ApiTest: set user profile photo

build(deps): bump @testing-library/user-event from 14.5.2 to 14.6.1 in /services/idp

.bingo/Variables.mk

@@ -65,12 +65,6 @@ $(GOVULNCHECK): $(BINGO_DIR)/govulncheck.mod
 	@echo "(re)installing $(GOBIN)/govulncheck-v1.1.4"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=govulncheck.mod -o=$(GOBIN)/govulncheck-v1.1.4 "golang.org/x/vuln/cmd/govulncheck"
 
-HUGO := $(GOBIN)/hugo-v0.123.7
-$(HUGO): $(BINGO_DIR)/hugo.mod
-	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/hugo-v0.123.7"
-	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=hugo.mod -o=$(GOBIN)/hugo-v0.123.7 "github.com/gohugoio/hugo"
-
 MOCKERY := $(GOBIN)/mockery-v2.53.2
 $(MOCKERY): $(BINGO_DIR)/mockery.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

.bingo/hugo.mod

@@ -1,7 +0,0 @@
-module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
-
-go 1.17
-
-replace github.com/markbates/inflect => github.com/markbates/inflect v0.0.0-20171215194931-a12c3aec81a6
-
-require github.com/gohugoio/hugo v0.123.7

.bingo/variables.env

@@ -24,8 +24,6 @@ GOLANGCI_LINT="${GOBIN}/golangci-lint-v1.64.6"
 
 GOVULNCHECK="${GOBIN}/govulncheck-v1.1.4"
 
-HUGO="${GOBIN}/hugo-v0.123.7"
-
 MOCKERY="${GOBIN}/mockery-v2.53.2"
 
 MUTAGEN="${GOBIN}/mutagen-v0.18.1"

deployments/examples/opencloud_full/collabora.yml

@@ -53,7 +53,7 @@ services:
     restart: always
 
   collabora:
-    image: collabora/code:25.04.1.1.1
+    image: collabora/code:25.04.2.1.1
     # release notes: https://www.collaboraonline.com/release-notes/
     networks:
       opencloud-net:

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/Nerzal/gocloak/v13 v13.9.0
 	github.com/bbalet/stopwords v1.0.0
 	github.com/beevik/etree v1.5.1
-	github.com/blevesearch/bleve/v2 v2.5.0
+	github.com/blevesearch/bleve/v2 v2.5.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.14.1
 	github.com/cs3org/go-cs3apis v0.0.0-20241105092511-3ad35d174fc1
@@ -55,16 +55,16 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/mna/pigeon v1.3.0
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
-	github.com/nats-io/nats-server/v2 v2.11.3
+	github.com/nats-io/nats-server/v2 v2.11.4
 	github.com/nats-io/nats.go v1.42.0
 	github.com/oklog/run v1.1.0
-	github.com/olekukonko/tablewriter v0.0.5
+	github.com/olekukonko/tablewriter v1.0.6
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.37.0
 	github.com/open-policy-agent/opa v1.4.2
-	github.com/opencloud-eu/libre-graph-api-go v1.0.5
-	github.com/opencloud-eu/reva/v2 v2.33.0
+	github.com/opencloud-eu/libre-graph-api-go v1.0.6
+	github.com/opencloud-eu/reva/v2 v2.33.1-0.20250520152851-d33c49bb52b9
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.10
@@ -89,22 +89,22 @@ require (
 	go-micro.dev/v4 v4.11.0
 	go.etcd.io/bbolt v1.4.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0
 	go.opentelemetry.io/contrib/zpages v0.60.0
-	go.opentelemetry.io/otel v1.35.0
+	go.opentelemetry.io/otel v1.36.0
 	go.opentelemetry.io/otel/exporters/jaeger v1.17.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0
-	go.opentelemetry.io/otel/sdk v1.35.0
-	go.opentelemetry.io/otel/trace v1.35.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0
+	go.opentelemetry.io/otel/sdk v1.36.0
+	go.opentelemetry.io/otel/trace v1.36.0
 	golang.org/x/crypto v0.38.0
 	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac
 	golang.org/x/image v0.27.0
-	golang.org/x/net v0.39.0
+	golang.org/x/net v0.40.0
 	golang.org/x/oauth2 v0.30.0
 	golang.org/x/sync v0.14.0
 	golang.org/x/term v0.32.0
 	golang.org/x/text v0.25.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb
+	google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237
 	google.golang.org/grpc v1.72.1
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v2 v2.4.0
@@ -128,30 +128,30 @@ require (
 	github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go v1.55.6 // indirect
+	github.com/aws/aws-sdk-go v1.55.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitly/go-simplejson v0.5.0 // indirect
 	github.com/bits-and-blooms/bitset v1.22.0 // indirect
-	github.com/blevesearch/bleve_index_api v1.2.7 // indirect
-	github.com/blevesearch/geo v0.1.20 // indirect
+	github.com/blevesearch/bleve_index_api v1.2.8 // indirect
+	github.com/blevesearch/geo v0.2.3 // indirect
 	github.com/blevesearch/go-faiss v1.0.25 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.0.4 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.3.9 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.3.10 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
 	github.com/blevesearch/vellum v1.1.0 // indirect
-	github.com/blevesearch/zapx/v11 v11.4.1 // indirect
-	github.com/blevesearch/zapx/v12 v12.4.1 // indirect
-	github.com/blevesearch/zapx/v13 v13.4.1 // indirect
-	github.com/blevesearch/zapx/v14 v14.4.1 // indirect
-	github.com/blevesearch/zapx/v15 v15.4.1 // indirect
-	github.com/blevesearch/zapx/v16 v16.2.2 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.2 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.2 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.2 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.2 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.2 // indirect
+	github.com/blevesearch/zapx/v16 v16.2.3 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/ceph/go-ceph v0.33.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cevaris/ordered_map v0.0.0-20190319150403-3adeae072e73 // indirect
@@ -211,12 +211,11 @@ require (
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/gomodule/redigo v1.9.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/go-tpm v0.9.3 // indirect
+	github.com/google/go-tpm v0.9.5 // indirect
 	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/gookit/color v1.5.4 // indirect
@@ -266,6 +265,8 @@ require (
 	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
+	github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6 // indirect
+	github.com/olekukonko/ll v0.0.8-0.20250516010636-22ea57d81985 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
 	github.com/pablodz/inotifywaitgo v0.0.9 // indirect
@@ -317,9 +318,9 @@ require (
 	go.etcd.io/etcd/client/v3 v3.5.20 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.6.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
@@ -330,7 +331,7 @@ require (
 	golang.org/x/tools v0.31.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect

go.sum

@@ -126,8 +126,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkY
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.37.27/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
-github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
+github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/bbalet/stopwords v1.0.0 h1:0TnGycCtY0zZi4ltKoOGRFIlZHv0WqpoIGUsObjztfo=
 github.com/bbalet/stopwords v1.0.0/go.mod h1:sAWrQoDMfqARGIn4s6dp7OW7ISrshUD8IP2q3KoqPjc=
 github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
@@ -146,12 +146,12 @@ github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6
 github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCkcs2uw7w4=
 github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/blevesearch/bleve/v2 v2.5.0 h1:HzYqBy/5/M9Ul9ESEmXzN/3Jl7YpmWBdHM/+zzv/3k4=
-github.com/blevesearch/bleve/v2 v2.5.0/go.mod h1:PcJzTPnEynO15dCf9isxOga7YFRa/cMSsbnRwnszXUk=
-github.com/blevesearch/bleve_index_api v1.2.7 h1:c8r9vmbaYQroAMSGag7zq5gEVPiuXrUQDqfnj7uYZSY=
-github.com/blevesearch/bleve_index_api v1.2.7/go.mod h1:rKQDl4u51uwafZxFrPD1R7xFOwKnzZW7s/LSeK4lgo0=
-github.com/blevesearch/geo v0.1.20 h1:paaSpu2Ewh/tn5DKn/FB5SzvH0EWupxHEIwbCk/QPqM=
-github.com/blevesearch/geo v0.1.20/go.mod h1:DVG2QjwHNMFmjo+ZgzrIq2sfCh6rIHzy9d9d0B59I6w=
+github.com/blevesearch/bleve/v2 v2.5.1 h1:cc/O++W2Hcjp1SU5ETHeE+QYWv2oV88ldYEPowdmg8M=
+github.com/blevesearch/bleve/v2 v2.5.1/go.mod h1:9g/wnbWKm9AgXrU8Ecqi+IDdqjUHWymwkQRDg+5tafU=
+github.com/blevesearch/bleve_index_api v1.2.8 h1:Y98Pu5/MdlkRyLM0qDHostYo7i+Vv1cDNhqTeR4Sy6Y=
+github.com/blevesearch/bleve_index_api v1.2.8/go.mod h1:rKQDl4u51uwafZxFrPD1R7xFOwKnzZW7s/LSeK4lgo0=
+github.com/blevesearch/geo v0.2.3 h1:K9/vbGI9ehlXdxjxDRJtoAMt7zGAsMIzc6n8zWcwnhg=
+github.com/blevesearch/geo v0.2.3/go.mod h1:K56Q33AzXt2YExVHGObtmRSFYZKYGv0JEN5mdacJJR8=
 github.com/blevesearch/go-faiss v1.0.25 h1:lel1rkOUGbT1CJ0YgzKwC7k+XH0XVBHnCVWahdCXk4U=
 github.com/blevesearch/go-faiss v1.0.25/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
@@ -160,8 +160,8 @@ github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZG
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
 github.com/blevesearch/mmap-go v1.0.4 h1:OVhDhT5B/M1HNPpYPBKIEJaD0F3Si+CrEKULGCDPWmc=
 github.com/blevesearch/mmap-go v1.0.4/go.mod h1:EWmEAOmdAS9z/pi/+Toxu99DnsbhG1TIxUoRmJw/pSs=
-github.com/blevesearch/scorch_segment_api/v2 v2.3.9 h1:X6nJXnNHl7nasXW+U6y2Ns2Aw8F9STszkYkyBfQ+p0o=
-github.com/blevesearch/scorch_segment_api/v2 v2.3.9/go.mod h1:IrzspZlVjhf4X29oJiEhBxEteTqOY9RlYlk1lCmYHr4=
+github.com/blevesearch/scorch_segment_api/v2 v2.3.10 h1:Yqk0XD1mE0fDZAJXTjawJ8If/85JxnLd8v5vG/jWE/s=
+github.com/blevesearch/scorch_segment_api/v2 v2.3.10/go.mod h1:Z3e6ChN3qyN35yaQpl00MfI5s8AxUJbpTR/DL8QOQ+8=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
@@ -170,18 +170,18 @@ github.com/blevesearch/upsidedown_store_api v1.0.2 h1:U53Q6YoWEARVLd1OYNc9kvhBMG
