Wrap-up changes for updated subfolders

appinfo/routes.php

@@ -26,22 +26,31 @@
 
 return [
 	'ocs' => [
+		# v1
 		['name' => 'Key#setPrivateKey', 'url' => '/api/v1/private-key', 'verb' => 'POST'],
 		['name' => 'Key#getPrivateKey', 'url' => '/api/v1/private-key', 'verb' => 'GET'],
 		['name' => 'Key#deletePrivateKey', 'url' => '/api/v1/private-key', 'verb' => 'DELETE'],
 		['name' => 'Key#createPublicKey', 'url' => '/api/v1/public-key', 'verb' => 'POST'],
 		['name' => 'Key#getPublicKeys', 'url' => '/api/v1/public-key', 'verb' => 'GET'],
 		['name' => 'Key#deletePublicKey', 'url' => '/api/v1/public-key', 'verb' => 'DELETE'],
 		['name' => 'Key#getPublicServerKey', 'url' => '/api/v1/server-key', 'verb' => 'GET'],
-		['name' => 'MetaData#setMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'POST'],
-		['name' => 'MetaData#getMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'GET'],
-		['name' => 'MetaData#updateMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'PUT'],
-		['name' => 'MetaData#deleteMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'DELETE'],
-		['name' => 'MetaData#addMetadataFileDrop', 'url' => '/api/v1/meta-data/{id}/filedrop', 'verb' => 'PUT'],
+		['name' => 'V1\MetaData#setMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'POST'],
+		['name' => 'V1\MetaData#getMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'GET'],
+		['name' => 'V1\MetaData#updateMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'PUT'],
+		['name' => 'V1\MetaData#deleteMetaData', 'url' => '/api/v1/meta-data/{id}', 'verb' => 'DELETE'],
+		['name' => 'V1\MetaData#addMetadataFileDrop', 'url' => '/api/v1/meta-data/{id}/filedrop', 'verb' => 'PUT'],
 		['name' => 'Encryption#removeEncryptedFolders', 'url' => '/api/v1/encrypted-files', 'verb' => 'DELETE'],
 		['name' => 'Encryption#setEncryptionFlag', 'url' => '/api/v1/encrypted/{id}', 'verb' => 'PUT'],
 		['name' => 'Encryption#removeEncryptionFlag', 'url' => '/api/v1/encrypted/{id}', 'verb' => 'DELETE'],
-		['name' => 'Locking#lockFolder', 'url' => '/api/v1/lock/{id}', 'verb' => 'POST'],
-		['name' => 'Locking#unlockFolder', 'url' => '/api/v1/lock/{id}', 'verb' => 'DELETE'],
+		['name' => 'V1\Locking#lockFolder', 'url' => '/api/v1/lock/{id}', 'verb' => 'POST'],
+		['name' => 'V1\Locking#unlockFolder', 'url' => '/api/v1/lock/{id}', 'verb' => 'DELETE'],
+		# v2
+		['name' => 'MetaData#setMetaData', 'url' => '/api/v2/meta-data/{id}', 'verb' => 'POST'],
+		['name' => 'MetaData#getMetaData', 'url' => '/api/v2/meta-data/{id}', 'verb' => 'GET'],
+		['name' => 'MetaData#updateMetaData', 'url' => '/api/v2/meta-data/{id}', 'verb' => 'PUT'],
+		['name' => 'MetaData#deleteMetaData', 'url' => '/api/v2/meta-data/{id}', 'verb' => 'DELETE'],
+		['name' => 'MetaData#addMetadataFileDrop', 'url' => '/api/v2/meta-data/{id}/filedrop', 'verb' => 'PUT'],
+		['name' => 'Locking#lockFolder', 'url' => '/api/v2/lock/{id}', 'verb' => 'POST'],
+		['name' => 'Locking#unlockFolder', 'url' => '/api/v2/lock/{id}', 'verb' => 'DELETE'],
 	],
 ];

