2014-10-31 10:41:07 +00:00
|
|
|
<?php
|
|
|
|
/**
|
2015-10-06 07:52:19 +00:00
|
|
|
* @author Robin McCorkell <rmccorkell@karoshi.org.uk>
|
2015-03-26 10:44:34 +00:00
|
|
|
* @author Vincent Petry <pvince81@owncloud.com>
|
2014-10-31 10:41:07 +00:00
|
|
|
*
|
2015-03-26 10:44:34 +00:00
|
|
|
* @copyright Copyright (c) 2015, ownCloud, Inc.
|
|
|
|
* @license AGPL-3.0
|
|
|
|
*
|
|
|
|
* This code is free software: you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Affero General Public License, version 3,
|
|
|
|
* as published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU Affero General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Affero General Public License, version 3,
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
2014-10-31 10:41:07 +00:00
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
namespace OCA\Files_External\Controller;
|
|
|
|
|
|
|
|
|
|
|
|
use \OCP\IConfig;
|
|
|
|
use \OCP\IUserSession;
|
|
|
|
use \OCP\IRequest;
|
2015-03-16 13:39:48 +00:00
|
|
|
use \OCP\IL10N;
|
2014-10-31 10:41:07 +00:00
|
|
|
use \OCP\AppFramework\Http\DataResponse;
|
|
|
|
use \OCP\AppFramework\Controller;
|
|
|
|
use \OCP\AppFramework\Http;
|
|
|
|
use \OCA\Files_external\Service\StoragesService;
|
|
|
|
use \OCA\Files_external\NotFoundException;
|
|
|
|
use \OCA\Files_external\Lib\StorageConfig;
|
2015-08-11 17:45:07 +00:00
|
|
|
use \OCA\Files_External\Lib\Backend\Backend;
|
Authentication mechanisms for external storage backends
A backend can now specify generic authentication schemes that it
supports, instead of specifying the parameters for its authentication
method directly. This allows multiple authentication mechanisms to be
implemented for a single scheme, providing altered functionality.
This commit introduces the backend framework for this feature, and so at
this point the UI will be broken as the frontend does not specify the
required information.
Terminology:
- authentication scheme
Parameter interface for the authentication method. A backend
supporting the 'password' scheme accepts two parameters, 'user' and
'password'.
- authentication mechanism
Specific mechanism implementing a scheme. Basic mechanisms may
forward configuration options directly to the backend, more advanced
ones may lookup parameters or retrieve them from the session
New dropdown selector for external storage configurations to select the
authentication mechanism to be used.
Authentication mechanisms can have visibilities, just like backends.
The API was extended too to make it easier to add/remove visibilities.
In addition, the concept of 'allowed visibility' has been introduced, so
a backend/auth mechanism can force a maximum visibility level (e.g.
Local storage type) that cannot be overridden by configuration in the
web UI.
An authentication mechanism is a fully instantiated implementation. This
allows an implementation to have dependencies injected into it, e.g. an
\OCP\IDB for database operations.
When a StorageConfig is being prepared for mounting, the authentication
mechanism implementation has manipulateStorage() called,
which inserts the relevant authentication method options into the
storage ready for mounting.
2015-08-12 09:54:03 +00:00
|
|
|
use \OCA\Files_External\Lib\Auth\AuthMechanism;
|
2015-08-12 18:51:09 +00:00
|
|
|
use \OCP\Files\StorageNotAvailableException;
|
|
|
|
use \OCA\Files_External\Lib\InsufficientDataForMeaningfulAnswerException;
|
2015-08-28 15:15:21 +00:00
|
|
|
use \OCA\Files_External\Service\BackendService;
|
2014-10-31 10:41:07 +00:00
|
|
|
|
2015-03-17 10:42:52 +00:00
|
|
|
/**
|
|
|
|
* Base class for storages controllers
|
|
|
|
*/
|
2014-10-31 10:41:07 +00:00
|
|
|
abstract class StoragesController extends Controller {
|
|
|
|
|
|
|
|
/**
|
2015-03-17 10:42:52 +00:00
|
|
|
* L10N service
|
|
|
|
*
|
2015-03-16 13:39:48 +00:00
|
|
|
* @var IL10N
|
2014-10-31 10:41:07 +00:00
|
|
|
*/
|
|
|
|
protected $l10n;
|
|
|
|
|
|
|
|
/**
|
2015-03-17 10:42:52 +00:00
|
|
|
* Storages service
|
|
|
|
*
|
2014-10-31 10:41:07 +00:00
|
|
|
* @var StoragesService
|
|
|
|
*/
|
|
|
|
protected $service;
|
|
|
|
|
|
|
|
/**
|
2015-03-16 13:39:48 +00:00
|
|
|
* Creates a new storages controller.
