nextcloud / server

apps/dav/lib/Connector/Sabre/ServerFactory.php

Indentation +196 added lines, -196 removed lines

@@ -44,200 +44,200 @@
 
 class ServerFactory {
 
-	public function __construct(
-		private IConfig $config,
-		private LoggerInterface $logger,
-		private IDBConnection $databaseConnection,
-		private IUserSession $userSession,
-		private IMountManager $mountManager,
-		private ITagManager $tagManager,
-		private IRequest $request,
-		private IPreview $previewManager,
-		private IEventDispatcher $eventDispatcher,
-		private IL10N $l10n,
-	) {
-	}
-
-	/**
-	 * @param callable $viewCallBack callback that should return the view for the dav endpoint
-	 */
-	public function createServer(
-		bool $isPublicShare,
-		string $baseUri,
-		string $requestUri,
-		Plugin $authPlugin,
-		callable $viewCallBack,
-	): Server {
-		// Fire up server
-		if ($isPublicShare) {
-			$rootCollection = new SimpleCollection('root');
-			$tree = new CachingTree($rootCollection);
-		} else {
-			$rootCollection = null;
-			$tree = new ObjectTree();
-		}
-		$server = new Server($tree);
-		// Set URL explicitly due to reverse-proxy situations
-		$server->httpRequest->setUrl($requestUri);
-		$server->setBaseUri($baseUri);
-
-		// Load plugins
-		$server->addPlugin(new MaintenancePlugin($this->config, $this->l10n));
-		$server->addPlugin(new BlockLegacyClientPlugin(
-			$this->config,
-			\OCP\Server::get(ThemingDefaults::class),
-		));
-		$server->addPlugin(new AnonymousOptionsPlugin());
-		$server->addPlugin($authPlugin);
-		// FIXME: The following line is a workaround for legacy components relying on being able to send a GET to /
-		$server->addPlugin(new DummyGetResponsePlugin());
-		$server->addPlugin(new ExceptionLoggerPlugin('webdav', $this->logger));
-		$server->addPlugin(new LockPlugin());
-
-		$server->addPlugin(new RequestIdHeaderPlugin($this->request));
-
-		$server->addPlugin(new ZipFolderPlugin(
-			$tree,
-			$this->logger,
-			$this->eventDispatcher,
-		));
-
-		// Some WebDAV clients do require Class 2 WebDAV support (locking), since
-		// we do not provide locking we emulate it using a fake locking plugin.
-		if ($this->request->isUserAgent([
-			'/WebDAVFS/',
-			'/OneNote/',
-			'/Microsoft-WebDAV-MiniRedir/',
-		])) {
-			$server->addPlugin(new FakeLockerPlugin());
-		}
-
-		if (BrowserErrorPagePlugin::isBrowserRequest($this->request)) {
-			$server->addPlugin(new BrowserErrorPagePlugin());
-		}
-
-		// wait with registering these until auth is handled and the filesystem is setup
-		$server->on('beforeMethod:*', function () use ($server, $tree, $viewCallBack, $isPublicShare, $rootCollection): void {
-			// ensure the skeleton is copied
-			$userFolder = \OC::$server->getUserFolder();
-
-			/** @var View $view */
-			$view = $viewCallBack($server);
-			if ($userFolder instanceof Folder && $userFolder->getPath() === $view->getRoot()) {
-				$rootInfo = $userFolder;
-			} else {
-				$rootInfo = $view->getFileInfo('');
-			}
-
-			// Create Nextcloud Dir
-			if ($rootInfo->getType() === 'dir') {
-				$root = new Directory($view, $rootInfo, $tree);
-			} else {
-				$root = new File($view, $rootInfo);
-			}
-
-			if ($isPublicShare) {
-				$userPrincipalBackend = new Principal(
-					\OCP\Server::get(IUserManager::class),
-					\OCP\Server::get(IGroupManager::class),
-					\OCP\Server::get(IAccountManager::class),
-					\OCP\Server::get(\OCP\Share\IManager::class),
-					\OCP\Server::get(IUserSession::class),
-					\OCP\Server::get(IAppManager::class),
-					\OCP\Server::get(ProxyMapper::class),
-					\OCP\Server::get(KnownUserService::class),
-					\OCP\Server::get(IConfig::class),
-					\OC::$server->getL10NFactory(),
-				);
-
-				// Mount the share collection at /public.php/dav/shares/<share token>
-				$rootCollection->addChild(new RootCollection(
-					$root,
-					$userPrincipalBackend,
-					'principals/shares',
-				));
-
-				// Mount the upload collection at /public.php/dav/uploads/<share token>
-				$rootCollection->addChild(new \OCA\DAV\Upload\RootCollection(
-					$userPrincipalBackend,
-					'principals/shares',
-					\OCP\Server::get(CleanupService::class),
-					\OCP\Server::get(IRootFolder::class),
-					\OCP\Server::get(IUserSession::class),
-					\OCP\Server::get(\OCP\Share\IManager::class),
-				));
-			} else {
-				/** @var ObjectTree $tree */
-				$tree->init($root, $view, $this->mountManager);
-			}
-
-			$server->addPlugin(
-				new FilesPlugin(
-					$tree,
-					$this->config,
-					$this->request,
-					$this->previewManager,
-					$this->userSession,
-					\OCP\Server::get(IFilenameValidator::class),
-					\OCP\Server::get(IAccountManager::class),
-					false,
-					!$this->config->getSystemValue('debug', false)
-				)
-			);
-			$server->addPlugin(new QuotaPlugin($view, true));
-			$server->addPlugin(new ChecksumUpdatePlugin());
-
-			// Allow view-only plugin for webdav requests
-			$server->addPlugin(new ViewOnlyPlugin(
-				$userFolder,
-			));
-
-			if ($this->userSession->isLoggedIn()) {
-				$server->addPlugin(new TagsPlugin($tree, $this->tagManager, $this->eventDispatcher, $this->userSession));
-				$server->addPlugin(new SharesPlugin(
-					$tree,
-					$this->userSession,
-					$userFolder,
-					\OCP\Server::get(\OCP\Share\IManager::class)
-				));
-				$server->addPlugin(new CommentPropertiesPlugin(\OCP\Server::get(ICommentsManager::class), $this->userSession));
-				$server->addPlugin(new FilesReportPlugin(
-					$tree,
-					$view,
-					\OCP\Server::get(ISystemTagManager::class),
-					\OCP\Server::get(ISystemTagObjectMapper::class),
-					\OCP\Server::get(ITagManager::class),
-					$this->userSession,
-					\OCP\Server::get(IGroupManager::class),
-					$userFolder,
-					\OCP\Server::get(IAppManager::class)
-				));
-				// custom properties plugin must be the last one
-				$server->addPlugin(
-					new \Sabre\DAV\PropertyStorage\Plugin(
-						new CustomPropertiesBackend(
-							$server,
-							$tree,
-							$this->databaseConnection,
-							$this->userSession->getUser(),
-							\OCP\Server::get(DefaultCalendarValidator::class),
-						)
-					)
-				);
-			}
-			$server->addPlugin(new CopyEtagHeaderPlugin());
-
-			// Load dav plugins from apps
-			$event = new SabrePluginEvent($server);
-			$this->eventDispatcher->dispatchTyped($event);
-			$pluginManager = new PluginManager(
-				\OC::$server,
-				\OCP\Server::get(IAppManager::class)
-			);
-			foreach ($pluginManager->getAppPlugins() as $appPlugin) {
-				$server->addPlugin($appPlugin);
-			}
-		}, 30); // priority 30: after auth (10) and acl(20), before lock(50) and handling the request
-		return $server;
-	}
+    public function __construct(
+        private IConfig $config,
+        private LoggerInterface $logger,
+        private IDBConnection $databaseConnection,
+        private IUserSession $userSession,
+        private IMountManager $mountManager,
+        private ITagManager $tagManager,
+        private IRequest $request,
+        private IPreview $previewManager,
+        private IEventDispatcher $eventDispatcher,
+        private IL10N $l10n,
+    ) {
+    }
+
+    /**
+     * @param callable $viewCallBack callback that should return the view for the dav endpoint
+     */
+    public function createServer(
+        bool $isPublicShare,
+        string $baseUri,
+        string $requestUri,
+        Plugin $authPlugin,
+        callable $viewCallBack,
+    ): Server {
+        // Fire up server
+        if ($isPublicShare) {
+            $rootCollection = new SimpleCollection('root');
+            $tree = new CachingTree($rootCollection);
+        } else {
+            $rootCollection = null;
+            $tree = new ObjectTree();
+        }
+        $server = new Server($tree);
+        // Set URL explicitly due to reverse-proxy situations
+        $server->httpRequest->setUrl($requestUri);
+        $server->setBaseUri($baseUri);
+
+        // Load plugins
+        $server->addPlugin(new MaintenancePlugin($this->config, $this->l10n));
+        $server->addPlugin(new BlockLegacyClientPlugin(
+            $this->config,
+            \OCP\Server::get(ThemingDefaults::class),
+        ));
+        $server->addPlugin(new AnonymousOptionsPlugin());
+        $server->addPlugin($authPlugin);
+        // FIXME: The following line is a workaround for legacy components relying on being able to send a GET to /
+        $server->addPlugin(new DummyGetResponsePlugin());
+        $server->addPlugin(new ExceptionLoggerPlugin('webdav', $this->logger));
+        $server->addPlugin(new LockPlugin());
+
+        $server->addPlugin(new RequestIdHeaderPlugin($this->request));
+
+        $server->addPlugin(new ZipFolderPlugin(
+            $tree,
+            $this->logger,
+            $this->eventDispatcher,
+        ));
+
+        // Some WebDAV clients do require Class 2 WebDAV support (locking), since
+        // we do not provide locking we emulate it using a fake locking plugin.
+        if ($this->request->isUserAgent([
+            '/WebDAVFS/',
+            '/OneNote/',
+            '/Microsoft-WebDAV-MiniRedir/',
+        ])) {
+            $server->addPlugin(new FakeLockerPlugin());
+        }
+
+        if (BrowserErrorPagePlugin::isBrowserRequest($this->request)) {
+            $server->addPlugin(new BrowserErrorPagePlugin());
+        }
+
+        // wait with registering these until auth is handled and the filesystem is setup
+        $server->on('beforeMethod:*', function () use ($server, $tree, $viewCallBack, $isPublicShare, $rootCollection): void {
+            // ensure the skeleton is copied
+            $userFolder = \OC::$server->getUserFolder();
+
+            /** @var View $view */
+            $view = $viewCallBack($server);
+            if ($userFolder instanceof Folder && $userFolder->getPath() === $view->getRoot()) {
+                $rootInfo = $userFolder;
+            } else {
+                $rootInfo = $view->getFileInfo('');
+            }
+
+            // Create Nextcloud Dir
+            if ($rootInfo->getType() === 'dir') {
+                $root = new Directory($view, $rootInfo, $tree);
+            } else {
+                $root = new File($view, $rootInfo);
+            }
+
+            if ($isPublicShare) {
+                $userPrincipalBackend = new Principal(
+                    \OCP\Server::get(IUserManager::class),
+                    \OCP\Server::get(IGroupManager::class),
+                    \OCP\Server::get(IAccountManager::class),
+                    \OCP\Server::get(\OCP\Share\IManager::class),
+                    \OCP\Server::get(IUserSession::class),
+                    \OCP\Server::get(IAppManager::class),
+                    \OCP\Server::get(ProxyMapper::class),
+                    \OCP\Server::get(KnownUserService::class),
+                    \OCP\Server::get(IConfig::class),
+                    \OC::$server->getL10NFactory(),
+                );
+
+                // Mount the share collection at /public.php/dav/shares/<share token>
+                $rootCollection->addChild(new RootCollection(
+                    $root,
+                    $userPrincipalBackend,
+                    'principals/shares',
+                ));
+
+                // Mount the upload collection at /public.php/dav/uploads/<share token>
+                $rootCollection->addChild(new \OCA\DAV\Upload\RootCollection(
+                    $userPrincipalBackend,
+                    'principals/shares',
+                    \OCP\Server::get(CleanupService::class),
+                    \OCP\Server::get(IRootFolder::class),
+                    \OCP\Server::get(IUserSession::class),
+                    \OCP\Server::get(\OCP\Share\IManager::class),
+                ));
+            } else {
+                /** @var ObjectTree $tree */
+                $tree->init($root, $view, $this->mountManager);
+            }
+
+            $server->addPlugin(
+                new FilesPlugin(
+                    $tree,
+                    $this->config,
+                    $this->request,
+                    $this->previewManager,
+                    $this->userSession,
+                    \OCP\Server::get(IFilenameValidator::class),
+                    \OCP\Server::get(IAccountManager::class),
+                    false,
+                    !$this->config->getSystemValue('debug', false)
+                )
+            );
+            $server->addPlugin(new QuotaPlugin($view, true));
+            $server->addPlugin(new ChecksumUpdatePlugin());
+
+            // Allow view-only plugin for webdav requests
+            $server->addPlugin(new ViewOnlyPlugin(
+                $userFolder,
+            ));
+
+            if ($this->userSession->isLoggedIn()) {
+                $server->addPlugin(new TagsPlugin($tree, $this->tagManager, $this->eventDispatcher, $this->userSession));
+                $server->addPlugin(new SharesPlugin(
+                    $tree,
+                    $this->userSession,
+                    $userFolder,
+                    \OCP\Server::get(\OCP\Share\IManager::class)
+                ));
+                $server->addPlugin(new CommentPropertiesPlugin(\OCP\Server::get(ICommentsManager::class), $this->userSession));
+                $server->addPlugin(new FilesReportPlugin(
+                    $tree,
+                    $view,
+                    \OCP\Server::get(ISystemTagManager::class),
+                    \OCP\Server::get(ISystemTagObjectMapper::class),
+                    \OCP\Server::get(ITagManager::class),
+                    $this->userSession,
+                    \OCP\Server::get(IGroupManager::class),
+                    $userFolder,
+                    \OCP\Server::get(IAppManager::class)
+                ));
+                // custom properties plugin must be the last one
+                $server->addPlugin(
+                    new \Sabre\DAV\PropertyStorage\Plugin(
+                        new CustomPropertiesBackend(
+                            $server,
+                            $tree,
+                            $this->databaseConnection,
+                            $this->userSession->getUser(),
+                            \OCP\Server::get(DefaultCalendarValidator::class),
+                        )
+                    )
+                );
+            }
+            $server->addPlugin(new CopyEtagHeaderPlugin());
+
+            // Load dav plugins from apps
+            $event = new SabrePluginEvent($server);
+            $this->eventDispatcher->dispatchTyped($event);
+            $pluginManager = new PluginManager(
+                \OC::$server,
+                \OCP\Server::get(IAppManager::class)
+            );
+            foreach ($pluginManager->getAppPlugins() as $appPlugin) {
+                $server->addPlugin($appPlugin);
+            }
+        }, 30); // priority 30: after auth (10) and acl(20), before lock(50) and handling the request
+        return $server;
+    }
 }

