nextcloud / server

apps/dav/lib/SystemTag/SystemTagPlugin.php

Indentation +517 added lines, -517 removed lines

@@ -42,521 +42,521 @@
  */
 class SystemTagPlugin extends \Sabre\DAV\ServerPlugin {
 
-	// namespace
-	public const NS_OWNCLOUD = 'http://owncloud.org/ns';
-	public const NS_NEXTCLOUD = 'http://nextcloud.org/ns';
-	public const ID_PROPERTYNAME = '{http://owncloud.org/ns}id';
-	public const DISPLAYNAME_PROPERTYNAME = '{http://owncloud.org/ns}display-name';
-	public const USERVISIBLE_PROPERTYNAME = '{http://owncloud.org/ns}user-visible';
-	public const USERASSIGNABLE_PROPERTYNAME = '{http://owncloud.org/ns}user-assignable';
-	public const GROUPS_PROPERTYNAME = '{http://owncloud.org/ns}groups';
-	public const CANASSIGN_PROPERTYNAME = '{http://owncloud.org/ns}can-assign';
-	public const SYSTEM_TAGS_PROPERTYNAME = '{http://nextcloud.org/ns}system-tags';
-	public const NUM_FILES_PROPERTYNAME = '{http://nextcloud.org/ns}files-assigned';
-	public const REFERENCE_FILEID_PROPERTYNAME = '{http://nextcloud.org/ns}reference-fileid';
-	public const OBJECTIDS_PROPERTYNAME = '{http://nextcloud.org/ns}object-ids';
-	public const COLOR_PROPERTYNAME = '{http://nextcloud.org/ns}color';
-
-	/**
-	 * @var \Sabre\DAV\Server $server
-	 */
-	private $server;
-
-	/** @var array<int, string[]> */
-	private array $cachedTagMappings = [];
-	/** @var array<string, ISystemTag> */
-	private array $cachedTags = [];
-
-	public function __construct(
-		protected ISystemTagManager $tagManager,
-		protected IGroupManager $groupManager,
-		protected IUserSession $userSession,
-		protected IRootFolder $rootFolder,
-		protected ISystemTagObjectMapper $tagMapper,
-	) {
-	}
-
-	/**
-	 * This initializes the plugin.
-	 *
-	 * This function is called by \Sabre\DAV\Server, after
-	 * addPlugin is called.
-	 *
-	 * This method should set up the required event subscriptions.
-	 *
-	 * @param \Sabre\DAV\Server $server
-	 * @return void
-	 */
-	public function initialize(\Sabre\DAV\Server $server) {
-		$server->xml->namespaceMap[self::NS_OWNCLOUD] = 'oc';
-		$server->xml->namespaceMap[self::NS_NEXTCLOUD] = 'nc';
-
-		$server->xml->elementMap[self::OBJECTIDS_PROPERTYNAME] = SystemTagsObjectList::class;
-
-		$server->protectedProperties[] = self::ID_PROPERTYNAME;
-
-		$server->on('preloadCollection', $this->preloadCollection(...));
-		$server->on('propFind', [$this, 'handleGetProperties']);
-		$server->on('propPatch', [$this, 'handleUpdateProperties']);
-		$server->on('method:POST', [$this, 'httpPost']);
-
-		$this->server = $server;
-	}
-
-	/**
-	 * POST operation on system tag collections
-	 *
-	 * @param RequestInterface $request request object
-	 * @param ResponseInterface $response response object
-	 * @return null|false
-	 */
-	public function httpPost(RequestInterface $request, ResponseInterface $response) {
-		$path = $request->getPath();
-
-		// Making sure the node exists
-		$node = $this->server->tree->getNodeForPath($path);
-		if ($node instanceof SystemTagsByIdCollection || $node instanceof SystemTagsObjectMappingCollection) {
-			$data = $request->getBodyAsString();
-
-			$tag = $this->createTag($data, $request->getHeader('Content-Type'));
-
-			if ($node instanceof SystemTagsObjectMappingCollection) {
-				// also add to collection
-				$node->createFile($tag->getId());
-				$url = $request->getBaseUrl() . 'systemtags/';
-			} else {
-				$url = $request->getUrl();
-			}
-
-			if ($url[strlen($url) - 1] !== '/') {
-				$url .= '/';
-			}
-
-			$response->setHeader('Content-Location', $url . $tag->getId());
-
-			// created
-			$response->setStatus(Http::STATUS_CREATED);
-			return false;
-		}
-	}
-
-	/**
-	 * Creates a new tag
-	 *
-	 * @param string $data JSON encoded string containing the properties of the tag to create
-	 * @param string $contentType content type of the data
-	 * @return ISystemTag newly created system tag
-	 *
-	 * @throws BadRequest if a field was missing
-	 * @throws Conflict if a tag with the same properties already exists
-	 * @throws UnsupportedMediaType if the content type is not supported
-	 */
-	private function createTag($data, $contentType = 'application/json') {
-		if (explode(';', $contentType)[0] === 'application/json') {
-			$data = json_decode($data, true, 512, JSON_THROW_ON_ERROR);
-		} else {
-			throw new UnsupportedMediaType();
-		}
-
-		if (!isset($data['name'])) {
-			throw new BadRequest('Missing "name" attribute');
-		}
-
-		$tagName = $data['name'];
-		$userVisible = true;
-		$userAssignable = true;
-
-		if (isset($data['userVisible'])) {
-			$userVisible = (bool)$data['userVisible'];
-		}
-
-		if (isset($data['userAssignable'])) {
-			$userAssignable = (bool)$data['userAssignable'];
-		}
-
-		$groups = [];
-		if (isset($data['groups'])) {
-			$groups = $data['groups'];
-			if (is_string($groups)) {
-				$groups = explode('|', $groups);
-			}
-		}
-
-		if ($userVisible === false || $userAssignable === false || !empty($groups)) {
-			if (!$this->userSession->isLoggedIn() || !$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
-				throw new BadRequest('Not sufficient permissions');
-			}
-		}
-
-		try {
-			$tag = $this->tagManager->createTag($tagName, $userVisible, $userAssignable);
-			if (!empty($groups)) {
-				$this->tagManager->setTagGroups($tag, $groups);
-			}
-			return $tag;
-		} catch (TagAlreadyExistsException $e) {
-			throw new Conflict('Tag already exists', 0, $e);
-		} catch (TagCreationForbiddenException $e) {
-			throw new Forbidden('You don’t have permissions to create tags', 0, $e);
-		}
-	}
-
-	private function preloadCollection(
-		PropFind $propFind,
-		ICollection $collection,
-	): void {
-		if (!$collection instanceof Node) {
-			return;
-		}
-
-		if ($collection instanceof Directory
-			&& !isset($this->cachedTagMappings[$collection->getId()])
-			&& $propFind->getStatus(
-				self::SYSTEM_TAGS_PROPERTYNAME
-			) !== null) {
-			$fileIds = [$collection->getId()];
-
-			// note: pre-fetching only supported for depth <= 1
-			$folderContent = $collection->getChildren();
-			foreach ($folderContent as $info) {
-				if ($info instanceof Node) {
-					$fileIds[] = $info->getId();
-				}
-			}
-
-			$tags = $this->tagMapper->getTagIdsForObjects($fileIds, 'files');
-
-			$this->cachedTagMappings += $tags;