|
|
|
|
*
|
|
|
|
* @param string $AppName application name
|
|
|
|
* @param IRequest $request request object
|
|
|
|
* @param IL10N $l10n l10n service
|
|
|
|
* @param StoragesService $storagesService storage service
|
2014-10-31 10:41:07 +00:00
|
|
|
*/
|
|
|
|
public function __construct(
|
|
|
|
$AppName,
|
|
|
|
IRequest $request,
|
2015-03-16 13:39:48 +00:00
|
|
|
IL10N $l10n,
|
2014-10-31 10:41:07 +00:00
|
|
|
StoragesService $storagesService
|
2015-03-17 10:42:52 +00:00
|
|
|
) {
|
2014-10-31 10:41:07 +00:00
|
|
|
parent::__construct($AppName, $request);
|
|
|
|
$this->l10n = $l10n;
|
|
|
|
$this->service = $storagesService;
|
|
|
|
}
|
|
|
|
|
2015-08-11 17:45:07 +00:00
|
|
|
/**
|
|
|
|
* Create a storage from its parameters
|
|
|
|
*
|
|
|
|
* @param string $mountPoint storage mount point
|
2015-08-12 19:03:11 +00:00
|
|
|
* @param string $backend backend identifier
|
|
|
|
* @param string $authMechanism authentication mechanism identifier
|
2015-08-11 17:45:07 +00:00
|
|
|
* @param array $backendOptions backend-specific options
|
|
|
|
* @param array|null $mountOptions mount-specific options
|
|
|
|
* @param array|null $applicableUsers users for which to mount the storage
|
|
|
|
* @param array|null $applicableGroups groups for which to mount the storage
|
|
|
|
* @param int|null $priority priority
|
|
|
|
*
|
|
|
|
* @return StorageConfig|DataResponse
|
|
|
|
*/
|
|
|
|
protected function createStorage(
|
|
|
|
$mountPoint,
|
2015-08-12 19:03:11 +00:00
|
|
|
$backend,
|
|
|
|
$authMechanism,
|
2015-08-11 17:45:07 +00:00
|
|
|
$backendOptions,
|
|
|
|
$mountOptions = null,
|
|
|
|
$applicableUsers = null,
|
|
|
|
$applicableGroups = null,
|
|
|
|
$priority = null
|
|
|
|
) {
|
|
|
|
try {
|
|
|
|
return $this->service->createStorage(
|
|
|
|
$mountPoint,
|
2015-08-12 19:03:11 +00:00
|
|
|
$backend,
|
|
|
|
$authMechanism,
|
2015-08-11 17:45:07 +00:00
|
|
|
$backendOptions,
|
|
|
|
$mountOptions,
|
|
|
|
$applicableUsers,
|
|
|
|
$applicableGroups,
|
|
|
|
$priority
|
|
|
|
);
|
|
|
|
} catch (\InvalidArgumentException $e) {
|
|
|
|
return new DataResponse(
|
|
|
|
[
|
Authentication mechanisms for external storage backends
A backend can now specify generic authentication schemes that it
supports, instead of specifying the parameters for its authentication
method directly. This allows multiple authentication mechanisms to be
implemented for a single scheme, providing altered functionality.
This commit introduces the backend framework for this feature, and so at
this point the UI will be broken as the frontend does not specify the
required information.
Terminology:
- authentication scheme
Parameter interface for the authentication method. A backend
supporting the 'password' scheme accepts two parameters, 'user' and
'password'.
- authentication mechanism
Specific mechanism implementing a scheme. Basic mechanisms may
forward configuration options directly to the backend, more advanced
ones may lookup parameters or retrieve them from the session
New dropdown selector for external storage configurations to select the
authentication mechanism to be used.
