feat(federatedfilesharing): When a remote requests a share with a token, it may be an access token

Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Author: enriquepablo

apps/cloud_federation_api/lib/Controller/RequestHandlerController.php

@@ -15,6 +15,7 @@
 use NCU\Security\Signature\Exceptions\SignatureNotFoundException;
 use NCU\Security\Signature\IIncomingSignedRequest;
 use NCU\Security\Signature\ISignatureManager;
+use OC\Authentication\Token\PublicKeyTokenProvider;
 use OC\OCM\OCMSignatoryManager;
 use OCA\CloudFederationAPI\Config;
 use OCA\CloudFederationAPI\Db\FederatedInviteMapper;
@@ -44,6 +45,7 @@
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\IUserManager;
+use OCP\Server;
 use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Util;
 use Psr\Log\LoggerInterface;
@@ -522,6 +524,12 @@ private function confirmNotificationIdentity(
 			$provider = $this->cloudFederationProviderManager->getCloudFederationProvider($resourceType);
 			if ($provider instanceof ISignedCloudFederationProvider) {
 				$identity = $provider->getFederationIdFromSharedSecret($sharedSecret, $notification);
+				if ($identity === "") {
+					$tokenProvider = Server::get(PublicKeyTokenProvider::class);
+					$accessTokenDb = $tokenProvider->getToken($sharedSecret);
+					$refreshToken = $accessTokenDb->getUID();
+					$identity = $provider->getFederationIdFromSharedSecret($refreshToken, $notification);
+				}
 			} else {
 				$this->logger->debug('cloud federation provider {provider} does not implements ISignedCloudFederationProvider', ['provider' => $provider::class]);
 				return;

apps/federatedfilesharing/lib/FederatedShareProvider.php

@@ -751,6 +751,20 @@ public function getShareByToken(string $token): IShare {
 
 		$data = $cursor->fetchAssociative();
 
+		if ($data === false) {
+
+			$provider = Server::get(PublicKeyTokenProvider::class);
+			$accessTokenDb = $provider->getToken($token);
+			$refreshToken = $accessTokenDb->getUID();
+
+			$cursor = $qb->select('*')
+				->from('share')
+				->where($qb->expr()->in('share_type', $qb->createNamedParameter($this->supportedShareType, IQueryBuilder::PARAM_INT_ARRAY)))
+				->andWhere($qb->expr()->eq('token', $qb->createNamedParameter($refreshToken)))
+				->executeQuery();
+
+			$data = $cursor->fetch();
+		}
 		if ($data === false) {
 			throw new ShareNotFound('Share not found', $this->l->t('Could not find share'));
 		}

lib/private/Share20/Manager.php

@@ -7,6 +7,8 @@
  */
 namespace OC\Share20;
 
+use OC\Authentication\Token\IToken;
+use OC\Authentication\Token\PublicKeyTokenProvider;
 use OC\Core\AppInfo\ConfigLexicon;
 use OC\Files\Mount\MoveableMount;
 use OC\KnownUser\KnownUserService;
@@ -38,6 +40,7 @@
 use OCP\Security\IHasher;
 use OCP\Security\ISecureRandom;
 use OCP\Security\PasswordContext;
+use OCP\Server;
 use OCP\Share;
 use OCP\Share\Events\BeforeShareDeletedEvent;
 use OCP\Share\Events\ShareAcceptedEvent;
@@ -1343,6 +1346,20 @@ public function getShareByToken(string $token): IShare {
 			}
 		}
 
+		// Try to fetch a federated share by access token
+		if ($share === null) {
+			try {
+				$provider = $this->factory->getProviderForType(IShare::TYPE_REMOTE);
+				$tokenProvider = Server::get(PublicKeyTokenProvider::class);
+				$accessTokenDb = $tokenProvider->getToken($token);
+				$refreshToken = $accessTokenDb->getUID();
+				$share = $provider->getShareByToken($refreshToken);
+			} catch (ProviderException $e) {
+			} catch (ShareNotFound $e) {
+			}
+		}
+
+
 		// If it is not a link share try to fetch a mail share by token
 		if ($share === null && $this->shareProviderExists(IShare::TYPE_EMAIL)) {
 			try {

lib/private/User/Session.php

@@ -609,14 +609,35 @@ private function loginWithToken($token) {
 			// Ignore and use empty string instead
 		}
 
-		$this->manager->emit('\OC\User', 'preLogin', [$dbToken->getLoginName(), $password]);
-
 		$user = $this->manager->get($uid);
 		if (is_null($user)) {
+			// Maybe this is an access token. We keep the refresh tokens as UID of access tokens
+			try {
+				$token = $uid;
+				$dbToken = $this->tokenProvider->getToken($token);
+			} catch (InvalidTokenException $ex) {
+				return false;
+			}
+			$uid = $dbToken->getUID();
+
+			// When logging in with token, the password must be decrypted first before passing to login hook
+			$password = '';
+			try {
+				$password = $this->tokenProvider->getPassword($dbToken, $token);
+			} catch (PasswordlessTokenException $ex) {
+				// Ignore and use empty string instead
+			}
 			// user does not exist
-			return false;
+			$user = $this->manager->get($uid);
+			if (is_null($user)) {
+				return false;
+			}
 		}
 
+		$this->manager->emit('\OC\User', 'preLogin', [$dbToken->getLoginName(), $password]);
+
+		// See line 173 in this module, needed for completeLogin
+		OC_User::setIncognitoMode(false);
 		return $this->completeLogin(
 			$user,
 			[