chore(release): sync main back into development

lib/Controller/PublicationsController.php

@@ -40,6 +40,8 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http\Attribute\AnonRateLimit;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\DataDownloadResponse;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\AppFramework\Http\Response;
@@ -391,11 +393,10 @@ private function objectMatchesCatalogScope(object $object, array $allowedRegiste
 	 *
 	 * @return Response The CORS response
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
-	 *
 	 * @spec openspec/specs/cross-origin-api-access/spec.md#requirement-answer-cors-preflight-requests-on-public-api-controllers-cor-001
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 240, period: 60)]
 	public function preflightedCors(): Response {
 		// Determine the origin via the same allowlist-aware resolver used elsewhere
@@ -420,15 +421,14 @@ public function preflightedCors(): Response {
 	 *
 	 * @return JSONResponse JSON response containing publications, pagination info, and optionally facets
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
-	 *
 	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
 	 * @SuppressWarnings(PHPMD.NPathComplexity)
 	 * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
 	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 120, period: 60)]
 	public function index(string $catalogSlug): JSONResponse {
 		try {
@@ -552,15 +552,14 @@ public function index(string $catalogSlug): JSONResponse {
 	 * @return JSONResponse JSON response containing the requested publication
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
-	 *
 	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
 	 * @SuppressWarnings(PHPMD.NPathComplexity)
 	 * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
 	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 120, period: 60)]
 	public function show(string $catalogSlug, string $id): JSONResponse {
 		try {
@@ -840,11 +839,10 @@ public function show(string $catalogSlug, string $id): JSONResponse {
 	 * @return JSONResponse JSON response containing the requested attachments/files.
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
-	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 120, period: 60)]
 	public function attachments(string $catalogSlug, string $id): JSONResponse {
 
@@ -927,11 +925,10 @@ public function attachments(string $catalogSlug, string $id): JSONResponse {
 	 * @return DataDownloadResponse|JSONResponse JSON response containing the requested attachments/files.
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
-	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 60, period: 60)]
 	public function download(string $catalogSlug, string $id): DataDownloadResponse|JSONResponse {
 		try {
@@ -1023,12 +1020,12 @@ public function download(string $catalogSlug, string $id): DataDownloadResponse|
 	 * @return JSONResponse A JSON response containing the related objects
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
 	 * @SuppressWarnings(PHPMD.UnusedFormalParameter) catalogSlug required by route pattern.
 	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 120, period: 60)]
 	public function uses(string $catalogSlug, string $id): JSONResponse {
 		try {
@@ -1041,7 +1038,7 @@ public function uses(string $catalogSlug, string $id): JSONResponse {
 			//
 			// Failing to place the object inside the catalog is a refusal, not a reason to
 			// continue unscoped (#857): find() below with no register and no schema falls
-			// back to OpenRegister's every-magic-table path, and this route is @PublicPage.
+			// back to OpenRegister's every-magic-table path, and this route is #[PublicPage].
 			// A catalog with no configured scope has no namespace to serve from, which is
 			// the same C-1 policy attachments() and download() have carried since wave-7.
 			$catalog = $this->catalogiService->getCatalogBySlug($catalogSlug);
@@ -1128,12 +1125,12 @@ public function uses(string $catalogSlug, string $id): JSONResponse {
 	 * @return JSONResponse A JSON response containing the referenced objects
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoCSRFRequired
-	 * @PublicPage
 	 * @SuppressWarnings(PHPMD.UnusedFormalParameter) catalogSlug required by route pattern.
 	 *
 	 * @spec openspec/specs/publications/spec.md
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 120, period: 60)]
 	public function used(string $catalogSlug, string $id): JSONResponse {
 		try {
@@ -1146,7 +1143,7 @@ public function used(string $catalogSlug, string $id): JSONResponse {
 			//
 			// Failing to place the object inside the catalog is a refusal, not a reason to
 			// continue unscoped (#857): find() below with no register and no schema falls
-			// back to OpenRegister's every-magic-table path, and this route is @PublicPage.
+			// back to OpenRegister's every-magic-table path, and this route is #[PublicPage].
 			// A catalog with no configured scope has no namespace to serve from, which is
 			// the same C-1 policy attachments() and download() have carried since wave-7.
 			$catalog = $this->catalogiService->getCatalogBySlug($catalogSlug);

lib/Controller/SearchController.php

@@ -30,6 +30,9 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\AnonRateLimit;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\DataDownloadResponse;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IL10N;
@@ -54,7 +57,7 @@
  *
  * The remaining methods on this controller are internal/admin-use only
  * (testing + administrative introspection); they retain their original
- * `@NoAdminRequired` posture and do not participate in the public surface.
+ * `#[NoAdminRequired]` posture and do not participate in the public surface.
  *
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
@@ -129,12 +132,11 @@ private function getObjectService(): object {
 	 *
 	 * @return JSONResponse JSON response containing the mixed publication/document result envelope.
 	 *
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/changes/add-public-fulltext-search/tasks.md#task-3
 	 * @spec openspec/changes/add-document-content-search/tasks.md#task-3
 	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
 	#[AnonRateLimit(limit: 60, period: 60)]
 	public function index(): JSONResponse {
 		try {
@@ -188,11 +190,10 @@ public function index(): JSONResponse {
 	 *
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/specs/federation/spec.md#requirement-retrieve-a-single-publication-by-id-from-local-or-federated-sources-fed-002
 	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
 	public function show(string $id): JSONResponse {
 		if ($this->userSession->getUser() === null) {
 			return new JSONResponse(data: ['message' => $this->l10n->t('Not logged in')], statusCode: Http::STATUS_UNAUTHORIZED);
@@ -212,11 +213,10 @@ public function show(string $id): JSONResponse {
 	 *
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/specs/federation/spec.md#requirement-retrieve-publication-attachments-from-local-or-federated-sources-fed-005
 	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
 	public function attachments(string $id): JSONResponse {
 		if ($this->userSession->getUser() === null) {
 			return new JSONResponse(data: ['message' => $this->l10n->t('Not logged in')], statusCode: Http::STATUS_UNAUTHORIZED);
@@ -236,11 +236,10 @@ public function attachments(string $id): JSONResponse {
 	 *
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/specs/federation/spec.md#requirement-download-publication-files-from-local-or-federated-sources-fed-006
 	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
 	public function download(string $id): DataDownloadResponse|JSONResponse {
 		if ($this->userSession->getUser() === null) {
 			return new JSONResponse(data: ['message' => $this->l10n->t('Not logged in')], statusCode: Http::STATUS_UNAUTHORIZED);
@@ -261,11 +260,10 @@ public function download(string $id): DataDownloadResponse|JSONResponse {
 	 *
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/specs/federation/spec.md#requirement-retrieve-outgoing-relations-uses-with-federation-support-fed-003
 	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
 	public function uses(string $id): JSONResponse {
 		if ($this->userSession->getUser() === null) {
 			return new JSONResponse(data: ['message' => $this->l10n->t('Not logged in')], statusCode: Http::STATUS_UNAUTHORIZED);
@@ -286,11 +284,10 @@ public function uses(string $id): JSONResponse {
 	 *
 	 * @throws ContainerExceptionInterface|NotFoundExceptionInterface
 	 *
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
-	 *
 	 * @spec openspec/specs/federation/spec.md#requirement-retrieve-incoming-relations-used-by-with-federation-support-fed-004
 	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
 	public function used(string $id): JSONResponse {
 		if ($this->userSession->getUser() === null) {
 			return new JSONResponse(data: ['message' => $this->l10n->t('Not logged in')], statusCode: Http::STATUS_UNAUTHORIZED);