nextcloud / server

apps/provisioning_api/tests/Controller/AppsControllerTest.php

Indentation +80 added lines, -80 removed lines

@@ -27,84 +27,84 @@
  * @package OCA\Provisioning_API\Tests
  */
 class AppsControllerTest extends TestCase {
-	private IAppManager $appManager;
-	private IAppConfig&MockObject $appConfig;
-	private Installer&MockObject $installer;
-	private AppsController $api;
-	private IUserSession $userSession;
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->appManager = Server::get(IAppManager::class);
-		$this->groupManager = Server::get(IGroupManager::class);
-		$this->userSession = Server::get(IUserSession::class);
-		$this->appConfig = $this->createMock(IAppConfig::class);
-		$this->installer = $this->createMock(Installer::class);
-
-		$request = $this->createMock(IRequest::class);
-
-		$this->api = new AppsController(
-			'provisioning_api',
-			$request,
-			$this->appManager,
-			$this->installer,
-			$this->appConfig,
-		);
-	}
-
-	protected function tearDown(): void {
-		$this->userSession->setUser(null);
-	}
-
-	public function testGetAppInfo(): void {
-		$result = $this->api->getAppInfo('provisioning_api');
-		$expected = $this->appManager->getAppInfo('provisioning_api');
-		$this->assertEquals($expected, $result->getData());
-	}
-
-
-	public function testGetAppInfoOnBadAppID(): void {
-		$this->expectException(OCSException::class);
-		$this->expectExceptionCode(998);
-
-		$this->api->getAppInfo('not_provisioning_api');
-	}
-
-	public function testGetApps(): void {
-		$user = $this->generateUsers();
-		$this->groupManager->get('admin')->addUser($user);
-		$this->userSession->setUser($user);
-
-		$result = $this->api->getApps();
-
-		$data = $result->getData();
-		$this->assertEquals(count((new \OC_App())->listAllApps()), count($data['apps']));
-	}
-
-	public function testGetAppsEnabled(): void {
-		$result = $this->api->getApps('enabled');
-		$data = $result->getData();
-		$this->assertEquals(count(\OC_App::getEnabledApps()), count($data['apps']));
-	}
-
-	public function testGetAppsDisabled(): void {
-		$result = $this->api->getApps('disabled');
-		$data = $result->getData();
-		$apps = (new \OC_App)->listAllApps();
-		$list = [];
-		foreach ($apps as $app) {
-			$list[] = $app['id'];
-		}
-		$disabled = array_diff($list, \OC_App::getEnabledApps());
-		$this->assertEquals(count($disabled), count($data['apps']));
-	}
-
-
-	public function testGetAppsInvalidFilter(): void {
-		$this->expectException(OCSException::class);
-		$this->expectExceptionCode(101);
-
-		$this->api->getApps('foo');
-	}
+    private IAppManager $appManager;
+    private IAppConfig&MockObject $appConfig;
+    private Installer&MockObject $installer;
+    private AppsController $api;
+    private IUserSession $userSession;
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->appManager = Server::get(IAppManager::class);
+        $this->groupManager = Server::get(IGroupManager::class);
+        $this->userSession = Server::get(IUserSession::class);
+        $this->appConfig = $this->createMock(IAppConfig::class);
+        $this->installer = $this->createMock(Installer::class);
+
+        $request = $this->createMock(IRequest::class);
+
+        $this->api = new AppsController(
+            'provisioning_api',
+            $request,
+            $this->appManager,
+            $this->installer,
+            $this->appConfig,
+        );
+    }
+
+    protected function tearDown(): void {
+        $this->userSession->setUser(null);
+    }
+
+    public function testGetAppInfo(): void {
+        $result = $this->api->getAppInfo('provisioning_api');
+        $expected = $this->appManager->getAppInfo('provisioning_api');
+        $this->assertEquals($expected, $result->getData());
+    }
+
+
+    public function testGetAppInfoOnBadAppID(): void {
+        $this->expectException(OCSException::class);
+        $this->expectExceptionCode(998);
+
+        $this->api->getAppInfo('not_provisioning_api');
+    }
+
+    public function testGetApps(): void {
+        $user = $this->generateUsers();
+        $this->groupManager->get('admin')->addUser($user);
+        $this->userSession->setUser($user);
+
+        $result = $this->api->getApps();
+
+        $data = $result->getData();
+        $this->assertEquals(count((new \OC_App())->listAllApps()), count($data['apps']));
+    }
+
+    public function testGetAppsEnabled(): void {
+        $result = $this->api->getApps('enabled');
+        $data = $result->getData();
+        $this->assertEquals(count(\OC_App::getEnabledApps()), count($data['apps']));
+    }
+
+    public function testGetAppsDisabled(): void {
+        $result = $this->api->getApps('disabled');
+        $data = $result->getData();
+        $apps = (new \OC_App)->listAllApps();
+        $list = [];
+        foreach ($apps as $app) {
+            $list[] = $app['id'];
+        }
+        $disabled = array_diff($list, \OC_App::getEnabledApps());
+        $this->assertEquals(count($disabled), count($data['apps']));
+    }
+
+
+    public function testGetAppsInvalidFilter(): void {
+        $this->expectException(OCSException::class);
+        $this->expectExceptionCode(101);
+
+        $this->api->getApps('foo');
+    }
 }

apps/provisioning_api/lib/Controller/AppsController.php

Indentation +119 added lines, -119 removed lines

@@ -22,132 +22,132 @@
 use OCP\IRequest;
 
 class AppsController extends OCSController {
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		private IAppManager $appManager,
-		private Installer $installer,
-		private IAppConfig $appConfig,
-	) {
-		parent::__construct($appName, $request);
-	}
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        private IAppManager $appManager,
+        private Installer $installer,
+        private IAppConfig $appConfig,
+    ) {
+        parent::__construct($appName, $request);
+    }
 
-	/**
-	 * @throws \InvalidArgumentException
-	 */
-	protected function verifyAppId(string $app): string {
-		$cleanId = $this->appManager->cleanAppId($app);
-		if ($cleanId !== $app) {
-			throw new \InvalidArgumentException('Invalid app id given');
-		}
-		return $cleanId;
-	}
+    /**
+     * @throws \InvalidArgumentException
+     */
+    protected function verifyAppId(string $app): string {
+        $cleanId = $this->appManager->cleanAppId($app);
+        if ($cleanId !== $app) {
+            throw new \InvalidArgumentException('Invalid app id given');
+        }
+        return $cleanId;
+    }
 
-	/**
-	 * Get a list of installed apps
-	 *
-	 * @param ?string $filter Filter for enabled or disabled apps
-	 * @return DataResponse<Http::STATUS_OK, array{apps: list<string>}, array{}>
-	 * @throws OCSException
-	 *
-	 * 200: Installed apps returned
-	 */
-	public function getApps(?string $filter = null): DataResponse {
-		$apps = (new OC_App())->listAllApps();
-		/** @var list<string> $list */
-		$list = [];
-		foreach ($apps as $app) {
-			$list[] = $app['id'];
-		}
-		if ($filter) {
-			switch ($filter) {
-				case 'enabled':
-					return new DataResponse(['apps' => \OC_App::getEnabledApps()]);
-					break;
-				case 'disabled':
-					$enabled = OC_App::getEnabledApps();
-					return new DataResponse(['apps' => array_values(array_diff($list, $enabled))]);
-					break;
-				default:
-					// Invalid filter variable
-					throw new OCSException('', 101);
-			}
-		} else {
-			return new DataResponse(['apps' => $list]);
-		}
-	}
+    /**
+     * Get a list of installed apps
+     *
+     * @param ?string $filter Filter for enabled or disabled apps
+     * @return DataResponse<Http::STATUS_OK, array{apps: list<string>}, array{}>
+     * @throws OCSException
+     *
+     * 200: Installed apps returned
+     */
+    public function getApps(?string $filter = null): DataResponse {
+        $apps = (new OC_App())->listAllApps();
+        /** @var list<string> $list */
+        $list = [];
+        foreach ($apps as $app) {
+            $list[] = $app['id'];
+        }
+        if ($filter) {
+            switch ($filter) {
+                case 'enabled':
+                    return new DataResponse(['apps' => \OC_App::getEnabledApps()]);
+                    break;
+                case 'disabled':
+                    $enabled = OC_App::getEnabledApps();
+                    return new DataResponse(['apps' => array_values(array_diff($list, $enabled))]);
+                    break;
+                default:
+                    // Invalid filter variable
+                    throw new OCSException('', 101);
+            }
+        } else {
+            return new DataResponse(['apps' => $list]);
+        }
+    }
 
-	/**
-	 * Get the app info for an app
-	 *
-	 * @param string $app ID of the app
-	 * @return DataResponse<Http::STATUS_OK, array<string, ?mixed>, array{}>
-	 * @throws OCSException
-	 *
-	 * 200: App info returned
-	 */
-	public function getAppInfo(string $app): DataResponse {
-		try {
-			$app = $this->verifyAppId($app);
-		} catch (\InvalidArgumentException $e) {
-			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
-		}
-		$info = $this->appManager->getAppInfo($app);
-		if (!is_null($info)) {
-			return new DataResponse($info);
-		}
+    /**
+     * Get the app info for an app
+     *
+     * @param string $app ID of the app
+     * @return DataResponse<Http::STATUS_OK, array<string, ?mixed>, array{}>
+     * @throws OCSException
+     *
+     * 200: App info returned
+     */
+    public function getAppInfo(string $app): DataResponse {
+        try {
+            $app = $this->verifyAppId($app);
+        } catch (\InvalidArgumentException $e) {
+            throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+        }
+        $info = $this->appManager->getAppInfo($app);
+        if (!is_null($info)) {
+            return new DataResponse($info);
+        }
 
-		throw new OCSException('The request app was not found', OCSController::RESPOND_NOT_FOUND);
-	}
+        throw new OCSException('The request app was not found', OCSController::RESPOND_NOT_FOUND);
+    }
 
-	/**
-	 * Enable an app
-	 *
-	 * @param string $app ID of the app
-	 * @return DataResponse<Http::STATUS_OK, list<empty>, array{}>
-	 * @throws OCSException
-	 *
-	 * 200: App enabled successfully
-	 */
-	#[PasswordConfirmationRequired]
-	public function enable(string $app): DataResponse {
-		try {
-			$app = $this->verifyAppId($app);
+    /**
+     * Enable an app
+     *
+     * @param string $app ID of the app
+     * @return DataResponse<Http::STATUS_OK, list<empty>, array{}>
+     * @throws OCSException
+     *
+     * 200: App enabled successfully
+     */
+    #[PasswordConfirmationRequired]
+    public function enable(string $app): DataResponse {
+        try {
+            $app = $this->verifyAppId($app);
 
-			if (!$this->installer->isDownloaded($app)) {
-				$this->installer->downloadApp($app);
-			}
+            if (!$this->installer->isDownloaded($app)) {
+                $this->installer->downloadApp($app);
+            }
 
-			if ($this->appConfig->getValueString($app, 'installed_version', '') === '') {
-				$this->installer->installApp($app);
-			}
+            if ($this->appConfig->getValueString($app, 'installed_version', '') === '') {
+                $this->installer->installApp($app);
+            }
 
-			$this->appManager->enableApp($app);
-		} catch (\InvalidArgumentException $e) {
-			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
-		} catch (AppPathNotFoundException|AppNotFoundException $e) {
-			throw new OCSException('The request app was not found', OCSController::RESPOND_NOT_FOUND);
-		}
-		return new DataResponse();
-	}
+            $this->appManager->enableApp($app);
+        } catch (\InvalidArgumentException $e) {
+            throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+        } catch (AppPathNotFoundException|AppNotFoundException $e) {
+            throw new OCSException('The request app was not found', OCSController::RESPOND_NOT_FOUND);
+        }
+        return new DataResponse();
+    }
 
