nextcloud / server

lib/private/Encryption/DecryptAll.php

Indentation +211 added lines, -211 removed lines

@@ -20,215 +20,215 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class DecryptAll {
-	/** @var array<string,list<string>> files which couldn't be decrypted */
-	protected array $failed = [];
-
-	public function __construct(
-		protected IManager $encryptionManager,
-		protected IUserManager $userManager,
-		protected View $rootView,
-	) {
-	}
-
-	/**
-	 * start to decrypt all files
-	 *
-	 * @param string $user which users data folder should be decrypted, default = all users
-	 * @throws \Exception
-	 */
-	public function decryptAll(InputInterface $input, OutputInterface $output, string $user = ''): bool {
-		if ($user !== '' && $this->userManager->userExists($user) === false) {
-			$output->writeln('User "' . $user . '" does not exist. Please check the username and try again');
-			return false;
-		}
-
-		$output->writeln('prepare encryption modules...');
-		if ($this->prepareEncryptionModules($input, $output, $user) === false) {
-			return false;
-		}
-		$output->writeln(' done.');
-
-		$this->failed = [];
-		$this->decryptAllUsersFiles($output, $user);
-
-		/** @psalm-suppress RedundantCondition $this->failed is modified by decryptAllUsersFiles, not clear why psalm fails to see it */
-		if (empty($this->failed)) {
-			$output->writeln('all files could be decrypted successfully!');
-		} else {
-			$output->writeln('Files for following users couldn\'t be decrypted, ');
-			$output->writeln('maybe the user is not set up in a way that supports this operation: ');
-			foreach ($this->failed as $uid => $paths) {
-				$output->writeln('    ' . $uid);
-				foreach ($paths as $path) {
-					$output->writeln('        ' . $path);
-				}
-			}
-			$output->writeln('');
-		}
-
-		return true;
-	}
-
-	/**
-	 * prepare encryption modules to perform the decrypt all function
-	 */
-	protected function prepareEncryptionModules(InputInterface $input, OutputInterface $output, string $user): bool {
-		// prepare all encryption modules for decrypt all
-		$encryptionModules = $this->encryptionManager->getEncryptionModules();
-		foreach ($encryptionModules as $moduleDesc) {
-			/** @var IEncryptionModule $module */
-			$module = call_user_func($moduleDesc['callback']);
-			$output->writeln('');
-			$output->writeln('Prepare "' . $module->getDisplayName() . '"');
-			$output->writeln('');
-			if ($module->prepareDecryptAll($input, $output, $user) === false) {
-				$output->writeln('Module "' . $moduleDesc['displayName'] . '" does not support the functionality to decrypt all files again or the initialization of the module failed!');
-				return false;
-			}
-		}
-
-		return true;
-	}
-
-	/**
-	 * iterate over all user and encrypt their files
-	 *
-	 * @param string $user which users files should be decrypted, default = all users
-	 */
-	protected function decryptAllUsersFiles(OutputInterface $output, string $user = ''): void {
-		$output->writeln("\n");
-
-		$userList = [];
-		if ($user === '') {
-			$fetchUsersProgress = new ProgressBar($output);
-			$fetchUsersProgress->setFormat(" %message% \n [%bar%]");
-			$fetchUsersProgress->start();
-			$fetchUsersProgress->setMessage('Fetch list of users...');
-			$fetchUsersProgress->advance();
-
-			foreach ($this->userManager->getBackends() as $backend) {
-				$limit = 500;
-				$offset = 0;
-				do {
-					$users = $backend->getUsers('', $limit, $offset);
-					foreach ($users as $user) {
-						$userList[] = $user;
-					}
-					$offset += $limit;
-					$fetchUsersProgress->advance();
-				} while (count($users) >= $limit);
-				$fetchUsersProgress->setMessage('Fetch list of users... finished');
-				$fetchUsersProgress->finish();
-			}
-		} else {
-			$userList[] = $user;
-		}
-
-		$output->writeln("\n\n");
-
-		$progress = new ProgressBar($output);
-		$progress->setFormat(" %message% \n [%bar%]");
-		$progress->start();
-		$progress->setMessage('starting to decrypt files...');
-		$progress->advance();
-
-		$numberOfUsers = count($userList);
-		$userNo = 1;
-		foreach ($userList as $uid) {
-			$userCount = "$uid ($userNo of $numberOfUsers)";
-			$this->decryptUsersFiles($uid, $progress, $userCount);
-			$userNo++;
-		}
-
-		$progress->setMessage('starting to decrypt files... finished');
-		$progress->finish();
-
-		$output->writeln("\n\n");
-	}
-
-	/**
-	 * encrypt files from the given user
-	 */
-	protected function decryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
-		$this->setupUserFS($uid);
-		$directories = [];
-		$directories[] = '/' . $uid . '/files';
-
-		while ($root = array_pop($directories)) {
-			$content = $this->rootView->getDirectoryContent($root);
-			foreach ($content as $file) {
-				// only decrypt files owned by the user
-				if ($file->getStorage()->instanceOfStorage('OCA\Files_Sharing\SharedStorage')) {
-					continue;
-				}
-				$path = $root . '/' . $file['name'];
-				if ($this->rootView->is_dir($path)) {
-					$directories[] = $path;
-					continue;
-				} else {
-					try {
-						$progress->setMessage("decrypt files for user $userCount: $path");
-						$progress->advance();
-						if ($file->isEncrypted() === false) {
-							$progress->setMessage("decrypt files for user $userCount: $path (already decrypted)");
-							$progress->advance();
-						} else {
-							if ($this->decryptFile($path) === false) {
-								$progress->setMessage("decrypt files for user $userCount: $path (already decrypted)");
-								$progress->advance();
-							}
-						}
-					} catch (\Exception $e) {
-						if (isset($this->failed[$uid])) {
-							$this->failed[$uid][] = $path;
-						} else {
-							$this->failed[$uid] = [$path];
-						}
-					}
-				}
-			}
-		}
-	}
-
-	/**
-	 * encrypt file
-	 */
-	protected function decryptFile(string $path): bool {
-		// skip already decrypted files
-		$fileInfo = $this->rootView->getFileInfo($path);
-		if ($fileInfo !== false && !$fileInfo->isEncrypted()) {
-			return true;
-		}
-
-		$source = $path;
-		$target = $path . '.decrypted.' . $this->getTimestamp();
-
-		try {
-			$this->rootView->copy($source, $target);
-			$this->rootView->touch($target, $fileInfo->getMTime());
-			$this->rootView->rename($target, $source);
-		} catch (DecryptionFailedException $e) {
-			if ($this->rootView->file_exists($target)) {
-				$this->rootView->unlink($target);
-			}
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * get current timestamp
-	 */
-	protected function getTimestamp(): int {
-		return time();
-	}
-
-	/**
-	 * setup user file system
-	 */
-	protected function setupUserFS(string $uid): void {
-		\OC_Util::tearDownFS();
-		\OC_Util::setupFS($uid);
-	}
+    /** @var array<string,list<string>> files which couldn't be decrypted */
+    protected array $failed = [];
+
+    public function __construct(
+        protected IManager $encryptionManager,
+        protected IUserManager $userManager,
+        protected View $rootView,
+    ) {
+    }
+
+    /**
+     * start to decrypt all files
+     *
+     * @param string $user which users data folder should be decrypted, default = all users
+     * @throws \Exception
+     */
+    public function decryptAll(InputInterface $input, OutputInterface $output, string $user = ''): bool {
+        if ($user !== '' && $this->userManager->userExists($user) === false) {
+            $output->writeln('User "' . $user . '" does not exist. Please check the username and try again');
+            return false;
+        }
+
+        $output->writeln('prepare encryption modules...');
+        if ($this->prepareEncryptionModules($input, $output, $user) === false) {
+            return false;
+        }
+        $output->writeln(' done.');
+
+        $this->failed = [];
+        $this->decryptAllUsersFiles($output, $user);
+
+        /** @psalm-suppress RedundantCondition $this->failed is modified by decryptAllUsersFiles, not clear why psalm fails to see it */
+        if (empty($this->failed)) {
+            $output->writeln('all files could be decrypted successfully!');
+        } else {
+            $output->writeln('Files for following users couldn\'t be decrypted, ');
+            $output->writeln('maybe the user is not set up in a way that supports this operation: ');
+            foreach ($this->failed as $uid => $paths) {
+                $output->writeln('    ' . $uid);
+                foreach ($paths as $path) {
+                    $output->writeln('        ' . $path);
+                }
+            }
+            $output->writeln('');
+        }
+
+        return true;
+    }
+
+    /**
+     * prepare encryption modules to perform the decrypt all function
+     */
+    protected function prepareEncryptionModules(InputInterface $input, OutputInterface $output, string $user): bool {
+        // prepare all encryption modules for decrypt all
+        $encryptionModules = $this->encryptionManager->getEncryptionModules();
+        foreach ($encryptionModules as $moduleDesc) {
+            /** @var IEncryptionModule $module */
+            $module = call_user_func($moduleDesc['callback']);
+            $output->writeln('');
+            $output->writeln('Prepare "' . $module->getDisplayName() . '"');
+            $output->writeln('');
+            if ($module->prepareDecryptAll($input, $output, $user) === false) {
+                $output->writeln('Module "' . $moduleDesc['displayName'] . '" does not support the functionality to decrypt all files again or the initialization of the module failed!');
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * iterate over all user and encrypt their files
+     *
+     * @param string $user which users files should be decrypted, default = all users
+     */
+    protected function decryptAllUsersFiles(OutputInterface $output, string $user = ''): void {
+        $output->writeln("\n");
+
+        $userList = [];
+        if ($user === '') {
+            $fetchUsersProgress = new ProgressBar($output);
+            $fetchUsersProgress->setFormat(" %message% \n [%bar%]");
+            $fetchUsersProgress->start();
+            $fetchUsersProgress->setMessage('Fetch list of users...');
+            $fetchUsersProgress->advance();
+
+            foreach ($this->userManager->getBackends() as $backend) {
+                $limit = 500;
+                $offset = 0;
+                do {
+                    $users = $backend->getUsers('', $limit, $offset);
+                    foreach ($users as $user) {
+                        $userList[] = $user;
+                    }
+                    $offset += $limit;
+                    $fetchUsersProgress->advance();
+                } while (count($users) >= $limit);
+                $fetchUsersProgress->setMessage('Fetch list of users... finished');
+                $fetchUsersProgress->finish();
+            }
+        } else {
+            $userList[] = $user;
+        }
+
+        $output->writeln("\n\n");
+
+        $progress = new ProgressBar($output);
+        $progress->setFormat(" %message% \n [%bar%]");
+        $progress->start();
+        $progress->setMessage('starting to decrypt files...');
+        $progress->advance();
+
+        $numberOfUsers = count($userList);
+        $userNo = 1;
+        foreach ($userList as $uid) {
+            $userCount = "$uid ($userNo of $numberOfUsers)";
+            $this->decryptUsersFiles($uid, $progress, $userCount);
+            $userNo++;
+        }
+
+        $progress->setMessage('starting to decrypt files... finished');
+        $progress->finish();
+
+        $output->writeln("\n\n");
+    }
+
+    /**
+     * encrypt files from the given user
+     */
+    protected function decryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
+        $this->setupUserFS($uid);
+        $directories = [];
+        $directories[] = '/' . $uid . '/files';
+
+        while ($root = array_pop($directories)) {
+            $content = $this->rootView->getDirectoryContent($root);
+            foreach ($content as $file) {
+                // only decrypt files owned by the user
+                if ($file->getStorage()->instanceOfStorage('OCA\Files_Sharing\SharedStorage')) {
+                    continue;
+                }
+                $path = $root . '/' . $file['name'];
+                if ($this->rootView->is_dir($path)) {
+                    $directories[] = $path;
+                    continue;
+                } else {
+                    try {
+                        $progress->setMessage("decrypt files for user $userCount: $path");
+                        $progress->advance();
+                        if ($file->isEncrypted() === false) {
+                            $progress->setMessage("decrypt files for user $userCount: $path (already decrypted)");
+                            $progress->advance();
+                        } else {
+                            if ($this->decryptFile($path) === false) {
+                                $progress->setMessage("decrypt files for user $userCount: $path (already decrypted)");
+                                $progress->advance();
+                            }
+                        }
+                    } catch (\Exception $e) {
+                        if (isset($this->failed[$uid])) {
+                            $this->failed[$uid][] = $path;
+                        } else {
+                            $this->failed[$uid] = [$path];
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * encrypt file
+     */
+    protected function decryptFile(string $path): bool {
+        // skip already decrypted files
+        $fileInfo = $this->rootView->getFileInfo($path);
+        if ($fileInfo !== false && !$fileInfo->isEncrypted()) {
+            return true;
+        }
+
+        $source = $path;
+        $target = $path . '.decrypted.' . $this->getTimestamp();
+
+        try {
+            $this->rootView->copy($source, $target);
+            $this->rootView->touch($target, $fileInfo->getMTime());
+            $this->rootView->rename($target, $source);
+        } catch (DecryptionFailedException $e) {
+            if ($this->rootView->file_exists($target)) {
+                $this->rootView->unlink($target);
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * get current timestamp
+     */
+    protected function getTimestamp(): int {
+        return time();
+    }
+
+    /**
+     * setup user file system
+     */
+    protected function setupUserFS(string $uid): void {
+        \OC_Util::tearDownFS();
+        \OC_Util::setupFS($uid);
+    }
 }

Spacing +8 added lines, -8 removed lines

@@ -38,7 +38,7 @@ 
 	 */
 	public function decryptAll(InputInterface $input, OutputInterface $output, string $user = ''): bool {
 		if ($user !== '' && $this->userManager->userExists($user) === false) {
-			$output->writeln('User "' . $user . '" does not exist. Please check the username and try again');
+			$output->writeln('User "'.$user.'" does not exist. Please check the username and try again');
 			return false;
 		}
 
@@ -58,9 +58,9 @@ 
 			$output->writeln('Files for following users couldn\'t be decrypted, ');
 			$output->writeln('maybe the user is not set up in a way that supports this operation: ');
 			foreach ($this->failed as $uid => $paths) {
-				$output->writeln('    ' . $uid);
+				$output->writeln('    '.$uid);
 				foreach ($paths as $path) {
-					$output->writeln('        ' . $path);
+					$output->writeln('        '.$path);
 				}
 			}
 			$output->writeln('');
@@ -79,10 +79,10 @@ 
 			/** @var IEncryptionModule $module */
 			$module = call_user_func($moduleDesc['callback']);
 			$output->writeln('');
-			$output->writeln('Prepare "' . $module->getDisplayName() . '"');
+			$output->writeln('Prepare "'.$module->getDisplayName().'"');
 			$output->writeln('');
 			if ($module->prepareDecryptAll($input, $output, $user) === false) {
-				$output->writeln('Module "' . $moduleDesc['displayName'] . '" does not support the functionality to decrypt all files again or the initialization of the module failed!');
+				$output->writeln('Module "'.$moduleDesc['displayName'].'" does not support the functionality to decrypt all files again or the initialization of the module failed!');
 				return false;
 			}
 		}
@@ -152,7 +152,7 @@ 
 	protected function decryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
 		$this->setupUserFS($uid);
 		$directories = [];
-		$directories[] = '/' . $uid . '/files';
+		$directories[] = '/'.$uid.'/files';
 
 		while ($root = array_pop($directories)) {
 			$content = $this->rootView->getDirectoryContent($root);
@@ -161,7 +161,7 @@ 
 				if ($file->getStorage()->instanceOfStorage('OCA\Files_Sharing\SharedStorage')) {
 					continue;
 				}
-				$path = $root . '/' . $file['name'];
+				$path = $root.'/'.$file['name'];
 				if ($this->rootView->is_dir($path)) {
 					$directories[] = $path;
 					continue;
@@ -201,7 +201,7 @@ 
 		}
 
 		$source = $path;
-		$target = $path . '.decrypted.' . $this->getTimestamp();
+		$target = $path.'.decrypted.'.$this->getTimestamp();
 
 		try {
 			$this->rootView->copy($source, $target);

lib/private/Encryption/Update.php

Indentation +83 added lines, -83 removed lines

@@ -22,96 +22,96 @@
  * update encrypted files, e.g. because a file was shared
  */
 class Update {
-	public function __construct(
-		protected Util $util,
-		protected Manager $encryptionManager,
-		protected File $file,
-		protected LoggerInterface $logger,
-	) {
-	}
+    public function __construct(
+        protected Util $util,
+        protected Manager $encryptionManager,
+        protected File $file,
+        protected LoggerInterface $logger,
+    ) {
+    }
 
-	/**
-	 * hook after file was shared
-	 */
-	public function postShared(OCPFile|Folder $node): void {
-		$this->update($node);
-	}
+    /**
+     * hook after file was shared
+     */
+    public function postShared(OCPFile|Folder $node): void {
+        $this->update($node);
+    }
 
-	/**
-	 * hook after file was unshared
-	 */
-	public function postUnshared(OCPFile|Folder $node): void {
-		$this->update($node);
-	}
+    /**
+     * hook after file was unshared
+     */
+    public function postUnshared(OCPFile|Folder $node): void {
+        $this->update($node);
+    }
 
-	/**
-	 * inform encryption module that a file was restored from the trash bin,
-	 * e.g. to update the encryption keys
-	 */
-	public function postRestore(OCPFile|Folder $node): void {
-		$this->update($node);
-	}
+    /**
+     * inform encryption module that a file was restored from the trash bin,
+     * e.g. to update the encryption keys
+     */
+    public function postRestore(OCPFile|Folder $node): void {
+        $this->update($node);
+    }
 
-	/**
-	 * inform encryption module that a file was renamed,
-	 * e.g. to update the encryption keys
-	 */
-	public function postRename(OCPFile|Folder $source, OCPFile|Folder $target): void {
-		if (dirname($source->getPath()) !== dirname($target->getPath())) {
-			$this->update($target);
-		}
-	}
+    /**
+     * inform encryption module that a file was renamed,
+     * e.g. to update the encryption keys
+     */
+    public function postRename(OCPFile|Folder $source, OCPFile|Folder $target): void {
+        if (dirname($source->getPath()) !== dirname($target->getPath())) {
+            $this->update($target);
+        }
+    }
 
-	/**
-	 * get owner and path relative to data/
-	 *
-	 * @throws \InvalidArgumentException
-	 */
-	protected function getOwnerPath(OCPFile|Folder $node): string {
-		$owner = $node->getOwner()?->getUID();
-		if ($owner === null) {
-			throw new InvalidArgumentException('No owner found for ' . $node->getId());
-		}
-		$view = new View('/' . $owner . '/files');
-		try {
-			$path = $view->getPath($node->getId());
-		} catch (NotFoundException $e) {
-			throw new InvalidArgumentException('No file found for ' . $node->getId(), previous:$e);
-		}
-		return '/' . $owner . '/files/' . $path;
-	}
+    /**
+     * get owner and path relative to data/
+     *
+     * @throws \InvalidArgumentException
+     */
+    protected function getOwnerPath(OCPFile|Folder $node): string {
+        $owner = $node->getOwner()?->getUID();
+        if ($owner === null) {
+            throw new InvalidArgumentException('No owner found for ' . $node->getId());
+        }
+        $view = new View('/' . $owner . '/files');
+        try {
+            $path = $view->getPath($node->getId());
+        } catch (NotFoundException $e) {
+            throw new InvalidArgumentException('No file found for ' . $node->getId(), previous:$e);
+        }
+        return '/' . $owner . '/files/' . $path;
+    }
 
-	/**
-	 * notify encryption module about added/removed users from a file/folder
-	 *
-	 * @param string $path relative to data/
-	 * @throws Exceptions\ModuleDoesNotExistsException
-	 */
-	public function update(OCPFile|Folder $node): void {
-		$encryptionModule = $this->encryptionManager->getEncryptionModule();
+    /**
+     * notify encryption module about added/removed users from a file/folder
+     *
+     * @param string $path relative to data/
+     * @throws Exceptions\ModuleDoesNotExistsException
+     */
+    public function update(OCPFile|Folder $node): void {
+        $encryptionModule = $this->encryptionManager->getEncryptionModule();
 
-		// if the encryption module doesn't encrypt the files on a per-user basis
-		// we have nothing to do here.
-		if ($encryptionModule->needDetailedAccessList() === false) {
-			return;
-		}
+        // if the encryption module doesn't encrypt the files on a per-user basis
+        // we have nothing to do here.
+        if ($encryptionModule->needDetailedAccessList() === false) {
+            return;
+        }
 
-		$path = $this->getOwnerPath($node);
-		// if a folder was shared, get a list of all (sub-)folders
-		if ($node instanceof Folder) {
-			$allFiles = $this->util->getAllFiles($path);
-		} else {
-			$allFiles = [$path];
-		}
+        $path = $this->getOwnerPath($node);
+        // if a folder was shared, get a list of all (sub-)folders
+        if ($node instanceof Folder) {
+            $allFiles = $this->util->getAllFiles($path);
+        } else {
+            $allFiles = [$path];
+        }
 
-		foreach ($allFiles as $file) {
-			$usersSharing = $this->file->getAccessList($file);
-			try {
-				$encryptionModule->update($file, '', $usersSharing);
-			} catch (GenericEncryptionException $e) {
-				// If the update of an individual file fails e.g. due to a corrupt key we should continue the operation and just log the failure
-				$this->logger->error('Failed to update encryption module for ' . $file, [ 'exception' => $e ]);
-			}
-		}
-	}
+        foreach ($allFiles as $file) {
+            $usersSharing = $this->file->getAccessList($file);
+            try {
+                $encryptionModule->update($file, '', $usersSharing);
+            } catch (GenericEncryptionException $e) {
+                // If the update of an individual file fails e.g. due to a corrupt key we should continue the operation and just log the failure
+                $this->logger->error('Failed to update encryption module for ' . $file, [ 'exception' => $e ]);
+            }
+        }
+    }
 }

Spacing +11 added lines, -11 removed lines

@@ -33,14 +33,14 @@ 
 	/**
 	 * hook after file was shared
 	 */
-	public function postShared(OCPFile|Folder $node): void {
+	public function postShared(OCPFile | Folder $node): void {
 		$this->update($node);
 	}
 
 	/**
 	 * hook after file was unshared
 	 */
-	public function postUnshared(OCPFile|Folder $node): void {
+	public function postUnshared(OCPFile | Folder $node): void {
 		$this->update($node);
 	}
 
@@ -48,7 +48,7 @@ 
 	 * inform encryption module that a file was restored from the trash bin,
 	 * e.g. to update the encryption keys
 	 */
-	public function postRestore(OCPFile|Folder $node): void {
+	public function postRestore(OCPFile | Folder $node): void {
 		$this->update($node);
 	}
 
@@ -56,7 +56,7 @@ 
 	 * inform encryption module that a file was renamed,
 	 * e.g. to update the encryption keys
 	 */
-	public function postRename(OCPFile|Folder $source, OCPFile|Folder $target): void {
+	public function postRename(OCPFile | Folder $source, OCPFile | Folder $target): void {
 		if (dirname($source->getPath()) !== dirname($target->getPath())) {
 			$this->update($target);
 		}
@@ -67,18 +67,18 @@ 
 	 *
 	 * @throws \InvalidArgumentException
 	 */
-	protected function getOwnerPath(OCPFile|Folder $node): string {
+	protected function getOwnerPath(OCPFile | Folder $node): string {
 		$owner = $node->getOwner()?->getUID();
 		if ($owner === null) {
-			throw new InvalidArgumentException('No owner found for ' . $node->getId());
+			throw new InvalidArgumentException('No owner found for '.$node->getId());
 		}
-		$view = new View('/' . $owner . '/files');
+		$view = new View('/'.$owner.'/files');
 		try {
 			$path = $view->getPath($node->getId());
 		} catch (NotFoundException $e) {
-			throw new InvalidArgumentException('No file found for ' . $node->getId(), previous:$e);
+			throw new InvalidArgumentException('No file found for '.$node->getId(), previous:$e);
 		}
-		return '/' . $owner . '/files/' . $path;
+		return '/'.$owner.'/files/'.$path;
 	}
 
 	/**
@@ -87,7 +87,7 @@ 
 	 * @param string $path relative to data/
 	 * @throws Exceptions\ModuleDoesNotExistsException
 	 */
-	public function update(OCPFile|Folder $node): void {
+	public function update(OCPFile | Folder $node): void {
 		$encryptionModule = $this->encryptionManager->getEncryptionModule();
 
 		// if the encryption module doesn't encrypt the files on a per-user basis
@@ -110,7 +110,7 @@ 
 				$encryptionModule->update($file, '', $usersSharing);
 			} catch (GenericEncryptionException $e) {
 				// If the update of an individual file fails e.g. due to a corrupt key we should continue the operation and just log the failure
-				$this->logger->error('Failed to update encryption module for ' . $file, [ 'exception' => $e ]);
+				$this->logger->error('Failed to update encryption module for '.$file, ['exception' => $e]);
 			}
 		}
 	}

lib/private/Encryption/EncryptionEventListener.php

Indentation +59 added lines, -59 removed lines

@@ -27,68 +27,68 @@
 
 /** @template-implements IEventListener<NodeRenamedEvent|ShareCreatedEvent|ShareDeletedEvent|NodeRestoredEvent> */
 class EncryptionEventListener implements IEventListener {
-	private ?Update $updater = null;
+    private ?Update $updater = null;
 
-	public function __construct(
-		private IUserSession $userSession,
-		private SetupManager $setupManager,
-		private Manager $encryptionManager,
-		private IUserManager $userManager,
-	) {
-	}
+    public function __construct(
+        private IUserSession $userSession,
+        private SetupManager $setupManager,
+        private Manager $encryptionManager,
+        private IUserManager $userManager,
+    ) {
+    }
 
-	public static function register(IEventDispatcher $dispatcher): void {
-		$dispatcher->addServiceListener(NodeRenamedEvent::class, static::class);
-		$dispatcher->addServiceListener(ShareCreatedEvent::class, static::class);
-		$dispatcher->addServiceListener(ShareDeletedEvent::class, static::class);
-		$dispatcher->addServiceListener(NodeRestoredEvent::class, static::class);
-	}
+    public static function register(IEventDispatcher $dispatcher): void {
+        $dispatcher->addServiceListener(NodeRenamedEvent::class, static::class);
+        $dispatcher->addServiceListener(ShareCreatedEvent::class, static::class);
+        $dispatcher->addServiceListener(ShareDeletedEvent::class, static::class);
+        $dispatcher->addServiceListener(NodeRestoredEvent::class, static::class);
+    }
 
-	public function handle(Event $event): void {
-		if (!$this->encryptionManager->isEnabled()) {
-			return;
-		}
-		if ($event instanceof NodeRenamedEvent) {
-			$this->getUpdate()->postRename($event->getSource(), $event->getTarget());
-		} elseif ($event instanceof ShareCreatedEvent) {
-			$this->getUpdate()->postShared($event->getShare()->getNode());
-		} elseif ($event instanceof ShareDeletedEvent) {
-			try {
-				// In case the unsharing happens in a background job, we don't have
-				// a session and we load instead the user from the UserManager
-				$owner = $this->userManager->get($event->getShare()->getShareOwner());
-				$this->getUpdate($owner)->postUnshared($event->getShare()->getNode());
-			} catch (NotFoundException $e) {
-				/* The node was deleted already, nothing to update */
-			}
-		} elseif ($event instanceof NodeRestoredEvent) {
-			$this->getUpdate()->postRestore($event->getTarget());
-		}
-	}
+    public function handle(Event $event): void {
+        if (!$this->encryptionManager->isEnabled()) {
+            return;
+        }
+        if ($event instanceof NodeRenamedEvent) {
+            $this->getUpdate()->postRename($event->getSource(), $event->getTarget());
+        } elseif ($event instanceof ShareCreatedEvent) {
+            $this->getUpdate()->postShared($event->getShare()->getNode());
+        } elseif ($event instanceof ShareDeletedEvent) {
+            try {
+                // In case the unsharing happens in a background job, we don't have
+                // a session and we load instead the user from the UserManager
+                $owner = $this->userManager->get($event->getShare()->getShareOwner());
+                $this->getUpdate($owner)->postUnshared($event->getShare()->getNode());
+            } catch (NotFoundException $e) {
+                /* The node was deleted already, nothing to update */
+            }
+        } elseif ($event instanceof NodeRestoredEvent) {
+            $this->getUpdate()->postRestore($event->getTarget());
+        }
+    }
 
-	private function getUpdate(?IUser $owner = null): Update {
-		$user = $this->userSession->getUser();
-		if (!$user && ($owner !== null)) {
-			$user = $owner;
-		}
-		if ($user) {
-			if (!$this->setupManager->isSetupComplete($user)) {
-				$this->setupManager->setupForUser($user);
-			}
-		}
-		if (is_null($this->updater)) {
-			$this->updater = new Update(
-				new Util(
-					new View(),
-					$this->userManager,
-					\OC::$server->getGroupManager(),
-					\OC::$server->getConfig()),
-				\OC::$server->getEncryptionManager(),
-				\OC::$server->get(IFile::class),
-				\OC::$server->get(LoggerInterface::class),
-			);
-		}
+    private function getUpdate(?IUser $owner = null): Update {
+        $user = $this->userSession->getUser();
+        if (!$user && ($owner !== null)) {
+            $user = $owner;
+        }
+        if ($user) {
+            if (!$this->setupManager->isSetupComplete($user)) {
+                $this->setupManager->setupForUser($user);
+            }
+        }
+        if (is_null($this->updater)) {
+            $this->updater = new Update(
+                new Util(
+                    new View(),
+                    $this->userManager,
+                    \OC::$server->getGroupManager(),
+                    \OC::$server->getConfig()),
+                \OC::$server->getEncryptionManager(),
+                \OC::$server->get(IFile::class),
+                \OC::$server->get(LoggerInterface::class),
+            );
+        }
 
-		return $this->updater;
-	}
+        return $this->updater;
+    }
 }

lib/private/Files/Storage/Wrapper/Encryption.php

Indentation +919 added lines, -919 removed lines

@@ -29,923 +29,923 @@
 use Psr\Log\LoggerInterface;
 
