Groupware by pbleser-oc · Pull Request #1994 · opencloud-eu/opencloud

@pbleser-oc self-assigned this

Dec 9, 2025

butonic

butonic

butonic

butonic

butonic

butonic

butonic

butonic

butonic

butonic

…enLDAP container as a directory for user authentication

@pbleser-oc

@pbleser-oc

@pbleser-oc

…es.go to avoid dependency recursion
…switching to using our own tool instead
…and Stalwart

 * re-implement the auth-api service to authenticate Reva tokens
   following the OIDC Userinfo endpoint specification

 * pass the context where necessary and add an authenticator interface
   to the JMAP HTTP driver, in order to select between master
   authentication (which is used when GROUPWARE_JMAP_MASTER_USERNAME and
   GROUPWARE_JMAP_MASTER_PASSWORD are both set) and OIDC token
   forwarding through bearer auth

 * add Stalwart directory configuration "idmoidc" which uses the
   OpenCloud auth-api service API (/auth/) to validate the token it
   received as bearer auth from the Groupware backend's JMAP client,
   using it as an OIDC Userinfo endpoint

 * implement optional additional shared secret to secure the Userinfo
   service, as an additional path parameter

@pbleser-oc

@pbleser-oc

@pbleser-oc

@pbleser-oc

@pbleser-oc

@pbleser-oc

@pbleser-oc

 - fix a bunch of minor issues and typos that were found using GoLand
   and gosec

 - add a gosec Makefile target for Groupware related files, in
   services/groupware/Makefile

 - enable checking JMAP session capabilities for events and contacts,
   and only enable skipping that check for tasks until those are
   implemented in Stalwart as well

 - fix a CWE-190 (integer overflow or wraparound) found by gosec

 - consistently use struct references for methods of Groupware and
   Request, instead of mixing up references and copies

 - always log errors when unable to register a Prometheus metric

@pbleser-oc

@pbleser-oc

@pbleser-oc

…g (must use updated instead of name)

@pbleser-oc

@pbleser-oc

@pbleser-oc

 * implement ContactCard retrieval endpoint for syncing

 * re-implement that endpoint for Email too

 * fix the Mailbox changes endpoint to actually return changes about
   Mailboxes, and not about Emails

 * when querying the diff of Mailboxes without any prior state, return
   an error since the result is not what one would expect

 * introduce the 'changes' API tag and group

 * refactor the successful response functions to consistently return an
   object type and object state whenever possible

 * move the syncing endpoints under /accounts/*/changes/ for better
   clarity, e.g. /changes/emails instead of /emails/mailbox/*/changes

@pbleser-oc

@pbleser-oc

… use of JMAP API templates

@pbleser-oc

@pbleser-oc

@pbleser-oc

@pbleser-oc

 * add Groupware APIs for creating and deleting addressbooks

 * add Groupware APIs for creating and deleting calendars

 * add JMAP APIs for creating and deleting addressbooks, calendars

 * add JMAP APIs to retrieve Principals

 * fix API tagging

 * move addressbook JMAP APIs into its own file

 * move addressbook Groupware APIs into its own file