doc/api.md

@@ -2,22 +2,23 @@
 
 This are the available OCS API calls for clients to implement end-to-end encryption.
 A more general documentation how to use the API can be found [here](https://github.com/nextcloud/end_to_end_encryption/blob/master/doc/api-usage.md).
-* [List files and folders with encryption status](#list-files-and-folders-with-encryption-status)
-* [Store private key](#store-private-key)
-* [Get private key](#get-private-key)
-* [Delete private key](#delete-private-key)
-* [Sign public key](#sign-public-key)
-* [Get public keys](#get-public-keys)
-* [Delete public keys](#delete-public-keys)
-* [Lock file](#lock-file)
-* [Unlock file](#unlock-file)
-* [Store-meta-data file](#store-meta-data-file)
-* [Get meta-data file](#get-meta-data-file)
-* [Update meta-data file](#update-meta-data-file)
-* [Delete meta-data file](#delete-meta-data-file)
-* [Get server public key](#get-server-public-key)
-* [Set encryption flag for a folder](#set-encryption-flag-for-a-folder)
-* [Remove encryption flag for a folder](#remove-encryption-flag-for-a-folder)
+- [End-to-End Encryption API](#end-to-end-encryption-api)
+- [Base URL for all API calls](#base-url-for-all-api-calls)
+  - [List files and folders with encryption status](#list-files-and-folders-with-encryption-status)
+  - [Store private key](#store-private-key)
+  - [Get private key](#get-private-key)
+  - [Delete private key](#delete-private-key)
+  - [Sign public key](#sign-public-key)
+  - [Get public keys](#get-public-keys)
+  - [Delete public keys](#delete-public-keys)
+  - [Lock file](#lock-file)
+  - [Get meta-data file](#get-meta-data-file)
+  - [Update meta-data file](#update-meta-data-file)
+  - [Update filedrop property of meta-data file](#update-filedrop-property-of-meta-data-file)
+  - [Delete meta-data file](#delete-meta-data-file)
+  - [Get server public key](#get-server-public-key)
+  - [Set encryption flag for a folder](#set-encryption-flag-for-a-folder)
+  - [Remove encryption flag for a folder](#remove-encryption-flag-for-a-folder)
 
 
 
@@ -31,7 +32,7 @@ PROPFIND: `https://<nextcloud>/remote.php/webdav/<folder>/`
 
 **Data:**
 
-xml body: 
+xml body:
 ````xml
 <d:propfind xmlns:d="DAV:">
     <d:prop xmlns:nc="http://nextcloud.org/ns">
@@ -343,11 +344,22 @@ e2e-token: if you re-try a previously failed upload, use the token from the firs
 
 First try:
 
-`curl -X POST https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/<file-id> -H "OCS-APIRequest:true"`
+````shell
+curl https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/10 \
+    -X POST \
+    -H "OCS-APIRequest:true" \
+    -H "X-NC-E2EE-COUNTER:<incremented-counter-from-the-metadata>
+```
 
 Retry:
 
 `curl -X POST https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/<file-id> -H "OCS-APIRequest:true"` -d e2e-token="<e2e-token-from-previous-try>"
+curl https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/10 \
+    -X POST \
+    -H "OCS-APIRequest:true" \
+    -d "e2e-token:<e2e-token-from-previous-try> \
+    -H "X-NC-E2EE-COUNTER:<incremented-counter-from-the-metadata>
+```
 
 ## Unlock file
 
@@ -376,12 +388,25 @@ DELETE: `<base-url>/lock/<file-id>`
 </ocs>
 ````
 
-
 **Example curl call:**
 
-First try:
+Unlock:
+
+````shell
+curl https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/10 \
+    -X DELETE \
+    -H "OCS-APIRequest:true" \
+    -H "e2e-token:<e2e-token-received-during-lock-operation>
+```
 
-`curl -X DELETE https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/10 -H "OCS-APIRequest:true" -H "e2e-token:<e2e-token-received-during-lock-operation>`
+Unlock and drop pending changes:
+
+````shell
+curl https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/lock/10?abort=true \
+    -X DELETE \
+    -H "OCS-APIRequest:true" \
+    -H "e2e-token:<e2e-token-received-during-lock-operation>
+```
 
 ## Store meta-data file
 
@@ -419,7 +444,13 @@ metaData: content of the encrypted meta-data file
 
 **Example curl call:**
 
-`curl -X POST https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id> -H "OCS-APIRequest:true"` -d metaData="<encrypted-meta-data>"
+```bash
+curl "https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id>" \
+    -X POST \
+    -H "OCS-APIRequest:true" \
+    -H "e2e-token:<e2e-token-received-during-lock-operation>" \
+    -d metaData="<encrypted-meta-data>"
+```
 
 ## Get meta-data file
 
@@ -466,8 +497,8 @@ e2e-token: token to authenticate that you are the client who currently manipulat
 