 class Encryption extends Wrapper {
-	use LocalTempFileTrait;
-
-	private string $mountPoint;
-	protected array $unencryptedSize = [];
-	private IMountPoint $mount;
-	/** for which path we execute the repair step to avoid recursions */
-	private array $fixUnencryptedSizeOf = [];
-	/** @var CappedMemoryCache<bool> */
-	private CappedMemoryCache $encryptedPaths;
-	private bool $enabled = true;
-
-	/**
-	 * @param array $parameters
-	 */
-	public function __construct(
-		array $parameters,
-		private IManager $encryptionManager,
-		private Util $util,
-		private LoggerInterface $logger,
-		private IFile $fileHelper,
-		private ?string $uid,
-		private IStorage $keyStorage,
-		private Manager $mountManager,
-		private ArrayCache $arrayCache,
-	) {
-		$this->mountPoint = $parameters['mountPoint'];
-		$this->mount = $parameters['mount'];
-		$this->encryptedPaths = new CappedMemoryCache();
-		parent::__construct($parameters);
-	}
-
-	public function filesize(string $path): int|float|false {
-		$fullPath = $this->getFullPath($path);
-
-		$info = $this->getCache()->get($path);
-		if ($info === false) {
-			/* Pass call to wrapped storage, it may be a special file like a part file */
-			return $this->storage->filesize($path);
-		}
-		if (isset($this->unencryptedSize[$fullPath])) {
-			$size = $this->unencryptedSize[$fullPath];
-
-			// Update file cache (only if file is already cached).
-			// Certain files are not cached (e.g. *.part).
-			if (isset($info['fileid'])) {
-				if ($info instanceof ICacheEntry) {
-					$info['encrypted'] = $info['encryptedVersion'];
-				} else {
-					/**
-					 * @psalm-suppress RedundantCondition
-					 */
-					if (!is_array($info)) {
-						$info = [];
-					}
-					$info['encrypted'] = true;
-					$info = new CacheEntry($info);
-				}
-
-				if ($size !== $info->getUnencryptedSize()) {
-					$this->getCache()->update($info->getId(), [
-						'unencrypted_size' => $size
-					]);
-				}
-			}
-
-			return $size;
-		}
-
-		if (isset($info['fileid']) && $info['encrypted']) {
-			return $this->verifyUnencryptedSize($path, $info->getUnencryptedSize());
-		}
-
-		return $this->storage->filesize($path);
-	}
-
-	private function modifyMetaData(string $path, array $data): array {
-		$fullPath = $this->getFullPath($path);
-		$info = $this->getCache()->get($path);
-
-		if (isset($this->unencryptedSize[$fullPath])) {
-			$data['encrypted'] = true;
-			$data['size'] = $this->unencryptedSize[$fullPath];
-			$data['unencrypted_size'] = $data['size'];
-		} else {
-			if (isset($info['fileid']) && $info['encrypted']) {
-				$data['size'] = $this->verifyUnencryptedSize($path, $info->getUnencryptedSize());
-				$data['encrypted'] = true;
-				$data['unencrypted_size'] = $data['size'];
-			}
-		}
-
-		if (isset($info['encryptedVersion']) && $info['encryptedVersion'] > 1) {
-			$data['encryptedVersion'] = $info['encryptedVersion'];
-		}
-
-		return $data;
-	}
-
-	public function getMetaData(string $path): ?array {
-		$data = $this->storage->getMetaData($path);
-		if (is_null($data)) {
-			return null;
-		}
-		return $this->modifyMetaData($path, $data);
-	}
-
-	public function getDirectoryContent(string $directory): \Traversable {
-		$parent = rtrim($directory, '/');
-		foreach ($this->getWrapperStorage()->getDirectoryContent($directory) as $data) {
-			yield $this->modifyMetaData($parent . '/' . $data['name'], $data);
-		}
-	}
-
-	public function file_get_contents(string $path): string|false {
-		$encryptionModule = $this->getEncryptionModule($path);
-
-		if ($encryptionModule) {
-			$handle = $this->fopen($path, 'r');
-			if (!$handle) {
-				return false;
-			}
-			$data = stream_get_contents($handle);
-			fclose($handle);
-			return $data;
-		}
-		return $this->storage->file_get_contents($path);
-	}
-
-	public function file_put_contents(string $path, mixed $data): int|float|false {
-		// file put content will always be translated to a stream write
-		$handle = $this->fopen($path, 'w');
-		if (is_resource($handle)) {
-			$written = fwrite($handle, $data);
-			fclose($handle);
-			return $written;
-		}
-
-		return false;
-	}
-
-	public function unlink(string $path): bool {
-		$fullPath = $this->getFullPath($path);
-		if ($this->util->isExcluded($fullPath)) {
-			return $this->storage->unlink($path);
-		}
-
-		$encryptionModule = $this->getEncryptionModule($path);
-		if ($encryptionModule) {
-			$this->keyStorage->deleteAllFileKeys($fullPath);
-		}
-
-		return $this->storage->unlink($path);
-	}
-
-	public function rename(string $source, string $target): bool {
-		$result = $this->storage->rename($source, $target);
-
-		if ($result
-			// versions always use the keys from the original file, so we can skip
-			// this step for versions
-			&& $this->isVersion($target) === false
-			&& $this->encryptionManager->isEnabled()) {
-			$sourcePath = $this->getFullPath($source);
-			if (!$this->util->isExcluded($sourcePath)) {
-				$targetPath = $this->getFullPath($target);
-				if (isset($this->unencryptedSize[$sourcePath])) {
-					$this->unencryptedSize[$targetPath] = $this->unencryptedSize[$sourcePath];
-				}
-				$this->keyStorage->renameKeys($sourcePath, $targetPath);
-				$module = $this->getEncryptionModule($target);
-				if ($module) {
-					$module->update($targetPath, $this->uid, []);
-				}
-			}
-		}
-
-		return $result;
-	}
-
-	public function rmdir(string $path): bool {
-		$result = $this->storage->rmdir($path);
-		$fullPath = $this->getFullPath($path);
-		if ($result
-			&& $this->util->isExcluded($fullPath) === false
-			&& $this->encryptionManager->isEnabled()
-		) {
-			$this->keyStorage->deleteAllFileKeys($fullPath);
-		}
-
-		return $result;
-	}
-
-	public function isReadable(string $path): bool {
-		$isReadable = true;
-
-		$metaData = $this->getMetaData($path);
-		if (
-			!$this->is_dir($path)
-			&& isset($metaData['encrypted'])
-			&& $metaData['encrypted'] === true
-		) {
-			$fullPath = $this->getFullPath($path);
-			$module = $this->getEncryptionModule($path);
-			$isReadable = $module->isReadable($fullPath, $this->uid);
-		}
-
-		return $this->storage->isReadable($path) && $isReadable;
-	}
-
-	public function copy(string $source, string $target): bool {
-		$sourcePath = $this->getFullPath($source);
-
-		if ($this->util->isExcluded($sourcePath)) {
-			return $this->storage->copy($source, $target);
-		}
-
-		// need to stream copy file by file in case we copy between a encrypted
-		// and a unencrypted storage
-		$this->unlink($target);
-		return $this->copyFromStorage($this, $source, $target);
-	}
-
-	public function fopen(string $path, string $mode) {
-		// check if the file is stored in the array cache, this means that we
-		// copy a file over to the versions folder, in this case we don't want to
-		// decrypt it
-		if ($this->arrayCache->hasKey('encryption_copy_version_' . $path)) {
-			$this->arrayCache->remove('encryption_copy_version_' . $path);
-			return $this->storage->fopen($path, $mode);
-		}
-
-		if (!$this->enabled) {
-			return $this->storage->fopen($path, $mode);
-		}
-
-		$encryptionEnabled = $this->encryptionManager->isEnabled();
-		$shouldEncrypt = false;
-		$encryptionModule = null;
-		$header = $this->getHeader($path);
-		$signed = isset($header['signed']) && $header['signed'] === 'true';
-		$fullPath = $this->getFullPath($path);
-		$encryptionModuleId = $this->util->getEncryptionModuleId($header);
-
-		if ($this->util->isExcluded($fullPath) === false) {
-			$size = $unencryptedSize = 0;
-			$realFile = $this->util->stripPartialFileExtension($path);
-			$targetExists = $this->is_file($realFile) || $this->file_exists($path);
-			$targetIsEncrypted = false;
-			if ($targetExists) {
-				// in case the file exists we require the explicit module as
-				// specified in the file header - otherwise we need to fail hard to
-				// prevent data loss on client side
-				if (!empty($encryptionModuleId)) {
-					$targetIsEncrypted = true;
-					$encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
-				}
-
-				if ($this->file_exists($path)) {
-					$size = $this->storage->filesize($path);
-					$unencryptedSize = $this->filesize($path);
-				} else {
-					$size = $unencryptedSize = 0;
-				}
-			}
-
-			try {
-				if (
-					$mode === 'w'
-					|| $mode === 'w+'
-					|| $mode === 'wb'
-					|| $mode === 'wb+'
-				) {
-					// if we update a encrypted file with a un-encrypted one we change the db flag
-					if ($targetIsEncrypted && $encryptionEnabled === false) {
-						$cache = $this->storage->getCache();
-						$entry = $cache->get($path);
-						$cache->update($entry->getId(), ['encrypted' => 0]);
-					}
-					if ($encryptionEnabled) {
-						// if $encryptionModuleId is empty, the default module will be used
-						$encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
-						$shouldEncrypt = $encryptionModule->shouldEncrypt($fullPath);
-						$signed = true;
-					}
-				} else {
-					$info = $this->getCache()->get($path);
-					// only get encryption module if we found one in the header
-					// or if file should be encrypted according to the file cache
-					if (!empty($encryptionModuleId)) {
-						$encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
-						$shouldEncrypt = true;
-					} elseif ($info !== false && $info['encrypted'] === true) {
-						// we come from a old installation. No header and/or no module defined
-						// but the file is encrypted. In this case we need to use the
-						// OC_DEFAULT_MODULE to read the file
-						$encryptionModule = $this->encryptionManager->getEncryptionModule('OC_DEFAULT_MODULE');
-						$shouldEncrypt = true;
-						$targetIsEncrypted = true;
-					}
-				}
-			} catch (ModuleDoesNotExistsException $e) {
-				$this->logger->warning('Encryption module "' . $encryptionModuleId . '" not found, file will be stored unencrypted', [
-					'exception' => $e,
-					'app' => 'core',
-				]);
-			}
-
-			// encryption disabled on write of new file and write to existing unencrypted file -> don't encrypt
-			if (!$this->shouldEncrypt($path)) {
-				if (!$targetExists || !$targetIsEncrypted) {
-					$shouldEncrypt = false;
-				}
-			}
-
-			if ($shouldEncrypt === true && $encryptionModule !== null) {
-				$this->encryptedPaths->set($this->util->stripPartialFileExtension($path), true);
-				$headerSize = $this->getHeaderSize($path);
-				if ($mode === 'r' && $headerSize === 0) {
-					$firstBlock = $this->readFirstBlock($path);
-					if (!$firstBlock) {
-						throw new InvalidHeaderException("Unable to get header block for $path");
-					} elseif (!str_starts_with($firstBlock, Util::HEADER_START)) {
-						throw new InvalidHeaderException("Unable to get header size for $path, file doesn't start with encryption header");
-					} else {
-						throw new InvalidHeaderException("Unable to get header size for $path, even though file does start with encryption header");
-					}
-				}
-				$source = $this->storage->fopen($path, $mode);
-				if (!is_resource($source)) {
-					return false;
-				}
-				$handle = \OC\Files\Stream\Encryption::wrap($source, $path, $fullPath, $header,
-					$this->uid, $encryptionModule, $this->storage, $this, $this->util, $this->fileHelper, $mode,
-					$size, $unencryptedSize, $headerSize, $signed);
-
-				return $handle;
-			}
-		}
-
-		return $this->storage->fopen($path, $mode);
-	}
-
-
-	/**
-	 * perform some plausibility checks if the unencrypted size is correct.
-	 * If not, we calculate the correct unencrypted size and return it
-	 *
-	 * @param string $path internal path relative to the storage root
-	 * @param int $unencryptedSize size of the unencrypted file
-	 *
-	 * @return int unencrypted size
-	 */
-	protected function verifyUnencryptedSize(string $path, int $unencryptedSize): int {
-		$size = $this->storage->filesize($path);
-		$result = $unencryptedSize;
-
-		if ($unencryptedSize < 0
-			|| ($size > 0 && $unencryptedSize === $size)
-			|| $unencryptedSize > $size
-		) {
-			// check if we already calculate the unencrypted size for the
-			// given path to avoid recursions
-			if (isset($this->fixUnencryptedSizeOf[$this->getFullPath($path)]) === false) {
-				$this->fixUnencryptedSizeOf[$this->getFullPath($path)] = true;
-				try {
-					$result = $this->fixUnencryptedSize($path, $size, $unencryptedSize);
-				} catch (\Exception $e) {
-					$this->logger->error('Couldn\'t re-calculate unencrypted size for ' . $path, ['exception' => $e]);
-				}
-				unset($this->fixUnencryptedSizeOf[$this->getFullPath($path)]);
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * calculate the unencrypted size
-	 *
-	 * @param string $path internal path relative to the storage root
-	 * @param int $size size of the physical file
-	 * @param int $unencryptedSize size of the unencrypted file
-	 */
-	protected function fixUnencryptedSize(string $path, int $size, int $unencryptedSize): int|float {
-		$headerSize = $this->getHeaderSize($path);
-		$header = $this->getHeader($path);
-		$encryptionModule = $this->getEncryptionModule($path);
-
-		$stream = $this->storage->fopen($path, 'r');
-
-		// if we couldn't open the file we return the old unencrypted size
-		if (!is_resource($stream)) {
-			$this->logger->error('Could not open ' . $path . '. Recalculation of unencrypted size aborted.');
-			return $unencryptedSize;
-		}
-
-		$newUnencryptedSize = 0;
-		$size -= $headerSize;
-		$blockSize = $this->util->getBlockSize();
-
-		// if a header exists we skip it
-		if ($headerSize > 0) {
-			$this->fread_block($stream, $headerSize);
-		}
-
-		// fast path, else the calculation for $lastChunkNr is bogus
-		if ($size === 0) {
-			return 0;
-		}
-
-		$signed = isset($header['signed']) && $header['signed'] === 'true';
-		$unencryptedBlockSize = $encryptionModule->getUnencryptedBlockSize($signed);
-
-		// calculate last chunk nr
-		// next highest is end of chunks, one subtracted is last one
-		// we have to read the last chunk, we can't just calculate it (because of padding etc)
-
-		$lastChunkNr = ceil($size / $blockSize) - 1;
-		// calculate last chunk position
-		$lastChunkPos = ($lastChunkNr * $blockSize);
-		// try to fseek to the last chunk, if it fails we have to read the whole file
-		if (@fseek($stream, $lastChunkPos, SEEK_CUR) === 0) {
-			$newUnencryptedSize += $lastChunkNr * $unencryptedBlockSize;
-		}
-
-		$lastChunkContentEncrypted = '';
-		$count = $blockSize;
-
-		while ($count > 0) {
-			$data = $this->fread_block($stream, $blockSize);
-			$count = strlen($data);
-			$lastChunkContentEncrypted .= $data;
-			if (strlen($lastChunkContentEncrypted) > $blockSize) {
-				$newUnencryptedSize += $unencryptedBlockSize;
-				$lastChunkContentEncrypted = substr($lastChunkContentEncrypted, $blockSize);
-			}
-		}
-
-		fclose($stream);
-
-		// we have to decrypt the last chunk to get it actual size
-		$encryptionModule->begin($this->getFullPath($path), $this->uid, 'r', $header, []);
-		$decryptedLastChunk = $encryptionModule->decrypt($lastChunkContentEncrypted, $lastChunkNr . 'end');
-		$decryptedLastChunk .= $encryptionModule->end($this->getFullPath($path), $lastChunkNr . 'end');
-
-		// calc the real file size with the size of the last chunk
-		$newUnencryptedSize += strlen($decryptedLastChunk);
-
-		$this->updateUnencryptedSize($this->getFullPath($path), $newUnencryptedSize);
-
-		// write to cache if applicable
-		$cache = $this->storage->getCache();
-		$entry = $cache->get($path);
-		$cache->update($entry['fileid'], [
-			'unencrypted_size' => $newUnencryptedSize
-		]);
-
-		return $newUnencryptedSize;
-	}
-
-	/**
-	 * fread_block
-	 *
-	 * This function is a wrapper around the fread function.  It is based on the
-	 * stream_read_block function from lib/private/Files/Streams/Encryption.php
-	 * It calls stream read until the requested $blockSize was received or no remaining data is present.
-	 * This is required as stream_read only returns smaller chunks of data when the stream fetches from a
-	 * remote storage over the internet and it does not care about the given $blockSize.
-	 *
-	 * @param resource $handle the stream to read from
-	 * @param int $blockSize Length of requested data block in bytes
-	 * @return string Data fetched from stream.
-	 */
-	private function fread_block($handle, int $blockSize): string {
-		$remaining = $blockSize;
-		$data = '';
-
-		do {
-			$chunk = fread($handle, $remaining);
-			$chunk_len = strlen($chunk);
-			$data .= $chunk;
-			$remaining -= $chunk_len;
-		} while (($remaining > 0) && ($chunk_len > 0));
-
-		return $data;
-	}
-
-	public function moveFromStorage(
-		Storage\IStorage $sourceStorage,
-		string $sourceInternalPath,
-		string $targetInternalPath,
-		$preserveMtime = true,
-	): bool {
-		if ($sourceStorage === $this) {
-			return $this->rename($sourceInternalPath, $targetInternalPath);
-		}
-
-		// TODO clean this up once the underlying moveFromStorage in OC\Files\Storage\Wrapper\Common is fixed:
-		// - call $this->storage->moveFromStorage() instead of $this->copyBetweenStorage
-		// - copy the file cache update from  $this->copyBetweenStorage to this method
-		// - copy the copyKeys() call from  $this->copyBetweenStorage to this method
-		// - remove $this->copyBetweenStorage
-
-		if (!$sourceStorage->isDeletable($sourceInternalPath)) {
-			return false;
-		}
-
-		$result = $this->copyBetweenStorage($sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime, true);
-		if ($result) {
-			$setPreserveCacheOnDelete = $sourceStorage->instanceOfStorage(ObjectStoreStorage::class) && !$this->instanceOfStorage(ObjectStoreStorage::class);
-			if ($setPreserveCacheOnDelete) {
-				/** @var ObjectStoreStorage $sourceStorage */
-				$sourceStorage->setPreserveCacheOnDelete(true);
-			}
-			try {
-				if ($sourceStorage->is_dir($sourceInternalPath)) {
-					$result = $sourceStorage->rmdir($sourceInternalPath);
-				} else {
-					$result = $sourceStorage->unlink($sourceInternalPath);
-				}
-			} finally {
-				if ($setPreserveCacheOnDelete) {
-					/** @var ObjectStoreStorage $sourceStorage */
-					$sourceStorage->setPreserveCacheOnDelete(false);
-				}
-			}
-		}
-		return $result;
-	}
-
-	public function copyFromStorage(
-		Storage\IStorage $sourceStorage,
-		string $sourceInternalPath,
-		string $targetInternalPath,
-		$preserveMtime = false,
-		$isRename = false,
-	): bool {
-		// TODO clean this up once the underlying moveFromStorage in OC\Files\Storage\Wrapper\Common is fixed:
-		// - call $this->storage->copyFromStorage() instead of $this->copyBetweenStorage
-		// - copy the file cache update from  $this->copyBetweenStorage to this method
-		// - copy the copyKeys() call from  $this->copyBetweenStorage to this method
-		// - remove $this->copyBetweenStorage
-
-		return $this->copyBetweenStorage($sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime, $isRename);
-	}
-
-	/**
-	 * Update the encrypted cache version in the database
-	 */
-	private function updateEncryptedVersion(
-		Storage\IStorage $sourceStorage,
-		string $sourceInternalPath,
-		string $targetInternalPath,
-		bool $isRename,
-		bool $keepEncryptionVersion,
-	): void {
-		$isEncrypted = $this->shouldEncrypt($targetInternalPath);
-		$cacheInformation = [
-			'encrypted' => $isEncrypted,
-		];
-		if ($isEncrypted) {
-			$sourceCacheEntry = $sourceStorage->getCache()->get($sourceInternalPath);
-			$targetCacheEntry = $this->getCache()->get($targetInternalPath);
-
-			// Rename of the cache already happened, so we do the cleanup on the target
-			if ($sourceCacheEntry === false && $targetCacheEntry !== false) {
-				$encryptedVersion = $targetCacheEntry['encryptedVersion'];
-				$isRename = false;
-			} else {
-				$encryptedVersion = $sourceCacheEntry['encryptedVersion'];
-			}
-
-			// In case of a move operation from an unencrypted to an encrypted
-			// storage the old encrypted version would stay with "0" while the
-			// correct value would be "1". Thus we manually set the value to "1"
-			// for those cases.
-			// See also https://github.com/owncloud/core/issues/23078
-			if ($encryptedVersion === 0 || !$keepEncryptionVersion) {
-				$encryptedVersion = 1;
-			}
-
-			$cacheInformation['encryptedVersion'] = $encryptedVersion;
-		}
-
-		// in case of a rename we need to manipulate the source cache because
-		// this information will be kept for the new target
-		if ($isRename) {
-			$sourceStorage->getCache()->put($sourceInternalPath, $cacheInformation);
-		} else {
-			$this->getCache()->put($targetInternalPath, $cacheInformation);
-		}
-	}
-
-	/**
-	 * copy file between two storages
-	 * @throws \Exception
-	 */
-	private function copyBetweenStorage(
-		Storage\IStorage $sourceStorage,
-		string $sourceInternalPath,
-		string $targetInternalPath,
-		bool $preserveMtime,
-		bool $isRename,
-	): bool {
-		// for versions we have nothing to do, because versions should always use the
-		// key from the original file. Just create a 1:1 copy and done
-		if ($this->isVersion($targetInternalPath)
-			|| $this->isVersion($sourceInternalPath)) {
-			// remember that we try to create a version so that we can detect it during
-			// fopen($sourceInternalPath) and by-pass the encryption in order to
-			// create a 1:1 copy of the file
-			$this->arrayCache->set('encryption_copy_version_' . $sourceInternalPath, true);
-			$result = $this->storage->copyFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
-			$this->arrayCache->remove('encryption_copy_version_' . $sourceInternalPath);
-			if ($result) {
-				$info = $this->getCache('', $sourceStorage)->get($sourceInternalPath);
-				// make sure that we update the unencrypted size for the version
-				if (isset($info['encrypted']) && $info['encrypted'] === true) {
-					$this->updateUnencryptedSize(
-						$this->getFullPath($targetInternalPath),
-						$info->getUnencryptedSize()
-					);
-				}
-				$this->updateEncryptedVersion($sourceStorage, $sourceInternalPath, $targetInternalPath, $isRename, true);
-			}
-			return $result;
-		}
-
-		// first copy the keys that we reuse the existing file key on the target location
-		// and don't create a new one which would break versions for example.
-		if ($sourceStorage->instanceOfStorage(Common::class) && $sourceStorage->getMountOption('mount_point')) {
-			$mountPoint = $sourceStorage->getMountOption('mount_point');
-			$source = $mountPoint . '/' . $sourceInternalPath;
-			$target = $this->getFullPath($targetInternalPath);
-			$this->copyKeys($source, $target);
-		} else {
-			$this->logger->error('Could not find mount point, can\'t keep encryption keys');
-		}
-
-		if ($sourceStorage->is_dir($sourceInternalPath)) {
-			$dh = $sourceStorage->opendir($sourceInternalPath);
-			if (!$this->is_dir($targetInternalPath)) {
-				$result = $this->mkdir($targetInternalPath);
-			} else {
-				$result = true;
-			}
-			if (is_resource($dh)) {
-				while ($result && ($file = readdir($dh)) !== false) {
-					if (!Filesystem::isIgnoredDir($file)) {
-						$result = $this->copyFromStorage($sourceStorage, $sourceInternalPath . '/' . $file, $targetInternalPath . '/' . $file, $preserveMtime, $isRename);
-					}
-				}
-			}
-		} else {
-			$source = false;
-			$target = false;
-			try {
-				$source = $sourceStorage->fopen($sourceInternalPath, 'r');
-				$target = $this->fopen($targetInternalPath, 'w');
-				if ($source === false || $target === false) {
-					$result = false;
-				} else {
-					[, $result] = Files::streamCopy($source, $target, true);
-				}
-			} finally {
-				if ($source !== false) {
-					fclose($source);
-				}
-				if ($target !== false) {
-					fclose($target);
-				}
-			}
-			if ($result) {
-				if ($preserveMtime) {
-					$this->touch($targetInternalPath, $sourceStorage->filemtime($sourceInternalPath));
-				}
-				$this->updateEncryptedVersion($sourceStorage, $sourceInternalPath, $targetInternalPath, $isRename, false);
-			} else {
-				// delete partially written target file
-				$this->unlink($targetInternalPath);
-				// delete cache entry that was created by fopen
-				$this->getCache()->remove($targetInternalPath);
-			}
-		}
-		return (bool)$result;
-	}
-
-	public function getLocalFile(string $path): string|false {
-		if ($this->encryptionManager->isEnabled()) {
-			$cachedFile = $this->getCachedFile($path);
-			if (is_string($cachedFile)) {
-				return $cachedFile;
-			}
-		}
-		return $this->storage->getLocalFile($path);
-	}
-
-	public function isLocal(): bool {
-		if ($this->encryptionManager->isEnabled()) {
-			return false;
-		}
-		return $this->storage->isLocal();
-	}
-
-	public function stat(string $path): array|false {
-		$stat = $this->storage->stat($path);
-		if (!$stat) {
-			return false;
-		}
-		$fileSize = $this->filesize($path);
-		$stat['size'] = $fileSize;
-		$stat[7] = $fileSize;
-		$stat['hasHeader'] = $this->getHeaderSize($path) > 0;
-		return $stat;
-	}
-
-	public function hash(string $type, string $path, bool $raw = false): string|false {
-		$fh = $this->fopen($path, 'rb');
-		if ($fh === false) {
-			return false;
-		}
-		$ctx = hash_init($type);
-		hash_update_stream($ctx, $fh);
-		fclose($fh);
-		return hash_final($ctx, $raw);
-	}
-
-	/**
-	 * return full path, including mount point
-	 *
-	 * @param string $path relative to mount point
-	 * @return string full path including mount point
-	 */
-	protected function getFullPath(string $path): string {
-		return Filesystem::normalizePath($this->mountPoint . '/' . $path);
-	}
-
-	/**
-	 * read first block of encrypted file, typically this will contain the
-	 * encryption header
-	 */
-	protected function readFirstBlock(string $path): string {
-		$firstBlock = '';
-		if ($this->storage->is_file($path)) {
-			$handle = $this->storage->fopen($path, 'r');
-			if ($handle === false) {
-				return '';
-			}
-			$firstBlock = fread($handle, $this->util->getHeaderSize());
-			fclose($handle);
-		}
-		return $firstBlock;
-	}
-
-	/**
-	 * return header size of given file
-	 */
-	protected function getHeaderSize(string $path): int {
-		$headerSize = 0;
-		$realFile = $this->util->stripPartialFileExtension($path);
-		if ($this->storage->is_file($realFile)) {
-			$path = $realFile;
-		}
-		$firstBlock = $this->readFirstBlock($path);
-
-		if (str_starts_with($firstBlock, Util::HEADER_START)) {
-			$headerSize = $this->util->getHeaderSize();
-		}
-
-		return $headerSize;
-	}
-
-	/**
-	 * read header from file
-	 */
-	protected function getHeader(string $path): array {
-		$realFile = $this->util->stripPartialFileExtension($path);
-		$exists = $this->storage->is_file($realFile);
-		if ($exists) {
-			$path = $realFile;
-		}
-
-		$result = [];
-
-		$isEncrypted = $this->encryptedPaths->get($realFile);
-		if (is_null($isEncrypted)) {
-			$info = $this->getCache()->get($path);
-			$isEncrypted = isset($info['encrypted']) && $info['encrypted'] === true;
-		}
-
-		if ($isEncrypted) {
-			$firstBlock = $this->readFirstBlock($path);
-			$result = $this->util->parseRawHeader($firstBlock);
-
-			// if the header doesn't contain a encryption module we check if it is a
-			// legacy file. If true, we add the default encryption module
-			if (!isset($result[Util::HEADER_ENCRYPTION_MODULE_KEY]) && (!empty($result) || $exists)) {
-				$result[Util::HEADER_ENCRYPTION_MODULE_KEY] = 'OC_DEFAULT_MODULE';
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * read encryption module needed to read/write the file located at $path
-	 *
-	 * @throws ModuleDoesNotExistsException
-	 * @throws \Exception
-	 */
-	protected function getEncryptionModule(string $path): ?\OCP\Encryption\IEncryptionModule {
-		$encryptionModule = null;
-		$header = $this->getHeader($path);
-		$encryptionModuleId = $this->util->getEncryptionModuleId($header);
-		if (!empty($encryptionModuleId)) {
-			try {
-				$encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
-			} catch (ModuleDoesNotExistsException $e) {
-				$this->logger->critical('Encryption module defined in "' . $path . '" not loaded!');
-				throw $e;
-			}
-		}
-
-		return $encryptionModule;
-	}
-
-	public function updateUnencryptedSize(string $path, int|float $unencryptedSize): void {
-		$this->unencryptedSize[$path] = $unencryptedSize;
-	}
-
-	/**
-	 * copy keys to new location
-	 *
-	 * @param string $source path relative to data/
-	 * @param string $target path relative to data/
-	 */
-	protected function copyKeys(string $source, string $target): bool {
-		if (!$this->util->isExcluded($source)) {
-			return $this->keyStorage->copyKeys($source, $target);
-		}
-
-		return false;
-	}
-
-	/**
-	 * check if path points to a files version
-	 */
-	protected function isVersion(string $path): bool {
-		$normalized = Filesystem::normalizePath($path);
-		return substr($normalized, 0, strlen('/files_versions/')) === '/files_versions/';
-	}
-
-	/**
-	 * check if the given storage should be encrypted or not
-	 */
-	public function shouldEncrypt(string $path): bool {
-		if (!$this->encryptionManager->isEnabled()) {
-			return false;
-		}
-		$fullPath = $this->getFullPath($path);
-		$mountPointConfig = $this->mount->getOption('encrypt', true);
-		if ($mountPointConfig === false) {
-			return false;
-		}
-
-		try {
-			$encryptionModule = $this->getEncryptionModule($fullPath);
-		} catch (ModuleDoesNotExistsException $e) {
-			return false;
-		}
-
-		if ($encryptionModule === null) {
-			$encryptionModule = $this->encryptionManager->getEncryptionModule();
-		}
-
-		return $encryptionModule->shouldEncrypt($fullPath);
-	}
-
-	public function writeStream(string $path, $stream, ?int $size = null): int {
-		// always fall back to fopen
-		$target = $this->fopen($path, 'w');
-		if ($target === false) {
-			throw new GenericFileException("Failed to open $path for writing");
-		}
-		[$count, $result] = Files::streamCopy($stream, $target, true);
-		fclose($stream);
-		fclose($target);
-
-		// object store, stores the size after write and doesn't update this during scan
-		// manually store the unencrypted size
-		if ($result && $this->getWrapperStorage()->instanceOfStorage(ObjectStoreStorage::class) && $this->shouldEncrypt($path)) {
-			$this->getCache()->put($path, ['unencrypted_size' => $count]);
-		}
-
-		return $count;
-	}
-
-	public function clearIsEncryptedCache(): void {
-		$this->encryptedPaths->clear();
-	}
-
-	/**
-	 * Allow temporarily disabling the wrapper
-	 */
-	public function setEnabled(bool $enabled): void {
-		$this->enabled = $enabled;
-	}
-
-	/**
-	 * Check if the on-disk data for a file has a valid encrypted header
-	 *
-	 * @param string $path
-	 * @return bool
-	 */
-	public function hasValidHeader(string $path): bool {
-		$firstBlock = $this->readFirstBlock($path);
-		$header = $this->util->parseRawHeader($firstBlock);
-		return (count($header) > 0);
-	}
+    use LocalTempFileTrait;
+
+    private string $mountPoint;
+    protected array $unencryptedSize = [];
+    private IMountPoint $mount;
+    /** for which path we execute the repair step to avoid recursions */
+    private array $fixUnencryptedSizeOf = [];
+    /** @var CappedMemoryCache<bool> */
+    private CappedMemoryCache $encryptedPaths;
+    private bool $enabled = true;
+
+    /**
+     * @param array $parameters
+     */
+    public function __construct(
+        array $parameters,
+        private IManager $encryptionManager,
+        private Util $util,
+        private LoggerInterface $logger,
+        private IFile $fileHelper,
+        private ?string $uid,
+        private IStorage $keyStorage,
+        private Manager $mountManager,
+        private ArrayCache $arrayCache,
+    ) {
+        $this->mountPoint = $parameters['mountPoint'];
+        $this->mount = $parameters['mount'];
+        $this->encryptedPaths = new CappedMemoryCache();
+        parent::__construct($parameters);
+    }
+
+    public function filesize(string $path): int|float|false {
+        $fullPath = $this->getFullPath($path);
+
+        $info = $this->getCache()->get($path);
+        if ($info === false) {
+            /* Pass call to wrapped storage, it may be a special file like a part file */
+            return $this->storage->filesize($path);
+        }
+        if (isset($this->unencryptedSize[$fullPath])) {
+            $size = $this->unencryptedSize[$fullPath];
+
+            // Update file cache (only if file is already cached).
+            // Certain files are not cached (e.g. *.part).
+            if (isset($info['fileid'])) {
+                if ($info instanceof ICacheEntry) {
+                    $info['encrypted'] = $info['encryptedVersion'];
+                } else {
+                    /**
+                     * @psalm-suppress RedundantCondition
+                     */
+                    if (!is_array($info)) {
+                        $info = [];
+                    }
+                    $info['encrypted'] = true;
+                    $info = new CacheEntry($info);
+                }
+
+                if ($size !== $info->getUnencryptedSize()) {
+                    $this->getCache()->update($info->getId(), [
+                        'unencrypted_size' => $size
+                    ]);
+                }
+            }
+
+            return $size;
+        }
+
+        if (isset($info['fileid']) && $info['encrypted']) {
+            return $this->verifyUnencryptedSize($path, $info->getUnencryptedSize());
+        }
+
+        return $this->storage->filesize($path);
+    }
+
+    private function modifyMetaData(string $path, array $data): array {
+        $fullPath = $this->getFullPath($path);
+        $info = $this->getCache()->get($path);
+
+        if (isset($this->unencryptedSize[$fullPath])) {
+            $data['encrypted'] = true;
+            $data['size'] = $this->unencryptedSize[$fullPath];
+            $data['unencrypted_size'] = $data['size'];
+        } else {