 github.com/blevesearch/upsidedown_store_api v1.0.2/go.mod h1:M01mh3Gpfy56Ps/UXHjEO/knbqyQ1Oamg8If49gRwrQ=
 github.com/blevesearch/vellum v1.1.0 h1:CinkGyIsgVlYf8Y2LUQHvdelgXr6PYuvoDIajq6yR9w=
 github.com/blevesearch/vellum v1.1.0/go.mod h1:QgwWryE8ThtNPxtgWJof5ndPfx0/YMBh+W2weHKPw8Y=
-github.com/blevesearch/zapx/v11 v11.4.1 h1:qFCPlFbsEdwbbckJkysptSQOsHn4s6ZOHL5GMAIAVHA=
-github.com/blevesearch/zapx/v11 v11.4.1/go.mod h1:qNOGxIqdPC1MXauJCD9HBG487PxviTUUbmChFOAosGs=
-github.com/blevesearch/zapx/v12 v12.4.1 h1:K77bhypII60a4v8mwvav7r4IxWA8qxhNjgF9xGdb9eQ=
-github.com/blevesearch/zapx/v12 v12.4.1/go.mod h1:QRPrlPOzAxBNMI0MkgdD+xsTqx65zbuPr3Ko4Re49II=
-github.com/blevesearch/zapx/v13 v13.4.1 h1:EnkEMZFUK0lsW/jOJJF2xOcp+W8TjEsyeN5BeAZEYYE=
-github.com/blevesearch/zapx/v13 v13.4.1/go.mod h1:e6duBMlCvgbH9rkzNMnUa9hRI9F7ri2BRcHfphcmGn8=
-github.com/blevesearch/zapx/v14 v14.4.1 h1:G47kGCshknBZzZAtjcnIAMn3oNx8XBLxp8DMq18ogyE=
-github.com/blevesearch/zapx/v14 v14.4.1/go.mod h1:O7sDxiaL2r2PnCXbhh1Bvm7b4sP+jp4unE9DDPWGoms=
-github.com/blevesearch/zapx/v15 v15.4.1 h1:B5IoTMUCEzFdc9FSQbhVOxAY+BO17c05866fNruiI7g=
-github.com/blevesearch/zapx/v15 v15.4.1/go.mod h1:b/MreHjYeQoLjyY2+UaM0hGZZUajEbE0xhnr1A2/Q6Y=
-github.com/blevesearch/zapx/v16 v16.2.2 h1:MifKJVRTEhMTgSlle2bDRTb39BGc9jXFRLPZc6r0Rzk=
-github.com/blevesearch/zapx/v16 v16.2.2/go.mod h1:B9Pk4G1CqtErgQV9DyCSA9Lb7WZe4olYfGw7fVDZ4sk=
+github.com/blevesearch/zapx/v11 v11.4.2 h1:l46SV+b0gFN+Rw3wUI1YdMWdSAVhskYuvxlcgpQFljs=
+github.com/blevesearch/zapx/v11 v11.4.2/go.mod h1:4gdeyy9oGa/lLa6D34R9daXNUvfMPZqUYjPwiLmekwc=
+github.com/blevesearch/zapx/v12 v12.4.2 h1:fzRbhllQmEMUuAQ7zBuMvKRlcPA5ESTgWlDEoB9uQNE=
+github.com/blevesearch/zapx/v12 v12.4.2/go.mod h1:TdFmr7afSz1hFh/SIBCCZvcLfzYvievIH6aEISCte58=
+github.com/blevesearch/zapx/v13 v13.4.2 h1:46PIZCO/ZuKZYgxI8Y7lOJqX3Irkc3N8W82QTK3MVks=
+github.com/blevesearch/zapx/v13 v13.4.2/go.mod h1:knK8z2NdQHlb5ot/uj8wuvOq5PhDGjNYQQy0QDnopZk=
+github.com/blevesearch/zapx/v14 v14.4.2 h1:2SGHakVKd+TrtEqpfeq8X+So5PShQ5nW6GNxT7fWYz0=
+github.com/blevesearch/zapx/v14 v14.4.2/go.mod h1:rz0XNb/OZSMjNorufDGSpFpjoFKhXmppH9Hi7a877D8=
+github.com/blevesearch/zapx/v15 v15.4.2 h1:sWxpDE0QQOTjyxYbAVjt3+0ieu8NCE0fDRaFxEsp31k=
+github.com/blevesearch/zapx/v15 v15.4.2/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
+github.com/blevesearch/zapx/v16 v16.2.3 h1:7Y0r+a3diEvlazsncexq1qoFOcBd64xwMS7aDm4lo1s=
+github.com/blevesearch/zapx/v16 v16.2.3/go.mod h1:wVJ+GtURAaRG9KQAMNYyklq0egV+XJlGcXNCE0OFjjA=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
 github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
@@ -201,6 +201,8 @@ github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QH
 github.com/cenkalti/backoff/v4 v4.1.0/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/ceph/go-ceph v0.33.0 h1:xT9v/MAa+DIBmflyITyFkGRgWngATghGegKJguEOInQ=