Authentication mechanisms can have visibilities, just like backends.
The API was extended too to make it easier to add/remove visibilities.
In addition, the concept of 'allowed visibility' has been introduced, so
a backend/auth mechanism can force a maximum visibility level (e.g.
Local storage type) that cannot be overridden by configuration in the
web UI.
An authentication mechanism is a fully instantiated implementation. This
allows an implementation to have dependencies injected into it, e.g. an
\OCP\IDB for database operations.
When a StorageConfig is being prepared for mounting, the authentication
mechanism implementation has manipulateStorage() called,
which inserts the relevant authentication method options into the
storage ready for mounting.
2015-08-12 09:54:03 +00:00
|
|
|
'message' => (string)$this->l10n->t('Invalid backend or authentication mechanism class')
|
2015-08-11 17:45:07 +00:00
|
|
|
],
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-10-31 10:41:07 +00:00
|
|
|
/**
|
|
|
|
* Validate storage config
|
|
|
|
*
|
|
|
|
* @param StorageConfig $storage storage config
|
|
|
|
*
|
|
|
|
* @return DataResponse|null returns response in case of validation error
|
|
|
|
*/
|
2015-09-17 09:24:19 +00:00
|
|
|
protected function validate(StorageConfig $storage) {
|
2014-10-31 10:41:07 +00:00
|
|
|
$mountPoint = $storage->getMountPoint();
|
|
|
|
if ($mountPoint === '' || $mountPoint === '/') {
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
|
|
|
'message' => (string)$this->l10n->t('Invalid mount point')
|
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2015-08-25 13:51:47 +00:00
|
|
|
if ($storage->getBackendOption('objectstore')) {
|
|
|
|
// objectstore must not be sent from client side
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
|
|
|
'message' => (string)$this->l10n->t('Objectstore forbidden')
|
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2015-08-11 17:45:07 +00:00
|
|
|
/** @var Backend */
|
|
|
|
$backend = $storage->getBackend();
|
Authentication mechanisms for external storage backends
A backend can now specify generic authentication schemes that it
supports, instead of specifying the parameters for its authentication
method directly. This allows multiple authentication mechanisms to be
implemented for a single scheme, providing altered functionality.
This commit introduces the backend framework for this feature, and so at
this point the UI will be broken as the frontend does not specify the
required information.
Terminology:
- authentication scheme
Parameter interface for the authentication method. A backend
supporting the 'password' scheme accepts two parameters, 'user' and
'password'.
- authentication mechanism
Specific mechanism implementing a scheme. Basic mechanisms may
forward configuration options directly to the backend, more advanced
ones may lookup parameters or retrieve them from the session
New dropdown selector for external storage configurations to select the
authentication mechanism to be used.
Authentication mechanisms can have visibilities, just like backends.
The API was extended too to make it easier to add/remove visibilities.
In addition, the concept of 'allowed visibility' has been introduced, so
a backend/auth mechanism can force a maximum visibility level (e.g.
Local storage type) that cannot be overridden by configuration in the
web UI.
An authentication mechanism is a fully instantiated implementation. This
allows an implementation to have dependencies injected into it, e.g. an
\OCP\IDB for database operations.
When a StorageConfig is being prepared for mounting, the authentication
mechanism implementation has manipulateStorage() called,
which inserts the relevant authentication method options into the
storage ready for mounting.
