graph: implement driveItem creation under drives/items/children

Implements the CreateDriveItem/CreateChildDriveItem operations from
libre-graph-api#42 including @libre.graph.conflictBehavior and
@libre.graph.missingParentsBehavior.

Author: dschmidt

services/graph/mocks/drives_drive_item_provider.go

@@ -49,6 +49,7 @@ var (
 	errPathNotFound    = errors.New("path not found")
 	errInvalidRequest  = errors.New("invalid request")
 	errUnauthenticated = errors.New("unauthenticated")
+	errAccessDenied    = errors.New("access denied")
 )
 
 // ResolveGraphPath returns middleware that detects MS Graph colon-syntax path
@@ -91,7 +92,7 @@ func ResolveGraphPath(gws pool.Selectable[gateway.GatewayAPIClient], logger log.
 
 			driveID := chi.URLParam(r, "driveID")
 			original := r.URL.Path
-			rewritten, err := rewriteColonPath(r.Context(), gws, l, driveID, rctx.RoutePath)
+			rewritten, err := rewriteColonPath(r.Context(), gws, l, driveID, rctx.RoutePath, r)
 			switch {
 			case errors.Is(err, errPathNotFound):
 				l.Debug().Str("original", original).Msg("colon-path resolution: not found")
@@ -105,6 +106,10 @@ func ResolveGraphPath(gws pool.Selectable[gateway.GatewayAPIClient], logger log.
 				l.Debug().Str("original", original).Msg("colon-path resolution: unauthenticated")
 				errorcode.Unauthenticated.Render(w, r, http.StatusUnauthorized, "unauthenticated")
 				return
+			case errors.Is(err, errAccessDenied):
+				l.Debug().Str("original", original).Msg("colon-path resolution: access denied")
+				errorcode.AccessDenied.Render(w, r, http.StatusForbidden, "access denied")
+				return
 			case err != nil:
 				l.Error().Err(err).Str("original", original).Msg("colon-path resolution: internal error")
 				errorcode.GeneralException.Render(
@@ -154,19 +159,38 @@ type colonMatch struct {
 //   - ""        + other error        - operational / internal failure (5xx)
 //
 // driveIDParam is the {driveID} route param (raw chi.URLParam value); routePath
-// is chi.RouteContext().RoutePath (the part below /drives/{driveID}).
+// is chi.RouteContext().RoutePath (the part below /drives/{driveID}). r is only
+// consulted for the method and the @libre.graph.missingParentsBehavior query
+// parameter, which is meaningful for POST .../children requests only and
+// ignored otherwise.
 func rewriteColonPath(
 	ctx context.Context,
 	gws pool.Selectable[gateway.GatewayAPIClient],
 	logger zerolog.Logger,
 	driveIDParam string,
 	routePath string,
+	r *http.Request,
 ) (string, error) {
 	match, ok := parseColonPath(routePath)
 	if !ok {
 		return "", nil
 	}
 
+	// The colon path addresses the parent of the item a POST .../children
+	// creates. With missingParentsBehavior=create the missing folders along
+	// that path are created instead of returning 404.
+	createParents := false
+	if r.Method == http.MethodPost && match.suffix == "/children" {
+		switch r.URL.Query().Get("@libre.graph.missingParentsBehavior") {
+		case "", "fail":
+		case "create":
+			createParents = true
+		default:
+			logger.Debug().Msg("invalid @libre.graph.missingParentsBehavior in colon path")
+			return "", errInvalidRequest
+		}
+	}
+
 	// RoutePath follows chi's RawPath, i.e. the percent-encoded wire form
 	// (e.g. "/Documents/My%20File"). A single PathUnescape reproduces exactly
 	// what net/http put in r.URL.Path; it is NOT a double-decode (a crafted
@@ -218,7 +242,11 @@ func rewriteColonPath(
 		return "", errInvalidRequest
 	}
 
-	itemID, err := resolvePath(ctx, gws, &anchor, relPath)
+	resolve := resolvePath
+	if createParents {
+		resolve = resolveOrCreatePath
+	}
+	itemID, err := resolve(ctx, gws, &anchor, relPath)
 	if err != nil {
 		return "", err
 	}
@@ -320,6 +348,79 @@ func resolvePath(
 		return "", fmt.Errorf("gateway selector: %w", err)
 	}
 
