feat(files_sharing): When requesting a remote share with bearer auth, get an access token to use as bearer token

Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Author: enriquepablo

apps/files_sharing/lib/External/Storage.php

@@ -66,10 +66,16 @@ public function __construct($options) {
 			$ocmProvider = $discoveryService->discover($this->cloudId->getRemote());
 			$webDavEndpoint = $ocmProvider->extractProtocolEntry('file', 'webdav');
 			$remote = $ocmProvider->getEndPoint();
+			$authType = \Sabre\DAV\Client::AUTH_BASIC;
+			$capabilities = $ocmProvider->getCapabilities();
+			if (in_array('exchange-token', $capabilities)) {
+				$authType = \OC\Files\Storage\BearerAuthAwareSabreClient::AUTH_BEARER;
+			}
 		} catch (OCMProviderException|OCMArgumentException $e) {
 			$this->logger->notice('exception while retrieving webdav endpoint', ['exception' => $e]);
 			$webDavEndpoint = '/public.php/webdav';
 			$remote = $this->cloudId->getRemote();
+			$authType = \Sabre\DAV\Client::AUTH_BASIC;
 		}
 
 		$host = parse_url($remote, PHP_URL_HOST);
@@ -92,8 +98,9 @@ public function __construct($options) {
 				'host' => $host,
 				'root' => $webDavEndpoint,
 				'user' => $options['token'],
-				'authType' => \Sabre\DAV\Client::AUTH_BASIC,
-				'password' => (string)$options['password']
+				'authType' => $authType,
+				'password' => (string)$options['password'],
+				'discoveryService' => $discoveryService,
 			]
 		);
 	}

lib/private/Files/Storage/DAV.php

@@ -10,8 +10,10 @@
 use Exception;
 use Icewind\Streams\CallbackWrapper;
 use Icewind\Streams\IteratorDirectory;
+use NCU\Security\Signature\ISignatureManager;
 use OC\Files\Filesystem;
 use OC\MemCache\ArrayCache;
+use OC\OCM\OCMSignatoryManager;
 use OCP\AppFramework\Http;
 use OCP\Constants;
 use OCP\Diagnostics\IEventLogger;
@@ -22,8 +24,12 @@
 use OCP\Files\StorageNotAvailableException;
 use OCP\Http\Client\IClient;
 use OCP\Http\Client\IClientService;
+use OCP\IAppConfig;
 use OCP\ICertificateManager;
 use OCP\IConfig;
+use OCP\OCM\Exceptions\OCMArgumentException;
+use OCP\OCM\Exceptions\OCMProviderException;
+use OCP\OCM\IOCMDiscoveryService;
 use OCP\Server;
 use OCP\Util;
 use Psr\Http\Message\ResponseInterface;
@@ -34,7 +40,7 @@
 use Sabre\HTTP\ClientHttpException;
 use Sabre\HTTP\RequestInterface;
 
-/*
+/**
  * Class BearerAuthAwareSabreClient
  *
  * This is an extension of the Sabre HTTP Client
@@ -104,6 +110,10 @@ class DAV extends Common {
 	protected LoggerInterface $logger;
 	protected IEventLogger $eventLogger;
 	protected IMimeTypeDetector $mimeTypeDetector;
+	protected IOCMDiscoveryService $discoveryService;
+	protected ISignatureManager $signatureManager;
+	protected OCMSignatoryManager $signatoryManager;
+	protected IAppConfig $appConfig;
 
 	/** @var int */
 	private $timeout;
@@ -126,6 +136,11 @@ class DAV extends Common {
 	public function __construct(array $parameters) {
 		$this->statCache = new ArrayCache();
 		$this->httpClientService = Server::get(IClientService::class);
+		if (isset($parameters['discoveryService'])) {
+			$this->discoveryService = $parameters['discoveryService'];
+		} else {
+			$this->discoveryService = Server::get(IOCMDiscoveryService::class);
+		}
 		if (isset($parameters['host']) && isset($parameters['user']) && isset($parameters['password'])) {
 			$host = $parameters['host'];
 			//remove leading http[s], will be generated in createBaseUri()
@@ -164,6 +179,9 @@ public function __construct(array $parameters) {
 		// This timeout value will be used for the download and upload of files
 		$this->timeout = Server::get(IConfig::class)->getSystemValueInt('davstorage.request_timeout', IClient::DEFAULT_REQUEST_TIMEOUT);
 		$this->mimeTypeDetector = \OC::$server->getMimeTypeDetector();
+		$this->signatureManager = Server::get(ISignatureManager::class);
+		$this->signatoryManager = Server::get(OCMSignatoryManager::class);
+		$this->appConfig = Server::get(IAppConfig::class);
 	}
 
 	protected function init(): void {
@@ -172,9 +190,82 @@ protected function init(): void {
 		}
 		$this->ready = true;
 