+            if (isset($info['fileid']) && $info['encrypted']) {
+                $data['size'] = $this->verifyUnencryptedSize($path, $info->getUnencryptedSize());
+                $data['encrypted'] = true;
+                $data['unencrypted_size'] = $data['size'];
+            }
+        }
+
+        if (isset($info['encryptedVersion']) && $info['encryptedVersion'] > 1) {
+            $data['encryptedVersion'] = $info['encryptedVersion'];
+        }
+
+        return $data;
+    }
+
+    public function getMetaData(string $path): ?array {
+        $data = $this->storage->getMetaData($path);
+        if (is_null($data)) {
+            return null;
+        }
+        return $this->modifyMetaData($path, $data);
+    }
+
+    public function getDirectoryContent(string $directory): \Traversable {
+        $parent = rtrim($directory, '/');
+        foreach ($this->getWrapperStorage()->getDirectoryContent($directory) as $data) {
+            yield $this->modifyMetaData($parent . '/' . $data['name'], $data);
+        }
+    }
+
+    public function file_get_contents(string $path): string|false {
+        $encryptionModule = $this->getEncryptionModule($path);
+
+        if ($encryptionModule) {
+            $handle = $this->fopen($path, 'r');
+            if (!$handle) {
+                return false;
+            }
+            $data = stream_get_contents($handle);
+            fclose($handle);
+            return $data;
+        }
+        return $this->storage->file_get_contents($path);
+    }
+
+    public function file_put_contents(string $path, mixed $data): int|float|false {
+        // file put content will always be translated to a stream write
+        $handle = $this->fopen($path, 'w');
+        if (is_resource($handle)) {
+            $written = fwrite($handle, $data);
+            fclose($handle);
+            return $written;
+        }
+
+        return false;
+    }
+
+    public function unlink(string $path): bool {
+        $fullPath = $this->getFullPath($path);
+        if ($this->util->isExcluded($fullPath)) {
+            return $this->storage->unlink($path);
+        }
+
+        $encryptionModule = $this->getEncryptionModule($path);
+        if ($encryptionModule) {
+            $this->keyStorage->deleteAllFileKeys($fullPath);
+        }
+
+        return $this->storage->unlink($path);
+    }
+
+    public function rename(string $source, string $target): bool {
+        $result = $this->storage->rename($source, $target);
+
+        if ($result
+            // versions always use the keys from the original file, so we can skip
+            // this step for versions
+            && $this->isVersion($target) === false
+            && $this->encryptionManager->isEnabled()) {
+            $sourcePath = $this->getFullPath($source);
+            if (!$this->util->isExcluded($sourcePath)) {
+                $targetPath = $this->getFullPath($target);
+                if (isset($this->unencryptedSize[$sourcePath])) {
+                    $this->unencryptedSize[$targetPath] = $this->unencryptedSize[$sourcePath];
+                }
+                $this->keyStorage->renameKeys($sourcePath, $targetPath);
+                $module = $this->getEncryptionModule($target);
+                if ($module) {
+                    $module->update($targetPath, $this->uid, []);
+                }
+            }
+        }
+
+        return $result;
+    }
+
+    public function rmdir(string $path): bool {
+        $result = $this->storage->rmdir($path);
+        $fullPath = $this->getFullPath($path);
+        if ($result
+            && $this->util->isExcluded($fullPath) === false
+            && $this->encryptionManager->isEnabled()
+        ) {
+            $this->keyStorage->deleteAllFileKeys($fullPath);
+        }
+
+        return $result;
+    }
+
+    public function isReadable(string $path): bool {
+        $isReadable = true;
+
+        $metaData = $this->getMetaData($path);
+        if (
+            !$this->is_dir($path)
+            && isset($metaData['encrypted'])
+            && $metaData['encrypted'] === true
+        ) {
+            $fullPath = $this->getFullPath($path);
+            $module = $this->getEncryptionModule($path);
+            $isReadable = $module->isReadable($fullPath, $this->uid);
+        }
+
+        return $this->storage->isReadable($path) && $isReadable;
+    }
+
+    public function copy(string $source, string $target): bool {
+        $sourcePath = $this->getFullPath($source);
+
+        if ($this->util->isExcluded($sourcePath)) {
+            return $this->storage->copy($source, $target);
+        }
+
+        // need to stream copy file by file in case we copy between a encrypted
+        // and a unencrypted storage
+        $this->unlink($target);
+        return $this->copyFromStorage($this, $source, $target);
+    }
+
+    public function fopen(string $path, string $mode) {
+        // check if the file is stored in the array cache, this means that we
+        // copy a file over to the versions folder, in this case we don't want to
+        // decrypt it
+        if ($this->arrayCache->hasKey('encryption_copy_version_' . $path)) {
+            $this->arrayCache->remove('encryption_copy_version_' . $path);
+            return $this->storage->fopen($path, $mode);
+        }
+
+        if (!$this->enabled) {
+            return $this->storage->fopen($path, $mode);
+        }
+
+        $encryptionEnabled = $this->encryptionManager->isEnabled();
+        $shouldEncrypt = false;
+        $encryptionModule = null;
+        $header = $this->getHeader($path);
+        $signed = isset($header['signed']) && $header['signed'] === 'true';
+        $fullPath = $this->getFullPath($path);
+        $encryptionModuleId = $this->util->getEncryptionModuleId($header);
+
+        if ($this->util->isExcluded($fullPath) === false) {
+            $size = $unencryptedSize = 0;
+            $realFile = $this->util->stripPartialFileExtension($path);
+            $targetExists = $this->is_file($realFile) || $this->file_exists($path);
+            $targetIsEncrypted = false;
+            if ($targetExists) {
+                // in case the file exists we require the explicit module as
+                // specified in the file header - otherwise we need to fail hard to
+                // prevent data loss on client side
+                if (!empty($encryptionModuleId)) {
+                    $targetIsEncrypted = true;
+                    $encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
+                }
+
+                if ($this->file_exists($path)) {
+                    $size = $this->storage->filesize($path);
+                    $unencryptedSize = $this->filesize($path);
+                } else {
+                    $size = $unencryptedSize = 0;
+                }
+            }
+
+            try {
+                if (
+                    $mode === 'w'
+                    || $mode === 'w+'
+                    || $mode === 'wb'
+                    || $mode === 'wb+'
+                ) {
+                    // if we update a encrypted file with a un-encrypted one we change the db flag
+                    if ($targetIsEncrypted && $encryptionEnabled === false) {
+                        $cache = $this->storage->getCache();
+                        $entry = $cache->get($path);
+                        $cache->update($entry->getId(), ['encrypted' => 0]);
+                    }
+                    if ($encryptionEnabled) {
+                        // if $encryptionModuleId is empty, the default module will be used
+                        $encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
+                        $shouldEncrypt = $encryptionModule->shouldEncrypt($fullPath);
+                        $signed = true;
+                    }
+                } else {
+                    $info = $this->getCache()->get($path);
+                    // only get encryption module if we found one in the header
+                    // or if file should be encrypted according to the file cache
+                    if (!empty($encryptionModuleId)) {
+                        $encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
+                        $shouldEncrypt = true;
+                    } elseif ($info !== false && $info['encrypted'] === true) {
+                        // we come from a old installation. No header and/or no module defined
+                        // but the file is encrypted. In this case we need to use the
+                        // OC_DEFAULT_MODULE to read the file
+                        $encryptionModule = $this->encryptionManager->getEncryptionModule('OC_DEFAULT_MODULE');
+                        $shouldEncrypt = true;
+                        $targetIsEncrypted = true;
+                    }
+                }
+            } catch (ModuleDoesNotExistsException $e) {
+                $this->logger->warning('Encryption module "' . $encryptionModuleId . '" not found, file will be stored unencrypted', [
+                    'exception' => $e,
+                    'app' => 'core',
+                ]);
+            }
+
+            // encryption disabled on write of new file and write to existing unencrypted file -> don't encrypt
+            if (!$this->shouldEncrypt($path)) {
+                if (!$targetExists || !$targetIsEncrypted) {
+                    $shouldEncrypt = false;
+                }
+            }
+
+            if ($shouldEncrypt === true && $encryptionModule !== null) {
+                $this->encryptedPaths->set($this->util->stripPartialFileExtension($path), true);
+                $headerSize = $this->getHeaderSize($path);
+                if ($mode === 'r' && $headerSize === 0) {
+                    $firstBlock = $this->readFirstBlock($path);
+                    if (!$firstBlock) {
+                        throw new InvalidHeaderException("Unable to get header block for $path");
+                    } elseif (!str_starts_with($firstBlock, Util::HEADER_START)) {
+                        throw new InvalidHeaderException("Unable to get header size for $path, file doesn't start with encryption header");
+                    } else {
+                        throw new InvalidHeaderException("Unable to get header size for $path, even though file does start with encryption header");
+                    }
+                }
+                $source = $this->storage->fopen($path, $mode);
+                if (!is_resource($source)) {
+                    return false;
+                }
+                $handle = \OC\Files\Stream\Encryption::wrap($source, $path, $fullPath, $header,
+                    $this->uid, $encryptionModule, $this->storage, $this, $this->util, $this->fileHelper, $mode,
+                    $size, $unencryptedSize, $headerSize, $signed);
+
+                return $handle;
+            }
+        }
+
+        return $this->storage->fopen($path, $mode);
+    }
+
+
+    /**
+     * perform some plausibility checks if the unencrypted size is correct.
+     * If not, we calculate the correct unencrypted size and return it
+     *
+     * @param string $path internal path relative to the storage root
+     * @param int $unencryptedSize size of the unencrypted file
+     *
+     * @return int unencrypted size
+     */
+    protected function verifyUnencryptedSize(string $path, int $unencryptedSize): int {
+        $size = $this->storage->filesize($path);
+        $result = $unencryptedSize;
+
+        if ($unencryptedSize < 0
+            || ($size > 0 && $unencryptedSize === $size)
+            || $unencryptedSize > $size
+        ) {
+            // check if we already calculate the unencrypted size for the
+            // given path to avoid recursions
+            if (isset($this->fixUnencryptedSizeOf[$this->getFullPath($path)]) === false) {
+                $this->fixUnencryptedSizeOf[$this->getFullPath($path)] = true;
+                try {
+                    $result = $this->fixUnencryptedSize($path, $size, $unencryptedSize);
+                } catch (\Exception $e) {
+                    $this->logger->error('Couldn\'t re-calculate unencrypted size for ' . $path, ['exception' => $e]);
+                }
+                unset($this->fixUnencryptedSizeOf[$this->getFullPath($path)]);
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * calculate the unencrypted size
+     *
+     * @param string $path internal path relative to the storage root
+     * @param int $size size of the physical file
+     * @param int $unencryptedSize size of the unencrypted file
+     */
+    protected function fixUnencryptedSize(string $path, int $size, int $unencryptedSize): int|float {
+        $headerSize = $this->getHeaderSize($path);
+        $header = $this->getHeader($path);
+        $encryptionModule = $this->getEncryptionModule($path);
+
+        $stream = $this->storage->fopen($path, 'r');
+
+        // if we couldn't open the file we return the old unencrypted size
+        if (!is_resource($stream)) {
+            $this->logger->error('Could not open ' . $path . '. Recalculation of unencrypted size aborted.');
+            return $unencryptedSize;
+        }
+
+        $newUnencryptedSize = 0;
+        $size -= $headerSize;
+        $blockSize = $this->util->getBlockSize();
+
+        // if a header exists we skip it
+        if ($headerSize > 0) {
+            $this->fread_block($stream, $headerSize);
+        }
+
+        // fast path, else the calculation for $lastChunkNr is bogus
+        if ($size === 0) {
+            return 0;
+        }
+
+        $signed = isset($header['signed']) && $header['signed'] === 'true';
+        $unencryptedBlockSize = $encryptionModule->getUnencryptedBlockSize($signed);
+
+        // calculate last chunk nr
+        // next highest is end of chunks, one subtracted is last one
+        // we have to read the last chunk, we can't just calculate it (because of padding etc)
+
+        $lastChunkNr = ceil($size / $blockSize) - 1;
+        // calculate last chunk position
+        $lastChunkPos = ($lastChunkNr * $blockSize);
+        // try to fseek to the last chunk, if it fails we have to read the whole file
+        if (@fseek($stream, $lastChunkPos, SEEK_CUR) === 0) {
+            $newUnencryptedSize += $lastChunkNr * $unencryptedBlockSize;
+        }
+
+        $lastChunkContentEncrypted = '';
+        $count = $blockSize;
+
+        while ($count > 0) {
+            $data = $this->fread_block($stream, $blockSize);
+            $count = strlen($data);
+            $lastChunkContentEncrypted .= $data;
+            if (strlen($lastChunkContentEncrypted) > $blockSize) {
+                $newUnencryptedSize += $unencryptedBlockSize;
+                $lastChunkContentEncrypted = substr($lastChunkContentEncrypted, $blockSize);
+            }
+        }
+
+        fclose($stream);
+
+        // we have to decrypt the last chunk to get it actual size
+        $encryptionModule->begin($this->getFullPath($path), $this->uid, 'r', $header, []);
+        $decryptedLastChunk = $encryptionModule->decrypt($lastChunkContentEncrypted, $lastChunkNr . 'end');
+        $decryptedLastChunk .= $encryptionModule->end($this->getFullPath($path), $lastChunkNr . 'end');
+
+        // calc the real file size with the size of the last chunk
+        $newUnencryptedSize += strlen($decryptedLastChunk);
+
+        $this->updateUnencryptedSize($this->getFullPath($path), $newUnencryptedSize);
+
+        // write to cache if applicable
+        $cache = $this->storage->getCache();
+        $entry = $cache->get($path);
+        $cache->update($entry['fileid'], [
+            'unencrypted_size' => $newUnencryptedSize
+        ]);
+
+        return $newUnencryptedSize;
+    }
+
+    /**
+     * fread_block
+     *
+     * This function is a wrapper around the fread function.  It is based on the
+     * stream_read_block function from lib/private/Files/Streams/Encryption.php
+     * It calls stream read until the requested $blockSize was received or no remaining data is present.
+     * This is required as stream_read only returns smaller chunks of data when the stream fetches from a
+     * remote storage over the internet and it does not care about the given $blockSize.
+     *
+     * @param resource $handle the stream to read from
+     * @param int $blockSize Length of requested data block in bytes
+     * @return string Data fetched from stream.
+     */
+    private function fread_block($handle, int $blockSize): string {
+        $remaining = $blockSize;
+        $data = '';
+
+        do {
+            $chunk = fread($handle, $remaining);
+            $chunk_len = strlen($chunk);
+            $data .= $chunk;
+            $remaining -= $chunk_len;
+        } while (($remaining > 0) && ($chunk_len > 0));
+
+        return $data;
+    }
+
+    public function moveFromStorage(
+        Storage\IStorage $sourceStorage,
+        string $sourceInternalPath,
+        string $targetInternalPath,
+        $preserveMtime = true,
+    ): bool {
+        if ($sourceStorage === $this) {
+            return $this->rename($sourceInternalPath, $targetInternalPath);
+        }
+
+        // TODO clean this up once the underlying moveFromStorage in OC\Files\Storage\Wrapper\Common is fixed:
+        // - call $this->storage->moveFromStorage() instead of $this->copyBetweenStorage
+        // - copy the file cache update from  $this->copyBetweenStorage to this method
+        // - copy the copyKeys() call from  $this->copyBetweenStorage to this method
+        // - remove $this->copyBetweenStorage
+
+        if (!$sourceStorage->isDeletable($sourceInternalPath)) {
+            return false;
+        }
+
+        $result = $this->copyBetweenStorage($sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime, true);
+        if ($result) {
+            $setPreserveCacheOnDelete = $sourceStorage->instanceOfStorage(ObjectStoreStorage::class) && !$this->instanceOfStorage(ObjectStoreStorage::class);
+            if ($setPreserveCacheOnDelete) {
+                /** @var ObjectStoreStorage $sourceStorage */
+                $sourceStorage->setPreserveCacheOnDelete(true);
+            }
+            try {
+                if ($sourceStorage->is_dir($sourceInternalPath)) {
+                    $result = $sourceStorage->rmdir($sourceInternalPath);
+                } else {
+                    $result = $sourceStorage->unlink($sourceInternalPath);
+                }
+            } finally {
+                if ($setPreserveCacheOnDelete) {
+                    /** @var ObjectStoreStorage $sourceStorage */
+                    $sourceStorage->setPreserveCacheOnDelete(false);
+                }
+            }
+        }
+        return $result;
+    }
+
+    public function copyFromStorage(
+        Storage\IStorage $sourceStorage,
+        string $sourceInternalPath,
+        string $targetInternalPath,
+        $preserveMtime = false,
+        $isRename = false,
+    ): bool {
+        // TODO clean this up once the underlying moveFromStorage in OC\Files\Storage\Wrapper\Common is fixed:
+        // - call $this->storage->copyFromStorage() instead of $this->copyBetweenStorage
+        // - copy the file cache update from  $this->copyBetweenStorage to this method
+        // - copy the copyKeys() call from  $this->copyBetweenStorage to this method
+        // - remove $this->copyBetweenStorage
+
+        return $this->copyBetweenStorage($sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime, $isRename);
+    }
+
+    /**
+     * Update the encrypted cache version in the database
+     */
+    private function updateEncryptedVersion(
+        Storage\IStorage $sourceStorage,
+        string $sourceInternalPath,
+        string $targetInternalPath,
+        bool $isRename,
+        bool $keepEncryptionVersion,
+    ): void {
+        $isEncrypted = $this->shouldEncrypt($targetInternalPath);
+        $cacheInformation = [
+            'encrypted' => $isEncrypted,
+        ];
+        if ($isEncrypted) {
+            $sourceCacheEntry = $sourceStorage->getCache()->get($sourceInternalPath);
+            $targetCacheEntry = $this->getCache()->get($targetInternalPath);
+
+            // Rename of the cache already happened, so we do the cleanup on the target
+            if ($sourceCacheEntry === false && $targetCacheEntry !== false) {
+                $encryptedVersion = $targetCacheEntry['encryptedVersion'];
+                $isRename = false;
+            } else {
+                $encryptedVersion = $sourceCacheEntry['encryptedVersion'];
+            }
+
+            // In case of a move operation from an unencrypted to an encrypted
+            // storage the old encrypted version would stay with "0" while the
+            // correct value would be "1". Thus we manually set the value to "1"
+            // for those cases.
+            // See also https://github.com/owncloud/core/issues/23078
+            if ($encryptedVersion === 0 || !$keepEncryptionVersion) {
+                $encryptedVersion = 1;
+            }
+
+            $cacheInformation['encryptedVersion'] = $encryptedVersion;
+        }
+
+        // in case of a rename we need to manipulate the source cache because
+        // this information will be kept for the new target
+        if ($isRename) {
+            $sourceStorage->getCache()->put($sourceInternalPath, $cacheInformation);
+        } else {
+            $this->getCache()->put($targetInternalPath, $cacheInformation);
+        }
+    }
+
+    /**
+     * copy file between two storages
+     * @throws \Exception
+     */
+    private function copyBetweenStorage(
+        Storage\IStorage $sourceStorage,
+        string $sourceInternalPath,
+        string $targetInternalPath,
+        bool $preserveMtime,
+        bool $isRename,
+    ): bool {
+        // for versions we have nothing to do, because versions should always use the
+        // key from the original file. Just create a 1:1 copy and done
+        if ($this->isVersion($targetInternalPath)
+            || $this->isVersion($sourceInternalPath)) {
+            // remember that we try to create a version so that we can detect it during
+            // fopen($sourceInternalPath) and by-pass the encryption in order to
+            // create a 1:1 copy of the file
+            $this->arrayCache->set('encryption_copy_version_' . $sourceInternalPath, true);
+            $result = $this->storage->copyFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
+            $this->arrayCache->remove('encryption_copy_version_' . $sourceInternalPath);
+            if ($result) {
+                $info = $this->getCache('', $sourceStorage)->get($sourceInternalPath);
+                // make sure that we update the unencrypted size for the version
+                if (isset($info['encrypted']) && $info['encrypted'] === true) {
+                    $this->updateUnencryptedSize(
+                        $this->getFullPath($targetInternalPath),
+                        $info->getUnencryptedSize()
+                    );
+                }
+                $this->updateEncryptedVersion($sourceStorage, $sourceInternalPath, $targetInternalPath, $isRename, true);
+            }
+            return $result;
+        }
+
+        // first copy the keys that we reuse the existing file key on the target location
+        // and don't create a new one which would break versions for example.
+        if ($sourceStorage->instanceOfStorage(Common::class) && $sourceStorage->getMountOption('mount_point')) {
+            $mountPoint = $sourceStorage->getMountOption('mount_point');
+            $source = $mountPoint . '/' . $sourceInternalPath;
+            $target = $this->getFullPath($targetInternalPath);
+            $this->copyKeys($source, $target);
+        } else {
+            $this->logger->error('Could not find mount point, can\'t keep encryption keys');
+        }
+
+        if ($sourceStorage->is_dir($sourceInternalPath)) {
+            $dh = $sourceStorage->opendir($sourceInternalPath);
+            if (!$this->is_dir($targetInternalPath)) {
+                $result = $this->mkdir($targetInternalPath);
+            } else {
+                $result = true;
+            }
+            if (is_resource($dh)) {
+                while ($result && ($file = readdir($dh)) !== false) {
+                    if (!Filesystem::isIgnoredDir($file)) {
+                        $result = $this->copyFromStorage($sourceStorage, $sourceInternalPath . '/' . $file, $targetInternalPath . '/' . $file, $preserveMtime, $isRename);
+                    }
+                }
+            }
+        } else {
+            $source = false;
+            $target = false;
+            try {
+                $source = $sourceStorage->fopen($sourceInternalPath, 'r');
+                $target = $this->fopen($targetInternalPath, 'w');
+                if ($source === false || $target === false) {
+                    $result = false;
+                } else {
+                    [, $result] = Files::streamCopy($source, $target, true);
+                }
+            } finally {
+                if ($source !== false) {
+                    fclose($source);
+                }
+                if ($target !== false) {
+                    fclose($target);
+                }
+            }
+            if ($result) {
+                if ($preserveMtime) {
+                    $this->touch($targetInternalPath, $sourceStorage->filemtime($sourceInternalPath));
+                }
+                $this->updateEncryptedVersion($sourceStorage, $sourceInternalPath, $targetInternalPath, $isRename, false);
+            } else {
+                // delete partially written target file
+                $this->unlink($targetInternalPath);
+                // delete cache entry that was created by fopen
+                $this->getCache()->remove($targetInternalPath);
+            }
+        }
+        return (bool)$result;
+    }
+
+    public function getLocalFile(string $path): string|false {
+        if ($this->encryptionManager->isEnabled()) {
+            $cachedFile = $this->getCachedFile($path);
+            if (is_string($cachedFile)) {
+                return $cachedFile;
+            }
+        }
+        return $this->storage->getLocalFile($path);
+    }
+
+    public function isLocal(): bool {
+        if ($this->encryptionManager->isEnabled()) {
+            return false;
+        }
+        return $this->storage->isLocal();
+    }
+
+    public function stat(string $path): array|false {
+        $stat = $this->storage->stat($path);
+        if (!$stat) {
+            return false;
+        }
+        $fileSize = $this->filesize($path);
+        $stat['size'] = $fileSize;
+        $stat[7] = $fileSize;
+        $stat['hasHeader'] = $this->getHeaderSize($path) > 0;
+        return $stat;
+    }
+
+    public function hash(string $type, string $path, bool $raw = false): string|false {
+        $fh = $this->fopen($path, 'rb');
+        if ($fh === false) {
+            return false;
+        }
+        $ctx = hash_init($type);
+        hash_update_stream($ctx, $fh);
+        fclose($fh);
+        return hash_final($ctx, $raw);
+    }
+
+    /**
+     * return full path, including mount point
+     *
+     * @param string $path relative to mount point
+     * @return string full path including mount point
+     */
+    protected function getFullPath(string $path): string {
+        return Filesystem::normalizePath($this->mountPoint . '/' . $path);
+    }
+
+    /**
+     * read first block of encrypted file, typically this will contain the
+     * encryption header
+     */
+    protected function readFirstBlock(string $path): string {
+        $firstBlock = '';
+        if ($this->storage->is_file($path)) {
+            $handle = $this->storage->fopen($path, 'r');
+            if ($handle === false) {
+                return '';
+            }
+            $firstBlock = fread($handle, $this->util->getHeaderSize());
+            fclose($handle);
+        }
+        return $firstBlock;
+    }
+
+    /**
+     * return header size of given file
+     */
+    protected function getHeaderSize(string $path): int {
+        $headerSize = 0;
+        $realFile = $this->util->stripPartialFileExtension($path);
+        if ($this->storage->is_file($realFile)) {
+            $path = $realFile;
+        }
+        $firstBlock = $this->readFirstBlock($path);
+
+        if (str_starts_with($firstBlock, Util::HEADER_START)) {
+            $headerSize = $this->util->getHeaderSize();
+        }
+
+        return $headerSize;
+    }
+
+    /**
+     * read header from file
+     */
+    protected function getHeader(string $path): array {
+        $realFile = $this->util->stripPartialFileExtension($path);
+        $exists = $this->storage->is_file($realFile);
+        if ($exists) {
+            $path = $realFile;
+        }
+
+        $result = [];
+
+        $isEncrypted = $this->encryptedPaths->get($realFile);
+        if (is_null($isEncrypted)) {
+            $info = $this->getCache()->get($path);
+            $isEncrypted = isset($info['encrypted']) && $info['encrypted'] === true;
+        }
+
+        if ($isEncrypted) {
+            $firstBlock = $this->readFirstBlock($path);
+            $result = $this->util->parseRawHeader($firstBlock);
+
+            // if the header doesn't contain a encryption module we check if it is a
+            // legacy file. If true, we add the default encryption module
+            if (!isset($result[Util::HEADER_ENCRYPTION_MODULE_KEY]) && (!empty($result) || $exists)) {
+                $result[Util::HEADER_ENCRYPTION_MODULE_KEY] = 'OC_DEFAULT_MODULE';
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * read encryption module needed to read/write the file located at $path
+     *
+     * @throws ModuleDoesNotExistsException
+     * @throws \Exception
+     */
+    protected function getEncryptionModule(string $path): ?\OCP\Encryption\IEncryptionModule {
+        $encryptionModule = null;
+        $header = $this->getHeader($path);
+        $encryptionModuleId = $this->util->getEncryptionModuleId($header);
+        if (!empty($encryptionModuleId)) {
+            try {
+                $encryptionModule = $this->encryptionManager->getEncryptionModule($encryptionModuleId);
+            } catch (ModuleDoesNotExistsException $e) {
+                $this->logger->critical('Encryption module defined in "' . $path . '" not loaded!');
+                throw $e;
+            }
+        }
+
+        return $encryptionModule;
+    }
+
+    public function updateUnencryptedSize(string $path, int|float $unencryptedSize): void {
+        $this->unencryptedSize[$path] = $unencryptedSize;
+    }
+
+    /**
+     * copy keys to new location
+     *
+     * @param string $source path relative to data/
+     * @param string $target path relative to data/
+     */
+    protected function copyKeys(string $source, string $target): bool {
+        if (!$this->util->isExcluded($source)) {
+            return $this->keyStorage->copyKeys($source, $target);
+        }
+
+        return false;
+    }
+
+    /**
+     * check if path points to a files version
+     */
+    protected function isVersion(string $path): bool {
+        $normalized = Filesystem::normalizePath($path);
+        return substr($normalized, 0, strlen('/files_versions/')) === '/files_versions/';
+    }
+
+    /**
+     * check if the given storage should be encrypted or not
+     */
+    public function shouldEncrypt(string $path): bool {
+        if (!$this->encryptionManager->isEnabled()) {
+            return false;
+        }
+        $fullPath = $this->getFullPath($path);
+        $mountPointConfig = $this->mount->getOption('encrypt', true);
+        if ($mountPointConfig === false) {
+            return false;
+        }
+
+        try {
+            $encryptionModule = $this->getEncryptionModule($fullPath);
+        } catch (ModuleDoesNotExistsException $e) {
+            return false;
+        }
+
+        if ($encryptionModule === null) {
+            $encryptionModule = $this->encryptionManager->getEncryptionModule();
+        }
+
+        return $encryptionModule->shouldEncrypt($fullPath);
+    }
+
+    public function writeStream(string $path, $stream, ?int $size = null): int {
+        // always fall back to fopen
+        $target = $this->fopen($path, 'w');
+        if ($target === false) {
+            throw new GenericFileException("Failed to open $path for writing");
+        }
+        [$count, $result] = Files::streamCopy($stream, $target, true);
+        fclose($stream);
+        fclose($target);
+
+        // object store, stores the size after write and doesn't update this during scan
+        // manually store the unencrypted size
+        if ($result && $this->getWrapperStorage()->instanceOfStorage(ObjectStoreStorage::class) && $this->shouldEncrypt($path)) {
+            $this->getCache()->put($path, ['unencrypted_size' => $count]);
+        }
+
+        return $count;
+    }
+
+    public function clearIsEncryptedCache(): void {
+        $this->encryptedPaths->clear();
+    }
+
+    /**
+     * Allow temporarily disabling the wrapper
+     */
+    public function setEnabled(bool $enabled): void {
+        $this->enabled = $enabled;
+    }
+
+    /**
+     * Check if the on-disk data for a file has a valid encrypted header
+     *
+     * @param string $path
+     * @return bool
+     */
+    public function hasValidHeader(string $path): bool {
+        $firstBlock = $this->readFirstBlock($path);
+        $header = $this->util->parseRawHeader($firstBlock);
+        return (count($header) > 0);
+    }
 }