apps/dav/lib/CalDAV/ResourceBooking/AbstractPrincipalBackend.php

Indentation +465 added lines, -465 removed lines

@@ -25,469 +25,469 @@
 
 abstract class AbstractPrincipalBackend implements BackendInterface {
 
-	/** @var string */
-	private $dbTableName;
-
-	/** @var string */
-	private $dbMetaDataTableName;
-
-	/** @var string */
-	private $dbForeignKeyName;
-
-	public function __construct(
-		private IDBConnection $db,
-		private IUserSession $userSession,
-		private IGroupManager $groupManager,
-		private LoggerInterface $logger,
-		private ProxyMapper $proxyMapper,
-		private string $principalPrefix,
-		string $dbPrefix,
-		private string $cuType,
-	) {
-		$this->dbTableName = 'calendar_' . $dbPrefix . 's';
-		$this->dbMetaDataTableName = $this->dbTableName . '_md';
-		$this->dbForeignKeyName = $dbPrefix . '_id';
-	}
-
-	use PrincipalProxyTrait;
-
-	/**
-	 * Returns a list of principals based on a prefix.
-	 *
-	 * This prefix will often contain something like 'principals'. You are only
-	 * expected to return principals that are in this base path.
-	 *
-	 * You are expected to return at least a 'uri' for every user, you can
-	 * return any additional properties if you wish so. Common properties are:
-	 *   {DAV:}displayname
-	 *
-	 * @param string $prefixPath
-	 * @return string[]
-	 */
-	public function getPrincipalsByPrefix($prefixPath): array {
-		$principals = [];
-
-		if ($prefixPath === $this->principalPrefix) {
-			$query = $this->db->getQueryBuilder();
-			$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
-				->from($this->dbTableName);
-			$stmt = $query->execute();
-
-			$metaDataQuery = $this->db->getQueryBuilder();
-			$metaDataQuery->select([$this->dbForeignKeyName, 'key', 'value'])
-				->from($this->dbMetaDataTableName);
-			$metaDataStmt = $metaDataQuery->execute();
-			$metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
-
-			$metaDataById = [];
-			foreach ($metaDataRows as $metaDataRow) {
-				if (!isset($metaDataById[$metaDataRow[$this->dbForeignKeyName]])) {
-					$metaDataById[$metaDataRow[$this->dbForeignKeyName]] = [];
-				}
-
-				$metaDataById[$metaDataRow[$this->dbForeignKeyName]][$metaDataRow['key']] =
-					$metaDataRow['value'];
-			}
-
-			while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
-				$id = $row['id'];
-
-				if (isset($metaDataById[$id])) {
-					$principals[] = $this->rowToPrincipal($row, $metaDataById[$id]);
-				} else {
-					$principals[] = $this->rowToPrincipal($row);
-				}
-			}
-
-			$stmt->closeCursor();
-		}
-
-		return $principals;
-	}
-
-	/**
-	 * Returns a specific principal, specified by its path.
-	 * The returned structure should be the exact same as from
-	 * getPrincipalsByPrefix.
-	 *
-	 * @param string $prefixPath
-	 *
-	 * @return array
-	 */
-	public function getPrincipalByPath($path) {
-		if (!str_starts_with($path, $this->principalPrefix)) {
-			return null;
-		}
-		[, $name] = \Sabre\Uri\split($path);
-
-		[$backendId, $resourceId] = explode('-', $name, 2);
-
-		$query = $this->db->getQueryBuilder();
-		$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
-			->from($this->dbTableName)
-			->where($query->expr()->eq('backend_id', $query->createNamedParameter($backendId)))
-			->andWhere($query->expr()->eq('resource_id', $query->createNamedParameter($resourceId)));
-		$stmt = $query->execute();
-		$row = $stmt->fetch(\PDO::FETCH_ASSOC);
-
-		if (!$row) {
-			return null;
-		}
-
-		$metaDataQuery = $this->db->getQueryBuilder();
-		$metaDataQuery->select(['key', 'value'])
-			->from($this->dbMetaDataTableName)
-			->where($metaDataQuery->expr()->eq($this->dbForeignKeyName, $metaDataQuery->createNamedParameter($row['id'])));
-		$metaDataStmt = $metaDataQuery->execute();
-		$metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
-		$metadata = [];
-
-		foreach ($metaDataRows as $metaDataRow) {
-			$metadata[$metaDataRow['key']] = $metaDataRow['value'];
-		}
-
-		return $this->rowToPrincipal($row, $metadata);
-	}
-
-	/**
-	 * @param int $id
-	 * @return string[]|null
-	 */
-	public function getPrincipalById($id): ?array {
-		$query = $this->db->getQueryBuilder();
-		$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
-			->from($this->dbTableName)
-			->where($query->expr()->eq('id', $query->createNamedParameter($id)));
-		$stmt = $query->execute();
-		$row = $stmt->fetch(\PDO::FETCH_ASSOC);
-
-		if (!$row) {
-			return null;
-		}
-
-		$metaDataQuery = $this->db->getQueryBuilder();
-		$metaDataQuery->select(['key', 'value'])
-			->from($this->dbMetaDataTableName)
-			->where($metaDataQuery->expr()->eq($this->dbForeignKeyName, $metaDataQuery->createNamedParameter($row['id'])));
-		$metaDataStmt = $metaDataQuery->execute();
-		$metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
-		$metadata = [];
-
-		foreach ($metaDataRows as $metaDataRow) {
-			$metadata[$metaDataRow['key']] = $metaDataRow['value'];
-		}
-
-		return $this->rowToPrincipal($row, $metadata);
-	}
-
-	/**
-	 * @param string $path
-	 * @param PropPatch $propPatch
-	 * @return int
-	 */
-	public function updatePrincipal($path, PropPatch $propPatch): int {
-		return 0;
-	}
-
-	/**
-	 * @param string $prefixPath
-	 * @param string $test
-	 *
-	 * @return array
-	 */
-	public function searchPrincipals($prefixPath, array $searchProperties, $test = 'allof') {
-		$results = [];
-		if (\count($searchProperties) === 0) {
-			return [];
-		}
-		if ($prefixPath !== $this->principalPrefix) {
-			return [];
-		}
-
-		$user = $this->userSession->getUser();
-		if (!$user) {
-			return [];
-		}
-		$usersGroups = $this->groupManager->getUserGroupIds($user);
-
-		foreach ($searchProperties as $prop => $value) {
-			switch ($prop) {
-				case '{http://sabredav.org/ns}email-address':
-					$query = $this->db->getQueryBuilder();
-					$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
-						->from($this->dbTableName)
-						->where($query->expr()->iLike('email', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
-
-					$stmt = $query->execute();
-					$principals = [];
-					while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
-						if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
-							continue;
-						}
-						$principals[] = $this->rowToPrincipal($row)['uri'];
-					}
-					$results[] = $principals;
-
-					$stmt->closeCursor();
-					break;
-
-				case '{DAV:}displayname':
-					$query = $this->db->getQueryBuilder();
-					$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
-						->from($this->dbTableName)
-						->where($query->expr()->iLike('displayname', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
-
-					$stmt = $query->execute();
-					$principals = [];
-					while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
-						if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
-							continue;
-						}
-						$principals[] = $this->rowToPrincipal($row)['uri'];
-					}
-					$results[] = $principals;
-
-					$stmt->closeCursor();
-					break;
-
-				case '{urn:ietf:params:xml:ns:caldav}calendar-user-address-set':
-					// If you add support for more search properties that qualify as a user-address,
-					// please also add them to the array below
-					$results[] = $this->searchPrincipals($this->principalPrefix, [
-						'{http://sabredav.org/ns}email-address' => $value,
-					], 'anyof');
-					break;
-
-				case IRoomMetadata::FEATURES:
-					$results[] = $this->searchPrincipalsByRoomFeature($prop, $value);
-					break;
-
-				case IRoomMetadata::CAPACITY:
-				case IResourceMetadata::VEHICLE_SEATING_CAPACITY:
-					$results[] = $this->searchPrincipalsByCapacity($prop, $value);
-					break;
-
-				default:
-					$results[] = $this->searchPrincipalsByMetadataKey($prop, $value, $usersGroups);
-					break;
-			}
-		}
-
-		// results is an array of arrays, so this is not the first search result
-		// but the results of the first searchProperty
-		if (count($results) === 1) {
-			return $results[0];
-		}
-
-		switch ($test) {
-			case 'anyof':
-				return array_values(array_unique(array_merge(...$results)));
-
-			case 'allof':
-			default:
-				return array_values(array_intersect(...$results));
-		}
-	}
-
-	/**
-	 * @param string $key
-	 * @return IQueryBuilder
-	 */
-	private function getMetadataQuery(string $key): IQueryBuilder {
-		$query = $this->db->getQueryBuilder();
-		$query->select([$this->dbForeignKeyName])
-			->from($this->dbMetaDataTableName)
-			->where($query->expr()->eq('key', $query->createNamedParameter($key)));
-		return $query;
-	}
-
-	/**
-	 * Searches principals based on their metadata keys.
-	 * This allows to search for all principals with a specific key.
-	 * e.g.:
-	 * '{http://nextcloud.com/ns}room-building-address' => 'ABC Street 123, ...'
-	 *
-	 * @param string $key
-	 * @param string $value
-	 * @param string[] $usersGroups
-	 * @return string[]
-	 */
-	private function searchPrincipalsByMetadataKey(string $key, string $value, array $usersGroups = []): array {
-		$query = $this->getMetadataQuery($key);
-		$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
-		return $this->getRows($query, $usersGroups);
-	}
-
-	/**
-	 * Searches principals based on room features
-	 * e.g.:
-	 * '{http://nextcloud.com/ns}room-features' => 'TV,PROJECTOR'
-	 *
-	 * @param string $key
-	 * @param string $value
-	 * @param string[] $usersGroups
-	 * @return string[]
-	 */
-	private function searchPrincipalsByRoomFeature(string $key, string $value, array $usersGroups = []): array {
-		$query = $this->getMetadataQuery($key);
-		foreach (explode(',', $value) as $v) {
-			$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($v) . '%')));
-		}
-		return $this->getRows($query, $usersGroups);
-	}
-
-	/**
-	 * Searches principals based on room seating capacity or vehicle capacity
-	 * e.g.:
-	 * '{http://nextcloud.com/ns}room-seating-capacity' => '100'
-	 *
-	 * @param string $key
-	 * @param string $value
-	 * @param string[] $usersGroups
-	 * @return string[]
-	 */
-	private function searchPrincipalsByCapacity(string $key, string $value, array $usersGroups = []): array {
-		$query = $this->getMetadataQuery($key);
-		$query->andWhere($query->expr()->gte('value', $query->createNamedParameter($value)));
-		return $this->getRows($query, $usersGroups);
-	}
-
-	/**
-	 * @param IQueryBuilder $query
-	 * @param string[] $usersGroups
-	 * @return string[]
-	 */
-	private function getRows(IQueryBuilder $query, array $usersGroups): array {
-		try {
-			$stmt = $query->executeQuery();
-		} catch (Exception $e) {
-			$this->logger->error('Could not search resources: ' . $e->getMessage(), ['exception' => $e]);
-		}
-
-		$rows = [];
-		while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
-			$principalRow = $this->getPrincipalById($row[$this->dbForeignKeyName]);
-			if (!$principalRow) {
-				continue;
-			}
-
-			$rows[] = $principalRow;
-		}
-
-		$stmt->closeCursor();
-
-		$filteredRows = array_filter($rows, function ($row) use ($usersGroups) {
-			return $this->isAllowedToAccessResource($row, $usersGroups);
-		});
-
-		return array_map(static function ($row): string {
-			return $row['uri'];
-		}, $filteredRows);
-	}
-
-	/**
-	 * @param string $uri
-	 * @param string $principalPrefix
-	 * @return null|string
-	 * @throws Exception
-	 */
-	public function findByUri($uri, $principalPrefix): ?string {
-		$user = $this->userSession->getUser();
-		if (!$user) {
-			return null;
-		}
-		$usersGroups = $this->groupManager->getUserGroupIds($user);
-
-		if (str_starts_with($uri, 'mailto:')) {
-			$email = substr($uri, 7);
-			$query = $this->db->getQueryBuilder();
-			$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
-				->from($this->dbTableName)
-				->where($query->expr()->eq('email', $query->createNamedParameter($email)));
-
-			$stmt = $query->execute();
-			$row = $stmt->fetch(\PDO::FETCH_ASSOC);
-
-			if (!$row) {
-				return null;
-			}
-			if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
-				return null;
-			}
-
-			return $this->rowToPrincipal($row)['uri'];
-		}
-
-		if (str_starts_with($uri, 'principal:')) {
-			$path = substr($uri, 10);
-			if (!str_starts_with($path, $this->principalPrefix)) {
-				return null;
-			}
-
-			[, $name] = \Sabre\Uri\split($path);
-			[$backendId, $resourceId] = explode('-', $name, 2);
-
-			$query = $this->db->getQueryBuilder();
-			$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
-				->from($this->dbTableName)
-				->where($query->expr()->eq('backend_id', $query->createNamedParameter($backendId)))
-				->andWhere($query->expr()->eq('resource_id', $query->createNamedParameter($resourceId)));
-			$stmt = $query->execute();
-			$row = $stmt->fetch(\PDO::FETCH_ASSOC);
-
-			if (!$row) {
-				return null;
-			}
-			if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
-				return null;
-			}
-
-			return $this->rowToPrincipal($row)['uri'];
-		}
-
-		return null;
-	}
-
-	/**
-	 * convert database row to principal
-	 *
-	 * @param string[] $row
-	 * @param string[] $metadata
-	 * @return string[]
-	 */
-	private function rowToPrincipal(array $row, array $metadata = []): array {
-		return array_merge([
-			'uri' => $this->principalPrefix . '/' . $row['backend_id'] . '-' . $row['resource_id'],
-			'{DAV:}displayname' => $row['displayname'],
-			'{http://sabredav.org/ns}email-address' => $row['email'],
-			'{urn:ietf:params:xml:ns:caldav}calendar-user-type' => $this->cuType,
-		], $metadata);
-	}
-
-	/**
-	 * @param array $row
-	 * @param array $userGroups
-	 * @return bool
-	 */
-	private function isAllowedToAccessResource(array $row, array $userGroups): bool {
-		if (!isset($row['group_restrictions']) ||
-			$row['group_restrictions'] === null ||
-			$row['group_restrictions'] === '') {
-			return true;
-		}
-
-		// group restrictions contains something, but not parsable, deny access and log warning
-		$json = json_decode($row['group_restrictions'], null, 512, JSON_THROW_ON_ERROR);
-		if (!\is_array($json)) {
-			$this->logger->info('group_restrictions field could not be parsed for ' . $this->dbTableName . '::' . $row['id'] . ', denying access to resource');
-			return false;
-		}
-
-		// empty array => no group restrictions
-		if (empty($json)) {
-			return true;
-		}
-
-		return !empty(array_intersect($json, $userGroups));
-	}
+    /** @var string */
+    private $dbTableName;
+
+    /** @var string */
+    private $dbMetaDataTableName;
+
+    /** @var string */
+    private $dbForeignKeyName;
+
+    public function __construct(
+        private IDBConnection $db,
+        private IUserSession $userSession,
+        private IGroupManager $groupManager,
+        private LoggerInterface $logger,
+        private ProxyMapper $proxyMapper,
+        private string $principalPrefix,
+        string $dbPrefix,
+        private string $cuType,
+    ) {
+        $this->dbTableName = 'calendar_' . $dbPrefix . 's';
+        $this->dbMetaDataTableName = $this->dbTableName . '_md';
+        $this->dbForeignKeyName = $dbPrefix . '_id';
+    }
+
+    use PrincipalProxyTrait;
+
+    /**
+     * Returns a list of principals based on a prefix.
+     *
+     * This prefix will often contain something like 'principals'. You are only
+     * expected to return principals that are in this base path.
+     *
+     * You are expected to return at least a 'uri' for every user, you can
+     * return any additional properties if you wish so. Common properties are:
+     *   {DAV:}displayname
+     *
+     * @param string $prefixPath
+     * @return string[]
+     */
+    public function getPrincipalsByPrefix($prefixPath): array {
+        $principals = [];
+
+        if ($prefixPath === $this->principalPrefix) {
+            $query = $this->db->getQueryBuilder();
+            $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
+                ->from($this->dbTableName);
+            $stmt = $query->execute();
+
+            $metaDataQuery = $this->db->getQueryBuilder();
+            $metaDataQuery->select([$this->dbForeignKeyName, 'key', 'value'])
+                ->from($this->dbMetaDataTableName);
+            $metaDataStmt = $metaDataQuery->execute();
+            $metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
+
+            $metaDataById = [];
+            foreach ($metaDataRows as $metaDataRow) {
+                if (!isset($metaDataById[$metaDataRow[$this->dbForeignKeyName]])) {
+                    $metaDataById[$metaDataRow[$this->dbForeignKeyName]] = [];
+                }
+
+                $metaDataById[$metaDataRow[$this->dbForeignKeyName]][$metaDataRow['key']] =
+                    $metaDataRow['value'];
+            }
+
+            while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
+                $id = $row['id'];
+
+                if (isset($metaDataById[$id])) {
+                    $principals[] = $this->rowToPrincipal($row, $metaDataById[$id]);
+                } else {
+                    $principals[] = $this->rowToPrincipal($row);
+                }
+            }
+
+            $stmt->closeCursor();
+        }
+
+        return $principals;
+    }
+
+    /**
+     * Returns a specific principal, specified by its path.
+     * The returned structure should be the exact same as from
+     * getPrincipalsByPrefix.
+     *
+     * @param string $prefixPath
+     *
+     * @return array
+     */
+    public function getPrincipalByPath($path) {
+        if (!str_starts_with($path, $this->principalPrefix)) {
+            return null;
+        }
+        [, $name] = \Sabre\Uri\split($path);
+
+        [$backendId, $resourceId] = explode('-', $name, 2);
+
+        $query = $this->db->getQueryBuilder();
+        $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
+            ->from($this->dbTableName)
+            ->where($query->expr()->eq('backend_id', $query->createNamedParameter($backendId)))
+            ->andWhere($query->expr()->eq('resource_id', $query->createNamedParameter($resourceId)));
+        $stmt = $query->execute();
+        $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+
+        if (!$row) {
+            return null;
+        }
+
+        $metaDataQuery = $this->db->getQueryBuilder();
+        $metaDataQuery->select(['key', 'value'])
+            ->from($this->dbMetaDataTableName)
+            ->where($metaDataQuery->expr()->eq($this->dbForeignKeyName, $metaDataQuery->createNamedParameter($row['id'])));
+        $metaDataStmt = $metaDataQuery->execute();
+        $metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
+        $metadata = [];
+
+        foreach ($metaDataRows as $metaDataRow) {
+            $metadata[$metaDataRow['key']] = $metaDataRow['value'];
+        }
+
+        return $this->rowToPrincipal($row, $metadata);
+    }
+
+    /**
+     * @param int $id
+     * @return string[]|null
+     */
+    public function getPrincipalById($id): ?array {
+        $query = $this->db->getQueryBuilder();
+        $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname'])
+            ->from($this->dbTableName)
+            ->where($query->expr()->eq('id', $query->createNamedParameter($id)));
+        $stmt = $query->execute();
+        $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+
+        if (!$row) {
+            return null;
+        }
+
+        $metaDataQuery = $this->db->getQueryBuilder();
+        $metaDataQuery->select(['key', 'value'])
+            ->from($this->dbMetaDataTableName)
+            ->where($metaDataQuery->expr()->eq($this->dbForeignKeyName, $metaDataQuery->createNamedParameter($row['id'])));
+        $metaDataStmt = $metaDataQuery->execute();
+        $metaDataRows = $metaDataStmt->fetchAll(\PDO::FETCH_ASSOC);
+        $metadata = [];
+
+        foreach ($metaDataRows as $metaDataRow) {
+            $metadata[$metaDataRow['key']] = $metaDataRow['value'];
+        }
+
+        return $this->rowToPrincipal($row, $metadata);
+    }
+
+    /**
+     * @param string $path
+     * @param PropPatch $propPatch
+     * @return int
+     */
+    public function updatePrincipal($path, PropPatch $propPatch): int {
+        return 0;
+    }
+
+    /**
+     * @param string $prefixPath
+     * @param string $test
+     *
+     * @return array
+     */
+    public function searchPrincipals($prefixPath, array $searchProperties, $test = 'allof') {
+        $results = [];
+        if (\count($searchProperties) === 0) {
+            return [];
+        }
+        if ($prefixPath !== $this->principalPrefix) {
+            return [];
+        }
+
+        $user = $this->userSession->getUser();
+        if (!$user) {
+            return [];
+        }
+        $usersGroups = $this->groupManager->getUserGroupIds($user);
+
+        foreach ($searchProperties as $prop => $value) {
+            switch ($prop) {
+                case '{http://sabredav.org/ns}email-address':
+                    $query = $this->db->getQueryBuilder();
+                    $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
+                        ->from($this->dbTableName)
+                        ->where($query->expr()->iLike('email', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+
+                    $stmt = $query->execute();
+                    $principals = [];
+                    while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
+                        if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
+                            continue;
+                        }
+                        $principals[] = $this->rowToPrincipal($row)['uri'];
+                    }
+                    $results[] = $principals;
+
+                    $stmt->closeCursor();
+                    break;
+
+                case '{DAV:}displayname':
+                    $query = $this->db->getQueryBuilder();
+                    $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
+                        ->from($this->dbTableName)
+                        ->where($query->expr()->iLike('displayname', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+
+                    $stmt = $query->execute();
+                    $principals = [];
+                    while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
+                        if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
+                            continue;
+                        }
+                        $principals[] = $this->rowToPrincipal($row)['uri'];
+                    }
+                    $results[] = $principals;
+
+                    $stmt->closeCursor();
+                    break;
+
+                case '{urn:ietf:params:xml:ns:caldav}calendar-user-address-set':
+                    // If you add support for more search properties that qualify as a user-address,
+                    // please also add them to the array below
+                    $results[] = $this->searchPrincipals($this->principalPrefix, [
+                        '{http://sabredav.org/ns}email-address' => $value,
+                    ], 'anyof');
+                    break;
+
+                case IRoomMetadata::FEATURES:
+                    $results[] = $this->searchPrincipalsByRoomFeature($prop, $value);
+                    break;
+
+                case IRoomMetadata::CAPACITY:
+                case IResourceMetadata::VEHICLE_SEATING_CAPACITY:
+                    $results[] = $this->searchPrincipalsByCapacity($prop, $value);
+                    break;
+
+                default:
+                    $results[] = $this->searchPrincipalsByMetadataKey($prop, $value, $usersGroups);
+                    break;
+            }
+        }
+
+        // results is an array of arrays, so this is not the first search result
+        // but the results of the first searchProperty
+        if (count($results) === 1) {
+            return $results[0];
+        }
+
+        switch ($test) {
+            case 'anyof':
+                return array_values(array_unique(array_merge(...$results)));
+
+            case 'allof':
+            default:
+                return array_values(array_intersect(...$results));
+        }
+    }
+
+    /**
+     * @param string $key
+     * @return IQueryBuilder
+     */
+    private function getMetadataQuery(string $key): IQueryBuilder {
+        $query = $this->db->getQueryBuilder();
+        $query->select([$this->dbForeignKeyName])
+            ->from($this->dbMetaDataTableName)
+            ->where($query->expr()->eq('key', $query->createNamedParameter($key)));
+        return $query;
+    }
+
+    /**
+     * Searches principals based on their metadata keys.
+     * This allows to search for all principals with a specific key.
+     * e.g.:
+     * '{http://nextcloud.com/ns}room-building-address' => 'ABC Street 123, ...'
+     *
+     * @param string $key
+     * @param string $value
+     * @param string[] $usersGroups
+     * @return string[]
+     */
+    private function searchPrincipalsByMetadataKey(string $key, string $value, array $usersGroups = []): array {
+        $query = $this->getMetadataQuery($key);
+        $query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+        return $this->getRows($query, $usersGroups);
+    }
+
+    /**
+     * Searches principals based on room features
+     * e.g.:
+     * '{http://nextcloud.com/ns}room-features' => 'TV,PROJECTOR'
+     *
+     * @param string $key
+     * @param string $value
+     * @param string[] $usersGroups
+     * @return string[]
+     */
+    private function searchPrincipalsByRoomFeature(string $key, string $value, array $usersGroups = []): array {
+        $query = $this->getMetadataQuery($key);
+        foreach (explode(',', $value) as $v) {
+            $query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($v) . '%')));
+        }
+        return $this->getRows($query, $usersGroups);
+    }
+
+    /**
+     * Searches principals based on room seating capacity or vehicle capacity
+     * e.g.:
+     * '{http://nextcloud.com/ns}room-seating-capacity' => '100'
+     *
+     * @param string $key
+     * @param string $value
+     * @param string[] $usersGroups
+     * @return string[]
+     */
+    private function searchPrincipalsByCapacity(string $key, string $value, array $usersGroups = []): array {
+        $query = $this->getMetadataQuery($key);
+        $query->andWhere($query->expr()->gte('value', $query->createNamedParameter($value)));
+        return $this->getRows($query, $usersGroups);
+    }
+
+    /**
+     * @param IQueryBuilder $query
+     * @param string[] $usersGroups
+     * @return string[]
+     */
+    private function getRows(IQueryBuilder $query, array $usersGroups): array {
+        try {
+            $stmt = $query->executeQuery();
+        } catch (Exception $e) {
+            $this->logger->error('Could not search resources: ' . $e->getMessage(), ['exception' => $e]);
+        }
+
+        $rows = [];
+        while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
+            $principalRow = $this->getPrincipalById($row[$this->dbForeignKeyName]);
+            if (!$principalRow) {
+                continue;
+            }
+
+            $rows[] = $principalRow;
+        }
+
+        $stmt->closeCursor();
+
+        $filteredRows = array_filter($rows, function ($row) use ($usersGroups) {
+            return $this->isAllowedToAccessResource($row, $usersGroups);
+        });
+
+        return array_map(static function ($row): string {
+            return $row['uri'];
+        }, $filteredRows);
+    }
+
+    /**
+     * @param string $uri
+     * @param string $principalPrefix
+     * @return null|string
+     * @throws Exception
+     */
+    public function findByUri($uri, $principalPrefix): ?string {
+        $user = $this->userSession->getUser();
+        if (!$user) {
+            return null;
+        }
+        $usersGroups = $this->groupManager->getUserGroupIds($user);
+
+        if (str_starts_with($uri, 'mailto:')) {
+            $email = substr($uri, 7);
+            $query = $this->db->getQueryBuilder();
+            $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
+                ->from($this->dbTableName)
+                ->where($query->expr()->eq('email', $query->createNamedParameter($email)));
+
+            $stmt = $query->execute();
+            $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+
+            if (!$row) {
+                return null;
+            }
+            if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
+                return null;
+            }
+
+            return $this->rowToPrincipal($row)['uri'];
+        }
+
+        if (str_starts_with($uri, 'principal:')) {
+            $path = substr($uri, 10);
+            if (!str_starts_with($path, $this->principalPrefix)) {
+                return null;
+            }
+
+            [, $name] = \Sabre\Uri\split($path);
+            [$backendId, $resourceId] = explode('-', $name, 2);
+
+            $query = $this->db->getQueryBuilder();
+            $query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
+                ->from($this->dbTableName)
+                ->where($query->expr()->eq('backend_id', $query->createNamedParameter($backendId)))
+                ->andWhere($query->expr()->eq('resource_id', $query->createNamedParameter($resourceId)));
+            $stmt = $query->execute();
+            $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+
+            if (!$row) {
+                return null;
+            }
+            if (!$this->isAllowedToAccessResource($row, $usersGroups)) {
+                return null;
+            }
+
+            return $this->rowToPrincipal($row)['uri'];
+        }
+
+        return null;
+    }
+
+    /**
+     * convert database row to principal
+     *
+     * @param string[] $row
+     * @param string[] $metadata
+     * @return string[]
+     */
+    private function rowToPrincipal(array $row, array $metadata = []): array {
+        return array_merge([
+            'uri' => $this->principalPrefix . '/' . $row['backend_id'] . '-' . $row['resource_id'],
+            '{DAV:}displayname' => $row['displayname'],
+            '{http://sabredav.org/ns}email-address' => $row['email'],
+            '{urn:ietf:params:xml:ns:caldav}calendar-user-type' => $this->cuType,
+        ], $metadata);
+    }
+
+    /**
+     * @param array $row
+     * @param array $userGroups
+     * @return bool
+     */
+    private function isAllowedToAccessResource(array $row, array $userGroups): bool {
+        if (!isset($row['group_restrictions']) ||
+            $row['group_restrictions'] === null ||
+            $row['group_restrictions'] === '') {
+            return true;
+        }
+
+        // group restrictions contains something, but not parsable, deny access and log warning
+        $json = json_decode($row['group_restrictions'], null, 512, JSON_THROW_ON_ERROR);
+        if (!\is_array($json)) {
+            $this->logger->info('group_restrictions field could not be parsed for ' . $this->dbTableName . '::' . $row['id'] . ', denying access to resource');
+            return false;
+        }
+
+        // empty array => no group restrictions
+        if (empty($json)) {
+            return true;
+        }
+
+        return !empty(array_intersect($json, $userGroups));
+    }
 }

