From 8e8acf2d9087523ac8f8bf3aeac8daa0c17add91 Mon Sep 17 00:00:00 2001 From: Arthur Schiwon Date: Tue, 6 Sep 2022 22:34:54 +0200 Subject: [PATCH 1/4] LDAP to no register new users when outside of fair use or over limits Signed-off-by: Arthur Schiwon --- apps/user_ldap/ajax/clearMappings.php | 2 +- apps/user_ldap/lib/Group_Proxy.php | 35 ++++++++++-- apps/user_ldap/lib/Jobs/CleanUp.php | 2 +- apps/user_ldap/lib/Jobs/Sync.php | 2 +- apps/user_ldap/lib/Mapping/UserMapping.php | 20 +++++++ apps/user_ldap/lib/Proxy.php | 42 +++++--------- apps/user_ldap/lib/User_Proxy.php | 39 ++++++++++++- .../tests/Mapping/UserMappingTest.php | 3 +- lib/composer/composer/autoload_classmap.php | 2 + lib/composer/composer/autoload_static.php | 2 + lib/private/Server.php | 1 + .../Support/Subscription/Assertion.php | 55 +++++++++++++++++++ lib/private/User/Manager.php | 17 ++---- .../Support/Subscription/IAssertion.php | 44 +++++++++++++++ 14 files changed, 215 insertions(+), 51 deletions(-) create mode 100644 lib/private/Support/Subscription/Assertion.php create mode 100644 lib/public/Support/Subscription/IAssertion.php diff --git a/apps/user_ldap/ajax/clearMappings.php b/apps/user_ldap/ajax/clearMappings.php index 39462f334c979..f8469cc85b11c 100644 --- a/apps/user_ldap/ajax/clearMappings.php +++ b/apps/user_ldap/ajax/clearMappings.php @@ -35,7 +35,7 @@ $mapping = null; try { if ($subject === 'user') { - $mapping = new UserMapping(\OC::$server->getDatabaseConnection()); + $mapping = \OCP\Server::get(UserMapping::class); $result = $mapping->clearCb( function ($uid) { \OC::$server->getUserManager()->emit('\OC\User', 'preUnassignedUserId', [$uid]); diff --git a/apps/user_ldap/lib/Group_Proxy.php b/apps/user_ldap/lib/Group_Proxy.php index ea2fcce679c4a..f8bdae67b7207 100644 --- a/apps/user_ldap/lib/Group_Proxy.php +++ b/apps/user_ldap/lib/Group_Proxy.php @@ -34,18 +34,32 @@ class Group_Proxy extends Proxy implements \OCP\GroupInterface, IGroupLDAP, IGetDisplayNameBackend, INamedBackend, IDeleteGroupBackend { private $backends = []; - private $refBackend = null; + private ?Group_LDAP $refBackend = null; + private Helper $helper; + private GroupPluginManager $groupPluginManager; + private bool $isSetUp = false; public function __construct(Helper $helper, ILDAPWrapper $ldap, GroupPluginManager $groupPluginManager) { parent::__construct($ldap); - $serverConfigPrefixes = $helper->getServerConfigurationPrefixes(true); + $this->helper = $helper; + $this->groupPluginManager = $groupPluginManager; + } + + protected function setup(): void { + if ($this->isSetUp) { + return; + } + + $serverConfigPrefixes = $this->helper->getServerConfigurationPrefixes(true); foreach ($serverConfigPrefixes as $configPrefix) { $this->backends[$configPrefix] = - new \OCA\User_LDAP\Group_LDAP($this->getAccess($configPrefix), $groupPluginManager); + new Group_LDAP($this->getAccess($configPrefix), $this->groupPluginManager); if (is_null($this->refBackend)) { $this->refBackend = &$this->backends[$configPrefix]; } } + + $this->isSetUp = true; } /** @@ -57,6 +71,8 @@ public function __construct(Helper $helper, ILDAPWrapper $ldap, GroupPluginManag * @return mixed the result of the method or false */ protected function walkBackends($id, $method, $parameters) { + $this->setup(); + $gid = $id; $cacheKey = $this->getGroupCacheKey($gid); foreach ($this->backends as $configPrefix => $backend) { @@ -80,6 +96,8 @@ protected function walkBackends($id, $method, $parameters) { * @return mixed the result of the method or false */ protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) { + $this->setup(); + $gid = $id; $cacheKey = $this->getGroupCacheKey($gid); $prefix = $this->getFromCache($cacheKey); @@ -105,6 +123,7 @@ protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) { } protected function activeBackends(): int { + $this->setup(); return