nextcloud / server

lib/private/Accounts/AccountManager.php

Indentation +764 added lines, -764 removed lines

@@ -79,768 +79,768 @@
  * @package OC\Accounts
  */
 class AccountManager implements IAccountManager {
-	use TAccountsHelper;
-
-	use TProfileHelper;
-
-	/** @var  IDBConnection database connection */
-	private $connection;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var string table name */
-	private $table = 'accounts';
-
-	/** @var string table name */
-	private $dataTable = 'accounts_data';
-
-	/** @var EventDispatcherInterface */
-	private $eventDispatcher;
-
-	/** @var IJobList */
-	private $jobList;
-
-	/** @var LoggerInterface */
-	private $logger;
-	/** @var IVerificationToken */
-	private $verificationToken;
-	/** @var IMailer */
-	private $mailer;
-	/** @var Defaults */
-	private $defaults;
-	/** @var IL10N */
-	private $l10n;
-	/** @var IURLGenerator */
-	private $urlGenerator;
-	/** @var ICrypto */
-	private $crypto;
-	/** @var IFactory */
-	private $l10nfactory;
-	private CappedMemoryCache $internalCache;
-
-	/**
-	 * The list of default scopes for each property.
-	 */
-	public const DEFAULT_SCOPES = [
-		self::PROPERTY_DISPLAYNAME => self::SCOPE_FEDERATED,
-		self::PROPERTY_ADDRESS => self::SCOPE_LOCAL,
-		self::PROPERTY_WEBSITE => self::SCOPE_LOCAL,
-		self::PROPERTY_EMAIL => self::SCOPE_FEDERATED,
-		self::PROPERTY_AVATAR => self::SCOPE_FEDERATED,
-		self::PROPERTY_PHONE => self::SCOPE_LOCAL,
-		self::PROPERTY_TWITTER => self::SCOPE_LOCAL,
-		self::PROPERTY_FEDIVERSE => self::SCOPE_LOCAL,
-		self::PROPERTY_ORGANISATION => self::SCOPE_LOCAL,
-		self::PROPERTY_ROLE => self::SCOPE_LOCAL,
-		self::PROPERTY_HEADLINE => self::SCOPE_LOCAL,
-		self::PROPERTY_BIOGRAPHY => self::SCOPE_LOCAL,
-	];
-
-	public function __construct(
-		IDBConnection            $connection,
-		IConfig                  $config,
-		EventDispatcherInterface $eventDispatcher,
-		IJobList                 $jobList,
-		LoggerInterface          $logger,
-		IVerificationToken       $verificationToken,
-		IMailer                  $mailer,
-		Defaults                 $defaults,
-		IFactory                 $factory,
-		IURLGenerator            $urlGenerator,
-		ICrypto                  $crypto
-	) {
-		$this->connection = $connection;
-		$this->config = $config;
-		$this->eventDispatcher = $eventDispatcher;
-		$this->jobList = $jobList;
-		$this->logger = $logger;
-		$this->verificationToken = $verificationToken;
-		$this->mailer = $mailer;
-		$this->defaults = $defaults;
-		$this->urlGenerator = $urlGenerator;
-		$this->crypto = $crypto;
-		// DIing IL10N results in a dependency loop
-		$this->l10nfactory = $factory;
-		$this->internalCache = new CappedMemoryCache();
-	}
-
-	/**
-	 * @param string $input
-	 * @return string Provided phone number in E.164 format when it was a valid number
-	 * @throws InvalidArgumentException When the phone number was invalid or no default region is set and the number doesn't start with a country code
-	 */
-	protected function parsePhoneNumber(string $input): string {
-		$defaultRegion = $this->config->getSystemValueString('default_phone_region', '');
-
-		if ($defaultRegion === '') {
-			// When no default region is set, only +49… numbers are valid
-			if (strpos($input, '+') !== 0) {
-				throw new InvalidArgumentException(self::PROPERTY_PHONE);
-			}
-
-			$defaultRegion = 'EN';
-		}
-
-		$phoneUtil = PhoneNumberUtil::getInstance();
-		try {
-			$phoneNumber = $phoneUtil->parse($input, $defaultRegion);
-			if ($phoneUtil->isValidNumber($phoneNumber)) {
-				return $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
-			}
-		} catch (NumberParseException $e) {
-		}
-
-		throw new InvalidArgumentException(self::PROPERTY_PHONE);
-	}
-
-	/**
-	 *
-	 * @param string $input
-	 * @return string
-	 * @throws InvalidArgumentException When the website did not have http(s) as protocol or the host name was empty
-	 */
-	protected function parseWebsite(string $input): string {
-		$parts = parse_url($input);
-		if (!isset($parts['scheme']) || ($parts['scheme'] !== 'https' && $parts['scheme'] !== 'http')) {
-			throw new InvalidArgumentException(self::PROPERTY_WEBSITE);
-		}
-
-		if (!isset($parts['host']) || $parts['host'] === '') {
-			throw new InvalidArgumentException(self::PROPERTY_WEBSITE);
-		}
-
-		return $input;
-	}
-
-	/**
-	 * @param IAccountProperty[] $properties
-	 */
-	protected function testValueLengths(array $properties, bool $throwOnData = false): void {
-		foreach ($properties as $property) {
-			if (strlen($property->getValue()) > 2048) {
-				if ($throwOnData) {
-					throw new InvalidArgumentException($property->getName());
-				} else {
-					$property->setValue('');
-				}
-			}
-		}
-	}
-
-	protected function testPropertyScope(IAccountProperty $property, array $allowedScopes, bool $throwOnData): void {
-		if ($throwOnData && !in_array($property->getScope(), $allowedScopes, true)) {
-			throw new InvalidArgumentException('scope');
-		}
-
-		if (
-			$property->getScope() === self::SCOPE_PRIVATE
-			&& in_array($property->getName(), [self::PROPERTY_DISPLAYNAME, self::PROPERTY_EMAIL])
-		) {
-			if ($throwOnData) {
-				// v2-private is not available for these fields
-				throw new InvalidArgumentException('scope');
-			} else {
-				// default to local
-				$property->setScope(self::SCOPE_LOCAL);
-			}
-		} else {
-			// migrate scope values to the new format
-			// invalid scopes are mapped to a default value
-			$property->setScope(AccountProperty::mapScopeToV2($property->getScope()));
-		}
-	}
-
-	protected function sanitizePhoneNumberValue(IAccountProperty $property, bool $throwOnData = false) {
-		if ($property->getName() !== self::PROPERTY_PHONE) {
-			if ($throwOnData) {
-				throw new InvalidArgumentException(sprintf('sanitizePhoneNumberValue can only sanitize phone numbers, %s given', $property->getName()));
-			}
-			return;
-		}
-		if ($property->getValue() === '') {
-			return;
-		}
-		try {
-			$property->setValue($this->parsePhoneNumber($property->getValue()));
-		} catch (InvalidArgumentException $e) {
-			if ($throwOnData) {
-				throw $e;
-			}
-			$property->setValue('');
-		}
-	}
-
-	protected function sanitizeWebsite(IAccountProperty $property, bool $throwOnData = false) {
-		if ($property->getName() !== self::PROPERTY_WEBSITE) {
-			if ($throwOnData) {
-				throw new InvalidArgumentException(sprintf('sanitizeWebsite can only sanitize web domains, %s given', $property->getName()));
-			}
-		}
-		try {
-			$property->setValue($this->parseWebsite($property->getValue()));
-		} catch (InvalidArgumentException $e) {
-			if ($throwOnData) {
-				throw $e;
-			}
-			$property->setValue('');
-		}
-	}
-
-	protected function updateUser(IUser $user, array $data, ?array $oldUserData, bool $throwOnData = false): array {
-		if ($oldUserData === null) {
-			$oldUserData = $this->getUser($user, false);
-		}
-
-		$updated = true;
-
-		if ($oldUserData !== $data) {
-			$this->updateExistingUser($user, $data, $oldUserData);
-		} else {
-			// nothing needs to be done if new and old data set are the same
-			$updated = false;
-		}
-
-		if ($updated) {
-			$this->eventDispatcher->dispatch(
-				'OC\AccountManager::userUpdated',
-				new GenericEvent($user, $data)
-			);
-		}
-
-		return $data;
-	}
-
-	/**
-	 * delete user from accounts table
-	 *
-	 * @param IUser $user
-	 */
-	public function deleteUser(IUser $user) {
-		$uid = $user->getUID();
-		$query = $this->connection->getQueryBuilder();
-		$query->delete($this->table)
-			->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
-			->execute();
-
-		$this->deleteUserData($user);
-	}
-
-	/**
-	 * delete user from accounts table
-	 *
-	 * @param IUser $user
-	 */
-	public function deleteUserData(IUser $user): void {
-		$uid = $user->getUID();
-		$query = $this->connection->getQueryBuilder();
-		$query->delete($this->dataTable)
-			->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
-			->execute();
-	}
-
-	/**
-	 * get stored data from a given user
-	 */
-	protected function getUser(IUser $user, bool $insertIfNotExists = true): array {
-		$uid = $user->getUID();
-		$query = $this->connection->getQueryBuilder();
-		$query->select('data')
-			->from($this->table)
-			->where($query->expr()->eq('uid', $query->createParameter('uid')))
-			->setParameter('uid', $uid);
-		$result = $query->executeQuery();
-		$accountData = $result->fetchAll();
-		$result->closeCursor();
-
-		if (empty($accountData)) {
-			$userData = $this->buildDefaultUserRecord($user);
-			if ($insertIfNotExists) {
-				$this->insertNewUser($user, $userData);
-			}
-			return $userData;
-		}
-
-		$userDataArray = $this->importFromJson($accountData[0]['data'], $uid);
-		if ($userDataArray === null || $userDataArray === []) {
-			return $this->buildDefaultUserRecord($user);
-		}
-
-		return $this->addMissingDefaultValues($userDataArray, $this->buildDefaultUserRecord($user));
-	}
-
-	public function searchUsers(string $property, array $values): array {
-		// the value col is limited to 255 bytes. It is used for searches only.
-		$values = array_map(function (string $value) {
-			return Util::shortenMultibyteString($value, 255);
-		}, $values);
-		$chunks = array_chunk($values, 500);
-		$query = $this->connection->getQueryBuilder();
-		$query->select('*')
-			->from($this->dataTable)
-			->where($query->expr()->eq('name', $query->createNamedParameter($property)))
-			->andWhere($query->expr()->in('value', $query->createParameter('values')));
-
-		$matches = [];
-		foreach ($chunks as $chunk) {
-			$query->setParameter('values', $chunk, IQueryBuilder::PARAM_STR_ARRAY);
-			$result = $query->executeQuery();
-
-			while ($row = $result->fetch()) {
-				$matches[$row['uid']] = $row['value'];
-			}
-			$result->closeCursor();
-		}
-
-		$result = array_merge($matches, $this->searchUsersForRelatedCollection($property, $values));
-
-		return array_flip($result);
-	}
-
-	protected function searchUsersForRelatedCollection(string $property, array $values): array {
-		switch ($property) {
-			case IAccountManager::PROPERTY_EMAIL:
-				return array_flip($this->searchUsers(IAccountManager::COLLECTION_EMAIL, $values));
-			default:
-				return [];
-		}
-	}
-
-	/**
-	 * check if we need to ask the server for email verification, if yes we create a cronjob
-	 */
-	protected function checkEmailVerification(IAccount $updatedAccount, array $oldData): void {
-		try {
-			$property = $updatedAccount->getProperty(self::PROPERTY_EMAIL);
-		} catch (PropertyDoesNotExistException $e) {
-			return;
-		}
-
-		$oldMailIndex = array_search(self::PROPERTY_EMAIL, array_column($oldData, 'name'), true);
-		$oldMail = $oldMailIndex !== false ? $oldData[$oldMailIndex]['value'] : '';
-
-		if ($oldMail !== $property->getValue()) {
-			$this->jobList->add(
-				VerifyUserData::class,
-				[
-					'verificationCode' => '',
-					'data' => $property->getValue(),
-					'type' => self::PROPERTY_EMAIL,
-					'uid' => $updatedAccount->getUser()->getUID(),
-					'try' => 0,
-					'lastRun' => time()
-				]
-			);
-
-			$property->setVerified(self::VERIFICATION_IN_PROGRESS);
-		}
-	}
-
-	protected function checkLocalEmailVerification(IAccount $updatedAccount, array $oldData): void {
-		$mailCollection = $updatedAccount->getPropertyCollection(self::COLLECTION_EMAIL);
-		foreach ($mailCollection->getProperties() as $property) {
-			if ($property->getLocallyVerified() !== self::NOT_VERIFIED) {
-				continue;
-			}
-			if ($this->sendEmailVerificationEmail($updatedAccount->getUser(), $property->getValue())) {
-				$property->setLocallyVerified(self::VERIFICATION_IN_PROGRESS);
-			}
-		}
-	}
-
-	protected function sendEmailVerificationEmail(IUser $user, string $email): bool {
-		$ref = \substr(hash('sha256', $email), 0, 8);
-		$key = $this->crypto->encrypt($email);
-		$token = $this->verificationToken->create($user, 'verifyMail' . $ref, $email);
-
-		$link = $this->urlGenerator->linkToRouteAbsolute(
-			'provisioning_api.Verification.verifyMail',
-			[
-				'userId' => $user->getUID(),
-				'token' => $token,
-				'key' => $key
-			]
-		);
-
-		$emailTemplate = $this->mailer->createEMailTemplate('core.EmailVerification', [
-			'link' => $link,
-		]);
-
-		if (!$this->l10n) {
-			$this->l10n = $this->l10nfactory->get('core');
-		}
-
-		$emailTemplate->setSubject($this->l10n->t('%s email verification', [$this->defaults->getName()]));
-		$emailTemplate->addHeader();
-		$emailTemplate->addHeading($this->l10n->t('Email verification'));
-
-		$emailTemplate->addBodyText(
-			htmlspecialchars($this->l10n->t('Click the following button to confirm your email.')),
-			$this->l10n->t('Click the following link to confirm your email.')