-			$emptyFileIds = array_diff($fileIds, array_keys($tags));
-
-			// also cache the ones that were not found
-			foreach ($emptyFileIds as $fileId) {
-				$this->cachedTagMappings[$fileId] = [];
-			}
-		}
-	}
-
-	/**
-	 * Retrieves system tag properties
-	 *
-	 * @param PropFind $propFind
-	 * @param \Sabre\DAV\INode $node
-	 *
-	 * @return void
-	 */
-	public function handleGetProperties(
-		PropFind $propFind,
-		\Sabre\DAV\INode $node,
-	) {
-		if ($node instanceof Node) {
-			$this->propfindForFile($propFind, $node);
-			return;
-		}
-
-		if (!$node instanceof SystemTagNode && !$node instanceof SystemTagMappingNode && !$node instanceof SystemTagObjectType) {
-			return;
-		}
-
-		// child nodes from systemtags-assigned should point to normal tag endpoint
-		if (preg_match('/^systemtags-assigned\/[0-9]+/', $propFind->getPath())) {
-			$propFind->setPath(str_replace('systemtags-assigned/', 'systemtags/', $propFind->getPath()));
-		}
-
-		$propFind->handle(FilesPlugin::GETETAG_PROPERTYNAME, function () use ($node): string {
-			return '"' . ($node->getSystemTag()->getETag() ?? '') . '"';
-		});
-
-		$propFind->handle(self::ID_PROPERTYNAME, function () use ($node) {
-			return $node->getSystemTag()->getId();
-		});
-
-		$propFind->handle(self::DISPLAYNAME_PROPERTYNAME, function () use ($node) {
-			return $node->getSystemTag()->getName();
-		});
-
-		$propFind->handle(self::USERVISIBLE_PROPERTYNAME, function () use ($node) {
-			return $node->getSystemTag()->isUserVisible() ? 'true' : 'false';
-		});
-
-		$propFind->handle(self::USERASSIGNABLE_PROPERTYNAME, function () use ($node) {
-			// this is the tag's inherent property "is user assignable"
-			return $node->getSystemTag()->isUserAssignable() ? 'true' : 'false';
-		});
-
-		$propFind->handle(self::CANASSIGN_PROPERTYNAME, function () use ($node) {
-			// this is the effective permission for the current user
-			return $this->tagManager->canUserAssignTag($node->getSystemTag(), $this->userSession->getUser()) ? 'true' : 'false';
-		});
-
-		$propFind->handle(self::COLOR_PROPERTYNAME, function () use ($node) {
-			return $node->getSystemTag()->getColor() ?? '';
-		});
-
-		$propFind->handle(self::GROUPS_PROPERTYNAME, function () use ($node) {
-			if (!$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
-				// property only available for admins
-				throw new Forbidden();
-			}
-			$groups = [];
-			// no need to retrieve groups for namespaces that don't qualify
-			if ($node->getSystemTag()->isUserVisible() && !$node->getSystemTag()->isUserAssignable()) {
-				$groups = $this->tagManager->getTagGroups($node->getSystemTag());
-			}
-			return implode('|', $groups);
-		});
-
-		if ($node instanceof SystemTagNode) {
-			$propFind->handle(self::NUM_FILES_PROPERTYNAME, function () use ($node): int {
-				return $node->getNumberOfFiles();
-			});
-
-			$propFind->handle(self::REFERENCE_FILEID_PROPERTYNAME, function () use ($node): int {
-				return $node->getReferenceFileId();
-			});
-
-			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
-				$objectTypes = $this->tagMapper->getAvailableObjectTypes();
-				$objects = [];
-				foreach ($objectTypes as $type) {
-					$systemTagObjectType = new SystemTagObjectType($node->getSystemTag(), $type, $this->tagManager, $this->tagMapper);
-					$objects = array_merge($objects, array_fill_keys($systemTagObjectType->getObjectsIds(), $type));
-				}
-				return new SystemTagsObjectList($objects);
-			});
-		}
-
-		if ($node instanceof SystemTagObjectType) {
-			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
-				return new SystemTagsObjectList(array_fill_keys($node->getObjectsIds(), $node->getName()));
-			});
-		}
-	}
-
-	private function propfindForFile(PropFind $propFind, Node $node): void {
-
-		$propFind->handle(self::SYSTEM_TAGS_PROPERTYNAME, function () use ($node) {
-			$user = $this->userSession->getUser();
-
-			$tags = $this->getTagsForFile($node->getId(), $user);
-			usort($tags, function (ISystemTag $tagA, ISystemTag $tagB): int {
-				return Util::naturalSortCompare($tagA->getName(), $tagB->getName());
-			});
-			return new SystemTagList($tags, $this->tagManager, $user);
-		});
-	}
-
-	/**
-	 * @param int $fileId
-	 * @return ISystemTag[]
-	 */
-	private function getTagsForFile(int $fileId, ?IUser $user): array {
-		if (isset($this->cachedTagMappings[$fileId])) {
-			$tagIds = $this->cachedTagMappings[$fileId];
-		} else {
-			$tags = $this->tagMapper->getTagIdsForObjects([$fileId], 'files');
-			$fileTags = current($tags);
-			if ($fileTags) {
-				$tagIds = $fileTags;
-			} else {
-				$tagIds = [];
-			}
-		}
-
-		$tags = array_filter(array_map(function (string $tagId) {
-			return $this->cachedTags[$tagId] ?? null;
-		}, $tagIds));
-
-		$uncachedTagIds = array_filter($tagIds, function (string $tagId): bool {
-			return !isset($this->cachedTags[$tagId]);
-		});
-
-		if (count($uncachedTagIds)) {
-			$retrievedTags = $this->tagManager->getTagsByIds($uncachedTagIds);
-			foreach ($retrievedTags as $tag) {
-				$this->cachedTags[$tag->getId()] = $tag;
-			}
-			$tags += $retrievedTags;
-		}
-
-		return array_filter($tags, function (ISystemTag $tag) use ($user) {
-			return $this->tagManager->canUserSeeTag($tag, $user);
-		});
-	}
-
-	/**
-	 * Updates tag attributes
-	 *
-	 * @param string $path
-	 * @param PropPatch $propPatch
-	 *
-	 * @return void
-	 */
-	public function handleUpdateProperties($path, PropPatch $propPatch) {
-		$node = $this->server->tree->getNodeForPath($path);
-		if (!$node instanceof SystemTagNode && !$node instanceof SystemTagObjectType) {
-			return;
-		}
-
-		$propPatch->handle([self::OBJECTIDS_PROPERTYNAME], function ($props) use ($node) {
-			if (!$node instanceof SystemTagObjectType) {
-				return false;
-			}
-
-			if (isset($props[self::OBJECTIDS_PROPERTYNAME])) {
-				$user = $this->userSession->getUser();
-				if (!$user) {
-					throw new Forbidden('You don’t have permissions to update tags');
-				}
-
-				$propValue = $props[self::OBJECTIDS_PROPERTYNAME];
-				if (!$propValue instanceof SystemTagsObjectList || count($propValue->getObjects()) === 0) {
-					throw new BadRequest('Invalid object-ids property');
-				}
-
-				$objects = $propValue->getObjects();
-				$objectTypes = array_unique(array_values($objects));
-