 200 ok: meta data successfully updated
 
-404 not found: if the meta-data file doesn't exist or if the user can't access 
-the file with the given file-id 
+404 not found: if the meta-data file doesn't exist or if the user can't access
+the file with the given file-id
 
 403 forbidden: if the file was not locked or the client sends the wrong e2e-token
 
@@ -491,7 +522,14 @@ the file with the given file-id
 
 **Example curl call:**
 
-`curl -X PUT https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id> -H "OCS-APIRequest:true"` -d "metaData=<encrypted-meta-data>&e2e-token=<e2e-token-received-during-lock-operation>"
+```bash
+curl "https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id>" \
+    -X PUT \
+    -H "OCS-APIRequest:true" \
+    -H "e2e-token:<e2e-token-received-during-lock-operation>" \
+    -H "X-NC-E2EE-SIGNATURE:<metadata-signature>" \
+    -d metaData="<encrypted-meta-data>"
+```
 
 ## Update filedrop property of meta-data file
 
@@ -506,8 +544,8 @@ e2e-token: token to authenticate that you are the client who currently manipulat
 
 200 ok: filedrop successfully updated
 
-404 not found: if the meta-data file doesn't exist or if the user can't access 
-the file with the given file-id 
+404 not found: if the meta-data file doesn't exist or if the user can't access
+the file with the given file-id
 
 403 forbidden: if the file was not locked or the client sends the wrong e2e-token
 
@@ -564,12 +602,16 @@ DELETE: `<base-url>/meta-data/<file-id>`
 
 **Example curl call:**
 
-`curl -X DELETE https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id> -H "OCS-APIRequest:true"`
-
+```bash
+curl "https://<user>:<password>@<nextcloud>/ocs/v2.php/apps/end_to_end_encryption/api/v1/meta-data/<file-id>" \
+    -X DELETE \
+    -H "OCS-APIRequest:true" \
+    -H "e2e-token:<e2e-token-received-during-lock-operation>"
+```
 
 ## Get server public key
 
-This is the key, used to sign the users public keys. By retrieving the server's 
+This is the key, used to sign the users public keys. By retrieving the server's
 public key the clients can check the signature of the users public keys.
 
 GET: `<base-url>/server-key`

lib/AppInfo/Application.php

@@ -31,9 +31,11 @@
 use OCA\EndToEndEncryption\EncryptionManager;
 use OCA\EndToEndEncryption\IKeyStorage;
 use OCA\EndToEndEncryption\IMetaDataStorage;
+use OCA\EndToEndEncryption\IMetaDataStorageV1;
 use OCA\EndToEndEncryption\KeyStorage;
 use OCA\EndToEndEncryption\Listener\UserDeletedListener;
 use OCA\EndToEndEncryption\MetaDataStorage;
+use OCA\EndToEndEncryption\MetaDataStorageV1;
 use OCA\EndToEndEncryption\Middleware\CanUseAppMiddleware;
 use OCA\EndToEndEncryption\Middleware\UserAgentCheckMiddleware;
 use OCA\Files_Trashbin\Events\MoveToTrashEvent;
@@ -67,6 +69,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerMiddleware(UserAgentCheckMiddleware::class);
 		$context->registerMiddleware(CanUseAppMiddleware::class);
 		$context->registerServiceAlias(IKeyStorage::class, KeyStorage::class);
+		$context->registerServiceAlias(IMetaDataStorageV1::class, MetaDataStorageV1::class);
 		$context->registerServiceAlias(IMetaDataStorage::class, MetaDataStorage::class);
 		$context->registerEventListener(UserDeletedEvent::class, UserDeletedListener::class);
 		$context->registerPublicShareTemplateProvider(E2EEPublicShareTemplateProvider::class);

lib/Capabilities.php

@@ -51,7 +51,7 @@ public function getCapabilities(): array {
 		$capabilities = ['end-to-end-encryption' =>
 			[
 				'enabled' => true,
-				'api-version' => '1.2',
+				'api-version' => '2.0',
 				'keys-exist' => $keysExist,
 			]
 		];

lib/Connector/Sabre/LockPlugin.php

@@ -108,7 +108,10 @@ public function checkLock(RequestInterface $request): void {
 				}
 