-	/**
-	 * Disable an app
-	 *
-	 * @param string $app ID of the app
-	 * @return DataResponse<Http::STATUS_OK, list<empty>, array{}>
-	 * @throws OCSException
-	 *
-	 * 200: App disabled successfully
-	 */
-	#[PasswordConfirmationRequired]
-	public function disable(string $app): DataResponse {
-		try {
-			$app = $this->verifyAppId($app);
-			$this->appManager->disableApp($app);
-		} catch (\InvalidArgumentException $e) {
-			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
-		}
-		return new DataResponse();
-	}
+    /**
+     * Disable an app
+     *
+     * @param string $app ID of the app
+     * @return DataResponse<Http::STATUS_OK, list<empty>, array{}>
+     * @throws OCSException
+     *
+     * 200: App disabled successfully
+     */
+    #[PasswordConfirmationRequired]
+    public function disable(string $app): DataResponse {
+        try {
+            $app = $this->verifyAppId($app);
+            $this->appManager->disableApp($app);
+        } catch (\InvalidArgumentException $e) {
+            throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+        }
+        return new DataResponse();
+    }
 }

lib/private/Installer.php

Indentation +596 added lines, -596 removed lines

@@ -34,600 +34,600 @@
  * This class provides the functionality needed to install, update and remove apps
  */
 class Installer {
-	private ?bool $isInstanceReadyForUpdates = null;
-	private ?array $apps = null;
-
-	public function __construct(
-		private AppFetcher $appFetcher,
-		private IClientService $clientService,
-		private ITempManager $tempManager,
-		private LoggerInterface $logger,
-		private IConfig $config,
-		private bool $isCLI,
-	) {
-	}
-
-	/**
-	 * Installs an app that is located in one of the app folders already
-	 *
-	 * @param string $appId App to install
-	 * @param bool $forceEnable
-	 * @throws \Exception
-	 * @return string app ID
-	 */
-	public function installApp(string $appId, bool $forceEnable = false): string {
-		$app = \OC_App::findAppInDirectories($appId);
-		if ($app === false) {
-			throw new \Exception('App not found in any app directory');
-		}
-
-		$basedir = $app['path'] . '/' . $appId;
-
-		if (is_file($basedir . '/appinfo/database.xml')) {
-			throw new \Exception('The appinfo/database.xml file is not longer supported. Used in ' . $appId);
-		}
-
-		$l = \OCP\Util::getL10N('core');
-		$info = \OCP\Server::get(IAppManager::class)->getAppInfoByPath($basedir . '/appinfo/info.xml', $l->getLanguageCode());
-
-		if (!is_array($info)) {
-			throw new \Exception(
-				$l->t('App "%s" cannot be installed because appinfo file cannot be read.',
-					[$appId]
-				)
-			);
-		}
-
-		$ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
-		$ignoreMax = $forceEnable || in_array($appId, $ignoreMaxApps, true);
-
-		$version = implode('.', \OCP\Util::getVersion());
-		if (!\OC_App::isAppCompatible($version, $info, $ignoreMax)) {
-			throw new \Exception(
-				// TODO $l
-				$l->t('App "%s" cannot be installed because it is not compatible with this version of the server.',
-					[$info['name']]
-				)
-			);
-		}
-
-		// check for required dependencies
-		\OC_App::checkAppDependencies($this->config, $l, $info, $ignoreMax);
-		/** @var Coordinator $coordinator */
-		$coordinator = \OC::$server->get(Coordinator::class);
-		$coordinator->runLazyRegistration($appId);
-		\OC_App::registerAutoloading($appId, $basedir);
-
-		$previousVersion = $this->config->getAppValue($info['id'], 'installed_version', false);
-		if ($previousVersion) {
-			OC_App::executeRepairSteps($appId, $info['repair-steps']['pre-migration']);
-		}
-
-		//install the database
-		$ms = new MigrationService($info['id'], \OCP\Server::get(Connection::class));
-		$ms->migrate('latest', !$previousVersion);
-
-		if ($previousVersion) {
-			OC_App::executeRepairSteps($appId, $info['repair-steps']['post-migration']);
-		}
-
-		\OC_App::setupBackgroundJobs($info['background-jobs']);
-
-		//run appinfo/install.php
-		self::includeAppScript($basedir . '/appinfo/install.php');
-
-		OC_App::executeRepairSteps($appId, $info['repair-steps']['install']);
-
-		$config = \OCP\Server::get(IConfig::class);
-		//set the installed version
-		$config->setAppValue($info['id'], 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($info['id'], false));
-		$config->setAppValue($info['id'], 'enabled', 'no');
-
-		//set remote/public handlers
-		foreach ($info['remote'] as $name => $path) {
-			$config->setAppValue('core', 'remote_' . $name, $info['id'] . '/' . $path);
-		}
-		foreach ($info['public'] as $name => $path) {
-			$config->setAppValue('core', 'public_' . $name, $info['id'] . '/' . $path);
-		}
-
-		OC_App::setAppTypes($info['id']);
-
-		return $info['id'];
-	}
-
-	/**
-	 * Updates the specified app from the appstore
-	 *
-	 * @param bool $allowUnstable Allow unstable releases
-	 */
-	public function updateAppstoreApp(string $appId, bool $allowUnstable = false): bool {
-		if ($this->isUpdateAvailable($appId, $allowUnstable)) {
-			try {
-				$this->downloadApp($appId, $allowUnstable);
-			} catch (\Exception $e) {
-				$this->logger->error($e->getMessage(), [
-					'exception' => $e,
-				]);
-				return false;
-			}
-			return OC_App::updateApp($appId);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Split the certificate file in individual certs
-	 *
-	 * @param string $cert
-	 * @return string[]
-	 */
-	private function splitCerts(string $cert): array {
-		preg_match_all('([\-]{3,}[\S\ ]+?[\-]{3,}[\S\s]+?[\-]{3,}[\S\ ]+?[\-]{3,})', $cert, $matches);
-
-		return $matches[0];
-	}
-
-	/**
-	 * Downloads an app and puts it into the app directory
-	 *
-	 * @param string $appId
-	 * @param bool [$allowUnstable]
-	 *
-	 * @throws AppNotFoundException If the app is not found on the appstore
-	 * @throws \Exception If the installation was not successful
-	 */
-	public function downloadApp(string $appId, bool $allowUnstable = false): void {
-		$appId = strtolower($appId);
-
-		$apps = $this->appFetcher->get($allowUnstable);
-		foreach ($apps as $app) {
-			if ($app['id'] === $appId) {
-				// Load the certificate
-				$certificate = new X509();
-				$rootCrt = file_get_contents(__DIR__ . '/../../resources/codesigning/root.crt');
-				$rootCrts = $this->splitCerts($rootCrt);
-				foreach ($rootCrts as $rootCrt) {
-					$certificate->loadCA($rootCrt);
-				}
-				$loadedCertificate = $certificate->loadX509($app['certificate']);
-
-				// Verify if the certificate has been revoked
-				$crl = new X509();
-				foreach ($rootCrts as $rootCrt) {
-					$crl->loadCA($rootCrt);
-				}
-				$crl->loadCRL(file_get_contents(__DIR__ . '/../../resources/codesigning/root.crl'));
-				if ($crl->validateSignature() !== true) {
-					throw new \Exception('Could not validate CRL signature');
-				}
-				$csn = $loadedCertificate['tbsCertificate']['serialNumber']->toString();
-				$revoked = $crl->getRevoked($csn);
-				if ($revoked !== false) {
-					throw new \Exception(
-						sprintf(
-							'Certificate "%s" has been revoked',
-							$csn
-						)
-					);
-				}
-
-				// Verify if the certificate has been issued by the Nextcloud Code Authority CA
-				if ($certificate->validateSignature() !== true) {
-					throw new \Exception(
-						sprintf(
-							'App with id %s has a certificate not issued by a trusted Code Signing Authority',
-							$appId
-						)
-					);
-				}
-
-				// Verify if the certificate is issued for the requested app id
-				$certInfo = openssl_x509_parse($app['certificate']);
-				if (!isset($certInfo['subject']['CN'])) {
-					throw new \Exception(
-						sprintf(
-							'App with id %s has a cert with no CN',
-							$appId
-						)
-					);
-				}
-				if ($certInfo['subject']['CN'] !== $appId) {
-					throw new \Exception(
-						sprintf(
-							'App with id %s has a cert issued to %s',
-							$appId,
-							$certInfo['subject']['CN']
-						)
-					);
-				}
-
-				// Download the release
-				$tempFile = $this->tempManager->getTemporaryFile('.tar.gz');
-				if ($tempFile === false) {
-					throw new \RuntimeException('Could not create temporary file for downloading app archive.');
-				}
-
-				$timeout = $this->isCLI ? 0 : 120;
-				$client = $this->clientService->newClient();
-				$client->get($app['releases'][0]['download'], ['sink' => $tempFile, 'timeout' => $timeout]);
-
-				// Check if the signature actually matches the downloaded content
-				$certificate = openssl_get_publickey($app['certificate']);
-				$verified = openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512) === 1;
-
-				if ($verified === true) {
-					// Seems to match, let's proceed
-					$extractDir = $this->tempManager->getTemporaryFolder();
-					if ($extractDir === false) {
-						throw new \RuntimeException('Could not create temporary directory for unpacking app.');
-					}
-
-					$archive = new TAR($tempFile);
-					if (!$archive->extract($extractDir)) {
-						$errorMessage = 'Could not extract app ' . $appId;
-
-						$archiveError = $archive->getError();
-						if ($archiveError instanceof \PEAR_Error) {
-							$errorMessage .= ': ' . $archiveError->getMessage();
-						}
-
-						throw new \Exception($errorMessage);
-					}
-					$allFiles = scandir($extractDir);
-					$folders = array_diff($allFiles, ['.', '..']);
-					$folders = array_values($folders);
-
-					if (count($folders) < 1) {
-						throw new \Exception(
-							sprintf(
-								'Extracted app %s has no folders',
-								$appId
-							)
-						);
-					}
-
-					if (count($folders) > 1) {
-						throw new \Exception(
-							sprintf(
-								'Extracted app %s has more than 1 folder',
-								$appId
-							)
-						);
-					}
-
-					// Check if appinfo/info.xml has the same app ID as well
-					$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
-
-					if ($xml === false) {
-						throw new \Exception(
-							sprintf(
-								'Failed to load info.xml for app id %s',
-								$appId,
-							)
-						);
-					}
-
-					if ((string)$xml->id !== $appId) {
-						throw new \Exception(
-							sprintf(
-								'App for id %s has a wrong app ID in info.xml: %s',
-								$appId,
-								(string)$xml->id
-							)
-						);
-					}
-
-					// Check if the version is lower than before
-					$currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
-					$newVersion = (string)$xml->version;
-					if (version_compare($currentVersion, $newVersion) === 1) {
-						throw new \Exception(
-							sprintf(
-								'App for id %s has version %s and tried to update to lower version %s',
-								$appId,
-								$currentVersion,
-								$newVersion
-							)
-						);
-					}
-
-					$baseDir = OC_App::getInstallPath() . '/' . $appId;
-					// Remove old app with the ID if existent
-					Files::rmdirr($baseDir);
-					// Move to app folder
-					if (@mkdir($baseDir)) {
-						$extractDir .= '/' . $folders[0];
-					}
-					// otherwise we just copy the outer directory
-					$this->copyRecursive($extractDir, $baseDir);
-					Files::rmdirr($extractDir);
-					if (function_exists('opcache_reset')) {
-						opcache_reset();
-					}
-					return;
-				}
-				// Signature does not match
-				throw new \Exception(
-					sprintf(
-						'App with id %s has invalid signature',
-						$appId
-					)
-				);
-			}
-		}
-
-		throw new AppNotFoundException(
-			sprintf(
-				'Could not download app %s, it was not found on the appstore',
-				$appId
-			)
-		);
-	}
-
-	/**
-	 * Check if an update for the app is available
-	 *
-	 * @param string $appId
-	 * @param bool $allowUnstable
-	 * @return string|false false or the version number of the update
-	 */
-	public function isUpdateAvailable($appId, $allowUnstable = false): string|false {
-		if ($this->isInstanceReadyForUpdates === null) {
-			$installPath = OC_App::getInstallPath();
-			if ($installPath === null) {
-				$this->isInstanceReadyForUpdates = false;
-			} else {
-				$this->isInstanceReadyForUpdates = true;
-			}
-		}
-
-		if ($this->isInstanceReadyForUpdates === false) {
-			return false;
-		}
-
-		if ($this->isInstalledFromGit($appId) === true) {
-			return false;
-		}
-
-		if ($this->apps === null) {
-			$this->apps = $this->appFetcher->get($allowUnstable);
-		}
-
-		foreach ($this->apps as $app) {
-			if ($app['id'] === $appId) {
-				$currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
-
-				if (!isset($app['releases'][0]['version'])) {
-					return false;
-				}
-				$newestVersion = $app['releases'][0]['version'];
-				if ($currentVersion !== '0' && version_compare($newestVersion, $currentVersion, '>')) {
-					return $newestVersion;
-				} else {
-					return false;
-				}
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Check if app has been installed from git
-	 *
-	 * The function will check if the path contains a .git folder
-	 */
-	private function isInstalledFromGit(string $appId): bool {
-		$app = \OC_App::findAppInDirectories($appId);
-		if ($app === false) {
-			return false;
-		}
-		$basedir = $app['path'] . '/' . $appId;
-		return file_exists($basedir . '/.git/');
-	}
-
-	/**
-	 * Check if app is already downloaded
-	 *
-	 * The function will check if the app is already downloaded in the apps repository
-	 */
-	public function isDownloaded(string $name): bool {
-		foreach (\OC::$APPSROOTS as $dir) {
-			$dirToTest = $dir['path'];
-			$dirToTest .= '/';
-			$dirToTest .= $name;
-			$dirToTest .= '/';
-
-			if (is_dir($dirToTest)) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Removes an app
-	 *
-	 * This function works as follows
-	 *   -# call uninstall repair steps
-	 *   -# removing the files
-	 *
-	 * The function will not delete preferences, tables and the configuration,
-	 * this has to be done by the function oc_app_uninstall().
-	 */
-	public function removeApp(string $appId): bool {
-		if ($this->isDownloaded($appId)) {
-			if (\OCP\Server::get(IAppManager::class)->isShipped($appId)) {
-				return false;
-			}
-			$appDir = OC_App::getInstallPath() . '/' . $appId;
-			Files::rmdirr($appDir);
-			return true;
-		} else {
-			$this->logger->error('can\'t remove app ' . $appId . '. It is not installed.');