lib/private/Files/Cache/Cache.php

Indentation +1260 added lines, -1260 removed lines

@@ -47,1264 +47,1264 @@
  * - ChangePropagator: updates the mtime and etags of parent folders whenever a change to the cache is made to the cache by the updater
  */
 class Cache implements ICache {
-	use MoveFromCacheTrait {
-		MoveFromCacheTrait::moveFromCache as moveFromCacheFallback;
-	}
-
-	/**
-	 * @var array partial data for the cache
-	 */
-	protected array $partial = [];
-	protected string $storageId;
-	protected Storage $storageCache;
-	protected IMimeTypeLoader $mimetypeLoader;
-	protected IDBConnection $connection;
-	protected SystemConfig $systemConfig;
-	protected LoggerInterface $logger;
-	protected QuerySearchHelper $querySearchHelper;
-	protected IEventDispatcher $eventDispatcher;
-	protected IFilesMetadataManager $metadataManager;
-
-	public function __construct(
-		private IStorage $storage,
-		// this constructor is used in to many pleases to easily do proper di
-		// so instead we group it all together
-		?CacheDependencies $dependencies = null,
-	) {
-		$this->storageId = $storage->getId();
-		if (strlen($this->storageId) > 64) {
-			$this->storageId = md5($this->storageId);
-		}
-		if (!$dependencies) {
-			$dependencies = \OCP\Server::get(CacheDependencies::class);
-		}
-		$this->storageCache = new Storage($this->storage, true, $dependencies->getConnection());
-		$this->mimetypeLoader = $dependencies->getMimeTypeLoader();
-		$this->connection = $dependencies->getConnection();
-		$this->systemConfig = $dependencies->getSystemConfig();
-		$this->logger = $dependencies->getLogger();
-		$this->querySearchHelper = $dependencies->getQuerySearchHelper();
-		$this->eventDispatcher = $dependencies->getEventDispatcher();
-		$this->metadataManager = $dependencies->getMetadataManager();
-	}
-
-	protected function getQueryBuilder() {
-		return new CacheQueryBuilder(
-			$this->connection->getQueryBuilder(),
-			$this->metadataManager,
-		);
-	}
-
-	public function getStorageCache(): Storage {
-		return $this->storageCache;
-	}
-
-	/**
-	 * Get the numeric storage id for this cache's storage
-	 *
-	 * @return int
-	 */
-	public function getNumericStorageId() {
-		return $this->storageCache->getNumericId();
-	}
-
-	/**
-	 * get the stored metadata of a file or folder
-	 *
-	 * @param string|int $file either the path of a file or folder or the file id for a file or folder
-	 * @return ICacheEntry|false the cache entry as array or false if the file is not found in the cache
-	 */
-	public function get($file) {
-		$query = $this->getQueryBuilder();
-		$query->selectFileCache();
-		$metadataQuery = $query->selectMetadata();
-
-		if (is_string($file) || $file == '') {
-			// normalize file
-			$file = $this->normalize($file);
-
-			$query->wherePath($file);
-		} else { //file id
-			$query->whereFileId($file);
-		}
-		$query->whereStorageId($this->getNumericStorageId());
-
-		$result = $query->executeQuery();
-		$data = $result->fetch();
-		$result->closeCursor();
-
-		if ($data !== false) {
-			$data['metadata'] = $metadataQuery->extractMetadata($data)->asArray();
-			return self::cacheEntryFromData($data, $this->mimetypeLoader);
-		} else {
-			//merge partial data
-			if (is_string($file) && isset($this->partial[$file])) {
-				return $this->partial[$file];
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Create a CacheEntry from database row
-	 *
-	 * @param array $data
-	 * @param IMimeTypeLoader $mimetypeLoader
-	 * @return CacheEntry
-	 */
-	public static function cacheEntryFromData($data, IMimeTypeLoader $mimetypeLoader) {
-		//fix types
-		$data['name'] = (string)$data['name'];
-		$data['path'] = (string)$data['path'];
-		$data['fileid'] = (int)$data['fileid'];
-		$data['parent'] = (int)$data['parent'];
-		$data['size'] = Util::numericToNumber($data['size']);
-		$data['unencrypted_size'] = Util::numericToNumber($data['unencrypted_size'] ?? 0);
-		$data['mtime'] = (int)$data['mtime'];
-		$data['storage_mtime'] = (int)$data['storage_mtime'];
-		$data['encryptedVersion'] = (int)$data['encrypted'];
-		$data['encrypted'] = (bool)$data['encrypted'];
-		$data['storage_id'] = $data['storage'];
-		$data['storage'] = (int)$data['storage'];
-		$data['mimetype'] = $mimetypeLoader->getMimetypeById($data['mimetype']);
-		$data['mimepart'] = $mimetypeLoader->getMimetypeById($data['mimepart']);
-		if ($data['storage_mtime'] == 0) {
-			$data['storage_mtime'] = $data['mtime'];
-		}
-		if (isset($data['f_permissions'])) {
-			$data['scan_permissions'] = $data['f_permissions'];
-		}
-		$data['permissions'] = (int)$data['permissions'];
-		if (isset($data['creation_time'])) {
-			$data['creation_time'] = (int)$data['creation_time'];
-		}
-		if (isset($data['upload_time'])) {
-			$data['upload_time'] = (int)$data['upload_time'];
-		}
-		return new CacheEntry($data);
-	}
-
-	/**
-	 * get the metadata of all files stored in $folder
-	 *
-	 * @param string $folder
-	 * @return ICacheEntry[]
-	 */
-	public function getFolderContents($folder) {
-		$fileId = $this->getId($folder);
-		return $this->getFolderContentsById($fileId);
-	}
-
-	/**
-	 * get the metadata of all files stored in $folder
-	 *
-	 * @param int $fileId the file id of the folder
-	 * @return ICacheEntry[]
-	 */
-	public function getFolderContentsById($fileId) {
-		if ($fileId > -1) {
-			$query = $this->getQueryBuilder();
-			$query->selectFileCache()
-				->whereParent($fileId)
-				->whereStorageId($this->getNumericStorageId())
-				->orderBy('name', 'ASC');
-
-			$metadataQuery = $query->selectMetadata();
-
-			$result = $query->executeQuery();
-			$files = $result->fetchAll();
-			$result->closeCursor();
-
-			return array_map(function (array $data) use ($metadataQuery) {
-				$data['metadata'] = $metadataQuery->extractMetadata($data)->asArray();
-				return self::cacheEntryFromData($data, $this->mimetypeLoader);
-			}, $files);
-		}
-		return [];
-	}
-
-	/**
-	 * insert or update meta data for a file or folder
-	 *
-	 * @param string $file
-	 * @param array $data
-	 *
-	 * @return int file id
-	 * @throws \RuntimeException
-	 */
-	public function put($file, array $data) {
-		if (($id = $this->getId($file)) > -1) {
-			$this->update($id, $data);
-			return $id;
-		} else {
-			return $this->insert($file, $data);
-		}
-	}
-
-	/**
-	 * insert meta data for a new file or folder
-	 *
-	 * @param string $file
-	 * @param array $data
-	 *
-	 * @return int file id
-	 * @throws \RuntimeException|Exception
-	 */
-	public function insert($file, array $data) {
-		// normalize file
-		$file = $this->normalize($file);
-
-		if (isset($this->partial[$file])) { //add any saved partial data
-			$data = array_merge($this->partial[$file]->getData(), $data);
-			unset($this->partial[$file]);
-		}
-
-		$requiredFields = ['size', 'mtime', 'mimetype'];
-		foreach ($requiredFields as $field) {
-			if (!isset($data[$field])) { //data not complete save as partial and return
-				$this->partial[$file] = new CacheEntry($data);
-				return -1;
-			}
-		}
-
-		$data['path'] = $file;
-		if (!isset($data['parent'])) {
-			$data['parent'] = $this->getParentId($file);
-		}
-		if ($data['parent'] === -1 && $file !== '') {
-			throw new \Exception('Parent folder not in filecache for ' . $file);
-		}
-		$data['name'] = basename($file);
-
-		[$values, $extensionValues] = $this->normalizeData($data);
-		$storageId = $this->getNumericStorageId();
-		$values['storage'] = $storageId;
-
-		try {
-			$builder = $this->connection->getQueryBuilder();
-			$builder->insert('filecache');
-
-			foreach ($values as $column => $value) {
-				$builder->setValue($column, $builder->createNamedParameter($value));
-			}
-
-			if ($builder->executeStatement()) {
-				$fileId = $builder->getLastInsertId();
-
-				if (count($extensionValues)) {
-					$query = $this->getQueryBuilder();
-					$query->insert('filecache_extended');
-					$query->hintShardKey('storage', $storageId);
-
-					$query->setValue('fileid', $query->createNamedParameter($fileId, IQueryBuilder::PARAM_INT));
-					foreach ($extensionValues as $column => $value) {
-						$query->setValue($column, $query->createNamedParameter($value));
-					}
-					$query->executeStatement();
-				}
-
-				$event = new CacheEntryInsertedEvent($this->storage, $file, $fileId, $storageId);
-				$this->eventDispatcher->dispatch(CacheInsertEvent::class, $event);
-				$this->eventDispatcher->dispatchTyped($event);
-				return $fileId;
-			}
-		} catch (Exception $e) {
-			if ($e->getReason() === Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
-				// entry exists already
-				if ($this->connection->inTransaction()) {
-					$this->connection->commit();
-					$this->connection->beginTransaction();
-				}
-			} else {
-				throw $e;
-			}
-		}
-
-		// The file was created in the meantime
-		if (($id = $this->getId($file)) > -1) {
-			$this->update($id, $data);
-			return $id;
-		} else {
-			throw new \RuntimeException('File entry could not be inserted but could also not be selected with getId() in order to perform an update. Please try again.');
-		}
-	}
-
-	/**
-	 * update the metadata of an existing file or folder in the cache
-	 *
-	 * @param int $id the fileid of the existing file or folder
-	 * @param array $data [$key => $value] the metadata to update, only the fields provided in the array will be updated, non-provided values will remain unchanged
-	 */
-	public function update($id, array $data) {
-		if (isset($data['path'])) {
-			// normalize path
-			$data['path'] = $this->normalize($data['path']);
-		}
-
-		if (isset($data['name'])) {
-			// normalize path
-			$data['name'] = $this->normalize($data['name']);
-		}
-
-		[$values, $extensionValues] = $this->normalizeData($data);
-
-		if (count($values)) {
-			$query = $this->getQueryBuilder();
-
-			$query->update('filecache')
-				->whereFileId($id)
-				->whereStorageId($this->getNumericStorageId())
-				->andWhere($query->expr()->orX(...array_map(function ($key, $value) use ($query) {
-					return $query->expr()->orX(
-						$query->expr()->neq($key, $query->createNamedParameter($value)),
-						$query->expr()->isNull($key)
-					);
-				}, array_keys($values), array_values($values))));
-
-			foreach ($values as $key => $value) {
-				$query->set($key, $query->createNamedParameter($value));
-			}
-
-			$query->executeStatement();
-		}
-
-		if (count($extensionValues)) {
-			try {
-				$query = $this->getQueryBuilder();
-				$query->insert('filecache_extended');
-				$query->hintShardKey('storage', $this->getNumericStorageId());
-
-				$query->setValue('fileid', $query->createNamedParameter($id, IQueryBuilder::PARAM_INT));
-				foreach ($extensionValues as $column => $value) {
-					$query->setValue($column, $query->createNamedParameter($value));
-				}
-
-				$query->executeStatement();
-			} catch (Exception $e) {
-				if ($e->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
-					throw $e;
-				}
-				$query = $this->getQueryBuilder();
-				$query->update('filecache_extended')
-					->whereFileId($id)
-					->hintShardKey('storage', $this->getNumericStorageId())
-					->andWhere($query->expr()->orX(...array_map(function ($key, $value) use ($query) {
-						return $query->expr()->orX(
-							$query->expr()->neq($key, $query->createNamedParameter($value)),
-							$query->expr()->isNull($key)
-						);
-					}, array_keys($extensionValues), array_values($extensionValues))));
-
-				foreach ($extensionValues as $key => $value) {
-					$query->set($key, $query->createNamedParameter($value));
-				}
-
-				$query->executeStatement();
-			}
-		}
-
-		$path = $this->getPathById($id);
-		// path can still be null if the file doesn't exist
-		if ($path !== null) {
-			$event = new CacheEntryUpdatedEvent($this->storage, $path, $id, $this->getNumericStorageId());
-			$this->eventDispatcher->dispatch(CacheUpdateEvent::class, $event);
-			$this->eventDispatcher->dispatchTyped($event);
-		}
-	}
-
-	/**
-	 * extract query parts and params array from data array
-	 *
-	 * @param array $data
-	 * @return array
-	 */
-	protected function normalizeData(array $data): array {
-		$fields = [
-			'path', 'parent', 'name', 'mimetype', 'size', 'mtime', 'storage_mtime', 'encrypted',
-			'etag', 'permissions', 'checksum', 'storage', 'unencrypted_size'];
-		$extensionFields = ['metadata_etag', 'creation_time', 'upload_time'];
-
-		$doNotCopyStorageMTime = false;
-		if (array_key_exists('mtime', $data) && $data['mtime'] === null) {
-			// this horrific magic tells it to not copy storage_mtime to mtime
-			unset($data['mtime']);
-			$doNotCopyStorageMTime = true;
-		}
-
-		$params = [];
-		$extensionParams = [];
-		foreach ($data as $name => $value) {
-			if (in_array($name, $fields)) {
-				if ($name === 'path') {
-					$params['path_hash'] = md5($value);
-				} elseif ($name === 'mimetype') {
-					$params['mimepart'] = $this->mimetypeLoader->getId(substr($value, 0, strpos($value, '/')));
-					$value = $this->mimetypeLoader->getId($value);
-				} elseif ($name === 'storage_mtime') {
-					if (!$doNotCopyStorageMTime && !isset($data['mtime'])) {
-						$params['mtime'] = $value;
-					}
-				} elseif ($name === 'encrypted') {
-					if (isset($data['encryptedVersion'])) {
-						$value = $data['encryptedVersion'];
-					} else {
-						// Boolean to integer conversion
-						$value = $value ? 1 : 0;
-					}
-				}
-				$params[$name] = $value;
-			}
-			if (in_array($name, $extensionFields)) {
-				$extensionParams[$name] = $value;
-			}
-		}
-		return [$params, array_filter($extensionParams)];
-	}
-
-	/**
-	 * get the file id for a file
-	 *
-	 * A file id is a numeric id for a file or folder that's unique within an owncloud instance which stays the same for the lifetime of a file
-	 *
-	 * File ids are easiest way for apps to store references to a file since unlike paths they are not affected by renames or sharing
-	 *
-	 * @param string $file
-	 * @return int
-	 */
-	public function getId($file) {
-		// normalize file
-		$file = $this->normalize($file);
-
-		$query = $this->getQueryBuilder();
-		$query->select('fileid')
-			->from('filecache')
-			->whereStorageId($this->getNumericStorageId())
-			->wherePath($file);
-
-		$result = $query->executeQuery();
-		$id = $result->fetchOne();
-		$result->closeCursor();
-
-		return $id === false ? -1 : (int)$id;
-	}
-
-	/**
-	 * get the id of the parent folder of a file
-	 *
-	 * @param string $file
-	 * @return int
-	 */
-	public function getParentId($file) {
-		if ($file === '') {
-			return -1;
-		} else {
-			$parent = $this->getParentPath($file);
-			return (int)$this->getId($parent);
-		}
-	}
-
-	private function getParentPath($path) {
-		$parent = dirname($path);
-		if ($parent === '.') {
-			$parent = '';
-		}
-		return $parent;
-	}
-
-	/**
-	 * check if a file is available in the cache
-	 *
-	 * @param string $file
-	 * @return bool
-	 */
-	public function inCache($file) {
-		return $this->getId($file) != -1;
-	}
-
-	/**
-	 * remove a file or folder from the cache
-	 *
-	 * when removing a folder from the cache all files and folders inside the folder will be removed as well
-	 *
-	 * @param string $file
-	 */
-	public function remove($file) {
-		$entry = $this->get($file);
-
-		if ($entry instanceof ICacheEntry) {
-			$query = $this->getQueryBuilder();
-			$query->delete('filecache')
-				->whereStorageId($this->getNumericStorageId())
-				->whereFileId($entry->getId());
-			$query->executeStatement();
-
-			$query = $this->getQueryBuilder();
-			$query->delete('filecache_extended')
-				->whereFileId($entry->getId())
-				->hintShardKey('storage', $this->getNumericStorageId());
-			$query->executeStatement();
-
-			if ($entry->getMimeType() == FileInfo::MIMETYPE_FOLDER) {
-				$this->removeChildren($entry);
-			}
-
-			$this->eventDispatcher->dispatchTyped(new CacheEntryRemovedEvent($this->storage, $entry->getPath(), $entry->getId(), $this->getNumericStorageId()));
-		}
-	}
-
-	/**
-	 * Remove all children of a folder
-	 *
-	 * @param ICacheEntry $entry the cache entry of the folder to remove the children of
-	 * @throws \OC\DatabaseException
-	 */
-	private function removeChildren(ICacheEntry $entry) {
-		$parentIds = [$entry->getId()];
-		$queue = [$entry->getId()];
-		$deletedIds = [];
-		$deletedPaths = [];
-
-		// we walk depth first through the file tree, removing all filecache_extended attributes while we walk
-		// and collecting all folder ids to later use to delete the filecache entries
-		while ($entryId = array_pop($queue)) {
-			$children = $this->getFolderContentsById($entryId);
-			$childIds = array_map(function (ICacheEntry $cacheEntry) {
-				return $cacheEntry->getId();
-			}, $children);
-			$childPaths = array_map(function (ICacheEntry $cacheEntry) {
-				return $cacheEntry->getPath();
-			}, $children);
-
-			foreach ($childIds as $childId) {
-				$deletedIds[] = $childId;
-			}
-
-			foreach ($childPaths as $childPath) {
-				$deletedPaths[] = $childPath;
-			}
-
-			$query = $this->getQueryBuilder();
-			$query->delete('filecache_extended')
-				->where($query->expr()->in('fileid', $query->createParameter('childIds')))
-				->hintShardKey('storage', $this->getNumericStorageId());
-
-			foreach (array_chunk($childIds, 1000) as $childIdChunk) {
-				$query->setParameter('childIds', $childIdChunk, IQueryBuilder::PARAM_INT_ARRAY);
-				$query->executeStatement();
-			}
-
-			/** @var ICacheEntry[] $childFolders */
-			$childFolders = [];
-			foreach ($children as $child) {
-				if ($child->getMimeType() == FileInfo::MIMETYPE_FOLDER) {
-					$childFolders[] = $child;
-				}
-			}
-			foreach ($childFolders as $folder) {
-				$parentIds[] = $folder->getId();
-				$queue[] = $folder->getId();
-			}
-		}
-
-		$query = $this->getQueryBuilder();
-		$query->delete('filecache')
-			->whereStorageId($this->getNumericStorageId())
-			->whereParentInParameter('parentIds');
-
-		// Sorting before chunking allows the db to find the entries close to each
-		// other in the index
-		sort($parentIds, SORT_NUMERIC);
-		foreach (array_chunk($parentIds, 1000) as $parentIdChunk) {
-			$query->setParameter('parentIds', $parentIdChunk, IQueryBuilder::PARAM_INT_ARRAY);
-			$query->executeStatement();
-		}
-
-		foreach (array_combine($deletedIds, $deletedPaths) as $fileId => $filePath) {
-			$cacheEntryRemovedEvent = new CacheEntryRemovedEvent(
-				$this->storage,
-				$filePath,
-				$fileId,
-				$this->getNumericStorageId()
-			);
-			$this->eventDispatcher->dispatchTyped($cacheEntryRemovedEvent);
-		}
-	}
-
-	/**
-	 * Move a file or folder in the cache
-	 *
-	 * @param string $source
-	 * @param string $target
-	 */
-	public function move($source, $target) {
-		$this->moveFromCache($this, $source, $target);
-	}
-
-	/**
-	 * Get the storage id and path needed for a move
-	 *
-	 * @param string $path
-	 * @return array [$storageId, $internalPath]
-	 */
-	protected function getMoveInfo($path) {
-		return [$this->getNumericStorageId(), $path];
-	}
-
-	protected function hasEncryptionWrapper(): bool {
-		return $this->storage->instanceOfStorage(Encryption::class);
-	}
-
-	protected function shouldEncrypt(string $targetPath): bool {
-		if (!$this->storage->instanceOfStorage(Encryption::class)) {
-			return false;
-		}
-		return $this->storage->shouldEncrypt($targetPath);
-	}
-
-	/**
-	 * Move a file or folder in the cache
-	 *
-	 * @param ICache $sourceCache
-	 * @param string $sourcePath
-	 * @param string $targetPath
-	 * @throws \OC\DatabaseException
-	 * @throws \Exception if the given storages have an invalid id
-	 */
-	public function moveFromCache(ICache $sourceCache, $sourcePath, $targetPath) {
-		if ($sourceCache instanceof Cache) {
-			// normalize source and target
-			$sourcePath = $this->normalize($sourcePath);
-			$targetPath = $this->normalize($targetPath);
-
-			$sourceData = $sourceCache->get($sourcePath);
-			if (!$sourceData) {
-				throw new \Exception('Source path not found in cache: ' . $sourcePath);
-			}
-
-			$shardDefinition = $this->connection->getShardDefinition('filecache');
-			if (
-				$shardDefinition
-				&& $shardDefinition->getShardForKey($sourceCache->getNumericStorageId()) !== $shardDefinition->getShardForKey($this->getNumericStorageId())
-			) {
-				$this->moveFromStorageSharded($shardDefinition, $sourceCache, $sourceData, $targetPath);
-				return;
-			}
-
-			$sourceId = $sourceData['fileid'];
-			$newParentId = $this->getParentId($targetPath);
-
-			[$sourceStorageId, $sourcePath] = $sourceCache->getMoveInfo($sourcePath);
-			[$targetStorageId, $targetPath] = $this->getMoveInfo($targetPath);
-
-			if (is_null($sourceStorageId) || $sourceStorageId === false) {
-				throw new \Exception('Invalid source storage id: ' . $sourceStorageId);
-			}
-			if (is_null($targetStorageId) || $targetStorageId === false) {
-				throw new \Exception('Invalid target storage id: ' . $targetStorageId);
-			}
-
-			if ($sourceData['mimetype'] === 'httpd/unix-directory') {
-				//update all child entries
-				$sourceLength = mb_strlen($sourcePath);
-
-				$childIds = $this->getChildIds($sourceStorageId, $sourcePath);
-
-				$childChunks = array_chunk($childIds, 1000);
-
-				$query = $this->getQueryBuilder();
-
-				$fun = $query->func();
-				$newPathFunction = $fun->concat(
-					$query->createNamedParameter($targetPath),
-					$fun->substring('path', $query->createNamedParameter($sourceLength + 1, IQueryBuilder::PARAM_INT))// +1 for the leading slash
-				);
-				$query->update('filecache')
-					->set('path_hash', $fun->md5($newPathFunction))
-					->set('path', $newPathFunction)
-					->whereStorageId($sourceStorageId)
-					->andWhere($query->expr()->in('fileid', $query->createParameter('files')));
-
-				if ($sourceStorageId !== $targetStorageId) {
-					$query->set('storage', $query->createNamedParameter($targetStorageId), IQueryBuilder::PARAM_INT);
-				}
-
-				// when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
-				if ($sourceCache->hasEncryptionWrapper() && !$this->hasEncryptionWrapper()) {
-					$query->set('encrypted', $query->createNamedParameter(0, IQueryBuilder::PARAM_INT));
-				}
-
-				// Retry transaction in case of RetryableException like deadlocks.
-				// Retry up to 4 times because we should receive up to 4 concurrent requests from the frontend
-				$retryLimit = 4;
-				for ($i = 1; $i <= $retryLimit; $i++) {
-					try {
-						$this->connection->beginTransaction();
-						foreach ($childChunks as $chunk) {
-							$query->setParameter('files', $chunk, IQueryBuilder::PARAM_INT_ARRAY);
-							$query->executeStatement();
-						}
-						break;
-					} catch (\OC\DatabaseException $e) {
-						$this->connection->rollBack();
-						throw $e;
-					} catch (DbalException $e) {
-						$this->connection->rollBack();
-
-						if (!$e->isRetryable()) {
-							throw $e;
-						}
-
-						// Simply throw if we already retried 4 times.
-						if ($i === $retryLimit) {
-							throw $e;
-						}
-
-						// Sleep a bit to give some time to the other transaction to finish.
-						usleep(100 * 1000 * $i);
-					}
-				}
-			} else {
-				$this->connection->beginTransaction();
-			}
-
-			$query = $this->getQueryBuilder();
-			$query->update('filecache')
-				->set('path', $query->createNamedParameter($targetPath))
-				->set('path_hash', $query->createNamedParameter(md5($targetPath)))
-				->set('name', $query->createNamedParameter(basename($targetPath)))
-				->set('parent', $query->createNamedParameter($newParentId, IQueryBuilder::PARAM_INT))
-				->whereStorageId($sourceStorageId)
-				->whereFileId($sourceId);
-
-			if ($sourceStorageId !== $targetStorageId) {
-				$query->set('storage', $query->createNamedParameter($targetStorageId), IQueryBuilder::PARAM_INT);
-			}
-
-			// when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
-			if ($sourceCache->hasEncryptionWrapper() && !$this->hasEncryptionWrapper()) {
-				$query->set('encrypted', $query->createNamedParameter(0, IQueryBuilder::PARAM_INT));
-			}
-
-			$query->executeStatement();
-
-			$this->connection->commit();
-
-			if ($sourceCache->getNumericStorageId() !== $this->getNumericStorageId()) {
-				$this->eventDispatcher->dispatchTyped(new CacheEntryRemovedEvent($this->storage, $sourcePath, $sourceId, $sourceCache->getNumericStorageId()));
-				$event = new CacheEntryInsertedEvent($this->storage, $targetPath, $sourceId, $this->getNumericStorageId());
-				$this->eventDispatcher->dispatch(CacheInsertEvent::class, $event);
-				$this->eventDispatcher->dispatchTyped($event);
-			} else {
-				$event = new CacheEntryUpdatedEvent($this->storage, $targetPath, $sourceId, $this->getNumericStorageId());
-				$this->eventDispatcher->dispatch(CacheUpdateEvent::class, $event);
-				$this->eventDispatcher->dispatchTyped($event);
-			}
-		} else {
-			$this->moveFromCacheFallback($sourceCache, $sourcePath, $targetPath);
-		}
-	}
-
-	private function getChildIds(int $storageId, string $path): array {
-		$query = $this->connection->getQueryBuilder();
-		$query->select('fileid')
-			->from('filecache')
-			->where($query->expr()->eq('storage', $query->createNamedParameter($storageId, IQueryBuilder::PARAM_INT)))
-			->andWhere($query->expr()->like('path', $query->createNamedParameter($this->connection->escapeLikeParameter($path) . '/%')));
-		return $query->executeQuery()->fetchAll(\PDO::FETCH_COLUMN);
-	}
-
-	/**
-	 * remove all entries for files that are stored on the storage from the cache
-	 */
-	public function clear() {
-		$query = $this->getQueryBuilder();
-		$query->delete('filecache')
-			->whereStorageId($this->getNumericStorageId());
-		$query->executeStatement();
-
-		$query = $this->connection->getQueryBuilder();
-		$query->delete('storages')
-			->where($query->expr()->eq('id', $query->createNamedParameter($this->storageId)));
-		$query->executeStatement();
-	}
-
-	/**
-	 * Get the scan status of a file
-	 *
-	 * - Cache::NOT_FOUND: File is not in the cache
-	 * - Cache::PARTIAL: File is not stored in the cache but some incomplete data is known
-	 * - Cache::SHALLOW: The folder and it's direct children are in the cache but not all sub folders are fully scanned
-	 * - Cache::COMPLETE: The file or folder, with all it's children) are fully scanned
-	 *
-	 * @param string $file
-	 *
-	 * @return int Cache::NOT_FOUND, Cache::PARTIAL, Cache::SHALLOW or Cache::COMPLETE
-	 */
-	public function getStatus($file) {
-		// normalize file
-		$file = $this->normalize($file);
-
-		$query = $this->getQueryBuilder();
-		$query->select('size')
-			->from('filecache')
-			->whereStorageId($this->getNumericStorageId())
-			->wherePath($file);
-
-		$result = $query->executeQuery();
-		$size = $result->fetchOne();
-		$result->closeCursor();
-
-		if ($size !== false) {
-			if ((int)$size === -1) {
-				return self::SHALLOW;
-			} else {
-				return self::COMPLETE;
-			}
-		} else {
-			if (isset($this->partial[$file])) {
-				return self::PARTIAL;
-			} else {
-				return self::NOT_FOUND;
-			}
-		}
-	}
-
-	/**
-	 * search for files matching $pattern
-	 *
-	 * @param string $pattern the search pattern using SQL search syntax (e.g. '%searchstring%')
-	 * @return ICacheEntry[] an array of cache entries where the name matches the search pattern
-	 */
-	public function search($pattern) {
-		$operator = new SearchComparison(ISearchComparison::COMPARE_LIKE, 'name', $pattern);
-		return $this->searchQuery(new SearchQuery($operator, 0, 0, [], null));
-	}
-
-	/**
-	 * search for files by mimetype
-	 *
-	 * @param string $mimetype either a full mimetype to search ('text/plain') or only the first part of a mimetype ('image')
-	 *                         where it will search for all mimetypes in the group ('image/*')
-	 * @return ICacheEntry[] an array of cache entries where the mimetype matches the search
-	 */
-	public function searchByMime($mimetype) {
-		if (!str_contains($mimetype, '/')) {
-			$operator = new SearchComparison(ISearchComparison::COMPARE_LIKE, 'mimetype', $mimetype . '/%');
-		} else {
-			$operator = new SearchComparison(ISearchComparison::COMPARE_EQUAL, 'mimetype', $mimetype);
-		}
-		return $this->searchQuery(new SearchQuery($operator, 0, 0, [], null));
-	}
-
-	public function searchQuery(ISearchQuery $query) {
-		return current($this->querySearchHelper->searchInCaches($query, [$this]));
-	}
-
-	/**
-	 * Re-calculate the folder size and the size of all parent folders
-	 *
-	 * @param array|ICacheEntry|null $data (optional) meta data of the folder
-	 */
-	public function correctFolderSize(string $path, $data = null, bool $isBackgroundScan = false): void {
-		$this->calculateFolderSize($path, $data);
-
-		if ($path !== '') {
-			$parent = dirname($path);
-			if ($parent === '.' || $parent === '/') {
-				$parent = '';
-			}
-
-			if ($isBackgroundScan) {
-				$parentData = $this->get($parent);
-				if ($parentData !== false
-					&& $parentData['size'] !== -1
-					&& $this->getIncompleteChildrenCount($parentData['fileid']) === 0
-				) {
-					$this->correctFolderSize($parent, $parentData, $isBackgroundScan);
-				}
-			} else {
-				$this->correctFolderSize($parent);
-			}
-		}
-	}
-
-	/**
-	 * get the incomplete count that shares parent $folder
-	 *
-	 * @param int $fileId the file id of the folder
-	 * @return int
-	 */
-	public function getIncompleteChildrenCount($fileId) {
-		if ($fileId > -1) {
-			$query = $this->getQueryBuilder();
-			$query->select($query->func()->count())
-				->from('filecache')
-				->whereParent($fileId)
-				->whereStorageId($this->getNumericStorageId())
-				->andWhere($query->expr()->eq('size', $query->createNamedParameter(-1, IQueryBuilder::PARAM_INT)));
-
-			$result = $query->executeQuery();
-			$size = (int)$result->fetchOne();
-			$result->closeCursor();
-
-			return $size;
-		}
-		return -1;
-	}
-
-	/**
-	 * calculate the size of a folder and set it in the cache
-	 *
-	 * @param string $path
-	 * @param array|null|ICacheEntry $entry (optional) meta data of the folder
-	 * @return int|float
-	 */
-	public function calculateFolderSize($path, $entry = null) {
-		return $this->calculateFolderSizeInner($path, $entry);
-	}
-
-
-	/**
-	 * inner function because we can't add new params to the public function without breaking any child classes
-	 *
-	 * @param string $path
-	 * @param array|null|ICacheEntry $entry (optional) meta data of the folder
-	 * @param bool $ignoreUnknown don't mark the folder size as unknown if any of it's children are unknown
-	 * @return int|float
-	 */
-	protected function calculateFolderSizeInner(string $path, $entry = null, bool $ignoreUnknown = false) {
-		$totalSize = 0;
-		if (is_null($entry) || !isset($entry['fileid'])) {
-			$entry = $this->get($path);
-		}
-		if (isset($entry['mimetype']) && $entry['mimetype'] === FileInfo::MIMETYPE_FOLDER) {
-			$id = $entry['fileid'];
-
-			$query = $this->getQueryBuilder();
-			$query->select('size', 'unencrypted_size')
-				->from('filecache')
-				->whereStorageId($this->getNumericStorageId())
-				->whereParent($id);
-			if ($ignoreUnknown) {
-				$query->andWhere($query->expr()->gte('size', $query->createNamedParameter(0)));
-			}
-
-			$result = $query->executeQuery();
-			$rows = $result->fetchAll();
-			$result->closeCursor();
-
-			if ($rows) {
-				$sizes = array_map(function (array $row) {
-					return Util::numericToNumber($row['size']);
-				}, $rows);
-				$unencryptedOnlySizes = array_map(function (array $row) {
-					return Util::numericToNumber($row['unencrypted_size']);
-				}, $rows);
-				$unencryptedSizes = array_map(function (array $row) {
-					return Util::numericToNumber(($row['unencrypted_size'] > 0) ? $row['unencrypted_size'] : $row['size']);
-				}, $rows);
-
-				$sum = array_sum($sizes);
-				$min = min($sizes);
-
-				$unencryptedSum = array_sum($unencryptedSizes);
-				$unencryptedMin = min($unencryptedSizes);
-				$unencryptedMax = max($unencryptedOnlySizes);
-
-				$sum = 0 + $sum;
-				$min = 0 + $min;
-				if ($min === -1) {
-					$totalSize = $min;
-				} else {
-					$totalSize = $sum;
-				}
-				if ($unencryptedMin === -1 || $min === -1) {
-					$unencryptedTotal = $unencryptedMin;
-				} else {
-					$unencryptedTotal = $unencryptedSum;
-				}
-			} else {
-				$totalSize = 0;
-				$unencryptedTotal = 0;
-				$unencryptedMax = 0;
-			}
-
-			// only set unencrypted size for a folder if any child entries have it set, or the folder is empty
-			$shouldWriteUnEncryptedSize = $unencryptedMax > 0 || $totalSize === 0 || ($entry['unencrypted_size'] ?? 0) > 0;
-			if ($entry['size'] !== $totalSize || (($entry['unencrypted_size'] ?? 0) !== $unencryptedTotal && $shouldWriteUnEncryptedSize)) {
-				if ($shouldWriteUnEncryptedSize) {
-					// if all children have an unencrypted size of 0, just set the folder unencrypted size to 0 instead of summing the sizes
-					if ($unencryptedMax === 0) {
-						$unencryptedTotal = 0;
-					}
-
-					$this->update($id, [
-						'size' => $totalSize,
-						'unencrypted_size' => $unencryptedTotal,
-					]);
-				} else {
-					$this->update($id, [
-						'size' => $totalSize,
-					]);
-				}
-			}
-		}
-		return $totalSize;
-	}
-
-	/**
-	 * get all file ids on the files on the storage
-	 *
-	 * @return int[]
-	 */
-	public function getAll() {
-		$query = $this->getQueryBuilder();
-		$query->select('fileid')
-			->from('filecache')
-			->whereStorageId($this->getNumericStorageId());
-
-		$result = $query->executeQuery();
-		$files = $result->fetchAll(\PDO::FETCH_COLUMN);
-		$result->closeCursor();
-
-		return array_map(function ($id) {
-			return (int)$id;
-		}, $files);
-	}
-
-	/**
-	 * find a folder in the cache which has not been fully scanned
-	 *
-	 * If multiple incomplete folders are in the cache, the one with the highest id will be returned,
-	 * use the one with the highest id gives the best result with the background scanner, since that is most
-	 * likely the folder where we stopped scanning previously
-	 *
-	 * @return string|false the path of the folder or false when no folder matched
-	 */
-	public function getIncomplete() {
-		$query = $this->getQueryBuilder();
-		$query->select('path')
-			->from('filecache')
-			->whereStorageId($this->getNumericStorageId())
-			->andWhere($query->expr()->eq('size', $query->createNamedParameter(-1, IQueryBuilder::PARAM_INT)))
-			->orderBy('fileid', 'DESC')
-			->setMaxResults(1);
-
-		$result = $query->executeQuery();
-		$path = $result->fetchOne();
-		$result->closeCursor();
-
-		return $path === false ? false : (string)$path;
-	}
-
-	/**
-	 * get the path of a file on this storage by it's file id
-	 *
-	 * @param int $id the file id of the file or folder to search
-	 * @return string|null the path of the file (relative to the storage) or null if a file with the given id does not exists within this cache
-	 */
-	public function getPathById($id) {
-		$query = $this->getQueryBuilder();
-		$query->select('path')
-			->from('filecache')
-			->whereStorageId($this->getNumericStorageId())
-			->whereFileId($id);
-
-		$result = $query->executeQuery();
-		$path = $result->fetchOne();
-		$result->closeCursor();
-
-		if ($path === false) {
-			return null;
-		}
-
-		return (string)$path;
-	}
-
-	/**
-	 * get the storage id of the storage for a file and the internal path of the file
-	 * unlike getPathById this does not limit the search to files on this storage and
-	 * instead does a global search in the cache table
-	 *
-	 * @param int $id
-	 * @return array first element holding the storage id, second the path
-	 * @deprecated 17.0.0 use getPathById() instead
-	 */
-	public static function getById($id) {
-		$query = \OC::$server->getDatabaseConnection()->getQueryBuilder();
-		$query->select('path', 'storage')
-			->from('filecache')
-			->where($query->expr()->eq('fileid', $query->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
-
-		$result = $query->executeQuery();
-		$row = $result->fetch();
-		$result->closeCursor();
-
-		if ($row) {
-			$numericId = $row['storage'];
-			$path = $row['path'];
-		} else {
-			return null;
-		}
-
-		if ($id = Storage::getStorageId($numericId)) {
-			return [$id, $path];
-		} else {
-			return null;
-		}
-	}
-
-	/**
-	 * normalize the given path
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	public function normalize($path) {
-		return trim(\OC_Util::normalizeUnicode($path), '/');
-	}
-
-	/**
-	 * Copy a file or folder in the cache
-	 *
-	 * @param ICache $sourceCache
-	 * @param ICacheEntry $sourceEntry
-	 * @param string $targetPath
-	 * @return int fileId of copied entry
-	 */
-	public function copyFromCache(ICache $sourceCache, ICacheEntry $sourceEntry, string $targetPath): int {
-		if ($sourceEntry->getId() < 0) {
-			throw new \RuntimeException('Invalid source cache entry on copyFromCache');
-		}
-		$data = $this->cacheEntryToArray($sourceEntry);
-
-		// when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
-		if ($sourceCache instanceof Cache
-			&& $sourceCache->hasEncryptionWrapper()
-			&& !$this->shouldEncrypt($targetPath)) {
-			$data['encrypted'] = 0;
-		}
-
-		$fileId = $this->put($targetPath, $data);
-		if ($fileId <= 0) {
-			throw new \RuntimeException('Failed to copy to ' . $targetPath . ' from cache with source data ' . json_encode($data) . ' ');
-		}
-		if ($sourceEntry->getMimeType() === ICacheEntry::DIRECTORY_MIMETYPE) {
-			$folderContent = $sourceCache->getFolderContentsById($sourceEntry->getId());
-			foreach ($folderContent as $subEntry) {
-				$subTargetPath = $targetPath . '/' . $subEntry->getName();
-				$this->copyFromCache($sourceCache, $subEntry, $subTargetPath);
-			}
-		}
-		return $fileId;
-	}
-
-	private function cacheEntryToArray(ICacheEntry $entry): array {
-		$data = [
-			'size' => $entry->getSize(),
-			'mtime' => $entry->getMTime(),
-			'storage_mtime' => $entry->getStorageMTime(),
-			'mimetype' => $entry->getMimeType(),
-			'mimepart' => $entry->getMimePart(),
-			'etag' => $entry->getEtag(),
-			'permissions' => $entry->getPermissions(),
-			'encrypted' => $entry->isEncrypted(),
-			'creation_time' => $entry->getCreationTime(),
-			'upload_time' => $entry->getUploadTime(),
-			'metadata_etag' => $entry->getMetadataEtag(),
-		];
-		if ($entry instanceof CacheEntry && isset($entry['scan_permissions'])) {
-			$data['permissions'] = $entry['scan_permissions'];
-		}
-		return $data;
-	}
-
-	public function getQueryFilterForStorage(): ISearchOperator {
-		return new SearchComparison(ISearchComparison::COMPARE_EQUAL, 'storage', $this->getNumericStorageId());
-	}
-
-	public function getCacheEntryFromSearchResult(ICacheEntry $rawEntry): ?ICacheEntry {
-		if ($rawEntry->getStorageId() === $this->getNumericStorageId()) {
-			return $rawEntry;
-		} else {
-			return null;
-		}
-	}
-
-	private function moveFromStorageSharded(ShardDefinition $shardDefinition, ICache $sourceCache, ICacheEntry $sourceEntry, $targetPath): void {
-		$sourcePath = $sourceEntry->getPath();
-		while ($sourceCache instanceof CacheWrapper) {
-			if ($sourceCache instanceof CacheJail) {
-				$sourcePath = $sourceCache->getSourcePath($sourcePath);
-			}
-			$sourceCache = $sourceCache->getCache();
-		}
-
-		if ($sourceEntry->getMimeType() === ICacheEntry::DIRECTORY_MIMETYPE) {
-			$fileIds = $this->getChildIds($sourceCache->getNumericStorageId(), $sourcePath);
-		} else {
-			$fileIds = [];
-		}
-		$fileIds[] = $sourceEntry->getId();
-
-		$helper = $this->connection->getCrossShardMoveHelper();
-
-		$sourceConnection = $helper->getConnection($shardDefinition, $sourceCache->getNumericStorageId());
-		$targetConnection = $helper->getConnection($shardDefinition, $this->getNumericStorageId());
-
-		$cacheItems = $helper->loadItems($sourceConnection, 'filecache', 'fileid', $fileIds);
-		$extendedItems = $helper->loadItems($sourceConnection, 'filecache_extended', 'fileid', $fileIds);
-		$metadataItems = $helper->loadItems($sourceConnection, 'files_metadata', 'file_id', $fileIds);
-
-		// when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
-		$removeEncryptedFlag = ($sourceCache instanceof Cache && $sourceCache->hasEncryptionWrapper()) && !$this->hasEncryptionWrapper();
-
-		$sourcePathLength = strlen($sourcePath);
-		foreach ($cacheItems as &$cacheItem) {
-			if ($cacheItem['path'] === $sourcePath) {
-				$cacheItem['path'] = $targetPath;
-				$cacheItem['parent'] = $this->getParentId($targetPath);
-				$cacheItem['name'] = basename($cacheItem['path']);
-			} else {
-				$cacheItem['path'] = $targetPath . '/' . substr($cacheItem['path'], $sourcePathLength + 1); // +1 for the leading slash
-			}
-			$cacheItem['path_hash'] = md5($cacheItem['path']);
-			$cacheItem['storage'] = $this->getNumericStorageId();
-			if ($removeEncryptedFlag) {
-				$cacheItem['encrypted'] = 0;
-			}
-		}
-
-		$targetConnection->beginTransaction();
-
-		try {
-			$helper->saveItems($targetConnection, 'filecache', $cacheItems);
-			$helper->saveItems($targetConnection, 'filecache_extended', $extendedItems);
-			$helper->saveItems($targetConnection, 'files_metadata', $metadataItems);
-		} catch (\Exception $e) {
-			$targetConnection->rollback();
-			throw $e;
-		}
-
-		$sourceConnection->beginTransaction();
-
-		try {
-			$helper->deleteItems($sourceConnection, 'filecache', 'fileid', $fileIds);
-			$helper->deleteItems($sourceConnection, 'filecache_extended', 'fileid', $fileIds);
-			$helper->deleteItems($sourceConnection, 'files_metadata', 'file_id', $fileIds);
-		} catch (\Exception $e) {
-			$targetConnection->rollback();
-			$sourceConnection->rollBack();
-			throw $e;
-		}
-
-		try {
-			$sourceConnection->commit();
-		} catch (\Exception $e) {
-			$targetConnection->rollback();
-			throw $e;
-		}
-		$targetConnection->commit();
-	}
+    use MoveFromCacheTrait {
+        MoveFromCacheTrait::moveFromCache as moveFromCacheFallback;
+    }
+
+    /**
+     * @var array partial data for the cache
+     */
+    protected array $partial = [];
+    protected string $storageId;
+    protected Storage $storageCache;
+    protected IMimeTypeLoader $mimetypeLoader;
+    protected IDBConnection $connection;
+    protected SystemConfig $systemConfig;
+    protected LoggerInterface $logger;
+    protected QuerySearchHelper $querySearchHelper;
+    protected IEventDispatcher $eventDispatcher;
+    protected IFilesMetadataManager $metadataManager;
+
+    public function __construct(
+        private IStorage $storage,
+        // this constructor is used in to many pleases to easily do proper di
+        // so instead we group it all together
+        ?CacheDependencies $dependencies = null,
+    ) {
+        $this->storageId = $storage->getId();
+        if (strlen($this->storageId) > 64) {
+            $this->storageId = md5($this->storageId);
+        }
+        if (!$dependencies) {
+            $dependencies = \OCP\Server::get(CacheDependencies::class);
+        }
+        $this->storageCache = new Storage($this->storage, true, $dependencies->getConnection());
+        $this->mimetypeLoader = $dependencies->getMimeTypeLoader();
+        $this->connection = $dependencies->getConnection();
+        $this->systemConfig = $dependencies->getSystemConfig();
+        $this->logger = $dependencies->getLogger();
+        $this->querySearchHelper = $dependencies->getQuerySearchHelper();
+        $this->eventDispatcher = $dependencies->getEventDispatcher();
+        $this->metadataManager = $dependencies->getMetadataManager();
+    }
+
+    protected function getQueryBuilder() {
+        return new CacheQueryBuilder(
+            $this->connection->getQueryBuilder(),
+            $this->metadataManager,
+        );
+    }
+
+    public function getStorageCache(): Storage {
+        return $this->storageCache;
+    }
+
+    /**
+     * Get the numeric storage id for this cache's storage
+     *
+     * @return int
+     */
+    public function getNumericStorageId() {
+        return $this->storageCache->getNumericId();
+    }
+
+    /**
+     * get the stored metadata of a file or folder
+     *
+     * @param string|int $file either the path of a file or folder or the file id for a file or folder
+     * @return ICacheEntry|false the cache entry as array or false if the file is not found in the cache
+     */
+    public function get($file) {
+        $query = $this->getQueryBuilder();
+        $query->selectFileCache();
+        $metadataQuery = $query->selectMetadata();
+
+        if (is_string($file) || $file == '') {
+            // normalize file
+            $file = $this->normalize($file);
+
+            $query->wherePath($file);
+        } else { //file id
+            $query->whereFileId($file);
+        }
+        $query->whereStorageId($this->getNumericStorageId());
+
+        $result = $query->executeQuery();
+        $data = $result->fetch();
+        $result->closeCursor();
+
+        if ($data !== false) {
+            $data['metadata'] = $metadataQuery->extractMetadata($data)->asArray();
+            return self::cacheEntryFromData($data, $this->mimetypeLoader);
+        } else {
+            //merge partial data
+            if (is_string($file) && isset($this->partial[$file])) {
+                return $this->partial[$file];
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Create a CacheEntry from database row
+     *
+     * @param array $data
+     * @param IMimeTypeLoader $mimetypeLoader
+     * @return CacheEntry
+     */
+    public static function cacheEntryFromData($data, IMimeTypeLoader $mimetypeLoader) {
+        //fix types
+        $data['name'] = (string)$data['name'];
+        $data['path'] = (string)$data['path'];
+        $data['fileid'] = (int)$data['fileid'];
+        $data['parent'] = (int)$data['parent'];
+        $data['size'] = Util::numericToNumber($data['size']);