-				if (count($objectTypes) !== 1 || $objectTypes[0] !== $node->getName()) {
-					throw new BadRequest('Invalid object-ids property. All object types must be of the same type: ' . $node->getName());
-				}
-
-				// Only files are supported at the moment
-				// Also see SystemTagsRelationsCollection file
-				if ($objectTypes[0] !== 'files') {
-					throw new BadRequest('Invalid object-ids property type. Only files are supported');
-				}
-
-				// Get all current tagged objects
-				$taggedObjects = $this->tagMapper->getObjectIdsForTags([$node->getSystemTag()->getId()], 'files');
-				$toAddObjects = array_map(fn ($value) => (string)$value, array_keys($objects));
-
-				// Compute the tags to add and remove
-				$addedObjects = array_values(array_diff($toAddObjects, $taggedObjects));
-				$removedObjects = array_values(array_diff($taggedObjects, $toAddObjects));
-
-				// Check permissions for each object to be freshly tagged or untagged
-				if (!$this->canUpdateTagForFileIds(array_merge($addedObjects, $removedObjects))) {
-					throw new Forbidden('You don’t have permissions to update tags');
-				}
-
-				$this->tagMapper->setObjectIdsForTag($node->getSystemTag()->getId(), $node->getName(), array_keys($objects));
-			}
-
-			if ($props[self::OBJECTIDS_PROPERTYNAME] === null) {
-				// Check the user have permissions to remove the tag from all currently tagged objects
-				$taggedObjects = $this->tagMapper->getObjectIdsForTags([$node->getSystemTag()->getId()], 'files');
-				if (!$this->canUpdateTagForFileIds($taggedObjects)) {
-					throw new Forbidden('You don’t have permissions to update tags');
-				}
-
-				$this->tagMapper->setObjectIdsForTag($node->getSystemTag()->getId(), $node->getName(), []);
-			}
-
-			return true;
-		});
-
-		$propPatch->handle([
-			self::DISPLAYNAME_PROPERTYNAME,
-			self::USERVISIBLE_PROPERTYNAME,
-			self::USERASSIGNABLE_PROPERTYNAME,
-			self::GROUPS_PROPERTYNAME,
-			self::NUM_FILES_PROPERTYNAME,
-			self::REFERENCE_FILEID_PROPERTYNAME,
-			self::COLOR_PROPERTYNAME,
-		], function ($props) use ($node) {
-			if (!$node instanceof SystemTagNode) {
-				return false;
-			}
-
-			$tag = $node->getSystemTag();
-			$name = $tag->getName();
-			$userVisible = $tag->isUserVisible();
-			$userAssignable = $tag->isUserAssignable();
-			$color = $tag->getColor();
-
-			$updateTag = false;
-
-			if (isset($props[self::DISPLAYNAME_PROPERTYNAME])) {
-				$name = $props[self::DISPLAYNAME_PROPERTYNAME];
-				$updateTag = true;
-			}
-
-			if (isset($props[self::USERVISIBLE_PROPERTYNAME])) {
-				$propValue = $props[self::USERVISIBLE_PROPERTYNAME];
-				$userVisible = ($propValue !== 'false' && $propValue !== '0');
-				$updateTag = true;
-			}
-
-			if (isset($props[self::USERASSIGNABLE_PROPERTYNAME])) {
-				$propValue = $props[self::USERASSIGNABLE_PROPERTYNAME];
-				$userAssignable = ($propValue !== 'false' && $propValue !== '0');
-				$updateTag = true;
-			}
-
-			if (isset($props[self::COLOR_PROPERTYNAME])) {
-				$propValue = $props[self::COLOR_PROPERTYNAME];
-				if ($propValue === '' || $propValue === 'null') {
-					$propValue = null;
-				}
-				$color = $propValue;
-				$updateTag = true;
-			}
-
-			if (isset($props[self::GROUPS_PROPERTYNAME])) {
-				if (!$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
-					// property only available for admins
-					throw new Forbidden();
-				}
-
-				$propValue = $props[self::GROUPS_PROPERTYNAME];
-				$groupIds = explode('|', $propValue);
-				$this->tagManager->setTagGroups($tag, $groupIds);
-			}
-
-			if (isset($props[self::NUM_FILES_PROPERTYNAME]) || isset($props[self::REFERENCE_FILEID_PROPERTYNAME])) {
-				// read-only properties
-				throw new Forbidden();
-			}
-
-			if ($updateTag) {
-				try {
-					$node->update($name, $userVisible, $userAssignable, $color);
-				} catch (TagUpdateForbiddenException $e) {
-					throw new Forbidden('You don’t have permissions to update tags', 0, $e);
-				}
-			}
-
-			return true;
-		});
-	}
-
-	/**
-	 * Check if the user can update the tag for the given file ids
-	 *
-	 * @param list<string> $fileIds
-	 * @return bool
-	 */
-	private function canUpdateTagForFileIds(array $fileIds): bool {
-		$user = $this->userSession->getUser();
-		$userFolder = $this->rootFolder->getUserFolder($user->getUID());
-
-		foreach ($fileIds as $fileId) {
-			try {
-				$nodes = $userFolder->getById((int)$fileId);
-				if (empty($nodes)) {
-					return false;
-				}
-
-				foreach ($nodes as $node) {
-					if (($node->getPermissions() & Constants::PERMISSION_UPDATE) !== Constants::PERMISSION_UPDATE) {
-						return false;
-					}
-				}
-			} catch (\Exception $e) {
-				return false;
-			}
-		}
-
-		return true;
-	}
+    // namespace
+    public const NS_OWNCLOUD = 'http://owncloud.org/ns';
+    public const NS_NEXTCLOUD = 'http://nextcloud.org/ns';
+    public const ID_PROPERTYNAME = '{http://owncloud.org/ns}id';
+    public const DISPLAYNAME_PROPERTYNAME = '{http://owncloud.org/ns}display-name';
+    public const USERVISIBLE_PROPERTYNAME = '{http://owncloud.org/ns}user-visible';
+    public const USERASSIGNABLE_PROPERTYNAME = '{http://owncloud.org/ns}user-assignable';
+    public const GROUPS_PROPERTYNAME = '{http://owncloud.org/ns}groups';
+    public const CANASSIGN_PROPERTYNAME = '{http://owncloud.org/ns}can-assign';
+    public const SYSTEM_TAGS_PROPERTYNAME = '{http://nextcloud.org/ns}system-tags';
+    public const NUM_FILES_PROPERTYNAME = '{http://nextcloud.org/ns}files-assigned';
+    public const REFERENCE_FILEID_PROPERTYNAME = '{http://nextcloud.org/ns}reference-fileid';
+    public const OBJECTIDS_PROPERTYNAME = '{http://nextcloud.org/ns}object-ids';
+    public const COLOR_PROPERTYNAME = '{http://nextcloud.org/ns}color';
+
+    /**
+     * @var \Sabre\DAV\Server $server
+     */
+    private $server;
+
+    /** @var array<int, string[]> */
+    private array $cachedTagMappings = [];
+    /** @var array<string, ISystemTag> */
+    private array $cachedTags = [];
+
+    public function __construct(
+        protected ISystemTagManager $tagManager,
+        protected IGroupManager $groupManager,
+        protected IUserSession $userSession,
+        protected IRootFolder $rootFolder,
+        protected ISystemTagObjectMapper $tagMapper,
+    ) {
+    }
+