2015-08-12 09:54:03 +00:00
|
|
|
/** @var AuthMechanism */
|
|
|
|
$authMechanism = $storage->getAuthMechanism();
|
2015-09-23 14:35:17 +00:00
|
|
|
if ($backend->checkDependencies()) {
|
2014-10-31 10:41:07 +00:00
|
|
|
// invalid backend
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
2015-08-11 17:45:07 +00:00
|
|
|
'message' => (string)$this->l10n->t('Invalid storage backend "%s"', [
|
2015-08-28 15:15:21 +00:00
|
|
|
$backend->getIdentifier()
|
2015-08-11 17:45:07 +00:00
|
|
|
])
|
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
2015-08-28 15:15:21 +00:00
|
|
|
|
2015-09-23 14:35:17 +00:00
|
|
|
if (!$backend->isVisibleFor($this->service->getVisibilityType())) {
|
2015-08-28 15:15:21 +00:00
|
|
|
// not permitted to use backend
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
|
|
|
'message' => (string)$this->l10n->t('Not permitted to use backend "%s"', [
|
|
|
|
$backend->getIdentifier()
|
|
|
|
])
|
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
2015-09-23 14:35:17 +00:00
|
|
|
if (!$authMechanism->isVisibleFor($this->service->getVisibilityType())) {
|
2015-08-28 15:15:21 +00:00
|
|
|
// not permitted to use auth mechanism
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
|
|
|
'message' => (string)$this->l10n->t('Not permitted to use authentication mechanism "%s"', [
|
|
|
|
$authMechanism->getIdentifier()
|
|
|
|
])
|
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2015-08-11 17:45:07 +00:00
|
|
|
if (!$backend->validateStorage($storage)) {
|
|
|
|
// unsatisfied parameters
|
|
|
|
return new DataResponse(
|
|
|
|
array(
|
|
|
|
'message' => (string)$this->l10n->t('Unsatisfied backend parameters')
|
2014-10-31 10:41:07 +00:00
|
|
|
),
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
Authentication mechanisms for external storage backends
A backend can now specify generic authentication schemes that it
supports, instead of specifying the parameters for its authentication
method directly. This allows multiple authentication mechanisms to be
implemented for a single scheme, providing altered functionality.
This commit introduces the backend framework for this feature, and so at
this point the UI will be broken as the frontend does not specify the
required information.
Terminology:
- authentication scheme
Parameter interface for the authentication method. A backend
supporting the 'password' scheme accepts two parameters, 'user' and
'password'.
- authentication mechanism
Specific mechanism implementing a scheme. Basic mechanisms may
forward configuration options directly to the backend, more advanced
ones may lookup parameters or retrieve them from the session
New dropdown selector for external storage configurations to select the
authentication mechanism to be used.
Authentication mechanisms can have visibilities, just like backends.
The API was extended too to make it easier to add/remove visibilities.
In addition, the concept of 'allowed visibility' has been introduced, so
a backend/auth mechanism can force a maximum visibility level (e.g.
Local storage type) that cannot be overridden by configuration in the
web UI.
An authentication mechanism is a fully instantiated implementation. This
allows an implementation to have dependencies injected into it, e.g. an
\OCP\IDB for database operations.
When a StorageConfig is being prepared for mounting, the authentication
mechanism implementation has manipulateStorage() called,
which inserts the relevant authentication method options into the
storage ready for mounting.
2015-08-12 09:54:03 +00:00
|
|
|
if (!$authMechanism->validateStorage($storage)) {
|
|
|
|
// unsatisfied parameters
|
|
|
|
return new DataResponse(
|
|
|
|
[
|
|
|
|
'message' => (string)$this->l10n->t('Unsatisfied authentication mechanism parameters')
|
|
|
|
],
|
|
|
|
Http::STATUS_UNPROCESSABLE_ENTITY
|
|
|
|
);
|
|
|
|
}
|
2014-10-31 10:41:07 +00:00
|
|
|
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Check whether the given storage is available / valid.
|
|
|
|
*
|
|
|
|
* Note that this operation can be time consuming depending
|
|
|
|
* on whether the remote storage is available or not.