-
-			return false;
-		}
-	}
-
-	/**
-	 * Installs the app within the bundle and marks the bundle as installed
-	 *
-	 * @throws \Exception If app could not get installed
-	 */
-	public function installAppBundle(Bundle $bundle): void {
-		$appIds = $bundle->getAppIdentifiers();
-		foreach ($appIds as $appId) {
-			if (!$this->isDownloaded($appId)) {
-				$this->downloadApp($appId);
-			}
-			$this->installApp($appId);
-			$app = new OC_App();
-			$app->enable($appId);
-		}
-		$bundles = json_decode($this->config->getAppValue('core', 'installed.bundles', json_encode([])), true);
-		$bundles[] = $bundle->getIdentifier();
-		$this->config->setAppValue('core', 'installed.bundles', json_encode($bundles));
-	}
-
-	/**
-	 * Installs shipped apps
-	 *
-	 * This function installs all apps found in the 'apps' directory that should be enabled by default;
-	 * @param bool $softErrors When updating we ignore errors and simply log them, better to have a
-	 *                         working ownCloud at the end instead of an aborted update.
-	 * @return array Array of error messages (appid => Exception)
-	 */
-	public static function installShippedApps(bool $softErrors = false, ?IOutput $output = null): array {
-		if ($output instanceof IOutput) {
-			$output->debug('Installing shipped apps');
-		}
-		$appManager = \OCP\Server::get(IAppManager::class);
-		$config = \OCP\Server::get(IConfig::class);
-		$errors = [];
-		foreach (\OC::$APPSROOTS as $app_dir) {
-			if ($dir = opendir($app_dir['path'])) {
-				while (false !== ($filename = readdir($dir))) {
-					if ($filename[0] !== '.' and is_dir($app_dir['path'] . "/$filename")) {
-						if (file_exists($app_dir['path'] . "/$filename/appinfo/info.xml")) {
-							if ($config->getAppValue($filename, 'installed_version', null) === null) {
-								$enabled = $appManager->isDefaultEnabled($filename);
-								if (($enabled || in_array($filename, $appManager->getAlwaysEnabledApps()))
-									  && $config->getAppValue($filename, 'enabled') !== 'no') {
-									if ($softErrors) {
-										try {
-											Installer::installShippedApp($filename, $output);
-										} catch (HintException $e) {
-											if ($e->getPrevious() instanceof TableExistsException) {
-												$errors[$filename] = $e;
-												continue;
-											}
-											throw $e;
-										}
-									} else {
-										Installer::installShippedApp($filename, $output);
-									}
-									$config->setAppValue($filename, 'enabled', 'yes');
-								}
-							}
-						}
-					}
-				}
-				closedir($dir);
-			}
-		}
-
-		return $errors;
-	}
-
-	/**
-	 * install an app already placed in the app folder
-	 */
-	public static function installShippedApp(string $app, ?IOutput $output = null): string|false {
-		if ($output instanceof IOutput) {
-			$output->debug('Installing ' . $app);
-		}
-
-		$appManager = \OCP\Server::get(IAppManager::class);
-		$config = \OCP\Server::get(IConfig::class);
-
-		$appPath = $appManager->getAppPath($app);
-		\OC_App::registerAutoloading($app, $appPath);
-
-		$ms = new MigrationService($app, \OCP\Server::get(Connection::class));
-		if ($output instanceof IOutput) {
-			$ms->setOutput($output);
-		}
-		$previousVersion = $config->getAppValue($app, 'installed_version', false);
-		$ms->migrate('latest', !$previousVersion);
-
-		//run appinfo/install.php
-		self::includeAppScript("$appPath/appinfo/install.php");
-
-		$info = \OCP\Server::get(IAppManager::class)->getAppInfo($app);
-		if (is_null($info)) {
-			return false;
-		}
-		if ($output instanceof IOutput) {
-			$output->debug('Registering tasks of ' . $app);
-		}
-		\OC_App::setupBackgroundJobs($info['background-jobs']);
-
-		OC_App::executeRepairSteps($app, $info['repair-steps']['install']);
-
-		$config->setAppValue($app, 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($app));
-		if (array_key_exists('ocsid', $info)) {
-			$config->setAppValue($app, 'ocsid', $info['ocsid']);
-		}
-
-		//set remote/public handlers
-		foreach ($info['remote'] as $name => $path) {
-			$config->setAppValue('core', 'remote_' . $name, $app . '/' . $path);
-		}
-		foreach ($info['public'] as $name => $path) {
-			$config->setAppValue('core', 'public_' . $name, $app . '/' . $path);
-		}
-
-		OC_App::setAppTypes($info['id']);
-
-		return $info['id'];
-	}
-
-	private static function includeAppScript(string $script): void {
-		if (file_exists($script)) {
-			include $script;
-		}
-	}
-
-	/**
-	 * Recursive copying of local folders.
-	 *
-	 * @param string $src source folder
-	 * @param string $dest target folder
-	 */
-	private function copyRecursive(string $src, string $dest): void {
-		if (!file_exists($src)) {
-			return;
-		}
-
-		if (is_dir($src)) {
-			if (!is_dir($dest)) {
-				mkdir($dest);
-			}
-			$files = scandir($src);
-			foreach ($files as $file) {
-				if ($file != '.' && $file != '..') {
-					$this->copyRecursive("$src/$file", "$dest/$file");
-				}
-			}
-		} else {
-			$validator = Server::get(FilenameValidator::class);
-			if (!$validator->isForbidden($src)) {
-				copy($src, $dest);
-			}
-		}
-	}
+    private ?bool $isInstanceReadyForUpdates = null;
+    private ?array $apps = null;
+
+    public function __construct(
+        private AppFetcher $appFetcher,
+        private IClientService $clientService,
+        private ITempManager $tempManager,
+        private LoggerInterface $logger,
+        private IConfig $config,
+        private bool $isCLI,
+    ) {
+    }
+
+    /**
+     * Installs an app that is located in one of the app folders already
+     *
+     * @param string $appId App to install
+     * @param bool $forceEnable
+     * @throws \Exception
+     * @return string app ID
+     */
+    public function installApp(string $appId, bool $forceEnable = false): string {
+        $app = \OC_App::findAppInDirectories($appId);
+        if ($app === false) {
+            throw new \Exception('App not found in any app directory');
+        }
+
+        $basedir = $app['path'] . '/' . $appId;
+
+        if (is_file($basedir . '/appinfo/database.xml')) {
+            throw new \Exception('The appinfo/database.xml file is not longer supported. Used in ' . $appId);
+        }
+
+        $l = \OCP\Util::getL10N('core');
+        $info = \OCP\Server::get(IAppManager::class)->getAppInfoByPath($basedir . '/appinfo/info.xml', $l->getLanguageCode());
+
+        if (!is_array($info)) {
+            throw new \Exception(
+                $l->t('App "%s" cannot be installed because appinfo file cannot be read.',
+                    [$appId]
+                )
+            );
+        }
+
+        $ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
+        $ignoreMax = $forceEnable || in_array($appId, $ignoreMaxApps, true);
+
+        $version = implode('.', \OCP\Util::getVersion());
+        if (!\OC_App::isAppCompatible($version, $info, $ignoreMax)) {
+            throw new \Exception(
+                // TODO $l
+                $l->t('App "%s" cannot be installed because it is not compatible with this version of the server.',
+                    [$info['name']]
+                )
+            );
+        }
+
+        // check for required dependencies
+        \OC_App::checkAppDependencies($this->config, $l, $info, $ignoreMax);
+        /** @var Coordinator $coordinator */
+        $coordinator = \OC::$server->get(Coordinator::class);
+        $coordinator->runLazyRegistration($appId);
+        \OC_App::registerAutoloading($appId, $basedir);
+
+        $previousVersion = $this->config->getAppValue($info['id'], 'installed_version', false);
+        if ($previousVersion) {
+            OC_App::executeRepairSteps($appId, $info['repair-steps']['pre-migration']);
+        }
+
+        //install the database
+        $ms = new MigrationService($info['id'], \OCP\Server::get(Connection::class));
+        $ms->migrate('latest', !$previousVersion);
+
+        if ($previousVersion) {
+            OC_App::executeRepairSteps($appId, $info['repair-steps']['post-migration']);
+        }
+
+        \OC_App::setupBackgroundJobs($info['background-jobs']);
+
+        //run appinfo/install.php
+        self::includeAppScript($basedir . '/appinfo/install.php');
+
+        OC_App::executeRepairSteps($appId, $info['repair-steps']['install']);
+
+        $config = \OCP\Server::get(IConfig::class);
+        //set the installed version
+        $config->setAppValue($info['id'], 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($info['id'], false));
+        $config->setAppValue($info['id'], 'enabled', 'no');
+
+        //set remote/public handlers
+        foreach ($info['remote'] as $name => $path) {
+            $config->setAppValue('core', 'remote_' . $name, $info['id'] . '/' . $path);
+        }
+        foreach ($info['public'] as $name => $path) {
+            $config->setAppValue('core', 'public_' . $name, $info['id'] . '/' . $path);
+        }
+
+        OC_App::setAppTypes($info['id']);
+
+        return $info['id'];
+    }
+
+    /**
+     * Updates the specified app from the appstore
+     *
+     * @param bool $allowUnstable Allow unstable releases
+     */
+    public function updateAppstoreApp(string $appId, bool $allowUnstable = false): bool {
+        if ($this->isUpdateAvailable($appId, $allowUnstable)) {
+            try {
+                $this->downloadApp($appId, $allowUnstable);
+            } catch (\Exception $e) {
+                $this->logger->error($e->getMessage(), [
+                    'exception' => $e,
+                ]);
+                return false;
+            }
+            return OC_App::updateApp($appId);
+        }
+
+        return false;
+    }
+
+    /**
+     * Split the certificate file in individual certs
+     *
+     * @param string $cert
+     * @return string[]
+     */
+    private function splitCerts(string $cert): array {
+        preg_match_all('([\-]{3,}[\S\ ]+?[\-]{3,}[\S\s]+?[\-]{3,}[\S\ ]+?[\-]{3,})', $cert, $matches);
+
+        return $matches[0];
+    }
+
+    /**
+     * Downloads an app and puts it into the app directory
+     *
+     * @param string $appId
+     * @param bool [$allowUnstable]
+     *
+     * @throws AppNotFoundException If the app is not found on the appstore
+     * @throws \Exception If the installation was not successful
+     */
+    public function downloadApp(string $appId, bool $allowUnstable = false): void {
+        $appId = strtolower($appId);
+
+        $apps = $this->appFetcher->get($allowUnstable);
+        foreach ($apps as $app) {
+            if ($app['id'] === $appId) {
+                // Load the certificate
+                $certificate = new X509();
+                $rootCrt = file_get_contents(__DIR__ . '/../../resources/codesigning/root.crt');
+                $rootCrts = $this->splitCerts($rootCrt);
+                foreach ($rootCrts as $rootCrt) {
+                    $certificate->loadCA($rootCrt);
+                }
+                $loadedCertificate = $certificate->loadX509($app['certificate']);
+
+                // Verify if the certificate has been revoked
+                $crl = new X509();
+                foreach ($rootCrts as $rootCrt) {
+                    $crl->loadCA($rootCrt);
+                }
+                $crl->loadCRL(file_get_contents(__DIR__ . '/../../resources/codesigning/root.crl'));
+                if ($crl->validateSignature() !== true) {
+                    throw new \Exception('Could not validate CRL signature');
+                }
+                $csn = $loadedCertificate['tbsCertificate']['serialNumber']->toString();
+                $revoked = $crl->getRevoked($csn);
+                if ($revoked !== false) {
+                    throw new \Exception(
+                        sprintf(
+                            'Certificate "%s" has been revoked',
+                            $csn
+                        )
+                    );
+                }
+
+                // Verify if the certificate has been issued by the Nextcloud Code Authority CA
+                if ($certificate->validateSignature() !== true) {
+                    throw new \Exception(
+                        sprintf(
+                            'App with id %s has a certificate not issued by a trusted Code Signing Authority',
+                            $appId
+                        )
+                    );
+                }
+
+                // Verify if the certificate is issued for the requested app id
+                $certInfo = openssl_x509_parse($app['certificate']);
+                if (!isset($certInfo['subject']['CN'])) {
+                    throw new \Exception(
+                        sprintf(
+                            'App with id %s has a cert with no CN',
+                            $appId
+                        )
+                    );
+                }
+                if ($certInfo['subject']['CN'] !== $appId) {
+                    throw new \Exception(
+                        sprintf(
+                            'App with id %s has a cert issued to %s',
+                            $appId,
+                            $certInfo['subject']['CN']
+                        )
+                    );
+                }
+
+                // Download the release
+                $tempFile = $this->tempManager->getTemporaryFile('.tar.gz');
+                if ($tempFile === false) {
+                    throw new \RuntimeException('Could not create temporary file for downloading app archive.');
+                }
+
+                $timeout = $this->isCLI ? 0 : 120;
+                $client = $this->clientService->newClient();
+                $client->get($app['releases'][0]['download'], ['sink' => $tempFile, 'timeout' => $timeout]);
+
+                // Check if the signature actually matches the downloaded content
+                $certificate = openssl_get_publickey($app['certificate']);
+                $verified = openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512) === 1;
+
+                if ($verified === true) {
+                    // Seems to match, let's proceed