+    /**
+     * This initializes the plugin.
+     *
+     * This function is called by \Sabre\DAV\Server, after
+     * addPlugin is called.
+     *
+     * This method should set up the required event subscriptions.
+     *
+     * @param \Sabre\DAV\Server $server
+     * @return void
+     */
+    public function initialize(\Sabre\DAV\Server $server) {
+        $server->xml->namespaceMap[self::NS_OWNCLOUD] = 'oc';
+        $server->xml->namespaceMap[self::NS_NEXTCLOUD] = 'nc';
+
+        $server->xml->elementMap[self::OBJECTIDS_PROPERTYNAME] = SystemTagsObjectList::class;
+
+        $server->protectedProperties[] = self::ID_PROPERTYNAME;
+
+        $server->on('preloadCollection', $this->preloadCollection(...));
+        $server->on('propFind', [$this, 'handleGetProperties']);
+        $server->on('propPatch', [$this, 'handleUpdateProperties']);
+        $server->on('method:POST', [$this, 'httpPost']);
+
+        $this->server = $server;
+    }
+
+    /**
+     * POST operation on system tag collections
+     *
+     * @param RequestInterface $request request object
+     * @param ResponseInterface $response response object
+     * @return null|false
+     */
+    public function httpPost(RequestInterface $request, ResponseInterface $response) {
+        $path = $request->getPath();
+
+        // Making sure the node exists
+        $node = $this->server->tree->getNodeForPath($path);
+        if ($node instanceof SystemTagsByIdCollection || $node instanceof SystemTagsObjectMappingCollection) {
+            $data = $request->getBodyAsString();
+
+            $tag = $this->createTag($data, $request->getHeader('Content-Type'));
+
+            if ($node instanceof SystemTagsObjectMappingCollection) {
+                // also add to collection
+                $node->createFile($tag->getId());
+                $url = $request->getBaseUrl() . 'systemtags/';
+            } else {
+                $url = $request->getUrl();
+            }
+
+            if ($url[strlen($url) - 1] !== '/') {
+                $url .= '/';
+            }
+
+            $response->setHeader('Content-Location', $url . $tag->getId());
+
+            // created
+            $response->setStatus(Http::STATUS_CREATED);
+            return false;
+        }
+    }
+
+    /**
+     * Creates a new tag
+     *
+     * @param string $data JSON encoded string containing the properties of the tag to create
+     * @param string $contentType content type of the data
+     * @return ISystemTag newly created system tag
+     *
+     * @throws BadRequest if a field was missing
+     * @throws Conflict if a tag with the same properties already exists
+     * @throws UnsupportedMediaType if the content type is not supported
+     */
+    private function createTag($data, $contentType = 'application/json') {
+        if (explode(';', $contentType)[0] === 'application/json') {
+            $data = json_decode($data, true, 512, JSON_THROW_ON_ERROR);
+        } else {
+            throw new UnsupportedMediaType();
+        }
+
+        if (!isset($data['name'])) {
+            throw new BadRequest('Missing "name" attribute');
+        }
+
+        $tagName = $data['name'];
+        $userVisible = true;
+        $userAssignable = true;
+
+        if (isset($data['userVisible'])) {
+            $userVisible = (bool)$data['userVisible'];
+        }
+
+        if (isset($data['userAssignable'])) {
+            $userAssignable = (bool)$data['userAssignable'];
+        }
+
+        $groups = [];
+        if (isset($data['groups'])) {
+            $groups = $data['groups'];
+            if (is_string($groups)) {
+                $groups = explode('|', $groups);
+            }
+        }
+
+        if ($userVisible === false || $userAssignable === false || !empty($groups)) {
+            if (!$this->userSession->isLoggedIn() || !$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
+                throw new BadRequest('Not sufficient permissions');
+            }
+        }
+
+        try {
+            $tag = $this->tagManager->createTag($tagName, $userVisible, $userAssignable);
+            if (!empty($groups)) {
+                $this->tagManager->setTagGroups($tag, $groups);
+            }
+            return $tag;
+        } catch (TagAlreadyExistsException $e) {
+            throw new Conflict('Tag already exists', 0, $e);
+        } catch (TagCreationForbiddenException $e) {
+            throw new Forbidden('You don’t have permissions to create tags', 0, $e);
+        }
+    }
+
+    private function preloadCollection(
+        PropFind $propFind,
+        ICollection $collection,
+    ): void {
+        if (!$collection instanceof Node) {
+            return;
+        }
+
+        if ($collection instanceof Directory
+            && !isset($this->cachedTagMappings[$collection->getId()])
+            && $propFind->getStatus(
+                self::SYSTEM_TAGS_PROPERTYNAME
+            ) !== null) {
+            $fileIds = [$collection->getId()];
+
+            // note: pre-fetching only supported for depth <= 1
+            $folderContent = $collection->getChildren();
+            foreach ($folderContent as $info) {
+                if ($info instanceof Node) {
+                    $fileIds[] = $info->getId();
+                }
+            }
+
+            $tags = $this->tagMapper->getTagIdsForObjects($fileIds, 'files');
+
+            $this->cachedTagMappings += $tags;
+            $emptyFileIds = array_diff($fileIds, array_keys($tags));
+
+            // also cache the ones that were not found
+            foreach ($emptyFileIds as $fileId) {
+                $this->cachedTagMappings[$fileId] = [];
+            }
+        }
+    }
+
+    /**
+     * Retrieves system tag properties
+     *
+     * @param PropFind $propFind
+     * @param \Sabre\DAV\INode $node
+     *
+     * @return void
+     */
+    public function handleGetProperties(
+        PropFind $propFind,
+        \Sabre\DAV\INode $node,
+    ) {
+        if ($node instanceof Node) {
+            $this->propfindForFile($propFind, $node);
+            return;
+        }
+
+        if (!$node instanceof SystemTagNode && !$node instanceof SystemTagMappingNode && !$node instanceof SystemTagObjectType) {
+            return;
+        }
+