-		);
-
-		$emailTemplate->addBodyButton(
-			htmlspecialchars($this->l10n->t('Confirm your email')),
-			$link,
-			false
-		);
-		$emailTemplate->addFooter();
-
-		try {
-			$message = $this->mailer->createMessage();
-			$message->setTo([$email => $user->getDisplayName()]);
-			$message->setFrom([Util::getDefaultEmailAddress('verification-noreply') => $this->defaults->getName()]);
-			$message->useTemplate($emailTemplate);
-			$this->mailer->send($message);
-		} catch (Exception $e) {
-			// Log the exception and continue
-			$this->logger->info('Failed to send verification mail', [
-				'app' => 'core',
-				'exception' => $e
-			]);
-			return false;
-		}
-		return true;
-	}
-
-	/**
-	 * Make sure that all expected data are set
-	 */
-	protected function addMissingDefaultValues(array $userData, array $defaultUserData): array {
-		foreach ($defaultUserData as $defaultDataItem) {
-			// If property does not exist, initialize it
-			$userDataIndex = array_search($defaultDataItem['name'], array_column($userData, 'name'));
-			if ($userDataIndex === false) {
-				$userData[] = $defaultDataItem;
-				continue;
-			}
-
-			// Merge and extend default missing values
-			$userData[$userDataIndex] = array_merge($defaultDataItem, $userData[$userDataIndex]);
-		}
-
-		return $userData;
-	}
-
-	protected function updateVerificationStatus(IAccount $updatedAccount, array $oldData): void {
-		static $propertiesVerifiableByLookupServer = [
-			self::PROPERTY_TWITTER,
-			self::PROPERTY_FEDIVERSE,
-			self::PROPERTY_WEBSITE,
-			self::PROPERTY_EMAIL,
-		];
-
-		foreach ($propertiesVerifiableByLookupServer as $propertyName) {
-			try {
-				$property = $updatedAccount->getProperty($propertyName);
-			} catch (PropertyDoesNotExistException $e) {
-				continue;
-			}
-			$wasVerified = isset($oldData[$propertyName])
-				&& isset($oldData[$propertyName]['verified'])
-				&& $oldData[$propertyName]['verified'] === self::VERIFIED;
-			if ((!isset($oldData[$propertyName])
-					|| !isset($oldData[$propertyName]['value'])
-					|| $property->getValue() !== $oldData[$propertyName]['value'])
-				&& ($property->getVerified() !== self::NOT_VERIFIED
-					|| $wasVerified)
-			) {
-				$property->setVerified(self::NOT_VERIFIED);
-			}
-		}
-	}
-
-	/**
-	 * add new user to accounts table
-	 *
-	 * @param IUser $user
-	 * @param array $data
-	 */
-	protected function insertNewUser(IUser $user, array $data): void {
-		$uid = $user->getUID();
-		$jsonEncodedData = $this->prepareJson($data);
-		$query = $this->connection->getQueryBuilder();
-		$query->insert($this->table)
-			->values(
-				[
-					'uid' => $query->createNamedParameter($uid),
-					'data' => $query->createNamedParameter($jsonEncodedData),
-				]
-			)
-			->executeStatement();
-
-		$this->deleteUserData($user);
-		$this->writeUserData($user, $data);
-	}
-
-	protected function prepareJson(array $data): string {
-		$preparedData = [];
-		foreach ($data as $dataRow) {
-			$propertyName = $dataRow['name'];
-			unset($dataRow['name']);
-
-			if (isset($dataRow['locallyVerified']) && $dataRow['locallyVerified'] === self::NOT_VERIFIED) {
-				// do not write default value, save DB space
-				unset($dataRow['locallyVerified']);
-			}
-
-			if (!$this->isCollection($propertyName)) {
-				$preparedData[$propertyName] = $dataRow;
-				continue;
-			}
-			if (!isset($preparedData[$propertyName])) {
-				$preparedData[$propertyName] = [];
-			}
-			$preparedData[$propertyName][] = $dataRow;
-		}
-		return json_encode($preparedData);
-	}
-
-	protected function importFromJson(string $json, string $userId): ?array {
-		$result = [];
-		$jsonArray = json_decode($json, true);
-		$jsonError = json_last_error();
-		if ($jsonError !== JSON_ERROR_NONE) {
-			$this->logger->critical(
-				'User data of {uid} contained invalid JSON (error {json_error}), hence falling back to a default user record',
-				[
-					'uid' => $userId,
-					'json_error' => $jsonError
-				]
-			);
-			return null;
-		}
-		foreach ($jsonArray as $propertyName => $row) {
-			if (!$this->isCollection($propertyName)) {
-				$result[] = array_merge($row, ['name' => $propertyName]);
-				continue;
-			}
-			foreach ($row as $singleRow) {
-				$result[] = array_merge($singleRow, ['name' => $propertyName]);
-			}
-		}
-		return $result;
-	}
-
-	/**
-	 * Update existing user in accounts table
-	 */
-	protected function updateExistingUser(IUser $user, array $data, array $oldData): void {
-		$uid = $user->getUID();
-		$jsonEncodedData = $this->prepareJson($data);
-		$query = $this->connection->getQueryBuilder();
-		$query->update($this->table)
-			->set('data', $query->createNamedParameter($jsonEncodedData))
-			->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
-			->executeStatement();
-
-		$this->deleteUserData($user);
-		$this->writeUserData($user, $data);
-	}
-
-	protected function writeUserData(IUser $user, array $data): void {
-		$query = $this->connection->getQueryBuilder();
-		$query->insert($this->dataTable)
-			->values(
-				[
-					'uid' => $query->createNamedParameter($user->getUID()),
-					'name' => $query->createParameter('name'),
-					'value' => $query->createParameter('value'),
-				]
-			);
-		$this->writeUserDataProperties($query, $data);
-	}
-
-	protected function writeUserDataProperties(IQueryBuilder $query, array $data): void {
-		foreach ($data as $property) {
-			if ($property['name'] === self::PROPERTY_AVATAR) {
-				continue;
-			}
-
-			// the value col is limited to 255 bytes. It is used for searches only.
-			$value = $property['value'] ? Util::shortenMultibyteString($property['value'], 255) : '';
-
-			$query->setParameter('name', $property['name'])
-				->setParameter('value', $value);
-			$query->executeStatement();
-		}
-	}
-
-	/**
-	 * build default user record in case not data set exists yet
-	 */
-	protected function buildDefaultUserRecord(IUser $user): array {
-		$scopes = array_merge(self::DEFAULT_SCOPES, array_filter($this->config->getSystemValue('account_manager.default_property_scope', []), static function (string $scope, string $property) {
-			return in_array($property, self::ALLOWED_PROPERTIES, true) && in_array($scope, self::ALLOWED_SCOPES, true);
-		}, ARRAY_FILTER_USE_BOTH));
-
-		return [
-			[
-				'name' => self::PROPERTY_DISPLAYNAME,
-				'value' => $user->getDisplayName(),
-				// Display name must be at least SCOPE_LOCAL
-				'scope' => $scopes[self::PROPERTY_DISPLAYNAME] === self::SCOPE_PRIVATE ? self::SCOPE_LOCAL : $scopes[self::PROPERTY_DISPLAYNAME],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_ADDRESS,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_ADDRESS],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_WEBSITE,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_WEBSITE],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_EMAIL,
-				'value' => $user->getEMailAddress(),
-				// Email must be at least SCOPE_LOCAL
-				'scope' => $scopes[self::PROPERTY_EMAIL] === self::SCOPE_PRIVATE ? self::SCOPE_LOCAL : $scopes[self::PROPERTY_EMAIL],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_AVATAR,
-				'scope' => $scopes[self::PROPERTY_AVATAR],
-			],
-
-			[
-				'name' => self::PROPERTY_PHONE,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_PHONE],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_TWITTER,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_TWITTER],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_FEDIVERSE,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_FEDIVERSE],
-				'verified' => self::NOT_VERIFIED,
-			],
-
-			[
-				'name' => self::PROPERTY_ORGANISATION,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_ORGANISATION],
-			],
-
-			[
-				'name' => self::PROPERTY_ROLE,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_ROLE],
-			],
-
-			[
-				'name' => self::PROPERTY_HEADLINE,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_HEADLINE],
-			],
-
-			[
-				'name' => self::PROPERTY_BIOGRAPHY,
-				'value' => '',
-				'scope' => $scopes[self::PROPERTY_BIOGRAPHY],
-			],
-
-			[
-				'name' => self::PROPERTY_PROFILE_ENABLED,
-				'value' => $this->isProfileEnabledByDefault($this->config) ? '1' : '0',
-			],
-		];
-	}
-
-	private function arrayDataToCollection(IAccount $account, array $data): IAccountPropertyCollection {
-		$collection = $account->getPropertyCollection($data['name']);
-
-		$p = new AccountProperty(
-			$data['name'],
-			$data['value'] ?? '',
-			$data['scope'] ?? self::SCOPE_LOCAL,
-			$data['verified'] ?? self::NOT_VERIFIED,
-			''
-		);
-		$p->setLocallyVerified($data['locallyVerified'] ?? self::NOT_VERIFIED);
-		$collection->addProperty($p);
-
-		return $collection;
-	}
-
-	private function parseAccountData(IUser $user, $data): Account {
-		$account = new Account($user);
-		foreach ($data as $accountData) {
-			if ($this->isCollection($accountData['name'])) {
-				$account->setPropertyCollection($this->arrayDataToCollection($account, $accountData));
-			} else {
-				$account->setProperty($accountData['name'], $accountData['value'] ?? '', $accountData['scope'] ?? self::SCOPE_LOCAL, $accountData['verified'] ?? self::NOT_VERIFIED);
-				if (isset($accountData['locallyVerified'])) {
-					$property = $account->getProperty($accountData['name']);
-					$property->setLocallyVerified($accountData['locallyVerified']);
-				}
-			}
-		}
-		return $account;
-	}
-
-	public function getAccount(IUser $user): IAccount {
-		if ($this->internalCache->hasKey($user->getUID())) {
-			return $this->internalCache->get($user->getUID());
-		}
-		$account = $this->parseAccountData($user, $this->getUser($user));
-		$this->internalCache->set($user->getUID(), $account);
-		return $account;
-	}
-
-	public function updateAccount(IAccount $account): void {
-		$this->testValueLengths(iterator_to_array($account->getAllProperties()), true);
-		try {
-			$property = $account->getProperty(self::PROPERTY_PHONE);
-			$this->sanitizePhoneNumberValue($property);
-		} catch (PropertyDoesNotExistException $e) {
-			//  valid case, nothing to do
-		}
-
-		try {
-			$property = $account->getProperty(self::PROPERTY_WEBSITE);
-			$this->sanitizeWebsite($property);
-		} catch (PropertyDoesNotExistException $e) {
-			//  valid case, nothing to do
-		}
-
-		foreach ($account->getAllProperties() as $property) {
-			$this->testPropertyScope($property, self::ALLOWED_SCOPES, true);
-		}
-
-		$oldData = $this->getUser($account->getUser(), false);
-		$this->updateVerificationStatus($account, $oldData);
-		$this->checkEmailVerification($account, $oldData);
-		$this->checkLocalEmailVerification($account, $oldData);
-
-		$data = [];
-		foreach ($account->getAllProperties() as $property) {
-			/** @var IAccountProperty $property */
-			$data[] = [
-				'name' => $property->getName(),
-				'value' => $property->getValue(),
-				'scope' => $property->getScope(),
-				'verified' => $property->getVerified(),
-				'locallyVerified' => $property->getLocallyVerified(),
-			];
-		}
-
-		$this->updateUser($account->getUser(), $data, $oldData, true);
-		$this->internalCache->set($account->getUser()->getUID(), $account);
-	}
+    use TAccountsHelper;
+
+    use TProfileHelper;
+
+    /** @var  IDBConnection database connection */
+    private $connection;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var string table name */
+    private $table = 'accounts';
+
+    /** @var string table name */
+    private $dataTable = 'accounts_data';
+
+    /** @var EventDispatcherInterface */
+    private $eventDispatcher;
+
+    /** @var IJobList */
+    private $jobList;
+
+    /** @var LoggerInterface */
+    private $logger;
+    /** @var IVerificationToken */
+    private $verificationToken;
+    /** @var IMailer */
+    private $mailer;
+    /** @var Defaults */
+    private $defaults;
+    /** @var IL10N */
+    private $l10n;
+    /** @var IURLGenerator */
+    private $urlGenerator;
+    /** @var ICrypto */
+    private $crypto;
+    /** @var IFactory */
+    private $l10nfactory;
+    private CappedMemoryCache $internalCache;
+
+    /**
+     * The list of default scopes for each property.
+     */
+    public const DEFAULT_SCOPES = [
+        self::PROPERTY_DISPLAYNAME => self::SCOPE_FEDERATED,
+        self::PROPERTY_ADDRESS => self::SCOPE_LOCAL,
+        self::PROPERTY_WEBSITE => self::SCOPE_LOCAL,
+        self::PROPERTY_EMAIL => self::SCOPE_FEDERATED,
+        self::PROPERTY_AVATAR => self::SCOPE_FEDERATED,
+        self::PROPERTY_PHONE => self::SCOPE_LOCAL,
+        self::PROPERTY_TWITTER => self::SCOPE_LOCAL,
+        self::PROPERTY_FEDIVERSE => self::SCOPE_LOCAL,
+        self::PROPERTY_ORGANISATION => self::SCOPE_LOCAL,
+        self::PROPERTY_ROLE => self::SCOPE_LOCAL,
+        self::PROPERTY_HEADLINE => self::SCOPE_LOCAL,
+        self::PROPERTY_BIOGRAPHY => self::SCOPE_LOCAL,
+    ];
+
+    public function __construct(
+        IDBConnection            $connection,
+        IConfig                  $config,
+        EventDispatcherInterface $eventDispatcher,
+        IJobList                 $jobList,
+        LoggerInterface          $logger,
+        IVerificationToken       $verificationToken,
+        IMailer                  $mailer,
+        Defaults                 $defaults,
+        IFactory                 $factory,
+        IURLGenerator            $urlGenerator,
+        ICrypto                  $crypto
+    ) {
+        $this->connection = $connection;
+        $this->config = $config;
+        $this->eventDispatcher = $eventDispatcher;
+        $this->jobList = $jobList;
+        $this->logger = $logger;
+        $this->verificationToken = $verificationToken;
+        $this->mailer = $mailer;
+        $this->defaults = $defaults;
+        $this->urlGenerator = $urlGenerator;
+        $this->crypto = $crypto;
+        // DIing IL10N results in a dependency loop
+        $this->l10nfactory = $factory;
+        $this->internalCache = new CappedMemoryCache();
+    }
+
+    /**
+     * @param string $input
+     * @return string Provided phone number in E.164 format when it was a valid number
+     * @throws InvalidArgumentException When the phone number was invalid or no default region is set and the number doesn't start with a country code
+     */
+    protected function parsePhoneNumber(string $input): string {
+        $defaultRegion = $this->config->getSystemValueString('default_phone_region', '');
+
+        if ($defaultRegion === '') {
+            // When no default region is set, only +49… numbers are valid
+            if (strpos($input, '+') !== 0) {
+                throw new InvalidArgumentException(self::PROPERTY_PHONE);
+            }
+
+            $defaultRegion = 'EN';
+        }
+
+        $phoneUtil = PhoneNumberUtil::getInstance();
+        try {
+            $phoneNumber = $phoneUtil->parse($input, $defaultRegion);
+            if ($phoneUtil->isValidNumber($phoneNumber)) {
+                return $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
+            }
+        } catch (NumberParseException $e) {
+        }
+
+        throw new InvalidArgumentException(self::PROPERTY_PHONE);
+    }
+
+    /**
+     *
+     * @param string $input
+     * @return string
+     * @throws InvalidArgumentException When the website did not have http(s) as protocol or the host name was empty
+     */
+    protected function parseWebsite(string $input): string {
+        $parts = parse_url($input);
+        if (!isset($parts['scheme']) || ($parts['scheme'] !== 'https' && $parts['scheme'] !== 'http')) {
+            throw new InvalidArgumentException(self::PROPERTY_WEBSITE);
+        }
+
+        if (!isset($parts['host']) || $parts['host'] === '') {
+            throw new InvalidArgumentException(self::PROPERTY_WEBSITE);
+        }
+
+        return $input;
+    }
+
+    /**
+     * @param IAccountProperty[] $properties
+     */
+    protected function testValueLengths(array $properties, bool $throwOnData = false): void {
+        foreach ($properties as $property) {
+            if (strlen($property->getValue()) > 2048) {
+                if ($throwOnData) {
+                    throw new InvalidArgumentException($property->getName());
+                } else {
+                    $property->setValue('');
+                }
+            }
+        }
+    }
+
+    protected function testPropertyScope(IAccountProperty $property, array $allowedScopes, bool $throwOnData): void {
+        if ($throwOnData && !in_array($property->getScope(), $allowedScopes, true)) {
+            throw new InvalidArgumentException('scope');
+        }
+
+        if (
+            $property->getScope() === self::SCOPE_PRIVATE
+            && in_array($property->getName(), [self::PROPERTY_DISPLAYNAME, self::PROPERTY_EMAIL])
+        ) {
+            if ($throwOnData) {
+                // v2-private is not available for these fields
+                throw new InvalidArgumentException('scope');
+            } else {
+                // default to local
+                $property->setScope(self::SCOPE_LOCAL);
+            }
+        } else {
+            // migrate scope values to the new format
+            // invalid scopes are mapped to a default value
+            $property->setScope(AccountProperty::mapScopeToV2($property->getScope()));
+        }
+    }
+
+    protected function sanitizePhoneNumberValue(IAccountProperty $property, bool $throwOnData = false) {
+        if ($property->getName() !== self::PROPERTY_PHONE) {
+            if ($throwOnData) {
+                throw new InvalidArgumentException(sprintf('sanitizePhoneNumberValue can only sanitize phone numbers, %s given', $property->getName()));
+            }
+            return;
+        }
+        if ($property->getValue() === '') {
+            return;
+        }
+        try {
+            $property->setValue($this->parsePhoneNumber($property->getValue()));
+        } catch (InvalidArgumentException $e) {
+            if ($throwOnData) {
+                throw $e;
+            }
+            $property->setValue('');
+        }
+    }
+
+    protected function sanitizeWebsite(IAccountProperty $property, bool $throwOnData = false) {
+        if ($property->getName() !== self::PROPERTY_WEBSITE) {
+            if ($throwOnData) {
+                throw new InvalidArgumentException(sprintf('sanitizeWebsite can only sanitize web domains, %s given', $property->getName()));
+            }
+        }
+        try {
+            $property->setValue($this->parseWebsite($property->getValue()));
+        } catch (InvalidArgumentException $e) {
+            if ($throwOnData) {
+                throw $e;
+            }
+            $property->setValue('');
+        }
+    }
+
+    protected function updateUser(IUser $user, array $data, ?array $oldUserData, bool $throwOnData = false): array {
+        if ($oldUserData === null) {
+            $oldUserData = $this->getUser($user, false);
+        }
+
+        $updated = true;
+
+        if ($oldUserData !== $data) {
+            $this->updateExistingUser($user, $data, $oldUserData);
+        } else {
+            // nothing needs to be done if new and old data set are the same
+            $updated = false;
+        }
+
+        if ($updated) {
+            $this->eventDispatcher->dispatch(
+                'OC\AccountManager::userUpdated',
+                new GenericEvent($user, $data)
+            );
+        }
+
+        return $data;
+    }
+
+    /**
+     * delete user from accounts table
+     *
+     * @param IUser $user
+     */
+    public function deleteUser(IUser $user) {
+        $uid = $user->getUID();
+        $query = $this->connection->getQueryBuilder();
+        $query->delete($this->table)
+            ->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
+            ->execute();
+
+        $this->deleteUserData($user);
+    }
+
+    /**
+     * delete user from accounts table
+     *
+     * @param IUser $user
+     */
+    public function deleteUserData(IUser $user): void {
+        $uid = $user->getUID();
+        $query = $this->connection->getQueryBuilder();
+        $query->delete($this->dataTable)
+            ->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
+            ->execute();
+    }
+
+    /**
+     * get stored data from a given user
+     */
+    protected function getUser(IUser $user, bool $insertIfNotExists = true): array {
+        $uid = $user->getUID();
+        $query = $this->connection->getQueryBuilder();
+        $query->select('data')
+            ->from($this->table)
+            ->where($query->expr()->eq('uid', $query->createParameter('uid')))
+            ->setParameter('uid', $uid);
+        $result = $query->executeQuery();
+        $accountData = $result->fetchAll();
+        $result->closeCursor();
+
+        if (empty($accountData)) {
+            $userData = $this->buildDefaultUserRecord($user);
+            if ($insertIfNotExists) {
+                $this->insertNewUser($user, $userData);
+            }
+            return $userData;
+        }
+
+        $userDataArray = $this->importFromJson($accountData[0]['data'], $uid);
+        if ($userDataArray === null || $userDataArray === []) {
+            return $this->buildDefaultUserRecord($user);
+        }
+
+        return $this->addMissingDefaultValues($userDataArray, $this->buildDefaultUserRecord($user));
+    }
+
+    public function searchUsers(string $property, array $values): array {
+        // the value col is limited to 255 bytes. It is used for searches only.