 				// Prevent moving or copying stuff from non-encrypted to encrypted folders
-				if ($this->isE2EEnabledPath($node) xor $this->isE2EEnabledPath($destNode)) {
+				// if original operation is not a DELETE
+				if ($this->isE2EEnabledPath($node) !== $this->isE2EEnabledPath($destNode)
+					&& $request->getHeader('X-Nc-Sabre-Original-Method') !== 'DELETE'
+				) {
 					throw new Forbidden('Cannot copy or move files from non-encrypted folders to end to end encrypted folders or vice versa.');
 				}
 			}

lib/Connector/Sabre/RedirectRequestPlugin.php

@@ -141,7 +141,6 @@ public function httpDelete(RequestInterface $request, ResponseInterface $respons
 
 	/**
 	 * @param RequestInterface $request
-	 * @return bool
 	 */
 	public function httpMkColPut(RequestInterface $request): void {
 		$node = $this->getNode($request->getPath(), $request->getMethod());

lib/Controller/LockingController.php

@@ -32,7 +32,6 @@
 use OC\User\NoUserException;
 use OCA\EndToEndEncryption\Exceptions\FileLockedException;
 use OCA\EndToEndEncryption\Exceptions\FileNotLockedException;
-use OCA\EndToEndEncryption\Exceptions\MissingMetaDataException;
 use OCA\EndToEndEncryption\FileService;
 use OCA\EndToEndEncryption\IMetaDataStorage;
 use OCA\EndToEndEncryption\LockManager;
@@ -47,6 +46,8 @@
 use OCP\IRequest;
 use OCP\Share\IManager as ShareManager;
 use Psr\Log\LoggerInterface;
+use OCP\AppFramework\OCS\OCSPreconditionFailedException;
+use OCP\AppFramework\OCS\OCSBadRequestException;
 
 class LockingController extends OCSController {
 	private ?string $userId;
@@ -95,6 +96,11 @@ public function __construct(
 	 */
 	public function lockFolder(int $id, ?string $shareToken = null): DataResponse {
 		$e2eToken = $this->request->getParam('e2e-token', '');
+		$e2eCounter = (int)$this->request->getHeader('X-NC-E2EE-COUNTER');
+
+		if ($e2eCounter === 0) {
+			throw new OCSPreconditionFailedException($this->l10n->t('X-NC-E2EE-COUNTER'));
+		}
 
 		$ownerId = $this->getOwnerId($shareToken);
 
@@ -115,7 +121,7 @@ public function lockFolder(int $id, ?string $shareToken = null): DataResponse {
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to create the lock'));
 		}
 
-		$newToken = $this->lockManager->lockFile($id, $e2eToken, $ownerId);
+		$newToken = $this->lockManager->lockFile($id, $e2eToken, $e2eCounter, $ownerId);
 		if ($newToken === null) {
 			throw new OCSForbiddenException($this->l10n->t('File already locked'));
 		}
@@ -137,8 +143,13 @@ public function lockFolder(int $id, ?string $shareToken = null): DataResponse {
 	 * @throws OCSNotFoundException
 	 */
 	public function unlockFolder(int $id, ?string $shareToken = null): DataResponse {
+		$abort = $this->request->getParam('abort') === 'true';
 		$token = $this->request->getHeader('e2e-token');
 
+		if ($token === '') {
+			throw new OCSPreconditionFailedException($this->l10n->t('e2e-token is empty'));
+		}
+
 		$ownerId = $this->getOwnerId($shareToken);
 
 		try {
@@ -152,16 +163,19 @@ public function unlockFolder(int $id, ?string $shareToken = null): DataResponse
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to remove the lock'));
 		}
 
-		$hadChanges = $this->fileService->finalizeChanges($nodes[0]);
-
-		try {
-			$this->metaDataStorage->saveIntermediateFile($ownerId, $id);
-		} catch (MissingMetaDataException $ex) {
-			if ($hadChanges) {
-				throw $ex;
+		$touchFoldersIds = $this->metaDataStorage->getTouchedFolders($token);
+		foreach ($touchFoldersIds as $folderId) {
+			if ($abort) {
+				$this->fileService->revertChanges($userFolder->getById($folderId)[0]);
+				$this->metaDataStorage->deleteIntermediateFile($ownerId, $folderId);
+			} else {
+				$this->fileService->finalizeChanges($userFolder->getById($folderId)[0]);
+				$this->metaDataStorage->saveIntermediateFile($ownerId, $folderId);
 			}
 		}
 
+		$this->metaDataStorage->clearTouchedFolders($token);
+
 		try {
 			$this->lockManager->unlockFile($id, $token);
 		} catch (FileLockedException $e) {