+                    $extractDir = $this->tempManager->getTemporaryFolder();
+                    if ($extractDir === false) {
+                        throw new \RuntimeException('Could not create temporary directory for unpacking app.');
+                    }
+
+                    $archive = new TAR($tempFile);
+                    if (!$archive->extract($extractDir)) {
+                        $errorMessage = 'Could not extract app ' . $appId;
+
+                        $archiveError = $archive->getError();
+                        if ($archiveError instanceof \PEAR_Error) {
+                            $errorMessage .= ': ' . $archiveError->getMessage();
+                        }
+
+                        throw new \Exception($errorMessage);
+                    }
+                    $allFiles = scandir($extractDir);
+                    $folders = array_diff($allFiles, ['.', '..']);
+                    $folders = array_values($folders);
+
+                    if (count($folders) < 1) {
+                        throw new \Exception(
+                            sprintf(
+                                'Extracted app %s has no folders',
+                                $appId
+                            )
+                        );
+                    }
+
+                    if (count($folders) > 1) {
+                        throw new \Exception(
+                            sprintf(
+                                'Extracted app %s has more than 1 folder',
+                                $appId
+                            )
+                        );
+                    }
+
+                    // Check if appinfo/info.xml has the same app ID as well
+                    $xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
+
+                    if ($xml === false) {
+                        throw new \Exception(
+                            sprintf(
+                                'Failed to load info.xml for app id %s',
+                                $appId,
+                            )
+                        );
+                    }
+
+                    if ((string)$xml->id !== $appId) {
+                        throw new \Exception(
+                            sprintf(
+                                'App for id %s has a wrong app ID in info.xml: %s',
+                                $appId,
+                                (string)$xml->id
+                            )
+                        );
+                    }
+
+                    // Check if the version is lower than before
+                    $currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
+                    $newVersion = (string)$xml->version;
+                    if (version_compare($currentVersion, $newVersion) === 1) {
+                        throw new \Exception(
+                            sprintf(
+                                'App for id %s has version %s and tried to update to lower version %s',
+                                $appId,
+                                $currentVersion,
+                                $newVersion
+                            )
+                        );
+                    }
+
+                    $baseDir = OC_App::getInstallPath() . '/' . $appId;
+                    // Remove old app with the ID if existent
+                    Files::rmdirr($baseDir);
+                    // Move to app folder
+                    if (@mkdir($baseDir)) {
+                        $extractDir .= '/' . $folders[0];
+                    }
+                    // otherwise we just copy the outer directory
+                    $this->copyRecursive($extractDir, $baseDir);
+                    Files::rmdirr($extractDir);
+                    if (function_exists('opcache_reset')) {
+                        opcache_reset();
+                    }
+                    return;
+                }
+                // Signature does not match
+                throw new \Exception(
+                    sprintf(
+                        'App with id %s has invalid signature',
+                        $appId
+                    )
+                );
+            }
+        }
+
+        throw new AppNotFoundException(
+            sprintf(
+                'Could not download app %s, it was not found on the appstore',
+                $appId
+            )
+        );
+    }
+
+    /**
+     * Check if an update for the app is available
+     *
+     * @param string $appId
+     * @param bool $allowUnstable
+     * @return string|false false or the version number of the update
+     */
+    public function isUpdateAvailable($appId, $allowUnstable = false): string|false {
+        if ($this->isInstanceReadyForUpdates === null) {
+            $installPath = OC_App::getInstallPath();
+            if ($installPath === null) {
+                $this->isInstanceReadyForUpdates = false;
+            } else {
+                $this->isInstanceReadyForUpdates = true;
+            }
+        }
+
+        if ($this->isInstanceReadyForUpdates === false) {
+            return false;
+        }
+
+        if ($this->isInstalledFromGit($appId) === true) {
+            return false;
+        }
+
+        if ($this->apps === null) {
+            $this->apps = $this->appFetcher->get($allowUnstable);
+        }
+
+        foreach ($this->apps as $app) {
+            if ($app['id'] === $appId) {
+                $currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
+
+                if (!isset($app['releases'][0]['version'])) {
+                    return false;
+                }
+                $newestVersion = $app['releases'][0]['version'];
+                if ($currentVersion !== '0' && version_compare($newestVersion, $currentVersion, '>')) {
+                    return $newestVersion;
+                } else {
+                    return false;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if app has been installed from git
+     *
+     * The function will check if the path contains a .git folder
+     */
+    private function isInstalledFromGit(string $appId): bool {
+        $app = \OC_App::findAppInDirectories($appId);
+        if ($app === false) {
+            return false;
+        }
+        $basedir = $app['path'] . '/' . $appId;
+        return file_exists($basedir . '/.git/');
+    }
+
+    /**
+     * Check if app is already downloaded
+     *
+     * The function will check if the app is already downloaded in the apps repository
+     */
+    public function isDownloaded(string $name): bool {
+        foreach (\OC::$APPSROOTS as $dir) {
+            $dirToTest = $dir['path'];
+            $dirToTest .= '/';
+            $dirToTest .= $name;
+            $dirToTest .= '/';
+
+            if (is_dir($dirToTest)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Removes an app
+     *
+     * This function works as follows
+     *   -# call uninstall repair steps
+     *   -# removing the files
+     *
+     * The function will not delete preferences, tables and the configuration,
+     * this has to be done by the function oc_app_uninstall().
+     */
+    public function removeApp(string $appId): bool {
+        if ($this->isDownloaded($appId)) {
+            if (\OCP\Server::get(IAppManager::class)->isShipped($appId)) {
+                return false;
+            }
+            $appDir = OC_App::getInstallPath() . '/' . $appId;
+            Files::rmdirr($appDir);
+            return true;
+        } else {
+            $this->logger->error('can\'t remove app ' . $appId . '. It is not installed.');
+
+            return false;
+        }
+    }
+
+    /**
+     * Installs the app within the bundle and marks the bundle as installed
+     *
+     * @throws \Exception If app could not get installed
+     */
+    public function installAppBundle(Bundle $bundle): void {
+        $appIds = $bundle->getAppIdentifiers();
+        foreach ($appIds as $appId) {
+            if (!$this->isDownloaded($appId)) {
+                $this->downloadApp($appId);
+            }
+            $this->installApp($appId);
+            $app = new OC_App();
+            $app->enable($appId);
+        }
+        $bundles = json_decode($this->config->getAppValue('core', 'installed.bundles', json_encode([])), true);
+        $bundles[] = $bundle->getIdentifier();
+        $this->config->setAppValue('core', 'installed.bundles', json_encode($bundles));
+    }
+
+    /**
+     * Installs shipped apps
+     *
+     * This function installs all apps found in the 'apps' directory that should be enabled by default;
+     * @param bool $softErrors When updating we ignore errors and simply log them, better to have a
+     *                         working ownCloud at the end instead of an aborted update.
+     * @return array Array of error messages (appid => Exception)
+     */
+    public static function installShippedApps(bool $softErrors = false, ?IOutput $output = null): array {
+        if ($output instanceof IOutput) {
+            $output->debug('Installing shipped apps');
+        }
+        $appManager = \OCP\Server::get(IAppManager::class);
+        $config = \OCP\Server::get(IConfig::class);
+        $errors = [];
+        foreach (\OC::$APPSROOTS as $app_dir) {
+            if ($dir = opendir($app_dir['path'])) {
+                while (false !== ($filename = readdir($dir))) {
+                    if ($filename[0] !== '.' and is_dir($app_dir['path'] . "/$filename")) {
+                        if (file_exists($app_dir['path'] . "/$filename/appinfo/info.xml")) {
+                            if ($config->getAppValue($filename, 'installed_version', null) === null) {
+                                $enabled = $appManager->isDefaultEnabled($filename);
+                                if (($enabled || in_array($filename, $appManager->getAlwaysEnabledApps()))
+                                      && $config->getAppValue($filename, 'enabled') !== 'no') {
+                                    if ($softErrors) {
+                                        try {
+                                            Installer::installShippedApp($filename, $output);
+                                        } catch (HintException $e) {
+                                            if ($e->getPrevious() instanceof TableExistsException) {
+                                                $errors[$filename] = $e;
+                                                continue;
+                                            }
+                                            throw $e;
+                                        }
+                                    } else {
+                                        Installer::installShippedApp($filename, $output);
+                                    }
+                                    $config->setAppValue($filename, 'enabled', 'yes');
+                                }
+                            }
+                        }
+                    }
+                }
+                closedir($dir);
+            }
+        }
+
+        return $errors;
+    }
+
+    /**
+     * install an app already placed in the app folder
+     */
+    public static function installShippedApp(string $app, ?IOutput $output = null): string|false {
+        if ($output instanceof IOutput) {
+            $output->debug('Installing ' . $app);
+        }
+
+        $appManager = \OCP\Server::get(IAppManager::class);
+        $config = \OCP\Server::get(IConfig::class);
+
+        $appPath = $appManager->getAppPath($app);
+        \OC_App::registerAutoloading($app, $appPath);
+
+        $ms = new MigrationService($app, \OCP\Server::get(Connection::class));
+        if ($output instanceof IOutput) {
+            $ms->setOutput($output);
+        }
+        $previousVersion = $config->getAppValue($app, 'installed_version', false);
+        $ms->migrate('latest', !$previousVersion);
+
+        //run appinfo/install.php
+        self::includeAppScript("$appPath/appinfo/install.php");
+
+        $info = \OCP\Server::get(IAppManager::class)->getAppInfo($app);
+        if (is_null($info)) {
+            return false;
+        }
+        if ($output instanceof IOutput) {
+            $output->debug('Registering tasks of ' . $app);
+        }
+        \OC_App::setupBackgroundJobs($info['background-jobs']);
+
+        OC_App::executeRepairSteps($app, $info['repair-steps']['install']);
+
+        $config->setAppValue($app, 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($app));
+        if (array_key_exists('ocsid', $info)) {
+            $config->setAppValue($app, 'ocsid', $info['ocsid']);
+        }
+
+        //set remote/public handlers
+        foreach ($info['remote'] as $name => $path) {
+            $config->setAppValue('core', 'remote_' . $name, $app . '/' . $path);
+        }
+        foreach ($info['public'] as $name => $path) {
+            $config->setAppValue('core', 'public_' . $name, $app . '/' . $path);
+        }
+
+        OC_App::setAppTypes($info['id']);
+
+        return $info['id'];
+    }
+
+    private static function includeAppScript(string $script): void {
+        if (file_exists($script)) {
+            include $script;
+        }
+    }
+
+    /**
+     * Recursive copying of local folders.
+     *
+     * @param string $src source folder
+     * @param string $dest target folder
+     */
+    private function copyRecursive(string $src, string $dest): void {
+        if (!file_exists($src)) {
+            return;
+        }
+
+        if (is_dir($src)) {
+            if (!is_dir($dest)) {
+                mkdir($dest);
+            }
+            $files = scandir($src);
+            foreach ($files as $file) {
+                if ($file != '.' && $file != '..') {
+                    $this->copyRecursive("$src/$file", "$dest/$file");
+                }
+            }
+        } else {
+            $validator = Server::get(FilenameValidator::class);
+            if (!$validator->isForbidden($src)) {
+                copy($src, $dest);
+            }
+        }
+    }
 }

