[full-ci] feat: ocisdev-533 graph #12108
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -64,4 +64,5 @@ go.work.sum | |
| .envrc | ||
| CLAUDE.md | ||
| .claude/ | ||
| GEMINI.md | ||
| .agents/ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| Enhancement: Add vault storage with MFA-protected access | ||
|
|
||
| Added a dedicated vault storage that can be protected with MFA. A separate | ||
| `storage-users-vault` service instance runs in vault mode and serves | ||
| `/vault/users` and `/vault/projects` mount points with a dedicated | ||
| `VaultStorageProviderID`. The `graph` service gained a new vault mode | ||
| (`GRAPH_ENABLE_VAULT_MODE`) that serves the vault API under the `/vault` | ||
| prefix. The storage registry now routes vault-specific requests exclusively to | ||
| the vault storage provider, preventing accidental access to vault spaces when | ||
| no explicit storage ID is provided. | ||
|
|
||
| MFA status is propagated through gRPC metadata | ||
| and forwarded in HTTP headers for WOPI/collaboration flows. | ||
|
|
||
| https://github.com/owncloud/ocis/pull/12108 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| services: | ||
| ocis: | ||
| environment: | ||
| OCIS_MFA_ENABLED: true | ||
| NATS_NATS_HOST: 0.0.0.0 | ||
| SETTINGS_GRPC_ADDR: ocis:9191 | ||
| PROXY_CREATE_VAULT_HOME: true | ||
| GRAPH_ENABLE_VAULT_MODE: true | ||
|
|
||
| storage-users-vault: | ||
| image: ${OCIS_DOCKER_IMAGE}:${OCIS_DOCKER_TAG} | ||
| networks: | ||
| ocis-net: | ||
| depends_on: | ||
| ocis: | ||
| condition: service_started | ||
| command: ["storage-users", "server"] | ||
| environment: | ||
| OCIS_LOG_LEVEL: debug | ||
| OCIS_GATEWAY_GRPC_ADDR: ocis:9142 | ||
| STORAGE_USERS_ENABLE_VAULT_MODE: true | ||
| STORAGE_USERS_SERVICE_NAME: storage-users-vault | ||
| STORAGE_USERS_GRPC_ADDR: storage-users-vault:9170 | ||
| STORAGE_USERS_HTTP_ADDR: storage-users-vault:9168 | ||
| STORAGE_USERS_DATA_SERVER_URL: http://storage-users-vault:9168/data | ||
| STORAGE_USERS_DEBUG_ADDR: storage-users-vault:9169 | ||
| STORAGE_USERS_OCIS_ROOT: /var/lib/ocis/storage/users-vault | ||
| STORAGE_USERS_EVENTS_CONSUMER_GROUP: vault-dcfs | ||
| MICRO_REGISTRY_ADDRESS: ocis:9233 | ||
| OCIS_EVENTS_ENDPOINT: ocis:9233 | ||
| OCIS_CACHE_STORE_NODES: ocis:9233 | ||
| volumes: | ||
| # configure the .env file to use own paths instead of docker internal volumes | ||
| - ${OCIS_CONFIG_DIR:-ocis-config}:/etc/ocis | ||
| - ${OCIS_DATA_DIR:-ocis-data}:/var/lib/ocis | ||
| logging: | ||
| driver: ${LOG_DRIVER:-local} | ||
| restart: always |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,6 +15,7 @@ import ( | |
| rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1" | ||
| providerv1beta1 "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" | ||
| types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1" | ||
| "github.com/owncloud/ocis/v2/ocis-pkg/mfa" | ||
| "github.com/owncloud/ocis/v2/ocis-pkg/tracing" | ||
| "github.com/owncloud/ocis/v2/services/collaboration/pkg/config" | ||
| "github.com/owncloud/ocis/v2/services/collaboration/pkg/middleware" | ||
|
|
@@ -71,6 +72,9 @@ func newHttpRequest(ctx context.Context, wopiContext middleware.WopiContext, met | |
| } else { | ||
| httpReq.Header.Add("X-Access-Token", wopiContext.AccessToken) | ||
| } | ||
| if wopiContext.HasMFA { | ||
| httpReq.Header.Add(mfa.MFAHeader, "true") | ||
|
Contributor
Author
There was a problem hiding this comment. @jvillafanez Please use |
||
| } | ||
| return httpReq, nil | ||
| } | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| package middleware | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "github.com/owncloud/ocis/v2/ocis-pkg/log" | ||
| "github.com/owncloud/ocis/v2/ocis-pkg/mfa" | ||
| ) | ||
|
|
||
| // RequireMFA middleware is used to require the user in context to have MFA satisfied | ||
| func RequireMFA(logger log.Logger) func(next http.Handler) http.Handler { | ||
|
2403905 marked this conversation as resolved.
|
||
| return func(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| if !mfa.Has(r.Context()) { | ||
| l := logger.SubloggerWithRequestID(r.Context()) | ||
| l.Error().Str("path", r.URL.Path).Msg("MFA required but not satisfied") | ||
| mfa.SetRequiredStatus(w) | ||
| return | ||
| } | ||
| next.ServeHTTP(w, r) | ||
| }) | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package middleware | ||
|
|
||
| import ( | ||
| "context" | ||
| "net/http" | ||
| ) | ||
|
|
||
| type key int | ||
|
|
||
| const vaultModeKey key = iota | ||
|
|
||
| // SetVaultMode sets the vault mode in the context. | ||
| func SetVaultMode(ctx context.Context, enabled bool) context.Context { | ||
| return context.WithValue(ctx, vaultModeKey, enabled) | ||
| } | ||
|
|
||
| // IsVaultMode checks if the vault mode is enabled in the context. | ||
| func IsVaultMode(ctx context.Context) bool { | ||
| val, ok := ctx.Value(vaultModeKey).(bool) | ||
| return val && ok | ||
| } | ||
|
|
||
| // VaultModeMiddleware is a middleware that sets the vault mode in the context. | ||
| func VaultModeMiddleware() func(next http.Handler) http.Handler { | ||
| return func(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| next.ServeHTTP(w, r.WithContext(SetVaultMode(r.Context(), true))) | ||
| }) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.