|
|
|
|
*
|
2015-03-17 10:42:52 +00:00
|
|
|
* @param StorageConfig $storage storage configuration
|
2014-10-31 10:41:07 +00:00
|
|
|
*/
|
|
|
|
protected function updateStorageStatus(StorageConfig &$storage) {
|
2015-08-12 18:51:09 +00:00
|
|
|
try {
|
|
|
|
/** @var AuthMechanism */
|
|
|
|
$authMechanism = $storage->getAuthMechanism();
|
|
|
|
$authMechanism->manipulateStorageConfig($storage);
|
|
|
|
/** @var Backend */
|
|
|
|
$backend = $storage->getBackend();
|
|
|
|
$backend->manipulateStorageConfig($storage);
|
|
|
|
|
|
|
|
// update status (can be time-consuming)
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::getBackendStatus(
|
|
|
|
$backend->getStorageClass(),
|
|
|
|
$storage->getBackendOptions(),
|
|
|
|
false
|
|
|
|
)
|
|
|
|
);
|
|
|
|
} catch (InsufficientDataForMeaningfulAnswerException $e) {
|
2015-09-16 15:58:26 +00:00
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_INDETERMINATE,
|
|
|
|
$this->l10n->t('Insufficient data: %s', [$e->getMessage()])
|
|
|
|
);
|
2015-08-12 18:51:09 +00:00
|
|
|
} catch (StorageNotAvailableException $e) {
|
2015-11-25 10:58:54 +00:00
|
|
|
switch ($e->getCode()) {
|
|
|
|
case 1:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_ERROR,
|
|
|
|
$this->l10n->t('%s', [$e->getMessage()])
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
case 3:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_INCOMPLETE_CONF,
|
|
|
|
$this->l10n->t('Incomplete configuration. %s', [$e->getMessage()])
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
case 4:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_UNAUTHORIZED,
|
|
|
|
$this->l10n->t('Unauthorized. %s', [$e->getMessage()])
|
|
|
|
$e->getMessage()
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
case 5:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_TIMEOUT,
|
|
|
|
$this->l10n->t('Timeout. %s', [$e->getMessage()])
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
case 6:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_NETWORK_ERROR,
|
|
|
|
$this->l10n->t('Network error. %s', [$e->getMessage()])
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_ERROR,
|
|
|
|
$this->l10n->t('%s', [$e->getMessage()])
|
|
|
|
);
|
|
|
|
}
|
2015-09-16 15:58:26 +00:00
|
|
|
} catch (\Exception $e) {
|
|
|
|
// FIXME: convert storage exceptions to StorageNotAvailableException
|
|
|
|
$storage->setStatus(
|
|
|
|
\OC_Mount_Config::STATUS_ERROR,
|
|
|
|
get_class($e).': '.$e->getMessage()
|
|
|
|
);
|
2015-08-12 18:51:09 +00:00
|
|
|
}
|
2014-10-31 10:41:07 +00:00
|
|
|
}
|
|
|
|
|
2015-09-13 22:23:42 +00:00
|
|
|
/**
|
|
|
|
* Get all storage entries
|
|
|
|
*
|
|
|
|
* @return DataResponse
|
|
|
|
*/
|
|
|
|
public function index() {
|
|
|
|
$storages = $this->service->getAllStorages();
|
|
|
|
|
|
|
|
return new DataResponse(
|
|
|
|
$storages,
|
|
|
|
Http::STATUS_OK
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2014-10-31 10:41:07 +00:00
|
|
|
/**
|
|
|
|
* Get an external storage entry.
|
|
|
|
*
|
|
|
|
* @param int $id storage id
|
|
|
|
*
|
|
|
|
* @return DataResponse
|
|
|
|
*/
|
|
|
|
public function show($id) {
|
|
|
|
try {
|
|
|
|
$storage = $this->service->getStorage($id);
|
|
|
|
|
|
|
|
$this->updateStorageStatus($storage);
|
|
|
|
} catch (NotFoundException $e) {
|
|
|
|
return new DataResponse(
|
|
|
|
[
|
|
|
|
'message' => (string)$this->l10n->t('Storage with id "%i" not found', array($id))
|
|
|
|
],
|
|
|
|
Http::STATUS_NOT_FOUND
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
return new DataResponse(
|
|
|
|
$storage,
|
|
|
|
Http::STATUS_OK
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Deletes the storage with the given id.
|
|
|
|
*
|
|
|
|
* @param int $id storage id
|
|
|
|
*
|
|
|
|
* @return DataResponse
|
|
|
|
*/
|
|
|
|
public function destroy($id) {
|
|
|
|
try {
|
|
|
|
$this->service->removeStorage($id);
|
|
|
|
} catch (NotFoundException $e) {
|
|
|
|
return new DataResponse(
|
|
|
|
[
|
|
|
|
'message' => (string)$this->l10n->t('Storage with id "%i" not found', array($id))
|
|
|
|
],
|
|
|
|
Http::STATUS_NOT_FOUND
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
return new DataResponse([], Http::STATUS_NO_CONTENT);
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|