+        // child nodes from systemtags-assigned should point to normal tag endpoint
+        if (preg_match('/^systemtags-assigned\/[0-9]+/', $propFind->getPath())) {
+            $propFind->setPath(str_replace('systemtags-assigned/', 'systemtags/', $propFind->getPath()));
+        }
+
+        $propFind->handle(FilesPlugin::GETETAG_PROPERTYNAME, function () use ($node): string {
+            return '"' . ($node->getSystemTag()->getETag() ?? '') . '"';
+        });
+
+        $propFind->handle(self::ID_PROPERTYNAME, function () use ($node) {
+            return $node->getSystemTag()->getId();
+        });
+
+        $propFind->handle(self::DISPLAYNAME_PROPERTYNAME, function () use ($node) {
+            return $node->getSystemTag()->getName();
+        });
+
+        $propFind->handle(self::USERVISIBLE_PROPERTYNAME, function () use ($node) {
+            return $node->getSystemTag()->isUserVisible() ? 'true' : 'false';
+        });
+
+        $propFind->handle(self::USERASSIGNABLE_PROPERTYNAME, function () use ($node) {
+            // this is the tag's inherent property "is user assignable"
+            return $node->getSystemTag()->isUserAssignable() ? 'true' : 'false';
+        });
+
+        $propFind->handle(self::CANASSIGN_PROPERTYNAME, function () use ($node) {
+            // this is the effective permission for the current user
+            return $this->tagManager->canUserAssignTag($node->getSystemTag(), $this->userSession->getUser()) ? 'true' : 'false';
+        });
+
+        $propFind->handle(self::COLOR_PROPERTYNAME, function () use ($node) {
+            return $node->getSystemTag()->getColor() ?? '';
+        });
+
+        $propFind->handle(self::GROUPS_PROPERTYNAME, function () use ($node) {
+            if (!$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
+                // property only available for admins
+                throw new Forbidden();
+            }
+            $groups = [];
+            // no need to retrieve groups for namespaces that don't qualify
+            if ($node->getSystemTag()->isUserVisible() && !$node->getSystemTag()->isUserAssignable()) {
+                $groups = $this->tagManager->getTagGroups($node->getSystemTag());
+            }
+            return implode('|', $groups);
+        });
+
+        if ($node instanceof SystemTagNode) {
+            $propFind->handle(self::NUM_FILES_PROPERTYNAME, function () use ($node): int {
+                return $node->getNumberOfFiles();
+            });
+
+            $propFind->handle(self::REFERENCE_FILEID_PROPERTYNAME, function () use ($node): int {
+                return $node->getReferenceFileId();
+            });
+
+            $propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
+                $objectTypes = $this->tagMapper->getAvailableObjectTypes();
+                $objects = [];
+                foreach ($objectTypes as $type) {
+                    $systemTagObjectType = new SystemTagObjectType($node->getSystemTag(), $type, $this->tagManager, $this->tagMapper);
+                    $objects = array_merge($objects, array_fill_keys($systemTagObjectType->getObjectsIds(), $type));
+                }
+                return new SystemTagsObjectList($objects);
+            });
+        }
+
+        if ($node instanceof SystemTagObjectType) {
+            $propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
+                return new SystemTagsObjectList(array_fill_keys($node->getObjectsIds(), $node->getName()));
+            });
+        }
+    }
+
+    private function propfindForFile(PropFind $propFind, Node $node): void {
+
+        $propFind->handle(self::SYSTEM_TAGS_PROPERTYNAME, function () use ($node) {
+            $user = $this->userSession->getUser();
+
+            $tags = $this->getTagsForFile($node->getId(), $user);
+            usort($tags, function (ISystemTag $tagA, ISystemTag $tagB): int {
+                return Util::naturalSortCompare($tagA->getName(), $tagB->getName());
+            });
+            return new SystemTagList($tags, $this->tagManager, $user);
+        });
+    }
+
+    /**
+     * @param int $fileId
+     * @return ISystemTag[]
+     */
+    private function getTagsForFile(int $fileId, ?IUser $user): array {
+        if (isset($this->cachedTagMappings[$fileId])) {
+            $tagIds = $this->cachedTagMappings[$fileId];
+        } else {
+            $tags = $this->tagMapper->getTagIdsForObjects([$fileId], 'files');
+            $fileTags = current($tags);
+            if ($fileTags) {
+                $tagIds = $fileTags;
+            } else {
+                $tagIds = [];
+            }
+        }
+
+        $tags = array_filter(array_map(function (string $tagId) {
+            return $this->cachedTags[$tagId] ?? null;
+        }, $tagIds));
+
+        $uncachedTagIds = array_filter($tagIds, function (string $tagId): bool {
+            return !isset($this->cachedTags[$tagId]);
+        });
+
+        if (count($uncachedTagIds)) {
+            $retrievedTags = $this->tagManager->getTagsByIds($uncachedTagIds);
+            foreach ($retrievedTags as $tag) {
+                $this->cachedTags[$tag->getId()] = $tag;
+            }
+            $tags += $retrievedTags;
+        }
+
+        return array_filter($tags, function (ISystemTag $tag) use ($user) {
+            return $this->tagManager->canUserSeeTag($tag, $user);
+        });
+    }
+
+    /**
+     * Updates tag attributes
+     *
+     * @param string $path
+     * @param PropPatch $propPatch
+     *
+     * @return void
+     */
+    public function handleUpdateProperties($path, PropPatch $propPatch) {
+        $node = $this->server->tree->getNodeForPath($path);
+        if (!$node instanceof SystemTagNode && !$node instanceof SystemTagObjectType) {
+            return;
+        }
+
+        $propPatch->handle([self::OBJECTIDS_PROPERTYNAME], function ($props) use ($node) {
+            if (!$node instanceof SystemTagObjectType) {
+                return false;
+            }
+
+            if (isset($props[self::OBJECTIDS_PROPERTYNAME])) {
+                $user = $this->userSession->getUser();
+                if (!$user) {
+                    throw new Forbidden('You don’t have permissions to update tags');
+                }
+