Spacing +12 added lines, -12 removed lines

@@ -44,9 +44,9 @@ 
 		string $dbPrefix,
 		private string $cuType,
 	) {
-		$this->dbTableName = 'calendar_' . $dbPrefix . 's';
-		$this->dbMetaDataTableName = $this->dbTableName . '_md';
-		$this->dbForeignKeyName = $dbPrefix . '_id';
+		$this->dbTableName = 'calendar_'.$dbPrefix.'s';
+		$this->dbMetaDataTableName = $this->dbTableName.'_md';
+		$this->dbForeignKeyName = $dbPrefix.'_id';
 	}
 
 	use PrincipalProxyTrait;
@@ -216,7 +216,7 @@ 
 					$query = $this->db->getQueryBuilder();
 					$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
 						->from($this->dbTableName)
-						->where($query->expr()->iLike('email', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+						->where($query->expr()->iLike('email', $query->createNamedParameter('%'.$this->db->escapeLikeParameter($value).'%')));
 
 					$stmt = $query->execute();
 					$principals = [];
@@ -235,7 +235,7 @@ 
 					$query = $this->db->getQueryBuilder();
 					$query->select(['id', 'backend_id', 'resource_id', 'email', 'displayname', 'group_restrictions'])
 						->from($this->dbTableName)
-						->where($query->expr()->iLike('displayname', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+						->where($query->expr()->iLike('displayname', $query->createNamedParameter('%'.$this->db->escapeLikeParameter($value).'%')));
 
 					$stmt = $query->execute();
 					$principals = [];
@@ -314,7 +314,7 @@ 
 	 */
 	private function searchPrincipalsByMetadataKey(string $key, string $value, array $usersGroups = []): array {
 		$query = $this->getMetadataQuery($key);
-		$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($value) . '%')));
+		$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%'.$this->db->escapeLikeParameter($value).'%')));
 		return $this->getRows($query, $usersGroups);
 	}
 
@@ -331,7 +331,7 @@ 
 	private function searchPrincipalsByRoomFeature(string $key, string $value, array $usersGroups = []): array {
 		$query = $this->getMetadataQuery($key);
 		foreach (explode(',', $value) as $v) {
-			$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%' . $this->db->escapeLikeParameter($v) . '%')));
+			$query->andWhere($query->expr()->iLike('value', $query->createNamedParameter('%'.$this->db->escapeLikeParameter($v).'%')));
 		}
 		return $this->getRows($query, $usersGroups);
 	}
@@ -361,7 +361,7 @@ 
 		try {
 			$stmt = $query->executeQuery();
 		} catch (Exception $e) {
-			$this->logger->error('Could not search resources: ' . $e->getMessage(), ['exception' => $e]);
+			$this->logger->error('Could not search resources: '.$e->getMessage(), ['exception' => $e]);
 		}
 
 		$rows = [];
@@ -376,11 +376,11 @@ 
 
 		$stmt->closeCursor();
 
-		$filteredRows = array_filter($rows, function ($row) use ($usersGroups) {
+		$filteredRows = array_filter($rows, function($row) use ($usersGroups) {
 			return $this->isAllowedToAccessResource($row, $usersGroups);
 		});
 
-		return array_map(static function ($row): string {
+		return array_map(static function($row): string {
 			return $row['uri'];
 		}, $filteredRows);
 	}
@@ -457,7 +457,7 @@ 
 	 */
 	private function rowToPrincipal(array $row, array $metadata = []): array {
 		return array_merge([
-			'uri' => $this->principalPrefix . '/' . $row['backend_id'] . '-' . $row['resource_id'],
+			'uri' => $this->principalPrefix.'/'.$row['backend_id'].'-'.$row['resource_id'],
 			'{DAV:}displayname' => $row['displayname'],
 			'{http://sabredav.org/ns}email-address' => $row['email'],
 			'{urn:ietf:params:xml:ns:caldav}calendar-user-type' => $this->cuType,
@@ -479,7 +479,7 @@ 
 		// group restrictions contains something, but not parsable, deny access and log warning
 		$json = json_decode($row['group_restrictions'], null, 512, JSON_THROW_ON_ERROR);
 		if (!\is_array($json)) {
-			$this->logger->info('group_restrictions field could not be parsed for ' . $this->dbTableName . '::' . $row['id'] . ', denying access to resource');
+			$this->logger->info('group_restrictions field could not be parsed for '.$this->dbTableName.'::'.$row['id'].', denying access to resource');
 			return false;
 		}
 

apps/dav/tests/integration/DAV/Sharing/CalDavSharingBackendTest.php

Indentation +196 added lines, -196 removed lines

@@ -30,222 +30,222 @@
  */
 class CalDavSharingBackendTest extends TestCase {
 
-	private IDBConnection $db;
-	private IUserManager $userManager;
-	private IGroupManager $groupManager;
-	private Principal $principalBackend;
-	private ICacheFactory $cacheFactory;
-	private LoggerInterface $logger;
-	private SharingMapper $sharingMapper;
-	private SharingService $sharingService;
-	private Backend $sharingBackend;
-
-	private $resourceIds = [10001];
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->db = Server::get(IDBConnection::class);
-
-		$this->userManager = $this->createMock(IUserManager::class);
-		$this->groupManager = $this->createMock(IGroupManager::class);
-		$this->principalBackend = $this->createMock(Principal::class);
-		$this->cacheFactory = $this->createMock(ICacheFactory::class);
-		$this->cacheFactory->method('createInMemory')
-			->willReturn(new NullCache());
-		$this->logger = new \Psr\Log\NullLogger();
-
-		$this->sharingMapper = new SharingMapper($this->db);
-		$this->sharingService = new Service($this->sharingMapper);
-
-		$this->sharingBackend = new \OCA\DAV\CalDAV\Sharing\Backend(
-			$this->userManager,
-			$this->groupManager,
-			$this->principalBackend,
-			$this->cacheFactory,
-			$this->sharingService,
-			$this->logger
-		);
-
-		$this->removeFixtures();
-	}
-
-	protected function tearDown(): void {
-		$this->removeFixtures();
-	}
-
-	protected function removeFixtures(): void {
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete('dav_shares')
-			->where($qb->expr()->in('resourceid', $qb->createNamedParameter($this->resourceIds, IQueryBuilder::PARAM_INT_ARRAY)));
-		$qb->executeStatement();
-	}
-
-	public function testShareCalendarWithGroup(): void {
-		$calendar = $this->createMock(Calendar::class);
-		$calendar->method('getResourceId')
-			->willReturn(10001);
-		$calendar->method('getOwner')
-			->willReturn('principals/users/admin');
-
-		$this->principalBackend->method('findByUri')
-			->willReturn('principals/groups/alice_bob');
-
-		$this->groupManager->method('groupExists')
-			->willReturn(true);
-
-		$this->sharingBackend->updateShares(
-			$calendar,
-			[['href' => 'principals/groups/alice_bob']],
-			[],
-			[]
-		);
-
-		$this->assertCount(1, $this->sharingService->getShares(10001));
-	}
-
-	public function testUnshareCalendarFromGroup(): void {
-		$calendar = $this->createMock(Calendar::class);
-		$calendar->method('getResourceId')
-			->willReturn(10001);
-		$calendar->method('getOwner')
-			->willReturn('principals/users/admin');
-
-		$this->principalBackend->method('findByUri')
-			->willReturn('principals/groups/alice_bob');
-
-		$this->groupManager->method('groupExists')
-			->willReturn(true);
-
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [['href' => 'principals/groups/alice_bob']],
-			remove: [],
-		);
-
-		$this->assertCount(1, $this->sharingService->getShares(10001));
-
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [],
-			remove: ['principals/groups/alice_bob'],
-		);
-
-		$this->assertCount(0, $this->sharingService->getShares(10001));
-	}
-
-	public function testShareCalendarWithGroupAndUnshareAsUser(): void {
-		$calendar = $this->createMock(Calendar::class);
-		$calendar->method('getResourceId')
-			->willReturn(10001);
-		$calendar->method('getOwner')
-			->willReturn('principals/users/admin');
-
-		$this->principalBackend->method('findByUri')
-			->willReturnMap([
-				['principals/groups/alice_bob', '', 'principals/groups/alice_bob'],
-				['principals/users/bob', '', 'principals/users/bob'],
-			]);
-		$this->principalBackend->method('getGroupMembership')
-			->willReturn([
-				'principals/groups/alice_bob',
-			]);
-		$this->principalBackend->method('getCircleMembership')
-			->willReturn([]);
-
-		$this->groupManager->method('groupExists')
-			->willReturn(true);
-
-		/*
+    private IDBConnection $db;
+    private IUserManager $userManager;
+    private IGroupManager $groupManager;
+    private Principal $principalBackend;
+    private ICacheFactory $cacheFactory;
+    private LoggerInterface $logger;
+    private SharingMapper $sharingMapper;
+    private SharingService $sharingService;
+    private Backend $sharingBackend;
+
+    private $resourceIds = [10001];
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->db = Server::get(IDBConnection::class);
+
+        $this->userManager = $this->createMock(IUserManager::class);
+        $this->groupManager = $this->createMock(IGroupManager::class);
+        $this->principalBackend = $this->createMock(Principal::class);
+        $this->cacheFactory = $this->createMock(ICacheFactory::class);
+        $this->cacheFactory->method('createInMemory')
+            ->willReturn(new NullCache());
+        $this->logger = new \Psr\Log\NullLogger();
+
+        $this->sharingMapper = new SharingMapper($this->db);
+        $this->sharingService = new Service($this->sharingMapper);
+
+        $this->sharingBackend = new \OCA\DAV\CalDAV\Sharing\Backend(
+            $this->userManager,
+            $this->groupManager,
+            $this->principalBackend,
+            $this->cacheFactory,
+            $this->sharingService,
+            $this->logger
+        );
+
+        $this->removeFixtures();
+    }
+
+    protected function tearDown(): void {
+        $this->removeFixtures();
+    }
+
+    protected function removeFixtures(): void {
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete('dav_shares')
+            ->where($qb->expr()->in('resourceid', $qb->createNamedParameter($this->resourceIds, IQueryBuilder::PARAM_INT_ARRAY)));
+        $qb->executeStatement();
+    }
+
+    public function testShareCalendarWithGroup(): void {
+        $calendar = $this->createMock(Calendar::class);
+        $calendar->method('getResourceId')
+            ->willReturn(10001);
+        $calendar->method('getOwner')
+            ->willReturn('principals/users/admin');
+
+        $this->principalBackend->method('findByUri')
+            ->willReturn('principals/groups/alice_bob');
+
+        $this->groupManager->method('groupExists')
+            ->willReturn(true);
+
+        $this->sharingBackend->updateShares(
+            $calendar,
+            [['href' => 'principals/groups/alice_bob']],
+            [],
+            []
+        );
+
+        $this->assertCount(1, $this->sharingService->getShares(10001));
+    }
+
+    public function testUnshareCalendarFromGroup(): void {
+        $calendar = $this->createMock(Calendar::class);
+        $calendar->method('getResourceId')
+            ->willReturn(10001);
+        $calendar->method('getOwner')
+            ->willReturn('principals/users/admin');
+
+        $this->principalBackend->method('findByUri')
+            ->willReturn('principals/groups/alice_bob');
+
+        $this->groupManager->method('groupExists')
+            ->willReturn(true);
+
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [['href' => 'principals/groups/alice_bob']],
+            remove: [],
+        );
+
+        $this->assertCount(1, $this->sharingService->getShares(10001));
+
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [],
+            remove: ['principals/groups/alice_bob'],
+        );
+
+        $this->assertCount(0, $this->sharingService->getShares(10001));
+    }
+
+    public function testShareCalendarWithGroupAndUnshareAsUser(): void {
+        $calendar = $this->createMock(Calendar::class);
+        $calendar->method('getResourceId')
+            ->willReturn(10001);
+        $calendar->method('getOwner')
+            ->willReturn('principals/users/admin');
+
+        $this->principalBackend->method('findByUri')
+            ->willReturnMap([
+                ['principals/groups/alice_bob', '', 'principals/groups/alice_bob'],
+                ['principals/users/bob', '', 'principals/users/bob'],
+            ]);
+        $this->principalBackend->method('getGroupMembership')
+            ->willReturn([
+                'principals/groups/alice_bob',
+            ]);
+        $this->principalBackend->method('getCircleMembership')
+            ->willReturn([]);
+
+        $this->groupManager->method('groupExists')
+            ->willReturn(true);
+
+        /*
 		 * Owner is sharing the calendar with a group.
 		 */
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [['href' => 'principals/groups/alice_bob']],
-			remove: [],
-		);
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [['href' => 'principals/groups/alice_bob']],
+            remove: [],
+        );
 
-		$this->assertCount(1, $this->sharingService->getShares(10001));
+        $this->assertCount(1, $this->sharingService->getShares(10001));
 