lib/private/App/AppManager.php

Indentation +908 added lines, -908 removed lines

@@ -31,912 +31,912 @@
 use Psr\Log\LoggerInterface;
 
 class AppManager implements IAppManager {
-	/**
-	 * Apps with these types can not be enabled for certain groups only
-	 * @var string[]
-	 */
-	protected $protectedAppTypes = [
-		'filesystem',
-		'prelogin',
-		'authentication',
-		'logging',
-		'prevent_group_restriction',
-	];
-
-	/** @var string[] $appId => $enabled */
-	private array $enabledAppsCache = [];
-
-	/** @var string[]|null */
-	private ?array $shippedApps = null;
-
-	private array $alwaysEnabled = [];
-	private array $defaultEnabled = [];
-
-	/** @var array */
-	private array $appInfos = [];
-
-	/** @var array */
-	private array $appVersions = [];
-
-	/** @var array */
-	private array $autoDisabledApps = [];
-	private array $appTypes = [];
-
-	/** @var array<string, true> */
-	private array $loadedApps = [];
-
-	private ?AppConfig $appConfig = null;
-	private ?IURLGenerator $urlGenerator = null;
-	private ?INavigationManager $navigationManager = null;
-
-	/**
-	 * Be extremely careful when injecting classes here. The AppManager is used by the installer,
-	 * so it needs to work before installation. See how AppConfig and IURLGenerator are injected for reference
-	 */
-	public function __construct(
-		private IUserSession $userSession,
-		private IConfig $config,
-		private IGroupManager $groupManager,
-		private ICacheFactory $memCacheFactory,
-		private IEventDispatcher $dispatcher,
-		private LoggerInterface $logger,
-		private ServerVersion $serverVersion,
-	) {
-	}
-
-	private function getNavigationManager(): INavigationManager {
-		if ($this->navigationManager === null) {
-			$this->navigationManager = \OCP\Server::get(INavigationManager::class);
-		}
-		return $this->navigationManager;
-	}
-
-	public function getAppIcon(string $appId, bool $dark = false): ?string {
-		$possibleIcons = $dark ? [$appId . '-dark.svg', 'app-dark.svg'] : [$appId . '.svg', 'app.svg'];
-		$icon = null;
-		foreach ($possibleIcons as $iconName) {
-			try {
-				$icon = $this->getUrlGenerator()->imagePath($appId, $iconName);
-				break;
-			} catch (\RuntimeException $e) {
-				// ignore
-			}
-		}
-		return $icon;
-	}
-
-	private function getAppConfig(): AppConfig {
-		if ($this->appConfig !== null) {
-			return $this->appConfig;
-		}
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			throw new \Exception('Nextcloud is not installed yet, AppConfig is not available');
-		}
-		$this->appConfig = \OCP\Server::get(AppConfig::class);
-		return $this->appConfig;
-	}
-
-	private function getUrlGenerator(): IURLGenerator {
-		if ($this->urlGenerator !== null) {
-			return $this->urlGenerator;
-		}
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			throw new \Exception('Nextcloud is not installed yet, AppConfig is not available');
-		}
-		$this->urlGenerator = \OCP\Server::get(IURLGenerator::class);
-		return $this->urlGenerator;
-	}
-
-	/**
-	 * For all enabled apps, return the value of their 'enabled' config key.
-	 *
-	 * @return array<string,string> appId => enabled (may be 'yes', or a json encoded list of group ids)
-	 */
-	private function getEnabledAppsValues(): array {
-		if (!$this->enabledAppsCache) {
-			$values = $this->getAppConfig()->getValues(false, 'enabled');
-
-			$alwaysEnabledApps = $this->getAlwaysEnabledApps();
-			foreach ($alwaysEnabledApps as $appId) {
-				$values[$appId] = 'yes';
-			}
-
-			$this->enabledAppsCache = array_filter($values, function ($value) {
-				return $value !== 'no';
-			});
-			ksort($this->enabledAppsCache);
-		}
-		return $this->enabledAppsCache;
-	}
-
-	/**
-	 * Deprecated alias
-	 *
-	 * @return string[]
-	 */
-	public function getInstalledApps() {
-		return $this->getEnabledApps();
-	}
-
-	/**
-	 * List all enabled apps, either for everyone or for some groups
-	 *
-	 * @return list<string>
-	 */
-	public function getEnabledApps(): array {
-		return array_keys($this->getEnabledAppsValues());
-	}
-
-	/**
-	 * Get a list of all apps in the apps folder
-	 *
-	 * @return list<string> an array of app names (string IDs)
-	 */
-	public function getAllAppsInAppsFolders(): array {
-		$apps = [];
-
-		foreach (\OC::$APPSROOTS as $apps_dir) {
-			if (!is_readable($apps_dir['path'])) {
-				$this->logger->warning('unable to read app folder : ' . $apps_dir['path'], ['app' => 'core']);
-				continue;
-			}
-			$dh = opendir($apps_dir['path']);
-
-			if (is_resource($dh)) {
-				while (($file = readdir($dh)) !== false) {
-					if (
-						$file[0] != '.' &&
-						is_dir($apps_dir['path'] . '/' . $file) &&
-						is_file($apps_dir['path'] . '/' . $file . '/appinfo/info.xml')
-					) {
-						$apps[] = $file;
-					}
-				}
-			}
-		}
-
-		return array_values(array_unique($apps));
-	}
-
-	/**
-	 * List all apps enabled for a user
-	 *
-	 * @param \OCP\IUser $user
-	 * @return string[]
-	 */
-	public function getEnabledAppsForUser(IUser $user) {
-		$apps = $this->getEnabledAppsValues();
-		$appsForUser = array_filter($apps, function ($enabled) use ($user) {
-			return $this->checkAppForUser($enabled, $user);
-		});
-		return array_keys($appsForUser);
-	}
-
-	public function getEnabledAppsForGroup(IGroup $group): array {
-		$apps = $this->getEnabledAppsValues();
-		$appsForGroups = array_filter($apps, function ($enabled) use ($group) {
-			return $this->checkAppForGroups($enabled, $group);
-		});
-		return array_keys($appsForGroups);
-	}
-
-	/**
-	 * Loads all apps
-	 *
-	 * @param string[] $types
-	 * @return bool
-	 *
-	 * This function walks through the Nextcloud directory and loads all apps
-	 * it can find. A directory contains an app if the file /appinfo/info.xml
-	 * exists.
-	 *
-	 * if $types is set to non-empty array, only apps of those types will be loaded
-	 */
-	public function loadApps(array $types = []): bool {
-		if ($this->config->getSystemValueBool('maintenance', false)) {
-			return false;
-		}
-		// Load the enabled apps here
-		$apps = \OC_App::getEnabledApps();
-
-		// Add each apps' folder as allowed class path
-		foreach ($apps as $app) {
-			// If the app is already loaded then autoloading it makes no sense
-			if (!$this->isAppLoaded($app)) {
-				$path = \OC_App::getAppPath($app);
-				if ($path !== false) {
-					\OC_App::registerAutoloading($app, $path);
-				}
-			}
-		}
-
-		// prevent app loading from printing output
-		ob_start();
-		foreach ($apps as $app) {
-			if (!$this->isAppLoaded($app) && ($types === [] || $this->isType($app, $types))) {
-				try {
-					$this->loadApp($app);
-				} catch (\Throwable $e) {
-					$this->logger->emergency('Error during app loading: ' . $e->getMessage(), [
-						'exception' => $e,
-						'app' => $app,
-					]);
-				}
-			}
-		}
-		ob_end_clean();
-
-		return true;
-	}
-
-	/**
-	 * check if an app is of a specific type
-	 *
-	 * @param string $app
-	 * @param array $types
-	 * @return bool
-	 */
-	public function isType(string $app, array $types): bool {
-		$appTypes = $this->getAppTypes($app);
-		foreach ($types as $type) {
-			if (in_array($type, $appTypes, true)) {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * get the types of an app
-	 *
-	 * @param string $app
-	 * @return string[]
-	 */
-	private function getAppTypes(string $app): array {
-		//load the cache
-		if (count($this->appTypes) === 0) {
-			$this->appTypes = $this->getAppConfig()->getValues(false, 'types') ?: [];
-		}
-
-		if (isset($this->appTypes[$app])) {
-			return explode(',', $this->appTypes[$app]);
-		}
-
-		return [];
-	}
-
-	/**
-	 * @return array
-	 */
-	public function getAutoDisabledApps(): array {
-		return $this->autoDisabledApps;
-	}
-
-	public function getAppRestriction(string $appId): array {
-		$values = $this->getEnabledAppsValues();
-
-		if (!isset($values[$appId])) {
-			return [];
-		}
-
-		if ($values[$appId] === 'yes' || $values[$appId] === 'no') {
-			return [];
-		}
-		return json_decode($values[$appId], true);
-	}
-
-	/**
-	 * Check if an app is enabled for user
-	 *
-	 * @param string $appId
-	 * @param \OCP\IUser|null $user (optional) if not defined, the currently logged in user will be used
-	 * @return bool
-	 */
-	public function isEnabledForUser($appId, $user = null) {
-		if ($this->isAlwaysEnabled($appId)) {
-			return true;
-		}
-		if ($user === null) {
-			$user = $this->userSession->getUser();
-		}
-		$enabledAppsValues = $this->getEnabledAppsValues();
-		if (isset($enabledAppsValues[$appId])) {
-			return $this->checkAppForUser($enabledAppsValues[$appId], $user);
-		} else {
-			return false;
-		}
-	}
-
-	private function checkAppForUser(string $enabled, ?IUser $user): bool {
-		if ($enabled === 'yes') {
-			return true;
-		} elseif ($user === null) {
-			return false;
-		} else {
-			if (empty($enabled)) {
-				return false;
-			}
-
-			$groupIds = json_decode($enabled);
-
-			if (!is_array($groupIds)) {
-				$jsonError = json_last_error();
-				$jsonErrorMsg = json_last_error_msg();
-				// this really should never happen (if it does, the admin should check the `enabled` key value via `occ config:list` because it's bogus for some reason)
-				$this->logger->warning('AppManager::checkAppForUser - can\'t decode group IDs listed in app\'s enabled config key: ' . print_r($enabled, true) . ' - JSON error (' . $jsonError . ') ' . $jsonErrorMsg);
-				return false;
-			}
-
-			$userGroups = $this->groupManager->getUserGroupIds($user);
-			foreach ($userGroups as $groupId) {
-				if (in_array($groupId, $groupIds, true)) {
-					return true;
-				}
-			}
-			return false;
-		}
-	}
-
-	private function checkAppForGroups(string $enabled, IGroup $group): bool {
-		if ($enabled === 'yes') {
-			return true;
-		} else {
-			if (empty($enabled)) {
-				return false;
-			}
-
-			$groupIds = json_decode($enabled);
-
-			if (!is_array($groupIds)) {
-				$jsonError = json_last_error();
-				$jsonErrorMsg = json_last_error_msg();
-				// this really should never happen (if it does, the admin should check the `enabled` key value via `occ config:list` because it's bogus for some reason)
-				$this->logger->warning('AppManager::checkAppForGroups - can\'t decode group IDs listed in app\'s enabled config key: ' . print_r($enabled, true) . ' - JSON error (' . $jsonError . ') ' . $jsonErrorMsg);
-				return false;
-			}
-
-			return in_array($group->getGID(), $groupIds);
-		}
-	}
-
-	/**
-	 * Check if an app is enabled in the instance
-	 *
-	 * Notice: This actually checks if the app is enabled and not only if it is installed.
-	 *
-	 * @param string $appId
-	 */
-	public function isInstalled($appId): bool {
-		return $this->isEnabledForAnyone($appId);
-	}
-
-	public function isEnabledForAnyone(string $appId): bool {
-		$enabledAppsValues = $this->getEnabledAppsValues();
-		return isset($enabledAppsValues[$appId]);
-	}
-
-	/**
-	 * Overwrite the `max-version` requirement for this app.
-	 */
-	public function overwriteNextcloudRequirement(string $appId): void {
-		$ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
-		if (!in_array($appId, $ignoreMaxApps, true)) {
-			$ignoreMaxApps[] = $appId;
-		}
-		$this->config->setSystemValue('app_install_overwrite', $ignoreMaxApps);
-	}
-
-	/**
-	 * Remove the `max-version` overwrite for this app.
-	 * This means this app now again can not be enabled if the `max-version` is smaller than the current Nextcloud version.
-	 */
-	public function removeOverwriteNextcloudRequirement(string $appId): void {
-		$ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
-		$ignoreMaxApps = array_filter($ignoreMaxApps, fn (string $id) => $id !== $appId);
-		$this->config->setSystemValue('app_install_overwrite', $ignoreMaxApps);
-	}
-
-	public function loadApp(string $app): void {
-		if (isset($this->loadedApps[$app])) {
-			return;
-		}
-		$this->loadedApps[$app] = true;
-		$appPath = \OC_App::getAppPath($app);
-		if ($appPath === false) {
-			return;
-		}
-		$eventLogger = \OC::$server->get(IEventLogger::class);
-		$eventLogger->start("bootstrap:load_app:$app", "Load app: $app");
-
-		// in case someone calls loadApp() directly
-		\OC_App::registerAutoloading($app, $appPath);
-
-		if (is_file($appPath . '/appinfo/app.php')) {
-			$this->logger->error('/appinfo/app.php is not supported anymore, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.', [
-				'app' => $app,
-			]);
-		}
-
-		$coordinator = \OCP\Server::get(Coordinator::class);
-		$coordinator->bootApp($app);
-
-		$eventLogger->start("bootstrap:load_app:$app:info", "Load info.xml for $app and register any services defined in it");
-		$info = $this->getAppInfo($app);
-		if (!empty($info['activity'])) {
-			$activityManager = \OC::$server->get(IActivityManager::class);
-			if (!empty($info['activity']['filters'])) {
-				foreach ($info['activity']['filters'] as $filter) {
-					$activityManager->registerFilter($filter);
-				}
-			}
-			if (!empty($info['activity']['settings'])) {
-				foreach ($info['activity']['settings'] as $setting) {
-					$activityManager->registerSetting($setting);
-				}
-			}
-			if (!empty($info['activity']['providers'])) {
-				foreach ($info['activity']['providers'] as $provider) {
-					$activityManager->registerProvider($provider);
-				}
-			}
-		}
-
-		if (!empty($info['settings'])) {
-			$settingsManager = \OC::$server->get(ISettingsManager::class);
-			if (!empty($info['settings']['admin'])) {
-				foreach ($info['settings']['admin'] as $setting) {
-					$settingsManager->registerSetting('admin', $setting);
-				}
-			}
-			if (!empty($info['settings']['admin-section'])) {
-				foreach ($info['settings']['admin-section'] as $section) {
-					$settingsManager->registerSection('admin', $section);
-				}
-			}
-			if (!empty($info['settings']['personal'])) {
-				foreach ($info['settings']['personal'] as $setting) {
-					$settingsManager->registerSetting('personal', $setting);
-				}
-			}
-			if (!empty($info['settings']['personal-section'])) {
-				foreach ($info['settings']['personal-section'] as $section) {
-					$settingsManager->registerSection('personal', $section);
-				}
-			}
-		}
-
-		if (!empty($info['collaboration']['plugins'])) {
-			// deal with one or many plugin entries
-			$plugins = isset($info['collaboration']['plugins']['plugin']['@value']) ?
-				[$info['collaboration']['plugins']['plugin']] : $info['collaboration']['plugins']['plugin'];
-			$collaboratorSearch = null;
-			$autoCompleteManager = null;
-			foreach ($plugins as $plugin) {
-				if ($plugin['@attributes']['type'] === 'collaborator-search') {
-					$pluginInfo = [
-						'shareType' => $plugin['@attributes']['share-type'],
-						'class' => $plugin['@value'],