+		// If using Bearer auth, exchange refresh token for access token
+		$userName = $this->user;
+		if ($this->authType !== null && ($this->authType & BearerAuthAwareSabreClient::AUTH_BEARER)) {
+			try {
+				$host = 'https://' . $this->host;
+				$ocmProvider = $this->discoveryService->discover($host);
+				$tokenEndpoint = $ocmProvider->getTokenEndPoint();
+
+				if ($tokenEndPoint === '') {
+					$this->logger->error('OCM provider response missing tokenEndPoint', ['app' => 'dav']);
+					throw new StorageNotAvailableException('Could not discover token endpoint');
+				}
+
+				$client = $this->httpClientService->newClient();
+				$payload = [
+					'grant_type' => 'authorization_code',
+					'client_id' => 'receiver.example.org',
+					'code' => $this->user,
+				];
+
+				$options = [
+					'body' => json_encode($payload),
+					'headers' => [
+						'Content-Type' => 'application/json',
+					],
+					'timeout' => 10,
+					'connect_timeout' => 10,
+				];
+
+				// Try signing the request
+				if (!$this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true)) {
+					try {
+						$options = $this->signatureManager->signOutgoingRequestIClientPayload(
+							$this->signatoryManager,
+							$options,
+							'post',
+							$tokenEndpoint
+						);
+						$this->logger->debug('Token request signed successfully', ['app' => 'dav']);
+					} catch (\Exception $e) {
+						$this->logger->warning('Failed to sign token request, continuing without signature', [
+							'app' => 'dav',
+							'exception' => $e,
+							'endpoint' => $tokenEndpoint,
+						]);
+					}
+				}
+
+				$response = $client->post($tokenEndpoint, $options);
+
+				$body = $response->getBody();
+				$data = json_decode($body, true);
+
+				if (isset($data['access_token'])) {
+					$userName = $data['access_token'];
+					$this->user = $userName;
+					$this->logger->debug('Successfully exchanged refresh token for access token', ['app' => 'dav']);
+				} else {
+					$this->logger->error('Failed to get access token from response', ['app' => 'dav']);
+					throw new StorageNotAvailableException('Could not obtain access token');
+				}
+			} catch (OCMProviderException|OCMArgumentException $e) {
+				$this->logger->error('OCM provider response missing tokenEndPoint', ['app' => 'dav']);
+				throw new StorageNotAvailableException('Could not discover token endpoint');
+			} catch (\Exception $e) {
+				$this->logger->error('Error exchanging refresh token for access token: ' . $e->getMessage(), [
+					'app' => 'dav',
+					'exception' => $e,
+				]);
+				throw new StorageNotAvailableException('Could not obtain access token: ' . $e->getMessage());
+			}
+		}
+
 		$settings = [
 			'baseUri' => $this->createBaseUri(),
-			'userName' => $this->user,
+			'userName' => $userName,
 			'password' => $this->password,
 		];
 		if ($this->authType !== null) {
@@ -186,7 +277,7 @@ protected function init(): void {
 			$settings['proxy'] = $proxy;
 		}
 
-		$this->client = new Client($settings);
+		$this->client = new BearerAuthAwareSabreClient($settings);
 		$this->client->setThrowExceptions(true);
 
 		if ($this->secure === true) {
@@ -362,10 +453,14 @@ public function fopen(string $path, string $mode) {
 			case 'r':
 			case 'rb':
 				try {
+					$auth = [$this->user, $this->password];
+					if ($this->authType === BearerAuthAwareSabreClient::AUTH_BEARER) {
+						$auth = [$this->user, '', 'bearer'];
+					}
 					$response = $this->httpClientService
 						->newClient()
 						->get($this->createBaseUri() . $this->encodePath($path), [
-							'auth' => [$this->user, $this->password],
+							'auth' => $auth,
 							'stream' => true,
 							// set download timeout for users with slow connections or large files
 							'timeout' => $this->timeout
@@ -512,11 +607,15 @@ protected function uploadFile(string $path, string $target): void {
 		$this->statCache->remove($target);
 		$source = fopen($path, 'r');
 
+		$auth = [$this->user, $this->password];
+		if ($this->authType === BearerAuthAwareSabreClient::AUTH_BEARER) {
+			$auth = [$this->user, '', 'bearer'];
+		}
 		$this->httpClientService
 			->newClient()
 			->put($this->createBaseUri() . $this->encodePath($target), [
 				'body' => $source,
-				'auth' => [$this->user, $this->password],
+				'auth' => $auth,
 				// set upload timeout for users with slow connections or large files
 				'timeout' => $this->timeout
 			]);