@@ -458,8 +460,6 @@ github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXe
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
 github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 h1:gtexQ/VGyN+VVFRXSFiguSNcXmS6rkKT+X7FdIrTtfo=
-github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -527,8 +527,8 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-tika v0.3.1 h1:l+jr10hDhZjcgxFRfcQChRLo1bPXQeLFluMyvDhXTTA=
 github.com/google/go-tika v0.3.1/go.mod h1:DJh5N8qxXIl85QkqmXknd+PeeRkUOTbvwyYf7ieDz6c=
-github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
-github.com/google/go-tpm v0.9.3/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm v0.9.5 h1:ocUmnDebX54dnW+MQWGQRbdaAcJELsa6PqZhJ48KwVU=
+github.com/google/go-tpm v0.9.5/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -820,8 +820,8 @@ github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRW
 github.com/namedotcom/go v0.0.0-20180403034216-08470befbe04/go.mod h1:5sN+Lt1CaY4wsPvgQH/jsuJi4XO2ssZbdsIizr4CVC8=
 github.com/nats-io/jwt/v2 v2.7.4 h1:jXFuDDxs/GQjGDZGhNgH4tXzSUK6WQi2rsj4xmsNOtI=
 github.com/nats-io/jwt/v2 v2.7.4/go.mod h1:me11pOkwObtcBNR8AiMrUbtVOUGkqYjMQZ6jnSdVUIA=
-github.com/nats-io/nats-server/v2 v2.11.3 h1:AbGtXxuwjo0gBroLGGr/dE0vf24kTKdRnBq/3z/Fdoc=
-github.com/nats-io/nats-server/v2 v2.11.3/go.mod h1:6Z6Fd+JgckqzKig7DYwhgrE7bJ6fypPHnGPND+DqgMY=
+github.com/nats-io/nats-server/v2 v2.11.4 h1:oQhvy6He6ER926sGqIKBKuYHH4BGnUQCNb0Y5Qa+M54=
+github.com/nats-io/nats-server/v2 v2.11.4/go.mod h1:jFnKKwbNeq6IfLHq+OMnl7vrFRihQ/MkhRbiWfjLdjU=
 github.com/nats-io/nats.go v1.42.0 h1:ynIMupIOvf/ZWH/b2qda6WGKGNSjwOUutTpWRvAmhaM=
 github.com/nats-io/nats.go v1.42.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
 github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
@@ -842,8 +842,13 @@ github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
+github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6 h1:r3FaAI0NZK3hSmtTDrBVREhKULp8oUeqLT5Eyl2mSPo=
+github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/ll v0.0.8-0.20250516010636-22ea57d81985 h1:V2wKiwjwAfRJRtUP6pC7wt4opeF14enO0du2dRV6Llo=
+github.com/olekukonko/ll v0.0.8-0.20250516010636-22ea57d81985/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/olekukonko/tablewriter v1.0.6 h1:/T45mIHc5hcEvibgzBzvMy7ruT+RjgoQRvkHbnl6OWA=
+github.com/olekukonko/tablewriter v1.0.6/go.mod h1:SJ0MV1aHb/89fLcsBMXMp30Xg3g5eGoOUu0RptEk4AU=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
@@ -860,10 +865,10 @@ github.com/open-policy-agent/opa v1.4.2 h1:ag4upP7zMsa4WE2p1pwAFeG4Pn3mNwfAx9DLh
 github.com/open-policy-agent/opa v1.4.2/go.mod h1:DNzZPKqKh4U0n0ANxcCVlw8lCSv2c+h5G/3QvSYdWZ8=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a h1:Sakl76blJAaM6NxylVkgSzktjo2dS504iDotEFJsh3M=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a/go.mod h1:pjcozWijkNPbEtX5SIQaxEW/h8VAVZYTLx+70bmB3LY=
-github.com/opencloud-eu/libre-graph-api-go v1.0.5 h1:Wv09oIjCF8zRN8roPzjXXo6ORp2h87/YhmdXE9N4p/A=