-					];
-					$collaboratorSearch ??= \OC::$server->get(ICollaboratorSearch::class);
-					$collaboratorSearch->registerPlugin($pluginInfo);
-				} elseif ($plugin['@attributes']['type'] === 'autocomplete-sort') {
-					$autoCompleteManager ??= \OC::$server->get(IAutoCompleteManager::class);
-					$autoCompleteManager->registerSorter($plugin['@value']);
-				}
-			}
-		}
-		$eventLogger->end("bootstrap:load_app:$app:info");
-
-		$eventLogger->end("bootstrap:load_app:$app");
-	}
-
-	/**
-	 * Check if an app is loaded
-	 * @param string $app app id
-	 * @since 26.0.0
-	 */
-	public function isAppLoaded(string $app): bool {
-		return isset($this->loadedApps[$app]);
-	}
-
-	/**
-	 * Enable an app for every user
-	 *
-	 * @param string $appId
-	 * @param bool $forceEnable
-	 * @throws AppPathNotFoundException
-	 * @throws \InvalidArgumentException if the application is not installed yet
-	 */
-	public function enableApp(string $appId, bool $forceEnable = false): void {
-		// Check if app exists
-		$this->getAppPath($appId);
-
-		if ($this->config->getAppValue($appId, 'installed_version', '') === '') {
-			throw new \InvalidArgumentException("$appId is not installed, cannot be enabled.");
-		}
-
-		if ($forceEnable) {
-			$this->overwriteNextcloudRequirement($appId);
-		}
-
-		$this->enabledAppsCache[$appId] = 'yes';
-		$this->getAppConfig()->setValue($appId, 'enabled', 'yes');
-		$this->dispatcher->dispatchTyped(new AppEnableEvent($appId));
-		$this->dispatcher->dispatch(ManagerEvent::EVENT_APP_ENABLE, new ManagerEvent(
-			ManagerEvent::EVENT_APP_ENABLE, $appId
-		));
-		$this->clearAppsCache();
-	}
-
-	/**
-	 * Whether a list of types contains a protected app type
-	 *
-	 * @param string[] $types
-	 * @return bool
-	 */
-	public function hasProtectedAppType($types) {
-		if (empty($types)) {
-			return false;
-		}
-
-		$protectedTypes = array_intersect($this->protectedAppTypes, $types);
-		return !empty($protectedTypes);
-	}
-
-	/**
-	 * Enable an app only for specific groups
-	 *
-	 * @param string $appId
-	 * @param IGroup[] $groups
-	 * @param bool $forceEnable
-	 * @throws \InvalidArgumentException if app can't be enabled for groups
-	 * @throws AppPathNotFoundException
-	 */
-	public function enableAppForGroups(string $appId, array $groups, bool $forceEnable = false): void {
-		// Check if app exists
-		$this->getAppPath($appId);
-
-		$info = $this->getAppInfo($appId);
-		if (!empty($info['types']) && $this->hasProtectedAppType($info['types'])) {
-			throw new \InvalidArgumentException("$appId can't be enabled for groups.");
-		}
-
-		if ($this->config->getAppValue($appId, 'installed_version', '') === '') {
-			throw new \InvalidArgumentException("$appId is not installed, cannot be enabled.");
-		}
-
-		if ($forceEnable) {
-			$this->overwriteNextcloudRequirement($appId);
-		}
-
-		/** @var string[] $groupIds */
-		$groupIds = array_map(function ($group) {
-			/** @var IGroup $group */
-			return ($group instanceof IGroup)
-				? $group->getGID()
-				: $group;
-		}, $groups);
-
-		$this->enabledAppsCache[$appId] = json_encode($groupIds);
-		$this->getAppConfig()->setValue($appId, 'enabled', json_encode($groupIds));
-		$this->dispatcher->dispatchTyped(new AppEnableEvent($appId, $groupIds));
-		$this->dispatcher->dispatch(ManagerEvent::EVENT_APP_ENABLE_FOR_GROUPS, new ManagerEvent(
-			ManagerEvent::EVENT_APP_ENABLE_FOR_GROUPS, $appId, $groups
-		));
-		$this->clearAppsCache();
-	}
-
-	/**
-	 * Disable an app for every user
-	 *
-	 * @param string $appId
-	 * @param bool $automaticDisabled
-	 * @throws \Exception if app can't be disabled
-	 */
-	public function disableApp($appId, $automaticDisabled = false): void {
-		if ($this->isAlwaysEnabled($appId)) {
-			throw new \Exception("$appId can't be disabled.");
-		}
-
-		if ($automaticDisabled) {
-			$previousSetting = $this->getAppConfig()->getValue($appId, 'enabled', 'yes');
-			if ($previousSetting !== 'yes' && $previousSetting !== 'no') {
-				$previousSetting = json_decode($previousSetting, true);
-			}
-			$this->autoDisabledApps[$appId] = $previousSetting;
-		}
-
-		unset($this->enabledAppsCache[$appId]);
-		$this->getAppConfig()->setValue($appId, 'enabled', 'no');
-
-		// run uninstall steps
-		$appData = $this->getAppInfo($appId);
-		if (!is_null($appData)) {
-			\OC_App::executeRepairSteps($appId, $appData['repair-steps']['uninstall']);
-		}
-
-		$this->dispatcher->dispatchTyped(new AppDisableEvent($appId));
-		$this->dispatcher->dispatch(ManagerEvent::EVENT_APP_DISABLE, new ManagerEvent(
-			ManagerEvent::EVENT_APP_DISABLE, $appId
-		));
-		$this->clearAppsCache();
-	}
-
-	/**
-	 * Get the directory for the given app.
-	 *
-	 * @throws AppPathNotFoundException if app folder can't be found
-	 */
-	public function getAppPath(string $appId): string {
-		$appPath = \OC_App::getAppPath($appId);
-		if ($appPath === false) {
-			throw new AppPathNotFoundException('Could not find path for ' . $appId);
-		}
-		return $appPath;
-	}
-
-	/**
-	 * Get the web path for the given app.
-	 *
-	 * @param string $appId
-	 * @return string
-	 * @throws AppPathNotFoundException if app path can't be found
-	 */
-	public function getAppWebPath(string $appId): string {
-		$appWebPath = \OC_App::getAppWebPath($appId);
-		if ($appWebPath === false) {
-			throw new AppPathNotFoundException('Could not find web path for ' . $appId);
-		}
-		return $appWebPath;
-	}
-
-	/**
-	 * Clear the cached list of apps when enabling/disabling an app
-	 */
-	public function clearAppsCache(): void {
-		$this->appInfos = [];
-	}
-
-	/**
-	 * Returns a list of apps that need upgrade
-	 *
-	 * @param string $version Nextcloud version as array of version components
-	 * @return array list of app info from apps that need an upgrade
-	 *
-	 * @internal
-	 */
-	public function getAppsNeedingUpgrade($version) {
-		$appsToUpgrade = [];
-		$apps = $this->getEnabledApps();
-		foreach ($apps as $appId) {
-			$appInfo = $this->getAppInfo($appId);
-			$appDbVersion = $this->getAppConfig()->getValue($appId, 'installed_version');
-			if ($appDbVersion
-				&& isset($appInfo['version'])
-				&& version_compare($appInfo['version'], $appDbVersion, '>')
-				&& \OC_App::isAppCompatible($version, $appInfo)
-			) {
-				$appsToUpgrade[] = $appInfo;
-			}
-		}
-
-		return $appsToUpgrade;
-	}
-
-	/**
-	 * Returns the app information from "appinfo/info.xml".
-	 *
-	 * @param string|null $lang
-	 * @return array|null app info
-	 */
-	public function getAppInfo(string $appId, bool $path = false, $lang = null) {
-		if ($path) {
-			throw new \InvalidArgumentException('Calling IAppManager::getAppInfo() with a path is no longer supported. Please call IAppManager::getAppInfoByPath() instead and verify that the path is good before calling.');
-		}
-		if ($lang === null && isset($this->appInfos[$appId])) {
-			return $this->appInfos[$appId];
-		}
-		try {
-			$appPath = $this->getAppPath($appId);
-		} catch (AppPathNotFoundException) {
-			return null;
-		}
-		$file = $appPath . '/appinfo/info.xml';
-
-		$data = $this->getAppInfoByPath($file, $lang);
-
-		if ($lang === null) {
-			$this->appInfos[$appId] = $data;
-		}
-
-		return $data;
-	}
-
-	public function getAppInfoByPath(string $path, ?string $lang = null): ?array {
-		if (!str_ends_with($path, '/appinfo/info.xml')) {
-			return null;
-		}
-
-		$parser = new InfoParser($this->memCacheFactory->createLocal('core.appinfo'));
-		$data = $parser->parse($path);
-
-		if (is_array($data)) {
-			$data = \OC_App::parseAppInfo($data, $lang);
-		}
-
-		return $data;
-	}
-
-	public function getAppVersion(string $appId, bool $useCache = true): string {
-		if (!$useCache || !isset($this->appVersions[$appId])) {
-			if ($appId === 'core') {
-				$this->appVersions[$appId] = $this->serverVersion->getVersionString();
-			} else {
-				$appInfo = $this->getAppInfo($appId);
-				$this->appVersions[$appId] = ($appInfo !== null && isset($appInfo['version'])) ? $appInfo['version'] : '0';
-			}
-		}
-		return $this->appVersions[$appId];
-	}
-
-	/**
-	 * Returns the installed versions of all apps
-	 *
-	 * @return array<string, string>
-	 */
-	public function getAppInstalledVersions(): array {
-		return $this->getAppConfig()->getAppInstalledVersions();
-	}
-
-	/**
-	 * Returns a list of apps incompatible with the given version
-	 *
-	 * @param string $version Nextcloud version as array of version components
-	 *
-	 * @return array list of app info from incompatible apps
-	 *
-	 * @internal
-	 */
-	public function getIncompatibleApps(string $version): array {
-		$apps = $this->getEnabledApps();
-		$incompatibleApps = [];
-		foreach ($apps as $appId) {
-			$info = $this->getAppInfo($appId);
-			if ($info === null) {
-				$incompatibleApps[] = ['id' => $appId, 'name' => $appId];
-			} elseif (!\OC_App::isAppCompatible($version, $info)) {
-				$incompatibleApps[] = $info;
-			}
-		}
-		return $incompatibleApps;
-	}
-
-	/**
-	 * @inheritdoc
-	 * In case you change this method, also change \OC\App\CodeChecker\InfoChecker::isShipped()
-	 */
-	public function isShipped($appId) {
-		$this->loadShippedJson();
-		return in_array($appId, $this->shippedApps, true);
-	}
-
-	private function isAlwaysEnabled(string $appId): bool {
-		if ($appId === 'core') {
-			return true;
-		}
-
-		$alwaysEnabled = $this->getAlwaysEnabledApps();
-		return in_array($appId, $alwaysEnabled, true);
-	}
-
-	/**
-	 * In case you change this method, also change \OC\App\CodeChecker\InfoChecker::loadShippedJson()
-	 * @throws \Exception
-	 */
-	private function loadShippedJson(): void {
-		if ($this->shippedApps === null) {
-			$shippedJson = \OC::$SERVERROOT . '/core/shipped.json';
-			if (!file_exists($shippedJson)) {
-				throw new \Exception("File not found: $shippedJson");
-			}
-			$content = json_decode(file_get_contents($shippedJson), true);
-			$this->shippedApps = $content['shippedApps'];
-			$this->alwaysEnabled = $content['alwaysEnabled'];
-			$this->defaultEnabled = $content['defaultEnabled'];
-		}
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getAlwaysEnabledApps() {
-		$this->loadShippedJson();
-		return $this->alwaysEnabled;
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function isDefaultEnabled(string $appId): bool {
-		return (in_array($appId, $this->getDefaultEnabledApps()));
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getDefaultEnabledApps(): array {
-		$this->loadShippedJson();
-
-		return $this->defaultEnabled;
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getDefaultAppForUser(?IUser $user = null, bool $withFallbacks = true): string {
-		$id = $this->getNavigationManager()->getDefaultEntryIdForUser($user, $withFallbacks);
-		$entry = $this->getNavigationManager()->get($id);
-		return (string)$entry['app'];
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getDefaultApps(): array {
-		$ids = $this->getNavigationManager()->getDefaultEntryIds();
-
-		return array_values(array_unique(array_map(function (string $id) {
-			$entry = $this->getNavigationManager()->get($id);
-			return (string)$entry['app'];
-		}, $ids)));
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function setDefaultApps(array $defaultApps): void {
-		$entries = $this->getNavigationManager()->getAll();
-		$ids = [];
-		foreach ($defaultApps as $defaultApp) {
-			foreach ($entries as $entry) {
-				if ((string)$entry['app'] === $defaultApp) {
-					$ids[] = (string)$entry['id'];
-					break;
-				}
-			}
-		}
-		$this->getNavigationManager()->setDefaultEntryIds($ids);
-	}
-
-	public function isBackendRequired(string $backend): bool {
-		foreach ($this->appInfos as $appInfo) {
-			foreach ($appInfo['dependencies']['backend'] as $appBackend) {
-				if ($backend === $appBackend) {
-					return true;
-				}
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Clean the appId from forbidden characters
-	 *
-	 * @psalm-taint-escape callable
-	 * @psalm-taint-escape cookie
-	 * @psalm-taint-escape file
-	 * @psalm-taint-escape has_quotes
-	 * @psalm-taint-escape header
-	 * @psalm-taint-escape html
-	 * @psalm-taint-escape include
-	 * @psalm-taint-escape ldap
-	 * @psalm-taint-escape shell
-	 * @psalm-taint-escape sql
-	 * @psalm-taint-escape unserialize
-	 */
-	public function cleanAppId(string $app): string {
-		/* Only lowercase alphanumeric is allowed */
-		return preg_replace('/(^[0-9_]|[^a-z0-9_]+|_$)/', '', $app);
-	}
+    /**
+     * Apps with these types can not be enabled for certain groups only
+     * @var string[]
+     */
+    protected $protectedAppTypes = [
+        'filesystem',
+        'prelogin',
+        'authentication',
+        'logging',
+        'prevent_group_restriction',
+    ];
+
+    /** @var string[] $appId => $enabled */
+    private array $enabledAppsCache = [];
+
+    /** @var string[]|null */
+    private ?array $shippedApps = null;
+
+    private array $alwaysEnabled = [];
+    private array $defaultEnabled = [];
+
+    /** @var array */
+    private array $appInfos = [];
+
+    /** @var array */
+    private array $appVersions = [];
+
+    /** @var array */
+    private array $autoDisabledApps = [];
+    private array $appTypes = [];
+
+    /** @var array<string, true> */
+    private array $loadedApps = [];
+
+    private ?AppConfig $appConfig = null;
+    private ?IURLGenerator $urlGenerator = null;
+    private ?INavigationManager $navigationManager = null;
+
+    /**
+     * Be extremely careful when injecting classes here. The AppManager is used by the installer,
+     * so it needs to work before installation. See how AppConfig and IURLGenerator are injected for reference
+     */
+    public function __construct(
+        private IUserSession $userSession,
+        private IConfig $config,
+        private IGroupManager $groupManager,
+        private ICacheFactory $memCacheFactory,
+        private IEventDispatcher $dispatcher,
+        private LoggerInterface $logger,
+        private ServerVersion $serverVersion,
+    ) {
+    }
+
+    private function getNavigationManager(): INavigationManager {
+        if ($this->navigationManager === null) {
+            $this->navigationManager = \OCP\Server::get(INavigationManager::class);
+        }
+        return $this->navigationManager;
+    }
+
+    public function getAppIcon(string $appId, bool $dark = false): ?string {
+        $possibleIcons = $dark ? [$appId . '-dark.svg', 'app-dark.svg'] : [$appId . '.svg', 'app.svg'];
+        $icon = null;
+        foreach ($possibleIcons as $iconName) {
+            try {
+                $icon = $this->getUrlGenerator()->imagePath($appId, $iconName);
+                break;