+        $values = array_map(function (string $value) {
+            return Util::shortenMultibyteString($value, 255);
+        }, $values);
+        $chunks = array_chunk($values, 500);
+        $query = $this->connection->getQueryBuilder();
+        $query->select('*')
+            ->from($this->dataTable)
+            ->where($query->expr()->eq('name', $query->createNamedParameter($property)))
+            ->andWhere($query->expr()->in('value', $query->createParameter('values')));
+
+        $matches = [];
+        foreach ($chunks as $chunk) {
+            $query->setParameter('values', $chunk, IQueryBuilder::PARAM_STR_ARRAY);
+            $result = $query->executeQuery();
+
+            while ($row = $result->fetch()) {
+                $matches[$row['uid']] = $row['value'];
+            }
+            $result->closeCursor();
+        }
+
+        $result = array_merge($matches, $this->searchUsersForRelatedCollection($property, $values));
+
+        return array_flip($result);
+    }
+
+    protected function searchUsersForRelatedCollection(string $property, array $values): array {
+        switch ($property) {
+            case IAccountManager::PROPERTY_EMAIL:
+                return array_flip($this->searchUsers(IAccountManager::COLLECTION_EMAIL, $values));
+            default:
+                return [];
+        }
+    }
+
+    /**
+     * check if we need to ask the server for email verification, if yes we create a cronjob
+     */
+    protected function checkEmailVerification(IAccount $updatedAccount, array $oldData): void {
+        try {
+            $property = $updatedAccount->getProperty(self::PROPERTY_EMAIL);
+        } catch (PropertyDoesNotExistException $e) {
+            return;
+        }
+
+        $oldMailIndex = array_search(self::PROPERTY_EMAIL, array_column($oldData, 'name'), true);
+        $oldMail = $oldMailIndex !== false ? $oldData[$oldMailIndex]['value'] : '';
+
+        if ($oldMail !== $property->getValue()) {
+            $this->jobList->add(
+                VerifyUserData::class,
+                [
+                    'verificationCode' => '',
+                    'data' => $property->getValue(),
+                    'type' => self::PROPERTY_EMAIL,
+                    'uid' => $updatedAccount->getUser()->getUID(),
+                    'try' => 0,
+                    'lastRun' => time()
+                ]
+            );
+
+            $property->setVerified(self::VERIFICATION_IN_PROGRESS);
+        }
+    }
+
+    protected function checkLocalEmailVerification(IAccount $updatedAccount, array $oldData): void {
+        $mailCollection = $updatedAccount->getPropertyCollection(self::COLLECTION_EMAIL);
+        foreach ($mailCollection->getProperties() as $property) {
+            if ($property->getLocallyVerified() !== self::NOT_VERIFIED) {
+                continue;
+            }
+            if ($this->sendEmailVerificationEmail($updatedAccount->getUser(), $property->getValue())) {
+                $property->setLocallyVerified(self::VERIFICATION_IN_PROGRESS);
+            }
+        }
+    }
+
+    protected function sendEmailVerificationEmail(IUser $user, string $email): bool {
+        $ref = \substr(hash('sha256', $email), 0, 8);
+        $key = $this->crypto->encrypt($email);
+        $token = $this->verificationToken->create($user, 'verifyMail' . $ref, $email);
+
+        $link = $this->urlGenerator->linkToRouteAbsolute(
+            'provisioning_api.Verification.verifyMail',
+            [
+                'userId' => $user->getUID(),
+                'token' => $token,
+                'key' => $key
+            ]
+        );
+
+        $emailTemplate = $this->mailer->createEMailTemplate('core.EmailVerification', [
+            'link' => $link,
+        ]);
+
+        if (!$this->l10n) {
+            $this->l10n = $this->l10nfactory->get('core');
+        }
+
+        $emailTemplate->setSubject($this->l10n->t('%s email verification', [$this->defaults->getName()]));
+        $emailTemplate->addHeader();
+        $emailTemplate->addHeading($this->l10n->t('Email verification'));
+
+        $emailTemplate->addBodyText(
+            htmlspecialchars($this->l10n->t('Click the following button to confirm your email.')),
+            $this->l10n->t('Click the following link to confirm your email.')
+        );
+
+        $emailTemplate->addBodyButton(
+            htmlspecialchars($this->l10n->t('Confirm your email')),
+            $link,
+            false
+        );
+        $emailTemplate->addFooter();
+
+        try {
+            $message = $this->mailer->createMessage();
+            $message->setTo([$email => $user->getDisplayName()]);
+            $message->setFrom([Util::getDefaultEmailAddress('verification-noreply') => $this->defaults->getName()]);
+            $message->useTemplate($emailTemplate);
+            $this->mailer->send($message);
+        } catch (Exception $e) {
+            // Log the exception and continue
+            $this->logger->info('Failed to send verification mail', [
+                'app' => 'core',
+                'exception' => $e
+            ]);
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * Make sure that all expected data are set
+     */
+    protected function addMissingDefaultValues(array $userData, array $defaultUserData): array {
+        foreach ($defaultUserData as $defaultDataItem) {
+            // If property does not exist, initialize it
+            $userDataIndex = array_search($defaultDataItem['name'], array_column($userData, 'name'));
+            if ($userDataIndex === false) {
+                $userData[] = $defaultDataItem;
+                continue;
+            }
+
+            // Merge and extend default missing values
+            $userData[$userDataIndex] = array_merge($defaultDataItem, $userData[$userDataIndex]);
+        }
+
+        return $userData;
+    }
+
+    protected function updateVerificationStatus(IAccount $updatedAccount, array $oldData): void {
+        static $propertiesVerifiableByLookupServer = [
+            self::PROPERTY_TWITTER,
+            self::PROPERTY_FEDIVERSE,
+            self::PROPERTY_WEBSITE,
+            self::PROPERTY_EMAIL,
+        ];
+
+        foreach ($propertiesVerifiableByLookupServer as $propertyName) {
+            try {
+                $property = $updatedAccount->getProperty($propertyName);
+            } catch (PropertyDoesNotExistException $e) {
+                continue;
+            }
+            $wasVerified = isset($oldData[$propertyName])
+                && isset($oldData[$propertyName]['verified'])
+                && $oldData[$propertyName]['verified'] === self::VERIFIED;
+            if ((!isset($oldData[$propertyName])
+                    || !isset($oldData[$propertyName]['value'])
+                    || $property->getValue() !== $oldData[$propertyName]['value'])
+                && ($property->getVerified() !== self::NOT_VERIFIED
+                    || $wasVerified)
+            ) {
+                $property->setVerified(self::NOT_VERIFIED);
+            }
+        }
+    }
+
+    /**
+     * add new user to accounts table
+     *
+     * @param IUser $user
+     * @param array $data
+     */
+    protected function insertNewUser(IUser $user, array $data): void {
+        $uid = $user->getUID();
+        $jsonEncodedData = $this->prepareJson($data);
+        $query = $this->connection->getQueryBuilder();
+        $query->insert($this->table)
+            ->values(
+                [
+                    'uid' => $query->createNamedParameter($uid),
+                    'data' => $query->createNamedParameter($jsonEncodedData),
+                ]
+            )
+            ->executeStatement();
+
+        $this->deleteUserData($user);
+        $this->writeUserData($user, $data);
+    }
+
+    protected function prepareJson(array $data): string {
+        $preparedData = [];
+        foreach ($data as $dataRow) {
+            $propertyName = $dataRow['name'];
+            unset($dataRow['name']);
+
+            if (isset($dataRow['locallyVerified']) && $dataRow['locallyVerified'] === self::NOT_VERIFIED) {
+                // do not write default value, save DB space
+                unset($dataRow['locallyVerified']);
+            }
+
+            if (!$this->isCollection($propertyName)) {
+                $preparedData[$propertyName] = $dataRow;
+                continue;
+            }
+            if (!isset($preparedData[$propertyName])) {
+                $preparedData[$propertyName] = [];
+            }
+            $preparedData[$propertyName][] = $dataRow;
+        }
+        return json_encode($preparedData);
+    }
+
+    protected function importFromJson(string $json, string $userId): ?array {
+        $result = [];
+        $jsonArray = json_decode($json, true);
+        $jsonError = json_last_error();
+        if ($jsonError !== JSON_ERROR_NONE) {
+            $this->logger->critical(
+                'User data of {uid} contained invalid JSON (error {json_error}), hence falling back to a default user record',
+                [
+                    'uid' => $userId,
+                    'json_error' => $jsonError
+                ]
+            );
+            return null;
+        }
+        foreach ($jsonArray as $propertyName => $row) {
+            if (!$this->isCollection($propertyName)) {
+                $result[] = array_merge($row, ['name' => $propertyName]);
+                continue;
+            }
+            foreach ($row as $singleRow) {
+                $result[] = array_merge($singleRow, ['name' => $propertyName]);
+            }
+        }
+        return $result;
+    }
+
+    /**
+     * Update existing user in accounts table
+     */
+    protected function updateExistingUser(IUser $user, array $data, array $oldData): void {
+        $uid = $user->getUID();
+        $jsonEncodedData = $this->prepareJson($data);
+        $query = $this->connection->getQueryBuilder();
+        $query->update($this->table)
+            ->set('data', $query->createNamedParameter($jsonEncodedData))
+            ->where($query->expr()->eq('uid', $query->createNamedParameter($uid)))
+            ->executeStatement();
+
+        $this->deleteUserData($user);
+        $this->writeUserData($user, $data);
+    }
+
+    protected function writeUserData(IUser $user, array $data): void {
+        $query = $this->connection->getQueryBuilder();
+        $query->insert($this->dataTable)
+            ->values(
+                [
+                    'uid' => $query->createNamedParameter($user->getUID()),
+                    'name' => $query->createParameter('name'),
+                    'value' => $query->createParameter('value'),
+                ]
+            );
+        $this->writeUserDataProperties($query, $data);
+    }
+
+    protected function writeUserDataProperties(IQueryBuilder $query, array $data): void {
+        foreach ($data as $property) {
+            if ($property['name'] === self::PROPERTY_AVATAR) {
+                continue;
+            }
+
+            // the value col is limited to 255 bytes. It is used for searches only.