-		/*
+        /*
 		 * Member of the group unshares the calendar.
 		 */
-		$this->sharingBackend->unshare(
-			shareable: $calendar,
-			principalUri: 'principals/users/bob'
-		);
-
-		$this->assertCount(1, $this->sharingService->getShares(10001));
-		$this->assertCount(1, $this->sharingService->getUnshares(10001));
-	}
-
-	/**
-	 * Tests the functionality of sharing a calendar with a user, then with a group (that includes the shared user),
-	 * and subsequently unsharing it from the individual user. Verifies that the unshare operation correctly removes the specific user share
-	 * without creating an additional unshare entry.
-	 */
-	public function testShareCalendarWithUserThenGroupThenUnshareUser(): void {
-		$calendar = $this->createMock(Calendar::class);
-		$calendar->method('getResourceId')
-			->willReturn(10001);
-		$calendar->method('getOwner')
-			->willReturn('principals/users/admin');
-
-		$this->principalBackend->method('findByUri')
-			->willReturnMap([
-				['principals/groups/alice_bob', '', 'principals/groups/alice_bob'],
-				['principals/users/bob', '', 'principals/users/bob'],
-			]);
-		$this->principalBackend->method('getGroupMembership')
-			->willReturn([
-				'principals/groups/alice_bob',
-			]);
-		$this->principalBackend->method('getCircleMembership')
-			->willReturn([]);
-
-		$this->userManager->method('userExists')
-			->willReturn(true);
-		$this->groupManager->method('groupExists')
-			->willReturn(true);
-
-		/*
+        $this->sharingBackend->unshare(
+            shareable: $calendar,
+            principalUri: 'principals/users/bob'
+        );
+
+        $this->assertCount(1, $this->sharingService->getShares(10001));
+        $this->assertCount(1, $this->sharingService->getUnshares(10001));
+    }
+
+    /**
+     * Tests the functionality of sharing a calendar with a user, then with a group (that includes the shared user),
+     * and subsequently unsharing it from the individual user. Verifies that the unshare operation correctly removes the specific user share
+     * without creating an additional unshare entry.
+     */
+    public function testShareCalendarWithUserThenGroupThenUnshareUser(): void {
+        $calendar = $this->createMock(Calendar::class);
+        $calendar->method('getResourceId')
+            ->willReturn(10001);
+        $calendar->method('getOwner')
+            ->willReturn('principals/users/admin');
+
+        $this->principalBackend->method('findByUri')
+            ->willReturnMap([
+                ['principals/groups/alice_bob', '', 'principals/groups/alice_bob'],
+                ['principals/users/bob', '', 'principals/users/bob'],
+            ]);
+        $this->principalBackend->method('getGroupMembership')
+            ->willReturn([
+                'principals/groups/alice_bob',
+            ]);
+        $this->principalBackend->method('getCircleMembership')
+            ->willReturn([]);
+
+        $this->userManager->method('userExists')
+            ->willReturn(true);
+        $this->groupManager->method('groupExists')
+            ->willReturn(true);
+
+        /*
 		 * Step 1) The owner shares the calendar with a user.
 		 */
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [['href' => 'principals/users/bob']],
-			remove: [],
-		);
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [['href' => 'principals/users/bob']],
+            remove: [],
+        );
 
-		$this->assertCount(1, $this->sharingService->getShares(10001));
+        $this->assertCount(1, $this->sharingService->getShares(10001));
 
-		/*
+        /*
 		 * Step 2) The owner shares the calendar with a group that includes the
 		 * user from step 1 as a member.
 		 */
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [['href' => 'principals/groups/alice_bob']],
-			remove: [],
-		);
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [['href' => 'principals/groups/alice_bob']],
+            remove: [],
+        );
 
-		$this->assertCount(2, $this->sharingService->getShares(10001));
+        $this->assertCount(2, $this->sharingService->getShares(10001));
 
-		/*
+        /*
 		 * Step 3) Unshare the calendar from user as owner.
 		 */
-		$this->sharingBackend->updateShares(
-			shareable: $calendar,
-			add: [],
-			remove: ['principals/users/bob'],
-		);
+        $this->sharingBackend->updateShares(
+            shareable: $calendar,
+            add: [],
+            remove: ['principals/users/bob'],
+        );
 
-		/*
+        /*
 		 * The purpose of this test is to ensure that removing a user from a share, as the owner, does not result in an "unshare" row being added.
 		 * Instead, the actual user share should be removed.
 		 */
-		$this->assertCount(1, $this->sharingService->getShares(10001));
-		$this->assertCount(0, $this->sharingService->getUnshares(10001));
-	}
+        $this->assertCount(1, $this->sharingService->getShares(10001));
+        $this->assertCount(0, $this->sharingService->getUnshares(10001));
+    }
 
 }

apps/dav/tests/unit/Connector/Sabre/DirectoryTest.php

Indentation +451 added lines, -451 removed lines

@@ -24,32 +24,32 @@ 
 use Test\Traits\UserTrait;
 
 class TestViewDirectory extends View {
-	public function __construct(
-		private $updatables,
-		private $deletables,
-		private $canRename = true,
-	) {
-	}
-
-	public function isUpdatable($path) {
-		return $this->updatables[$path];
-	}
-
-	public function isCreatable($path) {
-		return $this->updatables[$path];
-	}
-
-	public function isDeletable($path) {
-		return $this->deletables[$path];
-	}
-
-	public function rename($path1, $path2, array $options = []) {
-		return $this->canRename;
-	}
-
-	public function getRelativePath($path): ?string {
-		return $path;
-	}
+    public function __construct(
+        private $updatables,
+        private $deletables,
+        private $canRename = true,
+    ) {
+    }
+
+    public function isUpdatable($path) {
+        return $this->updatables[$path];
+    }
+
+    public function isCreatable($path) {
+        return $this->updatables[$path];
+    }
+
+    public function isDeletable($path) {
+        return $this->deletables[$path];
+    }
+
+    public function rename($path1, $path2, array $options = []) {
+        return $this->canRename;
+    }
+
+    public function getRelativePath($path): ?string {
+        return $path;
+    }
 }
 
 
@@ -57,431 +57,431 @@ 
  * @group DB
  */
 class DirectoryTest extends \Test\TestCase {
-	use UserTrait;
+    use UserTrait;
 
-	/** @var View|\PHPUnit\Framework\MockObject\MockObject */
-	private $view;
-	/** @var FileInfo|\PHPUnit\Framework\MockObject\MockObject */
-	private $info;
+    /** @var View|\PHPUnit\Framework\MockObject\MockObject */
+    private $view;
+    /** @var FileInfo|\PHPUnit\Framework\MockObject\MockObject */
+    private $info;
 
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->view = $this->createMock('OC\Files\View');
-		$this->info = $this->createMock('OC\Files\FileInfo');
-		$this->info->method('isReadable')
-			->willReturn(true);
-		$this->info->method('getType')
-			->willReturn(Node::TYPE_FOLDER);
-		$this->info->method('getName')
-			->willReturn('folder');
-		$this->info->method('getPath')
-			->willReturn('/admin/files/folder');
-		$this->info->method('getPermissions')
-			->willReturn(Constants::PERMISSION_READ);
-	}
-
-	private function getDir($path = '/') {
-		$this->view->expects($this->once())
-			->method('getRelativePath')
-			->willReturn($path);
-
-		$this->info->expects($this->once())
-			->method('getPath')
-			->willReturn($path);
-
-		return new Directory($this->view, $this->info);
-	}
-
-
-	public function testDeleteRootFolderFails(): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-
-		$this->info->expects($this->any())
-			->method('isDeletable')
-			->willReturn(true);
-		$this->view->expects($this->never())
-			->method('rmdir');
-		$dir = $this->getDir();
-		$dir->delete();
-	}
-
-
-	public function testDeleteForbidden(): void {
-		$this->expectException(Forbidden::class);
-
-		// deletion allowed
-		$this->info->expects($this->once())
-			->method('isDeletable')
-			->willReturn(true);
-
-		// but fails
-		$this->view->expects($this->once())
-			->method('rmdir')
-			->with('sub')
-			->willThrowException(new ForbiddenException('', true));
-
-		$dir = $this->getDir('sub');
-		$dir->delete();
-	}
-
-
-	public function testDeleteFolderWhenAllowed(): void {
-		// deletion allowed
-		$this->info->expects($this->once())
-			->method('isDeletable')
-			->willReturn(true);
-
-		// but fails
-		$this->view->expects($this->once())
-			->method('rmdir')
-			->with('sub')
-			->willReturn(true);
-
-		$dir = $this->getDir('sub');
-		$dir->delete();
-	}
-
-
-	public function testDeleteFolderFailsWhenNotAllowed(): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-
-		$this->info->expects($this->once())
-			->method('isDeletable')
-			->willReturn(false);
-
-		$dir = $this->getDir('sub');
-		$dir->delete();
-	}
-
-
-	public function testDeleteFolderThrowsWhenDeletionFailed(): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-
-		// deletion allowed
-		$this->info->expects($this->once())
-			->method('isDeletable')
-			->willReturn(true);
-
-		// but fails
-		$this->view->expects($this->once())
-			->method('rmdir')
-			->with('sub')
-			->willReturn(false);
-
-		$dir = $this->getDir('sub');
-		$dir->delete();
-	}
-
-	public function testGetChildren(): void {
-		$info1 = $this->getMockBuilder(FileInfo::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$info2 = $this->getMockBuilder(FileInfo::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$info1->method('getName')
-			->willReturn('first');
-		$info1->method('getPath')
-			->willReturn('folder/first');
-		$info1->method('getEtag')
-			->willReturn('abc');
-		$info2->method('getName')
-			->willReturn('second');
-		$info2->method('getPath')
-			->willReturn('folder/second');
-		$info2->method('getEtag')
-			->willReturn('def');
-
-		$this->view->expects($this->once())
-			->method('getDirectoryContent')
-			->willReturn([$info1, $info2]);
-
-		$this->view->expects($this->any())
-			->method('getRelativePath')
-			->willReturnCallback(function ($path) {
-				return str_replace('/admin/files/', '', $path);
-			});
-
-		$this->view->expects($this->any())
-			->method('getAbsolutePath')
-			->willReturnCallback(function ($path) {
-				return Filesystem::normalizePath('/admin/files' . $path);
-			});
-
-		$this->overwriteService(View::class, $this->view);
-
-		$dir = new Directory($this->view, $this->info);
-		$nodes = $dir->getChildren();
-
-		$this->assertEquals(2, count($nodes));
-
-		// calling a second time just returns the cached values,
-		// does not call getDirectoryContents again
-		$dir->getChildren();
-	}
-
-
-	public function testGetChildrenNoPermission(): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-
-		$info = $this->createMock(FileInfo::class);
-		$info->expects($this->any())
-			->method('isReadable')
-			->willReturn(false);
-
-		$dir = new Directory($this->view, $info);
-		$dir->getChildren();
-	}
-
-
-	public function testGetChildNoPermission(): void {
-		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
-
-		$this->info->expects($this->any())
-			->method('isReadable')
-			->willReturn(false);
-
-		$dir = new Directory($this->view, $this->info);
-		$dir->getChild('test');
-	}
-
-
-	public function testGetChildThrowStorageNotAvailableException(): void {
-		$this->expectException(\Sabre\DAV\Exception\ServiceUnavailable::class);
-
-		$this->view->expects($this->once())
-			->method('getFileInfo')
-			->willThrowException(new StorageNotAvailableException());
-
-		$dir = new Directory($this->view, $this->info);
-		$dir->getChild('.');
-	}
-
-
-	public function testGetChildThrowInvalidPath(): void {
-		$this->expectException(InvalidPath::class);
-
-		$this->view->expects($this->once())
-			->method('verifyPath')
-			->willThrowException(new InvalidPathException());
-		$this->view->expects($this->never())
-			->method('getFileInfo');
-
-		$dir = new Directory($this->view, $this->info);
-		$dir->getChild('.');
-	}
-
-	public function testGetQuotaInfoUnlimited(): void {
-		self::createUser('user', 'password');
-		self::loginAsUser('user');
-		$mountPoint = $this->createMock(IMountPoint::class);
-		$storage = $this->getMockBuilder(Quota::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$mountPoint->method('getStorage')
-			->willReturn($storage);
-
-		$storage->expects($this->any())
-			->method('instanceOfStorage')
-			->willReturnMap([
-				['\OCA\Files_Sharing\SharedStorage', false],
-				['\OC\Files\Storage\Wrapper\Quota', false],
-				[Storage::class, false],
-			]);
-
-		$storage->expects($this->once())
-			->method('getOwner')
-			->willReturn('user');
-
-		$storage->expects($this->never())
-			->method('getQuota');
-
-		$storage->expects($this->once())
-			->method('free_space')
-			->willReturn(800);
-
-		$this->info->expects($this->any())
-			->method('getPath')
-			->willReturn('/admin/files/foo');
-
-		$this->info->expects($this->once())
-			->method('getSize')
-			->willReturn(200);
-
-		$this->info->expects($this->once())
-			->method('getMountPoint')
-			->willReturn($mountPoint);
-
-		$this->view->expects($this->any())
-			->method('getRelativePath')
-			->willReturn('/foo');
-
-		$this->info->expects($this->once())
-			->method('getInternalPath')
-			->willReturn('/foo');
-
-		$mountPoint->method('getMountPoint')
-			->willReturn('/user/files/mymountpoint');
-
-		$dir = new Directory($this->view, $this->info);
-		$this->assertEquals([200, -3], $dir->getQuotaInfo()); //200 used, unlimited
-	}
-
-	public function testGetQuotaInfoSpecific(): void {
-		self::createUser('user', 'password');
-		self::loginAsUser('user');
-		$mountPoint = $this->createMock(IMountPoint::class);
-		$storage = $this->getMockBuilder(Quota::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$mountPoint->method('getStorage')
-			->willReturn($storage);
-
-		$storage->expects($this->any())
-			->method('instanceOfStorage')
-			->willReturnMap([
-				['\OCA\Files_Sharing\SharedStorage', false],
-				['\OC\Files\Storage\Wrapper\Quota', true],
-				[Storage::class, false],
-			]);
-
-		$storage->expects($this->once())
-			->method('getOwner')
-			->willReturn('user');
-
-		$storage->expects($this->once())
-			->method('getQuota')
-			->willReturn(1000);
-
-		$storage->expects($this->once())
-			->method('free_space')
-			->willReturn(800);
-
-		$this->info->expects($this->once())
-			->method('getSize')
-			->willReturn(200);
-
-		$this->info->expects($this->once())
-			->method('getMountPoint')
-			->willReturn($mountPoint);
-
-		$this->info->expects($this->once())
-			->method('getInternalPath')
-			->willReturn('/foo');
-
-		$mountPoint->method('getMountPoint')
-			->willReturn('/user/files/mymountpoint');
-
-		$this->view->expects($this->any())
-			->method('getRelativePath')
-			->willReturn('/foo');
-
-		$dir = new Directory($this->view, $this->info);
-		$this->assertEquals([200, 800], $dir->getQuotaInfo()); //200 used, 800 free
-	}
-
-	/**
-	 * @dataProvider moveFailedProvider
-	 */
-	public function testMoveFailed($source, $destination, $updatables, $deletables): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-
-		$this->moveTest($source, $destination, $updatables, $deletables);
-	}
-
-	/**
-	 * @dataProvider moveSuccessProvider
-	 */
-	public function testMoveSuccess($source, $destination, $updatables, $deletables): void {
-		$this->moveTest($source, $destination, $updatables, $deletables);
-		$this->addToAssertionCount(1);
-	}
-
-	/**
-	 * @dataProvider moveFailedInvalidCharsProvider
-	 */
-	public function testMoveFailedInvalidChars($source, $destination, $updatables, $deletables): void {
-		$this->expectException(InvalidPath::class);
-
-		$this->moveTest($source, $destination, $updatables, $deletables);
-	}
-
-	public function moveFailedInvalidCharsProvider() {
-		return [
-			['a/valid', "a/i\nvalid", ['a' => true, 'a/valid' => true, 'a/c*' => false], []],
-		];
-	}
-
-	public function moveFailedProvider() {
-		return [
-			['a/b', 'a/c', ['a' => false, 'a/b' => false, 'a/c' => false], []],
-			['a/b', 'b/b', ['a' => false, 'a/b' => false, 'b' => false, 'b/b' => false], []],
-			['a/b', 'b/b', ['a' => false, 'a/b' => true, 'b' => false, 'b/b' => false], []],
-			['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => false, 'b/b' => false], []],
-			['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => true, 'b/b' => false], ['a/b' => false]],