+        $data['unencrypted_size'] = Util::numericToNumber($data['unencrypted_size'] ?? 0);
+        $data['mtime'] = (int)$data['mtime'];
+        $data['storage_mtime'] = (int)$data['storage_mtime'];
+        $data['encryptedVersion'] = (int)$data['encrypted'];
+        $data['encrypted'] = (bool)$data['encrypted'];
+        $data['storage_id'] = $data['storage'];
+        $data['storage'] = (int)$data['storage'];
+        $data['mimetype'] = $mimetypeLoader->getMimetypeById($data['mimetype']);
+        $data['mimepart'] = $mimetypeLoader->getMimetypeById($data['mimepart']);
+        if ($data['storage_mtime'] == 0) {
+            $data['storage_mtime'] = $data['mtime'];
+        }
+        if (isset($data['f_permissions'])) {
+            $data['scan_permissions'] = $data['f_permissions'];
+        }
+        $data['permissions'] = (int)$data['permissions'];
+        if (isset($data['creation_time'])) {
+            $data['creation_time'] = (int)$data['creation_time'];
+        }
+        if (isset($data['upload_time'])) {
+            $data['upload_time'] = (int)$data['upload_time'];
+        }
+        return new CacheEntry($data);
+    }
+
+    /**
+     * get the metadata of all files stored in $folder
+     *
+     * @param string $folder
+     * @return ICacheEntry[]
+     */
+    public function getFolderContents($folder) {
+        $fileId = $this->getId($folder);
+        return $this->getFolderContentsById($fileId);
+    }
+
+    /**
+     * get the metadata of all files stored in $folder
+     *
+     * @param int $fileId the file id of the folder
+     * @return ICacheEntry[]
+     */
+    public function getFolderContentsById($fileId) {
+        if ($fileId > -1) {
+            $query = $this->getQueryBuilder();
+            $query->selectFileCache()
+                ->whereParent($fileId)
+                ->whereStorageId($this->getNumericStorageId())
+                ->orderBy('name', 'ASC');
+
+            $metadataQuery = $query->selectMetadata();
+
+            $result = $query->executeQuery();
+            $files = $result->fetchAll();
+            $result->closeCursor();
+
+            return array_map(function (array $data) use ($metadataQuery) {
+                $data['metadata'] = $metadataQuery->extractMetadata($data)->asArray();
+                return self::cacheEntryFromData($data, $this->mimetypeLoader);
+            }, $files);
+        }
+        return [];
+    }
+
+    /**
+     * insert or update meta data for a file or folder
+     *
+     * @param string $file
+     * @param array $data
+     *
+     * @return int file id
+     * @throws \RuntimeException
+     */
+    public function put($file, array $data) {
+        if (($id = $this->getId($file)) > -1) {
+            $this->update($id, $data);
+            return $id;
+        } else {
+            return $this->insert($file, $data);
+        }
+    }
+
+    /**
+     * insert meta data for a new file or folder
+     *
+     * @param string $file
+     * @param array $data
+     *
+     * @return int file id
+     * @throws \RuntimeException|Exception
+     */
+    public function insert($file, array $data) {
+        // normalize file
+        $file = $this->normalize($file);
+
+        if (isset($this->partial[$file])) { //add any saved partial data
+            $data = array_merge($this->partial[$file]->getData(), $data);
+            unset($this->partial[$file]);
+        }
+
+        $requiredFields = ['size', 'mtime', 'mimetype'];
+        foreach ($requiredFields as $field) {
+            if (!isset($data[$field])) { //data not complete save as partial and return
+                $this->partial[$file] = new CacheEntry($data);
+                return -1;
+            }
+        }
+
+        $data['path'] = $file;
+        if (!isset($data['parent'])) {
+            $data['parent'] = $this->getParentId($file);
+        }
+        if ($data['parent'] === -1 && $file !== '') {
+            throw new \Exception('Parent folder not in filecache for ' . $file);
+        }
+        $data['name'] = basename($file);
+
+        [$values, $extensionValues] = $this->normalizeData($data);
+        $storageId = $this->getNumericStorageId();
+        $values['storage'] = $storageId;
+
+        try {
+            $builder = $this->connection->getQueryBuilder();
+            $builder->insert('filecache');
+
+            foreach ($values as $column => $value) {
+                $builder->setValue($column, $builder->createNamedParameter($value));
+            }
+
+            if ($builder->executeStatement()) {
+                $fileId = $builder->getLastInsertId();
+
+                if (count($extensionValues)) {
+                    $query = $this->getQueryBuilder();
+                    $query->insert('filecache_extended');
+                    $query->hintShardKey('storage', $storageId);
+
+                    $query->setValue('fileid', $query->createNamedParameter($fileId, IQueryBuilder::PARAM_INT));
+                    foreach ($extensionValues as $column => $value) {
+                        $query->setValue($column, $query->createNamedParameter($value));
+                    }
+                    $query->executeStatement();
+                }
+
+                $event = new CacheEntryInsertedEvent($this->storage, $file, $fileId, $storageId);
+                $this->eventDispatcher->dispatch(CacheInsertEvent::class, $event);
+                $this->eventDispatcher->dispatchTyped($event);
+                return $fileId;
+            }
+        } catch (Exception $e) {
+            if ($e->getReason() === Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                // entry exists already
+                if ($this->connection->inTransaction()) {
+                    $this->connection->commit();
+                    $this->connection->beginTransaction();
+                }
+            } else {
+                throw $e;
+            }
+        }
+
+        // The file was created in the meantime
+        if (($id = $this->getId($file)) > -1) {
+            $this->update($id, $data);
+            return $id;
+        } else {
+            throw new \RuntimeException('File entry could not be inserted but could also not be selected with getId() in order to perform an update. Please try again.');
+        }
+    }
+
+    /**
+     * update the metadata of an existing file or folder in the cache
+     *
+     * @param int $id the fileid of the existing file or folder
+     * @param array $data [$key => $value] the metadata to update, only the fields provided in the array will be updated, non-provided values will remain unchanged
+     */
+    public function update($id, array $data) {
+        if (isset($data['path'])) {
+            // normalize path
+            $data['path'] = $this->normalize($data['path']);
+        }
+
+        if (isset($data['name'])) {
+            // normalize path
+            $data['name'] = $this->normalize($data['name']);
+        }
+
+        [$values, $extensionValues] = $this->normalizeData($data);
+
+        if (count($values)) {
+            $query = $this->getQueryBuilder();
+
+            $query->update('filecache')
+                ->whereFileId($id)
+                ->whereStorageId($this->getNumericStorageId())
+                ->andWhere($query->expr()->orX(...array_map(function ($key, $value) use ($query) {
+                    return $query->expr()->orX(
+                        $query->expr()->neq($key, $query->createNamedParameter($value)),
+                        $query->expr()->isNull($key)
+                    );
+                }, array_keys($values), array_values($values))));
+
+            foreach ($values as $key => $value) {
+                $query->set($key, $query->createNamedParameter($value));
+            }
+
+            $query->executeStatement();
+        }
+
+        if (count($extensionValues)) {
+            try {
+                $query = $this->getQueryBuilder();
+                $query->insert('filecache_extended');
+                $query->hintShardKey('storage', $this->getNumericStorageId());
+
+                $query->setValue('fileid', $query->createNamedParameter($id, IQueryBuilder::PARAM_INT));
+                foreach ($extensionValues as $column => $value) {
+                    $query->setValue($column, $query->createNamedParameter($value));
+                }
+
+                $query->executeStatement();
+            } catch (Exception $e) {
+                if ($e->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                    throw $e;
+                }
+                $query = $this->getQueryBuilder();
+                $query->update('filecache_extended')
+                    ->whereFileId($id)
+                    ->hintShardKey('storage', $this->getNumericStorageId())
+                    ->andWhere($query->expr()->orX(...array_map(function ($key, $value) use ($query) {
+                        return $query->expr()->orX(
+                            $query->expr()->neq($key, $query->createNamedParameter($value)),
+                            $query->expr()->isNull($key)
+                        );
+                    }, array_keys($extensionValues), array_values($extensionValues))));
+
+                foreach ($extensionValues as $key => $value) {
+                    $query->set($key, $query->createNamedParameter($value));
+                }
+
+                $query->executeStatement();
+            }
+        }
+
+        $path = $this->getPathById($id);
+        // path can still be null if the file doesn't exist
+        if ($path !== null) {
+            $event = new CacheEntryUpdatedEvent($this->storage, $path, $id, $this->getNumericStorageId());
+            $this->eventDispatcher->dispatch(CacheUpdateEvent::class, $event);
+            $this->eventDispatcher->dispatchTyped($event);
+        }
+    }
+
+    /**
+     * extract query parts and params array from data array
+     *
+     * @param array $data
+     * @return array
+     */
+    protected function normalizeData(array $data): array {
+        $fields = [
+            'path', 'parent', 'name', 'mimetype', 'size', 'mtime', 'storage_mtime', 'encrypted',
+            'etag', 'permissions', 'checksum', 'storage', 'unencrypted_size'];
+        $extensionFields = ['metadata_etag', 'creation_time', 'upload_time'];
+
+        $doNotCopyStorageMTime = false;
+        if (array_key_exists('mtime', $data) && $data['mtime'] === null) {
+            // this horrific magic tells it to not copy storage_mtime to mtime
+            unset($data['mtime']);
+            $doNotCopyStorageMTime = true;
+        }
+
+        $params = [];
+        $extensionParams = [];
+        foreach ($data as $name => $value) {
+            if (in_array($name, $fields)) {
+                if ($name === 'path') {
+                    $params['path_hash'] = md5($value);
+                } elseif ($name === 'mimetype') {
+                    $params['mimepart'] = $this->mimetypeLoader->getId(substr($value, 0, strpos($value, '/')));
+                    $value = $this->mimetypeLoader->getId($value);
+                } elseif ($name === 'storage_mtime') {
+                    if (!$doNotCopyStorageMTime && !isset($data['mtime'])) {
+                        $params['mtime'] = $value;
+                    }
+                } elseif ($name === 'encrypted') {
+                    if (isset($data['encryptedVersion'])) {
+                        $value = $data['encryptedVersion'];
+                    } else {
+                        // Boolean to integer conversion
+                        $value = $value ? 1 : 0;
+                    }
+                }
+                $params[$name] = $value;
+            }
+            if (in_array($name, $extensionFields)) {
+                $extensionParams[$name] = $value;
+            }
+        }
+        return [$params, array_filter($extensionParams)];
+    }
+
+    /**
+     * get the file id for a file
+     *
+     * A file id is a numeric id for a file or folder that's unique within an owncloud instance which stays the same for the lifetime of a file
+     *
+     * File ids are easiest way for apps to store references to a file since unlike paths they are not affected by renames or sharing
+     *
+     * @param string $file
+     * @return int
+     */
+    public function getId($file) {
+        // normalize file
+        $file = $this->normalize($file);
+
+        $query = $this->getQueryBuilder();
+        $query->select('fileid')
+            ->from('filecache')
+            ->whereStorageId($this->getNumericStorageId())
+            ->wherePath($file);
+
+        $result = $query->executeQuery();
+        $id = $result->fetchOne();
+        $result->closeCursor();
+
+        return $id === false ? -1 : (int)$id;
+    }
+
+    /**
+     * get the id of the parent folder of a file
+     *
+     * @param string $file
+     * @return int
+     */
+    public function getParentId($file) {
+        if ($file === '') {
+            return -1;
+        } else {
+            $parent = $this->getParentPath($file);
+            return (int)$this->getId($parent);
+        }
+    }
+
+    private function getParentPath($path) {
+        $parent = dirname($path);
+        if ($parent === '.') {
+            $parent = '';
+        }
+        return $parent;
+    }
+
+    /**
+     * check if a file is available in the cache
+     *
+     * @param string $file
+     * @return bool
+     */
+    public function inCache($file) {
+        return $this->getId($file) != -1;
+    }
+
+    /**
+     * remove a file or folder from the cache
+     *
+     * when removing a folder from the cache all files and folders inside the folder will be removed as well
+     *
+     * @param string $file
+     */
+    public function remove($file) {
+        $entry = $this->get($file);
+
+        if ($entry instanceof ICacheEntry) {
+            $query = $this->getQueryBuilder();
+            $query->delete('filecache')
+                ->whereStorageId($this->getNumericStorageId())
+                ->whereFileId($entry->getId());
+            $query->executeStatement();
+
+            $query = $this->getQueryBuilder();
+            $query->delete('filecache_extended')
+                ->whereFileId($entry->getId())
+                ->hintShardKey('storage', $this->getNumericStorageId());
+            $query->executeStatement();
+
+            if ($entry->getMimeType() == FileInfo::MIMETYPE_FOLDER) {
+                $this->removeChildren($entry);
+            }
+
+            $this->eventDispatcher->dispatchTyped(new CacheEntryRemovedEvent($this->storage, $entry->getPath(), $entry->getId(), $this->getNumericStorageId()));
+        }
+    }
+
+    /**
+     * Remove all children of a folder
+     *
+     * @param ICacheEntry $entry the cache entry of the folder to remove the children of
+     * @throws \OC\DatabaseException
+     */
+    private function removeChildren(ICacheEntry $entry) {
+        $parentIds = [$entry->getId()];
+        $queue = [$entry->getId()];
+        $deletedIds = [];
+        $deletedPaths = [];
+
+        // we walk depth first through the file tree, removing all filecache_extended attributes while we walk
+        // and collecting all folder ids to later use to delete the filecache entries
+        while ($entryId = array_pop($queue)) {
+            $children = $this->getFolderContentsById($entryId);
+            $childIds = array_map(function (ICacheEntry $cacheEntry) {
+                return $cacheEntry->getId();
+            }, $children);
+            $childPaths = array_map(function (ICacheEntry $cacheEntry) {
+                return $cacheEntry->getPath();
+            }, $children);
+
+            foreach ($childIds as $childId) {
+                $deletedIds[] = $childId;
+            }
+
+            foreach ($childPaths as $childPath) {
+                $deletedPaths[] = $childPath;
+            }
+
+            $query = $this->getQueryBuilder();
+            $query->delete('filecache_extended')
+                ->where($query->expr()->in('fileid', $query->createParameter('childIds')))
+                ->hintShardKey('storage', $this->getNumericStorageId());
+
+            foreach (array_chunk($childIds, 1000) as $childIdChunk) {
+                $query->setParameter('childIds', $childIdChunk, IQueryBuilder::PARAM_INT_ARRAY);
+                $query->executeStatement();
+            }
+
+            /** @var ICacheEntry[] $childFolders */
+            $childFolders = [];
+            foreach ($children as $child) {
+                if ($child->getMimeType() == FileInfo::MIMETYPE_FOLDER) {
+                    $childFolders[] = $child;
+                }
+            }
+            foreach ($childFolders as $folder) {
+                $parentIds[] = $folder->getId();
+                $queue[] = $folder->getId();
+            }
+        }
+
+        $query = $this->getQueryBuilder();
+        $query->delete('filecache')
+            ->whereStorageId($this->getNumericStorageId())
+            ->whereParentInParameter('parentIds');
+
+        // Sorting before chunking allows the db to find the entries close to each
+        // other in the index
+        sort($parentIds, SORT_NUMERIC);
+        foreach (array_chunk($parentIds, 1000) as $parentIdChunk) {
+            $query->setParameter('parentIds', $parentIdChunk, IQueryBuilder::PARAM_INT_ARRAY);
+            $query->executeStatement();
+        }
+
+        foreach (array_combine($deletedIds, $deletedPaths) as $fileId => $filePath) {
+            $cacheEntryRemovedEvent = new CacheEntryRemovedEvent(
+                $this->storage,
+                $filePath,
+                $fileId,
+                $this->getNumericStorageId()
+            );
+            $this->eventDispatcher->dispatchTyped($cacheEntryRemovedEvent);
+        }
+    }
+
+    /**
+     * Move a file or folder in the cache
+     *
+     * @param string $source
+     * @param string $target
+     */
+    public function move($source, $target) {
+        $this->moveFromCache($this, $source, $target);
+    }
+
+    /**
+     * Get the storage id and path needed for a move
+     *
+     * @param string $path
+     * @return array [$storageId, $internalPath]
+     */
+    protected function getMoveInfo($path) {
+        return [$this->getNumericStorageId(), $path];
+    }
+
+    protected function hasEncryptionWrapper(): bool {
+        return $this->storage->instanceOfStorage(Encryption::class);
+    }
+
+    protected function shouldEncrypt(string $targetPath): bool {
+        if (!$this->storage->instanceOfStorage(Encryption::class)) {
+            return false;
+        }
+        return $this->storage->shouldEncrypt($targetPath);
+    }
+
+    /**
+     * Move a file or folder in the cache
+     *
+     * @param ICache $sourceCache
+     * @param string $sourcePath
+     * @param string $targetPath
+     * @throws \OC\DatabaseException
+     * @throws \Exception if the given storages have an invalid id
+     */
+    public function moveFromCache(ICache $sourceCache, $sourcePath, $targetPath) {
+        if ($sourceCache instanceof Cache) {
+            // normalize source and target
+            $sourcePath = $this->normalize($sourcePath);
+            $targetPath = $this->normalize($targetPath);
+
+            $sourceData = $sourceCache->get($sourcePath);
+            if (!$sourceData) {
+                throw new \Exception('Source path not found in cache: ' . $sourcePath);
+            }
+
+            $shardDefinition = $this->connection->getShardDefinition('filecache');
+            if (
+                $shardDefinition
+                && $shardDefinition->getShardForKey($sourceCache->getNumericStorageId()) !== $shardDefinition->getShardForKey($this->getNumericStorageId())
+            ) {
+                $this->moveFromStorageSharded($shardDefinition, $sourceCache, $sourceData, $targetPath);
+                return;
+            }
+
+            $sourceId = $sourceData['fileid'];
+            $newParentId = $this->getParentId($targetPath);
+
+            [$sourceStorageId, $sourcePath] = $sourceCache->getMoveInfo($sourcePath);
+            [$targetStorageId, $targetPath] = $this->getMoveInfo($targetPath);
+
+            if (is_null($sourceStorageId) || $sourceStorageId === false) {
+                throw new \Exception('Invalid source storage id: ' . $sourceStorageId);
+            }
+            if (is_null($targetStorageId) || $targetStorageId === false) {
+                throw new \Exception('Invalid target storage id: ' . $targetStorageId);
+            }
+
+            if ($sourceData['mimetype'] === 'httpd/unix-directory') {
+                //update all child entries
+                $sourceLength = mb_strlen($sourcePath);
+
+                $childIds = $this->getChildIds($sourceStorageId, $sourcePath);
+
+                $childChunks = array_chunk($childIds, 1000);
+
+                $query = $this->getQueryBuilder();
+
+                $fun = $query->func();
+                $newPathFunction = $fun->concat(
+                    $query->createNamedParameter($targetPath),
+                    $fun->substring('path', $query->createNamedParameter($sourceLength + 1, IQueryBuilder::PARAM_INT))// +1 for the leading slash
+                );
+                $query->update('filecache')
+                    ->set('path_hash', $fun->md5($newPathFunction))
+                    ->set('path', $newPathFunction)
+                    ->whereStorageId($sourceStorageId)
+                    ->andWhere($query->expr()->in('fileid', $query->createParameter('files')));
+
+                if ($sourceStorageId !== $targetStorageId) {
+                    $query->set('storage', $query->createNamedParameter($targetStorageId), IQueryBuilder::PARAM_INT);
+                }
+
+                // when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
+                if ($sourceCache->hasEncryptionWrapper() && !$this->hasEncryptionWrapper()) {
+                    $query->set('encrypted', $query->createNamedParameter(0, IQueryBuilder::PARAM_INT));
+                }
+
+                // Retry transaction in case of RetryableException like deadlocks.
+                // Retry up to 4 times because we should receive up to 4 concurrent requests from the frontend
+                $retryLimit = 4;
+                for ($i = 1; $i <= $retryLimit; $i++) {
+                    try {
+                        $this->connection->beginTransaction();
+                        foreach ($childChunks as $chunk) {
+                            $query->setParameter('files', $chunk, IQueryBuilder::PARAM_INT_ARRAY);
+                            $query->executeStatement();
+                        }
+                        break;
+                    } catch (\OC\DatabaseException $e) {
+                        $this->connection->rollBack();
+                        throw $e;
+                    } catch (DbalException $e) {
+                        $this->connection->rollBack();
+
+                        if (!$e->isRetryable()) {
+                            throw $e;
+                        }
+
+                        // Simply throw if we already retried 4 times.
+                        if ($i === $retryLimit) {
+                            throw $e;
+                        }
+
+                        // Sleep a bit to give some time to the other transaction to finish.
+                        usleep(100 * 1000 * $i);
+                    }
+                }
+            } else {
+                $this->connection->beginTransaction();
+            }
+
+            $query = $this->getQueryBuilder();
+            $query->update('filecache')
+                ->set('path', $query->createNamedParameter($targetPath))
+                ->set('path_hash', $query->createNamedParameter(md5($targetPath)))
+                ->set('name', $query->createNamedParameter(basename($targetPath)))
+                ->set('parent', $query->createNamedParameter($newParentId, IQueryBuilder::PARAM_INT))
+                ->whereStorageId($sourceStorageId)
+                ->whereFileId($sourceId);
+
+            if ($sourceStorageId !== $targetStorageId) {
+                $query->set('storage', $query->createNamedParameter($targetStorageId), IQueryBuilder::PARAM_INT);
+            }
+
+            // when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
+            if ($sourceCache->hasEncryptionWrapper() && !$this->hasEncryptionWrapper()) {
+                $query->set('encrypted', $query->createNamedParameter(0, IQueryBuilder::PARAM_INT));
+            }
+
+            $query->executeStatement();
+
+            $this->connection->commit();
+
+            if ($sourceCache->getNumericStorageId() !== $this->getNumericStorageId()) {
+                $this->eventDispatcher->dispatchTyped(new CacheEntryRemovedEvent($this->storage, $sourcePath, $sourceId, $sourceCache->getNumericStorageId()));
+                $event = new CacheEntryInsertedEvent($this->storage, $targetPath, $sourceId, $this->getNumericStorageId());
+                $this->eventDispatcher->dispatch(CacheInsertEvent::class, $event);
+                $this->eventDispatcher->dispatchTyped($event);
+            } else {
+                $event = new CacheEntryUpdatedEvent($this->storage, $targetPath, $sourceId, $this->getNumericStorageId());
+                $this->eventDispatcher->dispatch(CacheUpdateEvent::class, $event);
+                $this->eventDispatcher->dispatchTyped($event);
+            }
+        } else {
+            $this->moveFromCacheFallback($sourceCache, $sourcePath, $targetPath);
+        }
+    }
+
+    private function getChildIds(int $storageId, string $path): array {
+        $query = $this->connection->getQueryBuilder();
+        $query->select('fileid')
+            ->from('filecache')
+            ->where($query->expr()->eq('storage', $query->createNamedParameter($storageId, IQueryBuilder::PARAM_INT)))
+            ->andWhere($query->expr()->like('path', $query->createNamedParameter($this->connection->escapeLikeParameter($path) . '/%')));
+        return $query->executeQuery()->fetchAll(\PDO::FETCH_COLUMN);
+    }
+
+    /**
+     * remove all entries for files that are stored on the storage from the cache
+     */
+    public function clear() {
+        $query = $this->getQueryBuilder();
+        $query->delete('filecache')
+            ->whereStorageId($this->getNumericStorageId());
+        $query->executeStatement();
+
+        $query = $this->connection->getQueryBuilder();
+        $query->delete('storages')
+            ->where($query->expr()->eq('id', $query->createNamedParameter($this->storageId)));
+        $query->executeStatement();
+    }
+
+    /**
+     * Get the scan status of a file
+     *
+     * - Cache::NOT_FOUND: File is not in the cache
+     * - Cache::PARTIAL: File is not stored in the cache but some incomplete data is known
+     * - Cache::SHALLOW: The folder and it's direct children are in the cache but not all sub folders are fully scanned
+     * - Cache::COMPLETE: The file or folder, with all it's children) are fully scanned
+     *
+     * @param string $file
+     *
+     * @return int Cache::NOT_FOUND, Cache::PARTIAL, Cache::SHALLOW or Cache::COMPLETE
+     */
+    public function getStatus($file) {
+        // normalize file
+        $file = $this->normalize($file);
+
+        $query = $this->getQueryBuilder();
+        $query->select('size')
+            ->from('filecache')
+            ->whereStorageId($this->getNumericStorageId())
+            ->wherePath($file);
+
+        $result = $query->executeQuery();
+        $size = $result->fetchOne();
+        $result->closeCursor();
+
+        if ($size !== false) {
+            if ((int)$size === -1) {
+                return self::SHALLOW;
+            } else {
+                return self::COMPLETE;
+            }
+        } else {
+            if (isset($this->partial[$file])) {
+                return self::PARTIAL;
+            } else {
+                return self::NOT_FOUND;
+            }
+        }
+    }
+
+    /**
+     * search for files matching $pattern
+     *
+     * @param string $pattern the search pattern using SQL search syntax (e.g. '%searchstring%')
+     * @return ICacheEntry[] an array of cache entries where the name matches the search pattern
+     */
+    public function search($pattern) {
+        $operator = new SearchComparison(ISearchComparison::COMPARE_LIKE, 'name', $pattern);
+        return $this->searchQuery(new SearchQuery($operator, 0, 0, [], null));
+    }
+
+    /**
+     * search for files by mimetype
+     *
+     * @param string $mimetype either a full mimetype to search ('text/plain') or only the first part of a mimetype ('image')
+     *                         where it will search for all mimetypes in the group ('image/*')
+     * @return ICacheEntry[] an array of cache entries where the mimetype matches the search
+     */
+    public function searchByMime($mimetype) {
+        if (!str_contains($mimetype, '/')) {
+            $operator = new SearchComparison(ISearchComparison::COMPARE_LIKE, 'mimetype', $mimetype . '/%');
+        } else {
+            $operator = new SearchComparison(ISearchComparison::COMPARE_EQUAL, 'mimetype', $mimetype);
+        }
+        return $this->searchQuery(new SearchQuery($operator, 0, 0, [], null));
+    }
+
+    public function searchQuery(ISearchQuery $query) {
+        return current($this->querySearchHelper->searchInCaches($query, [$this]));
+    }
+
+    /**
+     * Re-calculate the folder size and the size of all parent folders
+     *
+     * @param array|ICacheEntry|null $data (optional) meta data of the folder
+     */
+    public function correctFolderSize(string $path, $data = null, bool $isBackgroundScan = false): void {
+        $this->calculateFolderSize($path, $data);
+
+        if ($path !== '') {
+            $parent = dirname($path);
+            if ($parent === '.' || $parent === '/') {
+                $parent = '';
+            }
+
+            if ($isBackgroundScan) {
+                $parentData = $this->get($parent);
+                if ($parentData !== false
+                    && $parentData['size'] !== -1
+                    && $this->getIncompleteChildrenCount($parentData['fileid']) === 0
+                ) {
+                    $this->correctFolderSize($parent, $parentData, $isBackgroundScan);
+                }
+            } else {
+                $this->correctFolderSize($parent);
+            }
+        }
+    }
+
+    /**
+     * get the incomplete count that shares parent $folder
+     *
+     * @param int $fileId the file id of the folder
+     * @return int
+     */
+    public function getIncompleteChildrenCount($fileId) {
+        if ($fileId > -1) {
+            $query = $this->getQueryBuilder();
+            $query->select($query->func()->count())
+                ->from('filecache')
+                ->whereParent($fileId)
+                ->whereStorageId($this->getNumericStorageId())
+                ->andWhere($query->expr()->eq('size', $query->createNamedParameter(-1, IQueryBuilder::PARAM_INT)));
+
+            $result = $query->executeQuery();
+            $size = (int)$result->fetchOne();
+            $result->closeCursor();
+
+            return $size;
+        }
+        return -1;
+    }
+
+    /**
+     * calculate the size of a folder and set it in the cache
+     *
+     * @param string $path
+     * @param array|null|ICacheEntry $entry (optional) meta data of the folder
+     * @return int|float
+     */
+    public function calculateFolderSize($path, $entry = null) {
+        return $this->calculateFolderSizeInner($path, $entry);
+    }
+
+
+    /**
+     * inner function because we can't add new params to the public function without breaking any child classes
+     *
+     * @param string $path
+     * @param array|null|ICacheEntry $entry (optional) meta data of the folder
+     * @param bool $ignoreUnknown don't mark the folder size as unknown if any of it's children are unknown
+     * @return int|float
+     */
+    protected function calculateFolderSizeInner(string $path, $entry = null, bool $ignoreUnknown = false) {
+        $totalSize = 0;
+        if (is_null($entry) || !isset($entry['fileid'])) {
+            $entry = $this->get($path);
+        }
+        if (isset($entry['mimetype']) && $entry['mimetype'] === FileInfo::MIMETYPE_FOLDER) {
+            $id = $entry['fileid'];
+
+            $query = $this->getQueryBuilder();
+            $query->select('size', 'unencrypted_size')
+                ->from('filecache')
+                ->whereStorageId($this->getNumericStorageId())
+                ->whereParent($id);
+            if ($ignoreUnknown) {
+                $query->andWhere($query->expr()->gte('size', $query->createNamedParameter(0)));
+            }
+
+            $result = $query->executeQuery();
+            $rows = $result->fetchAll();
+            $result->closeCursor();
+
+            if ($rows) {
+                $sizes = array_map(function (array $row) {
+                    return Util::numericToNumber($row['size']);
+                }, $rows);
+                $unencryptedOnlySizes = array_map(function (array $row) {
+                    return Util::numericToNumber($row['unencrypted_size']);
+                }, $rows);
+                $unencryptedSizes = array_map(function (array $row) {
+                    return Util::numericToNumber(($row['unencrypted_size'] > 0) ? $row['unencrypted_size'] : $row['size']);
+                }, $rows);
+
+                $sum = array_sum($sizes);
+                $min = min($sizes);
+
+                $unencryptedSum = array_sum($unencryptedSizes);
+                $unencryptedMin = min($unencryptedSizes);
+                $unencryptedMax = max($unencryptedOnlySizes);
+
+                $sum = 0 + $sum;
+                $min = 0 + $min;
+                if ($min === -1) {
+                    $totalSize = $min;
+                } else {
+                    $totalSize = $sum;
+                }
+                if ($unencryptedMin === -1 || $min === -1) {
+                    $unencryptedTotal = $unencryptedMin;
+                } else {
+                    $unencryptedTotal = $unencryptedSum;
+                }
+            } else {
+                $totalSize = 0;
+                $unencryptedTotal = 0;
+                $unencryptedMax = 0;
+            }
+
+            // only set unencrypted size for a folder if any child entries have it set, or the folder is empty
+            $shouldWriteUnEncryptedSize = $unencryptedMax > 0 || $totalSize === 0 || ($entry['unencrypted_size'] ?? 0) > 0;
+            if ($entry['size'] !== $totalSize || (($entry['unencrypted_size'] ?? 0) !== $unencryptedTotal && $shouldWriteUnEncryptedSize)) {
+                if ($shouldWriteUnEncryptedSize) {
+                    // if all children have an unencrypted size of 0, just set the folder unencrypted size to 0 instead of summing the sizes
+                    if ($unencryptedMax === 0) {
+                        $unencryptedTotal = 0;
+                    }
+
+                    $this->update($id, [
+                        'size' => $totalSize,
+                        'unencrypted_size' => $unencryptedTotal,
+                    ]);
+                } else {
+                    $this->update($id, [
+                        'size' => $totalSize,
+                    ]);
+                }
+            }
+        }
+        return $totalSize;
+    }
+
+    /**
+     * get all file ids on the files on the storage
+     *
+     * @return int[]
+     */
+    public function getAll() {
+        $query = $this->getQueryBuilder();
+        $query->select('fileid')
+            ->from('filecache')
+            ->whereStorageId($this->getNumericStorageId());
+
+        $result = $query->executeQuery();
+        $files = $result->fetchAll(\PDO::FETCH_COLUMN);
+        $result->closeCursor();
+
+        return array_map(function ($id) {
+            return (int)$id;
+        }, $files);
+    }
+
+    /**
+     * find a folder in the cache which has not been fully scanned
+     *
+     * If multiple incomplete folders are in the cache, the one with the highest id will be returned,
+     * use the one with the highest id gives the best result with the background scanner, since that is most
+     * likely the folder where we stopped scanning previously
+     *
+     * @return string|false the path of the folder or false when no folder matched
+     */
+    public function getIncomplete() {
+        $query = $this->getQueryBuilder();
+        $query->select('path')
+            ->from('filecache')
+            ->whereStorageId($this->getNumericStorageId())
+            ->andWhere($query->expr()->eq('size', $query->createNamedParameter(-1, IQueryBuilder::PARAM_INT)))
+            ->orderBy('fileid', 'DESC')
+            ->setMaxResults(1);
+
+        $result = $query->executeQuery();
+        $path = $result->fetchOne();
+        $result->closeCursor();
+
+        return $path === false ? false : (string)$path;
+    }
+
+    /**
+     * get the path of a file on this storage by it's file id
+     *
+     * @param int $id the file id of the file or folder to search
+     * @return string|null the path of the file (relative to the storage) or null if a file with the given id does not exists within this cache
+     */
+    public function getPathById($id) {
+        $query = $this->getQueryBuilder();
+        $query->select('path')
+            ->from('filecache')
+            ->whereStorageId($this->getNumericStorageId())
+            ->whereFileId($id);
+
+        $result = $query->executeQuery();
+        $path = $result->fetchOne();
+        $result->closeCursor();
+
+        if ($path === false) {
+            return null;
+        }
+
+        return (string)$path;
+    }
+
+    /**
+     * get the storage id of the storage for a file and the internal path of the file
+     * unlike getPathById this does not limit the search to files on this storage and
+     * instead does a global search in the cache table
+     *
+     * @param int $id
+     * @return array first element holding the storage id, second the path
+     * @deprecated 17.0.0 use getPathById() instead
+     */
+    public static function getById($id) {
+        $query = \OC::$server->getDatabaseConnection()->getQueryBuilder();
+        $query->select('path', 'storage')
+            ->from('filecache')
+            ->where($query->expr()->eq('fileid', $query->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
+
+        $result = $query->executeQuery();
+        $row = $result->fetch();
+        $result->closeCursor();
+
+        if ($row) {
+            $numericId = $row['storage'];
+            $path = $row['path'];
+        } else {
+            return null;
+        }
+
+        if ($id = Storage::getStorageId($numericId)) {
+            return [$id, $path];
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * normalize the given path
+     *
+     * @param string $path
+     * @return string
+     */
+    public function normalize($path) {
+        return trim(\OC_Util::normalizeUnicode($path), '/');
+    }
+
+    /**
+     * Copy a file or folder in the cache
+     *
+     * @param ICache $sourceCache
+     * @param ICacheEntry $sourceEntry
+     * @param string $targetPath
+     * @return int fileId of copied entry
+     */
+    public function copyFromCache(ICache $sourceCache, ICacheEntry $sourceEntry, string $targetPath): int {
+        if ($sourceEntry->getId() < 0) {
+            throw new \RuntimeException('Invalid source cache entry on copyFromCache');
+        }
+        $data = $this->cacheEntryToArray($sourceEntry);
+
+        // when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
+        if ($sourceCache instanceof Cache
+            && $sourceCache->hasEncryptionWrapper()
+            && !$this->shouldEncrypt($targetPath)) {
+            $data['encrypted'] = 0;
+        }
+
+        $fileId = $this->put($targetPath, $data);
+        if ($fileId <= 0) {
+            throw new \RuntimeException('Failed to copy to ' . $targetPath . ' from cache with source data ' . json_encode($data) . ' ');
+        }
+        if ($sourceEntry->getMimeType() === ICacheEntry::DIRECTORY_MIMETYPE) {
+            $folderContent = $sourceCache->getFolderContentsById($sourceEntry->getId());
+            foreach ($folderContent as $subEntry) {
+                $subTargetPath = $targetPath . '/' . $subEntry->getName();
+                $this->copyFromCache($sourceCache, $subEntry, $subTargetPath);
+            }
+        }
+        return $fileId;
+    }
+
+    private function cacheEntryToArray(ICacheEntry $entry): array {
+        $data = [
+            'size' => $entry->getSize(),
+            'mtime' => $entry->getMTime(),
+            'storage_mtime' => $entry->getStorageMTime(),
+            'mimetype' => $entry->getMimeType(),
+            'mimepart' => $entry->getMimePart(),
+            'etag' => $entry->getEtag(),
+            'permissions' => $entry->getPermissions(),
+            'encrypted' => $entry->isEncrypted(),
+            'creation_time' => $entry->getCreationTime(),
+            'upload_time' => $entry->getUploadTime(),
+            'metadata_etag' => $entry->getMetadataEtag(),
+        ];
+        if ($entry instanceof CacheEntry && isset($entry['scan_permissions'])) {
+            $data['permissions'] = $entry['scan_permissions'];
+        }
+        return $data;
+    }
+
+    public function getQueryFilterForStorage(): ISearchOperator {
+        return new SearchComparison(ISearchComparison::COMPARE_EQUAL, 'storage', $this->getNumericStorageId());
+    }
+
+    public function getCacheEntryFromSearchResult(ICacheEntry $rawEntry): ?ICacheEntry {
+        if ($rawEntry->getStorageId() === $this->getNumericStorageId()) {
+            return $rawEntry;
+        } else {
+            return null;
+        }
+    }
+
+    private function moveFromStorageSharded(ShardDefinition $shardDefinition, ICache $sourceCache, ICacheEntry $sourceEntry, $targetPath): void {
+        $sourcePath = $sourceEntry->getPath();
+        while ($sourceCache instanceof CacheWrapper) {
+            if ($sourceCache instanceof CacheJail) {
+                $sourcePath = $sourceCache->getSourcePath($sourcePath);
+            }
+            $sourceCache = $sourceCache->getCache();
+        }
+
+        if ($sourceEntry->getMimeType() === ICacheEntry::DIRECTORY_MIMETYPE) {
+            $fileIds = $this->getChildIds($sourceCache->getNumericStorageId(), $sourcePath);
+        } else {
+            $fileIds = [];
+        }
+        $fileIds[] = $sourceEntry->getId();
+
+        $helper = $this->connection->getCrossShardMoveHelper();
+
+        $sourceConnection = $helper->getConnection($shardDefinition, $sourceCache->getNumericStorageId());
+        $targetConnection = $helper->getConnection($shardDefinition, $this->getNumericStorageId());
+
+        $cacheItems = $helper->loadItems($sourceConnection, 'filecache', 'fileid', $fileIds);
+        $extendedItems = $helper->loadItems($sourceConnection, 'filecache_extended', 'fileid', $fileIds);
+        $metadataItems = $helper->loadItems($sourceConnection, 'files_metadata', 'file_id', $fileIds);
+
+        // when moving from an encrypted storage to a non-encrypted storage remove the `encrypted` mark
+        $removeEncryptedFlag = ($sourceCache instanceof Cache && $sourceCache->hasEncryptionWrapper()) && !$this->hasEncryptionWrapper();
+
+        $sourcePathLength = strlen($sourcePath);
+        foreach ($cacheItems as &$cacheItem) {
+            if ($cacheItem['path'] === $sourcePath) {
+                $cacheItem['path'] = $targetPath;
+                $cacheItem['parent'] = $this->getParentId($targetPath);
+                $cacheItem['name'] = basename($cacheItem['path']);
+            } else {
+                $cacheItem['path'] = $targetPath . '/' . substr($cacheItem['path'], $sourcePathLength + 1); // +1 for the leading slash
+            }
+            $cacheItem['path_hash'] = md5($cacheItem['path']);
+            $cacheItem['storage'] = $this->getNumericStorageId();
+            if ($removeEncryptedFlag) {
+                $cacheItem['encrypted'] = 0;
+            }
+        }
+
+        $targetConnection->beginTransaction();
+
+        try {
+            $helper->saveItems($targetConnection, 'filecache', $cacheItems);
+            $helper->saveItems($targetConnection, 'filecache_extended', $extendedItems);
+            $helper->saveItems($targetConnection, 'files_metadata', $metadataItems);
+        } catch (\Exception $e) {
+            $targetConnection->rollback();
+            throw $e;
+        }
+
+        $sourceConnection->beginTransaction();
+
+        try {
+            $helper->deleteItems($sourceConnection, 'filecache', 'fileid', $fileIds);
+            $helper->deleteItems($sourceConnection, 'filecache_extended', 'fileid', $fileIds);
+            $helper->deleteItems($sourceConnection, 'files_metadata', 'file_id', $fileIds);
+        } catch (\Exception $e) {
+            $targetConnection->rollback();
+            $sourceConnection->rollBack();
+            throw $e;
+        }
+
+        try {
+            $sourceConnection->commit();
+        } catch (\Exception $e) {
+            $targetConnection->rollback();
+            throw $e;
+        }
+        $targetConnection->commit();
+    }
 }