+            $value = $property['value'] ? Util::shortenMultibyteString($property['value'], 255) : '';
+
+            $query->setParameter('name', $property['name'])
+                ->setParameter('value', $value);
+            $query->executeStatement();
+        }
+    }
+
+    /**
+     * build default user record in case not data set exists yet
+     */
+    protected function buildDefaultUserRecord(IUser $user): array {
+        $scopes = array_merge(self::DEFAULT_SCOPES, array_filter($this->config->getSystemValue('account_manager.default_property_scope', []), static function (string $scope, string $property) {
+            return in_array($property, self::ALLOWED_PROPERTIES, true) && in_array($scope, self::ALLOWED_SCOPES, true);
+        }, ARRAY_FILTER_USE_BOTH));
+
+        return [
+            [
+                'name' => self::PROPERTY_DISPLAYNAME,
+                'value' => $user->getDisplayName(),
+                // Display name must be at least SCOPE_LOCAL
+                'scope' => $scopes[self::PROPERTY_DISPLAYNAME] === self::SCOPE_PRIVATE ? self::SCOPE_LOCAL : $scopes[self::PROPERTY_DISPLAYNAME],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_ADDRESS,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_ADDRESS],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_WEBSITE,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_WEBSITE],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_EMAIL,
+                'value' => $user->getEMailAddress(),
+                // Email must be at least SCOPE_LOCAL
+                'scope' => $scopes[self::PROPERTY_EMAIL] === self::SCOPE_PRIVATE ? self::SCOPE_LOCAL : $scopes[self::PROPERTY_EMAIL],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_AVATAR,
+                'scope' => $scopes[self::PROPERTY_AVATAR],
+            ],
+
+            [
+                'name' => self::PROPERTY_PHONE,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_PHONE],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_TWITTER,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_TWITTER],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_FEDIVERSE,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_FEDIVERSE],
+                'verified' => self::NOT_VERIFIED,
+            ],
+
+            [
+                'name' => self::PROPERTY_ORGANISATION,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_ORGANISATION],
+            ],
+
+            [
+                'name' => self::PROPERTY_ROLE,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_ROLE],
+            ],
+
+            [
+                'name' => self::PROPERTY_HEADLINE,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_HEADLINE],
+            ],
+
+            [
+                'name' => self::PROPERTY_BIOGRAPHY,
+                'value' => '',
+                'scope' => $scopes[self::PROPERTY_BIOGRAPHY],
+            ],
+
+            [
+                'name' => self::PROPERTY_PROFILE_ENABLED,
+                'value' => $this->isProfileEnabledByDefault($this->config) ? '1' : '0',
+            ],
+        ];
+    }
+
+    private function arrayDataToCollection(IAccount $account, array $data): IAccountPropertyCollection {
+        $collection = $account->getPropertyCollection($data['name']);
+
+        $p = new AccountProperty(
+            $data['name'],
+            $data['value'] ?? '',
+            $data['scope'] ?? self::SCOPE_LOCAL,
+            $data['verified'] ?? self::NOT_VERIFIED,
+            ''
+        );
+        $p->setLocallyVerified($data['locallyVerified'] ?? self::NOT_VERIFIED);
+        $collection->addProperty($p);
+
+        return $collection;
+    }
+
+    private function parseAccountData(IUser $user, $data): Account {
+        $account = new Account($user);
+        foreach ($data as $accountData) {
+            if ($this->isCollection($accountData['name'])) {
+                $account->setPropertyCollection($this->arrayDataToCollection($account, $accountData));
+            } else {
+                $account->setProperty($accountData['name'], $accountData['value'] ?? '', $accountData['scope'] ?? self::SCOPE_LOCAL, $accountData['verified'] ?? self::NOT_VERIFIED);
+                if (isset($accountData['locallyVerified'])) {
+                    $property = $account->getProperty($accountData['name']);
+                    $property->setLocallyVerified($accountData['locallyVerified']);
+                }
+            }
+        }
+        return $account;
+    }
+
+    public function getAccount(IUser $user): IAccount {
+        if ($this->internalCache->hasKey($user->getUID())) {
+            return $this->internalCache->get($user->getUID());
+        }
+        $account = $this->parseAccountData($user, $this->getUser($user));
+        $this->internalCache->set($user->getUID(), $account);
+        return $account;
+    }
+
+    public function updateAccount(IAccount $account): void {
+        $this->testValueLengths(iterator_to_array($account->getAllProperties()), true);
+        try {
+            $property = $account->getProperty(self::PROPERTY_PHONE);
+            $this->sanitizePhoneNumberValue($property);
+        } catch (PropertyDoesNotExistException $e) {
+            //  valid case, nothing to do
+        }
+
+        try {
+            $property = $account->getProperty(self::PROPERTY_WEBSITE);
+            $this->sanitizeWebsite($property);
+        } catch (PropertyDoesNotExistException $e) {
+            //  valid case, nothing to do
+        }
+
+        foreach ($account->getAllProperties() as $property) {
+            $this->testPropertyScope($property, self::ALLOWED_SCOPES, true);
+        }
+
+        $oldData = $this->getUser($account->getUser(), false);
+        $this->updateVerificationStatus($account, $oldData);
+        $this->checkEmailVerification($account, $oldData);
+        $this->checkLocalEmailVerification($account, $oldData);
+
+        $data = [];
+        foreach ($account->getAllProperties() as $property) {
+            /** @var IAccountProperty $property */
+            $data[] = [
+                'name' => $property->getName(),
+                'value' => $property->getValue(),
+                'scope' => $property->getScope(),
+                'verified' => $property->getVerified(),
+                'locallyVerified' => $property->getLocallyVerified(),
+            ];
+        }
+
+        $this->updateUser($account->getUser(), $data, $oldData, true);
+        $this->internalCache->set($account->getUser()->getUID(), $account);
+    }
 }

apps/provisioning_api/lib/Controller/UsersController.php

Indentation +1359 added lines, -1359 removed lines

@@ -77,1363 +77,1363 @@
 use Psr\Log\LoggerInterface;
 
 class UsersController extends AUserData {
-	/** @var IURLGenerator */
-	protected $urlGenerator;
-	/** @var LoggerInterface */
-	private $logger;
-	/** @var IFactory */
-	protected $l10nFactory;
-	/** @var NewUserMailHelper */
-	private $newUserMailHelper;
-	/** @var ISecureRandom */
-	private $secureRandom;
-	/** @var RemoteWipe */
-	private $remoteWipe;
-	/** @var KnownUserService */
-	private $knownUserService;
-	/** @var IEventDispatcher */
-	private $eventDispatcher;
-
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		IUserManager $userManager,
-		IConfig $config,
-		IGroupManager $groupManager,
-		IUserSession $userSession,
-		IAccountManager $accountManager,
-		IURLGenerator $urlGenerator,
-		LoggerInterface $logger,
-		IFactory $l10nFactory,
-		NewUserMailHelper $newUserMailHelper,
-		ISecureRandom $secureRandom,
-		RemoteWipe $remoteWipe,
-		KnownUserService $knownUserService,
-		IEventDispatcher $eventDispatcher
-	) {
-		parent::__construct(
-			$appName,
-			$request,
-			$userManager,
-			$config,
-			$groupManager,
-			$userSession,
-			$accountManager,
-			$l10nFactory
-		);
-
-		$this->urlGenerator = $urlGenerator;
-		$this->logger = $logger;
-		$this->l10nFactory = $l10nFactory;
-		$this->newUserMailHelper = $newUserMailHelper;
-		$this->secureRandom = $secureRandom;
-		$this->remoteWipe = $remoteWipe;
-		$this->knownUserService = $knownUserService;
-		$this->eventDispatcher = $eventDispatcher;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * returns a list of users
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return DataResponse
-	 */
-	public function getUsers(string $search = '', int $limit = null, int $offset = 0): DataResponse {
-		$user = $this->userSession->getUser();
-		$users = [];
-
-		// Admin? Or SubAdmin?
-		$uid = $user->getUID();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if ($this->groupManager->isAdmin($uid)) {
-			$users = $this->userManager->search($search, $limit, $offset);
-		} elseif ($subAdminManager->isSubAdmin($user)) {
-			$subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
-			foreach ($subAdminOfGroups as $key => $group) {
-				$subAdminOfGroups[$key] = $group->getGID();
-			}
-
-			$users = [];
-			foreach ($subAdminOfGroups as $group) {
-				$users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
-			}
-		}
-
-		$users = array_keys($users);
-
-		return new DataResponse([
-			'users' => $users
-		]);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * returns a list of users and their data
-	 */
-	public function getUsersDetails(string $search = '', int $limit = null, int $offset = 0): DataResponse {
-		$currentUser = $this->userSession->getUser();
-		$users = [];
-
-		// Admin? Or SubAdmin?
-		$uid = $currentUser->getUID();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if ($this->groupManager->isAdmin($uid)) {
-			$users = $this->userManager->search($search, $limit, $offset);
-			$users = array_keys($users);
-		} elseif ($subAdminManager->isSubAdmin($currentUser)) {
-			$subAdminOfGroups = $subAdminManager->getSubAdminsGroups($currentUser);
-			foreach ($subAdminOfGroups as $key => $group) {
-				$subAdminOfGroups[$key] = $group->getGID();
-			}
-
-			$users = [];
-			foreach ($subAdminOfGroups as $group) {
-				$users[] = array_keys($this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
-			}
-			$users = array_merge(...$users);
-		}
-
-		$usersDetails = [];
-		foreach ($users as $userId) {
-			$userId = (string) $userId;
-			$userData = $this->getUserData($userId);
-			// Do not insert empty entry
-			if (!empty($userData)) {
-				$usersDetails[$userId] = $userData;
-			} else {
-				// Logged user does not have permissions to see this user
-				// only showing its id
-				$usersDetails[$userId] = ['id' => $userId];
-			}
-		}
-
-		return new DataResponse([
-			'users' => $usersDetails
-		]);
-	}
-
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * @param string $location
-	 * @param array $search
-	 * @return DataResponse
-	 */
-	public function searchByPhoneNumbers(string $location, array $search): DataResponse {
-		$phoneUtil = PhoneNumberUtil::getInstance();
-
-		if ($phoneUtil->getCountryCodeForRegion($location) === 0) {
-			// Not a valid region code
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-
-		/** @var IUser $user */
-		$user = $this->userSession->getUser();
-		$knownTo = $user->getUID();
-		$defaultPhoneRegion = $this->config->getSystemValueString('default_phone_region');
-
-		$normalizedNumberToKey = [];
-		foreach ($search as $key => $phoneNumbers) {
-			foreach ($phoneNumbers as $phone) {
-				try {
-					$phoneNumber = $phoneUtil->parse($phone, $location);
-					if ($phoneUtil->isValidNumber($phoneNumber)) {
-						$normalizedNumber = $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
-						$normalizedNumberToKey[$normalizedNumber] = (string) $key;
-					}
-				} catch (NumberParseException $e) {
-				}
-
-				if ($defaultPhoneRegion !== '' && $defaultPhoneRegion !== $location && strpos($phone, '0') === 0) {
-					// If the number has a leading zero (no country code),
-					// we also check the default phone region of the instance,
-					// when it's different to the user's given region.
-					try {
-						$phoneNumber = $phoneUtil->parse($phone, $defaultPhoneRegion);
-						if ($phoneUtil->isValidNumber($phoneNumber)) {
-							$normalizedNumber = $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
-							$normalizedNumberToKey[$normalizedNumber] = (string) $key;
-						}
-					} catch (NumberParseException $e) {
-					}
-				}
-			}
-		}
-
-		$phoneNumbers = array_keys($normalizedNumberToKey);
-
-		if (empty($phoneNumbers)) {
-			return new DataResponse();
-		}
-
-		// Cleanup all previous entries and only allow new matches
-		$this->knownUserService->deleteKnownTo($knownTo);
-
-		$userMatches = $this->accountManager->searchUsers(IAccountManager::PROPERTY_PHONE, $phoneNumbers);
-
-		if (empty($userMatches)) {
-			return new DataResponse();
-		}
-
-		$cloudUrl = rtrim($this->urlGenerator->getAbsoluteURL('/'), '/');
-		if (strpos($cloudUrl, 'http://') === 0) {
-			$cloudUrl = substr($cloudUrl, strlen('http://'));
-		} elseif (strpos($cloudUrl, 'https://') === 0) {
-			$cloudUrl = substr($cloudUrl, strlen('https://'));
-		}
-
-		$matches = [];
-		foreach ($userMatches as $phone => $userId) {
-			// Not using the ICloudIdManager as that would run a search for each contact to find the display name in the address book
-			$matches[$normalizedNumberToKey[$phone]] = $userId . '@' . $cloudUrl;
-			$this->knownUserService->storeIsKnownToUser($knownTo, $userId);
-		}
-
-		return new DataResponse($matches);
-	}
-
-	/**
-	 * @throws OCSException
-	 */
-	private function createNewUserId(): string {
-		$attempts = 0;
-		do {
-			$uidCandidate = $this->secureRandom->generate(10, ISecureRandom::CHAR_HUMAN_READABLE);
-			if (!$this->userManager->userExists($uidCandidate)) {
-				return $uidCandidate;
-			}
-			$attempts++;
-		} while ($attempts < 10);
-		throw new OCSException('Could not create non-existing user id', 111);
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userid
-	 * @param string $password
-	 * @param string $displayName
-	 * @param string $email
-	 * @param array $groups
-	 * @param array $subadmin
-	 * @param string $quota
-	 * @param string $language
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addUser(
-		string $userid,
-		string $password = '',
-		string $displayName = '',
-		string $email = '',
-		array $groups = [],
-		array $subadmin = [],
-		string $quota = '',
-		string $language = '',
-		?string $manager = null,
-	): DataResponse {
-		$user = $this->userSession->getUser();
-		$isAdmin = $this->groupManager->isAdmin($user->getUID());
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		if (empty($userid) && $this->config->getAppValue('core', 'newUser.generateUserID', 'no') === 'yes') {
-			$userid = $this->createNewUserId();
-		}
-
-		if ($this->userManager->userExists($userid)) {
-			$this->logger->error('Failed addUser attempt: User already exists.', ['app' => 'ocs_api']);
-			throw new OCSException($this->l10nFactory->get('provisioning_api')->t('User already exists'), 102);
-		}
-
-		if ($groups !== []) {
-			foreach ($groups as $group) {
-				if (!$this->groupManager->groupExists($group)) {
-					throw new OCSException('group ' . $group . ' does not exist', 104);
-				}
-				if (!$isAdmin && !$subAdminManager->isSubAdminOfGroup($user, $this->groupManager->get($group))) {
-					throw new OCSException('insufficient privileges for group ' . $group, 105);
-				}
-			}
-		} else {
-			if (!$isAdmin) {
-				throw new OCSException('no group specified (required for subadmins)', 106);
-			}
-		}
-
-		$subadminGroups = [];
-		if ($subadmin !== []) {
-			foreach ($subadmin as $groupid) {
-				$group = $this->groupManager->get($groupid);
-				// Check if group exists
-				if ($group === null) {
-					throw new OCSException('Subadmin group does not exist', 102);
-				}
-				// Check if trying to make subadmin of admin group
-				if ($group->getGID() === 'admin') {
-					throw new OCSException('Cannot create subadmins for admin group', 103);
-				}
-				// Check if has permission to promote subadmins
-				if (!$subAdminManager->isSubAdminOfGroup($user, $group) && !$isAdmin) {
-					throw new OCSForbiddenException('No permissions to promote subadmins');
-				}
-				$subadminGroups[] = $group;
-			}
-		}
-
-		$generatePasswordResetToken = false;
-		if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
-			throw new OCSException('Invalid password value', 101);
-		}
-		if ($password === '') {
-			if ($email === '') {
-				throw new OCSException('To send a password link to the user an email address is required.', 108);
-			}
-
-			$passwordEvent = new GenerateSecurePasswordEvent();
-			$this->eventDispatcher->dispatchTyped($passwordEvent);
-
-			$password = $passwordEvent->getPassword();
-			if ($password === null) {
-				// Fallback: ensure to pass password_policy in any case
-				$password = $this->secureRandom->generate(10)
-					. $this->secureRandom->generate(1, ISecureRandom::CHAR_UPPER)
-					. $this->secureRandom->generate(1, ISecureRandom::CHAR_LOWER)
-					. $this->secureRandom->generate(1, ISecureRandom::CHAR_DIGITS)
-					. $this->secureRandom->generate(1, ISecureRandom::CHAR_SYMBOLS);
-			}
-			$generatePasswordResetToken = true;
-		}
-
-		if ($email === '' && $this->config->getAppValue('core', 'newUser.requireEmail', 'no') === 'yes') {
-			throw new OCSException('Required email address was not provided', 110);
-		}
-
-		try {
-			$newUser = $this->userManager->createUser($userid, $password);
-			$this->logger->info('Successful addUser call with userid: ' . $userid, ['app' => 'ocs_api']);
-
-			foreach ($groups as $group) {
-				$this->groupManager->get($group)->addUser($newUser);
-				$this->logger->info('Added userid ' . $userid . ' to group ' . $group, ['app' => 'ocs_api']);
-			}
-			foreach ($subadminGroups as $group) {