+	return statPath(ctx, gw, anchor, relPath)
+}
+
+// resolveOrCreatePath is resolvePath for POST .../children requests with
+// @libre.graph.missingParentsBehavior=create: it walks relPath segment by
+// segment and creates the missing folders along the way.
+func resolveOrCreatePath(
+	ctx context.Context,
+	gws pool.Selectable[gateway.GatewayAPIClient],
+	anchor *storageprovider.ResourceId,
+	relPath string,
+) (string, error) {
+	gw, err := gws.Next()
+	if err != nil {
+		return "", fmt.Errorf("gateway selector: %w", err)
+	}
+
+	var id, walked string
+	for _, segment := range strings.Split(strings.Trim(relPath, "/"), "/") {
+		walked += "/" + segment
+		id, err = statPath(ctx, gw, anchor, walked)
+		if err == nil {
+			continue
+		}
+		if !errors.Is(err, errPathNotFound) {
+			return "", err
+		}
+
+		res, err := gw.CreateContainer(ctx, &storageprovider.CreateContainerRequest{
+			Ref: &storageprovider.Reference{
+				ResourceId: anchor,
+				Path:       utils.MakeRelativePath(walked),
+			},
+		})
+		if err != nil {
+			return "", fmt.Errorf("CS3 CreateContainer: %w", err)
+		}
+		switch res.GetStatus().GetCode() {
+		case cs3rpc.Code_CODE_OK:
+			// fall through
+		case cs3rpc.Code_CODE_ALREADY_EXISTS:
+			// lost a creation race, the folder is there
+		case cs3rpc.Code_CODE_NOT_FOUND:
+			return "", errPathNotFound
+		case cs3rpc.Code_CODE_PERMISSION_DENIED:
+			return "", errAccessDenied
+		case cs3rpc.Code_CODE_UNAUTHENTICATED:
+			return "", errUnauthenticated
+		default:
+			return "", fmt.Errorf(
+				"CS3 CreateContainer returned %s: %s",
+				res.GetStatus().GetCode(),
+				res.GetStatus().GetMessage(),
+			)
+		}
+
+		id, err = statPath(ctx, gw, anchor, walked)
+		if err != nil {
+			return "", err
+		}
+	}
+	return id, nil
+}
+
+// statPath stats a relative filesystem path (anchored at the given CS3
+// resource id) and returns the item's id, running with the request user's
+// permissions.
+func statPath(
+	ctx context.Context,
+	gw gateway.GatewayAPIClient,
+	anchor *storageprovider.ResourceId,
+	relPath string,
+) (string, error) {
 	// relPath is already decoded (PathUnescape'd once by the caller), matching
 	// the form a normal handler would receive from r.URL.Path.
 	statRes, err := gw.Stat(ctx, &storageprovider.StatRequest{