apps/encryption/lib/KeyManager.php

Indentation +664 added lines, -664 removed lines

@@ -20,668 +20,668 @@
 use Psr\Log\LoggerInterface;
 
 class KeyManager {
-	private string $recoveryKeyId;
-	private string $publicShareKeyId;
-	private string $masterKeyId;
-	private ?string $keyUid;
-	private string $publicKeyId = 'publicKey';
-	private string $privateKeyId = 'privateKey';
-	private string $shareKeyId = 'shareKey';
-	private string $fileKeyId = 'fileKey';
-
-	public function __construct(
-		private IStorage $keyStorage,
-		private Crypt $crypt,
-		private IConfig $config,
-		IUserSession $userSession,
-		private Session $session,
-		private LoggerInterface $logger,
-		private Util $util,
-		private ILockingProvider $lockingProvider,
-	) {
-		$this->recoveryKeyId = $this->config->getAppValue('encryption',
-			'recoveryKeyId');
-		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5((string)time()), 0, 8);
-			$this->config->setAppValue('encryption',
-				'recoveryKeyId',
-				$this->recoveryKeyId);
-		}
-
-		$this->publicShareKeyId = $this->config->getAppValue('encryption',
-			'publicShareKeyId');
-		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5((string)time()), 0, 8);
-			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
-		}
-
-		$this->masterKeyId = $this->config->getAppValue('encryption',
-			'masterKeyId');
-		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5((string)time()), 0, 8);
-			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
-		}
-
-		$this->keyUid = $userSession->isLoggedIn() ? $userSession->getUser()?->getUID() : null;
-	}
-
-	/**
-	 * check if key pair for public link shares exists, if not we create one
-	 */
-	public function validateShareKey() {
-		$shareKey = $this->getPublicShareKey();
-		if (empty($shareKey)) {
-			$this->lockingProvider->acquireLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: shared key generation');
-			try {
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyStorage->setSystemUserKey(
-					$this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
-					Encryption::ID);
-
-				// Encrypt private key empty passphrase
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
-				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
-			} catch (\Throwable $e) {
-				$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
-				throw $e;
-			}
-			$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
-		}
-	}
-
-	/**
-	 * check if a key pair for the master key exists, if not we create one
-	 */
-	public function validateMasterKey() {
-		if ($this->util->isMasterKeyEnabled() === false) {
-			return;
-		}
-
-		$publicMasterKey = $this->getPublicMasterKey();
-		$privateMasterKey = $this->getPrivateMasterKey();
-
-		if (empty($publicMasterKey) && empty($privateMasterKey)) {
-			// There could be a race condition here if two requests would trigger
-			// the generation the second one would enter the key generation as long
-			// as the first one didn't write the key to the keystorage yet
-			$this->lockingProvider->acquireLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: master key generation');
-			try {
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyStorage->setSystemUserKey(
-					$this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
-					Encryption::ID);
-
-				// Encrypt private key with system password
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
-				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
-			} catch (\Throwable $e) {
-				$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
-				throw $e;
-			}
-			$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
-		} elseif (empty($publicMasterKey)) {
-			$this->logger->error('A private master key is available but the public key could not be found. This should never happen.');
-			return;
-		} elseif (empty($privateMasterKey)) {
-			$this->logger->error('A public master key is available but the private key could not be found. This should never happen.');
-			return;
-		}
-
-		if (!$this->session->isPrivateKeySet()) {
-			$masterKey = $this->getSystemPrivateKey($this->masterKeyId);
-			$decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
-			if ($decryptedMasterKey === false) {
-				$this->logger->error('A public master key is available but decrypting it failed. This should never happen.');
-			} else {
-				$this->session->setPrivateKey($decryptedMasterKey);
-			}
-		}
-
-		// after the encryption key is available we are ready to go
-		$this->session->setStatus(Session::INIT_SUCCESSFUL);
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function recoveryKeyExists() {
-		$key = $this->getRecoveryKey();
-		return !empty($key);
-	}
-
-	/**
-	 * get recovery key
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * get recovery key ID
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKeyId() {
-		return $this->recoveryKeyId;
-	}
-
-	/**
-	 * @param string $password
-	 * @return bool
-	 */
-	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
-		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
-
-		if ($decryptedRecoveryKey) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function storeKeyPair($uid, $password, $keyPair) {
-		// Save Public Key
-		$this->setPublicKey($uid, $keyPair['publicKey']);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
-
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function setRecoveryKey($password, $keyPair) {
-		// Save Public Key
-		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId()
-			. '.' . $this->publicKeyId,
-			$keyPair['publicKey'],
-			Encryption::ID);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @param $key
-	 * @return bool
-	 */
-	public function setPublicKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * @param $userId
-	 * @param string $key
-	 * @return bool
-	 */
-	public function setPrivateKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId,
-			$this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * write file key to key storage
-	 *
-	 * @param string $path
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setFileKey($path, $key) {
-		return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * set all file keys (the file key and the corresponding share keys)
-	 *
-	 * @param string $path
-	 * @param array $keys
-	 */
-	public function setAllFileKeys($path, $keys) {
-		$this->setFileKey($path, $keys['data']);
-		foreach ($keys['keys'] as $uid => $keyFile) {
-			$this->setShareKey($path, $uid, $keyFile);
-		}
-	}
-
-	/**
-	 * write share key to the key storage
-	 *
-	 * @param string $path
-	 * @param string $uid
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * Decrypt private key and store it
-	 *
-	 * @return boolean
-	 */
-	public function init(string $uid, ?string $passPhrase) {
-		$this->session->setStatus(Session::INIT_EXECUTED);
-
-		try {
-			if ($this->util->isMasterKeyEnabled()) {
-				$uid = $this->getMasterKeyId();
-				$passPhrase = $this->getMasterKeyPassword();
-				$privateKey = $this->getSystemPrivateKey($uid);
-			} else {
-				if ($passPhrase === null) {
-					$this->logger->warning('Master key is disabled but not passphrase provided.');
-					return false;
-				}
-				$privateKey = $this->getPrivateKey($uid);
-			}
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
-		} catch (PrivateKeyMissingException $e) {
-			return false;
-		} catch (DecryptionFailedException $e) {
-			return false;
-		} catch (\Exception $e) {
-			$this->logger->warning(
-				'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
-				[
-					'app' => 'encryption',
-					'exception' => $e,
-				]
-			);
-			return false;
-		}
-
-		if ($privateKey) {
-			$this->session->setPrivateKey($privateKey);
-			$this->session->setStatus(Session::INIT_SUCCESSFUL);
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @return string
-	 * @throws PrivateKeyMissingException
-	 */
-	public function getPrivateKey($userId) {
-		$privateKey = $this->keyStorage->getUserKey($userId,
-			$this->privateKeyId, Encryption::ID);
-
-		if (strlen($privateKey) !== 0) {
-			return $privateKey;
-		}
-		throw new PrivateKeyMissingException($userId);
-	}
-
-	/**
-	 * @param ?bool $useLegacyFileKey null means try both
-	 */
-	public function getFileKey(string $path, ?bool $useLegacyFileKey, bool $useDecryptAll = false): string {
-		$publicAccess = ($this->keyUid === null);
-		$encryptedFileKey = '';
-		if ($useLegacyFileKey ?? true) {
-			$encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
-
-			if (empty($encryptedFileKey) && $useLegacyFileKey) {
-				return '';
-			}
-		}
-		if ($useDecryptAll) {
-			$shareKey = $this->getShareKey($path, $this->session->getDecryptAllUid());
-			$privateKey = $this->session->getDecryptAllKey();
-		} elseif ($this->util->isMasterKeyEnabled()) {
-			$uid = $this->getMasterKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			if ($publicAccess) {
-				$privateKey = $this->getSystemPrivateKey($uid);
-				$privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
-			} else {
-				// when logged in, the master key is already decrypted in the session
-				$privateKey = $this->session->getPrivateKey();
-			}
-		} elseif ($publicAccess) {
-			// use public share key for public links
-			$uid = $this->getPublicShareKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
-		} else {
-			$uid = $this->keyUid;
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->session->getPrivateKey();
-		}
-
-		if ($useLegacyFileKey ?? true) {
-			if ($encryptedFileKey && $shareKey && $privateKey) {
-				return $this->crypt->multiKeyDecryptLegacy($encryptedFileKey,
-					$shareKey,
-					$privateKey);
-			}
-		}
-		if (!($useLegacyFileKey ?? false)) {
-			if ($shareKey && $privateKey) {
-				return $this->crypt->multiKeyDecrypt($shareKey, $privateKey);
-			}
-		}
-
-		return '';
-	}
-
-	/**
-	 * Get the current version of a file
-	 *
-	 * @param string $path
-	 * @param View $view
-	 * @return int
-	 */
-	public function getVersion($path, View $view) {
-		$fileInfo = $view->getFileInfo($path);
-		if ($fileInfo === false) {
-			return 0;
-		}
-		return $fileInfo->getEncryptedVersion();
-	}
-
-	/**
-	 * Set the current version of a file
-	 *
-	 * @param string $path
-	 * @param int $version
-	 * @param View $view
-	 */
-	public function setVersion($path, $version, View $view) {
-		$fileInfo = $view->getFileInfo($path);
-
-		if ($fileInfo !== false) {
-			$cache = $fileInfo->getStorage()->getCache();
-			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
-		}
-	}
-
-	/**
-	 * get the encrypted file key
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	public function getEncryptedFileKey($path) {
-		$encryptedFileKey = $this->keyStorage->getFileKey($path,
-			$this->fileKeyId, Encryption::ID);
-
-		return $encryptedFileKey;
-	}
-
-	/**
-	 * delete share key
-	 *
-	 * @param string $path
-	 * @param string $keyId
-	 * @return boolean
-	 */
-	public function deleteShareKey($path, $keyId) {
-		return $this->keyStorage->deleteFileKey(
-			$path,
-			$keyId . '.' . $this->shareKeyId,
-			Encryption::ID);
-	}
-
-
-	/**
-	 * @param $path
-	 * @param $uid
-	 * @return mixed
-	 */
-	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
-	}
-
-	/**
-	 * check if user has a private and a public key
-	 *
-	 * @param string $userId
-	 * @return bool
-	 * @throws PrivateKeyMissingException
-	 * @throws PublicKeyMissingException
-	 */
-	public function userHasKeys($userId) {
-		$privateKey = $publicKey = true;
-		$exception = null;
-
-		try {
-			$this->getPrivateKey($userId);
-		} catch (PrivateKeyMissingException $e) {
-			$privateKey = false;
-			$exception = $e;
-		}
-		try {
-			$this->getPublicKey($userId);
-		} catch (PublicKeyMissingException $e) {
-			$publicKey = false;
-			$exception = $e;
-		}
-
-		if ($privateKey && $publicKey) {
-			return true;
-		} elseif (!$privateKey && !$publicKey) {
-			return false;
-		} else {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * @param $userId
-	 * @return mixed
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKey($userId) {
-		$publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
-
-		if (strlen($publicKey) !== 0) {
-			return $publicKey;
-		}
-		throw new PublicKeyMissingException($userId);
-	}
-
-	public function getPublicShareKeyId() {
-		return $this->publicShareKeyId;
-	}
-
-	/**
-	 * get public key for public link shares
-	 *
-	 * @return string
-	 */
-	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $purpose
-	 * @param string $uid
-	 */
-	public function backupUserKeys($purpose, $uid) {
-		$this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
-	}
-
-	/**
-	 * create a backup of the users private and public key and then delete it
-	 *
-	 * @param string $uid
-	 */
-	public function deleteUserKeys($uid) {
-		$this->deletePublicKey($uid);
-		$this->deletePrivateKey($uid);
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 */
-	public function deletePublicKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $uid
-	 * @return bool
-	 */
-	private function deletePrivateKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $path
-	 * @return bool
-	 */
-	public function deleteAllFileKeys($path) {
-		return $this->keyStorage->deleteAllFileKeys($path);
-	}
-
-	public function deleteLegacyFileKey(string $path): bool {
-		return $this->keyStorage->deleteFileKey($path, $this->fileKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param array $userIds
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKeys(array $userIds) {
-		$keys = [];
-
-		foreach ($userIds as $userId) {
-			try {
-				$keys[$userId] = $this->getPublicKey($userId);
-			} catch (PublicKeyMissingException $e) {
-				continue;
-			}
-		}
-
-		return $keys;
-	}
-
-	/**
-	 * @param string $keyId
-	 * @return string returns openssl key
-	 */
-	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $keyId
-	 * @param string $key
-	 * @return string returns openssl key
-	 */
-	public function setSystemPrivateKey($keyId, $key) {
-		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * add system keys such as the public share key and the recovery key
-	 *
-	 * @param array $accessList
-	 * @param array $publicKeys
-	 * @param string $uid
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
-		if (!empty($accessList['public'])) {
-			$publicShareKey = $this->getPublicShareKey();
-			if (empty($publicShareKey)) {
-				throw new PublicKeyMissingException($this->getPublicShareKeyId());
-			}
-			$publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
-		}
-
-		if ($this->recoveryKeyExists()
-			&& $this->util->isRecoveryEnabledForUser($uid)) {
-			$publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
-		}
-
-		return $publicKeys;
-	}
-
-	/**
-	 * get master key password
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getMasterKeyPassword() {
-		$password = $this->config->getSystemValue('secret');
-		if (empty($password)) {
-			throw new \Exception('Can not get secret from Nextcloud instance');
-		}
-
-		return $password;
-	}
-
-	/**
-	 * return master key id
-	 *
-	 * @return string
-	 */
-	public function getMasterKeyId() {
-		return $this->masterKeyId;
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPrivateMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
+    private string $recoveryKeyId;
+    private string $publicShareKeyId;
+    private string $masterKeyId;
+    private ?string $keyUid;
+    private string $publicKeyId = 'publicKey';
+    private string $privateKeyId = 'privateKey';
+    private string $shareKeyId = 'shareKey';
+    private string $fileKeyId = 'fileKey';
+
+    public function __construct(
+        private IStorage $keyStorage,
+        private Crypt $crypt,
+        private IConfig $config,
+        IUserSession $userSession,
+        private Session $session,
+        private LoggerInterface $logger,
+        private Util $util,
+        private ILockingProvider $lockingProvider,
+    ) {
+        $this->recoveryKeyId = $this->config->getAppValue('encryption',
+            'recoveryKeyId');
+        if (empty($this->recoveryKeyId)) {
+            $this->recoveryKeyId = 'recoveryKey_' . substr(md5((string)time()), 0, 8);
+            $this->config->setAppValue('encryption',
+                'recoveryKeyId',
+                $this->recoveryKeyId);
+        }
+
+        $this->publicShareKeyId = $this->config->getAppValue('encryption',
+            'publicShareKeyId');
+        if (empty($this->publicShareKeyId)) {
+            $this->publicShareKeyId = 'pubShare_' . substr(md5((string)time()), 0, 8);
+            $this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
+        }
+
+        $this->masterKeyId = $this->config->getAppValue('encryption',
+            'masterKeyId');
+        if (empty($this->masterKeyId)) {
+            $this->masterKeyId = 'master_' . substr(md5((string)time()), 0, 8);
+            $this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
+        }
+
+        $this->keyUid = $userSession->isLoggedIn() ? $userSession->getUser()?->getUID() : null;
+    }
+
+    /**
+     * check if key pair for public link shares exists, if not we create one
+     */
+    public function validateShareKey() {
+        $shareKey = $this->getPublicShareKey();
+        if (empty($shareKey)) {
+            $this->lockingProvider->acquireLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: shared key generation');
+            try {
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyStorage->setSystemUserKey(
+                    $this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+                    Encryption::ID);
+
+                // Encrypt private key empty passphrase
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
+                $header = $this->crypt->generateHeader();
+                $this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+            } catch (\Throwable $e) {
+                $this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+                throw $e;
+            }
+            $this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+        }
+    }
+
+    /**
+     * check if a key pair for the master key exists, if not we create one
+     */
+    public function validateMasterKey() {
+        if ($this->util->isMasterKeyEnabled() === false) {
+            return;
+        }
+
+        $publicMasterKey = $this->getPublicMasterKey();
+        $privateMasterKey = $this->getPrivateMasterKey();
+
+        if (empty($publicMasterKey) && empty($privateMasterKey)) {
+            // There could be a race condition here if two requests would trigger
+            // the generation the second one would enter the key generation as long
+            // as the first one didn't write the key to the keystorage yet
+            $this->lockingProvider->acquireLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: master key generation');
+            try {
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyStorage->setSystemUserKey(
+                    $this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+                    Encryption::ID);
+
+                // Encrypt private key with system password
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
+                $header = $this->crypt->generateHeader();
+                $this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+            } catch (\Throwable $e) {
+                $this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+                throw $e;
+            }
+            $this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+        } elseif (empty($publicMasterKey)) {
+            $this->logger->error('A private master key is available but the public key could not be found. This should never happen.');
+            return;
+        } elseif (empty($privateMasterKey)) {
+            $this->logger->error('A public master key is available but the private key could not be found. This should never happen.');
+            return;
+        }
+
+        if (!$this->session->isPrivateKeySet()) {
+            $masterKey = $this->getSystemPrivateKey($this->masterKeyId);
+            $decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
+            if ($decryptedMasterKey === false) {
+                $this->logger->error('A public master key is available but decrypting it failed. This should never happen.');
+            } else {
+                $this->session->setPrivateKey($decryptedMasterKey);
+            }
+        }
+
+        // after the encryption key is available we are ready to go
+        $this->session->setStatus(Session::INIT_SUCCESSFUL);
+    }
+
+    /**
+     * @return bool
+     */
+    public function recoveryKeyExists() {
+        $key = $this->getRecoveryKey();
+        return !empty($key);
+    }
+
+    /**
+     * get recovery key
+     *
+     * @return string
+     */
+    public function getRecoveryKey() {
+        return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * get recovery key ID
+     *
+     * @return string
+     */
+    public function getRecoveryKeyId() {
+        return $this->recoveryKeyId;
+    }
+
+    /**
+     * @param string $password
+     * @return bool
+     */
+    public function checkRecoveryPassword($password) {
+        $recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
+        $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+
+        if ($decryptedRecoveryKey) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function storeKeyPair($uid, $password, $keyPair) {
+        // Save Public Key
+        $this->setPublicKey($uid, $keyPair['publicKey']);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
+
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setPrivateKey($uid, $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function setRecoveryKey($password, $keyPair) {
+        // Save Public Key
+        $this->keyStorage->setSystemUserKey($this->getRecoveryKeyId()
+            . '.' . $this->publicKeyId,
+            $keyPair['publicKey'],
+            Encryption::ID);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @param $key
+     * @return bool
+     */
+    public function setPublicKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * @param $userId
+     * @param string $key
+     * @return bool
+     */
+    public function setPrivateKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId,
+            $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * write file key to key storage
+     *
+     * @param string $path
+     * @param string $key
+     * @return boolean
+     */
+    public function setFileKey($path, $key) {
+        return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * set all file keys (the file key and the corresponding share keys)
+     *
+     * @param string $path
+     * @param array $keys
+     */
+    public function setAllFileKeys($path, $keys) {
+        $this->setFileKey($path, $keys['data']);
+        foreach ($keys['keys'] as $uid => $keyFile) {
+            $this->setShareKey($path, $uid, $keyFile);
+        }
+    }
+
+    /**
+     * write share key to the key storage
+     *
+     * @param string $path
+     * @param string $uid
+     * @param string $key
+     * @return boolean
+     */
+    public function setShareKey($path, $uid, $key) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
+    }
+
+    /**
+     * Decrypt private key and store it
+     *
+     * @return boolean
+     */
+    public function init(string $uid, ?string $passPhrase) {
+        $this->session->setStatus(Session::INIT_EXECUTED);
+
+        try {
+            if ($this->util->isMasterKeyEnabled()) {
+                $uid = $this->getMasterKeyId();
+                $passPhrase = $this->getMasterKeyPassword();
+                $privateKey = $this->getSystemPrivateKey($uid);
+            } else {
+                if ($passPhrase === null) {
+                    $this->logger->warning('Master key is disabled but not passphrase provided.');
+                    return false;
+                }
+                $privateKey = $this->getPrivateKey($uid);
+            }
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
+        } catch (PrivateKeyMissingException $e) {
+            return false;
+        } catch (DecryptionFailedException $e) {
+            return false;
+        } catch (\Exception $e) {
+            $this->logger->warning(
+                'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
+                [
+                    'app' => 'encryption',
+                    'exception' => $e,
+                ]
+            );
+            return false;
+        }
+
+        if ($privateKey) {
+            $this->session->setPrivateKey($privateKey);
+            $this->session->setStatus(Session::INIT_SUCCESSFUL);
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @return string
+     * @throws PrivateKeyMissingException
+     */
+    public function getPrivateKey($userId) {
+        $privateKey = $this->keyStorage->getUserKey($userId,
+            $this->privateKeyId, Encryption::ID);
+
+        if (strlen($privateKey) !== 0) {
+            return $privateKey;
+        }
+        throw new PrivateKeyMissingException($userId);
+    }
+
+    /**
+     * @param ?bool $useLegacyFileKey null means try both
+     */
+    public function getFileKey(string $path, ?bool $useLegacyFileKey, bool $useDecryptAll = false): string {
+        $publicAccess = ($this->keyUid === null);
+        $encryptedFileKey = '';
+        if ($useLegacyFileKey ?? true) {
+            $encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
+
+            if (empty($encryptedFileKey) && $useLegacyFileKey) {
+                return '';
+            }
+        }
+        if ($useDecryptAll) {
+            $shareKey = $this->getShareKey($path, $this->session->getDecryptAllUid());
+            $privateKey = $this->session->getDecryptAllKey();
+        } elseif ($this->util->isMasterKeyEnabled()) {
+            $uid = $this->getMasterKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            if ($publicAccess) {
+                $privateKey = $this->getSystemPrivateKey($uid);
+                $privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
+            } else {
+                // when logged in, the master key is already decrypted in the session
+                $privateKey = $this->session->getPrivateKey();
+            }
+        } elseif ($publicAccess) {
+            // use public share key for public links
+            $uid = $this->getPublicShareKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey);
+        } else {
+            $uid = $this->keyUid;
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->session->getPrivateKey();
+        }
+
+        if ($useLegacyFileKey ?? true) {
+            if ($encryptedFileKey && $shareKey && $privateKey) {
+                return $this->crypt->multiKeyDecryptLegacy($encryptedFileKey,
+                    $shareKey,
+                    $privateKey);
+            }
+        }
+        if (!($useLegacyFileKey ?? false)) {
+            if ($shareKey && $privateKey) {
+                return $this->crypt->multiKeyDecrypt($shareKey, $privateKey);
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * Get the current version of a file
+     *
+     * @param string $path
+     * @param View $view
+     * @return int
+     */
+    public function getVersion($path, View $view) {
+        $fileInfo = $view->getFileInfo($path);
+        if ($fileInfo === false) {
+            return 0;
+        }
+        return $fileInfo->getEncryptedVersion();
+    }
+
+    /**
+     * Set the current version of a file
+     *
+     * @param string $path
+     * @param int $version
+     * @param View $view
+     */
+    public function setVersion($path, $version, View $view) {
+        $fileInfo = $view->getFileInfo($path);
+
+        if ($fileInfo !== false) {
+            $cache = $fileInfo->getStorage()->getCache();
+            $cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
+        }
+    }
+
+    /**
+     * get the encrypted file key
+     *
+     * @param string $path
+     * @return string
+     */
+    public function getEncryptedFileKey($path) {
+        $encryptedFileKey = $this->keyStorage->getFileKey($path,
+            $this->fileKeyId, Encryption::ID);
+
+        return $encryptedFileKey;
+    }
+
+    /**
+     * delete share key
+     *
+     * @param string $path
+     * @param string $keyId
+     * @return boolean
+     */
+    public function deleteShareKey($path, $keyId) {
+        return $this->keyStorage->deleteFileKey(
+            $path,
+            $keyId . '.' . $this->shareKeyId,
+            Encryption::ID);
+    }
+
+
+    /**
+     * @param $path
+     * @param $uid
+     * @return mixed
+     */
+    public function getShareKey($path, $uid) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
+    }
+
+    /**
+     * check if user has a private and a public key
+     *
+     * @param string $userId
+     * @return bool
+     * @throws PrivateKeyMissingException
+     * @throws PublicKeyMissingException
+     */
+    public function userHasKeys($userId) {
+        $privateKey = $publicKey = true;
+        $exception = null;
+
+        try {
+            $this->getPrivateKey($userId);
+        } catch (PrivateKeyMissingException $e) {
+            $privateKey = false;
+            $exception = $e;
+        }
+        try {
+            $this->getPublicKey($userId);
+        } catch (PublicKeyMissingException $e) {
+            $publicKey = false;
+            $exception = $e;
+        }
+
+        if ($privateKey && $publicKey) {
+            return true;
+        } elseif (!$privateKey && !$publicKey) {
+            return false;
+        } else {
+            throw $exception;
+        }
+    }
+
+    /**
+     * @param $userId
+     * @return mixed
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKey($userId) {
+        $publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
+
+        if (strlen($publicKey) !== 0) {
+            return $publicKey;
+        }
+        throw new PublicKeyMissingException($userId);
+    }
+
+    public function getPublicShareKeyId() {
+        return $this->publicShareKeyId;
+    }
+
+    /**
+     * get public key for public link shares
+     *
+     * @return string
+     */
+    public function getPublicShareKey() {
+        return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $purpose
+     * @param string $uid
+     */
+    public function backupUserKeys($purpose, $uid) {
+        $this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
+    }
+
+    /**
+     * create a backup of the users private and public key and then delete it
+     *
+     * @param string $uid
+     */
+    public function deleteUserKeys($uid) {
+        $this->deletePublicKey($uid);
+        $this->deletePrivateKey($uid);
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     */
+    public function deletePublicKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $uid
+     * @return bool
+     */
+    private function deletePrivateKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function deleteAllFileKeys($path) {
+        return $this->keyStorage->deleteAllFileKeys($path);
+    }
+
+    public function deleteLegacyFileKey(string $path): bool {
+        return $this->keyStorage->deleteFileKey($path, $this->fileKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param array $userIds
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKeys(array $userIds) {
+        $keys = [];
+
+        foreach ($userIds as $userId) {
+            try {
+                $keys[$userId] = $this->getPublicKey($userId);
+            } catch (PublicKeyMissingException $e) {
+                continue;
+            }
+        }
+
+        return $keys;
+    }
+
+    /**
+     * @param string $keyId
+     * @return string returns openssl key
+     */
+    public function getSystemPrivateKey($keyId) {
+        return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $keyId
+     * @param string $key
+     * @return string returns openssl key
+     */
+    public function setSystemPrivateKey($keyId, $key) {
+        return $this->keyStorage->setSystemUserKey(
+            $keyId . '.' . $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * add system keys such as the public share key and the recovery key
+     *
+     * @param array $accessList
+     * @param array $publicKeys
+     * @param string $uid
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
+        if (!empty($accessList['public'])) {
+            $publicShareKey = $this->getPublicShareKey();
+            if (empty($publicShareKey)) {
+                throw new PublicKeyMissingException($this->getPublicShareKeyId());
+            }
+            $publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
+        }
+
+        if ($this->recoveryKeyExists()
+            && $this->util->isRecoveryEnabledForUser($uid)) {
+            $publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
+        }
+
+        return $publicKeys;
+    }
+
+    /**
+     * get master key password
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function getMasterKeyPassword() {
+        $password = $this->config->getSystemValue('secret');
+        if (empty($password)) {
+            throw new \Exception('Can not get secret from Nextcloud instance');
+        }
+
+        return $password;
+    }
+
+    /**
+     * return master key id
+     *
+     * @return string
+     */
+    public function getMasterKeyId() {
+        return $this->masterKeyId;
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPublicMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPrivateMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
 }

Spacing +22 added lines, -22 removed lines

@@ -42,7 +42,7 @@ 
 		$this->recoveryKeyId = $this->config->getAppValue('encryption',
 			'recoveryKeyId');
 		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5((string)time()), 0, 8);
+			$this->recoveryKeyId = 'recoveryKey_'.substr(md5((string) time()), 0, 8);
 			$this->config->setAppValue('encryption',
 				'recoveryKeyId',
 				$this->recoveryKeyId);
@@ -51,14 +51,14 @@ 
 		$this->publicShareKeyId = $this->config->getAppValue('encryption',
 			'publicShareKeyId');
 		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5((string)time()), 0, 8);
+			$this->publicShareKeyId = 'pubShare_'.substr(md5((string) time()), 0, 8);
 			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
 		}
 
 		$this->masterKeyId = $this->config->getAppValue('encryption',
 			'masterKeyId');
 		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5((string)time()), 0, 8);
+			$this->masterKeyId = 'master_'.substr(md5((string) time()), 0, 8);
 			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
 		}
 
@@ -77,13 +77,13 @@ 
 
 				// Save public key
 				$this->keyStorage->setSystemUserKey(
-					$this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					$this->publicShareKeyId.'.'.$this->publicKeyId, $keyPair['publicKey'],
 					Encryption::ID);
 
 				// Encrypt private key empty passphrase
 				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
 				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+				$this->setSystemPrivateKey($this->publicShareKeyId, $header.$encryptedKey);
 			} catch (\Throwable $e) {
 				$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
 				throw $e;
@@ -113,13 +113,13 @@ 
 
 				// Save public key
 				$this->keyStorage->setSystemUserKey(
-					$this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					$this->masterKeyId.'.'.$this->publicKeyId, $keyPair['publicKey'],
 					Encryption::ID);
 
 				// Encrypt private key with system password
 				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
 				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+				$this->setSystemPrivateKey($this->masterKeyId, $header.$encryptedKey);
 			} catch (\Throwable $e) {
 				$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
 				throw $e;
@@ -161,7 +161,7 @@ 
 	 * @return string
 	 */
 	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -178,7 +178,7 @@ 
 	 * @return bool
 	 */
 	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
+		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.'.$this->privateKeyId, Encryption::ID);
 		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
 
 		if ($decryptedRecoveryKey) {
@@ -202,7 +202,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
+			$this->setPrivateKey($uid, $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -216,7 +216,7 @@ 
 	public function setRecoveryKey($password, $keyPair) {
 		// Save Public Key
 		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId()
-			. '.' . $this->publicKeyId,
+			. '.'.$this->publicKeyId,
 			$keyPair['publicKey'],
 			Encryption::ID);
 
@@ -224,7 +224,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -284,7 +284,7 @@ 
 	 * @return boolean
 	 */
 	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
 	}
 
@@ -315,7 +315,7 @@ 
 			return false;
 		} catch (\Exception $e) {
 			$this->logger->warning(
-				'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
+				'Could not decrypt the private key from user "'.$uid.'"" during login. Assume password change on the user back-end.',
 				[
 					'app' => 'encryption',
 					'exception' => $e,
@@ -378,7 +378,7 @@ 
 			// use public share key for public links
 			$uid = $this->getPublicShareKeyId();
 			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
+			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.'.$this->privateKeyId, Encryption::ID);
 			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
 		} else {
 			$uid = $this->keyUid;
@@ -456,7 +456,7 @@ 
 	public function deleteShareKey($path, $keyId) {
 		return $this->keyStorage->deleteFileKey(
 			$path,
-			$keyId . '.' . $this->shareKeyId,
+			$keyId.'.'.$this->shareKeyId,
 			Encryption::ID);
 	}
 
@@ -467,7 +467,7 @@ 
 	 * @return mixed
 	 */
 	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
 	}
 
@@ -529,7 +529,7 @@ 
 	 * @return string
 	 */
 	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -602,7 +602,7 @@ 
 	 * @return string returns openssl key
 	 */
 	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($keyId.'.'.$this->privateKeyId, Encryption::ID);
 	}
 
 	/**
@@ -612,7 +612,7 @@ 
 	 */
 	public function setSystemPrivateKey($keyId, $key) {
 		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
+			$keyId.'.'.$this->privateKeyId,
 			$key,
 			Encryption::ID);
 	}
@@ -673,7 +673,7 @@ 
 	 * @return string
 	 */
 	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -682,6 +682,6 @@ 
 	 * @return string
 	 */
 	public function getPrivateMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId.'.'.$this->privateKeyId, Encryption::ID);
 	}
 }

apps/encryption/lib/Crypto/DecryptAll.php

Indentation +78 added lines, -78 removed lines

@@ -21,91 +21,91 @@
 use Symfony\Component\Console\Question\Question;
 
 class DecryptAll {
-	public function __construct(
-		protected Util $util,
-		protected KeyManager $keyManager,
-		protected Crypt $crypt,
-		protected Session $session,
-		protected QuestionHelper $questionHelper,
-	) {
-	}
+    public function __construct(
+        protected Util $util,
+        protected KeyManager $keyManager,
+        protected Crypt $crypt,
+        protected Session $session,
+        protected QuestionHelper $questionHelper,
+    ) {
+    }
 
-	/**
-	 * prepare encryption module to decrypt all files
-	 */
-	public function prepare(InputInterface $input, OutputInterface $output, ?string $user): bool {
-		$question = new Question('Please enter the recovery key password: ');
+    /**
+     * prepare encryption module to decrypt all files
+     */
+    public function prepare(InputInterface $input, OutputInterface $output, ?string $user): bool {
+        $question = new Question('Please enter the recovery key password: ');
 
-		if ($this->util->isMasterKeyEnabled()) {
-			$output->writeln('Use master key to decrypt all files');
-			$user = $this->keyManager->getMasterKeyId();
-			$password = $this->keyManager->getMasterKeyPassword();
-		} else {
-			$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
-			if ($user !== null && $user !== '') {
-				$output->writeln('You can only decrypt the users files if you know');
-				$output->writeln('the users password or if they activated the recovery key.');
-				$output->writeln('');
-				$questionUseLoginPassword = new ConfirmationQuestion(
-					'Do you want to use the users login password to decrypt all files? (y/n) ',
-					false
-				);
-				$useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword);
-				if ($useLoginPassword) {
-					$question = new Question('Please enter the user\'s login password: ');
-				} elseif ($this->util->isRecoveryEnabledForUser($user) === false) {
-					$output->writeln('No recovery key available for user ' . $user);
-					return false;
-				} else {
-					$user = $recoveryKeyId;
-				}
-			} else {
-				$output->writeln('You can only decrypt the files of all users if the');
-				$output->writeln('recovery key is enabled by the admin and activated by the users.');
-				$output->writeln('');
-				$user = $recoveryKeyId;
-			}
+        if ($this->util->isMasterKeyEnabled()) {
+            $output->writeln('Use master key to decrypt all files');
+            $user = $this->keyManager->getMasterKeyId();
+            $password = $this->keyManager->getMasterKeyPassword();
+        } else {
+            $recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+            if ($user !== null && $user !== '') {
+                $output->writeln('You can only decrypt the users files if you know');
+                $output->writeln('the users password or if they activated the recovery key.');
+                $output->writeln('');
+                $questionUseLoginPassword = new ConfirmationQuestion(
+                    'Do you want to use the users login password to decrypt all files? (y/n) ',
+                    false
+                );
+                $useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword);
+                if ($useLoginPassword) {
+                    $question = new Question('Please enter the user\'s login password: ');
+                } elseif ($this->util->isRecoveryEnabledForUser($user) === false) {
+                    $output->writeln('No recovery key available for user ' . $user);
+                    return false;
+                } else {
+                    $user = $recoveryKeyId;
+                }
+            } else {
+                $output->writeln('You can only decrypt the files of all users if the');
+                $output->writeln('recovery key is enabled by the admin and activated by the users.');
+                $output->writeln('');
+                $user = $recoveryKeyId;
+            }
 
-			$question->setHidden(true);
-			$question->setHiddenFallback(false);
-			$password = $this->questionHelper->ask($input, $output, $question);
-		}
+            $question->setHidden(true);
+            $question->setHiddenFallback(false);
+            $password = $this->questionHelper->ask($input, $output, $question);
+        }
 
-		$privateKey = $this->getPrivateKey($user, $password);
-		if ($privateKey !== false) {
-			$this->updateSession($user, $privateKey);
-			return true;
-		} else {
-			$output->writeln('Could not decrypt private key, maybe you entered the wrong password?');
-		}
+        $privateKey = $this->getPrivateKey($user, $password);
+        if ($privateKey !== false) {
+            $this->updateSession($user, $privateKey);
+            return true;
+        } else {
+            $output->writeln('Could not decrypt private key, maybe you entered the wrong password?');
+        }
 
 
-		return false;
-	}
+        return false;
+    }
 
-	/**
-	 * get the private key which will be used to decrypt all files
-	 *
-	 * @throws PrivateKeyMissingException
-	 */
-	protected function getPrivateKey(string $user, string $password): string|false {
-		$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
-		$masterKeyId = $this->keyManager->getMasterKeyId();
-		if ($user === $recoveryKeyId) {
-			$recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
-			$privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
-		} elseif ($user === $masterKeyId) {
-			$masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId);
-			$privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId);
-		} else {
-			$userKey = $this->keyManager->getPrivateKey($user);
-			$privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user);
-		}
+    /**
+     * get the private key which will be used to decrypt all files
+     *
+     * @throws PrivateKeyMissingException
+     */
+    protected function getPrivateKey(string $user, string $password): string|false {
+        $recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+        $masterKeyId = $this->keyManager->getMasterKeyId();
+        if ($user === $recoveryKeyId) {
+            $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
+            $privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+        } elseif ($user === $masterKeyId) {
+            $masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId);
+            $privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId);
+        } else {
+            $userKey = $this->keyManager->getPrivateKey($user);
+            $privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user);
+        }
 
-		return $privateKey;
-	}
+        return $privateKey;
+    }
 
-	protected function updateSession(string $user, string $privateKey): void {
-		$this->session->prepareDecryptAll($user, $privateKey);
-	}
+    protected function updateSession(string $user, string $privateKey): void {
+        $this->session->prepareDecryptAll($user, $privateKey);
+    }
 }

Spacing +2 added lines, -2 removed lines

@@ -54,7 +54,7 @@ 
 				if ($useLoginPassword) {
 					$question = new Question('Please enter the user\'s login password: ');
 				} elseif ($this->util->isRecoveryEnabledForUser($user) === false) {
-					$output->writeln('No recovery key available for user ' . $user);
+					$output->writeln('No recovery key available for user '.$user);
 					return false;
 				} else {
 					$user = $recoveryKeyId;
@@ -88,7 +88,7 @@ 
 	 *
 	 * @throws PrivateKeyMissingException
 	 */
-	protected function getPrivateKey(string $user, string $password): string|false {
+	protected function getPrivateKey(string $user, string $password): string | false {
 		$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
 		$masterKeyId = $this->keyManager->getMasterKeyId();
 		if ($user === $recoveryKeyId) {