-			['a/b', 'a/c', ['a' => false, 'a/b' => true, 'a/c' => false], []],
-		];
-	}
-
-	public function moveSuccessProvider() {
-		return [
-			['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => true, 'b/b' => false], ['a/b' => true]],
-			// older files with special chars can still be renamed to valid names
-			['a/b*', 'b/b', ['a' => true, 'a/b*' => true, 'b' => true, 'b/b' => false], ['a/b*' => true]],
-		];
-	}
-
-	/**
-	 * @param $source
-	 * @param $destination
-	 * @param $updatables
-	 */
-	private function moveTest($source, $destination, $updatables, $deletables): void {
-		$view = new TestViewDirectory($updatables, $deletables);
-
-		$sourceInfo = new FileInfo($source, null, null, [
-			'type' => FileInfo::TYPE_FOLDER,
-		], null);
-		$targetInfo = new FileInfo(dirname($destination), null, null, [
-			'type' => FileInfo::TYPE_FOLDER,
-		], null);
-
-		$sourceNode = new Directory($view, $sourceInfo);
-		$targetNode = $this->getMockBuilder(Directory::class)
-			->setMethods(['childExists'])
-			->setConstructorArgs([$view, $targetInfo])
-			->getMock();
-		$targetNode->expects($this->any())->method('childExists')
-			->with(basename($destination))
-			->willReturn(false);
-		$this->assertTrue($targetNode->moveInto(basename($destination), $source, $sourceNode));
-	}
-
-
-	public function testFailingMove(): void {
-		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
-		$this->expectExceptionMessage('Could not copy directory b, target exists');
-
-		$source = 'a/b';
-		$destination = 'c/b';
-		$updatables = ['a' => true, 'a/b' => true, 'b' => true, 'c/b' => false];
-		$deletables = ['a/b' => true];
-
-		$view = new TestViewDirectory($updatables, $deletables);
-
-		$sourceInfo = new FileInfo($source, null, null, ['type' => FileInfo::TYPE_FOLDER], null);
-		$targetInfo = new FileInfo(dirname($destination), null, null, ['type' => FileInfo::TYPE_FOLDER], null);
-
-		$sourceNode = new Directory($view, $sourceInfo);
-		$targetNode = $this->getMockBuilder(Directory::class)
-			->onlyMethods(['childExists'])
-			->setConstructorArgs([$view, $targetInfo])
-			->getMock();
-		$targetNode->expects($this->once())->method('childExists')
-			->with(basename($destination))
-			->willReturn(true);
-
-		$targetNode->moveInto(basename($destination), $source, $sourceNode);
-	}
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->view = $this->createMock('OC\Files\View');
+        $this->info = $this->createMock('OC\Files\FileInfo');
+        $this->info->method('isReadable')
+            ->willReturn(true);
+        $this->info->method('getType')
+            ->willReturn(Node::TYPE_FOLDER);
+        $this->info->method('getName')
+            ->willReturn('folder');
+        $this->info->method('getPath')
+            ->willReturn('/admin/files/folder');
+        $this->info->method('getPermissions')
+            ->willReturn(Constants::PERMISSION_READ);
+    }
+
+    private function getDir($path = '/') {
+        $this->view->expects($this->once())
+            ->method('getRelativePath')
+            ->willReturn($path);
+
+        $this->info->expects($this->once())
+            ->method('getPath')
+            ->willReturn($path);
+
+        return new Directory($this->view, $this->info);
+    }
+
+
+    public function testDeleteRootFolderFails(): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+
+        $this->info->expects($this->any())
+            ->method('isDeletable')
+            ->willReturn(true);
+        $this->view->expects($this->never())
+            ->method('rmdir');
+        $dir = $this->getDir();
+        $dir->delete();
+    }
+
+
+    public function testDeleteForbidden(): void {
+        $this->expectException(Forbidden::class);
+
+        // deletion allowed
+        $this->info->expects($this->once())
+            ->method('isDeletable')
+            ->willReturn(true);
+
+        // but fails
+        $this->view->expects($this->once())
+            ->method('rmdir')
+            ->with('sub')
+            ->willThrowException(new ForbiddenException('', true));
+
+        $dir = $this->getDir('sub');
+        $dir->delete();
+    }
+
+
+    public function testDeleteFolderWhenAllowed(): void {
+        // deletion allowed
+        $this->info->expects($this->once())
+            ->method('isDeletable')
+            ->willReturn(true);
+
+        // but fails
+        $this->view->expects($this->once())
+            ->method('rmdir')
+            ->with('sub')
+            ->willReturn(true);
+
+        $dir = $this->getDir('sub');
+        $dir->delete();
+    }
+
+
+    public function testDeleteFolderFailsWhenNotAllowed(): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+
+        $this->info->expects($this->once())
+            ->method('isDeletable')
+            ->willReturn(false);
+
+        $dir = $this->getDir('sub');
+        $dir->delete();
+    }
+
+
+    public function testDeleteFolderThrowsWhenDeletionFailed(): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+
+        // deletion allowed
+        $this->info->expects($this->once())
+            ->method('isDeletable')
+            ->willReturn(true);
+
+        // but fails
+        $this->view->expects($this->once())
+            ->method('rmdir')
+            ->with('sub')
+            ->willReturn(false);
+
+        $dir = $this->getDir('sub');
+        $dir->delete();
+    }
+
+    public function testGetChildren(): void {
+        $info1 = $this->getMockBuilder(FileInfo::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $info2 = $this->getMockBuilder(FileInfo::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $info1->method('getName')
+            ->willReturn('first');
+        $info1->method('getPath')
+            ->willReturn('folder/first');
+        $info1->method('getEtag')
+            ->willReturn('abc');
+        $info2->method('getName')
+            ->willReturn('second');
+        $info2->method('getPath')
+            ->willReturn('folder/second');
+        $info2->method('getEtag')
+            ->willReturn('def');
+
+        $this->view->expects($this->once())
+            ->method('getDirectoryContent')
+            ->willReturn([$info1, $info2]);
+
+        $this->view->expects($this->any())
+            ->method('getRelativePath')
+            ->willReturnCallback(function ($path) {
+                return str_replace('/admin/files/', '', $path);
+            });
+
+        $this->view->expects($this->any())
+            ->method('getAbsolutePath')
+            ->willReturnCallback(function ($path) {
+                return Filesystem::normalizePath('/admin/files' . $path);
+            });
+
+        $this->overwriteService(View::class, $this->view);
+
+        $dir = new Directory($this->view, $this->info);
+        $nodes = $dir->getChildren();
+
+        $this->assertEquals(2, count($nodes));
+
+        // calling a second time just returns the cached values,
+        // does not call getDirectoryContents again
+        $dir->getChildren();
+    }
+
+
+    public function testGetChildrenNoPermission(): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+
+        $info = $this->createMock(FileInfo::class);
+        $info->expects($this->any())
+            ->method('isReadable')
+            ->willReturn(false);
+
+        $dir = new Directory($this->view, $info);
+        $dir->getChildren();
+    }
+
+
+    public function testGetChildNoPermission(): void {
+        $this->expectException(\Sabre\DAV\Exception\NotFound::class);
+
+        $this->info->expects($this->any())
+            ->method('isReadable')
+            ->willReturn(false);
+
+        $dir = new Directory($this->view, $this->info);
+        $dir->getChild('test');
+    }
+
+
+    public function testGetChildThrowStorageNotAvailableException(): void {
+        $this->expectException(\Sabre\DAV\Exception\ServiceUnavailable::class);
+
+        $this->view->expects($this->once())
+            ->method('getFileInfo')
+            ->willThrowException(new StorageNotAvailableException());
+
+        $dir = new Directory($this->view, $this->info);
+        $dir->getChild('.');
+    }
+
+
+    public function testGetChildThrowInvalidPath(): void {
+        $this->expectException(InvalidPath::class);
+
+        $this->view->expects($this->once())
+            ->method('verifyPath')
+            ->willThrowException(new InvalidPathException());
+        $this->view->expects($this->never())
+            ->method('getFileInfo');
+
+        $dir = new Directory($this->view, $this->info);
+        $dir->getChild('.');
+    }
+
+    public function testGetQuotaInfoUnlimited(): void {
+        self::createUser('user', 'password');
+        self::loginAsUser('user');
+        $mountPoint = $this->createMock(IMountPoint::class);
+        $storage = $this->getMockBuilder(Quota::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $mountPoint->method('getStorage')
+            ->willReturn($storage);
+
+        $storage->expects($this->any())
+            ->method('instanceOfStorage')
+            ->willReturnMap([
+                ['\OCA\Files_Sharing\SharedStorage', false],
+                ['\OC\Files\Storage\Wrapper\Quota', false],
+                [Storage::class, false],
+            ]);
+
+        $storage->expects($this->once())
+            ->method('getOwner')
+            ->willReturn('user');
+
+        $storage->expects($this->never())
+            ->method('getQuota');
+
+        $storage->expects($this->once())
+            ->method('free_space')
+            ->willReturn(800);
+
+        $this->info->expects($this->any())
+            ->method('getPath')
+            ->willReturn('/admin/files/foo');
+
+        $this->info->expects($this->once())
+            ->method('getSize')
+            ->willReturn(200);
+
+        $this->info->expects($this->once())
+            ->method('getMountPoint')
+            ->willReturn($mountPoint);
+
+        $this->view->expects($this->any())
+            ->method('getRelativePath')
+            ->willReturn('/foo');
+
+        $this->info->expects($this->once())
+            ->method('getInternalPath')
+            ->willReturn('/foo');
+
+        $mountPoint->method('getMountPoint')
+            ->willReturn('/user/files/mymountpoint');
+
+        $dir = new Directory($this->view, $this->info);
+        $this->assertEquals([200, -3], $dir->getQuotaInfo()); //200 used, unlimited
+    }
+
+    public function testGetQuotaInfoSpecific(): void {
+        self::createUser('user', 'password');
+        self::loginAsUser('user');
+        $mountPoint = $this->createMock(IMountPoint::class);
+        $storage = $this->getMockBuilder(Quota::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $mountPoint->method('getStorage')
+            ->willReturn($storage);
+
+        $storage->expects($this->any())
+            ->method('instanceOfStorage')
+            ->willReturnMap([
+                ['\OCA\Files_Sharing\SharedStorage', false],
+                ['\OC\Files\Storage\Wrapper\Quota', true],
+                [Storage::class, false],
+            ]);
+
+        $storage->expects($this->once())
+            ->method('getOwner')
+            ->willReturn('user');
+
+        $storage->expects($this->once())
+            ->method('getQuota')
+            ->willReturn(1000);
+
+        $storage->expects($this->once())
+            ->method('free_space')
+            ->willReturn(800);
+
+        $this->info->expects($this->once())
+            ->method('getSize')
+            ->willReturn(200);
+
+        $this->info->expects($this->once())
+            ->method('getMountPoint')
+            ->willReturn($mountPoint);
+
+        $this->info->expects($this->once())
+            ->method('getInternalPath')
+            ->willReturn('/foo');
+
+        $mountPoint->method('getMountPoint')
+            ->willReturn('/user/files/mymountpoint');
+
+        $this->view->expects($this->any())
+            ->method('getRelativePath')
+            ->willReturn('/foo');
+
+        $dir = new Directory($this->view, $this->info);
+        $this->assertEquals([200, 800], $dir->getQuotaInfo()); //200 used, 800 free
+    }
+
+    /**
+     * @dataProvider moveFailedProvider
+     */
+    public function testMoveFailed($source, $destination, $updatables, $deletables): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+
+        $this->moveTest($source, $destination, $updatables, $deletables);
+    }
+
+    /**
+     * @dataProvider moveSuccessProvider
+     */
+    public function testMoveSuccess($source, $destination, $updatables, $deletables): void {
+        $this->moveTest($source, $destination, $updatables, $deletables);
+        $this->addToAssertionCount(1);
+    }
+
+    /**
+     * @dataProvider moveFailedInvalidCharsProvider
+     */
+    public function testMoveFailedInvalidChars($source, $destination, $updatables, $deletables): void {
+        $this->expectException(InvalidPath::class);
+
+        $this->moveTest($source, $destination, $updatables, $deletables);
+    }
+
+    public function moveFailedInvalidCharsProvider() {
+        return [
+            ['a/valid', "a/i\nvalid", ['a' => true, 'a/valid' => true, 'a/c*' => false], []],
+        ];
+    }
+
+    public function moveFailedProvider() {
+        return [
+            ['a/b', 'a/c', ['a' => false, 'a/b' => false, 'a/c' => false], []],
+            ['a/b', 'b/b', ['a' => false, 'a/b' => false, 'b' => false, 'b/b' => false], []],
+            ['a/b', 'b/b', ['a' => false, 'a/b' => true, 'b' => false, 'b/b' => false], []],
+            ['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => false, 'b/b' => false], []],
+            ['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => true, 'b/b' => false], ['a/b' => false]],
+            ['a/b', 'a/c', ['a' => false, 'a/b' => true, 'a/c' => false], []],
+        ];
+    }
+
+    public function moveSuccessProvider() {
+        return [
+            ['a/b', 'b/b', ['a' => true, 'a/b' => true, 'b' => true, 'b/b' => false], ['a/b' => true]],
+            // older files with special chars can still be renamed to valid names
+            ['a/b*', 'b/b', ['a' => true, 'a/b*' => true, 'b' => true, 'b/b' => false], ['a/b*' => true]],
+        ];
+    }
+
+    /**
+     * @param $source
+     * @param $destination
+     * @param $updatables
+     */
+    private function moveTest($source, $destination, $updatables, $deletables): void {
+        $view = new TestViewDirectory($updatables, $deletables);
+
+        $sourceInfo = new FileInfo($source, null, null, [
+            'type' => FileInfo::TYPE_FOLDER,
+        ], null);
+        $targetInfo = new FileInfo(dirname($destination), null, null, [
+            'type' => FileInfo::TYPE_FOLDER,
+        ], null);
+
+        $sourceNode = new Directory($view, $sourceInfo);
+        $targetNode = $this->getMockBuilder(Directory::class)
+            ->setMethods(['childExists'])
+            ->setConstructorArgs([$view, $targetInfo])
+            ->getMock();
+        $targetNode->expects($this->any())->method('childExists')
+            ->with(basename($destination))
+            ->willReturn(false);
+        $this->assertTrue($targetNode->moveInto(basename($destination), $source, $sourceNode));
+    }
+
+
+    public function testFailingMove(): void {
+        $this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+        $this->expectExceptionMessage('Could not copy directory b, target exists');
+
+        $source = 'a/b';
+        $destination = 'c/b';
+        $updatables = ['a' => true, 'a/b' => true, 'b' => true, 'c/b' => false];
+        $deletables = ['a/b' => true];
+
+        $view = new TestViewDirectory($updatables, $deletables);
+
+        $sourceInfo = new FileInfo($source, null, null, ['type' => FileInfo::TYPE_FOLDER], null);
+        $targetInfo = new FileInfo(dirname($destination), null, null, ['type' => FileInfo::TYPE_FOLDER], null);
+
+        $sourceNode = new Directory($view, $sourceInfo);
+        $targetNode = $this->getMockBuilder(Directory::class)
+            ->onlyMethods(['childExists'])
+            ->setConstructorArgs([$view, $targetInfo])
+            ->getMock();
+        $targetNode->expects($this->once())->method('childExists')
+            ->with(basename($destination))
+            ->willReturn(true);
+
+        $targetNode->moveInto(basename($destination), $source, $sourceNode);
+    }
 }