services/graph/pkg/middleware/path_lookup.go

@@ -1,6 +1,7 @@
 package middleware_test
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -115,6 +116,7 @@ func newGraphTestRouter(t *testing.T, gw *cs3mocks.GatewayAPIClient) (http.Handl
 			r.Use(middleware.ResolveGraphPath(selector, log.NopLogger()))
 			r.Route("/items/{itemID}", func(r chi.Router) {
 				r.Get("/", leaf("item"))
+				r.Post("/children", leaf("createChild"))
 				r.Post("/createLink", leaf("createLink"))
 				r.Route("/permissions", func(r chi.Router) {
 					r.Get("/", leaf("permissions"))
@@ -469,3 +471,94 @@ func TestResolveGraphPath_OriginalPathContext(t *testing.T) {
 	assert.Equal(t, original, cap.original, "original URL must be available via OriginalPathContextKey")
 	assert.Equal(t, original, cap.urlPath, "r.URL.Path must remain the original request path")
 }
+
+// TestResolveGraphPath_MissingParentsBehavior covers the
+// @libre.graph.missingParentsBehavior query parameter on POST .../children
+// colon-syntax requests.
+func TestResolveGraphPath_MissingParentsBehavior(t *testing.T) {
+	childrenURL := "/graph/v1beta1/drives/" + testDriveID + "/root:/a/b:/children"
+
+	t.Run("create creates the missing folders along the path", func(t *testing.T) {
+		gw := cs3mocks.NewGatewayAPIClient(t)
+		created := false
+		gw.EXPECT().Stat(mock.Anything, mock.Anything, mock.Anything).RunAndReturn(
+			func(_ context.Context, req *storageprovider.StatRequest, _ ...grpc.CallOption) (*storageprovider.StatResponse, error) {
+				switch path := req.GetRef().GetPath(); path {
+				case "./a":
+					return statResponse(cs3rpc.Code_CODE_OK, true), nil
+				case "./a/b":
+					if created {
+						return statResponse(cs3rpc.Code_CODE_OK, true), nil
+					}
+					return statResponse(cs3rpc.Code_CODE_NOT_FOUND, false), nil
+				default:
+					t.Errorf("unexpected stat path %q", path)
+					return statResponse(cs3rpc.Code_CODE_NOT_FOUND, false), nil
+				}
+			})
+		gw.EXPECT().CreateContainer(mock.Anything, mock.Anything, mock.Anything).RunAndReturn(
+			func(_ context.Context, req *storageprovider.CreateContainerRequest, _ ...grpc.CallOption) (*storageprovider.CreateContainerResponse, error) {
+				assert.Equal(t, "./a/b", req.GetRef().GetPath())
+				created = true
+				return &storageprovider.CreateContainerResponse{Status: &cs3rpc.Status{Code: cs3rpc.Code_CODE_OK}}, nil
+			}).Once()
+
+		router, cap := newGraphTestRouter(t, gw)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, httptest.NewRequest(
+			http.MethodPost, childrenURL+"?%40libre.graph.missingParentsBehavior=create", nil,
+		))
+
+		assert.Equal(t, http.StatusOK, rr.Code)
+		assert.Equal(t, "createChild", cap.hit)
+		assert.Equal(t, testItemID, cap.itemID)
+	})
+
+	t.Run("default fail returns 404 for a missing path without creating anything", func(t *testing.T) {
+		gw := cs3mocks.NewGatewayAPIClient(t)
+		gw.EXPECT().Stat(mock.Anything, mock.Anything, mock.Anything).
+			Return(statResponse(cs3rpc.Code_CODE_NOT_FOUND, false), nil).
+			Once()
+
+		router, cap := newGraphTestRouter(t, gw)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, httptest.NewRequest(http.MethodPost, childrenURL, nil))
+
+		assert.Equal(t, http.StatusNotFound, rr.Code)
+		assert.Equal(t, "", cap.hit)
+	})
+
+	t.Run("invalid value returns 400", func(t *testing.T) {
+		gw := cs3mocks.NewGatewayAPIClient(t)
+
+		router, cap := newGraphTestRouter(t, gw)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, httptest.NewRequest(
+			http.MethodPost, childrenURL+"?%40libre.graph.missingParentsBehavior=maybe", nil,
+		))
+
+		assert.Equal(t, http.StatusBadRequest, rr.Code)
+		assert.Equal(t, "", cap.hit)
+	})
+
+	t.Run("denied folder creation returns 403", func(t *testing.T) {
+		gw := cs3mocks.NewGatewayAPIClient(t)
+		gw.EXPECT().Stat(mock.Anything, mock.Anything, mock.Anything).
+			Return(statResponse(cs3rpc.Code_CODE_NOT_FOUND, false), nil).
+			Once()
+		gw.EXPECT().CreateContainer(mock.Anything, mock.Anything, mock.Anything).
+			Return(&storageprovider.CreateContainerResponse{
+				Status: &cs3rpc.Status{Code: cs3rpc.Code_CODE_PERMISSION_DENIED},
+			}, nil).
+			Once()
+
+		router, cap := newGraphTestRouter(t, gw)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, httptest.NewRequest(
+			http.MethodPost, childrenURL+"?%40libre.graph.missingParentsBehavior=create", nil,
+		))
+
+		assert.Equal(t, http.StatusForbidden, rr.Code)
+		assert.Equal(t, "", cap.hit)
+	})
+}