count($this->backends); } @@ -131,8 +150,9 @@ public function inGroup($uid, $gid) { * if the user exists at all. */ public function getUserGroups($uid) { - $groups = []; + $this->setup(); + $groups = []; foreach ($this->backends as $backend) { $backendGroups = $backend->getUserGroups($uid); if (is_array($backendGroups)) { @@ -149,8 +169,9 @@ public function getUserGroups($uid) { * @return string[] with user ids */ public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) { - $users = []; + $this->setup(); + $users = []; foreach ($this->backends as $backend) { $backendUsers = $backend->usersInGroup($gid, $search, $limit, $offset); if (is_array($backendUsers)) { @@ -237,8 +258,9 @@ public function getGroupDetails($gid) { * Returns a list with all groups */ public function getGroups($search = '', $limit = -1, $offset = 0) { - $groups = []; + $this->setup(); + $groups = []; foreach ($this->backends as $backend) { $backendGroups = $backend->getGroups($search, $limit, $offset); if (is_array($backendGroups)) { @@ -269,6 +291,7 @@ public function groupExists($gid) { * compared with \OCP\GroupInterface::CREATE_GROUP etc. */ public function implementsActions($actions) { + $this->setup(); //it's the same across all our user backends obviously return $this->refBackend->implementsActions($actions); } diff --git a/apps/user_ldap/lib/Jobs/CleanUp.php b/apps/user_ldap/lib/Jobs/CleanUp.php index 1fb423b5faf43..22067d81a9d82 100644 --- a/apps/user_ldap/lib/Jobs/CleanUp.php +++ b/apps/user_ldap/lib/Jobs/CleanUp.php @@ -107,7 +107,7 @@ public function setArguments($arguments): void { if (isset($arguments['mapping'])) { $this->mapping = $arguments['mapping']; } else { - $this->mapping = new UserMapping($this->db); + $this->mapping = \OCP\Server::get(UserMapping::class); } if (isset($arguments['deletedUsersIndex'])) { diff --git a/apps/user_ldap/lib/Jobs/Sync.php b/apps/user_ldap/lib/Jobs/Sync.php index d9171f4aab722..b231089b79b1f 100644 --- a/apps/user_ldap/lib/Jobs/Sync.php +++ b/apps/user_ldap/lib/Jobs/Sync.php @@ -357,7 +357,7 @@ public function setArgument($argument) { if (isset($argument['mapper'])) { $this->mapper = $argument['mapper']; } else { - $this->mapper = new UserMapping($this->dbc); + $this->mapper = \OCP\Server::get(UserMapping::class); } if (isset($argument['connectionFactory'])) { diff --git a/apps/user_ldap/lib/Mapping/UserMapping.php b/apps/user_ldap/lib/Mapping/UserMapping.php index 899cc015c9f7b..df39f00f58b66 100644 --- a/apps/user_ldap/lib/Mapping/UserMapping.php +++ b/apps/user_ldap/lib/Mapping/UserMapping.php @@ -22,12 +22,32 @@ */ namespace OCA\User_LDAP\Mapping; +use OCP\HintException; +use OCP\IDBConnection; +use OCP\Support\Subscription\IAssertion; + /** * Class UserMapping + * * @package OCA\User_LDAP\Mapping */ class UserMapping extends AbstractMapping { + private IAssertion $assertion; + + public function __construct(IDBConnection $dbc, IAssertion $assertion) { + $this->assertion = $assertion; + parent::__construct($dbc); + } + + /** + * @throws HintException + */ + public function map($fdn, $name, $uuid): bool { + $this->assertion->createUserIsLegit(); + return parent::map($fdn, $name, $uuid); + } + /** * returns the DB table name which holds the mappings * @return string diff --git a/apps/user_ldap/lib/Proxy.php b/apps/user_ldap/lib/Proxy.php index d9546a163ab89..4df6c2683a62c 100644 --- a/apps/user_ldap/lib/Proxy.php +++ b/apps/user_ldap/lib/Proxy.php @@ -35,7 +35,9 @@ use OCA\User_LDAP\Mapping\GroupMapping; use OCA\User_LDAP\Mapping\UserMapping; use OCA\User_LDAP\User\Manager; -use OCP\Share\IManager; +use OCP\IConfig; +use OCP\IUserManager; +use OCP\Server; use Psr\Log\LoggerInterface; abstract class Proxy { @@ -61,34 +63,18 @@ public function __construct(ILDAPWrapper $ldap) { /** * @param string $configPrefix */ - private function addAccess($configPrefix) { - static $ocConfig; - static $fs; - static $log; - static $avatarM; - static $userMap; - static $groupMap; - static $shareManager; - static $coreUserManager; - static $coreNotificationManager; - static $logger; - if ($fs === null) { - $ocConfig = \OC::$server->getConfig(); - $fs = new FilesystemHelper(); - $avatarM = \OC::$server->getAvatarManager(); - $db = \OC::$server->getDatabaseConnection(); - $userMap = new UserMapping($db); - $groupMap = new GroupMapping($db); - $coreUserManager = \OC::$server->getUserManager(); - $coreNotificationManager = \OC::$server->getNotificationManager(); - $shareManager = \OC::$server->get(IManager::class); - $logger = \OC::$server->get(LoggerInterface::class); - } - $userManager = - new Manager($ocConfig, $fs, $logger, $avatarM, new \OCP\Image(), - $coreUserManager, $coreNotificationManager, $shareManager); + private function addAccess(string $configPrefix): void { + $ocConfig = Server::get(IConfig::class); + $userMap = Server::get(UserMapping::class); + $groupMap = Server::get(GroupMapping::class); + $coreUserManager = Server::get(IUserManager::class); + $logger = Server::get(LoggerInterface::class); + $helper = Server::get(Helper::class); + + $userManager = Server::get(Manager::class); + $connector = new Connection($this->ldap, $configPrefix); - $access = new Access($connector, $this->ldap, $userManager, new Helper($ocConfig, \OC::$server->getDatabaseConnection()), $ocConfig, $coreUserManager, $logger); + $access = new Access($connector, $this->ldap, $userManager, $helper, $ocConfig, $coreUserManager, $logger); $access->setUserMapper($userMap); $access->setGroupMapper($groupMap); self::$accesses[$configPrefix] = $access; diff --git a/apps/user_ldap/lib/User_Proxy.php b/apps/user_ldap/lib/User_Proxy.php index 040d4f5aa6964..93420bbb470b4 100644 --- a/apps/user_ldap/lib/User_Proxy.php +++ b/apps/user_ldap/lib/User_Proxy.php @@ -42,6 +42,13 @@ class User_Proxy extends Proxy implements \OCP\IUserBackend, \OCP\UserInterface, /** @var User_LDAP */ private $refBackend = null; + private bool $isSetUp = false; + private Helper $helper; + private IConfig $ocConfig; + private INotificationManager $notificationManager; + private IUserSession $userSession; + private UserPluginManager $userPluginManager; + public function __construct( Helper $helper, ILDAPWrapper $ldap, @@ -51,15 +58,29 @@ public function __construct( UserPluginManager $userPluginManager ) { parent::__construct($ldap); - $serverConfigPrefixes = $helper->getServerConfigurationPrefixes(true); + $this->helper = $helper; + $this->ocConfig = $ocConfig; + $this->notificationManager = $notificationManager; + $this->userSession = $userSession; + $this->userPluginManager = $userPluginManager; + } + + protected function setup(): void { + if ($this->isSetUp) { + return; + } + + $serverConfigPrefixes = $this->helper->getServerConfigurationPrefixes(true); foreach ($serverConfigPrefixes as $configPrefix) { $this->backends[$configPrefix] = - new User_LDAP($this->getAccess($configPrefix), $ocConfig, $notificationManager, $userSession, $userPluginManager); + new User_LDAP($this->getAccess($configPrefix), $this->ocConfig, $this->notificationManager, $this->userSession, $this->userPluginManager); if (is_null($this->refBackend)) { $this->refBackend = &$this->backends[$configPrefix]; } } + + $this->isSetUp = true; } /** @@ -71,6 +92,8 @@ public function __construct( * @return mixed the result of the method or false */ protected function walkBackends($id, $method, $parameters) { + $this->setup(); + $uid = $id; $cacheKey = $this->getUserCacheKey($uid); foreach ($this->backends as $configPrefix => $backend) { @@ -99,6 +122,8 @@ protected function walkBackends($id, $method, $parameters) { * @return mixed the result of the method or false */ protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) { + $this->setup(); + $uid = $id; $cacheKey = $this->getUserCacheKey($uid); $prefix = $this->getFromCache($cacheKey); @@ -129,6 +154,7 @@ protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) { } protected function activeBackends(): int { + $this->setup(); return count($this->backends); } @@ -142,6 +168,7 @@ protected function activeBackends(): int { * compared with \OC\User\Backend::CREATE_USER etc. */ public function implementsActions($actions) { + $this->setup(); //it's the same across all our user backends obviously return $this->refBackend->implementsActions($actions); } @@ -152,6 +179,7 @@ public function implementsActions($actions) { * @return string the name of the backend to be shown */ public function getBackendName() { + $this->setup(); return $this->refBackend->getBackendName(); } @@ -164,6 +192,8 @@ public function getBackendName() { * @return string[] an array of all uids */ public function getUsers($search = '', $limit = 10, $offset = 0) { + $this->setup(); + //we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends $users = []; foreach ($this->backends as $backend) { @@ -296,6 +326,8 @@ public function canChangeAvatar($uid) { * @return array an array of all displayNames (value) and the corresponding uids (key) */ public function getDisplayNames($search = '', $limit = null, $offset = null) { + $this->setup(); + //we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends $users = []; foreach ($this->backends as $backend) { @@ -335,6 +367,7 @@ public function setPassword($uid, $password) { * @return bool */ public function hasUserListings() { + $this->setup(); return $this->refBackend->hasUserListings(); } @@ -344,6 +377,8 @@ public function hasUserListings() { * @return int|bool */ public function countUsers() { + $this->setup(); + $users = false; foreach ($this->backends as $backend) { $backendUsers = $backend->countUsers(); diff --git a/apps/user_ldap/tests/Mapping/UserMappingTest.php b/apps/user_ldap/tests/Mapping/UserMappingTest.php index 081266cf3f1ad..e585fafb13411 100644 --- a/apps/user_ldap/tests/Mapping/UserMappingTest.php +++ b/apps/user_ldap/tests/Mapping/UserMappingTest.php @@ -24,6 +24,7 @@ namespace OCA\User_LDAP\Tests\Mapping; use OCA\User_LDAP\Mapping\UserMapping; +use OCP\Support\Subscription\IAssertion; /** * Class UserMappingTest @@ -34,6 +35,6 @@ */ class UserMappingTest extends AbstractMappingTest { public function getMapper(\OCP\IDBConnection $dbMock) { - return new UserMapping($dbMock); + return new UserMapping($dbMock, $this->createMock(IAssertion::class)); } } diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php index 1b721a2cc33e9..9358af8ae45bc 100644 --- a/lib/composer/composer/autoload_classmap.php +++ b/lib/composer/composer/autoload_classmap.php @@ -566,6 +566,7 @@ 'OCP\\Support\\CrashReport\\IRegistry' => $baseDir . '/lib/public/Support/CrashReport/IRegistry.php', 'OCP\\Support\\CrashReport\\IReporter' => $baseDir . '/lib/public/Support/CrashReport/IReporter.php', 'OCP\\Support\\Subscription\\Exception\\AlreadyRegisteredException' => $baseDir . '/lib/public/Support/Subscription/Exception/AlreadyRegisteredException.php', + 'OCP\\Support\\Subscription\\IAssertion' => $baseDir . '/lib/public/Support/Subscription/IAssertion.php', 'OCP\\Support\\Subscription\\IRegistry' => $baseDir . '/lib/public/Support/Subscription/IRegistry.php', 'OCP\\Support\\Subscription\\ISubscription' => $baseDir . '/lib/public/Support/Subscription/ISubscription.php', 'OCP\\Support\\Subscription\\ISupportedApps' => $baseDir . '/lib/public/Support/Subscription/ISupportedApps.php', @@ -1552,6 +1553,7 @@ 'OC\\Streamer' => $baseDir . '/lib/private/Streamer.php', 'OC\\SubAdmin' => $baseDir . '/lib/private/SubAdmin.php', 'OC\\Support\\CrashReport\\Registry' => $baseDir . '/lib/private/Support/CrashReport/Registry.php', + 'OC\\Support\\Subscription\\Assertion' => $baseDir . '/lib/private/Support/Subscription/Assertion.php', 'OC\\Support\\Subscription\\Registry' => $baseDir . '/lib/private/Support/Subscription/Registry.php', 'OC\\SystemConfig' => $baseDir . '/lib/private/SystemConfig.php', 'OC\\SystemTag\\ManagerFactory' => $baseDir . '/lib/private/SystemTag/ManagerFactory.php', diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php index 4539f89f206d7..afa1e85ff9910 100644 --- a/lib/composer/composer/autoload_static.php +++ b/lib/composer/composer/autoload_static.php @@ -599,6 +599,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2 'OCP\\Support\\CrashReport\\IRegistry' => __DIR__ . '/../../..' . '/lib/public/Support/CrashReport/IRegistry.php', 'OCP\\Support\\CrashReport\\IReporter' => __DIR__ . '/../../..' . '/lib/public/Support/CrashReport/IReporter.php', 'OCP\\Support\\Subscription\\Exception\\AlreadyRegisteredException' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/Exception/AlreadyRegisteredException.php', + 'OCP\\Support\\Subscription\\IAssertion' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/IAssertion.php', 'OCP\\Support\\Subscription\\IRegistry' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/IRegistry.php', 'OCP\\Support\\Subscription\\ISubscription' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/ISubscription.php', 'OCP\\Support\\Subscription\\ISupportedApps' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/ISupportedApps.php', @@ -1585,6 +1586,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2 'OC\\Streamer' => __DIR__ . '/../../..' . '/lib/private/Streamer.php', 'OC\\SubAdmin' => __DIR__ . '/../../..' . '/lib/private/SubAdmin.php', 'OC\\Support\\CrashReport\\Registry' => __DIR__ . '/../../..' . '/lib/private/Support/CrashReport/Registry.php', + 'OC\\Support\\Subscription\\Assertion' => __DIR__ . '/../../..' . '/lib/private/Support/Subscription/Assertion.php', 'OC\\Support\\Subscription\\Registry' => __DIR__ . '/../../..' . '/lib/private/Support/Subscription/Registry.php', 'OC\\SystemConfig' => __DIR__ . '/../../..' . '/lib/private/SystemConfig.php', 'OC\\SystemTag\\ManagerFactory' => __DIR__ . '/../../..' . '/lib/private/SystemTag/ManagerFactory.php', diff --git a/lib/private/Server.php b/lib/private/Server.php index 33ac8262ceab7..d804cca208677 100644 --- a/lib/private/Server.php +++ b/lib/private/Server.php @@ -795,6 +795,7 @@ public function __construct($webRoot, \OC\Config $config) { $this->registerAlias(\OCP\Support\CrashReport\IRegistry::class, \OC\Support\CrashReport\Registry::class); $this->registerAlias(\OCP\Support\Subscription\IRegistry::class, \OC\Support\Subscription\Registry::class); + $this->registerAlias(\OCP\Support\Subscription\IAssertion::class, \OC\Support\Subscription\Assertion::class); $this->registerService(\OC\Log::class, function (Server $c) { $logType = $c->get(AllConfig::class)->getSystemValue('log_type', 'file'); diff --git a/lib/private/Support/Subscription/Assertion.php b/lib/private/Support/Subscription/Assertion.php new file mode 100644 index 0000000000000..9acd3f878c311 --- /dev/null +++ b/lib/private/Support/Subscription/Assertion.php @@ -0,0 +1,55 @@ + + * + * @author Arthur Schiwon + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OC\Support\Subscription; + +use OCP\HintException; +use OCP\L10N\IFactory; +use OCP\Notification\IManager; +use OCP\Support\Subscription\IAssertion; +use OCP\Support\Subscription\IRegistry; + +class Assertion implements IAssertion { + private IRegistry $registry; + private IFactory $l10nFactory; + private IManager $notificationManager; + + public function __construct(IRegistry $registry, IFactory $l10nFactory, IManager $notificationManager) { + $this->registry = $registry; + $this->l10nFactory = $l10nFactory; + $this->notificationManager = $notificationManager; + } + + /** + * @inheritDoc + */ + public function createUserIsLegit(): void { + if ($this->registry->delegateIsHardUserLimitReached($this->notificationManager)) { + $l = $this->l10nFactory->get('lib'); + throw new HintException($l->t('The user limit has been reached and the user was not created.')); + } + } +} diff --git a/lib/private/User/Manager.php b/lib/private/User/Manager.php index be5151313c4c8..dc31eece41410 100644 --- a/lib/private/User/Manager.php +++ b/lib/private/User/Manager.php @@ -44,8 +44,7 @@ use OCP\IUser; use OCP\IUserBackend; use OCP\IUserManager; -use OCP\Notification\IManager; -use OCP\Support\Subscription\IRegistry; +use OCP\Support\Subscription\IAssertion; use OCP\User\Backend\IGetRealUIDBackend; use OCP\User\Backend\ISearchKnownUsersBackend; use OCP\User\Backend\ICheckPasswordBackend; @@ -386,19 +385,15 @@ public function searchKnownUsersByDisplayName(string $searcher, string $pattern, /** * @param string $uid * @param string $password - * @throws \InvalidArgumentException * @return false|IUser the created user or false + * @throws \InvalidArgumentException + * @throws HintException */ public function createUser($uid, $password) { // DI injection is not used here as IRegistry needs the user manager itself for user count and thus it would create a cyclic dependency - /** @var IRegistry $registry */ - $registry = \OC::$server->get(IRegistry::class); - /** @var IManager $notificationManager */ - $notificationManager = \OC::$server->get(IManager::class); - if ($registry->delegateIsHardUserLimitReached($notificationManager)) { - $l = \OC::$server->getL10N('lib'); - throw new HintException($l->t('The user limit has been reached and the user was not created.')); - } + /** @var IAssertion $assertion */ + $assertion = \OC::$server->get(IAssertion::class); + $assertion->createUserIsLegit(); $localBackends = []; foreach ($this->backends as $backend) { diff --git a/lib/public/Support/Subscription/IAssertion.php b/lib/public/Support/Subscription/IAssertion.php new file mode 100644 index 0000000000000..1ef6a7b71879d --- /dev/null +++ b/lib/public/Support/Subscription/IAssertion.php @@ -0,0 +1,44 @@ + + * + * @author Arthur Schiwon + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCP\Support\Subscription; + +use OCP\HintException; + +/** + * @since 26.0.0 + */ +interface IAssertion { + /** + * This method throws a localized exception when user limits are exceeded, + * if applicable. Notifications are also created in that case. It is a + * shorthand for a check against IRegistry::delegateIsHardUserLimitReached(). + * + * @throws HintException + * @since 26.0.0 + */ + public function createUserIsLegit(): void; +} From 50d4963772f290463c8addb73f7c5f392050bbba Mon Sep 17 00:00:00 2001 From: Arthur Schiwon Date: Tue, 18 Oct 2022 23:26:16 +0200 Subject: [PATCH 2/4] [LDAP] throw exception only against prov api - unbreaks functionality for end users when on demand mapping takes place Signed-off-by: Arthur Schiwon --- apps/user_ldap/lib/Mapping/UserMapping.php | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/apps/user_ldap/lib/Mapping/UserMapping.php b/apps/user_ldap/lib/Mapping/UserMapping.php index df39f00f58b66..ade9c67213a5f 100644 --- a/apps/user_ldap/lib/Mapping/UserMapping.php +++ b/apps/user_ldap/lib/Mapping/UserMapping.php @@ -24,6 +24,8 @@ use OCP\HintException; use OCP\IDBConnection; +use OCP\IRequest; +use OCP\Server; use OCP\Support\Subscription\IAssertion; /** @@ -34,6 +36,7 @@ class UserMapping extends AbstractMapping { private IAssertion $assertion; + protected const PROV_API_REGEX = '/\/ocs\/v[1-9].php\/cloud\/(groups|users)/'; public function __construct(IDBConnection $dbc, IAssertion $assertion) { $this->assertion = $assertion; @@ -44,7 +47,23 @@ public function __construct(IDBConnection $dbc, IAssertion $assertion) { * @throws HintException */ public function map($fdn, $name, $uuid): bool { - $this->assertion->createUserIsLegit(); + try { + $this->assertion->createUserIsLegit(); + } catch (HintException $e) { + static $isProvisioningApi = null; + + if ($isProvisioningApi === null) { + $request = Server::get(IRequest::class); + $isProvisioningApi = \preg_match(self::PROV_API_REGEX, $request->getRequestUri()) === 1; + } + if ($isProvisioningApi) { + // only throw when prov API is being used, since functionality + // should not break for end users (e.g. when sharing). + // On direct API usage, e.g. on users page, this is desired. + throw $e; + } + return false; + } return parent::map($fdn, $name, $uuid); } From 7d3457ec7364bdf14386ebe797a197e5efd785da Mon Sep 17 00:00:00 2001 From: Arthur Schiwon Date: Tue, 18 Oct 2022 23:36:14 +0200 Subject: [PATCH 3/4] improve admin notification experience - do not stack notifications, replace them - and replace them once a day only - with LDAP it might end in total spam terror (also push) otherwise Signed-off-by: Arthur Schiwon --- lib/private/Support/Subscription/Registry.php | 35 ++++++++++++++----- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/private/Support/Subscription/Registry.php b/lib/private/Support/Subscription/Registry.php index ba3642d021c4d..87070e7a0dcb8 100644 --- a/lib/private/Support/Subscription/Registry.php +++ b/lib/private/Support/Subscription/Registry.php @@ -215,19 +215,38 @@ private function getUserCount(): int { return $userCount; } - private function notifyAboutReachedUserLimit(IManager $notificationManager) { + private function notifyAboutReachedUserLimit(IManager $notificationManager): void { $admins = $this->groupManager->get('admin')->getUsers(); - foreach ($admins as $admin) { - $notification = $notificationManager->createNotification(); - $notification->setApp('core') - ->setUser($admin->getUID()) - ->setDateTime(new \DateTime()) - ->setObject('user_limit_reached', '1') - ->setSubject('user_limit_reached'); + $notification = $notificationManager->createNotification(); + $notification->setApp('core') + ->setObject('user_limit_reached', '1') + ->setSubject('user_limit_reached'); + + if ($notificationManager->getCount($notification) > 0 + && !$this->reIssue() + ) { + return; + } + + $notificationManager->markProcessed($notification); + $notification->setDateTime(new \DateTime()); + + foreach ($admins as $admin) { + $notification->setUser($admin->getUID()); $notificationManager->notify($notification); } $this->logger->warning('The user limit was reached and the new user was not created', ['app' => 'lib']); } + + protected function reIssue(): bool { + $lastNotification = (int)$this->config->getAppValue('lib', 'last_subscription_reminder', '0'); + + if ((time() - $lastNotification) >= 86400) { + $this->config->setAppValue('lib', 'last_subscription_reminder', (string)time()); + return true; + } + return false; + } } From bff23762d14600efcdc9bec27169d531ec60f16c Mon Sep 17 00:00:00 2001 From: blizzz Date: Fri, 21 Oct 2022 13:46:44 +0200 Subject: [PATCH 4/4] extended hint message Co-authored-by: Simon L. Signed-off-by: blizzz --- lib/private/Support/Subscription/Assertion.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/private/Support/Subscription/Assertion.php b/lib/private/Support/Subscription/Assertion.php index 9acd3f878c311..9b77e87594431 100644 --- a/lib/private/Support/Subscription/Assertion.php +++ b/lib/private/Support/Subscription/Assertion.php @@ -49,7 +49,7 @@ public function __construct(IRegistry $registry, IFactory $l10nFactory, IManager public function createUserIsLegit(): void { if ($this->registry->delegateIsHardUserLimitReached($this->notificationManager)) { $l = $this->l10nFactory->get('lib'); - throw new HintException($l->t('The user limit has been reached and the user was not created.')); + throw new HintException($l->t('The user limit has been reached and the user was not created. Check your notifications to learn more.')); } } }