apps/user_ldap/lib/User/User.php

Indentation +786 added lines, -786 removed lines

@@ -33,790 +33,790 @@
  * represents an LDAP user, gets and holds user-specific information from LDAP
  */
 class User {
-	protected Connection $connection;
-	/**
-	 * @var array<string,1>
-	 */
-	protected array $refreshedFeatures = [];
-	protected string|false|null $avatarImage = null;
-
-	protected BirthdateParserService $birthdateParser;
-
-	/**
-	 * DB config keys for user preferences
-	 * @var string
-	 */
-	public const USER_PREFKEY_FIRSTLOGIN = 'firstLoginAccomplished';
-
-	/**
-	 * @brief constructor, make sure the subclasses call this one!
-	 */
-	public function __construct(
-		protected string $uid,
-		protected string $dn,
-		protected Access $access,
-		protected IConfig $config,
-		protected Image $image,
-		protected LoggerInterface $logger,
-		protected IAvatarManager $avatarManager,
-		protected IUserManager $userManager,
-		protected INotificationManager $notificationManager,
-	) {
-		if ($uid === '') {
-			$logger->error("uid for '$dn' must not be an empty string", ['app' => 'user_ldap']);
-			throw new \InvalidArgumentException('uid must not be an empty string!');
-		}
-		$this->connection = $this->access->getConnection();
-		$this->birthdateParser = new BirthdateParserService();
-
-		Util::connectHook('OC_User', 'post_login', $this, 'handlePasswordExpiry');
-	}
-
-	/**
-	 * marks a user as deleted
-	 *
-	 * @throws PreConditionNotMetException
-	 */
-	public function markUser(): void {
-		$curValue = $this->config->getUserValue($this->getUsername(), 'user_ldap', 'isDeleted', '0');
-		if ($curValue === '1') {
-			// the user is already marked, do not write to DB again
-			return;
-		}
-		$this->config->setUserValue($this->getUsername(), 'user_ldap', 'isDeleted', '1');
-		$this->config->setUserValue($this->getUsername(), 'user_ldap', 'foundDeleted', (string)time());
-	}
-
-	/**
-	 * processes results from LDAP for attributes as returned by getAttributesToRead()
-	 * @param array $ldapEntry the user entry as retrieved from LDAP
-	 */
-	public function processAttributes(array $ldapEntry): void {
-		//Quota
-		$attr = strtolower($this->connection->ldapQuotaAttribute);
-		if (isset($ldapEntry[$attr])) {
-			$this->updateQuota($ldapEntry[$attr][0]);
-		} else {
-			if ($this->connection->ldapQuotaDefault !== '') {
-				$this->updateQuota();
-			}
-		}
-		unset($attr);
-
-		//displayName
-		$displayName = $displayName2 = '';
-		$attr = strtolower($this->connection->ldapUserDisplayName);
-		if (isset($ldapEntry[$attr])) {
-			$displayName = (string)$ldapEntry[$attr][0];
-		}
-		$attr = strtolower($this->connection->ldapUserDisplayName2);
-		if (isset($ldapEntry[$attr])) {
-			$displayName2 = (string)$ldapEntry[$attr][0];
-		}
-		if ($displayName !== '') {
-			$this->composeAndStoreDisplayName($displayName, $displayName2);
-			$this->access->cacheUserDisplayName(
-				$this->getUsername(),
-				$displayName,
-				$displayName2
-			);
-		}
-		unset($attr);
-
-		//Email
-		//email must be stored after displayname, because it would cause a user
-		//change event that will trigger fetching the display name again
-		$attr = strtolower($this->connection->ldapEmailAttribute);
-		if (isset($ldapEntry[$attr])) {
-			$mailValue = 0;
-			for ($x = 0; $x < count($ldapEntry[$attr]); $x++) {
-				if (filter_var($ldapEntry[$attr][$x], FILTER_VALIDATE_EMAIL)) {
-					$mailValue = $x;
-					break;
-				}
-			}
-			$this->updateEmail($ldapEntry[$attr][$mailValue]);
-		}
-		unset($attr);
-
-		// LDAP Username, needed for s2s sharing
-		if (isset($ldapEntry['uid'])) {
-			$this->storeLDAPUserName($ldapEntry['uid'][0]);
-		} elseif (isset($ldapEntry['samaccountname'])) {
-			$this->storeLDAPUserName($ldapEntry['samaccountname'][0]);
-		}
-
-		//homePath
-		if (str_starts_with($this->connection->homeFolderNamingRule, 'attr:')) {
-			$attr = strtolower(substr($this->connection->homeFolderNamingRule, strlen('attr:')));
-			if (isset($ldapEntry[$attr])) {
-				$this->access->cacheUserHome(
-					$this->getUsername(), $this->getHomePath($ldapEntry[$attr][0]));
-			}
-		}
-
-		//memberOf groups
-		$cacheKey = 'getMemberOf' . $this->getUsername();
-		$groups = false;
-		if (isset($ldapEntry['memberof'])) {
-			$groups = $ldapEntry['memberof'];
-		}
-		$this->connection->writeToCache($cacheKey, $groups);
-
-		//external storage var
-		$attr = strtolower($this->connection->ldapExtStorageHomeAttribute);
-		if (isset($ldapEntry[$attr])) {
-			$this->updateExtStorageHome($ldapEntry[$attr][0]);
-		}
-		unset($attr);
-
-		// check for cached profile data
-		$username = $this->getUsername(); // buffer variable, to save resource
-		$cacheKey = 'getUserProfile-' . $username;
-		$profileCached = $this->connection->getFromCache($cacheKey);
-		// honoring profile disabled in config.php and check if user profile was refreshed
-		if ($this->config->getSystemValueBool('profile.enabled', true) &&
-			($profileCached === null) && // no cache or TTL not expired
-			!$this->wasRefreshed('profile')) {
-			// check current data
-			$profileValues = [];
-			//User Profile Field - Phone number
-			$attr = strtolower($this->connection->ldapAttributePhone);
-			if (!empty($attr)) { // attribute configured
-				$profileValues[IAccountManager::PROPERTY_PHONE]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - website
-			$attr = strtolower($this->connection->ldapAttributeWebsite);
-			if (isset($ldapEntry[$attr])) {
-				$cutPosition = strpos($ldapEntry[$attr][0], ' ');
-				if ($cutPosition) {
-					// drop appended label
-					$profileValues[IAccountManager::PROPERTY_WEBSITE]
-						= substr($ldapEntry[$attr][0], 0, $cutPosition);
-				} else {
-					$profileValues[IAccountManager::PROPERTY_WEBSITE]
-						= $ldapEntry[$attr][0];
-				}
-			} elseif (!empty($attr)) {	// configured, but not defined
-				$profileValues[IAccountManager::PROPERTY_WEBSITE] = '';
-			}
-			//User Profile Field - Address
-			$attr = strtolower($this->connection->ldapAttributeAddress);
-			if (isset($ldapEntry[$attr])) {
-				if (str_contains($ldapEntry[$attr][0], '$')) {
-					// basic format conversion from postalAddress syntax to commata delimited
-					$profileValues[IAccountManager::PROPERTY_ADDRESS]
-						= str_replace('$', ', ', $ldapEntry[$attr][0]);
-				} else {
-					$profileValues[IAccountManager::PROPERTY_ADDRESS]
-						= $ldapEntry[$attr][0];
-				}
-			} elseif (!empty($attr)) {	// configured, but not defined
-				$profileValues[IAccountManager::PROPERTY_ADDRESS] = '';
-			}
-			//User Profile Field - Twitter
-			$attr = strtolower($this->connection->ldapAttributeTwitter);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_TWITTER]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - fediverse
-			$attr = strtolower($this->connection->ldapAttributeFediverse);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_FEDIVERSE]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - organisation
-			$attr = strtolower($this->connection->ldapAttributeOrganisation);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_ORGANISATION]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - role
-			$attr = strtolower($this->connection->ldapAttributeRole);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_ROLE]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - headline
-			$attr = strtolower($this->connection->ldapAttributeHeadline);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_HEADLINE]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			//User Profile Field - biography
-			$attr = strtolower($this->connection->ldapAttributeBiography);
-			if (isset($ldapEntry[$attr])) {
-				if (str_contains($ldapEntry[$attr][0], '\r')) {
-					// convert line endings
-					$profileValues[IAccountManager::PROPERTY_BIOGRAPHY]
-						= str_replace(["\r\n","\r"], "\n", $ldapEntry[$attr][0]);
-				} else {
-					$profileValues[IAccountManager::PROPERTY_BIOGRAPHY]
-						= $ldapEntry[$attr][0];
-				}
-			} elseif (!empty($attr)) {	// configured, but not defined
-				$profileValues[IAccountManager::PROPERTY_BIOGRAPHY] = '';
-			}
-			//User Profile Field - birthday
-			$attr = strtolower($this->connection->ldapAttributeBirthDate);
-			if (!empty($attr) && !empty($ldapEntry[$attr][0])) {
-				$value = $ldapEntry[$attr][0];
-				try {
-					$birthdate = $this->birthdateParser->parseBirthdate($value);
-					$profileValues[IAccountManager::PROPERTY_BIRTHDATE]
-						= $birthdate->format('Y-m-d');
-				} catch (InvalidArgumentException $e) {
-					// Invalid date -> just skip the property
-					$this->logger->info("Failed to parse user's birthdate from LDAP: $value", [
-						'exception' => $e,
-						'userId' => $username,
-					]);
-				}
-			}
-			//User Profile Field - pronouns
-			$attr = strtolower($this->connection->ldapAttributePronouns);
-			if (!empty($attr)) {
-				$profileValues[IAccountManager::PROPERTY_PRONOUNS]
-					= $ldapEntry[$attr][0] ?? '';
-			}
-			// check for changed data and cache just for TTL checking
-			$checksum = hash('sha256', json_encode($profileValues));
-			$this->connection->writeToCache($cacheKey, $checksum // write array to cache. is waste of cache space
-				, null); // use ldapCacheTTL from configuration
-			// Update user profile
-			if ($this->config->getUserValue($username, 'user_ldap', 'lastProfileChecksum', null) !== $checksum) {
-				$this->config->setUserValue($username, 'user_ldap', 'lastProfileChecksum', $checksum);
-				$this->updateProfile($profileValues);
-				$this->logger->info("updated profile uid=$username", ['app' => 'user_ldap']);
-			} else {
-				$this->logger->debug('profile data from LDAP unchanged', ['app' => 'user_ldap', 'uid' => $username]);
-			}
-			unset($attr);
-		} elseif ($profileCached !== null) { // message delayed, to declutter log
-			$this->logger->debug('skipping profile check, while cached data exist', ['app' => 'user_ldap', 'uid' => $username]);
-		}
-
-		//Avatar
-		/** @var Connection $connection */
-		$connection = $this->access->getConnection();
-		$attributes = $connection->resolveRule('avatar');
-		foreach ($attributes as $attribute) {
-			if (isset($ldapEntry[$attribute])) {
-				$this->avatarImage = $ldapEntry[$attribute][0];
-				$this->updateAvatar();
-				break;
-			}
-		}
-	}
-
-	/**
-	 * @brief returns the LDAP DN of the user
-	 * @return string
-	 */
-	public function getDN() {
-		return $this->dn;
-	}
-
-	/**
-	 * @brief returns the Nextcloud internal username of the user
-	 * @return string
-	 */
-	public function getUsername() {
-		return $this->uid;
-	}
-
-	/**
-	 * returns the home directory of the user if specified by LDAP settings
-	 * @throws \Exception
-	 */
-	public function getHomePath(?string $valueFromLDAP = null): string|false {
-		$path = (string)$valueFromLDAP;
-		$attr = null;
-
-		if (is_null($valueFromLDAP)
-		   && str_starts_with($this->access->connection->homeFolderNamingRule, 'attr:')
-		   && $this->access->connection->homeFolderNamingRule !== 'attr:') {
-			$attr = substr($this->access->connection->homeFolderNamingRule, strlen('attr:'));
-			$dn = $this->access->username2dn($this->getUsername());
-			if ($dn === false) {
-				return false;
-			}
-			$homedir = $this->access->readAttribute($dn, $attr);
-			if ($homedir !== false && isset($homedir[0])) {
-				$path = $homedir[0];
-			}
-		}
-
-		if ($path !== '') {
-			//if attribute's value is an absolute path take this, otherwise append it to data dir
-			//check for / at the beginning or pattern c:\ resp. c:/
-			if ($path[0] !== '/'
-			   && !(strlen($path) > 3 && ctype_alpha($path[0])
-				   && $path[1] === ':' && ($path[2] === '\\' || $path[2] === '/'))
-			) {
-				$path = $this->config->getSystemValue('datadirectory',
-					\OC::$SERVERROOT . '/data') . '/' . $path;
-			}
-			//we need it to store it in the DB as well in case a user gets
-			//deleted so we can clean up afterwards
-			$this->config->setUserValue(
-				$this->getUsername(), 'user_ldap', 'homePath', $path
-			);
-			return $path;
-		}
-
-		if (!is_null($attr)
-			&& $this->config->getAppValue('user_ldap', 'enforce_home_folder_naming_rule', 'true')
-		) {
-			// a naming rule attribute is defined, but it doesn't exist for that LDAP user
-			throw new \Exception('Home dir attribute can\'t be read from LDAP for uid: ' . $this->getUsername());
-		}
-
-		//false will apply default behaviour as defined and done by OC_User
-		$this->config->setUserValue($this->getUsername(), 'user_ldap', 'homePath', '');
-		return false;
-	}
-
-	public function getMemberOfGroups(): array|false {
-		$cacheKey = 'getMemberOf' . $this->getUsername();
-		$memberOfGroups = $this->connection->getFromCache($cacheKey);
-		if (!is_null($memberOfGroups)) {
-			return $memberOfGroups;
-		}
-		$groupDNs = $this->access->readAttribute($this->getDN(), 'memberOf');
-		$this->connection->writeToCache($cacheKey, $groupDNs);
-		return $groupDNs;
-	}
-
-	/**
-	 * @brief reads the image from LDAP that shall be used as Avatar
-	 * @return string|false data (provided by LDAP)
-	 */
-	public function getAvatarImage(): string|false {
-		if (!is_null($this->avatarImage)) {
-			return $this->avatarImage;
-		}
-
-		$this->avatarImage = false;
-		/** @var Connection $connection */
-		$connection = $this->access->getConnection();
-		$attributes = $connection->resolveRule('avatar');
-		foreach ($attributes as $attribute) {
-			$result = $this->access->readAttribute($this->dn, $attribute);
-			if ($result !== false && isset($result[0])) {
-				$this->avatarImage = $result[0];
-				break;
-			}
-		}
-
-		return $this->avatarImage;
-	}
-
-	/**
-	 * @brief marks the user as having logged in at least once
-	 */
-	public function markLogin(): void {
-		$this->config->setUserValue(
-			$this->uid, 'user_ldap', self::USER_PREFKEY_FIRSTLOGIN, '1');
-	}
-
-	/**
-	 * Stores a key-value pair in relation to this user
-	 */
-	private function store(string $key, string $value): void {
-		$this->config->setUserValue($this->uid, 'user_ldap', $key, $value);
-	}
-
-	/**
-	 * Composes the display name and stores it in the database. The final
-	 * display name is returned.
-	 *
-	 * @return string the effective display name
-	 */
-	public function composeAndStoreDisplayName(string $displayName, string $displayName2 = ''): string {
-		if ($displayName2 !== '') {
-			$displayName .= ' (' . $displayName2 . ')';
-		}
-		$oldName = $this->config->getUserValue($this->uid, 'user_ldap', 'displayName', null);
-		if ($oldName !== $displayName) {
-			$this->store('displayName', $displayName);
-			$user = $this->userManager->get($this->getUsername());
-			if (!empty($oldName) && $user instanceof \OC\User\User) {
-				// if it was empty, it would be a new record, not a change emitting the trigger could
-				// potentially cause a UniqueConstraintViolationException, depending on some factors.
-				$user->triggerChange('displayName', $displayName, $oldName);
-			}
-		}
-		return $displayName;
-	}
-
-	/**
-	 * Stores the LDAP Username in the Database
-	 */
-	public function storeLDAPUserName(string $userName): void {
-		$this->store('uid', $userName);
-	}
-
-	/**
-	 * @brief checks whether an update method specified by feature was run
-	 * already. If not, it will marked like this, because it is expected that
-	 * the method will be run, when false is returned.
-	 * @param string $feature email | quota | avatar | profile (can be extended)
-	 */
-	private function wasRefreshed(string $feature): bool {
-		if (isset($this->refreshedFeatures[$feature])) {
-			return true;
-		}
-		$this->refreshedFeatures[$feature] = 1;
-		return false;
-	}
-
-	/**
-	 * fetches the email from LDAP and stores it as Nextcloud user value
-	 * @param ?string $valueFromLDAP if known, to save an LDAP read request
-	 */
-	public function updateEmail(?string $valueFromLDAP = null): void {
-		if ($this->wasRefreshed('email')) {
-			return;
-		}
-		$email = (string)$valueFromLDAP;
-		if (is_null($valueFromLDAP)) {
-			$emailAttribute = $this->connection->ldapEmailAttribute;
-			if ($emailAttribute !== '') {
-				$aEmail = $this->access->readAttribute($this->dn, $emailAttribute);
-				if (is_array($aEmail) && (count($aEmail) > 0)) {
-					$email = (string)$aEmail[0];
-				}
-			}
-		}
-		if ($email !== '') {
-			$user = $this->userManager->get($this->uid);
-			if (!is_null($user)) {
-				$currentEmail = (string)$user->getSystemEMailAddress();
-				if ($currentEmail !== $email) {
-					$user->setSystemEMailAddress($email);
-				}
-			}
-		}
-	}
-
-	/**
-	 * Overall process goes as follow:
-	 * 1. fetch the quota from LDAP and check if it's parseable with the "verifyQuotaValue" function
-	 * 2. if the value can't be fetched, is empty or not parseable, use the default LDAP quota
-	 * 3. if the default LDAP quota can't be parsed, use the Nextcloud's default quota (use 'default')
-	 * 4. check if the target user exists and set the quota for the user.
-	 *
-	 * In order to improve performance and prevent an unwanted extra LDAP call, the $valueFromLDAP
-	 * parameter can be passed with the value of the attribute. This value will be considered as the
-	 * quota for the user coming from the LDAP server (step 1 of the process) It can be useful to
-	 * fetch all the user's attributes in one call and use the fetched values in this function.
-	 * The expected value for that parameter is a string describing the quota for the user. Valid
-	 * values are 'none' (unlimited), 'default' (the Nextcloud's default quota), '1234' (quota in
-	 * bytes), '1234 MB' (quota in MB - check the \OCP\Util::computerFileSize method for more info)
-	 *
-	 * fetches the quota from LDAP and stores it as Nextcloud user value
-	 * @param ?string $valueFromLDAP the quota attribute's value can be passed,
-	 *                               to save the readAttribute request
-	 */
-	public function updateQuota(?string $valueFromLDAP = null): void {
-		if ($this->wasRefreshed('quota')) {
-			return;
-		}
-
-		$quotaAttribute = $this->connection->ldapQuotaAttribute;
-		$defaultQuota = $this->connection->ldapQuotaDefault;
-		if ($quotaAttribute === '' && $defaultQuota === '') {
-			return;
-		}
-
-		$quota = false;
-		if (is_null($valueFromLDAP) && $quotaAttribute !== '') {
-			$aQuota = $this->access->readAttribute($this->dn, $quotaAttribute);
-			if ($aQuota !== false && isset($aQuota[0]) && $this->verifyQuotaValue($aQuota[0])) {
-				$quota = $aQuota[0];
-			} elseif (is_array($aQuota) && isset($aQuota[0])) {
-				$this->logger->debug('no suitable LDAP quota found for user ' . $this->uid . ': [' . $aQuota[0] . ']', ['app' => 'user_ldap']);
-			}
-		} elseif (!is_null($valueFromLDAP) && $this->verifyQuotaValue($valueFromLDAP)) {
-			$quota = $valueFromLDAP;
-		} else {
-			$this->logger->debug('no suitable LDAP quota found for user ' . $this->uid . ': [' . ($valueFromLDAP ?? '') . ']', ['app' => 'user_ldap']);
-		}
-
-		if ($quota === false && $this->verifyQuotaValue($defaultQuota)) {
-			// quota not found using the LDAP attribute (or not parseable). Try the default quota
-			$quota = $defaultQuota;
-		} elseif ($quota === false) {
-			$this->logger->debug('no suitable default quota found for user ' . $this->uid . ': [' . $defaultQuota . ']', ['app' => 'user_ldap']);
-			return;
-		}
-
-		$targetUser = $this->userManager->get($this->uid);
-		if ($targetUser instanceof IUser) {
-			$targetUser->setQuota($quota);
-		} else {
-			$this->logger->info('trying to set a quota for user ' . $this->uid . ' but the user is missing', ['app' => 'user_ldap']);
-		}
-	}
-
-	private function verifyQuotaValue(string $quotaValue): bool {
-		return $quotaValue === 'none' || $quotaValue === 'default' || Util::computerFileSize($quotaValue) !== false;
-	}
-
-	/**
-	 * takes values from LDAP and stores it as Nextcloud user profile value
-	 *
-	 * @param array $profileValues associative array of property keys and values from LDAP
-	 */
-	private function updateProfile(array $profileValues): void {
-		// check if given array is empty
-		if (empty($profileValues)) {
-			return; // okay, nothing to do
-		}
-		// fetch/prepare user
-		$user = $this->userManager->get($this->uid);
-		if (is_null($user)) {
-			$this->logger->error('could not get user for uid=' . $this->uid . '', ['app' => 'user_ldap']);
-			return;
-		}
-		// prepare AccountManager and Account
-		$accountManager = Server::get(IAccountManager::class);
-		$account = $accountManager->getAccount($user);	// get Account
-		$defaultScopes = array_merge(AccountManager::DEFAULT_SCOPES,
-			$this->config->getSystemValue('account_manager.default_property_scope', []));
-		// loop through the properties and handle them
-		foreach ($profileValues as $property => $valueFromLDAP) {
-			// check and update profile properties
-			$value = (is_array($valueFromLDAP) ? $valueFromLDAP[0] : $valueFromLDAP); // take ONLY the first value, if multiple values specified
-			try {
-				$accountProperty = $account->getProperty($property);
-				$currentValue = $accountProperty->getValue();
-				$scope = ($accountProperty->getScope() ?: $defaultScopes[$property]);
-			} catch (PropertyDoesNotExistException $e) { // thrown at getProperty
-				$this->logger->error('property does not exist: ' . $property
-					. ' for uid=' . $this->uid . '', ['app' => 'user_ldap', 'exception' => $e]);
-				$currentValue = '';
-				$scope = $defaultScopes[$property];
-			}
-			$verified = IAccountManager::VERIFIED; // trust the LDAP admin knew what they put there
-			if ($currentValue !== $value) {
-				$account->setProperty($property, $value, $scope, $verified);