+            } catch (\RuntimeException $e) {
+                // ignore
+            }
+        }
+        return $icon;
+    }
+
+    private function getAppConfig(): AppConfig {
+        if ($this->appConfig !== null) {
+            return $this->appConfig;
+        }
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            throw new \Exception('Nextcloud is not installed yet, AppConfig is not available');
+        }
+        $this->appConfig = \OCP\Server::get(AppConfig::class);
+        return $this->appConfig;
+    }
+
+    private function getUrlGenerator(): IURLGenerator {
+        if ($this->urlGenerator !== null) {
+            return $this->urlGenerator;
+        }
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            throw new \Exception('Nextcloud is not installed yet, AppConfig is not available');
+        }
+        $this->urlGenerator = \OCP\Server::get(IURLGenerator::class);
+        return $this->urlGenerator;
+    }
+
+    /**
+     * For all enabled apps, return the value of their 'enabled' config key.
+     *
+     * @return array<string,string> appId => enabled (may be 'yes', or a json encoded list of group ids)
+     */
+    private function getEnabledAppsValues(): array {
+        if (!$this->enabledAppsCache) {
+            $values = $this->getAppConfig()->getValues(false, 'enabled');
+
+            $alwaysEnabledApps = $this->getAlwaysEnabledApps();
+            foreach ($alwaysEnabledApps as $appId) {
+                $values[$appId] = 'yes';
+            }
+
+            $this->enabledAppsCache = array_filter($values, function ($value) {
+                return $value !== 'no';
+            });
+            ksort($this->enabledAppsCache);
+        }
+        return $this->enabledAppsCache;
+    }
+
+    /**
+     * Deprecated alias
+     *
+     * @return string[]
+     */
+    public function getInstalledApps() {
+        return $this->getEnabledApps();
+    }
+
+    /**
+     * List all enabled apps, either for everyone or for some groups
+     *
+     * @return list<string>
+     */
+    public function getEnabledApps(): array {
+        return array_keys($this->getEnabledAppsValues());
+    }
+
+    /**
+     * Get a list of all apps in the apps folder
+     *
+     * @return list<string> an array of app names (string IDs)
+     */
+    public function getAllAppsInAppsFolders(): array {
+        $apps = [];
+
+        foreach (\OC::$APPSROOTS as $apps_dir) {
+            if (!is_readable($apps_dir['path'])) {
+                $this->logger->warning('unable to read app folder : ' . $apps_dir['path'], ['app' => 'core']);
+                continue;
+            }
+            $dh = opendir($apps_dir['path']);
+
+            if (is_resource($dh)) {
+                while (($file = readdir($dh)) !== false) {
+                    if (
+                        $file[0] != '.' &&
+                        is_dir($apps_dir['path'] . '/' . $file) &&
+                        is_file($apps_dir['path'] . '/' . $file . '/appinfo/info.xml')
+                    ) {
+                        $apps[] = $file;
+                    }
+                }
+            }
+        }
+
+        return array_values(array_unique($apps));
+    }
+
+    /**
+     * List all apps enabled for a user
+     *
+     * @param \OCP\IUser $user
+     * @return string[]
+     */
+    public function getEnabledAppsForUser(IUser $user) {
+        $apps = $this->getEnabledAppsValues();
+        $appsForUser = array_filter($apps, function ($enabled) use ($user) {
+            return $this->checkAppForUser($enabled, $user);
+        });
+        return array_keys($appsForUser);
+    }
+
+    public function getEnabledAppsForGroup(IGroup $group): array {
+        $apps = $this->getEnabledAppsValues();
+        $appsForGroups = array_filter($apps, function ($enabled) use ($group) {
+            return $this->checkAppForGroups($enabled, $group);
+        });
+        return array_keys($appsForGroups);
+    }
+
+    /**
+     * Loads all apps
+     *
+     * @param string[] $types
+     * @return bool
+     *
+     * This function walks through the Nextcloud directory and loads all apps
+     * it can find. A directory contains an app if the file /appinfo/info.xml
+     * exists.
+     *
+     * if $types is set to non-empty array, only apps of those types will be loaded
+     */
+    public function loadApps(array $types = []): bool {
+        if ($this->config->getSystemValueBool('maintenance', false)) {
+            return false;
+        }
+        // Load the enabled apps here
+        $apps = \OC_App::getEnabledApps();
+
+        // Add each apps' folder as allowed class path
+        foreach ($apps as $app) {
+            // If the app is already loaded then autoloading it makes no sense
+            if (!$this->isAppLoaded($app)) {
+                $path = \OC_App::getAppPath($app);
+                if ($path !== false) {
+                    \OC_App::registerAutoloading($app, $path);
+                }
+            }
+        }
+
+        // prevent app loading from printing output
+        ob_start();
+        foreach ($apps as $app) {
+            if (!$this->isAppLoaded($app) && ($types === [] || $this->isType($app, $types))) {
+                try {
+                    $this->loadApp($app);
+                } catch (\Throwable $e) {
+                    $this->logger->emergency('Error during app loading: ' . $e->getMessage(), [
+                        'exception' => $e,
+                        'app' => $app,
+                    ]);
+                }
+            }
+        }
+        ob_end_clean();
+
+        return true;
+    }
+
+    /**
+     * check if an app is of a specific type
+     *
+     * @param string $app
+     * @param array $types
+     * @return bool
+     */
+    public function isType(string $app, array $types): bool {
+        $appTypes = $this->getAppTypes($app);
+        foreach ($types as $type) {
+            if (in_array($type, $appTypes, true)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * get the types of an app
+     *
+     * @param string $app
+     * @return string[]
+     */
+    private function getAppTypes(string $app): array {
+        //load the cache
+        if (count($this->appTypes) === 0) {
+            $this->appTypes = $this->getAppConfig()->getValues(false, 'types') ?: [];
+        }
+
+        if (isset($this->appTypes[$app])) {
+            return explode(',', $this->appTypes[$app]);
+        }
+
+        return [];
+    }
+
+    /**
+     * @return array
+     */
+    public function getAutoDisabledApps(): array {
+        return $this->autoDisabledApps;
+    }
+
+    public function getAppRestriction(string $appId): array {
+        $values = $this->getEnabledAppsValues();
+
+        if (!isset($values[$appId])) {
+            return [];
+        }
+
+        if ($values[$appId] === 'yes' || $values[$appId] === 'no') {
+            return [];
+        }
+        return json_decode($values[$appId], true);
+    }
+
+    /**
+     * Check if an app is enabled for user
+     *
+     * @param string $appId
+     * @param \OCP\IUser|null $user (optional) if not defined, the currently logged in user will be used
+     * @return bool
+     */
+    public function isEnabledForUser($appId, $user = null) {
+        if ($this->isAlwaysEnabled($appId)) {
+            return true;
+        }
+        if ($user === null) {
+            $user = $this->userSession->getUser();
+        }
+        $enabledAppsValues = $this->getEnabledAppsValues();
+        if (isset($enabledAppsValues[$appId])) {
+            return $this->checkAppForUser($enabledAppsValues[$appId], $user);
+        } else {
+            return false;
+        }
+    }
+
+    private function checkAppForUser(string $enabled, ?IUser $user): bool {
+        if ($enabled === 'yes') {
+            return true;
+        } elseif ($user === null) {
+            return false;
+        } else {
+            if (empty($enabled)) {
+                return false;
+            }
+
+            $groupIds = json_decode($enabled);
+
+            if (!is_array($groupIds)) {
+                $jsonError = json_last_error();
+                $jsonErrorMsg = json_last_error_msg();
+                // this really should never happen (if it does, the admin should check the `enabled` key value via `occ config:list` because it's bogus for some reason)
+                $this->logger->warning('AppManager::checkAppForUser - can\'t decode group IDs listed in app\'s enabled config key: ' . print_r($enabled, true) . ' - JSON error (' . $jsonError . ') ' . $jsonErrorMsg);
+                return false;
+            }
+
+            $userGroups = $this->groupManager->getUserGroupIds($user);
+            foreach ($userGroups as $groupId) {
+                if (in_array($groupId, $groupIds, true)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+
+    private function checkAppForGroups(string $enabled, IGroup $group): bool {
+        if ($enabled === 'yes') {
+            return true;
+        } else {
+            if (empty($enabled)) {
+                return false;
+            }
+
+            $groupIds = json_decode($enabled);
+
+            if (!is_array($groupIds)) {
+                $jsonError = json_last_error();
+                $jsonErrorMsg = json_last_error_msg();
+                // this really should never happen (if it does, the admin should check the `enabled` key value via `occ config:list` because it's bogus for some reason)
+                $this->logger->warning('AppManager::checkAppForGroups - can\'t decode group IDs listed in app\'s enabled config key: ' . print_r($enabled, true) . ' - JSON error (' . $jsonError . ') ' . $jsonErrorMsg);
+                return false;
+            }
+
+            return in_array($group->getGID(), $groupIds);
+        }
+    }
+
+    /**
+     * Check if an app is enabled in the instance
+     *
+     * Notice: This actually checks if the app is enabled and not only if it is installed.
+     *
+     * @param string $appId
+     */
+    public function isInstalled($appId): bool {
+        return $this->isEnabledForAnyone($appId);
+    }
+
+    public function isEnabledForAnyone(string $appId): bool {
+        $enabledAppsValues = $this->getEnabledAppsValues();
+        return isset($enabledAppsValues[$appId]);
+    }
+
+    /**
+     * Overwrite the `max-version` requirement for this app.
+     */
+    public function overwriteNextcloudRequirement(string $appId): void {
+        $ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
+        if (!in_array($appId, $ignoreMaxApps, true)) {
+            $ignoreMaxApps[] = $appId;
+        }
+        $this->config->setSystemValue('app_install_overwrite', $ignoreMaxApps);
+    }
+
+    /**
+     * Remove the `max-version` overwrite for this app.
+     * This means this app now again can not be enabled if the `max-version` is smaller than the current Nextcloud version.
+     */
+    public function removeOverwriteNextcloudRequirement(string $appId): void {
+        $ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
+        $ignoreMaxApps = array_filter($ignoreMaxApps, fn (string $id) => $id !== $appId);
+        $this->config->setSystemValue('app_install_overwrite', $ignoreMaxApps);
+    }
+
+    public function loadApp(string $app): void {
+        if (isset($this->loadedApps[$app])) {
+            return;
+        }
+        $this->loadedApps[$app] = true;
+        $appPath = \OC_App::getAppPath($app);
+        if ($appPath === false) {
+            return;
+        }
+        $eventLogger = \OC::$server->get(IEventLogger::class);
+        $eventLogger->start("bootstrap:load_app:$app", "Load app: $app");
+
+        // in case someone calls loadApp() directly
+        \OC_App::registerAutoloading($app, $appPath);
+
+        if (is_file($appPath . '/appinfo/app.php')) {
+            $this->logger->error('/appinfo/app.php is not supported anymore, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.', [
+                'app' => $app,
+            ]);
+        }
+
+        $coordinator = \OCP\Server::get(Coordinator::class);
+        $coordinator->bootApp($app);
+
+        $eventLogger->start("bootstrap:load_app:$app:info", "Load info.xml for $app and register any services defined in it");
+        $info = $this->getAppInfo($app);
+        if (!empty($info['activity'])) {
+            $activityManager = \OC::$server->get(IActivityManager::class);
+            if (!empty($info['activity']['filters'])) {
+                foreach ($info['activity']['filters'] as $filter) {
+                    $activityManager->registerFilter($filter);
+                }
+            }
+            if (!empty($info['activity']['settings'])) {
+                foreach ($info['activity']['settings'] as $setting) {
+                    $activityManager->registerSetting($setting);
+                }
+            }
+            if (!empty($info['activity']['providers'])) {
+                foreach ($info['activity']['providers'] as $provider) {
+                    $activityManager->registerProvider($provider);
+                }
+            }
+        }
+
+        if (!empty($info['settings'])) {
+            $settingsManager = \OC::$server->get(ISettingsManager::class);
+            if (!empty($info['settings']['admin'])) {
+                foreach ($info['settings']['admin'] as $setting) {
+                    $settingsManager->registerSetting('admin', $setting);
+                }
+            }
+            if (!empty($info['settings']['admin-section'])) {
+                foreach ($info['settings']['admin-section'] as $section) {
+                    $settingsManager->registerSection('admin', $section);
+                }
+            }
+            if (!empty($info['settings']['personal'])) {
+                foreach ($info['settings']['personal'] as $setting) {
+                    $settingsManager->registerSetting('personal', $setting);
+                }
+            }
+            if (!empty($info['settings']['personal-section'])) {
+                foreach ($info['settings']['personal-section'] as $section) {
+                    $settingsManager->registerSection('personal', $section);
+                }
+            }
+        }
+
+        if (!empty($info['collaboration']['plugins'])) {
+            // deal with one or many plugin entries
+            $plugins = isset($info['collaboration']['plugins']['plugin']['@value']) ?
+                [$info['collaboration']['plugins']['plugin']] : $info['collaboration']['plugins']['plugin'];
+            $collaboratorSearch = null;