-				$subAdminManager->createSubAdmin($newUser, $group);
-			}
-
-			if ($displayName !== '') {
-				try {
-					$this->editUser($userid, self::USER_FIELD_DISPLAYNAME, $displayName);
-				} catch (OCSException $e) {
-					if ($newUser instanceof IUser) {
-						$newUser->delete();
-					}
-					throw $e;
-				}
-			}
-
-			if ($quota !== '') {
-				$this->editUser($userid, self::USER_FIELD_QUOTA, $quota);
-			}
-
-			if ($language !== '') {
-				$this->editUser($userid, self::USER_FIELD_LANGUAGE, $language);
-			}
-
-			/**
-			 * null -> nothing sent
-			 * '' -> unset manager
-			 * else -> set manager
-			 */
-			if ($manager !== null) {
-				$this->editUser($userid, self::USER_FIELD_MANAGER, $manager);
-			}
-
-			// Send new user mail only if a mail is set
-			if ($email !== '') {
-				$newUser->setEMailAddress($email);
-				if ($this->config->getAppValue('core', 'newUser.sendEmail', 'yes') === 'yes') {
-					try {
-						$emailTemplate = $this->newUserMailHelper->generateTemplate($newUser, $generatePasswordResetToken);
-						$this->newUserMailHelper->sendMail($newUser, $emailTemplate);
-					} catch (\Exception $e) {
-						// Mail could be failing hard or just be plain not configured
-						// Logging error as it is the hardest of the two
-						$this->logger->error(
-							"Unable to send the invitation mail to $email",
-							[
-								'app' => 'ocs_api',
-								'exception' => $e,
-							]
-						);
-					}
-				}
-			}
-
-			return new DataResponse(['id' => $userid]);
-		} catch (HintException $e) {
-			$this->logger->warning(
-				'Failed addUser attempt with hint exception.',
-				[
-					'app' => 'ocs_api',
-					'exception' => $e,
-				]
-			);
-			throw new OCSException($e->getHint(), 107);
-		} catch (OCSException $e) {
-			$this->logger->warning(
-				'Failed addUser attempt with ocs exception.',
-				[
-					'app' => 'ocs_api',
-					'exception' => $e,
-				]
-			);
-			throw $e;
-		} catch (InvalidArgumentException $e) {
-			$this->logger->error(
-				'Failed addUser attempt with invalid argument exception.',
-				[
-					'app' => 'ocs_api',
-					'exception' => $e,
-				]
-			);
-			throw new OCSException($e->getMessage(), 101);
-		} catch (\Exception $e) {
-			$this->logger->error(
-				'Failed addUser attempt with exception.',
-				[
-					'app' => 'ocs_api',
-					'exception' => $e
-				]
-			);
-			throw new OCSException('Bad request', 101);
-		}
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * gets user info
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUser(string $userId): DataResponse {
-		$includeScopes = false;
-		$currentUser = $this->userSession->getUser();
-		if ($currentUser && $currentUser->getUID() === $userId) {
-			$includeScopes = true;
-		}
-
-		$data = $this->getUserData($userId, $includeScopes);
-		// getUserData returns empty array if not enough permissions
-		if (empty($data)) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-		return new DataResponse($data);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * gets user info from the currently logged in user
-	 *
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getCurrentUser(): DataResponse {
-		$user = $this->userSession->getUser();
-		if ($user) {
-			$data = $this->getUserData($user->getUID(), true);
-			return new DataResponse($data);
-		}
-
-		throw new OCSException('', OCSController::RESPOND_UNAUTHORISED);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getEditableFields(): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-		if (!$currentLoggedInUser instanceof IUser) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		return $this->getEditableFieldsForUser($currentLoggedInUser->getUID());
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getEditableFieldsForUser(string $userId): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-		if (!$currentLoggedInUser instanceof IUser) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		$permittedFields = [];
-
-		if ($userId !== $currentLoggedInUser->getUID()) {
-			$targetUser = $this->userManager->get($userId);
-			if (!$targetUser instanceof IUser) {
-				throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-			}
-
-			$subAdminManager = $this->groupManager->getSubAdmin();
-			if (
-				!$this->groupManager->isAdmin($currentLoggedInUser->getUID())
-				&& !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
-			) {
-				throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-			}
-		} else {
-			$targetUser = $currentLoggedInUser;
-		}
-
-		// Editing self (display, email)
-		if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
-			if (
-				$targetUser->getBackend() instanceof ISetDisplayNameBackend
-				|| $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
-			) {
-				$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
-			}
-			$permittedFields[] = IAccountManager::PROPERTY_EMAIL;
-		}
-
-		$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
-		$permittedFields[] = IAccountManager::PROPERTY_PHONE;
-		$permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
-		$permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
-		$permittedFields[] = IAccountManager::PROPERTY_TWITTER;
-		$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
-		$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
-		$permittedFields[] = IAccountManager::PROPERTY_ROLE;
-		$permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
-		$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
-		$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
-
-		return new DataResponse($permittedFields);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 * @PasswordConfirmationRequired
-	 * @UserRateThrottle(limit=5, period=60)
-	 *
-	 * @throws OCSException
-	 */
-	public function editUserMultiValue(
-		string $userId,
-		string $collectionName,
-		string $key,
-		string $value
-	): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-		if ($currentLoggedInUser === null) {
-			throw new OCSException('', OCSController::RESPOND_UNAUTHORISED);
-		}
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		$isAdminOrSubadmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID())
-			|| $subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser);
-
-		$permittedFields = [];
-		if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			// Editing self (display, email)
-			$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
-			$permittedFields[] = IAccountManager::COLLECTION_EMAIL . self::SCOPE_SUFFIX;
-		} else {
-			// Check if admin / subadmin
-			if ($isAdminOrSubadmin) {
-				// They have permissions over the user
-				$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
-			} else {
-				// No rights
-				throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-			}
-		}
-
-		// Check if permitted to edit this field
-		if (!in_array($collectionName, $permittedFields)) {
-			throw new OCSException('', 103);
-		}
-
-		switch ($collectionName) {
-			case IAccountManager::COLLECTION_EMAIL:
-				$userAccount = $this->accountManager->getAccount($targetUser);
-				$mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
-				$mailCollection->removePropertyByValue($key);
-				if ($value !== '') {
-					$mailCollection->addPropertyWithDefaults($value);
-					$property = $mailCollection->getPropertyByValue($key);
-					if ($isAdminOrSubadmin && $property) {
-						// admin set mails are auto-verified
-						$property->setLocallyVerified(IAccountManager::VERIFIED);
-					}
-				}
-				$this->accountManager->updateAccount($userAccount);
-				break;
-
-			case IAccountManager::COLLECTION_EMAIL . self::SCOPE_SUFFIX:
-				$userAccount = $this->accountManager->getAccount($targetUser);
-				$mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
-				$targetProperty = null;
-				foreach ($mailCollection->getProperties() as $property) {
-					if ($property->getValue() === $key) {
-						$targetProperty = $property;
-						break;
-					}
-				}
-				if ($targetProperty instanceof IAccountProperty) {
-					try {
-						$targetProperty->setScope($value);
-						$this->accountManager->updateAccount($userAccount);
-					} catch (InvalidArgumentException $e) {
-						throw new OCSException('', 102);
-					}
-				} else {
-					throw new OCSException('', 102);
-				}
-				break;
-
-			default:
-				throw new OCSException('', 103);
-		}
-		return new DataResponse();
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 * @PasswordConfirmationRequired
-	 * @UserRateThrottle(limit=50, period=600)
-	 *
-	 * edit users
-	 *
-	 * @param string $userId
-	 * @param string $key
-	 * @param string $value
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function editUser(string $userId, string $key, string $value): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		$permittedFields = [];
-		if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			// Editing self (display, email)
-			if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
-				if (
-					$targetUser->getBackend() instanceof ISetDisplayNameBackend
-					|| $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
-				) {
-					$permittedFields[] = self::USER_FIELD_DISPLAYNAME;
-					$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
-				}
-				$permittedFields[] = IAccountManager::PROPERTY_EMAIL;
-			}
-
-			$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_EMAIL . self::SCOPE_SUFFIX;
-
-			$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
-
-			$permittedFields[] = self::USER_FIELD_PASSWORD;
-			$permittedFields[] = self::USER_FIELD_NOTIFICATION_EMAIL;
-			if (
-				$this->config->getSystemValue('force_language', false) === false ||
-				$this->groupManager->isAdmin($currentLoggedInUser->getUID())
-			) {
-				$permittedFields[] = self::USER_FIELD_LANGUAGE;
-			}
-
-			if (
-				$this->config->getSystemValue('force_locale', false) === false ||
-				$this->groupManager->isAdmin($currentLoggedInUser->getUID())
-			) {
-				$permittedFields[] = self::USER_FIELD_LOCALE;
-			}
-
-			$permittedFields[] = IAccountManager::PROPERTY_PHONE;
-			$permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
-			$permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
-			$permittedFields[] = IAccountManager::PROPERTY_TWITTER;
-			$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
-			$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
-			$permittedFields[] = IAccountManager::PROPERTY_ROLE;
-			$permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
-			$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
-			$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
-			$permittedFields[] = IAccountManager::PROPERTY_PHONE . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_ADDRESS . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_WEBSITE . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_TWITTER . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_ROLE . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_HEADLINE . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY . self::SCOPE_SUFFIX;
-			$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED . self::SCOPE_SUFFIX;
-
-			$permittedFields[] = IAccountManager::PROPERTY_AVATAR . self::SCOPE_SUFFIX;
-
-			// If admin they can edit their own quota and manager
-			if ($this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
-				$permittedFields[] = self::USER_FIELD_QUOTA;
-				$permittedFields[] = self::USER_FIELD_MANAGER;
-
-			}
-		} else {
-			// Check if admin / subadmin
-			$subAdminManager = $this->groupManager->getSubAdmin();
-			if (
-				$this->groupManager->isAdmin($currentLoggedInUser->getUID())
-				|| $subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
-			) {
-				// They have permissions over the user
-				if (
-					$targetUser->getBackend() instanceof ISetDisplayNameBackend
-					|| $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
-				) {
-					$permittedFields[] = self::USER_FIELD_DISPLAYNAME;
-					$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
-				}
-				$permittedFields[] = IAccountManager::PROPERTY_EMAIL;
-				$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
-				$permittedFields[] = self::USER_FIELD_PASSWORD;
-				$permittedFields[] = self::USER_FIELD_LANGUAGE;
-				$permittedFields[] = self::USER_FIELD_LOCALE;
-				$permittedFields[] = IAccountManager::PROPERTY_PHONE;
-				$permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
-				$permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
-				$permittedFields[] = IAccountManager::PROPERTY_TWITTER;
-				$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
-				$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
-				$permittedFields[] = IAccountManager::PROPERTY_ROLE;
-				$permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
-				$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
-				$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
-				$permittedFields[] = self::USER_FIELD_QUOTA;
-				$permittedFields[] = self::USER_FIELD_NOTIFICATION_EMAIL;
-				$permittedFields[] = self::USER_FIELD_MANAGER;
-			} else {
-				// No rights
-				throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-			}
-		}
-		// Check if permitted to edit this field
-		if (!in_array($key, $permittedFields)) {
-			throw new OCSException('', 103);
-		}
-		// Process the edit
-		switch ($key) {
-			case self::USER_FIELD_DISPLAYNAME:
-			case IAccountManager::PROPERTY_DISPLAYNAME:
-				try {
-					$targetUser->setDisplayName($value);
-				} catch (InvalidArgumentException $e) {
-					throw new OCSException($e->getMessage(), 101);
-				}
-				break;
-			case self::USER_FIELD_QUOTA:
-				$quota = $value;
-				if ($quota !== 'none' && $quota !== 'default') {
-					if (is_numeric($quota)) {
-						$quota = (float) $quota;
-					} else {
-						$quota = \OCP\Util::computerFileSize($quota);
-					}
-					if ($quota === false) {
-						throw new OCSException('Invalid quota value ' . $value, 102);
-					}
-					if ($quota === -1) {
-						$quota = 'none';
-					} else {
-						$maxQuota = (int) $this->config->getAppValue('files', 'max_quota', '-1');
-						if ($maxQuota !== -1 && $quota > $maxQuota) {
-							throw new OCSException('Invalid quota value. ' . $value . ' is exceeding the maximum quota', 102);
-						}
-						$quota = \OCP\Util::humanFileSize($quota);
-					}
-				}
-				// no else block because quota can be set to 'none' in previous if
-				if ($quota === 'none') {
-					$allowUnlimitedQuota = $this->config->getAppValue('files', 'allow_unlimited_quota', '1') === '1';
-					if (!$allowUnlimitedQuota) {
-						throw new OCSException('Unlimited quota is forbidden on this instance', 102);
-					}
-				}
-				$targetUser->setQuota($quota);
-				break;
-			case self::USER_FIELD_MANAGER:
-				$targetUser->setManagerUids([$value]);
-				break;
-			case self::USER_FIELD_PASSWORD:
-				try {
-					if (strlen($value) > IUserManager::MAX_PASSWORD_LENGTH) {
-						throw new OCSException('Invalid password value', 102);
-					}
-					if (!$targetUser->canChangePassword()) {
-						throw new OCSException('Setting the password is not supported by the users backend', 103);
-					}
-					$targetUser->setPassword($value);
-				} catch (HintException $e) { // password policy error
-					throw new OCSException($e->getMessage(), 103);
-				}
-				break;
-			case self::USER_FIELD_LANGUAGE:
-				$languagesCodes = $this->l10nFactory->findAvailableLanguages();
-				if (!in_array($value, $languagesCodes, true) && $value !== 'en') {
-					throw new OCSException('Invalid language', 102);
-				}
-				$this->config->setUserValue($targetUser->getUID(), 'core', 'lang', $value);
-				break;
-			case self::USER_FIELD_LOCALE:
-				if (!$this->l10nFactory->localeExists($value)) {
-					throw new OCSException('Invalid locale', 102);
-				}
-				$this->config->setUserValue($targetUser->getUID(), 'core', 'locale', $value);
-				break;
-			case self::USER_FIELD_NOTIFICATION_EMAIL:
-				$success = false;
-				if ($value === '' || filter_var($value, FILTER_VALIDATE_EMAIL)) {
-					try {
-						$targetUser->setPrimaryEMailAddress($value);
-						$success = true;
-					} catch (InvalidArgumentException $e) {
-						$this->logger->info(
-							'Cannot set primary email, because provided address is not verified',
-							[
-								'app' => 'provisioning_api',
-								'exception' => $e,
-							]
-						);
-					}
-				}
-				if (!$success) {
-					throw new OCSException('', 102);
-				}
-				break;
-			case IAccountManager::PROPERTY_EMAIL:
-				if (filter_var($value, FILTER_VALIDATE_EMAIL) || $value === '') {
-					$targetUser->setEMailAddress($value);
-				} else {
-					throw new OCSException('', 102);
-				}
-				break;
-			case IAccountManager::COLLECTION_EMAIL:
-				if (filter_var($value, FILTER_VALIDATE_EMAIL) && $value !== $targetUser->getSystemEMailAddress()) {
-					$userAccount = $this->accountManager->getAccount($targetUser);
-					$mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
-
-					if ($mailCollection->getPropertyByValue($value)) {
-						throw new OCSException('', 102);
-					}
-
-					$mailCollection->addPropertyWithDefaults($value);
-					$this->accountManager->updateAccount($userAccount);
-				} else {
-					throw new OCSException('', 102);
-				}
-				break;
-			case IAccountManager::PROPERTY_PHONE:
-			case IAccountManager::PROPERTY_ADDRESS:
-			case IAccountManager::PROPERTY_WEBSITE:
-			case IAccountManager::PROPERTY_TWITTER:
-			case IAccountManager::PROPERTY_FEDIVERSE:
-			case IAccountManager::PROPERTY_ORGANISATION:
-			case IAccountManager::PROPERTY_ROLE:
-			case IAccountManager::PROPERTY_HEADLINE:
-			case IAccountManager::PROPERTY_BIOGRAPHY:
-				$userAccount = $this->accountManager->getAccount($targetUser);
-				try {