-				$this->logger->debug('update user profile: ' . $property . '=' . $value
-					. ' for uid=' . $this->uid . '', ['app' => 'user_ldap']);
-			}
-		}
-		try {
-			$accountManager->updateAccount($account); // may throw InvalidArgumentException
-		} catch (\InvalidArgumentException $e) {
-			$this->logger->error('invalid data from LDAP: for uid=' . $this->uid . '', ['app' => 'user_ldap', 'func' => 'updateProfile'
-				, 'exception' => $e]);
-		}
-	}
-
-	/**
-	 * @brief attempts to get an image from LDAP and sets it as Nextcloud avatar
-	 * @return bool true when the avatar was set successfully or is up to date
-	 */
-	public function updateAvatar(bool $force = false): bool {
-		if (!$force && $this->wasRefreshed('avatar')) {
-			return false;
-		}
-		$avatarImage = $this->getAvatarImage();
-		if ($avatarImage === false) {
-			//not set, nothing left to do;
-			return false;
-		}
-
-		if (!$this->image->loadFromBase64(base64_encode($avatarImage))) {
-			return false;
-		}
-
-		// use the checksum before modifications
-		$checksum = md5($this->image->data());
-
-		if ($checksum === $this->config->getUserValue($this->uid, 'user_ldap', 'lastAvatarChecksum', '') && $this->avatarExists()) {
-			return true;
-		}
-
-		$isSet = $this->setNextcloudAvatar();
-
-		if ($isSet) {
-			// save checksum only after successful setting
-			$this->config->setUserValue($this->uid, 'user_ldap', 'lastAvatarChecksum', $checksum);
-		}
-
-		return $isSet;
-	}
-
-	private function avatarExists(): bool {
-		try {
-			$currentAvatar = $this->avatarManager->getAvatar($this->uid);
-			return $currentAvatar->exists() && $currentAvatar->isCustomAvatar();
-		} catch (\Exception $e) {
-			return false;
-		}
-	}
-
-	/**
-	 * @brief sets an image as Nextcloud avatar
-	 */
-	private function setNextcloudAvatar(): bool {
-		if (!$this->image->valid()) {
-			$this->logger->error('avatar image data from LDAP invalid for ' . $this->dn, ['app' => 'user_ldap']);
-			return false;
-		}
-
-
-		//make sure it is a square and not bigger than 512x512
-		$size = min([$this->image->width(), $this->image->height(), 512]);
-		if (!$this->image->centerCrop($size)) {
-			$this->logger->error('croping image for avatar failed for ' . $this->dn, ['app' => 'user_ldap']);
-			return false;
-		}
-
-		try {
-			$avatar = $this->avatarManager->getAvatar($this->uid);
-			$avatar->set($this->image);
-			return true;
-		} catch (\Exception $e) {
-			$this->logger->info('Could not set avatar for ' . $this->dn, ['exception' => $e]);
-		}
-		return false;
-	}
-
-	/**
-	 * @throws AttributeNotSet
-	 * @throws \OC\ServerNotAvailableException
-	 * @throws PreConditionNotMetException
-	 */
-	public function getExtStorageHome():string {
-		$value = $this->config->getUserValue($this->getUsername(), 'user_ldap', 'extStorageHome', '');
-		if ($value !== '') {
-			return $value;
-		}
-
-		$value = $this->updateExtStorageHome();
-		if ($value !== '') {
-			return $value;
-		}
-
-		throw new AttributeNotSet(sprintf(
-			'external home storage attribute yield no value for %s', $this->getUsername()
-		));
-	}
-
-	/**
-	 * @throws PreConditionNotMetException
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	public function updateExtStorageHome(?string $valueFromLDAP = null):string {
-		if ($valueFromLDAP === null) {
-			$extHomeValues = $this->access->readAttribute($this->getDN(), $this->connection->ldapExtStorageHomeAttribute);
-		} else {
-			$extHomeValues = [$valueFromLDAP];
-		}
-		if ($extHomeValues !== false && isset($extHomeValues[0])) {
-			$extHome = $extHomeValues[0];
-			$this->config->setUserValue($this->getUsername(), 'user_ldap', 'extStorageHome', $extHome);
-			return $extHome;
-		} else {
-			$this->config->deleteUserValue($this->getUsername(), 'user_ldap', 'extStorageHome');
-			return '';
-		}
-	}
-
-	/**
-	 * called by a post_login hook to handle password expiry
-	 */
-	public function handlePasswordExpiry(array $params): void {
-		$ppolicyDN = $this->connection->ldapDefaultPPolicyDN;
-		if (empty($ppolicyDN) || ((int)$this->connection->turnOnPasswordChange !== 1)) {
-			//password expiry handling disabled
-			return;
-		}
-		$uid = $params['uid'];
-		if (isset($uid) && $uid === $this->getUsername()) {
-			//retrieve relevant user attributes
-			$result = $this->access->search('objectclass=*', $this->dn, ['pwdpolicysubentry', 'pwdgraceusetime', 'pwdreset', 'pwdchangedtime']);
-
-			if (array_key_exists('pwdpolicysubentry', $result[0])) {
-				$pwdPolicySubentry = $result[0]['pwdpolicysubentry'];
-				if ($pwdPolicySubentry && (count($pwdPolicySubentry) > 0)) {
-					$ppolicyDN = $pwdPolicySubentry[0];//custom ppolicy DN
-				}
-			}
-
-			$pwdGraceUseTime = array_key_exists('pwdgraceusetime', $result[0]) ? $result[0]['pwdgraceusetime'] : [];
-			$pwdReset = array_key_exists('pwdreset', $result[0]) ? $result[0]['pwdreset'] : [];
-			$pwdChangedTime = array_key_exists('pwdchangedtime', $result[0]) ? $result[0]['pwdchangedtime'] : [];
-
-			//retrieve relevant password policy attributes
-			$cacheKey = 'ppolicyAttributes' . $ppolicyDN;
-			$result = $this->connection->getFromCache($cacheKey);
-			if (is_null($result)) {
-				$result = $this->access->search('objectclass=*', $ppolicyDN, ['pwdgraceauthnlimit', 'pwdmaxage', 'pwdexpirewarning']);
-				$this->connection->writeToCache($cacheKey, $result);
-			}
-
-			$pwdGraceAuthNLimit = array_key_exists('pwdgraceauthnlimit', $result[0]) ? $result[0]['pwdgraceauthnlimit'] : [];
-			$pwdMaxAge = array_key_exists('pwdmaxage', $result[0]) ? $result[0]['pwdmaxage'] : [];
-			$pwdExpireWarning = array_key_exists('pwdexpirewarning', $result[0]) ? $result[0]['pwdexpirewarning'] : [];
-
-			//handle grace login
-			if (!empty($pwdGraceUseTime)) { //was this a grace login?
-				if (!empty($pwdGraceAuthNLimit)
-					&& count($pwdGraceUseTime) < (int)$pwdGraceAuthNLimit[0]) { //at least one more grace login available?
-					$this->config->setUserValue($uid, 'user_ldap', 'needsPasswordReset', 'true');
-					header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
-						'user_ldap.renewPassword.showRenewPasswordForm', ['user' => $uid]));
-				} else { //no more grace login available
-					header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
-						'user_ldap.renewPassword.showLoginFormInvalidPassword', ['user' => $uid]));
-				}
-				exit();
-			}
-			//handle pwdReset attribute
-			if (!empty($pwdReset) && $pwdReset[0] === 'TRUE') { //user must change their password
-				$this->config->setUserValue($uid, 'user_ldap', 'needsPasswordReset', 'true');
-				header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
-					'user_ldap.renewPassword.showRenewPasswordForm', ['user' => $uid]));
-				exit();
-			}
-			//handle password expiry warning
-			if (!empty($pwdChangedTime)) {
-				if (!empty($pwdMaxAge)
-					&& !empty($pwdExpireWarning)) {
-					$pwdMaxAgeInt = (int)$pwdMaxAge[0];
-					$pwdExpireWarningInt = (int)$pwdExpireWarning[0];
-					if ($pwdMaxAgeInt > 0 && $pwdExpireWarningInt > 0) {
-						$pwdChangedTimeDt = \DateTime::createFromFormat('YmdHisZ', $pwdChangedTime[0]);
-						$pwdChangedTimeDt->add(new \DateInterval('PT' . $pwdMaxAgeInt . 'S'));
-						$currentDateTime = new \DateTime();
-						$secondsToExpiry = $pwdChangedTimeDt->getTimestamp() - $currentDateTime->getTimestamp();
-						if ($secondsToExpiry <= $pwdExpireWarningInt) {
-							//remove last password expiry warning if any
-							$notification = $this->notificationManager->createNotification();
-							$notification->setApp('user_ldap')
-								->setUser($uid)
-								->setObject('pwd_exp_warn', $uid)
-							;
-							$this->notificationManager->markProcessed($notification);
-							//create new password expiry warning
-							$notification = $this->notificationManager->createNotification();
-							$notification->setApp('user_ldap')
-								->setUser($uid)
-								->setDateTime($currentDateTime)
-								->setObject('pwd_exp_warn', $uid)
-								->setSubject('pwd_exp_warn_days', [(int)ceil($secondsToExpiry / 60 / 60 / 24)])
-							;
-							$this->notificationManager->notify($notification);
-						}
-					}
-				}
-			}
-		}
-	}
+    protected Connection $connection;
+    /**
+     * @var array<string,1>
+     */
+    protected array $refreshedFeatures = [];
+    protected string|false|null $avatarImage = null;
+
+    protected BirthdateParserService $birthdateParser;
+
+    /**
+     * DB config keys for user preferences
+     * @var string
+     */
+    public const USER_PREFKEY_FIRSTLOGIN = 'firstLoginAccomplished';
+
+    /**
+     * @brief constructor, make sure the subclasses call this one!
+     */
+    public function __construct(
+        protected string $uid,
+        protected string $dn,
+        protected Access $access,
+        protected IConfig $config,
+        protected Image $image,
+        protected LoggerInterface $logger,
+        protected IAvatarManager $avatarManager,
+        protected IUserManager $userManager,
+        protected INotificationManager $notificationManager,
+    ) {
+        if ($uid === '') {
+            $logger->error("uid for '$dn' must not be an empty string", ['app' => 'user_ldap']);
+            throw new \InvalidArgumentException('uid must not be an empty string!');
+        }
+        $this->connection = $this->access->getConnection();
+        $this->birthdateParser = new BirthdateParserService();
+
+        Util::connectHook('OC_User', 'post_login', $this, 'handlePasswordExpiry');
+    }
+
+    /**
+     * marks a user as deleted
+     *
+     * @throws PreConditionNotMetException
+     */
+    public function markUser(): void {
+        $curValue = $this->config->getUserValue($this->getUsername(), 'user_ldap', 'isDeleted', '0');
+        if ($curValue === '1') {
+            // the user is already marked, do not write to DB again
+            return;
+        }
+        $this->config->setUserValue($this->getUsername(), 'user_ldap', 'isDeleted', '1');
+        $this->config->setUserValue($this->getUsername(), 'user_ldap', 'foundDeleted', (string)time());
+    }
+
+    /**
+     * processes results from LDAP for attributes as returned by getAttributesToRead()
+     * @param array $ldapEntry the user entry as retrieved from LDAP
+     */
+    public function processAttributes(array $ldapEntry): void {
+        //Quota
+        $attr = strtolower($this->connection->ldapQuotaAttribute);
+        if (isset($ldapEntry[$attr])) {
+            $this->updateQuota($ldapEntry[$attr][0]);
+        } else {
+            if ($this->connection->ldapQuotaDefault !== '') {
+                $this->updateQuota();
+            }
+        }
+        unset($attr);
+
+        //displayName
+        $displayName = $displayName2 = '';
+        $attr = strtolower($this->connection->ldapUserDisplayName);
+        if (isset($ldapEntry[$attr])) {
+            $displayName = (string)$ldapEntry[$attr][0];
+        }
+        $attr = strtolower($this->connection->ldapUserDisplayName2);
+        if (isset($ldapEntry[$attr])) {
+            $displayName2 = (string)$ldapEntry[$attr][0];
+        }
+        if ($displayName !== '') {
+            $this->composeAndStoreDisplayName($displayName, $displayName2);
+            $this->access->cacheUserDisplayName(
+                $this->getUsername(),
+                $displayName,
+                $displayName2
+            );
+        }
+        unset($attr);
+
+        //Email
+        //email must be stored after displayname, because it would cause a user
+        //change event that will trigger fetching the display name again
+        $attr = strtolower($this->connection->ldapEmailAttribute);
+        if (isset($ldapEntry[$attr])) {
+            $mailValue = 0;
+            for ($x = 0; $x < count($ldapEntry[$attr]); $x++) {
+                if (filter_var($ldapEntry[$attr][$x], FILTER_VALIDATE_EMAIL)) {
+                    $mailValue = $x;
+                    break;
+                }
+            }
+            $this->updateEmail($ldapEntry[$attr][$mailValue]);
+        }
+        unset($attr);
+
+        // LDAP Username, needed for s2s sharing
+        if (isset($ldapEntry['uid'])) {
+            $this->storeLDAPUserName($ldapEntry['uid'][0]);
+        } elseif (isset($ldapEntry['samaccountname'])) {
+            $this->storeLDAPUserName($ldapEntry['samaccountname'][0]);
+        }
+
+        //homePath
+        if (str_starts_with($this->connection->homeFolderNamingRule, 'attr:')) {
+            $attr = strtolower(substr($this->connection->homeFolderNamingRule, strlen('attr:')));
+            if (isset($ldapEntry[$attr])) {
+                $this->access->cacheUserHome(
+                    $this->getUsername(), $this->getHomePath($ldapEntry[$attr][0]));
+            }
+        }
+
+        //memberOf groups
+        $cacheKey = 'getMemberOf' . $this->getUsername();
+        $groups = false;
+        if (isset($ldapEntry['memberof'])) {
+            $groups = $ldapEntry['memberof'];
+        }
+        $this->connection->writeToCache($cacheKey, $groups);
+
+        //external storage var
+        $attr = strtolower($this->connection->ldapExtStorageHomeAttribute);
+        if (isset($ldapEntry[$attr])) {
+            $this->updateExtStorageHome($ldapEntry[$attr][0]);
+        }
+        unset($attr);
+
+        // check for cached profile data
+        $username = $this->getUsername(); // buffer variable, to save resource
+        $cacheKey = 'getUserProfile-' . $username;
+        $profileCached = $this->connection->getFromCache($cacheKey);
+        // honoring profile disabled in config.php and check if user profile was refreshed
+        if ($this->config->getSystemValueBool('profile.enabled', true) &&
+            ($profileCached === null) && // no cache or TTL not expired
+            !$this->wasRefreshed('profile')) {
+            // check current data
+            $profileValues = [];
+            //User Profile Field - Phone number
+            $attr = strtolower($this->connection->ldapAttributePhone);
+            if (!empty($attr)) { // attribute configured
+                $profileValues[IAccountManager::PROPERTY_PHONE]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - website
+            $attr = strtolower($this->connection->ldapAttributeWebsite);
+            if (isset($ldapEntry[$attr])) {
+                $cutPosition = strpos($ldapEntry[$attr][0], ' ');
+                if ($cutPosition) {
+                    // drop appended label
+                    $profileValues[IAccountManager::PROPERTY_WEBSITE]
+                        = substr($ldapEntry[$attr][0], 0, $cutPosition);
+                } else {
+                    $profileValues[IAccountManager::PROPERTY_WEBSITE]
+                        = $ldapEntry[$attr][0];
+                }
+            } elseif (!empty($attr)) {	// configured, but not defined
+                $profileValues[IAccountManager::PROPERTY_WEBSITE] = '';
+            }
+            //User Profile Field - Address
+            $attr = strtolower($this->connection->ldapAttributeAddress);
+            if (isset($ldapEntry[$attr])) {
+                if (str_contains($ldapEntry[$attr][0], '$')) {
+                    // basic format conversion from postalAddress syntax to commata delimited
+                    $profileValues[IAccountManager::PROPERTY_ADDRESS]
+                        = str_replace('$', ', ', $ldapEntry[$attr][0]);
+                } else {
+                    $profileValues[IAccountManager::PROPERTY_ADDRESS]
+                        = $ldapEntry[$attr][0];
+                }
+            } elseif (!empty($attr)) {	// configured, but not defined
+                $profileValues[IAccountManager::PROPERTY_ADDRESS] = '';
+            }
+            //User Profile Field - Twitter
+            $attr = strtolower($this->connection->ldapAttributeTwitter);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_TWITTER]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - fediverse
+            $attr = strtolower($this->connection->ldapAttributeFediverse);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_FEDIVERSE]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - organisation
+            $attr = strtolower($this->connection->ldapAttributeOrganisation);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_ORGANISATION]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - role
+            $attr = strtolower($this->connection->ldapAttributeRole);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_ROLE]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - headline
+            $attr = strtolower($this->connection->ldapAttributeHeadline);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_HEADLINE]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            //User Profile Field - biography
+            $attr = strtolower($this->connection->ldapAttributeBiography);
+            if (isset($ldapEntry[$attr])) {
+                if (str_contains($ldapEntry[$attr][0], '\r')) {
+                    // convert line endings
+                    $profileValues[IAccountManager::PROPERTY_BIOGRAPHY]
+                        = str_replace(["\r\n","\r"], "\n", $ldapEntry[$attr][0]);
+                } else {
+                    $profileValues[IAccountManager::PROPERTY_BIOGRAPHY]
+                        = $ldapEntry[$attr][0];
+                }
+            } elseif (!empty($attr)) {	// configured, but not defined
+                $profileValues[IAccountManager::PROPERTY_BIOGRAPHY] = '';
+            }
+            //User Profile Field - birthday
+            $attr = strtolower($this->connection->ldapAttributeBirthDate);
+            if (!empty($attr) && !empty($ldapEntry[$attr][0])) {
+                $value = $ldapEntry[$attr][0];
+                try {
+                    $birthdate = $this->birthdateParser->parseBirthdate($value);
+                    $profileValues[IAccountManager::PROPERTY_BIRTHDATE]
+                        = $birthdate->format('Y-m-d');
+                } catch (InvalidArgumentException $e) {
+                    // Invalid date -> just skip the property
+                    $this->logger->info("Failed to parse user's birthdate from LDAP: $value", [
+                        'exception' => $e,
+                        'userId' => $username,
+                    ]);
+                }
+            }
+            //User Profile Field - pronouns
+            $attr = strtolower($this->connection->ldapAttributePronouns);
+            if (!empty($attr)) {
+                $profileValues[IAccountManager::PROPERTY_PRONOUNS]
+                    = $ldapEntry[$attr][0] ?? '';
+            }
+            // check for changed data and cache just for TTL checking
+            $checksum = hash('sha256', json_encode($profileValues));
+            $this->connection->writeToCache($cacheKey, $checksum // write array to cache. is waste of cache space
+                , null); // use ldapCacheTTL from configuration
+            // Update user profile
+            if ($this->config->getUserValue($username, 'user_ldap', 'lastProfileChecksum', null) !== $checksum) {
+                $this->config->setUserValue($username, 'user_ldap', 'lastProfileChecksum', $checksum);
+                $this->updateProfile($profileValues);
+                $this->logger->info("updated profile uid=$username", ['app' => 'user_ldap']);
+            } else {
+                $this->logger->debug('profile data from LDAP unchanged', ['app' => 'user_ldap', 'uid' => $username]);
+            }
+            unset($attr);
+        } elseif ($profileCached !== null) { // message delayed, to declutter log
+            $this->logger->debug('skipping profile check, while cached data exist', ['app' => 'user_ldap', 'uid' => $username]);
+        }
+
+        //Avatar
+        /** @var Connection $connection */
+        $connection = $this->access->getConnection();
+        $attributes = $connection->resolveRule('avatar');
+        foreach ($attributes as $attribute) {
+            if (isset($ldapEntry[$attribute])) {
+                $this->avatarImage = $ldapEntry[$attribute][0];
+                $this->updateAvatar();
+                break;
+            }
+        }
+    }
+
+    /**
+     * @brief returns the LDAP DN of the user
+     * @return string
+     */
+    public function getDN() {
+        return $this->dn;
+    }
+
+    /**
+     * @brief returns the Nextcloud internal username of the user
+     * @return string
+     */
+    public function getUsername() {
+        return $this->uid;
+    }
+
+    /**
+     * returns the home directory of the user if specified by LDAP settings
+     * @throws \Exception
+     */
+    public function getHomePath(?string $valueFromLDAP = null): string|false {
+        $path = (string)$valueFromLDAP;
+        $attr = null;
+
+        if (is_null($valueFromLDAP)
+           && str_starts_with($this->access->connection->homeFolderNamingRule, 'attr:')
+           && $this->access->connection->homeFolderNamingRule !== 'attr:') {
+            $attr = substr($this->access->connection->homeFolderNamingRule, strlen('attr:'));
+            $dn = $this->access->username2dn($this->getUsername());
+            if ($dn === false) {
+                return false;
+            }
+            $homedir = $this->access->readAttribute($dn, $attr);
+            if ($homedir !== false && isset($homedir[0])) {
+                $path = $homedir[0];
+            }
+        }
+
+        if ($path !== '') {
+            //if attribute's value is an absolute path take this, otherwise append it to data dir