apps/encryption/lib/Crypto/EncryptAll.php

Indentation +381 added lines, -381 removed lines

@@ -34,385 +34,385 @@
 
 class EncryptAll {
 
-	/** @var array */
-	protected $userPasswords;
-
-	/** @var OutputInterface */
-	protected $output;
-
-	/** @var InputInterface */
-	protected $input;
-
-	public function __construct(
-		protected Setup $userSetup,
-		protected IUserManager $userManager,
-		protected View $rootView,
-		protected KeyManager $keyManager,
-		protected Util $util,
-		protected IConfig $config,
-		protected IMailer $mailer,
-		protected IL10N $l,
-		protected IFactory $l10nFactory,
-		protected QuestionHelper $questionHelper,
-		protected ISecureRandom $secureRandom,
-		protected LoggerInterface $logger,
-	) {
-		// store one time passwords for the users
-		$this->userPasswords = [];
-	}
-
-	/**
-	 * start to encrypt all files
-	 */
-	public function encryptAll(InputInterface $input, OutputInterface $output): void {
-		$this->input = $input;
-		$this->output = $output;
-
-		$headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME;
-		$this->output->writeln("\n");
-		$this->output->writeln($headline);
-		$this->output->writeln(str_pad('', strlen($headline), '='));
-		$this->output->writeln("\n");
-
-		if ($this->util->isMasterKeyEnabled()) {
-			$this->output->writeln('Use master key to encrypt all files.');
-			$this->keyManager->validateMasterKey();
-		} else {
-			//create private/public keys for each user and store the private key password
-			$this->output->writeln('Create key-pair for every user');
-			$this->output->writeln('------------------------------');
-			$this->output->writeln('');
-			$this->output->writeln('This module will encrypt all files in the users files folder initially.');
-			$this->output->writeln('Already existing versions and files in the trash bin will not be encrypted.');
-			$this->output->writeln('');
-			$this->createKeyPairs();
-		}
-
-
-		// output generated encryption key passwords
-		if ($this->util->isMasterKeyEnabled() === false) {
-			//send-out or display password list and write it to a file
-			$this->output->writeln("\n");
-			$this->output->writeln('Generated encryption key passwords');
-			$this->output->writeln('----------------------------------');
-			$this->output->writeln('');
-			$this->outputPasswords();
-		}
-
-		//setup users file system and encrypt all files one by one (take should encrypt setting of storage into account)
-		$this->output->writeln("\n");
-		$this->output->writeln('Start to encrypt users files');
-		$this->output->writeln('----------------------------');
-		$this->output->writeln('');
-		$this->encryptAllUsersFiles();
-		$this->output->writeln("\n");
-	}
-
-	/**
-	 * create key-pair for every user
-	 */
-	protected function createKeyPairs(): void {
-		$this->output->writeln("\n");
-		$progress = new ProgressBar($this->output);
-		$progress->setFormat(" %message% \n [%bar%]");
-		$progress->start();
-
-		foreach ($this->userManager->getBackends() as $backend) {
-			$limit = 500;
-			$offset = 0;
-			do {
-				$users = $backend->getUsers('', $limit, $offset);
-				foreach ($users as $user) {
-					if ($this->keyManager->userHasKeys($user) === false) {
-						$progress->setMessage('Create key-pair for ' . $user);
-						$progress->advance();
-						$this->setupUserFS($user);
-						$password = $this->generateOneTimePassword($user);
-						$this->userSetup->setupUser($user, $password);
-					} else {
-						// users which already have a key-pair will be stored with a
-						// empty password and filtered out later
-						$this->userPasswords[$user] = '';
-					}
-				}
-				$offset += $limit;
-			} while (count($users) >= $limit);
-		}
-
-		$progress->setMessage('Key-pair created for all users');
-		$progress->finish();
-	}
-
-	/**
-	 * iterate over all user and encrypt their files
-	 */
-	protected function encryptAllUsersFiles(): void {
-		$this->output->writeln("\n");
-		$progress = new ProgressBar($this->output);
-		$progress->setFormat(" %message% \n [%bar%]");
-		$progress->start();
-		$numberOfUsers = count($this->userPasswords);
-		$userNo = 1;
-		if ($this->util->isMasterKeyEnabled()) {
-			$this->encryptAllUserFilesWithMasterKey($progress);
-		} else {
-			foreach ($this->userPasswords as $uid => $password) {
-				$userCount = "$uid ($userNo of $numberOfUsers)";
-				$this->encryptUsersFiles($uid, $progress, $userCount);
-				$userNo++;
-			}
-		}
-		$progress->setMessage('all files encrypted');
-		$progress->finish();
-	}
-
-	/**
-	 * encrypt all user files with the master key
-	 */
-	protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress): void {
-		$userNo = 1;
-		foreach ($this->userManager->getBackends() as $backend) {
-			$limit = 500;
-			$offset = 0;
-			do {
-				$users = $backend->getUsers('', $limit, $offset);
-				foreach ($users as $user) {
-					$userCount = "$user ($userNo)";
-					$this->encryptUsersFiles($user, $progress, $userCount);
-					$userNo++;
-				}
-				$offset += $limit;
-			} while (count($users) >= $limit);
-		}
-	}
-
-	/**
-	 * encrypt files from the given user
-	 */
-	protected function encryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
-		$this->setupUserFS($uid);
-		$directories = [];
-		$directories[] = '/' . $uid . '/files';
-
-		while ($root = array_pop($directories)) {
-			$content = $this->rootView->getDirectoryContent($root);
-			foreach ($content as $file) {
-				$path = $root . '/' . $file->getName();
-				if ($file->isShared()) {
-					$progress->setMessage("Skip shared file/folder $path");
-					$progress->advance();
-					continue;
-				} elseif ($file->getType() === FileInfo::TYPE_FOLDER) {
-					$directories[] = $path;
-					continue;
-				} else {
-					$progress->setMessage("encrypt files for user $userCount: $path");
-					$progress->advance();
-					try {
-						if ($this->encryptFile($file, $path) === false) {
-							$progress->setMessage("encrypt files for user $userCount: $path (already encrypted)");
-							$progress->advance();
-						}
-					} catch (\Exception $e) {
-						$progress->setMessage("Failed to encrypt path $path: " . $e->getMessage());
-						$progress->advance();
-						$this->logger->error(
-							'Failed to encrypt path {path}',
-							[
-								'user' => $uid,
-								'path' => $path,
-								'exception' => $e,
-							]
-						);
-					}
-				}
-			}
-		}
-	}
-
-	protected function encryptFile(FileInfo $fileInfo, string $path): bool {
-		// skip already encrypted files
-		if ($fileInfo->isEncrypted()) {
-			return true;
-		}
-
-		$source = $path;
-		$target = $path . '.encrypted.' . time();
-
-		try {
-			$copySuccess = $this->rootView->copy($source, $target);
-			if ($copySuccess === false) {
-				/* Copy failed, abort */
-				if ($this->rootView->file_exists($target)) {
-					$this->rootView->unlink($target);
-				}
-				throw new \Exception('Copy failed for ' . $source);
-			}
-			$this->rootView->rename($target, $source);
-		} catch (DecryptionFailedException $e) {
-			if ($this->rootView->file_exists($target)) {
-				$this->rootView->unlink($target);
-			}
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * output one-time encryption passwords
-	 */
-	protected function outputPasswords(): void {
-		$table = new Table($this->output);
-		$table->setHeaders(['Username', 'Private key password']);
-
-		//create rows
-		$newPasswords = [];
-		$unchangedPasswords = [];
-		foreach ($this->userPasswords as $uid => $password) {
-			if (empty($password)) {
-				$unchangedPasswords[] = $uid;
-			} else {
-				$newPasswords[] = [$uid, $password];
-			}
-		}
-
-		if (empty($newPasswords)) {
-			$this->output->writeln("\nAll users already had a key-pair, no further action needed.\n");
-			return;
-		}
-
-		$table->setRows($newPasswords);
-		$table->render();
-
-		if (!empty($unchangedPasswords)) {
-			$this->output->writeln("\nThe following users already had a key-pair which was reused without setting a new password:\n");
-			foreach ($unchangedPasswords as $uid) {
-				$this->output->writeln("    $uid");
-			}
-		}
-
-		$this->writePasswordsToFile($newPasswords);
-
-		$this->output->writeln('');
-		$question = new ConfirmationQuestion('Do you want to send the passwords directly to the users by mail? (y/n) ', false);
-		if ($this->questionHelper->ask($this->input, $this->output, $question)) {
-			$this->sendPasswordsByMail();
-		}
-	}
-
-	/**
-	 * write one-time encryption passwords to a csv file
-	 */
-	protected function writePasswordsToFile(array $passwords): void {
-		$fp = $this->rootView->fopen('oneTimeEncryptionPasswords.csv', 'w');
-		foreach ($passwords as $pwd) {
-			fputcsv($fp, $pwd);
-		}
-		fclose($fp);
-		$this->output->writeln("\n");
-		$this->output->writeln('A list of all newly created passwords was written to data/oneTimeEncryptionPasswords.csv');
-		$this->output->writeln('');
-		$this->output->writeln('Each of these users need to login to the web interface, go to the');
-		$this->output->writeln('personal settings section "basic encryption module" and');
-		$this->output->writeln('update the private key password to match the login password again by');
-		$this->output->writeln('entering the one-time password into the "old log-in password" field');
-		$this->output->writeln('and their current login password');
-	}
-
-	/**
-	 * setup user file system
-	 */
-	protected function setupUserFS(string $uid): void {
-		\OC_Util::tearDownFS();
-		\OC_Util::setupFS($uid);
-	}
-
-	/**
-	 * generate one time password for the user and store it in a array
-	 *
-	 * @return string password
-	 */
-	protected function generateOneTimePassword(string $uid): string {
-		$password = $this->secureRandom->generate(16, ISecureRandom::CHAR_HUMAN_READABLE);
-		$this->userPasswords[$uid] = $password;
-		return $password;
-	}
-
-	/**
-	 * send encryption key passwords to the users by mail
-	 */
-	protected function sendPasswordsByMail(): void {
-		$noMail = [];
-
-		$this->output->writeln('');
-		$progress = new ProgressBar($this->output, count($this->userPasswords));
-		$progress->start();
-
-		foreach ($this->userPasswords as $uid => $password) {
-			$progress->advance();
-			if (!empty($password)) {
-				$recipient = $this->userManager->get($uid);
-				if (!$recipient instanceof IUser) {
-					continue;
-				}
-
-				$recipientDisplayName = $recipient->getDisplayName();
-				$to = $recipient->getEMailAddress();
-
-				if ($to === '' || $to === null) {
-					$noMail[] = $uid;
-					continue;
-				}
-
-				$l = $this->l10nFactory->get('encryption', $this->l10nFactory->getUserLanguage($recipient));
-
-				$template = $this->mailer->createEMailTemplate('encryption.encryptAllPassword', [
-					'user' => $recipient->getUID(),
-					'password' => $password,
-				]);
-
-				$template->setSubject($l->t('one-time password for server-side-encryption'));
-				// 'Hey there,<br><br>The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.<br><br>
-				// Please login to the web interface, go to the section "Basic encryption module" of your personal settings and update your encryption password by entering this password into the "Old log-in password" field and your current login-password.<br><br>'
-				$template->addHeader();
-				$template->addHeading($l->t('Encryption password'));
-				$template->addBodyText(
-					$l->t('The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.', [htmlspecialchars($password)]),
-					$l->t('The administration enabled server-side-encryption. Your files were encrypted using the password "%s".', $password)
-				);
-				$template->addBodyText(
-					$l->t('Please login to the web interface, go to the "Security" section of your personal settings and update your encryption password by entering this password into the "Old login password" field and your current login password.')
-				);
-				$template->addFooter();
-
-				// send it out now
-				try {
-					$message = $this->mailer->createMessage();
-					$message->setTo([$to => $recipientDisplayName]);
-					$message->useTemplate($template);
-					$message->setAutoSubmitted(AutoSubmitted::VALUE_AUTO_GENERATED);
-					$this->mailer->send($message);
-				} catch (\Exception $e) {
-					$noMail[] = $uid;
-				}
-			}
-		}
-
-		$progress->finish();
-
-		if (empty($noMail)) {
-			$this->output->writeln("\n\nPassword successfully send to all users");
-		} else {
-			$table = new Table($this->output);
-			$table->setHeaders(['Username', 'Private key password']);
-			$this->output->writeln("\n\nCould not send password to following users:\n");
-			$rows = [];
-			foreach ($noMail as $uid) {
-				$rows[] = [$uid, $this->userPasswords[$uid]];
-			}
-			$table->setRows($rows);
-			$table->render();
-		}
-	}
+    /** @var array */
+    protected $userPasswords;
+
+    /** @var OutputInterface */
+    protected $output;
+
+    /** @var InputInterface */
+    protected $input;
+
+    public function __construct(
+        protected Setup $userSetup,
+        protected IUserManager $userManager,
+        protected View $rootView,
+        protected KeyManager $keyManager,
+        protected Util $util,
+        protected IConfig $config,
+        protected IMailer $mailer,
+        protected IL10N $l,
+        protected IFactory $l10nFactory,
+        protected QuestionHelper $questionHelper,
+        protected ISecureRandom $secureRandom,
+        protected LoggerInterface $logger,
+    ) {
+        // store one time passwords for the users
+        $this->userPasswords = [];
+    }
+
+    /**
+     * start to encrypt all files
+     */
+    public function encryptAll(InputInterface $input, OutputInterface $output): void {
+        $this->input = $input;
+        $this->output = $output;
+
+        $headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME;
+        $this->output->writeln("\n");
+        $this->output->writeln($headline);
+        $this->output->writeln(str_pad('', strlen($headline), '='));
+        $this->output->writeln("\n");
+
+        if ($this->util->isMasterKeyEnabled()) {
+            $this->output->writeln('Use master key to encrypt all files.');
+            $this->keyManager->validateMasterKey();
+        } else {
+            //create private/public keys for each user and store the private key password
+            $this->output->writeln('Create key-pair for every user');
+            $this->output->writeln('------------------------------');
+            $this->output->writeln('');
+            $this->output->writeln('This module will encrypt all files in the users files folder initially.');
+            $this->output->writeln('Already existing versions and files in the trash bin will not be encrypted.');
+            $this->output->writeln('');
+            $this->createKeyPairs();
+        }
+
+
+        // output generated encryption key passwords
+        if ($this->util->isMasterKeyEnabled() === false) {
+            //send-out or display password list and write it to a file
+            $this->output->writeln("\n");
+            $this->output->writeln('Generated encryption key passwords');
+            $this->output->writeln('----------------------------------');
+            $this->output->writeln('');
+            $this->outputPasswords();
+        }
+
+        //setup users file system and encrypt all files one by one (take should encrypt setting of storage into account)
+        $this->output->writeln("\n");
+        $this->output->writeln('Start to encrypt users files');
+        $this->output->writeln('----------------------------');
+        $this->output->writeln('');
+        $this->encryptAllUsersFiles();
+        $this->output->writeln("\n");
+    }
+
+    /**
+     * create key-pair for every user
+     */
+    protected function createKeyPairs(): void {
+        $this->output->writeln("\n");
+        $progress = new ProgressBar($this->output);
+        $progress->setFormat(" %message% \n [%bar%]");
+        $progress->start();
+
+        foreach ($this->userManager->getBackends() as $backend) {
+            $limit = 500;
+            $offset = 0;
+            do {
+                $users = $backend->getUsers('', $limit, $offset);
+                foreach ($users as $user) {
+                    if ($this->keyManager->userHasKeys($user) === false) {
+                        $progress->setMessage('Create key-pair for ' . $user);
+                        $progress->advance();
+                        $this->setupUserFS($user);
+                        $password = $this->generateOneTimePassword($user);
+                        $this->userSetup->setupUser($user, $password);
+                    } else {
+                        // users which already have a key-pair will be stored with a
+                        // empty password and filtered out later
+                        $this->userPasswords[$user] = '';
+                    }
+                }
+                $offset += $limit;
+            } while (count($users) >= $limit);
+        }
+
+        $progress->setMessage('Key-pair created for all users');
+        $progress->finish();
+    }
+
+    /**
+     * iterate over all user and encrypt their files
+     */
+    protected function encryptAllUsersFiles(): void {
+        $this->output->writeln("\n");
+        $progress = new ProgressBar($this->output);
+        $progress->setFormat(" %message% \n [%bar%]");
+        $progress->start();
+        $numberOfUsers = count($this->userPasswords);
+        $userNo = 1;
+        if ($this->util->isMasterKeyEnabled()) {
+            $this->encryptAllUserFilesWithMasterKey($progress);
+        } else {
+            foreach ($this->userPasswords as $uid => $password) {
+                $userCount = "$uid ($userNo of $numberOfUsers)";
+                $this->encryptUsersFiles($uid, $progress, $userCount);
+                $userNo++;
+            }
+        }
+        $progress->setMessage('all files encrypted');
+        $progress->finish();
+    }
+
+    /**
+     * encrypt all user files with the master key
+     */
+    protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress): void {
+        $userNo = 1;
+        foreach ($this->userManager->getBackends() as $backend) {
+            $limit = 500;
+            $offset = 0;
+            do {
+                $users = $backend->getUsers('', $limit, $offset);
+                foreach ($users as $user) {
+                    $userCount = "$user ($userNo)";
+                    $this->encryptUsersFiles($user, $progress, $userCount);
+                    $userNo++;
+                }
+                $offset += $limit;
+            } while (count($users) >= $limit);
+        }
+    }
+
+    /**
+     * encrypt files from the given user
+     */
+    protected function encryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
+        $this->setupUserFS($uid);
+        $directories = [];
+        $directories[] = '/' . $uid . '/files';
+
+        while ($root = array_pop($directories)) {
+            $content = $this->rootView->getDirectoryContent($root);
+            foreach ($content as $file) {
+                $path = $root . '/' . $file->getName();
+                if ($file->isShared()) {
+                    $progress->setMessage("Skip shared file/folder $path");
+                    $progress->advance();
+                    continue;
+                } elseif ($file->getType() === FileInfo::TYPE_FOLDER) {
+                    $directories[] = $path;
+                    continue;
+                } else {
+                    $progress->setMessage("encrypt files for user $userCount: $path");
+                    $progress->advance();
+                    try {
+                        if ($this->encryptFile($file, $path) === false) {
+                            $progress->setMessage("encrypt files for user $userCount: $path (already encrypted)");
+                            $progress->advance();
+                        }
+                    } catch (\Exception $e) {
+                        $progress->setMessage("Failed to encrypt path $path: " . $e->getMessage());
+                        $progress->advance();
+                        $this->logger->error(
+                            'Failed to encrypt path {path}',
+                            [
+                                'user' => $uid,
+                                'path' => $path,
+                                'exception' => $e,
+                            ]
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    protected function encryptFile(FileInfo $fileInfo, string $path): bool {
+        // skip already encrypted files
+        if ($fileInfo->isEncrypted()) {
+            return true;
+        }
+
+        $source = $path;
+        $target = $path . '.encrypted.' . time();
+
+        try {
+            $copySuccess = $this->rootView->copy($source, $target);
+            if ($copySuccess === false) {
+                /* Copy failed, abort */
+                if ($this->rootView->file_exists($target)) {
+                    $this->rootView->unlink($target);
+                }
+                throw new \Exception('Copy failed for ' . $source);
+            }
+            $this->rootView->rename($target, $source);
+        } catch (DecryptionFailedException $e) {
+            if ($this->rootView->file_exists($target)) {
+                $this->rootView->unlink($target);
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * output one-time encryption passwords
+     */
+    protected function outputPasswords(): void {
+        $table = new Table($this->output);
+        $table->setHeaders(['Username', 'Private key password']);
+
+        //create rows
+        $newPasswords = [];
+        $unchangedPasswords = [];
+        foreach ($this->userPasswords as $uid => $password) {
+            if (empty($password)) {
+                $unchangedPasswords[] = $uid;
+            } else {
+                $newPasswords[] = [$uid, $password];
+            }
+        }
+
+        if (empty($newPasswords)) {
+            $this->output->writeln("\nAll users already had a key-pair, no further action needed.\n");
+            return;
+        }
+
+        $table->setRows($newPasswords);
+        $table->render();
+
+        if (!empty($unchangedPasswords)) {
+            $this->output->writeln("\nThe following users already had a key-pair which was reused without setting a new password:\n");
+            foreach ($unchangedPasswords as $uid) {
+                $this->output->writeln("    $uid");
+            }
+        }
+
+        $this->writePasswordsToFile($newPasswords);
+
+        $this->output->writeln('');
+        $question = new ConfirmationQuestion('Do you want to send the passwords directly to the users by mail? (y/n) ', false);
+        if ($this->questionHelper->ask($this->input, $this->output, $question)) {
+            $this->sendPasswordsByMail();
+        }
+    }
+
+    /**
+     * write one-time encryption passwords to a csv file
+     */
+    protected function writePasswordsToFile(array $passwords): void {
+        $fp = $this->rootView->fopen('oneTimeEncryptionPasswords.csv', 'w');
+        foreach ($passwords as $pwd) {
+            fputcsv($fp, $pwd);
+        }
+        fclose($fp);
+        $this->output->writeln("\n");
+        $this->output->writeln('A list of all newly created passwords was written to data/oneTimeEncryptionPasswords.csv');
+        $this->output->writeln('');
+        $this->output->writeln('Each of these users need to login to the web interface, go to the');
+        $this->output->writeln('personal settings section "basic encryption module" and');
+        $this->output->writeln('update the private key password to match the login password again by');
+        $this->output->writeln('entering the one-time password into the "old log-in password" field');
+        $this->output->writeln('and their current login password');
+    }
+
+    /**
+     * setup user file system
+     */
+    protected function setupUserFS(string $uid): void {
+        \OC_Util::tearDownFS();
+        \OC_Util::setupFS($uid);
+    }
+
+    /**
+     * generate one time password for the user and store it in a array
+     *
+     * @return string password
+     */
+    protected function generateOneTimePassword(string $uid): string {
+        $password = $this->secureRandom->generate(16, ISecureRandom::CHAR_HUMAN_READABLE);
+        $this->userPasswords[$uid] = $password;
+        return $password;
+    }
+
+    /**
+     * send encryption key passwords to the users by mail
+     */
+    protected function sendPasswordsByMail(): void {
+        $noMail = [];
+
+        $this->output->writeln('');
+        $progress = new ProgressBar($this->output, count($this->userPasswords));
+        $progress->start();
+
+        foreach ($this->userPasswords as $uid => $password) {
+            $progress->advance();
+            if (!empty($password)) {
+                $recipient = $this->userManager->get($uid);
+                if (!$recipient instanceof IUser) {
+                    continue;
+                }
+
+                $recipientDisplayName = $recipient->getDisplayName();
+                $to = $recipient->getEMailAddress();
+
+                if ($to === '' || $to === null) {
+                    $noMail[] = $uid;
+                    continue;
+                }
+
+                $l = $this->l10nFactory->get('encryption', $this->l10nFactory->getUserLanguage($recipient));
+
+                $template = $this->mailer->createEMailTemplate('encryption.encryptAllPassword', [
+                    'user' => $recipient->getUID(),
+                    'password' => $password,
+                ]);
+
+                $template->setSubject($l->t('one-time password for server-side-encryption'));
+                // 'Hey there,<br><br>The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.<br><br>
+                // Please login to the web interface, go to the section "Basic encryption module" of your personal settings and update your encryption password by entering this password into the "Old log-in password" field and your current login-password.<br><br>'
+                $template->addHeader();
+                $template->addHeading($l->t('Encryption password'));
+                $template->addBodyText(
+                    $l->t('The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.', [htmlspecialchars($password)]),
+                    $l->t('The administration enabled server-side-encryption. Your files were encrypted using the password "%s".', $password)
+                );
+                $template->addBodyText(
+                    $l->t('Please login to the web interface, go to the "Security" section of your personal settings and update your encryption password by entering this password into the "Old login password" field and your current login password.')
+                );
+                $template->addFooter();
+
+                // send it out now
+                try {
+                    $message = $this->mailer->createMessage();
+                    $message->setTo([$to => $recipientDisplayName]);
+                    $message->useTemplate($template);
+                    $message->setAutoSubmitted(AutoSubmitted::VALUE_AUTO_GENERATED);
+                    $this->mailer->send($message);
+                } catch (\Exception $e) {
+                    $noMail[] = $uid;
+                }
+            }
+        }
+
+        $progress->finish();
+
+        if (empty($noMail)) {
+            $this->output->writeln("\n\nPassword successfully send to all users");
+        } else {
+            $table = new Table($this->output);
+            $table->setHeaders(['Username', 'Private key password']);
+            $this->output->writeln("\n\nCould not send password to following users:\n");
+            $rows = [];
+            foreach ($noMail as $uid) {
+                $rows[] = [$uid, $this->userPasswords[$uid]];
+            }
+            $table->setRows($rows);
+            $table->render();
+        }
+    }
 }

Spacing +7 added lines, -7 removed lines

@@ -68,7 +68,7 @@ 
 		$this->input = $input;
 		$this->output = $output;
 
-		$headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME;
+		$headline = 'Encrypt all files with the '.Encryption::DISPLAY_NAME;
 		$this->output->writeln("\n");
 		$this->output->writeln($headline);
 		$this->output->writeln(str_pad('', strlen($headline), '='));
@@ -124,7 +124,7 @@ 
 				$users = $backend->getUsers('', $limit, $offset);
 				foreach ($users as $user) {
 					if ($this->keyManager->userHasKeys($user) === false) {
-						$progress->setMessage('Create key-pair for ' . $user);
+						$progress->setMessage('Create key-pair for '.$user);
 						$progress->advance();
 						$this->setupUserFS($user);
 						$password = $this->generateOneTimePassword($user);
@@ -192,12 +192,12 @@ 
 	protected function encryptUsersFiles(string $uid, ProgressBar $progress, string $userCount): void {
 		$this->setupUserFS($uid);
 		$directories = [];
-		$directories[] = '/' . $uid . '/files';
+		$directories[] = '/'.$uid.'/files';
 
 		while ($root = array_pop($directories)) {
 			$content = $this->rootView->getDirectoryContent($root);
 			foreach ($content as $file) {
-				$path = $root . '/' . $file->getName();
+				$path = $root.'/'.$file->getName();
 				if ($file->isShared()) {
 					$progress->setMessage("Skip shared file/folder $path");
 					$progress->advance();
@@ -214,7 +214,7 @@ 
 							$progress->advance();
 						}
 					} catch (\Exception $e) {
-						$progress->setMessage("Failed to encrypt path $path: " . $e->getMessage());
+						$progress->setMessage("Failed to encrypt path $path: ".$e->getMessage());
 						$progress->advance();
 						$this->logger->error(
 							'Failed to encrypt path {path}',
@@ -237,7 +237,7 @@ 
 		}
 
 		$source = $path;
-		$target = $path . '.encrypted.' . time();
+		$target = $path.'.encrypted.'.time();
 
 		try {
 			$copySuccess = $this->rootView->copy($source, $target);
@@ -246,7 +246,7 @@ 
 				if ($this->rootView->file_exists($target)) {
 					$this->rootView->unlink($target);
 				}
-				throw new \Exception('Copy failed for ' . $source);
+				throw new \Exception('Copy failed for '.$source);
 			}
 			$this->rootView->rename($target, $source);
 		} catch (DecryptionFailedException $e) {