-					$userProperty = $userAccount->getProperty($key);
-					if ($userProperty->getValue() !== $value) {
-						try {
-							$userProperty->setValue($value);
-							if ($userProperty->getName() === IAccountManager::PROPERTY_PHONE) {
-								$this->knownUserService->deleteByContactUserId($targetUser->getUID());
-							}
-						} catch (InvalidArgumentException $e) {
-							throw new OCSException('Invalid ' . $e->getMessage(), 102);
-						}
-					}
-				} catch (PropertyDoesNotExistException $e) {
-					$userAccount->setProperty($key, $value, IAccountManager::SCOPE_PRIVATE, IAccountManager::NOT_VERIFIED);
-				}
-				try {
-					$this->accountManager->updateAccount($userAccount);
-				} catch (InvalidArgumentException $e) {
-					throw new OCSException('Invalid ' . $e->getMessage(), 102);
-				}
-				break;
-			case IAccountManager::PROPERTY_PROFILE_ENABLED:
-				$userAccount = $this->accountManager->getAccount($targetUser);
-				try {
-					$userProperty = $userAccount->getProperty($key);
-					if ($userProperty->getValue() !== $value) {
-						$userProperty->setValue($value);
-					}
-				} catch (PropertyDoesNotExistException $e) {
-					$userAccount->setProperty($key, $value, IAccountManager::SCOPE_LOCAL, IAccountManager::NOT_VERIFIED);
-				}
-				$this->accountManager->updateAccount($userAccount);
-				break;
-			case IAccountManager::PROPERTY_DISPLAYNAME . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_EMAIL . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_PHONE . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_ADDRESS . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_WEBSITE . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_TWITTER . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_FEDIVERSE . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_ORGANISATION . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_ROLE . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_HEADLINE . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_BIOGRAPHY . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_PROFILE_ENABLED . self::SCOPE_SUFFIX:
-			case IAccountManager::PROPERTY_AVATAR . self::SCOPE_SUFFIX:
-				$propertyName = substr($key, 0, strlen($key) - strlen(self::SCOPE_SUFFIX));
-				$userAccount = $this->accountManager->getAccount($targetUser);
-				$userProperty = $userAccount->getProperty($propertyName);
-				if ($userProperty->getScope() !== $value) {
-					try {
-						$userProperty->setScope($value);
-						$this->accountManager->updateAccount($userAccount);
-					} catch (InvalidArgumentException $e) {
-						throw new OCSException('Invalid ' . $e->getMessage(), 102);
-					}
-				}
-				break;
-			default:
-				throw new OCSException('', 103);
-		}
-		return new DataResponse();
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 *
-	 * @return DataResponse
-	 *
-	 * @throws OCSException
-	 */
-	public function wipeUserDevices(string $userId): DataResponse {
-		/** @var IUser $currentLoggedInUser */
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			throw new OCSException('', 101);
-		}
-
-		// If not permitted
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		$this->remoteWipe->markAllTokensForWipe($targetUser);
-
-		return new DataResponse();
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function deleteUser(string $userId): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			throw new OCSException('', 101);
-		}
-
-		// If not permitted
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		// Go ahead with the delete
-		if ($targetUser->delete()) {
-			return new DataResponse();
-		} else {
-			throw new OCSException('', 101);
-		}
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 * @throws OCSForbiddenException
-	 */
-	public function disableUser(string $userId): DataResponse {
-		return $this->setEnabled($userId, false);
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 * @throws OCSForbiddenException
-	 */
-	public function enableUser(string $userId): DataResponse {
-		return $this->setEnabled($userId, true);
-	}
-
-	/**
-	 * @param string $userId
-	 * @param bool $value
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	private function setEnabled(string $userId, bool $value): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			throw new OCSException('', 101);
-		}
-
-		// If not permitted
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		// enable/disable the user now
-		$targetUser->setEnabled($value);
-		return new DataResponse();
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUsersGroups(string $userId): DataResponse {
-		$loggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		if ($targetUser->getUID() === $loggedInUser->getUID() || $this->groupManager->isAdmin($loggedInUser->getUID())) {
-			// Self lookup or admin lookup
-			return new DataResponse([
-				'groups' => $this->groupManager->getUserGroupIds($targetUser)
-			]);
-		} else {
-			$subAdminManager = $this->groupManager->getSubAdmin();
-
-			// Looking up someone else
-			if ($subAdminManager->isUserAccessible($loggedInUser, $targetUser)) {
-				// Return the group that the method caller is subadmin of for the user in question
-				/** @var IGroup[] $getSubAdminsGroups */
-				$getSubAdminsGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
-				foreach ($getSubAdminsGroups as $key => $group) {
-					$getSubAdminsGroups[$key] = $group->getGID();
-				}
-				$groups = array_intersect(
-					$getSubAdminsGroups,
-					$this->groupManager->getUserGroupIds($targetUser)
-				);
-				return new DataResponse(['groups' => $groups]);
-			} else {
-				// Not permitted
-				throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-			}
-		}
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addToGroup(string $userId, string $groupid = ''): DataResponse {
-		if ($groupid === '') {
-			throw new OCSException('', 101);
-		}
-
-		$group = $this->groupManager->get($groupid);
-		$targetUser = $this->userManager->get($userId);
-		if ($group === null) {
-			throw new OCSException('', 102);
-		}
-		if ($targetUser === null) {
-			throw new OCSException('', 103);
-		}
-
-		// If they're not an admin, check they are a subadmin of the group in question
-		$loggedInUser = $this->userSession->getUser();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
-			throw new OCSException('', 104);
-		}
-
-		// Add user to group
-		$group->addUser($targetUser);
-		return new DataResponse();
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function removeFromGroup(string $userId, string $groupid): DataResponse {
-		$loggedInUser = $this->userSession->getUser();
-
-		if ($groupid === null || trim($groupid) === '') {
-			throw new OCSException('', 101);
-		}
-
-		$group = $this->groupManager->get($groupid);
-		if ($group === null) {
-			throw new OCSException('', 102);
-		}
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', 103);
-		}
-
-		// If they're not an admin, check they are a subadmin of the group in question
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
-			throw new OCSException('', 104);
-		}
-
-		// Check they aren't removing themselves from 'admin' or their 'subadmin; group
-		if ($targetUser->getUID() === $loggedInUser->getUID()) {
-			if ($this->groupManager->isAdmin($loggedInUser->getUID())) {
-				if ($group->getGID() === 'admin') {
-					throw new OCSException('Cannot remove yourself from the admin group', 105);
-				}
-			} else {
-				// Not an admin, so the user must be a subadmin of this group, but that is not allowed.
-				throw new OCSException('Cannot remove yourself from this group as you are a SubAdmin', 105);
-			}
-		} elseif (!$this->groupManager->isAdmin($loggedInUser->getUID())) {
-			/** @var IGroup[] $subAdminGroups */
-			$subAdminGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
-			$subAdminGroups = array_map(function (IGroup $subAdminGroup) {
-				return $subAdminGroup->getGID();
-			}, $subAdminGroups);
-			$userGroups = $this->groupManager->getUserGroupIds($targetUser);
-			$userSubAdminGroups = array_intersect($subAdminGroups, $userGroups);
-
-			if (count($userSubAdminGroups) <= 1) {
-				// Subadmin must not be able to remove a user from all their subadmin groups.
-				throw new OCSException('Not viable to remove user from the last group you are SubAdmin of', 105);
-			}
-		}
-
-		// Remove user from group
-		$group->removeUser($targetUser);
-		return new DataResponse();
-	}
-
-	/**
-	 * Creates a subadmin
-	 *
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addSubAdmin(string $userId, string $groupid): DataResponse {
-		$group = $this->groupManager->get($groupid);
-		$user = $this->userManager->get($userId);
-
-		// Check if the user exists
-		if ($user === null) {
-			throw new OCSException('User does not exist', 101);
-		}
-		// Check if group exists
-		if ($group === null) {
-			throw new OCSException('Group does not exist', 102);
-		}
-		// Check if trying to make subadmin of admin group
-		if ($group->getGID() === 'admin') {
-			throw new OCSException('Cannot create subadmins for admin group', 103);
-		}
-
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		// We cannot be subadmin twice
-		if ($subAdminManager->isSubAdminOfGroup($user, $group)) {
-			return new DataResponse();
-		}
-		// Go
-		$subAdminManager->createSubAdmin($user, $group);
-		return new DataResponse();
-	}
-
-	/**
-	 * Removes a subadmin from a group
-	 *
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function removeSubAdmin(string $userId, string $groupid): DataResponse {
-		$group = $this->groupManager->get($groupid);
-		$user = $this->userManager->get($userId);
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		// Check if the user exists
-		if ($user === null) {
-			throw new OCSException('User does not exist', 101);
-		}
-		// Check if the group exists
-		if ($group === null) {
-			throw new OCSException('Group does not exist', 101);
-		}
-		// Check if they are a subadmin of this said group
-		if (!$subAdminManager->isSubAdminOfGroup($user, $group)) {
-			throw new OCSException('User is not a subadmin of this group', 102);
-		}
-
-		// Go
-		$subAdminManager->deleteSubAdmin($user, $group);
-		return new DataResponse();
-	}
-
-	/**
-	 * Get the groups a user is a subadmin of
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUserSubAdminGroups(string $userId): DataResponse {
-		$groups = $this->getUserSubAdminGroupsData($userId);
-		return new DataResponse($groups);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * resend welcome message
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function resendWelcomeMessage(string $userId): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		// Check if admin / subadmin
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (
-			!$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
-			&& !$this->groupManager->isAdmin($currentLoggedInUser->getUID())
-		) {
-			// No rights
-			throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
-		}
-
-		$email = $targetUser->getEMailAddress();
-		if ($email === '' || $email === null) {
-			throw new OCSException('Email address not available', 101);
-		}
-
-		try {
-			$emailTemplate = $this->newUserMailHelper->generateTemplate($targetUser, false);
-			$this->newUserMailHelper->sendMail($targetUser, $emailTemplate);
-		} catch (\Exception $e) {
-			$this->logger->error(
-				"Can't send new user mail to $email",
-				[
-					'app' => 'settings',
-					'exception' => $e,
-				]
-			);
-			throw new OCSException('Sending email failed', 102);
-		}
-
-		return new DataResponse();
-	}
+    /** @var IURLGenerator */
+    protected $urlGenerator;
+    /** @var LoggerInterface */
+    private $logger;
+    /** @var IFactory */
+    protected $l10nFactory;
+    /** @var NewUserMailHelper */
+    private $newUserMailHelper;
+    /** @var ISecureRandom */
+    private $secureRandom;
+    /** @var RemoteWipe */
+    private $remoteWipe;
+    /** @var KnownUserService */
+    private $knownUserService;
+    /** @var IEventDispatcher */
+    private $eventDispatcher;
+
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        IUserManager $userManager,
+        IConfig $config,
+        IGroupManager $groupManager,
+        IUserSession $userSession,
+        IAccountManager $accountManager,
+        IURLGenerator $urlGenerator,
+        LoggerInterface $logger,
+        IFactory $l10nFactory,
+        NewUserMailHelper $newUserMailHelper,
+        ISecureRandom $secureRandom,
+        RemoteWipe $remoteWipe,
+        KnownUserService $knownUserService,
+        IEventDispatcher $eventDispatcher
+    ) {
+        parent::__construct(
+            $appName,
+            $request,
+            $userManager,
+            $config,
+            $groupManager,
+            $userSession,
+            $accountManager,
+            $l10nFactory
+        );
+
+        $this->urlGenerator = $urlGenerator;
+        $this->logger = $logger;
+        $this->l10nFactory = $l10nFactory;
+        $this->newUserMailHelper = $newUserMailHelper;
+        $this->secureRandom = $secureRandom;
+        $this->remoteWipe = $remoteWipe;
+        $this->knownUserService = $knownUserService;
+        $this->eventDispatcher = $eventDispatcher;
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * returns a list of users
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return DataResponse
+     */
+    public function getUsers(string $search = '', int $limit = null, int $offset = 0): DataResponse {
+        $user = $this->userSession->getUser();
+        $users = [];
+
+        // Admin? Or SubAdmin?
+        $uid = $user->getUID();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if ($this->groupManager->isAdmin($uid)) {
+            $users = $this->userManager->search($search, $limit, $offset);
+        } elseif ($subAdminManager->isSubAdmin($user)) {
+            $subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
+            foreach ($subAdminOfGroups as $key => $group) {
+                $subAdminOfGroups[$key] = $group->getGID();
+            }
+
+            $users = [];
+            foreach ($subAdminOfGroups as $group) {
+                $users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
+            }
+        }
+
+        $users = array_keys($users);
+
+        return new DataResponse([
+            'users' => $users
+        ]);
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * returns a list of users and their data
+     */
+    public function getUsersDetails(string $search = '', int $limit = null, int $offset = 0): DataResponse {
+        $currentUser = $this->userSession->getUser();
+        $users = [];
+
+        // Admin? Or SubAdmin?
+        $uid = $currentUser->getUID();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if ($this->groupManager->isAdmin($uid)) {
+            $users = $this->userManager->search($search, $limit, $offset);
+            $users = array_keys($users);
+        } elseif ($subAdminManager->isSubAdmin($currentUser)) {
+            $subAdminOfGroups = $subAdminManager->getSubAdminsGroups($currentUser);
+            foreach ($subAdminOfGroups as $key => $group) {
+                $subAdminOfGroups[$key] = $group->getGID();
+            }
+
+            $users = [];
+            foreach ($subAdminOfGroups as $group) {
+                $users[] = array_keys($this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
+            }
+            $users = array_merge(...$users);
+        }
+
+        $usersDetails = [];
+        foreach ($users as $userId) {
+            $userId = (string) $userId;
+            $userData = $this->getUserData($userId);
+            // Do not insert empty entry
+            if (!empty($userData)) {
+                $usersDetails[$userId] = $userData;
+            } else {
+                // Logged user does not have permissions to see this user
+                // only showing its id
+                $usersDetails[$userId] = ['id' => $userId];
+            }
+        }
+
+        return new DataResponse([
+            'users' => $usersDetails
+        ]);
+    }
+
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * @param string $location
+     * @param array $search
+     * @return DataResponse
+     */
+    public function searchByPhoneNumbers(string $location, array $search): DataResponse {
+        $phoneUtil = PhoneNumberUtil::getInstance();
+
+        if ($phoneUtil->getCountryCodeForRegion($location) === 0) {
+            // Not a valid region code
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+
+        /** @var IUser $user */
+        $user = $this->userSession->getUser();
+        $knownTo = $user->getUID();
+        $defaultPhoneRegion = $this->config->getSystemValueString('default_phone_region');
+
+        $normalizedNumberToKey = [];
+        foreach ($search as $key => $phoneNumbers) {
+            foreach ($phoneNumbers as $phone) {
+                try {
+                    $phoneNumber = $phoneUtil->parse($phone, $location);
+                    if ($phoneUtil->isValidNumber($phoneNumber)) {
+                        $normalizedNumber = $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
+                        $normalizedNumberToKey[$normalizedNumber] = (string) $key;
+                    }
+                } catch (NumberParseException $e) {
+                }
+
+                if ($defaultPhoneRegion !== '' && $defaultPhoneRegion !== $location && strpos($phone, '0') === 0) {
+                    // If the number has a leading zero (no country code),
+                    // we also check the default phone region of the instance,
+                    // when it's different to the user's given region.