+            $autoCompleteManager = null;
+            foreach ($plugins as $plugin) {
+                if ($plugin['@attributes']['type'] === 'collaborator-search') {
+                    $pluginInfo = [
+                        'shareType' => $plugin['@attributes']['share-type'],
+                        'class' => $plugin['@value'],
+                    ];
+                    $collaboratorSearch ??= \OC::$server->get(ICollaboratorSearch::class);
+                    $collaboratorSearch->registerPlugin($pluginInfo);
+                } elseif ($plugin['@attributes']['type'] === 'autocomplete-sort') {
+                    $autoCompleteManager ??= \OC::$server->get(IAutoCompleteManager::class);
+                    $autoCompleteManager->registerSorter($plugin['@value']);
+                }
+            }
+        }
+        $eventLogger->end("bootstrap:load_app:$app:info");
+
+        $eventLogger->end("bootstrap:load_app:$app");
+    }
+
+    /**
+     * Check if an app is loaded
+     * @param string $app app id
+     * @since 26.0.0
+     */
+    public function isAppLoaded(string $app): bool {
+        return isset($this->loadedApps[$app]);
+    }
+
+    /**
+     * Enable an app for every user
+     *
+     * @param string $appId
+     * @param bool $forceEnable
+     * @throws AppPathNotFoundException
+     * @throws \InvalidArgumentException if the application is not installed yet
+     */
+    public function enableApp(string $appId, bool $forceEnable = false): void {
+        // Check if app exists
+        $this->getAppPath($appId);
+
+        if ($this->config->getAppValue($appId, 'installed_version', '') === '') {
+            throw new \InvalidArgumentException("$appId is not installed, cannot be enabled.");
+        }
+
+        if ($forceEnable) {
+            $this->overwriteNextcloudRequirement($appId);
+        }
+
+        $this->enabledAppsCache[$appId] = 'yes';
+        $this->getAppConfig()->setValue($appId, 'enabled', 'yes');
+        $this->dispatcher->dispatchTyped(new AppEnableEvent($appId));
+        $this->dispatcher->dispatch(ManagerEvent::EVENT_APP_ENABLE, new ManagerEvent(
+            ManagerEvent::EVENT_APP_ENABLE, $appId
+        ));
+        $this->clearAppsCache();
+    }
+
+    /**
+     * Whether a list of types contains a protected app type
+     *
+     * @param string[] $types
+     * @return bool
+     */
+    public function hasProtectedAppType($types) {
+        if (empty($types)) {
+            return false;
+        }
+
+        $protectedTypes = array_intersect($this->protectedAppTypes, $types);
+        return !empty($protectedTypes);
+    }
+
+    /**
+     * Enable an app only for specific groups
+     *
+     * @param string $appId
+     * @param IGroup[] $groups
+     * @param bool $forceEnable
+     * @throws \InvalidArgumentException if app can't be enabled for groups
+     * @throws AppPathNotFoundException
+     */
+    public function enableAppForGroups(string $appId, array $groups, bool $forceEnable = false): void {
+        // Check if app exists
+        $this->getAppPath($appId);
+
+        $info = $this->getAppInfo($appId);
+        if (!empty($info['types']) && $this->hasProtectedAppType($info['types'])) {
+            throw new \InvalidArgumentException("$appId can't be enabled for groups.");
+        }
+
+        if ($this->config->getAppValue($appId, 'installed_version', '') === '') {
+            throw new \InvalidArgumentException("$appId is not installed, cannot be enabled.");
+        }
+
+        if ($forceEnable) {
+            $this->overwriteNextcloudRequirement($appId);
+        }
+
+        /** @var string[] $groupIds */
+        $groupIds = array_map(function ($group) {
+            /** @var IGroup $group */
+            return ($group instanceof IGroup)
+                ? $group->getGID()
+                : $group;
+        }, $groups);
+
+        $this->enabledAppsCache[$appId] = json_encode($groupIds);
+        $this->getAppConfig()->setValue($appId, 'enabled', json_encode($groupIds));
+        $this->dispatcher->dispatchTyped(new AppEnableEvent($appId, $groupIds));
+        $this->dispatcher->dispatch(ManagerEvent::EVENT_APP_ENABLE_FOR_GROUPS, new ManagerEvent(
+            ManagerEvent::EVENT_APP_ENABLE_FOR_GROUPS, $appId, $groups
+        ));
+        $this->clearAppsCache();
+    }
+
+    /**
+     * Disable an app for every user
+     *
+     * @param string $appId
+     * @param bool $automaticDisabled
+     * @throws \Exception if app can't be disabled
+     */
+    public function disableApp($appId, $automaticDisabled = false): void {
+        if ($this->isAlwaysEnabled($appId)) {
+            throw new \Exception("$appId can't be disabled.");
+        }
+
+        if ($automaticDisabled) {
+            $previousSetting = $this->getAppConfig()->getValue($appId, 'enabled', 'yes');
+            if ($previousSetting !== 'yes' && $previousSetting !== 'no') {
+                $previousSetting = json_decode($previousSetting, true);
+            }
+            $this->autoDisabledApps[$appId] = $previousSetting;
+        }
+
+        unset($this->enabledAppsCache[$appId]);
+        $this->getAppConfig()->setValue($appId, 'enabled', 'no');
+
+        // run uninstall steps
+        $appData = $this->getAppInfo($appId);
+        if (!is_null($appData)) {
+            \OC_App::executeRepairSteps($appId, $appData['repair-steps']['uninstall']);
+        }
+
+        $this->dispatcher->dispatchTyped(new AppDisableEvent($appId));
+        $this->dispatcher->dispatch(ManagerEvent::EVENT_APP_DISABLE, new ManagerEvent(
+            ManagerEvent::EVENT_APP_DISABLE, $appId
+        ));
+        $this->clearAppsCache();
+    }
+
+    /**
+     * Get the directory for the given app.
+     *
+     * @throws AppPathNotFoundException if app folder can't be found
+     */
+    public function getAppPath(string $appId): string {
+        $appPath = \OC_App::getAppPath($appId);
+        if ($appPath === false) {
+            throw new AppPathNotFoundException('Could not find path for ' . $appId);
+        }
+        return $appPath;
+    }
+
+    /**
+     * Get the web path for the given app.
+     *
+     * @param string $appId
+     * @return string
+     * @throws AppPathNotFoundException if app path can't be found
+     */
+    public function getAppWebPath(string $appId): string {
+        $appWebPath = \OC_App::getAppWebPath($appId);
+        if ($appWebPath === false) {
+            throw new AppPathNotFoundException('Could not find web path for ' . $appId);
+        }
+        return $appWebPath;
+    }
+
+    /**
+     * Clear the cached list of apps when enabling/disabling an app
+     */
+    public function clearAppsCache(): void {
+        $this->appInfos = [];
+    }
+
+    /**
+     * Returns a list of apps that need upgrade
+     *
+     * @param string $version Nextcloud version as array of version components
+     * @return array list of app info from apps that need an upgrade
+     *
+     * @internal
+     */
+    public function getAppsNeedingUpgrade($version) {
+        $appsToUpgrade = [];
+        $apps = $this->getEnabledApps();
+        foreach ($apps as $appId) {
+            $appInfo = $this->getAppInfo($appId);
+            $appDbVersion = $this->getAppConfig()->getValue($appId, 'installed_version');
+            if ($appDbVersion
+                && isset($appInfo['version'])
+                && version_compare($appInfo['version'], $appDbVersion, '>')
+                && \OC_App::isAppCompatible($version, $appInfo)
+            ) {
+                $appsToUpgrade[] = $appInfo;
+            }
+        }
+
+        return $appsToUpgrade;
+    }
+
+    /**
+     * Returns the app information from "appinfo/info.xml".
+     *
+     * @param string|null $lang
+     * @return array|null app info
+     */
+    public function getAppInfo(string $appId, bool $path = false, $lang = null) {
+        if ($path) {
+            throw new \InvalidArgumentException('Calling IAppManager::getAppInfo() with a path is no longer supported. Please call IAppManager::getAppInfoByPath() instead and verify that the path is good before calling.');
+        }
+        if ($lang === null && isset($this->appInfos[$appId])) {
+            return $this->appInfos[$appId];
+        }
+        try {
+            $appPath = $this->getAppPath($appId);
+        } catch (AppPathNotFoundException) {
+            return null;
+        }
+        $file = $appPath . '/appinfo/info.xml';
+
+        $data = $this->getAppInfoByPath($file, $lang);
+
+        if ($lang === null) {
+            $this->appInfos[$appId] = $data;
+        }
+
+        return $data;
+    }
+
+    public function getAppInfoByPath(string $path, ?string $lang = null): ?array {
+        if (!str_ends_with($path, '/appinfo/info.xml')) {
+            return null;
+        }
+
+        $parser = new InfoParser($this->memCacheFactory->createLocal('core.appinfo'));
+        $data = $parser->parse($path);
+
+        if (is_array($data)) {
+            $data = \OC_App::parseAppInfo($data, $lang);
+        }
+
+        return $data;
+    }
+
+    public function getAppVersion(string $appId, bool $useCache = true): string {
+        if (!$useCache || !isset($this->appVersions[$appId])) {
+            if ($appId === 'core') {
+                $this->appVersions[$appId] = $this->serverVersion->getVersionString();
+            } else {
+                $appInfo = $this->getAppInfo($appId);
+                $this->appVersions[$appId] = ($appInfo !== null && isset($appInfo['version'])) ? $appInfo['version'] : '0';
+            }
+        }
+        return $this->appVersions[$appId];
+    }
+
+    /**
+     * Returns the installed versions of all apps
+     *
+     * @return array<string, string>
+     */
+    public function getAppInstalledVersions(): array {
+        return $this->getAppConfig()->getAppInstalledVersions();
+    }
+
+    /**
+     * Returns a list of apps incompatible with the given version
+     *
+     * @param string $version Nextcloud version as array of version components
+     *
+     * @return array list of app info from incompatible apps
+     *
+     * @internal
+     */
+    public function getIncompatibleApps(string $version): array {
+        $apps = $this->getEnabledApps();
+        $incompatibleApps = [];
+        foreach ($apps as $appId) {
+            $info = $this->getAppInfo($appId);
+            if ($info === null) {
+                $incompatibleApps[] = ['id' => $appId, 'name' => $appId];
+            } elseif (!\OC_App::isAppCompatible($version, $info)) {
+                $incompatibleApps[] = $info;
+            }
+        }
+        return $incompatibleApps;
+    }
+
+    /**
+     * @inheritdoc
+     * In case you change this method, also change \OC\App\CodeChecker\InfoChecker::isShipped()
+     */
+    public function isShipped($appId) {
+        $this->loadShippedJson();
+        return in_array($appId, $this->shippedApps, true);
+    }
+
+    private function isAlwaysEnabled(string $appId): bool {
+        if ($appId === 'core') {
+            return true;
+        }
+
+        $alwaysEnabled = $this->getAlwaysEnabledApps();
+        return in_array($appId, $alwaysEnabled, true);
+    }
+
+    /**
+     * In case you change this method, also change \OC\App\CodeChecker\InfoChecker::loadShippedJson()
+     * @throws \Exception
+     */
+    private function loadShippedJson(): void {
+        if ($this->shippedApps === null) {
+            $shippedJson = \OC::$SERVERROOT . '/core/shipped.json';
+            if (!file_exists($shippedJson)) {
+                throw new \Exception("File not found: $shippedJson");
+            }
+            $content = json_decode(file_get_contents($shippedJson), true);
+            $this->shippedApps = $content['shippedApps'];
+            $this->alwaysEnabled = $content['alwaysEnabled'];
+            $this->defaultEnabled = $content['defaultEnabled'];
+        }
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAlwaysEnabledApps() {
+        $this->loadShippedJson();
+        return $this->alwaysEnabled;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function isDefaultEnabled(string $appId): bool {
+        return (in_array($appId, $this->getDefaultEnabledApps()));
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getDefaultEnabledApps(): array {
+        $this->loadShippedJson();
+
+        return $this->defaultEnabled;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getDefaultAppForUser(?IUser $user = null, bool $withFallbacks = true): string {
+        $id = $this->getNavigationManager()->getDefaultEntryIdForUser($user, $withFallbacks);
+        $entry = $this->getNavigationManager()->get($id);
+        return (string)$entry['app'];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getDefaultApps(): array {
+        $ids = $this->getNavigationManager()->getDefaultEntryIds();
+
+        return array_values(array_unique(array_map(function (string $id) {
+            $entry = $this->getNavigationManager()->get($id);
+            return (string)$entry['app'];
+        }, $ids)));
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function setDefaultApps(array $defaultApps): void {
+        $entries = $this->getNavigationManager()->getAll();
+        $ids = [];
+        foreach ($defaultApps as $defaultApp) {
+            foreach ($entries as $entry) {
+                if ((string)$entry['app'] === $defaultApp) {
+                    $ids[] = (string)$entry['id'];
+                    break;
+                }
+            }
+        }
+        $this->getNavigationManager()->setDefaultEntryIds($ids);
+    }
+
+    public function isBackendRequired(string $backend): bool {
+        foreach ($this->appInfos as $appInfo) {
+            foreach ($appInfo['dependencies']['backend'] as $appBackend) {
+                if ($backend === $appBackend) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Clean the appId from forbidden characters
+     *
+     * @psalm-taint-escape callable
+     * @psalm-taint-escape cookie
+     * @psalm-taint-escape file
+     * @psalm-taint-escape has_quotes
+     * @psalm-taint-escape header
+     * @psalm-taint-escape html
+     * @psalm-taint-escape include
+     * @psalm-taint-escape ldap
+     * @psalm-taint-escape shell
+     * @psalm-taint-escape sql
+     * @psalm-taint-escape unserialize
+     */
+    public function cleanAppId(string $app): string {
+        /* Only lowercase alphanumeric is allowed */
+        return preg_replace('/(^[0-9_]|[^a-z0-9_]+|_$)/', '', $app);
+    }
 }