+                $propValue = $props[self::OBJECTIDS_PROPERTYNAME];
+                if (!$propValue instanceof SystemTagsObjectList || count($propValue->getObjects()) === 0) {
+                    throw new BadRequest('Invalid object-ids property');
+                }
+
+                $objects = $propValue->getObjects();
+                $objectTypes = array_unique(array_values($objects));
+
+                if (count($objectTypes) !== 1 || $objectTypes[0] !== $node->getName()) {
+                    throw new BadRequest('Invalid object-ids property. All object types must be of the same type: ' . $node->getName());
+                }
+
+                // Only files are supported at the moment
+                // Also see SystemTagsRelationsCollection file
+                if ($objectTypes[0] !== 'files') {
+                    throw new BadRequest('Invalid object-ids property type. Only files are supported');
+                }
+
+                // Get all current tagged objects
+                $taggedObjects = $this->tagMapper->getObjectIdsForTags([$node->getSystemTag()->getId()], 'files');
+                $toAddObjects = array_map(fn ($value) => (string)$value, array_keys($objects));
+
+                // Compute the tags to add and remove
+                $addedObjects = array_values(array_diff($toAddObjects, $taggedObjects));
+                $removedObjects = array_values(array_diff($taggedObjects, $toAddObjects));
+
+                // Check permissions for each object to be freshly tagged or untagged
+                if (!$this->canUpdateTagForFileIds(array_merge($addedObjects, $removedObjects))) {
+                    throw new Forbidden('You don’t have permissions to update tags');
+                }
+
+                $this->tagMapper->setObjectIdsForTag($node->getSystemTag()->getId(), $node->getName(), array_keys($objects));
+            }
+
+            if ($props[self::OBJECTIDS_PROPERTYNAME] === null) {
+                // Check the user have permissions to remove the tag from all currently tagged objects
+                $taggedObjects = $this->tagMapper->getObjectIdsForTags([$node->getSystemTag()->getId()], 'files');
+                if (!$this->canUpdateTagForFileIds($taggedObjects)) {
+                    throw new Forbidden('You don’t have permissions to update tags');
+                }
+
+                $this->tagMapper->setObjectIdsForTag($node->getSystemTag()->getId(), $node->getName(), []);
+            }
+
+            return true;
+        });
+
+        $propPatch->handle([
+            self::DISPLAYNAME_PROPERTYNAME,
+            self::USERVISIBLE_PROPERTYNAME,
+            self::USERASSIGNABLE_PROPERTYNAME,
+            self::GROUPS_PROPERTYNAME,
+            self::NUM_FILES_PROPERTYNAME,
+            self::REFERENCE_FILEID_PROPERTYNAME,
+            self::COLOR_PROPERTYNAME,
+        ], function ($props) use ($node) {
+            if (!$node instanceof SystemTagNode) {
+                return false;
+            }
+
+            $tag = $node->getSystemTag();
+            $name = $tag->getName();
+            $userVisible = $tag->isUserVisible();
+            $userAssignable = $tag->isUserAssignable();
+            $color = $tag->getColor();
+
+            $updateTag = false;
+
+            if (isset($props[self::DISPLAYNAME_PROPERTYNAME])) {
+                $name = $props[self::DISPLAYNAME_PROPERTYNAME];
+                $updateTag = true;
+            }
+
+            if (isset($props[self::USERVISIBLE_PROPERTYNAME])) {
+                $propValue = $props[self::USERVISIBLE_PROPERTYNAME];
+                $userVisible = ($propValue !== 'false' && $propValue !== '0');
+                $updateTag = true;
+            }
+
+            if (isset($props[self::USERASSIGNABLE_PROPERTYNAME])) {
+                $propValue = $props[self::USERASSIGNABLE_PROPERTYNAME];
+                $userAssignable = ($propValue !== 'false' && $propValue !== '0');
+                $updateTag = true;
+            }
+
+            if (isset($props[self::COLOR_PROPERTYNAME])) {
+                $propValue = $props[self::COLOR_PROPERTYNAME];
+                if ($propValue === '' || $propValue === 'null') {
+                    $propValue = null;
+                }
+                $color = $propValue;
+                $updateTag = true;
+            }
+
+            if (isset($props[self::GROUPS_PROPERTYNAME])) {
+                if (!$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
+                    // property only available for admins
+                    throw new Forbidden();
+                }
+
+                $propValue = $props[self::GROUPS_PROPERTYNAME];
+                $groupIds = explode('|', $propValue);
+                $this->tagManager->setTagGroups($tag, $groupIds);
+            }
+
+            if (isset($props[self::NUM_FILES_PROPERTYNAME]) || isset($props[self::REFERENCE_FILEID_PROPERTYNAME])) {
+                // read-only properties
+                throw new Forbidden();
+            }
+
+            if ($updateTag) {
+                try {
+                    $node->update($name, $userVisible, $userAssignable, $color);
+                } catch (TagUpdateForbiddenException $e) {
+                    throw new Forbidden('You don’t have permissions to update tags', 0, $e);
+                }
+            }
+
+            return true;
+        });
+    }
+
+    /**
+     * Check if the user can update the tag for the given file ids
+     *
+     * @param list<string> $fileIds
+     * @return bool
+     */
+    private function canUpdateTagForFileIds(array $fileIds): bool {
+        $user = $this->userSession->getUser();
+        $userFolder = $this->rootFolder->getUserFolder($user->getUID());
+
+        foreach ($fileIds as $fileId) {
+            try {
+                $nodes = $userFolder->getById((int)$fileId);
+                if (empty($nodes)) {
+                    return false;
+                }
+
+                foreach ($nodes as $node) {
+                    if (($node->getPermissions() & Constants::PERMISSION_UPDATE) !== Constants::PERMISSION_UPDATE) {
+                        return false;
+                    }
+                }
+            } catch (\Exception $e) {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }

Spacing +27 added lines, -27 removed lines

@@ -123,7 +123,7 @@ 
 			if ($node instanceof SystemTagsObjectMappingCollection) {
 				// also add to collection
 				$node->createFile($tag->getId());
-				$url = $request->getBaseUrl() . 'systemtags/';
+				$url = $request->getBaseUrl().'systemtags/';
 			} else {
 				$url = $request->getUrl();
 			}
@@ -132,7 +132,7 @@ 
 				$url .= '/';
 			}
 
-			$response->setHeader('Content-Location', $url . $tag->getId());
+			$response->setHeader('Content-Location', $url.$tag->getId());
 
 			// created
 			$response->setStatus(Http::STATUS_CREATED);
@@ -167,11 +167,11 @@ 
 		$userAssignable = true;
 
 		if (isset($data['userVisible'])) {
-			$userVisible = (bool)$data['userVisible'];
+			$userVisible = (bool) $data['userVisible'];
 		}
 
 		if (isset($data['userAssignable'])) {
-			$userAssignable = (bool)$data['userAssignable'];
+			$userAssignable = (bool) $data['userAssignable'];
 		}
 
 		$groups = [];
@@ -262,37 +262,37 @@ 
 			$propFind->setPath(str_replace('systemtags-assigned/', 'systemtags/', $propFind->getPath()));
 		}
 
-		$propFind->handle(FilesPlugin::GETETAG_PROPERTYNAME, function () use ($node): string {
-			return '"' . ($node->getSystemTag()->getETag() ?? '') . '"';
+		$propFind->handle(FilesPlugin::GETETAG_PROPERTYNAME, function() use ($node): string {
+			return '"'.($node->getSystemTag()->getETag() ?? '').'"';
 		});
 
-		$propFind->handle(self::ID_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::ID_PROPERTYNAME, function() use ($node) {
 			return $node->getSystemTag()->getId();
 		});
 
-		$propFind->handle(self::DISPLAYNAME_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::DISPLAYNAME_PROPERTYNAME, function() use ($node) {
 			return $node->getSystemTag()->getName();
 		});
 
-		$propFind->handle(self::USERVISIBLE_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::USERVISIBLE_PROPERTYNAME, function() use ($node) {
 			return $node->getSystemTag()->isUserVisible() ? 'true' : 'false';
 		});
 