+                    try {
+                        $phoneNumber = $phoneUtil->parse($phone, $defaultPhoneRegion);
+                        if ($phoneUtil->isValidNumber($phoneNumber)) {
+                            $normalizedNumber = $phoneUtil->format($phoneNumber, PhoneNumberFormat::E164);
+                            $normalizedNumberToKey[$normalizedNumber] = (string) $key;
+                        }
+                    } catch (NumberParseException $e) {
+                    }
+                }
+            }
+        }
+
+        $phoneNumbers = array_keys($normalizedNumberToKey);
+
+        if (empty($phoneNumbers)) {
+            return new DataResponse();
+        }
+
+        // Cleanup all previous entries and only allow new matches
+        $this->knownUserService->deleteKnownTo($knownTo);
+
+        $userMatches = $this->accountManager->searchUsers(IAccountManager::PROPERTY_PHONE, $phoneNumbers);
+
+        if (empty($userMatches)) {
+            return new DataResponse();
+        }
+
+        $cloudUrl = rtrim($this->urlGenerator->getAbsoluteURL('/'), '/');
+        if (strpos($cloudUrl, 'http://') === 0) {
+            $cloudUrl = substr($cloudUrl, strlen('http://'));
+        } elseif (strpos($cloudUrl, 'https://') === 0) {
+            $cloudUrl = substr($cloudUrl, strlen('https://'));
+        }
+
+        $matches = [];
+        foreach ($userMatches as $phone => $userId) {
+            // Not using the ICloudIdManager as that would run a search for each contact to find the display name in the address book
+            $matches[$normalizedNumberToKey[$phone]] = $userId . '@' . $cloudUrl;
+            $this->knownUserService->storeIsKnownToUser($knownTo, $userId);
+        }
+
+        return new DataResponse($matches);
+    }
+
+    /**
+     * @throws OCSException
+     */
+    private function createNewUserId(): string {
+        $attempts = 0;
+        do {
+            $uidCandidate = $this->secureRandom->generate(10, ISecureRandom::CHAR_HUMAN_READABLE);
+            if (!$this->userManager->userExists($uidCandidate)) {
+                return $uidCandidate;
+            }
+            $attempts++;
+        } while ($attempts < 10);
+        throw new OCSException('Could not create non-existing user id', 111);
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userid
+     * @param string $password
+     * @param string $displayName
+     * @param string $email
+     * @param array $groups
+     * @param array $subadmin
+     * @param string $quota
+     * @param string $language
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addUser(
+        string $userid,
+        string $password = '',
+        string $displayName = '',
+        string $email = '',
+        array $groups = [],
+        array $subadmin = [],
+        string $quota = '',
+        string $language = '',
+        ?string $manager = null,
+    ): DataResponse {
+        $user = $this->userSession->getUser();
+        $isAdmin = $this->groupManager->isAdmin($user->getUID());
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        if (empty($userid) && $this->config->getAppValue('core', 'newUser.generateUserID', 'no') === 'yes') {
+            $userid = $this->createNewUserId();
+        }
+
+        if ($this->userManager->userExists($userid)) {
+            $this->logger->error('Failed addUser attempt: User already exists.', ['app' => 'ocs_api']);
+            throw new OCSException($this->l10nFactory->get('provisioning_api')->t('User already exists'), 102);
+        }
+
+        if ($groups !== []) {
+            foreach ($groups as $group) {
+                if (!$this->groupManager->groupExists($group)) {
+                    throw new OCSException('group ' . $group . ' does not exist', 104);
+                }
+                if (!$isAdmin && !$subAdminManager->isSubAdminOfGroup($user, $this->groupManager->get($group))) {
+                    throw new OCSException('insufficient privileges for group ' . $group, 105);
+                }
+            }
+        } else {
+            if (!$isAdmin) {
+                throw new OCSException('no group specified (required for subadmins)', 106);
+            }
+        }
+
+        $subadminGroups = [];
+        if ($subadmin !== []) {
+            foreach ($subadmin as $groupid) {
+                $group = $this->groupManager->get($groupid);
+                // Check if group exists
+                if ($group === null) {
+                    throw new OCSException('Subadmin group does not exist', 102);
+                }
+                // Check if trying to make subadmin of admin group
+                if ($group->getGID() === 'admin') {
+                    throw new OCSException('Cannot create subadmins for admin group', 103);
+                }
+                // Check if has permission to promote subadmins
+                if (!$subAdminManager->isSubAdminOfGroup($user, $group) && !$isAdmin) {
+                    throw new OCSForbiddenException('No permissions to promote subadmins');
+                }
+                $subadminGroups[] = $group;
+            }
+        }
+
+        $generatePasswordResetToken = false;
+        if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
+            throw new OCSException('Invalid password value', 101);
+        }
+        if ($password === '') {
+            if ($email === '') {
+                throw new OCSException('To send a password link to the user an email address is required.', 108);
+            }
+
+            $passwordEvent = new GenerateSecurePasswordEvent();
+            $this->eventDispatcher->dispatchTyped($passwordEvent);
+
+            $password = $passwordEvent->getPassword();
+            if ($password === null) {
+                // Fallback: ensure to pass password_policy in any case
+                $password = $this->secureRandom->generate(10)
+                    . $this->secureRandom->generate(1, ISecureRandom::CHAR_UPPER)
+                    . $this->secureRandom->generate(1, ISecureRandom::CHAR_LOWER)
+                    . $this->secureRandom->generate(1, ISecureRandom::CHAR_DIGITS)
+                    . $this->secureRandom->generate(1, ISecureRandom::CHAR_SYMBOLS);
+            }
+            $generatePasswordResetToken = true;
+        }
+
+        if ($email === '' && $this->config->getAppValue('core', 'newUser.requireEmail', 'no') === 'yes') {
+            throw new OCSException('Required email address was not provided', 110);
+        }
+
+        try {
+            $newUser = $this->userManager->createUser($userid, $password);
+            $this->logger->info('Successful addUser call with userid: ' . $userid, ['app' => 'ocs_api']);
+
+            foreach ($groups as $group) {
+                $this->groupManager->get($group)->addUser($newUser);
+                $this->logger->info('Added userid ' . $userid . ' to group ' . $group, ['app' => 'ocs_api']);
+            }
+            foreach ($subadminGroups as $group) {
+                $subAdminManager->createSubAdmin($newUser, $group);
+            }
+
+            if ($displayName !== '') {
+                try {
+                    $this->editUser($userid, self::USER_FIELD_DISPLAYNAME, $displayName);
+                } catch (OCSException $e) {
+                    if ($newUser instanceof IUser) {
+                        $newUser->delete();
+                    }
+                    throw $e;
+                }
+            }
+
+            if ($quota !== '') {
+                $this->editUser($userid, self::USER_FIELD_QUOTA, $quota);
+            }
+
+            if ($language !== '') {
+                $this->editUser($userid, self::USER_FIELD_LANGUAGE, $language);
+            }
+
+            /**
+             * null -> nothing sent
+             * '' -> unset manager
+             * else -> set manager
+             */
+            if ($manager !== null) {
+                $this->editUser($userid, self::USER_FIELD_MANAGER, $manager);
+            }
+
+            // Send new user mail only if a mail is set
+            if ($email !== '') {
+                $newUser->setEMailAddress($email);
+                if ($this->config->getAppValue('core', 'newUser.sendEmail', 'yes') === 'yes') {
+                    try {
+                        $emailTemplate = $this->newUserMailHelper->generateTemplate($newUser, $generatePasswordResetToken);
+                        $this->newUserMailHelper->sendMail($newUser, $emailTemplate);
+                    } catch (\Exception $e) {
+                        // Mail could be failing hard or just be plain not configured
+                        // Logging error as it is the hardest of the two
+                        $this->logger->error(
+                            "Unable to send the invitation mail to $email",
+                            [
+                                'app' => 'ocs_api',
+                                'exception' => $e,
+                            ]
+                        );
+                    }
+                }
+            }
+
+            return new DataResponse(['id' => $userid]);
+        } catch (HintException $e) {
+            $this->logger->warning(
+                'Failed addUser attempt with hint exception.',
+                [
+                    'app' => 'ocs_api',
+                    'exception' => $e,
+                ]
+            );
+            throw new OCSException($e->getHint(), 107);
+        } catch (OCSException $e) {
+            $this->logger->warning(
+                'Failed addUser attempt with ocs exception.',
+                [
+                    'app' => 'ocs_api',
+                    'exception' => $e,
+                ]
+            );
+            throw $e;
+        } catch (InvalidArgumentException $e) {
+            $this->logger->error(
+                'Failed addUser attempt with invalid argument exception.',
+                [
+                    'app' => 'ocs_api',
+                    'exception' => $e,
+                ]
+            );
+            throw new OCSException($e->getMessage(), 101);
+        } catch (\Exception $e) {
+            $this->logger->error(
+                'Failed addUser attempt with exception.',
+                [
+                    'app' => 'ocs_api',
+                    'exception' => $e
+                ]
+            );
+            throw new OCSException('Bad request', 101);
+        }
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * gets user info
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUser(string $userId): DataResponse {
+        $includeScopes = false;
+        $currentUser = $this->userSession->getUser();
+        if ($currentUser && $currentUser->getUID() === $userId) {
+            $includeScopes = true;
+        }
+
+        $data = $this->getUserData($userId, $includeScopes);
+        // getUserData returns empty array if not enough permissions
+        if (empty($data)) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+        return new DataResponse($data);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * gets user info from the currently logged in user
+     *
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getCurrentUser(): DataResponse {
+        $user = $this->userSession->getUser();
+        if ($user) {
+            $data = $this->getUserData($user->getUID(), true);
+            return new DataResponse($data);
+        }
+
+        throw new OCSException('', OCSController::RESPOND_UNAUTHORISED);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getEditableFields(): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+        if (!$currentLoggedInUser instanceof IUser) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        return $this->getEditableFieldsForUser($currentLoggedInUser->getUID());
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getEditableFieldsForUser(string $userId): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+        if (!$currentLoggedInUser instanceof IUser) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        $permittedFields = [];
+
+        if ($userId !== $currentLoggedInUser->getUID()) {
+            $targetUser = $this->userManager->get($userId);
+            if (!$targetUser instanceof IUser) {
+                throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+            }
+
+            $subAdminManager = $this->groupManager->getSubAdmin();
+            if (
+                !$this->groupManager->isAdmin($currentLoggedInUser->getUID())
+                && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
+            ) {
+                throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+            }
+        } else {
+            $targetUser = $currentLoggedInUser;
+        }
+
+        // Editing self (display, email)
+        if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
+            if (
+                $targetUser->getBackend() instanceof ISetDisplayNameBackend
+                || $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
+            ) {
+                $permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
+            }
+            $permittedFields[] = IAccountManager::PROPERTY_EMAIL;
+        }
+
+        $permittedFields[] = IAccountManager::COLLECTION_EMAIL;
+        $permittedFields[] = IAccountManager::PROPERTY_PHONE;
+        $permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
+        $permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
+        $permittedFields[] = IAccountManager::PROPERTY_TWITTER;
+        $permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
+        $permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
+        $permittedFields[] = IAccountManager::PROPERTY_ROLE;
+        $permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
+        $permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
+        $permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
+
+        return new DataResponse($permittedFields);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     * @PasswordConfirmationRequired
+     * @UserRateThrottle(limit=5, period=60)
+     *
+     * @throws OCSException
+     */
+    public function editUserMultiValue(
+        string $userId,
+        string $collectionName,
+        string $key,
+        string $value
+    ): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+        if ($currentLoggedInUser === null) {
+            throw new OCSException('', OCSController::RESPOND_UNAUTHORISED);
+        }
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        $isAdminOrSubadmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID())
+            || $subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser);
+
+        $permittedFields = [];
+        if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            // Editing self (display, email)
+            $permittedFields[] = IAccountManager::COLLECTION_EMAIL;
+            $permittedFields[] = IAccountManager::COLLECTION_EMAIL . self::SCOPE_SUFFIX;
+        } else {
+            // Check if admin / subadmin
+            if ($isAdminOrSubadmin) {
+                // They have permissions over the user
+                $permittedFields[] = IAccountManager::COLLECTION_EMAIL;
+            } else {
+                // No rights
+                throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+            }
+        }
+
+        // Check if permitted to edit this field
+        if (!in_array($collectionName, $permittedFields)) {
+            throw new OCSException('', 103);
+        }
+
+        switch ($collectionName) {
+            case IAccountManager::COLLECTION_EMAIL:
+                $userAccount = $this->accountManager->getAccount($targetUser);
+                $mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
+                $mailCollection->removePropertyByValue($key);
+                if ($value !== '') {
+                    $mailCollection->addPropertyWithDefaults($value);
+                    $property = $mailCollection->getPropertyByValue($key);
+                    if ($isAdminOrSubadmin && $property) {
+                        // admin set mails are auto-verified
+                        $property->setLocallyVerified(IAccountManager::VERIFIED);
+                    }
+                }
+                $this->accountManager->updateAccount($userAccount);
+                break;
+
+            case IAccountManager::COLLECTION_EMAIL . self::SCOPE_SUFFIX:
+                $userAccount = $this->accountManager->getAccount($targetUser);
+                $mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
+                $targetProperty = null;
+                foreach ($mailCollection->getProperties() as $property) {
+                    if ($property->getValue() === $key) {
+                        $targetProperty = $property;
+                        break;
+                    }
+                }
+                if ($targetProperty instanceof IAccountProperty) {
+                    try {
+                        $targetProperty->setScope($value);
+                        $this->accountManager->updateAccount($userAccount);
+                    } catch (InvalidArgumentException $e) {
+                        throw new OCSException('', 102);
+                    }
+                } else {
+                    throw new OCSException('', 102);
+                }
+                break;
+
+            default:
+                throw new OCSException('', 103);
+        }
+        return new DataResponse();
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     * @PasswordConfirmationRequired
+     * @UserRateThrottle(limit=50, period=600)
+     *
+     * edit users
+     *
+     * @param string $userId
+     * @param string $key
+     * @param string $value
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function editUser(string $userId, string $key, string $value): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        $permittedFields = [];
+        if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            // Editing self (display, email)
+            if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
+                if (
+                    $targetUser->getBackend() instanceof ISetDisplayNameBackend
+                    || $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
+                ) {
+                    $permittedFields[] = self::USER_FIELD_DISPLAYNAME;
+                    $permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
+                }
+                $permittedFields[] = IAccountManager::PROPERTY_EMAIL;
+            }
+
+            $permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_EMAIL . self::SCOPE_SUFFIX;
+
+            $permittedFields[] = IAccountManager::COLLECTION_EMAIL;
+
+            $permittedFields[] = self::USER_FIELD_PASSWORD;
+            $permittedFields[] = self::USER_FIELD_NOTIFICATION_EMAIL;
+            if (
+                $this->config->getSystemValue('force_language', false) === false ||
+                $this->groupManager->isAdmin($currentLoggedInUser->getUID())
+            ) {
+                $permittedFields[] = self::USER_FIELD_LANGUAGE;
+            }
+
+            if (
+                $this->config->getSystemValue('force_locale', false) === false ||
+                $this->groupManager->isAdmin($currentLoggedInUser->getUID())
+            ) {
+                $permittedFields[] = self::USER_FIELD_LOCALE;
+            }
+
+            $permittedFields[] = IAccountManager::PROPERTY_PHONE;
+            $permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
+            $permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
+            $permittedFields[] = IAccountManager::PROPERTY_TWITTER;
+            $permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
+            $permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
+            $permittedFields[] = IAccountManager::PROPERTY_ROLE;
+            $permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
+            $permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
+            $permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
+            $permittedFields[] = IAccountManager::PROPERTY_PHONE . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_ADDRESS . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_WEBSITE . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_TWITTER . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_ORGANISATION . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_ROLE . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_HEADLINE . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY . self::SCOPE_SUFFIX;
+            $permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED . self::SCOPE_SUFFIX;
+
+            $permittedFields[] = IAccountManager::PROPERTY_AVATAR . self::SCOPE_SUFFIX;
+
+            // If admin they can edit their own quota and manager
+            if ($this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
+                $permittedFields[] = self::USER_FIELD_QUOTA;
+                $permittedFields[] = self::USER_FIELD_MANAGER;
+
+            }
+        } else {
+            // Check if admin / subadmin
+            $subAdminManager = $this->groupManager->getSubAdmin();
+            if (
+                $this->groupManager->isAdmin($currentLoggedInUser->getUID())
+                || $subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
+            ) {
+                // They have permissions over the user
+                if (
+                    $targetUser->getBackend() instanceof ISetDisplayNameBackend