+            //check for / at the beginning or pattern c:\ resp. c:/
+            if ($path[0] !== '/'
+               && !(strlen($path) > 3 && ctype_alpha($path[0])
+                   && $path[1] === ':' && ($path[2] === '\\' || $path[2] === '/'))
+            ) {
+                $path = $this->config->getSystemValue('datadirectory',
+                    \OC::$SERVERROOT . '/data') . '/' . $path;
+            }
+            //we need it to store it in the DB as well in case a user gets
+            //deleted so we can clean up afterwards
+            $this->config->setUserValue(
+                $this->getUsername(), 'user_ldap', 'homePath', $path
+            );
+            return $path;
+        }
+
+        if (!is_null($attr)
+            && $this->config->getAppValue('user_ldap', 'enforce_home_folder_naming_rule', 'true')
+        ) {
+            // a naming rule attribute is defined, but it doesn't exist for that LDAP user
+            throw new \Exception('Home dir attribute can\'t be read from LDAP for uid: ' . $this->getUsername());
+        }
+
+        //false will apply default behaviour as defined and done by OC_User
+        $this->config->setUserValue($this->getUsername(), 'user_ldap', 'homePath', '');
+        return false;
+    }
+
+    public function getMemberOfGroups(): array|false {
+        $cacheKey = 'getMemberOf' . $this->getUsername();
+        $memberOfGroups = $this->connection->getFromCache($cacheKey);
+        if (!is_null($memberOfGroups)) {
+            return $memberOfGroups;
+        }
+        $groupDNs = $this->access->readAttribute($this->getDN(), 'memberOf');
+        $this->connection->writeToCache($cacheKey, $groupDNs);
+        return $groupDNs;
+    }
+
+    /**
+     * @brief reads the image from LDAP that shall be used as Avatar
+     * @return string|false data (provided by LDAP)
+     */
+    public function getAvatarImage(): string|false {
+        if (!is_null($this->avatarImage)) {
+            return $this->avatarImage;
+        }
+
+        $this->avatarImage = false;
+        /** @var Connection $connection */
+        $connection = $this->access->getConnection();
+        $attributes = $connection->resolveRule('avatar');
+        foreach ($attributes as $attribute) {
+            $result = $this->access->readAttribute($this->dn, $attribute);
+            if ($result !== false && isset($result[0])) {
+                $this->avatarImage = $result[0];
+                break;
+            }
+        }
+
+        return $this->avatarImage;
+    }
+
+    /**
+     * @brief marks the user as having logged in at least once
+     */
+    public function markLogin(): void {
+        $this->config->setUserValue(
+            $this->uid, 'user_ldap', self::USER_PREFKEY_FIRSTLOGIN, '1');
+    }
+
+    /**
+     * Stores a key-value pair in relation to this user
+     */
+    private function store(string $key, string $value): void {
+        $this->config->setUserValue($this->uid, 'user_ldap', $key, $value);
+    }
+
+    /**
+     * Composes the display name and stores it in the database. The final
+     * display name is returned.
+     *
+     * @return string the effective display name
+     */
+    public function composeAndStoreDisplayName(string $displayName, string $displayName2 = ''): string {
+        if ($displayName2 !== '') {
+            $displayName .= ' (' . $displayName2 . ')';
+        }
+        $oldName = $this->config->getUserValue($this->uid, 'user_ldap', 'displayName', null);
+        if ($oldName !== $displayName) {
+            $this->store('displayName', $displayName);
+            $user = $this->userManager->get($this->getUsername());
+            if (!empty($oldName) && $user instanceof \OC\User\User) {
+                // if it was empty, it would be a new record, not a change emitting the trigger could
+                // potentially cause a UniqueConstraintViolationException, depending on some factors.
+                $user->triggerChange('displayName', $displayName, $oldName);
+            }
+        }
+        return $displayName;
+    }
+
+    /**
+     * Stores the LDAP Username in the Database
+     */
+    public function storeLDAPUserName(string $userName): void {
+        $this->store('uid', $userName);
+    }
+
+    /**
+     * @brief checks whether an update method specified by feature was run
+     * already. If not, it will marked like this, because it is expected that
+     * the method will be run, when false is returned.
+     * @param string $feature email | quota | avatar | profile (can be extended)
+     */
+    private function wasRefreshed(string $feature): bool {
+        if (isset($this->refreshedFeatures[$feature])) {
+            return true;
+        }
+        $this->refreshedFeatures[$feature] = 1;
+        return false;
+    }
+
+    /**
+     * fetches the email from LDAP and stores it as Nextcloud user value
+     * @param ?string $valueFromLDAP if known, to save an LDAP read request
+     */
+    public function updateEmail(?string $valueFromLDAP = null): void {
+        if ($this->wasRefreshed('email')) {
+            return;
+        }
+        $email = (string)$valueFromLDAP;
+        if (is_null($valueFromLDAP)) {
+            $emailAttribute = $this->connection->ldapEmailAttribute;
+            if ($emailAttribute !== '') {
+                $aEmail = $this->access->readAttribute($this->dn, $emailAttribute);
+                if (is_array($aEmail) && (count($aEmail) > 0)) {
+                    $email = (string)$aEmail[0];
+                }
+            }
+        }
+        if ($email !== '') {
+            $user = $this->userManager->get($this->uid);
+            if (!is_null($user)) {
+                $currentEmail = (string)$user->getSystemEMailAddress();
+                if ($currentEmail !== $email) {
+                    $user->setSystemEMailAddress($email);
+                }
+            }
+        }
+    }
+
+    /**
+     * Overall process goes as follow:
+     * 1. fetch the quota from LDAP and check if it's parseable with the "verifyQuotaValue" function
+     * 2. if the value can't be fetched, is empty or not parseable, use the default LDAP quota
+     * 3. if the default LDAP quota can't be parsed, use the Nextcloud's default quota (use 'default')
+     * 4. check if the target user exists and set the quota for the user.
+     *
+     * In order to improve performance and prevent an unwanted extra LDAP call, the $valueFromLDAP
+     * parameter can be passed with the value of the attribute. This value will be considered as the
+     * quota for the user coming from the LDAP server (step 1 of the process) It can be useful to
+     * fetch all the user's attributes in one call and use the fetched values in this function.
+     * The expected value for that parameter is a string describing the quota for the user. Valid
+     * values are 'none' (unlimited), 'default' (the Nextcloud's default quota), '1234' (quota in
+     * bytes), '1234 MB' (quota in MB - check the \OCP\Util::computerFileSize method for more info)
+     *
+     * fetches the quota from LDAP and stores it as Nextcloud user value
+     * @param ?string $valueFromLDAP the quota attribute's value can be passed,
+     *                               to save the readAttribute request
+     */
+    public function updateQuota(?string $valueFromLDAP = null): void {
+        if ($this->wasRefreshed('quota')) {
+            return;
+        }
+
+        $quotaAttribute = $this->connection->ldapQuotaAttribute;
+        $defaultQuota = $this->connection->ldapQuotaDefault;
+        if ($quotaAttribute === '' && $defaultQuota === '') {
+            return;
+        }
+
+        $quota = false;
+        if (is_null($valueFromLDAP) && $quotaAttribute !== '') {
+            $aQuota = $this->access->readAttribute($this->dn, $quotaAttribute);
+            if ($aQuota !== false && isset($aQuota[0]) && $this->verifyQuotaValue($aQuota[0])) {
+                $quota = $aQuota[0];
+            } elseif (is_array($aQuota) && isset($aQuota[0])) {
+                $this->logger->debug('no suitable LDAP quota found for user ' . $this->uid . ': [' . $aQuota[0] . ']', ['app' => 'user_ldap']);
+            }
+        } elseif (!is_null($valueFromLDAP) && $this->verifyQuotaValue($valueFromLDAP)) {
+            $quota = $valueFromLDAP;
+        } else {
+            $this->logger->debug('no suitable LDAP quota found for user ' . $this->uid . ': [' . ($valueFromLDAP ?? '') . ']', ['app' => 'user_ldap']);
+        }
+
+        if ($quota === false && $this->verifyQuotaValue($defaultQuota)) {
+            // quota not found using the LDAP attribute (or not parseable). Try the default quota
+            $quota = $defaultQuota;
+        } elseif ($quota === false) {
+            $this->logger->debug('no suitable default quota found for user ' . $this->uid . ': [' . $defaultQuota . ']', ['app' => 'user_ldap']);
+            return;
+        }
+
+        $targetUser = $this->userManager->get($this->uid);
+        if ($targetUser instanceof IUser) {
+            $targetUser->setQuota($quota);
+        } else {
+            $this->logger->info('trying to set a quota for user ' . $this->uid . ' but the user is missing', ['app' => 'user_ldap']);
+        }
+    }
+
+    private function verifyQuotaValue(string $quotaValue): bool {
+        return $quotaValue === 'none' || $quotaValue === 'default' || Util::computerFileSize($quotaValue) !== false;
+    }
+
+    /**
+     * takes values from LDAP and stores it as Nextcloud user profile value
+     *
+     * @param array $profileValues associative array of property keys and values from LDAP
+     */
+    private function updateProfile(array $profileValues): void {
+        // check if given array is empty
+        if (empty($profileValues)) {
+            return; // okay, nothing to do
+        }
+        // fetch/prepare user
+        $user = $this->userManager->get($this->uid);
+        if (is_null($user)) {
+            $this->logger->error('could not get user for uid=' . $this->uid . '', ['app' => 'user_ldap']);
+            return;
+        }
+        // prepare AccountManager and Account
+        $accountManager = Server::get(IAccountManager::class);
+        $account = $accountManager->getAccount($user);	// get Account
+        $defaultScopes = array_merge(AccountManager::DEFAULT_SCOPES,
+            $this->config->getSystemValue('account_manager.default_property_scope', []));
+        // loop through the properties and handle them
+        foreach ($profileValues as $property => $valueFromLDAP) {
+            // check and update profile properties
+            $value = (is_array($valueFromLDAP) ? $valueFromLDAP[0] : $valueFromLDAP); // take ONLY the first value, if multiple values specified
+            try {
+                $accountProperty = $account->getProperty($property);
+                $currentValue = $accountProperty->getValue();
+                $scope = ($accountProperty->getScope() ?: $defaultScopes[$property]);
+            } catch (PropertyDoesNotExistException $e) { // thrown at getProperty
+                $this->logger->error('property does not exist: ' . $property
+                    . ' for uid=' . $this->uid . '', ['app' => 'user_ldap', 'exception' => $e]);
+                $currentValue = '';
+                $scope = $defaultScopes[$property];
+            }
+            $verified = IAccountManager::VERIFIED; // trust the LDAP admin knew what they put there
+            if ($currentValue !== $value) {
+                $account->setProperty($property, $value, $scope, $verified);
+                $this->logger->debug('update user profile: ' . $property . '=' . $value
+                    . ' for uid=' . $this->uid . '', ['app' => 'user_ldap']);
+            }
+        }
+        try {
+            $accountManager->updateAccount($account); // may throw InvalidArgumentException
+        } catch (\InvalidArgumentException $e) {
+            $this->logger->error('invalid data from LDAP: for uid=' . $this->uid . '', ['app' => 'user_ldap', 'func' => 'updateProfile'
+                , 'exception' => $e]);
+        }
+    }
+
+    /**
+     * @brief attempts to get an image from LDAP and sets it as Nextcloud avatar
+     * @return bool true when the avatar was set successfully or is up to date
+     */
+    public function updateAvatar(bool $force = false): bool {
+        if (!$force && $this->wasRefreshed('avatar')) {
+            return false;
+        }
+        $avatarImage = $this->getAvatarImage();
+        if ($avatarImage === false) {
+            //not set, nothing left to do;
+            return false;
+        }
+
+        if (!$this->image->loadFromBase64(base64_encode($avatarImage))) {
+            return false;
+        }
+
+        // use the checksum before modifications
+        $checksum = md5($this->image->data());
+
+        if ($checksum === $this->config->getUserValue($this->uid, 'user_ldap', 'lastAvatarChecksum', '') && $this->avatarExists()) {
+            return true;
+        }
+
+        $isSet = $this->setNextcloudAvatar();
+
+        if ($isSet) {
+            // save checksum only after successful setting
+            $this->config->setUserValue($this->uid, 'user_ldap', 'lastAvatarChecksum', $checksum);
+        }
+
+        return $isSet;
+    }
+
+    private function avatarExists(): bool {
+        try {
+            $currentAvatar = $this->avatarManager->getAvatar($this->uid);
+            return $currentAvatar->exists() && $currentAvatar->isCustomAvatar();
+        } catch (\Exception $e) {
+            return false;
+        }
+    }
+
+    /**
+     * @brief sets an image as Nextcloud avatar
+     */
+    private function setNextcloudAvatar(): bool {
+        if (!$this->image->valid()) {
+            $this->logger->error('avatar image data from LDAP invalid for ' . $this->dn, ['app' => 'user_ldap']);
+            return false;
+        }
+
+
+        //make sure it is a square and not bigger than 512x512
+        $size = min([$this->image->width(), $this->image->height(), 512]);
+        if (!$this->image->centerCrop($size)) {
+            $this->logger->error('croping image for avatar failed for ' . $this->dn, ['app' => 'user_ldap']);
+            return false;
+        }
+
+        try {
+            $avatar = $this->avatarManager->getAvatar($this->uid);
+            $avatar->set($this->image);
+            return true;
+        } catch (\Exception $e) {
+            $this->logger->info('Could not set avatar for ' . $this->dn, ['exception' => $e]);
+        }
+        return false;
+    }
+
+    /**
+     * @throws AttributeNotSet
+     * @throws \OC\ServerNotAvailableException
+     * @throws PreConditionNotMetException
+     */
+    public function getExtStorageHome():string {
+        $value = $this->config->getUserValue($this->getUsername(), 'user_ldap', 'extStorageHome', '');
+        if ($value !== '') {
+            return $value;
+        }
+
+        $value = $this->updateExtStorageHome();
+        if ($value !== '') {
+            return $value;
+        }
+
+        throw new AttributeNotSet(sprintf(
+            'external home storage attribute yield no value for %s', $this->getUsername()
+        ));
+    }
+
+    /**
+     * @throws PreConditionNotMetException
+     * @throws \OC\ServerNotAvailableException
+     */
+    public function updateExtStorageHome(?string $valueFromLDAP = null):string {
+        if ($valueFromLDAP === null) {
+            $extHomeValues = $this->access->readAttribute($this->getDN(), $this->connection->ldapExtStorageHomeAttribute);
+        } else {
+            $extHomeValues = [$valueFromLDAP];
+        }
+        if ($extHomeValues !== false && isset($extHomeValues[0])) {
+            $extHome = $extHomeValues[0];
+            $this->config->setUserValue($this->getUsername(), 'user_ldap', 'extStorageHome', $extHome);
+            return $extHome;
+        } else {
+            $this->config->deleteUserValue($this->getUsername(), 'user_ldap', 'extStorageHome');
+            return '';
+        }
+    }
+
+    /**
+     * called by a post_login hook to handle password expiry
+     */
+    public function handlePasswordExpiry(array $params): void {
+        $ppolicyDN = $this->connection->ldapDefaultPPolicyDN;
+        if (empty($ppolicyDN) || ((int)$this->connection->turnOnPasswordChange !== 1)) {
+            //password expiry handling disabled
+            return;
+        }
+        $uid = $params['uid'];
+        if (isset($uid) && $uid === $this->getUsername()) {
+            //retrieve relevant user attributes
+            $result = $this->access->search('objectclass=*', $this->dn, ['pwdpolicysubentry', 'pwdgraceusetime', 'pwdreset', 'pwdchangedtime']);
+
+            if (array_key_exists('pwdpolicysubentry', $result[0])) {
+                $pwdPolicySubentry = $result[0]['pwdpolicysubentry'];
+                if ($pwdPolicySubentry && (count($pwdPolicySubentry) > 0)) {
+                    $ppolicyDN = $pwdPolicySubentry[0];//custom ppolicy DN
+                }
+            }
+
+            $pwdGraceUseTime = array_key_exists('pwdgraceusetime', $result[0]) ? $result[0]['pwdgraceusetime'] : [];
+            $pwdReset = array_key_exists('pwdreset', $result[0]) ? $result[0]['pwdreset'] : [];
+            $pwdChangedTime = array_key_exists('pwdchangedtime', $result[0]) ? $result[0]['pwdchangedtime'] : [];
+
+            //retrieve relevant password policy attributes
+            $cacheKey = 'ppolicyAttributes' . $ppolicyDN;
+            $result = $this->connection->getFromCache($cacheKey);
+            if (is_null($result)) {
+                $result = $this->access->search('objectclass=*', $ppolicyDN, ['pwdgraceauthnlimit', 'pwdmaxage', 'pwdexpirewarning']);
+                $this->connection->writeToCache($cacheKey, $result);
+            }
+
+            $pwdGraceAuthNLimit = array_key_exists('pwdgraceauthnlimit', $result[0]) ? $result[0]['pwdgraceauthnlimit'] : [];
+            $pwdMaxAge = array_key_exists('pwdmaxage', $result[0]) ? $result[0]['pwdmaxage'] : [];
+            $pwdExpireWarning = array_key_exists('pwdexpirewarning', $result[0]) ? $result[0]['pwdexpirewarning'] : [];
+
+            //handle grace login
+            if (!empty($pwdGraceUseTime)) { //was this a grace login?
+                if (!empty($pwdGraceAuthNLimit)
+                    && count($pwdGraceUseTime) < (int)$pwdGraceAuthNLimit[0]) { //at least one more grace login available?
+                    $this->config->setUserValue($uid, 'user_ldap', 'needsPasswordReset', 'true');
+                    header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
+                        'user_ldap.renewPassword.showRenewPasswordForm', ['user' => $uid]));
+                } else { //no more grace login available
+                    header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
+                        'user_ldap.renewPassword.showLoginFormInvalidPassword', ['user' => $uid]));
+                }
+                exit();
+            }
+            //handle pwdReset attribute
+            if (!empty($pwdReset) && $pwdReset[0] === 'TRUE') { //user must change their password
+                $this->config->setUserValue($uid, 'user_ldap', 'needsPasswordReset', 'true');
+                header('Location: ' . Server::get(IURLGenerator::class)->linkToRouteAbsolute(
+                    'user_ldap.renewPassword.showRenewPasswordForm', ['user' => $uid]));
+                exit();
+            }
+            //handle password expiry warning
+            if (!empty($pwdChangedTime)) {
+                if (!empty($pwdMaxAge)
+                    && !empty($pwdExpireWarning)) {
+                    $pwdMaxAgeInt = (int)$pwdMaxAge[0];
+                    $pwdExpireWarningInt = (int)$pwdExpireWarning[0];
+                    if ($pwdMaxAgeInt > 0 && $pwdExpireWarningInt > 0) {
+                        $pwdChangedTimeDt = \DateTime::createFromFormat('YmdHisZ', $pwdChangedTime[0]);
+                        $pwdChangedTimeDt->add(new \DateInterval('PT' . $pwdMaxAgeInt . 'S'));
+                        $currentDateTime = new \DateTime();
+                        $secondsToExpiry = $pwdChangedTimeDt->getTimestamp() - $currentDateTime->getTimestamp();
+                        if ($secondsToExpiry <= $pwdExpireWarningInt) {
+                            //remove last password expiry warning if any
+                            $notification = $this->notificationManager->createNotification();
+                            $notification->setApp('user_ldap')
+                                ->setUser($uid)
+                                ->setObject('pwd_exp_warn', $uid)
+                            ;
+                            $this->notificationManager->markProcessed($notification);
+                            //create new password expiry warning
+                            $notification = $this->notificationManager->createNotification();
+                            $notification->setApp('user_ldap')
+                                ->setUser($uid)
+                                ->setDateTime($currentDateTime)
+                                ->setObject('pwd_exp_warn', $uid)
+                                ->setSubject('pwd_exp_warn_days', [(int)ceil($secondsToExpiry / 60 / 60 / 24)])
+                            ;
+                            $this->notificationManager->notify($notification);
+                        }
+                    }
+                }
+            }
+        }
+    }
 }