-		$propFind->handle(self::USERASSIGNABLE_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::USERASSIGNABLE_PROPERTYNAME, function() use ($node) {
 			// this is the tag's inherent property "is user assignable"
 			return $node->getSystemTag()->isUserAssignable() ? 'true' : 'false';
 		});
 
-		$propFind->handle(self::CANASSIGN_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::CANASSIGN_PROPERTYNAME, function() use ($node) {
 			// this is the effective permission for the current user
 			return $this->tagManager->canUserAssignTag($node->getSystemTag(), $this->userSession->getUser()) ? 'true' : 'false';
 		});
 
-		$propFind->handle(self::COLOR_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::COLOR_PROPERTYNAME, function() use ($node) {
 			return $node->getSystemTag()->getColor() ?? '';
 		});
 
-		$propFind->handle(self::GROUPS_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::GROUPS_PROPERTYNAME, function() use ($node) {
 			if (!$this->groupManager->isAdmin($this->userSession->getUser()->getUID())) {
 				// property only available for admins
 				throw new Forbidden();
@@ -306,15 +306,15 @@ 
 		});
 
 		if ($node instanceof SystemTagNode) {
-			$propFind->handle(self::NUM_FILES_PROPERTYNAME, function () use ($node): int {
+			$propFind->handle(self::NUM_FILES_PROPERTYNAME, function() use ($node): int {
 				return $node->getNumberOfFiles();
 			});
 
-			$propFind->handle(self::REFERENCE_FILEID_PROPERTYNAME, function () use ($node): int {
+			$propFind->handle(self::REFERENCE_FILEID_PROPERTYNAME, function() use ($node): int {
 				return $node->getReferenceFileId();
 			});
 
-			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
+			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function() use ($node): SystemTagsObjectList {
 				$objectTypes = $this->tagMapper->getAvailableObjectTypes();
 				$objects = [];
 				foreach ($objectTypes as $type) {
@@ -326,7 +326,7 @@ 
 		}
 
 		if ($node instanceof SystemTagObjectType) {
-			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function () use ($node): SystemTagsObjectList {
+			$propFind->handle(self::OBJECTIDS_PROPERTYNAME, function() use ($node): SystemTagsObjectList {
 				return new SystemTagsObjectList(array_fill_keys($node->getObjectsIds(), $node->getName()));
 			});
 		}
@@ -334,11 +334,11 @@ 
 
 	private function propfindForFile(PropFind $propFind, Node $node): void {
 
-		$propFind->handle(self::SYSTEM_TAGS_PROPERTYNAME, function () use ($node) {
+		$propFind->handle(self::SYSTEM_TAGS_PROPERTYNAME, function() use ($node) {
 			$user = $this->userSession->getUser();
 
 			$tags = $this->getTagsForFile($node->getId(), $user);
-			usort($tags, function (ISystemTag $tagA, ISystemTag $tagB): int {
+			usort($tags, function(ISystemTag $tagA, ISystemTag $tagB): int {
 				return Util::naturalSortCompare($tagA->getName(), $tagB->getName());
 			});
 			return new SystemTagList($tags, $this->tagManager, $user);
@@ -362,11 +362,11 @@ 
 			}
 		}
 
-		$tags = array_filter(array_map(function (string $tagId) {
+		$tags = array_filter(array_map(function(string $tagId) {
 			return $this->cachedTags[$tagId] ?? null;
 		}, $tagIds));
 
-		$uncachedTagIds = array_filter($tagIds, function (string $tagId): bool {
+		$uncachedTagIds = array_filter($tagIds, function(string $tagId): bool {
 			return !isset($this->cachedTags[$tagId]);
 		});
 
@@ -378,7 +378,7 @@ 
 			$tags += $retrievedTags;
 		}
 
-		return array_filter($tags, function (ISystemTag $tag) use ($user) {
+		return array_filter($tags, function(ISystemTag $tag) use ($user) {
 			return $this->tagManager->canUserSeeTag($tag, $user);
 		});
 	}
@@ -397,7 +397,7 @@ 
 			return;
 		}
 
-		$propPatch->handle([self::OBJECTIDS_PROPERTYNAME], function ($props) use ($node) {
+		$propPatch->handle([self::OBJECTIDS_PROPERTYNAME], function($props) use ($node) {
 			if (!$node instanceof SystemTagObjectType) {
 				return false;
 			}
@@ -417,7 +417,7 @@ 
 				$objectTypes = array_unique(array_values($objects));
 
 				if (count($objectTypes) !== 1 || $objectTypes[0] !== $node->getName()) {
-					throw new BadRequest('Invalid object-ids property. All object types must be of the same type: ' . $node->getName());
+					throw new BadRequest('Invalid object-ids property. All object types must be of the same type: '.$node->getName());
 				}
 
 				// Only files are supported at the moment
@@ -428,7 +428,7 @@ 
 
 				// Get all current tagged objects
 				$taggedObjects = $this->tagMapper->getObjectIdsForTags([$node->getSystemTag()->getId()], 'files');
-				$toAddObjects = array_map(fn ($value) => (string)$value, array_keys($objects));
+				$toAddObjects = array_map(fn ($value) => (string) $value, array_keys($objects));
 
 				// Compute the tags to add and remove
 				$addedObjects = array_values(array_diff($toAddObjects, $taggedObjects));
@@ -463,7 +463,7 @@ 
 			self::NUM_FILES_PROPERTYNAME,
 			self::REFERENCE_FILEID_PROPERTYNAME,
 			self::COLOR_PROPERTYNAME,
-		], function ($props) use ($node) {
+		], function($props) use ($node) {
 			if (!$node instanceof SystemTagNode) {
 				return false;
 			}
@@ -542,7 +542,7 @@ 
 
 		foreach ($fileIds as $fileId) {
 			try {
-				$nodes = $userFolder->getById((int)$fileId);
+				$nodes = $userFolder->getById((int) $fileId);
 				if (empty($nodes)) {
 					return false;
 				}