+                    || $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
+                ) {
+                    $permittedFields[] = self::USER_FIELD_DISPLAYNAME;
+                    $permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
+                }
+                $permittedFields[] = IAccountManager::PROPERTY_EMAIL;
+                $permittedFields[] = IAccountManager::COLLECTION_EMAIL;
+                $permittedFields[] = self::USER_FIELD_PASSWORD;
+                $permittedFields[] = self::USER_FIELD_LANGUAGE;
+                $permittedFields[] = self::USER_FIELD_LOCALE;
+                $permittedFields[] = IAccountManager::PROPERTY_PHONE;
+                $permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
+                $permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
+                $permittedFields[] = IAccountManager::PROPERTY_TWITTER;
+                $permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
+                $permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
+                $permittedFields[] = IAccountManager::PROPERTY_ROLE;
+                $permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
+                $permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
+                $permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
+                $permittedFields[] = self::USER_FIELD_QUOTA;
+                $permittedFields[] = self::USER_FIELD_NOTIFICATION_EMAIL;
+                $permittedFields[] = self::USER_FIELD_MANAGER;
+            } else {
+                // No rights
+                throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+            }
+        }
+        // Check if permitted to edit this field
+        if (!in_array($key, $permittedFields)) {
+            throw new OCSException('', 103);
+        }
+        // Process the edit
+        switch ($key) {
+            case self::USER_FIELD_DISPLAYNAME:
+            case IAccountManager::PROPERTY_DISPLAYNAME:
+                try {
+                    $targetUser->setDisplayName($value);
+                } catch (InvalidArgumentException $e) {
+                    throw new OCSException($e->getMessage(), 101);
+                }
+                break;
+            case self::USER_FIELD_QUOTA:
+                $quota = $value;
+                if ($quota !== 'none' && $quota !== 'default') {
+                    if (is_numeric($quota)) {
+                        $quota = (float) $quota;
+                    } else {
+                        $quota = \OCP\Util::computerFileSize($quota);
+                    }
+                    if ($quota === false) {
+                        throw new OCSException('Invalid quota value ' . $value, 102);
+                    }
+                    if ($quota === -1) {
+                        $quota = 'none';
+                    } else {
+                        $maxQuota = (int) $this->config->getAppValue('files', 'max_quota', '-1');
+                        if ($maxQuota !== -1 && $quota > $maxQuota) {
+                            throw new OCSException('Invalid quota value. ' . $value . ' is exceeding the maximum quota', 102);
+                        }
+                        $quota = \OCP\Util::humanFileSize($quota);
+                    }
+                }
+                // no else block because quota can be set to 'none' in previous if
+                if ($quota === 'none') {
+                    $allowUnlimitedQuota = $this->config->getAppValue('files', 'allow_unlimited_quota', '1') === '1';
+                    if (!$allowUnlimitedQuota) {
+                        throw new OCSException('Unlimited quota is forbidden on this instance', 102);
+                    }
+                }
+                $targetUser->setQuota($quota);
+                break;
+            case self::USER_FIELD_MANAGER:
+                $targetUser->setManagerUids([$value]);
+                break;
+            case self::USER_FIELD_PASSWORD:
+                try {
+                    if (strlen($value) > IUserManager::MAX_PASSWORD_LENGTH) {
+                        throw new OCSException('Invalid password value', 102);
+                    }
+                    if (!$targetUser->canChangePassword()) {
+                        throw new OCSException('Setting the password is not supported by the users backend', 103);
+                    }
+                    $targetUser->setPassword($value);
+                } catch (HintException $e) { // password policy error
+                    throw new OCSException($e->getMessage(), 103);
+                }
+                break;
+            case self::USER_FIELD_LANGUAGE:
+                $languagesCodes = $this->l10nFactory->findAvailableLanguages();
+                if (!in_array($value, $languagesCodes, true) && $value !== 'en') {
+                    throw new OCSException('Invalid language', 102);
+                }
+                $this->config->setUserValue($targetUser->getUID(), 'core', 'lang', $value);
+                break;
+            case self::USER_FIELD_LOCALE:
+                if (!$this->l10nFactory->localeExists($value)) {
+                    throw new OCSException('Invalid locale', 102);
+                }
+                $this->config->setUserValue($targetUser->getUID(), 'core', 'locale', $value);
+                break;
+            case self::USER_FIELD_NOTIFICATION_EMAIL:
+                $success = false;
+                if ($value === '' || filter_var($value, FILTER_VALIDATE_EMAIL)) {
+                    try {
+                        $targetUser->setPrimaryEMailAddress($value);
+                        $success = true;
+                    } catch (InvalidArgumentException $e) {
+                        $this->logger->info(
+                            'Cannot set primary email, because provided address is not verified',
+                            [
+                                'app' => 'provisioning_api',
+                                'exception' => $e,
+                            ]
+                        );
+                    }
+                }
+                if (!$success) {
+                    throw new OCSException('', 102);
+                }
+                break;
+            case IAccountManager::PROPERTY_EMAIL:
+                if (filter_var($value, FILTER_VALIDATE_EMAIL) || $value === '') {
+                    $targetUser->setEMailAddress($value);
+                } else {
+                    throw new OCSException('', 102);
+                }
+                break;
+            case IAccountManager::COLLECTION_EMAIL:
+                if (filter_var($value, FILTER_VALIDATE_EMAIL) && $value !== $targetUser->getSystemEMailAddress()) {
+                    $userAccount = $this->accountManager->getAccount($targetUser);
+                    $mailCollection = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL);
+
+                    if ($mailCollection->getPropertyByValue($value)) {
+                        throw new OCSException('', 102);
+                    }
+
+                    $mailCollection->addPropertyWithDefaults($value);
+                    $this->accountManager->updateAccount($userAccount);
+                } else {
+                    throw new OCSException('', 102);
+                }
+                break;
+            case IAccountManager::PROPERTY_PHONE:
+            case IAccountManager::PROPERTY_ADDRESS:
+            case IAccountManager::PROPERTY_WEBSITE:
+            case IAccountManager::PROPERTY_TWITTER:
+            case IAccountManager::PROPERTY_FEDIVERSE:
+            case IAccountManager::PROPERTY_ORGANISATION:
+            case IAccountManager::PROPERTY_ROLE:
+            case IAccountManager::PROPERTY_HEADLINE:
+            case IAccountManager::PROPERTY_BIOGRAPHY:
+                $userAccount = $this->accountManager->getAccount($targetUser);
+                try {
+                    $userProperty = $userAccount->getProperty($key);
+                    if ($userProperty->getValue() !== $value) {
+                        try {
+                            $userProperty->setValue($value);
+                            if ($userProperty->getName() === IAccountManager::PROPERTY_PHONE) {
+                                $this->knownUserService->deleteByContactUserId($targetUser->getUID());
+                            }
+                        } catch (InvalidArgumentException $e) {
+                            throw new OCSException('Invalid ' . $e->getMessage(), 102);
+                        }
+                    }
+                } catch (PropertyDoesNotExistException $e) {
+                    $userAccount->setProperty($key, $value, IAccountManager::SCOPE_PRIVATE, IAccountManager::NOT_VERIFIED);
+                }
+                try {
+                    $this->accountManager->updateAccount($userAccount);
+                } catch (InvalidArgumentException $e) {
+                    throw new OCSException('Invalid ' . $e->getMessage(), 102);
+                }
+                break;
+            case IAccountManager::PROPERTY_PROFILE_ENABLED:
+                $userAccount = $this->accountManager->getAccount($targetUser);
+                try {
+                    $userProperty = $userAccount->getProperty($key);
+                    if ($userProperty->getValue() !== $value) {
+                        $userProperty->setValue($value);
+                    }
+                } catch (PropertyDoesNotExistException $e) {
+                    $userAccount->setProperty($key, $value, IAccountManager::SCOPE_LOCAL, IAccountManager::NOT_VERIFIED);
+                }
+                $this->accountManager->updateAccount($userAccount);
+                break;
+            case IAccountManager::PROPERTY_DISPLAYNAME . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_EMAIL . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_PHONE . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_ADDRESS . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_WEBSITE . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_TWITTER . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_FEDIVERSE . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_ORGANISATION . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_ROLE . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_HEADLINE . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_BIOGRAPHY . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_PROFILE_ENABLED . self::SCOPE_SUFFIX:
+            case IAccountManager::PROPERTY_AVATAR . self::SCOPE_SUFFIX:
+                $propertyName = substr($key, 0, strlen($key) - strlen(self::SCOPE_SUFFIX));
+                $userAccount = $this->accountManager->getAccount($targetUser);
+                $userProperty = $userAccount->getProperty($propertyName);
+                if ($userProperty->getScope() !== $value) {
+                    try {
+                        $userProperty->setScope($value);
+                        $this->accountManager->updateAccount($userAccount);
+                    } catch (InvalidArgumentException $e) {
+                        throw new OCSException('Invalid ' . $e->getMessage(), 102);
+                    }
+                }
+                break;
+            default:
+                throw new OCSException('', 103);
+        }
+        return new DataResponse();
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     *
+     * @return DataResponse
+     *
+     * @throws OCSException
+     */
+    public function wipeUserDevices(string $userId): DataResponse {
+        /** @var IUser $currentLoggedInUser */
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            throw new OCSException('', 101);
+        }
+
+        // If not permitted
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        $this->remoteWipe->markAllTokensForWipe($targetUser);
+
+        return new DataResponse();
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function deleteUser(string $userId): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            throw new OCSException('', 101);
+        }
+
+        // If not permitted
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        // Go ahead with the delete
+        if ($targetUser->delete()) {
+            return new DataResponse();
+        } else {
+            throw new OCSException('', 101);
+        }
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     * @throws OCSForbiddenException
+     */
+    public function disableUser(string $userId): DataResponse {
+        return $this->setEnabled($userId, false);
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     * @throws OCSForbiddenException
+     */
+    public function enableUser(string $userId): DataResponse {
+        return $this->setEnabled($userId, true);
+    }
+
+    /**
+     * @param string $userId
+     * @param bool $value
+     * @return DataResponse
+     * @throws OCSException
+     */
+    private function setEnabled(string $userId, bool $value): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            throw new OCSException('', 101);
+        }
+
+        // If not permitted
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        // enable/disable the user now
+        $targetUser->setEnabled($value);
+        return new DataResponse();
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUsersGroups(string $userId): DataResponse {
+        $loggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        if ($targetUser->getUID() === $loggedInUser->getUID() || $this->groupManager->isAdmin($loggedInUser->getUID())) {
+            // Self lookup or admin lookup
+            return new DataResponse([
+                'groups' => $this->groupManager->getUserGroupIds($targetUser)
+            ]);
+        } else {
+            $subAdminManager = $this->groupManager->getSubAdmin();
+
+            // Looking up someone else
+            if ($subAdminManager->isUserAccessible($loggedInUser, $targetUser)) {
+                // Return the group that the method caller is subadmin of for the user in question
+                /** @var IGroup[] $getSubAdminsGroups */
+                $getSubAdminsGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
+                foreach ($getSubAdminsGroups as $key => $group) {
+                    $getSubAdminsGroups[$key] = $group->getGID();
+                }
+                $groups = array_intersect(
+                    $getSubAdminsGroups,
+                    $this->groupManager->getUserGroupIds($targetUser)
+                );
+                return new DataResponse(['groups' => $groups]);
+            } else {
+                // Not permitted
+                throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+            }
+        }
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addToGroup(string $userId, string $groupid = ''): DataResponse {
+        if ($groupid === '') {
+            throw new OCSException('', 101);
+        }
+
+        $group = $this->groupManager->get($groupid);
+        $targetUser = $this->userManager->get($userId);
+        if ($group === null) {
+            throw new OCSException('', 102);
+        }
+        if ($targetUser === null) {
+            throw new OCSException('', 103);
+        }
+
+        // If they're not an admin, check they are a subadmin of the group in question
+        $loggedInUser = $this->userSession->getUser();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+            throw new OCSException('', 104);
+        }
+
+        // Add user to group
+        $group->addUser($targetUser);
+        return new DataResponse();
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function removeFromGroup(string $userId, string $groupid): DataResponse {
+        $loggedInUser = $this->userSession->getUser();
+
+        if ($groupid === null || trim($groupid) === '') {
+            throw new OCSException('', 101);
+        }
+
+        $group = $this->groupManager->get($groupid);
+        if ($group === null) {
+            throw new OCSException('', 102);
+        }
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', 103);
+        }
+
+        // If they're not an admin, check they are a subadmin of the group in question
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+            throw new OCSException('', 104);
+        }
+
+        // Check they aren't removing themselves from 'admin' or their 'subadmin; group
+        if ($targetUser->getUID() === $loggedInUser->getUID()) {
+            if ($this->groupManager->isAdmin($loggedInUser->getUID())) {
+                if ($group->getGID() === 'admin') {
+                    throw new OCSException('Cannot remove yourself from the admin group', 105);
+                }
+            } else {
+                // Not an admin, so the user must be a subadmin of this group, but that is not allowed.
+                throw new OCSException('Cannot remove yourself from this group as you are a SubAdmin', 105);
+            }
+        } elseif (!$this->groupManager->isAdmin($loggedInUser->getUID())) {
+            /** @var IGroup[] $subAdminGroups */
+            $subAdminGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
+            $subAdminGroups = array_map(function (IGroup $subAdminGroup) {
+                return $subAdminGroup->getGID();
+            }, $subAdminGroups);
+            $userGroups = $this->groupManager->getUserGroupIds($targetUser);
+            $userSubAdminGroups = array_intersect($subAdminGroups, $userGroups);
+
+            if (count($userSubAdminGroups) <= 1) {
+                // Subadmin must not be able to remove a user from all their subadmin groups.
+                throw new OCSException('Not viable to remove user from the last group you are SubAdmin of', 105);
+            }
+        }
+
+        // Remove user from group
+        $group->removeUser($targetUser);
+        return new DataResponse();
+    }
+
+    /**
+     * Creates a subadmin
+     *
+     * @PasswordConfirmationRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addSubAdmin(string $userId, string $groupid): DataResponse {
+        $group = $this->groupManager->get($groupid);
+        $user = $this->userManager->get($userId);
+
+        // Check if the user exists
+        if ($user === null) {
+            throw new OCSException('User does not exist', 101);
+        }
+        // Check if group exists
+        if ($group === null) {
+            throw new OCSException('Group does not exist', 102);
+        }
+        // Check if trying to make subadmin of admin group
+        if ($group->getGID() === 'admin') {
+            throw new OCSException('Cannot create subadmins for admin group', 103);
+        }
+
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        // We cannot be subadmin twice
+        if ($subAdminManager->isSubAdminOfGroup($user, $group)) {
+            return new DataResponse();
+        }
+        // Go
+        $subAdminManager->createSubAdmin($user, $group);
+        return new DataResponse();
+    }
+
+    /**
+     * Removes a subadmin from a group
+     *
+     * @PasswordConfirmationRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function removeSubAdmin(string $userId, string $groupid): DataResponse {
+        $group = $this->groupManager->get($groupid);
+        $user = $this->userManager->get($userId);
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        // Check if the user exists
+        if ($user === null) {
+            throw new OCSException('User does not exist', 101);
+        }
+        // Check if the group exists
+        if ($group === null) {
+            throw new OCSException('Group does not exist', 101);
+        }
+        // Check if they are a subadmin of this said group
+        if (!$subAdminManager->isSubAdminOfGroup($user, $group)) {
+            throw new OCSException('User is not a subadmin of this group', 102);
+        }
+
+        // Go
+        $subAdminManager->deleteSubAdmin($user, $group);
+        return new DataResponse();
+    }
+
+    /**
+     * Get the groups a user is a subadmin of
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUserSubAdminGroups(string $userId): DataResponse {
+        $groups = $this->getUserSubAdminGroupsData($userId);
+        return new DataResponse($groups);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * resend welcome message
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function resendWelcomeMessage(string $userId): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        // Check if admin / subadmin
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (
+            !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
+            && !$this->groupManager->isAdmin($currentLoggedInUser->getUID())
+        ) {
+            // No rights
+            throw new OCSException('', OCSController::RESPOND_NOT_FOUND);
+        }
+
+        $email = $targetUser->getEMailAddress();
+        if ($email === '' || $email === null) {
+            throw new OCSException('Email address not available', 101);
+        }
+
+        try {
+            $emailTemplate = $this->newUserMailHelper->generateTemplate($targetUser, false);
+            $this->newUserMailHelper->sendMail($targetUser, $emailTemplate);
+        } catch (\Exception $e) {
+            $this->logger->error(
+                "Can't send new user mail to $email",
+                [
+                    'app' => 'settings',
+                    'exception' => $e,
+                ]
+            );
+            throw new OCSException('Sending email failed', 102);
+        }
+
+        return new DataResponse();
+    }
 }