apps/encryption/lib/Crypto/Crypt.php

Indentation +777 added lines, -777 removed lines

@@ -34,781 +34,781 @@
  * @package OCA\Encryption\Crypto
  */
 class Crypt {
-	public const SUPPORTED_CIPHERS_AND_KEY_SIZE = [
-		'AES-256-CTR' => 32,
-		'AES-128-CTR' => 16,
-		'AES-256-CFB' => 32,
-		'AES-128-CFB' => 16,
-	];
-	// one out of SUPPORTED_CIPHERS_AND_KEY_SIZE
-	public const DEFAULT_CIPHER = 'AES-256-CTR';
-	// default cipher from old Nextcloud versions
-	public const LEGACY_CIPHER = 'AES-128-CFB';
-
-	public const SUPPORTED_KEY_FORMATS = ['hash2', 'hash', 'password'];
-	// one out of SUPPORTED_KEY_FORMATS
-	public const DEFAULT_KEY_FORMAT = 'hash2';
-	// default key format, old Nextcloud version encrypted the private key directly
-	// with the user password
-	public const LEGACY_KEY_FORMAT = 'password';
-
-	public const HEADER_START = 'HBEGIN';
-	public const HEADER_END = 'HEND';
-
-	// default encoding format, old Nextcloud versions used base64
-	public const BINARY_ENCODING_FORMAT = 'binary';
-
-	private string $user;
-
-	private ?string $currentCipher = null;
-
-	private bool $supportLegacy;
-
-	/**
-	 * Use the legacy base64 encoding instead of the more space-efficient binary encoding.
-	 */
-	private bool $useLegacyBase64Encoding;
-
-	public function __construct(
-		private LoggerInterface $logger,
-		IUserSession $userSession,
-		private IConfig $config,
-		private IL10N $l,
-	) {
-		$this->user = $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : '"no user given"';
-		$this->supportLegacy = $this->config->getSystemValueBool('encryption.legacy_format_support', false);
-		$this->useLegacyBase64Encoding = $this->config->getSystemValueBool('encryption.use_legacy_base64_encoding', false);
-	}
-
-	/**
-	 * create new private/public key-pair for user
-	 *
-	 * @return array{publicKey: string, privateKey: string}|false
-	 */
-	public function createKeyPair() {
-		$res = $this->getOpenSSLPKey();
-
-		if (!$res) {
-			$this->logger->error("Encryption Library couldn't generate users key-pair for {$this->user}",
-				['app' => 'encryption']);
-
-			if (openssl_error_string()) {
-				$this->logger->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
-					['app' => 'encryption']);
-			}
-		} elseif (openssl_pkey_export($res,
-			$privateKey,
-			null,
-			$this->getOpenSSLConfig())) {
-			$keyDetails = openssl_pkey_get_details($res);
-			$publicKey = $keyDetails['key'];
-
-			return [
-				'publicKey' => $publicKey,
-				'privateKey' => $privateKey
-			];
-		}
-		$this->logger->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
-			['app' => 'encryption']);
-		if (openssl_error_string()) {
-			$this->logger->error('Encryption Library:' . openssl_error_string(),
-				['app' => 'encryption']);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Generates a new private key
-	 *
-	 * @return \OpenSSLAsymmetricKey|false
-	 */
-	public function getOpenSSLPKey() {
-		$config = $this->getOpenSSLConfig();
-		return openssl_pkey_new($config);
-	}
-
-	private function getOpenSSLConfig(): array {
-		$config = ['private_key_bits' => 4096];
-		$config = array_merge(
-			$config,
-			$this->config->getSystemValue('openssl', [])
-		);
-		return $config;
-	}
-
-	/**
-	 * @throws EncryptionFailedException
-	 */
-	public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string|false {
-		if (!$plainContent) {
-			$this->logger->error('Encryption Library, symmetrical encryption failed no content given',
-				['app' => 'encryption']);
-			return false;
-		}
-
-		$iv = $this->generateIv();
-
-		$encryptedContent = $this->encrypt($plainContent,
-			$iv,
-			$passPhrase,
-			$this->getCipher());
-
-		// Create a signature based on the key as well as the current version
-		$sig = $this->createSignature($encryptedContent, $passPhrase . '_' . $version . '_' . $position);
-
-		// combine content to encrypt the IV identifier and actual IV
-		$catFile = $this->concatIV($encryptedContent, $iv);
-		$catFile = $this->concatSig($catFile, $sig);
-		return $this->addPadding($catFile);
-	}
-
-	/**
-	 * generate header for encrypted file
-	 *
-	 * @param string $keyFormat see SUPPORTED_KEY_FORMATS
-	 * @return string
-	 * @throws \InvalidArgumentException
-	 */
-	public function generateHeader($keyFormat = self::DEFAULT_KEY_FORMAT) {
-		if (in_array($keyFormat, self::SUPPORTED_KEY_FORMATS, true) === false) {
-			throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
-		}
-
-		$header = self::HEADER_START
-			. ':cipher:' . $this->getCipher()
-			. ':keyFormat:' . $keyFormat;
-
-		if ($this->useLegacyBase64Encoding !== true) {
-			$header .= ':encoding:' . self::BINARY_ENCODING_FORMAT;
-		}
-
-		$header .= ':' . self::HEADER_END;
-
-		return $header;
-	}
-
-	/**
-	 * @throws EncryptionFailedException
-	 */
-	private function encrypt(string $plainContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER): string {
-		$options = $this->useLegacyBase64Encoding ? 0 : OPENSSL_RAW_DATA;
-		$encryptedContent = openssl_encrypt($plainContent,
-			$cipher,
-			$passPhrase,
-			$options,
-			$iv);
-
-		if (!$encryptedContent) {
-			$error = 'Encryption (symmetric) of content failed';
-			$this->logger->error($error . openssl_error_string(),
-				['app' => 'encryption']);
-			throw new EncryptionFailedException($error);
-		}
-
-		return $encryptedContent;
-	}
-
-	/**
-	 * return cipher either from config.php or the default cipher defined in
-	 * this class
-	 */
-	private function getCachedCipher(): string {
-		if (isset($this->currentCipher)) {
-			return $this->currentCipher;
-		}
-
-		// Get cipher either from config.php or the default cipher defined in this class
-		$cipher = $this->config->getSystemValueString('cipher', self::DEFAULT_CIPHER);
-		if (!isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
-			$this->logger->warning(
-				sprintf(
-					'Unsupported cipher (%s) defined in config.php supported. Falling back to %s',
-					$cipher,
-					self::DEFAULT_CIPHER
-				),
-				['app' => 'encryption']
-			);
-			$cipher = self::DEFAULT_CIPHER;
-		}
-
-		// Remember current cipher to avoid frequent lookups
-		$this->currentCipher = $cipher;
-		return $this->currentCipher;
-	}
-
-	/**
-	 * return current encryption cipher
-	 *
-	 * @return string
-	 */
-	public function getCipher() {
-		return $this->getCachedCipher();
-	}
-
-	/**
-	 * get key size depending on the cipher
-	 *
-	 * @param string $cipher
-	 * @return int
-	 * @throws \InvalidArgumentException
-	 */
-	protected function getKeySize($cipher) {
-		if (isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
-			return self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher];
-		}
-
-		throw new \InvalidArgumentException(
-			sprintf(
-				'Unsupported cipher (%s) defined.',
-				$cipher
-			)
-		);
-	}
-
-	/**
-	 * get legacy cipher
-	 *
-	 * @return string
-	 */
-	public function getLegacyCipher() {
-		if (!$this->supportLegacy) {
-			throw new ServerNotAvailableException('Legacy cipher is no longer supported!');
-		}
-
-		return self::LEGACY_CIPHER;
-	}
-
-	private function concatIV(string $encryptedContent, string $iv): string {
-		return $encryptedContent . '00iv00' . $iv;
-	}
-
-	private function concatSig(string $encryptedContent, string $signature): string {
-		return $encryptedContent . '00sig00' . $signature;
-	}
-
-	/**
-	 * Note: This is _NOT_ a padding used for encryption purposes. It is solely
-	 * used to achieve the PHP stream size. It has _NOTHING_ to do with the
-	 * encrypted content and is not used in any crypto primitive.
-	 */
-	private function addPadding(string $data): string {
-		return $data . 'xxx';
-	}
-
-	/**
-	 * generate password hash used to encrypt the users private key
-	 *
-	 * @param string $uid only used for user keys
-	 */
-	protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
-		$instanceId = $this->config->getSystemValue('instanceid');
-		$instanceSecret = $this->config->getSystemValue('secret');
-		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
-		$keySize = $this->getKeySize($cipher);
-
-		return hash_pbkdf2(
-			'sha256',
-			$password,
-			$salt,
-			$iterations,
-			$keySize,
-			true
-		);
-	}
-
-	/**
-	 * encrypt private key
-	 *
-	 * @param string $privateKey
-	 * @param string $password
-	 * @param string $uid for regular users, empty for system keys
-	 * @return false|string
-	 */
-	public function encryptPrivateKey($privateKey, $password, $uid = '') {
-		$cipher = $this->getCipher();
-		$hash = $this->generatePasswordHash($password, $cipher, $uid);
-		$encryptedKey = $this->symmetricEncryptFileContent(
-			$privateKey,
-			$hash,
-			0,
-			'0'
-		);
-
-		return $encryptedKey;
-	}
-
-	/**
-	 * @param string $privateKey
-	 * @param string $password
-	 * @param string $uid for regular users, empty for system keys
-	 */
-	public function decryptPrivateKey($privateKey, $password = '', $uid = '') : string|false {
-		$header = $this->parseHeader($privateKey);
-
-		if (isset($header['cipher'])) {
-			$cipher = $header['cipher'];
-		} else {
-			$cipher = $this->getLegacyCipher();
-		}
-
-		if (isset($header['keyFormat'])) {
-			$keyFormat = $header['keyFormat'];
-		} else {
-			$keyFormat = self::LEGACY_KEY_FORMAT;
-		}
-
-		if ($keyFormat === 'hash') {
-			$password = $this->generatePasswordHash($password, $cipher, $uid, 100000);
-		} elseif ($keyFormat === 'hash2') {
-			$password = $this->generatePasswordHash($password, $cipher, $uid, 600000);
-		}
-
-		$binaryEncoding = isset($header['encoding']) && $header['encoding'] === self::BINARY_ENCODING_FORMAT;
-
-		// If we found a header we need to remove it from the key we want to decrypt
-		if (!empty($header)) {
-			$privateKey = substr($privateKey,
-				strpos($privateKey,
-					self::HEADER_END) + strlen(self::HEADER_END));
-		}
-
-		$plainKey = $this->symmetricDecryptFileContent(
-			$privateKey,
-			$password,
-			$cipher,
-			0,
-			0,
-			$binaryEncoding
-		);
-
-		if ($this->isValidPrivateKey($plainKey) === false) {
-			return false;
-		}
-
-		return $plainKey;
-	}
-
-	/**
-	 * check if it is a valid private key
-	 *
-	 * @param string $plainKey
-	 * @return bool
-	 */
-	protected function isValidPrivateKey($plainKey) {
-		$res = openssl_get_privatekey($plainKey);
-		if (is_object($res) && get_class($res) === 'OpenSSLAsymmetricKey') {
-			$sslInfo = openssl_pkey_get_details($res);
-			if (isset($sslInfo['key'])) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param string $keyFileContents
-	 * @param string $passPhrase
-	 * @param string $cipher
-	 * @param int $version
-	 * @param int|string $position
-	 * @param boolean $binaryEncoding
-	 * @return string
-	 * @throws DecryptionFailedException
-	 */
-	public function symmetricDecryptFileContent($keyFileContents, $passPhrase, $cipher = self::DEFAULT_CIPHER, $version = 0, $position = 0, bool $binaryEncoding = false) {
-		if ($keyFileContents == '') {
-			return '';
-		}
-
-		$catFile = $this->splitMetaData($keyFileContents, $cipher);
-
-		if ($catFile['signature'] !== false) {
-			try {
-				// First try the new format
-				$this->checkSignature($catFile['encrypted'], $passPhrase . '_' . $version . '_' . $position, $catFile['signature']);
-			} catch (GenericEncryptionException $e) {
-				// For compatibility with old files check the version without _
-				$this->checkSignature($catFile['encrypted'], $passPhrase . $version . $position, $catFile['signature']);
-			}
-		}
-
-		return $this->decrypt($catFile['encrypted'],
-			$catFile['iv'],
-			$passPhrase,
-			$cipher,
-			$binaryEncoding);
-	}
-
-	/**
-	 * check for valid signature
-	 *
-	 * @throws GenericEncryptionException
-	 */
-	private function checkSignature(string $data, string $passPhrase, string $expectedSignature): void {
-		$enforceSignature = !$this->config->getSystemValueBool('encryption_skip_signature_check', false);
-
-		$signature = $this->createSignature($data, $passPhrase);
-		$isCorrectHash = hash_equals($expectedSignature, $signature);
-
-		if (!$isCorrectHash) {
-			if ($enforceSignature) {
-				throw new GenericEncryptionException('Bad Signature', $this->l->t('Bad Signature'));
-			} else {
-				$this->logger->info('Signature check skipped', ['app' => 'encryption']);
-			}
-		}
-	}
-
-	/**
-	 * create signature
-	 */
-	private function createSignature(string $data, string $passPhrase): string {
-		$passPhrase = hash('sha512', $passPhrase . 'a', true);
-		return hash_hmac('sha256', $data, $passPhrase);
-	}
-
-
-	/**
-	 * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
-	 */
-	private function removePadding(string $padded, bool $hasSignature = false): string|false {
-		if ($hasSignature === false && substr($padded, -2) === 'xx') {
-			return substr($padded, 0, -2);
-		} elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
-			return substr($padded, 0, -3);
-		}
-		return false;
-	}
-
-	/**
-	 * split meta data from encrypted file
-	 * Note: for now, we assume that the meta data always start with the iv
-	 *       followed by the signature, if available
-	 */
-	private function splitMetaData(string $catFile, string $cipher): array {
-		if ($this->hasSignature($catFile, $cipher)) {
-			$catFile = $this->removePadding($catFile, true);
-			$meta = substr($catFile, -93);
-			$iv = substr($meta, strlen('00iv00'), 16);
-			$sig = substr($meta, 22 + strlen('00sig00'));
-			$encrypted = substr($catFile, 0, -93);
-		} else {
-			$catFile = $this->removePadding($catFile);
-			$meta = substr($catFile, -22);
-			$iv = substr($meta, -16);
-			$sig = false;
-			$encrypted = substr($catFile, 0, -22);
-		}
-
-		return [
-			'encrypted' => $encrypted,
-			'iv' => $iv,
-			'signature' => $sig
-		];
-	}
-
-	/**
-	 * check if encrypted block is signed
-	 *
-	 * @throws GenericEncryptionException
-	 */
-	private function hasSignature(string $catFile, string $cipher): bool {
-		$skipSignatureCheck = $this->config->getSystemValueBool('encryption_skip_signature_check', false);
-
-		$meta = substr($catFile, -93);
-		$signaturePosition = strpos($meta, '00sig00');
-
-		// If we no longer support the legacy format then everything needs a signature
-		if (!$skipSignatureCheck && !$this->supportLegacy && $signaturePosition === false) {
-			throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
-		}
-
-		// Enforce signature for the new 'CTR' ciphers
-		if (!$skipSignatureCheck && $signaturePosition === false && stripos($cipher, 'ctr') !== false) {
-			throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
-		}
-
-		return ($signaturePosition !== false);
-	}
-
-
-	/**
-	 * @throws DecryptionFailedException
-	 */
-	private function decrypt(string $encryptedContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER, bool $binaryEncoding = false): string {
-		$options = $binaryEncoding === true ? OPENSSL_RAW_DATA : 0;
-		$plainContent = openssl_decrypt($encryptedContent,
-			$cipher,
-			$passPhrase,
-			$options,
-			$iv);
-
-		if ($plainContent) {
-			return $plainContent;
-		} else {
-			throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * @param string $data
-	 * @return array
-	 */
-	protected function parseHeader($data) {
-		$result = [];
-
-		if (substr($data, 0, strlen(self::HEADER_START)) === self::HEADER_START) {
-			$endAt = strpos($data, self::HEADER_END);
-			$header = substr($data, 0, $endAt + strlen(self::HEADER_END));
-
-			// +1 not to start with an ':' which would result in empty element at the beginning
-			$exploded = explode(':',
-				substr($header, strlen(self::HEADER_START) + 1));
-
-			$element = array_shift($exploded);
-
-			while ($element !== self::HEADER_END) {
-				$result[$element] = array_shift($exploded);
-				$element = array_shift($exploded);
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * generate initialization vector
-	 *
-	 * @throws GenericEncryptionException
-	 */
-	private function generateIv(): string {
-		return random_bytes(16);
-	}
-
-	/**
-	 * Generate a cryptographically secure pseudo-random 256-bit ASCII key, used
-	 * as file key
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function generateFileKey() {
-		return random_bytes(32);
-	}
-
-	/**
-	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
-	 * @throws MultiKeyDecryptException
-	 */
-	public function multiKeyDecrypt(string $shareKey, $privateKey): string {
-		$plainContent = '';
-
-		// decrypt the intermediate key with RSA
-		if (openssl_private_decrypt($shareKey, $intermediate, $privateKey, OPENSSL_PKCS1_OAEP_PADDING)) {
-			return $intermediate;
-		} else {
-			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
-	 * @throws MultiKeyDecryptException
-	 */
-	public function multiKeyDecryptLegacy(string $encKeyFile, string $shareKey, $privateKey): string {
-		if (!$encKeyFile) {
-			throw new MultiKeyDecryptException('Cannot multikey decrypt empty plain content');
-		}
-
-		$plainContent = '';
-		if ($this->opensslOpen($encKeyFile, $plainContent, $shareKey, $privateKey, 'RC4')) {
-			return $plainContent;
-		} else {
-			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * @param array<string,\OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string> $keyFiles
-	 * @throws MultiKeyEncryptException
-	 */
-	public function multiKeyEncrypt(string $plainContent, array $keyFiles): array {
-		if (empty($plainContent)) {
-			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
-		}
-
-		// Set empty vars to be set by openssl by reference
-		$shareKeys = [];
-		$mappedShareKeys = [];
-
-		// make sure that there is at least one public key to use
-		if (count($keyFiles) >= 1) {
-			// prepare the encrypted keys
-			$shareKeys = [];
-
-			// iterate over the public keys and encrypt the intermediate
-			// for each of them with RSA
-			foreach ($keyFiles as $tmp_key) {
-				if (openssl_public_encrypt($plainContent, $tmp_output, $tmp_key, OPENSSL_PKCS1_OAEP_PADDING)) {
-					$shareKeys[] = $tmp_output;
-				}
-			}
-
-			// set the result if everything worked fine
-			if (count($keyFiles) === count($shareKeys)) {
-				$i = 0;
-
-				// Ensure each shareKey is labelled with its corresponding key id
-				foreach ($keyFiles as $userId => $publicKey) {
-					$mappedShareKeys[$userId] = $shareKeys[$i];
-					$i++;
-				}
-
-				return $mappedShareKeys;
-			}
-		}
-		throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
-	}
-
-	/**
-	 * @param string $plainContent
-	 * @param array $keyFiles
-	 * @return array
-	 * @throws MultiKeyEncryptException
-	 * @deprecated 27.0.0 use multiKeyEncrypt
-	 */
-	public function multiKeyEncryptLegacy($plainContent, array $keyFiles) {
-		// openssl_seal returns false without errors if plaincontent is empty
-		// so trigger our own error
-		if (empty($plainContent)) {
-			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
-		}
-
-		// Set empty vars to be set by openssl by reference
-		$sealed = '';
-		$shareKeys = [];
-		$mappedShareKeys = [];
-
-		if ($this->opensslSeal($plainContent, $sealed, $shareKeys, $keyFiles, 'RC4')) {
-			$i = 0;
-
-			// Ensure each shareKey is labelled with its corresponding key id
-			foreach ($keyFiles as $userId => $publicKey) {
-				$mappedShareKeys[$userId] = $shareKeys[$i];
-				$i++;
-			}
-
-			return [
-				'keys' => $mappedShareKeys,
-				'data' => $sealed
-			];
-		} else {
-			throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * returns the value of $useLegacyBase64Encoding
-	 *
-	 * @return bool
-	 */
-	public function useLegacyBase64Encoding(): bool {
-		return $this->useLegacyBase64Encoding;
-	}
-
-	/**
-	 * Uses phpseclib RC4 implementation
-	 */
-	private function rc4Decrypt(string $data, string $secret): string {
-		$rc4 = new RC4();
-		/** @psalm-suppress InternalMethod */
-		$rc4->setKey($secret);
-
-		return $rc4->decrypt($data);
-	}
-
-	/**
-	 * Uses phpseclib RC4 implementation
-	 */
-	private function rc4Encrypt(string $data, string $secret): string {
-		$rc4 = new RC4();
-		/** @psalm-suppress InternalMethod */
-		$rc4->setKey($secret);
-
-		return $rc4->encrypt($data);
-	}
-
-	/**
-	 * Custom implementation of openssl_open()
-	 *
-	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $private_key
-	 * @throws DecryptionFailedException
-	 */
-	private function opensslOpen(string $data, string &$output, string $encrypted_key, $private_key, string $cipher_algo): bool {
-		$result = false;
-
-		// check if RC4 is used
-		if (strcasecmp($cipher_algo, 'rc4') === 0) {
-			// decrypt the intermediate key with RSA
-			if (openssl_private_decrypt($encrypted_key, $intermediate, $private_key, OPENSSL_PKCS1_PADDING)) {
-				// decrypt the file key with the intermediate key
-				// using our own RC4 implementation
-				$output = $this->rc4Decrypt($data, $intermediate);
-				$result = (strlen($output) === strlen($data));
-			}
-		} else {
-			throw new DecryptionFailedException('Unsupported cipher ' . $cipher_algo);
-		}
-
-		return $result;
-	}
-
-	/**
-	 * Custom implementation of openssl_seal()
-	 *
-	 * @deprecated 27.0.0 use multiKeyEncrypt
-	 * @throws EncryptionFailedException
-	 */
-	private function opensslSeal(string $data, string &$sealed_data, array &$encrypted_keys, array $public_key, string $cipher_algo): int|false {
-		$result = false;
-
-		// check if RC4 is used
-		if (strcasecmp($cipher_algo, 'rc4') === 0) {
-			// make sure that there is at least one public key to use
-			if (count($public_key) >= 1) {
-				// generate the intermediate key
-				$intermediate = openssl_random_pseudo_bytes(16, $strong_result);
-
-				// check if we got strong random data
-				if ($strong_result) {
-					// encrypt the file key with the intermediate key
-					// using our own RC4 implementation
-					$sealed_data = $this->rc4Encrypt($data, $intermediate);
-					if (strlen($sealed_data) === strlen($data)) {
-						// prepare the encrypted keys
-						$encrypted_keys = [];
-
-						// iterate over the public keys and encrypt the intermediate
-						// for each of them with RSA
-						foreach ($public_key as $tmp_key) {
-							if (openssl_public_encrypt($intermediate, $tmp_output, $tmp_key, OPENSSL_PKCS1_PADDING)) {
-								$encrypted_keys[] = $tmp_output;
-							}
-						}
-
-						// set the result if everything worked fine
-						if (count($public_key) === count($encrypted_keys)) {
-							$result = strlen($sealed_data);
-						}
-					}
-				}
-			}
-		} else {
-			throw new EncryptionFailedException('Unsupported cipher ' . $cipher_algo);
-		}
-
-		return $result;
-	}
+    public const SUPPORTED_CIPHERS_AND_KEY_SIZE = [
+        'AES-256-CTR' => 32,
+        'AES-128-CTR' => 16,
+        'AES-256-CFB' => 32,
+        'AES-128-CFB' => 16,
+    ];
+    // one out of SUPPORTED_CIPHERS_AND_KEY_SIZE
+    public const DEFAULT_CIPHER = 'AES-256-CTR';
+    // default cipher from old Nextcloud versions
+    public const LEGACY_CIPHER = 'AES-128-CFB';
+
+    public const SUPPORTED_KEY_FORMATS = ['hash2', 'hash', 'password'];
+    // one out of SUPPORTED_KEY_FORMATS
+    public const DEFAULT_KEY_FORMAT = 'hash2';
+    // default key format, old Nextcloud version encrypted the private key directly
+    // with the user password
+    public const LEGACY_KEY_FORMAT = 'password';
+
+    public const HEADER_START = 'HBEGIN';
+    public const HEADER_END = 'HEND';
+
+    // default encoding format, old Nextcloud versions used base64
+    public const BINARY_ENCODING_FORMAT = 'binary';
+
+    private string $user;
+
+    private ?string $currentCipher = null;
+
+    private bool $supportLegacy;
+
+    /**
+     * Use the legacy base64 encoding instead of the more space-efficient binary encoding.
+     */
+    private bool $useLegacyBase64Encoding;
+
+    public function __construct(
+        private LoggerInterface $logger,
+        IUserSession $userSession,
+        private IConfig $config,
+        private IL10N $l,
+    ) {
+        $this->user = $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : '"no user given"';
+        $this->supportLegacy = $this->config->getSystemValueBool('encryption.legacy_format_support', false);
+        $this->useLegacyBase64Encoding = $this->config->getSystemValueBool('encryption.use_legacy_base64_encoding', false);
+    }
+
+    /**
+     * create new private/public key-pair for user
+     *
+     * @return array{publicKey: string, privateKey: string}|false
+     */
+    public function createKeyPair() {
+        $res = $this->getOpenSSLPKey();
+
+        if (!$res) {
+            $this->logger->error("Encryption Library couldn't generate users key-pair for {$this->user}",
+                ['app' => 'encryption']);
+
+            if (openssl_error_string()) {
+                $this->logger->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
+                    ['app' => 'encryption']);
+            }
+        } elseif (openssl_pkey_export($res,
+            $privateKey,
+            null,
+            $this->getOpenSSLConfig())) {
+            $keyDetails = openssl_pkey_get_details($res);
+            $publicKey = $keyDetails['key'];
+
+            return [
+                'publicKey' => $publicKey,
+                'privateKey' => $privateKey
+            ];
+        }
+        $this->logger->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
+            ['app' => 'encryption']);
+        if (openssl_error_string()) {
+            $this->logger->error('Encryption Library:' . openssl_error_string(),
+                ['app' => 'encryption']);
+        }
+
+        return false;
+    }
+
+    /**
+     * Generates a new private key
+     *
+     * @return \OpenSSLAsymmetricKey|false
+     */
+    public function getOpenSSLPKey() {
+        $config = $this->getOpenSSLConfig();
+        return openssl_pkey_new($config);
+    }
+
+    private function getOpenSSLConfig(): array {
+        $config = ['private_key_bits' => 4096];
+        $config = array_merge(
+            $config,
+            $this->config->getSystemValue('openssl', [])
+        );
+        return $config;
+    }
+
+    /**
+     * @throws EncryptionFailedException
+     */
+    public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string|false {
+        if (!$plainContent) {
+            $this->logger->error('Encryption Library, symmetrical encryption failed no content given',
+                ['app' => 'encryption']);
+            return false;
+        }
+
+        $iv = $this->generateIv();
+
+        $encryptedContent = $this->encrypt($plainContent,
+            $iv,
+            $passPhrase,
+            $this->getCipher());
+
+        // Create a signature based on the key as well as the current version
+        $sig = $this->createSignature($encryptedContent, $passPhrase . '_' . $version . '_' . $position);
+
+        // combine content to encrypt the IV identifier and actual IV
+        $catFile = $this->concatIV($encryptedContent, $iv);
+        $catFile = $this->concatSig($catFile, $sig);
+        return $this->addPadding($catFile);
+    }
+
+    /**
+     * generate header for encrypted file
+     *
+     * @param string $keyFormat see SUPPORTED_KEY_FORMATS
+     * @return string
+     * @throws \InvalidArgumentException
+     */
+    public function generateHeader($keyFormat = self::DEFAULT_KEY_FORMAT) {
+        if (in_array($keyFormat, self::SUPPORTED_KEY_FORMATS, true) === false) {
+            throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
+        }
+
+        $header = self::HEADER_START
+            . ':cipher:' . $this->getCipher()
+            . ':keyFormat:' . $keyFormat;
+
+        if ($this->useLegacyBase64Encoding !== true) {
+            $header .= ':encoding:' . self::BINARY_ENCODING_FORMAT;
+        }
+
+        $header .= ':' . self::HEADER_END;
+
+        return $header;
+    }
+
+    /**
+     * @throws EncryptionFailedException
+     */
+    private function encrypt(string $plainContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER): string {
+        $options = $this->useLegacyBase64Encoding ? 0 : OPENSSL_RAW_DATA;
+        $encryptedContent = openssl_encrypt($plainContent,
+            $cipher,
+            $passPhrase,
+            $options,
+            $iv);
+
+        if (!$encryptedContent) {
+            $error = 'Encryption (symmetric) of content failed';
+            $this->logger->error($error . openssl_error_string(),
+                ['app' => 'encryption']);
+            throw new EncryptionFailedException($error);
+        }
+
+        return $encryptedContent;
+    }
+
+    /**
+     * return cipher either from config.php or the default cipher defined in
+     * this class
+     */
+    private function getCachedCipher(): string {
+        if (isset($this->currentCipher)) {
+            return $this->currentCipher;
+        }
+
+        // Get cipher either from config.php or the default cipher defined in this class
+        $cipher = $this->config->getSystemValueString('cipher', self::DEFAULT_CIPHER);
+        if (!isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
+            $this->logger->warning(
+                sprintf(
+                    'Unsupported cipher (%s) defined in config.php supported. Falling back to %s',
+                    $cipher,
+                    self::DEFAULT_CIPHER
+                ),
+                ['app' => 'encryption']
+            );
+            $cipher = self::DEFAULT_CIPHER;
+        }
+
+        // Remember current cipher to avoid frequent lookups
+        $this->currentCipher = $cipher;
+        return $this->currentCipher;
+    }
+
+    /**
+     * return current encryption cipher
+     *
+     * @return string
+     */
+    public function getCipher() {
+        return $this->getCachedCipher();
+    }
+
+    /**
+     * get key size depending on the cipher
+     *
+     * @param string $cipher
+     * @return int
+     * @throws \InvalidArgumentException
+     */
+    protected function getKeySize($cipher) {
+        if (isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
+            return self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher];
+        }
+
+        throw new \InvalidArgumentException(
+            sprintf(
+                'Unsupported cipher (%s) defined.',
+                $cipher
+            )
+        );
+    }
+
+    /**
+     * get legacy cipher
+     *
+     * @return string
+     */
+    public function getLegacyCipher() {
+        if (!$this->supportLegacy) {
+            throw new ServerNotAvailableException('Legacy cipher is no longer supported!');
+        }
+
+        return self::LEGACY_CIPHER;
+    }
+
+    private function concatIV(string $encryptedContent, string $iv): string {
+        return $encryptedContent . '00iv00' . $iv;
+    }
+
+    private function concatSig(string $encryptedContent, string $signature): string {
+        return $encryptedContent . '00sig00' . $signature;
+    }
+
+    /**
+     * Note: This is _NOT_ a padding used for encryption purposes. It is solely
+     * used to achieve the PHP stream size. It has _NOTHING_ to do with the
+     * encrypted content and is not used in any crypto primitive.
+     */
+    private function addPadding(string $data): string {
+        return $data . 'xxx';
+    }
+
+    /**
+     * generate password hash used to encrypt the users private key
+     *
+     * @param string $uid only used for user keys
+     */
+    protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
+        $instanceId = $this->config->getSystemValue('instanceid');
+        $instanceSecret = $this->config->getSystemValue('secret');
+        $salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
+        $keySize = $this->getKeySize($cipher);
+
+        return hash_pbkdf2(
+            'sha256',
+            $password,
+            $salt,
+            $iterations,
+            $keySize,
+            true
+        );
+    }
+
+    /**
+     * encrypt private key
+     *
+     * @param string $privateKey
+     * @param string $password
+     * @param string $uid for regular users, empty for system keys
+     * @return false|string
+     */
+    public function encryptPrivateKey($privateKey, $password, $uid = '') {
+        $cipher = $this->getCipher();
+        $hash = $this->generatePasswordHash($password, $cipher, $uid);
+        $encryptedKey = $this->symmetricEncryptFileContent(
+            $privateKey,
+            $hash,
+            0,
+            '0'
+        );
+
+        return $encryptedKey;
+    }
+
+    /**
+     * @param string $privateKey
+     * @param string $password
+     * @param string $uid for regular users, empty for system keys
+     */
+    public function decryptPrivateKey($privateKey, $password = '', $uid = '') : string|false {
+        $header = $this->parseHeader($privateKey);
+
+        if (isset($header['cipher'])) {
+            $cipher = $header['cipher'];
+        } else {
+            $cipher = $this->getLegacyCipher();
+        }
+
+        if (isset($header['keyFormat'])) {
+            $keyFormat = $header['keyFormat'];
+        } else {
+            $keyFormat = self::LEGACY_KEY_FORMAT;
+        }
+
+        if ($keyFormat === 'hash') {
+            $password = $this->generatePasswordHash($password, $cipher, $uid, 100000);
+        } elseif ($keyFormat === 'hash2') {
+            $password = $this->generatePasswordHash($password, $cipher, $uid, 600000);
+        }
+
+        $binaryEncoding = isset($header['encoding']) && $header['encoding'] === self::BINARY_ENCODING_FORMAT;
+
+        // If we found a header we need to remove it from the key we want to decrypt
+        if (!empty($header)) {
+            $privateKey = substr($privateKey,
+                strpos($privateKey,
+                    self::HEADER_END) + strlen(self::HEADER_END));
+        }
+
+        $plainKey = $this->symmetricDecryptFileContent(
+            $privateKey,
+            $password,
+            $cipher,
+            0,
+            0,
+            $binaryEncoding
+        );
+
+        if ($this->isValidPrivateKey($plainKey) === false) {
+            return false;
+        }
+
+        return $plainKey;
+    }
+
+    /**
+     * check if it is a valid private key
+     *
+     * @param string $plainKey
+     * @return bool
+     */
+    protected function isValidPrivateKey($plainKey) {
+        $res = openssl_get_privatekey($plainKey);
+        if (is_object($res) && get_class($res) === 'OpenSSLAsymmetricKey') {
+            $sslInfo = openssl_pkey_get_details($res);
+            if (isset($sslInfo['key'])) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param string $keyFileContents
+     * @param string $passPhrase
+     * @param string $cipher
+     * @param int $version
+     * @param int|string $position
+     * @param boolean $binaryEncoding
+     * @return string
+     * @throws DecryptionFailedException
+     */
+    public function symmetricDecryptFileContent($keyFileContents, $passPhrase, $cipher = self::DEFAULT_CIPHER, $version = 0, $position = 0, bool $binaryEncoding = false) {
+        if ($keyFileContents == '') {
+            return '';
+        }
+
+        $catFile = $this->splitMetaData($keyFileContents, $cipher);
+
+        if ($catFile['signature'] !== false) {
+            try {
+                // First try the new format
+                $this->checkSignature($catFile['encrypted'], $passPhrase . '_' . $version . '_' . $position, $catFile['signature']);
+            } catch (GenericEncryptionException $e) {
+                // For compatibility with old files check the version without _
+                $this->checkSignature($catFile['encrypted'], $passPhrase . $version . $position, $catFile['signature']);
+            }
+        }
+
+        return $this->decrypt($catFile['encrypted'],
+            $catFile['iv'],
+            $passPhrase,
+            $cipher,
+            $binaryEncoding);
+    }
+
+    /**
+     * check for valid signature
+     *
+     * @throws GenericEncryptionException
+     */
+    private function checkSignature(string $data, string $passPhrase, string $expectedSignature): void {
+        $enforceSignature = !$this->config->getSystemValueBool('encryption_skip_signature_check', false);
+
+        $signature = $this->createSignature($data, $passPhrase);
+        $isCorrectHash = hash_equals($expectedSignature, $signature);
+
+        if (!$isCorrectHash) {
+            if ($enforceSignature) {
+                throw new GenericEncryptionException('Bad Signature', $this->l->t('Bad Signature'));
+            } else {
+                $this->logger->info('Signature check skipped', ['app' => 'encryption']);
+            }
+        }
+    }
+
+    /**
+     * create signature
+     */
+    private function createSignature(string $data, string $passPhrase): string {
+        $passPhrase = hash('sha512', $passPhrase . 'a', true);
+        return hash_hmac('sha256', $data, $passPhrase);
+    }
+
+
+    /**
+     * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
+     */
+    private function removePadding(string $padded, bool $hasSignature = false): string|false {
+        if ($hasSignature === false && substr($padded, -2) === 'xx') {
+            return substr($padded, 0, -2);
+        } elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
+            return substr($padded, 0, -3);
+        }
+        return false;
+    }
+
+    /**
+     * split meta data from encrypted file
+     * Note: for now, we assume that the meta data always start with the iv
+     *       followed by the signature, if available
+     */
+    private function splitMetaData(string $catFile, string $cipher): array {
+        if ($this->hasSignature($catFile, $cipher)) {
+            $catFile = $this->removePadding($catFile, true);
+            $meta = substr($catFile, -93);
+            $iv = substr($meta, strlen('00iv00'), 16);
+            $sig = substr($meta, 22 + strlen('00sig00'));
+            $encrypted = substr($catFile, 0, -93);
+        } else {
+            $catFile = $this->removePadding($catFile);
+            $meta = substr($catFile, -22);
+            $iv = substr($meta, -16);
+            $sig = false;
+            $encrypted = substr($catFile, 0, -22);
+        }
+
+        return [
+            'encrypted' => $encrypted,
+            'iv' => $iv,
+            'signature' => $sig
+        ];
+    }
+
+    /**
+     * check if encrypted block is signed
+     *
+     * @throws GenericEncryptionException
+     */
+    private function hasSignature(string $catFile, string $cipher): bool {
+        $skipSignatureCheck = $this->config->getSystemValueBool('encryption_skip_signature_check', false);
+
+        $meta = substr($catFile, -93);
+        $signaturePosition = strpos($meta, '00sig00');
+
+        // If we no longer support the legacy format then everything needs a signature
+        if (!$skipSignatureCheck && !$this->supportLegacy && $signaturePosition === false) {
+            throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
+        }
+
+        // Enforce signature for the new 'CTR' ciphers
+        if (!$skipSignatureCheck && $signaturePosition === false && stripos($cipher, 'ctr') !== false) {
+            throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
+        }
+
+        return ($signaturePosition !== false);
+    }
+
+
+    /**
+     * @throws DecryptionFailedException
+     */
+    private function decrypt(string $encryptedContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER, bool $binaryEncoding = false): string {
+        $options = $binaryEncoding === true ? OPENSSL_RAW_DATA : 0;
+        $plainContent = openssl_decrypt($encryptedContent,
+            $cipher,
+            $passPhrase,
+            $options,
+            $iv);
+
+        if ($plainContent) {
+            return $plainContent;
+        } else {
+            throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
+        }
+    }
+
+    /**
+     * @param string $data
+     * @return array
+     */
+    protected function parseHeader($data) {
+        $result = [];
+
+        if (substr($data, 0, strlen(self::HEADER_START)) === self::HEADER_START) {
+            $endAt = strpos($data, self::HEADER_END);
+            $header = substr($data, 0, $endAt + strlen(self::HEADER_END));
+
+            // +1 not to start with an ':' which would result in empty element at the beginning
+            $exploded = explode(':',
+                substr($header, strlen(self::HEADER_START) + 1));
+
+            $element = array_shift($exploded);
+
+            while ($element !== self::HEADER_END) {
+                $result[$element] = array_shift($exploded);
+                $element = array_shift($exploded);
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * generate initialization vector
+     *
+     * @throws GenericEncryptionException
+     */
+    private function generateIv(): string {
+        return random_bytes(16);
+    }
+
+    /**
+     * Generate a cryptographically secure pseudo-random 256-bit ASCII key, used
+     * as file key
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function generateFileKey() {
+        return random_bytes(32);
+    }
+
+    /**
+     * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
+     * @throws MultiKeyDecryptException
+     */
+    public function multiKeyDecrypt(string $shareKey, $privateKey): string {
+        $plainContent = '';
+
+        // decrypt the intermediate key with RSA
+        if (openssl_private_decrypt($shareKey, $intermediate, $privateKey, OPENSSL_PKCS1_OAEP_PADDING)) {
+            return $intermediate;
+        } else {
+            throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+        }
+    }
+
+    /**
+     * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
+     * @throws MultiKeyDecryptException
+     */
+    public function multiKeyDecryptLegacy(string $encKeyFile, string $shareKey, $privateKey): string {
+        if (!$encKeyFile) {
+            throw new MultiKeyDecryptException('Cannot multikey decrypt empty plain content');
+        }
+
+        $plainContent = '';
+        if ($this->opensslOpen($encKeyFile, $plainContent, $shareKey, $privateKey, 'RC4')) {
+            return $plainContent;
+        } else {
+            throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+        }
+    }
+
+    /**
+     * @param array<string,\OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string> $keyFiles
+     * @throws MultiKeyEncryptException
+     */
+    public function multiKeyEncrypt(string $plainContent, array $keyFiles): array {
+        if (empty($plainContent)) {
+            throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
+        }
+
+        // Set empty vars to be set by openssl by reference
+        $shareKeys = [];
+        $mappedShareKeys = [];
+
+        // make sure that there is at least one public key to use
+        if (count($keyFiles) >= 1) {
+            // prepare the encrypted keys
+            $shareKeys = [];
+
+            // iterate over the public keys and encrypt the intermediate
+            // for each of them with RSA
+            foreach ($keyFiles as $tmp_key) {
+                if (openssl_public_encrypt($plainContent, $tmp_output, $tmp_key, OPENSSL_PKCS1_OAEP_PADDING)) {
+                    $shareKeys[] = $tmp_output;
+                }
+            }
+
+            // set the result if everything worked fine
+            if (count($keyFiles) === count($shareKeys)) {
+                $i = 0;
+
+                // Ensure each shareKey is labelled with its corresponding key id
+                foreach ($keyFiles as $userId => $publicKey) {
+                    $mappedShareKeys[$userId] = $shareKeys[$i];
+                    $i++;
+                }
+
+                return $mappedShareKeys;
+            }
+        }
+        throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+    }
+
+    /**
+     * @param string $plainContent
+     * @param array $keyFiles
+     * @return array
+     * @throws MultiKeyEncryptException
+     * @deprecated 27.0.0 use multiKeyEncrypt
+     */
+    public function multiKeyEncryptLegacy($plainContent, array $keyFiles) {
+        // openssl_seal returns false without errors if plaincontent is empty
+        // so trigger our own error
+        if (empty($plainContent)) {
+            throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
+        }
+
+        // Set empty vars to be set by openssl by reference
+        $sealed = '';
+        $shareKeys = [];
+        $mappedShareKeys = [];
+
+        if ($this->opensslSeal($plainContent, $sealed, $shareKeys, $keyFiles, 'RC4')) {
+            $i = 0;
+
+            // Ensure each shareKey is labelled with its corresponding key id
+            foreach ($keyFiles as $userId => $publicKey) {
+                $mappedShareKeys[$userId] = $shareKeys[$i];
+                $i++;
+            }
+
+            return [
+                'keys' => $mappedShareKeys,
+                'data' => $sealed
+            ];
+        } else {
+            throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+        }
+    }
+
+    /**
+     * returns the value of $useLegacyBase64Encoding
+     *
+     * @return bool
+     */
+    public function useLegacyBase64Encoding(): bool {
+        return $this->useLegacyBase64Encoding;
+    }
+
+    /**
+     * Uses phpseclib RC4 implementation
+     */
+    private function rc4Decrypt(string $data, string $secret): string {
+        $rc4 = new RC4();
+        /** @psalm-suppress InternalMethod */
+        $rc4->setKey($secret);
+
+        return $rc4->decrypt($data);
+    }
+
+    /**
+     * Uses phpseclib RC4 implementation
+     */
+    private function rc4Encrypt(string $data, string $secret): string {
+        $rc4 = new RC4();
+        /** @psalm-suppress InternalMethod */
+        $rc4->setKey($secret);
+
+        return $rc4->encrypt($data);
+    }
+
+    /**
+     * Custom implementation of openssl_open()
+     *
+     * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $private_key
+     * @throws DecryptionFailedException
+     */
+    private function opensslOpen(string $data, string &$output, string $encrypted_key, $private_key, string $cipher_algo): bool {
+        $result = false;
+
+        // check if RC4 is used
+        if (strcasecmp($cipher_algo, 'rc4') === 0) {
+            // decrypt the intermediate key with RSA
+            if (openssl_private_decrypt($encrypted_key, $intermediate, $private_key, OPENSSL_PKCS1_PADDING)) {
+                // decrypt the file key with the intermediate key
+                // using our own RC4 implementation
+                $output = $this->rc4Decrypt($data, $intermediate);
+                $result = (strlen($output) === strlen($data));
+            }
+        } else {
+            throw new DecryptionFailedException('Unsupported cipher ' . $cipher_algo);
+        }
+
+        return $result;
+    }
+
+    /**
+     * Custom implementation of openssl_seal()
+     *
+     * @deprecated 27.0.0 use multiKeyEncrypt
+     * @throws EncryptionFailedException
+     */
+    private function opensslSeal(string $data, string &$sealed_data, array &$encrypted_keys, array $public_key, string $cipher_algo): int|false {
+        $result = false;
+
+        // check if RC4 is used
+        if (strcasecmp($cipher_algo, 'rc4') === 0) {
+            // make sure that there is at least one public key to use
+            if (count($public_key) >= 1) {
+                // generate the intermediate key
+                $intermediate = openssl_random_pseudo_bytes(16, $strong_result);
+
+                // check if we got strong random data
+                if ($strong_result) {
+                    // encrypt the file key with the intermediate key
+                    // using our own RC4 implementation
+                    $sealed_data = $this->rc4Encrypt($data, $intermediate);
+                    if (strlen($sealed_data) === strlen($data)) {
+                        // prepare the encrypted keys
+                        $encrypted_keys = [];
+
+                        // iterate over the public keys and encrypt the intermediate
+                        // for each of them with RSA
+                        foreach ($public_key as $tmp_key) {
+                            if (openssl_public_encrypt($intermediate, $tmp_output, $tmp_key, OPENSSL_PKCS1_PADDING)) {
+                                $encrypted_keys[] = $tmp_output;
+                            }
+                        }
+
+                        // set the result if everything worked fine
+                        if (count($public_key) === count($encrypted_keys)) {
+                            $result = strlen($sealed_data);
+                        }
+                    }
+                }
+            }
+        } else {
+            throw new EncryptionFailedException('Unsupported cipher ' . $cipher_algo);
+        }
+
+        return $result;
+    }
 }

Spacing +28 added lines, -28 removed lines

@@ -93,7 +93,7 @@ 
 				['app' => 'encryption']);
 
 			if (openssl_error_string()) {
-				$this->logger->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
+				$this->logger->error('Encryption library openssl_pkey_new() fails: '.openssl_error_string(),
 					['app' => 'encryption']);
 			}
 		} elseif (openssl_pkey_export($res,
@@ -108,10 +108,10 @@ 
 				'privateKey' => $privateKey
 			];
 		}
-		$this->logger->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
+		$this->logger->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.'.$this->user,
 			['app' => 'encryption']);
 		if (openssl_error_string()) {
-			$this->logger->error('Encryption Library:' . openssl_error_string(),
+			$this->logger->error('Encryption Library:'.openssl_error_string(),
 				['app' => 'encryption']);
 		}
 
@@ -140,7 +140,7 @@ 
 	/**
 	 * @throws EncryptionFailedException
 	 */
-	public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string|false {
+	public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string | false {
 		if (!$plainContent) {
 			$this->logger->error('Encryption Library, symmetrical encryption failed no content given',
 				['app' => 'encryption']);
@@ -155,7 +155,7 @@ 
 			$this->getCipher());
 
 		// Create a signature based on the key as well as the current version
-		$sig = $this->createSignature($encryptedContent, $passPhrase . '_' . $version . '_' . $position);
+		$sig = $this->createSignature($encryptedContent, $passPhrase.'_'.$version.'_'.$position);
 
 		// combine content to encrypt the IV identifier and actual IV
 		$catFile = $this->concatIV($encryptedContent, $iv);
@@ -172,18 +172,18 @@ 
 	 */
 	public function generateHeader($keyFormat = self::DEFAULT_KEY_FORMAT) {
 		if (in_array($keyFormat, self::SUPPORTED_KEY_FORMATS, true) === false) {
-			throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
+			throw new \InvalidArgumentException('key format "'.$keyFormat.'" is not supported');
 		}
 
 		$header = self::HEADER_START
-			. ':cipher:' . $this->getCipher()
-			. ':keyFormat:' . $keyFormat;
+			. ':cipher:'.$this->getCipher()
+			. ':keyFormat:'.$keyFormat;
 
 		if ($this->useLegacyBase64Encoding !== true) {
-			$header .= ':encoding:' . self::BINARY_ENCODING_FORMAT;
+			$header .= ':encoding:'.self::BINARY_ENCODING_FORMAT;
 		}
 
-		$header .= ':' . self::HEADER_END;
+		$header .= ':'.self::HEADER_END;
 
 		return $header;
 	}
@@ -201,7 +201,7 @@ 
 
 		if (!$encryptedContent) {
 			$error = 'Encryption (symmetric) of content failed';
-			$this->logger->error($error . openssl_error_string(),
+			$this->logger->error($error.openssl_error_string(),
 				['app' => 'encryption']);
 			throw new EncryptionFailedException($error);
 		}
@@ -280,11 +280,11 @@ 
 	}
 
 	private function concatIV(string $encryptedContent, string $iv): string {
-		return $encryptedContent . '00iv00' . $iv;
+		return $encryptedContent.'00iv00'.$iv;
 	}
 
 	private function concatSig(string $encryptedContent, string $signature): string {
-		return $encryptedContent . '00sig00' . $signature;
+		return $encryptedContent.'00sig00'.$signature;
 	}
 
 	/**
@@ -293,7 +293,7 @@ 
 	 * encrypted content and is not used in any crypto primitive.
 	 */
 	private function addPadding(string $data): string {
-		return $data . 'xxx';
+		return $data.'xxx';
 	}
 
 	/**
@@ -304,7 +304,7 @@ 
 	protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
 		$instanceId = $this->config->getSystemValue('instanceid');
 		$instanceSecret = $this->config->getSystemValue('secret');
-		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
+		$salt = hash('sha256', $uid.$instanceId.$instanceSecret, true);
 		$keySize = $this->getKeySize($cipher);
 
 		return hash_pbkdf2(
@@ -343,7 +343,7 @@ 
 	 * @param string $password
 	 * @param string $uid for regular users, empty for system keys
 	 */
-	public function decryptPrivateKey($privateKey, $password = '', $uid = '') : string|false {
+	public function decryptPrivateKey($privateKey, $password = '', $uid = '') : string | false {
 		$header = $this->parseHeader($privateKey);
 
 		if (isset($header['cipher'])) {
@@ -427,10 +427,10 @@ 
 		if ($catFile['signature'] !== false) {
 			try {
 				// First try the new format
-				$this->checkSignature($catFile['encrypted'], $passPhrase . '_' . $version . '_' . $position, $catFile['signature']);
+				$this->checkSignature($catFile['encrypted'], $passPhrase.'_'.$version.'_'.$position, $catFile['signature']);
 			} catch (GenericEncryptionException $e) {
 				// For compatibility with old files check the version without _
-				$this->checkSignature($catFile['encrypted'], $passPhrase . $version . $position, $catFile['signature']);
+				$this->checkSignature($catFile['encrypted'], $passPhrase.$version.$position, $catFile['signature']);
 			}
 		}
 
@@ -465,7 +465,7 @@ 
 	 * create signature
 	 */
 	private function createSignature(string $data, string $passPhrase): string {
-		$passPhrase = hash('sha512', $passPhrase . 'a', true);
+		$passPhrase = hash('sha512', $passPhrase.'a', true);
 		return hash_hmac('sha256', $data, $passPhrase);
 	}
 
@@ -473,7 +473,7 @@ 
 	/**
 	 * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
 	 */
-	private function removePadding(string $padded, bool $hasSignature = false): string|false {
+	private function removePadding(string $padded, bool $hasSignature = false): string | false {
 		if ($hasSignature === false && substr($padded, -2) === 'xx') {
 			return substr($padded, 0, -2);
 		} elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
@@ -548,7 +548,7 @@ 
 		if ($plainContent) {
 			return $plainContent;
 		} else {
-			throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
+			throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: '.openssl_error_string());
 		}
 	}
 
@@ -609,7 +609,7 @@ 
 		if (openssl_private_decrypt($shareKey, $intermediate, $privateKey, OPENSSL_PKCS1_OAEP_PADDING)) {
 			return $intermediate;
 		} else {
-			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:'.openssl_error_string());
 		}
 	}
 
@@ -626,7 +626,7 @@ 
 		if ($this->opensslOpen($encKeyFile, $plainContent, $shareKey, $privateKey, 'RC4')) {
 			return $plainContent;
 		} else {
-			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:'.openssl_error_string());
 		}
 	}
 
@@ -669,7 +669,7 @@ 
 				return $mappedShareKeys;
 			}
 		}
-		throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+		throw new MultiKeyEncryptException('multikeyencryption failed '.openssl_error_string());
 	}
 
 	/**
@@ -705,7 +705,7 @@ 
 				'data' => $sealed
 			];
 		} else {
-			throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+			throw new MultiKeyEncryptException('multikeyencryption failed '.openssl_error_string());
 		}
 	}
 
@@ -759,7 +759,7 @@ 
 				$result = (strlen($output) === strlen($data));
 			}
 		} else {
-			throw new DecryptionFailedException('Unsupported cipher ' . $cipher_algo);
+			throw new DecryptionFailedException('Unsupported cipher '.$cipher_algo);
 		}
 
 		return $result;
@@ -771,7 +771,7 @@ 
 	 * @deprecated 27.0.0 use multiKeyEncrypt
 	 * @throws EncryptionFailedException
 	 */
-	private function opensslSeal(string $data, string &$sealed_data, array &$encrypted_keys, array $public_key, string $cipher_algo): int|false {
+	private function opensslSeal(string $data, string &$sealed_data, array &$encrypted_keys, array $public_key, string $cipher_algo): int | false {
 		$result = false;
 
 		// check if RC4 is used
@@ -806,7 +806,7 @@ 
 				}
 			}
 		} else {
-			throw new EncryptionFailedException('Unsupported cipher ' . $cipher_algo);
+			throw new EncryptionFailedException('Unsupported cipher '.$cipher_algo);
 		}
 
 		return $result;