-github.com/opencloud-eu/libre-graph-api-go v1.0.5/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.33.0 h1:uFbt4BC21gU0bbrp4CHABhWR4Xk5H+e2kA7KrEUXGEQ=
-github.com/opencloud-eu/reva/v2 v2.33.0/go.mod h1:wRZ/7eJTOfkhjtDlYcNt83Loz2drfXssh+5JMDcq/5o=
+github.com/opencloud-eu/libre-graph-api-go v1.0.6 h1:bUQq0tfaLboZZmPuI6C1rr/wFIVOIM9IsE1WqI5QsDA=
+github.com/opencloud-eu/libre-graph-api-go v1.0.6/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
+github.com/opencloud-eu/reva/v2 v2.33.1-0.20250520152851-d33c49bb52b9 h1:7y8gTqVQSXLyAqeUFesbI58OkgGcS5fmfq2f3e95XOI=
+github.com/opencloud-eu/reva/v2 v2.33.1-0.20250520152851-d33c49bb52b9/go.mod h1:8S3B+GPFdGMcNL/pkSHI4K2/E0ICvR7qxllE7Ooydm8=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
@@ -1163,30 +1168,30 @@ go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJyS
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
 go.opentelemetry.io/contrib/zpages v0.60.0 h1:wOM9ie1Hz4H88L9KE6GrGbKJhfm+8F1NfW/Y3q9Xt+8=
 go.opentelemetry.io/contrib/zpages v0.60.0/go.mod h1:xqfToSRGh2MYUsfyErNz8jnNDPlnpZqWM/y6Z2Cx7xw=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
 go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4=
 go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 h1:dNzwXjZKpMpE2JhmO+9HsPl42NIXFIFSUSSs0fiqra0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0/go.mod h1:90PoxvaEB5n6AOdZvi+yWJQoE95U8Dhhw2bSyRqnTD0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 h1:JgtbA0xkWHnTmYk7YusopJFX6uleBmAuZ8n05NEh8nQ=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0/go.mod h1:179AK5aar5R3eS9FucPy6rggvU0g52cvKId8pv4+v0c=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
-go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
-go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI=
+go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
@@ -1326,8 +1331,8 @@ golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1593,10 +1598,10 @@ google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
 google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
-google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.19.1/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=

opencloud/pkg/command/benchmark.go

@@ -14,7 +14,8 @@ import (
 	"strings"
 	"time"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/opencloud/pkg/register"
 	"github.com/opencloud-eu/opencloud/pkg/config"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -403,11 +404,24 @@ func benchmark(iterations int, path string) error {
 	fmt.Printf("Iterations: %d\n", iterations)
 	fmt.Println("")
 
-	table := tw.NewWriter(os.Stdout)
-	table.SetHeader([]string{"Test", "Iterations", "dur/it", "total"})
-	table.SetAutoFormatHeaders(false)
-	table.SetColumnAlignment([]int{tw.ALIGN_LEFT, tw.ALIGN_RIGHT, tw.ALIGN_RIGHT, tw.ALIGN_RIGHT})
-	table.SetAutoMergeCellsByColumnIndex([]int{2, 3})
+	cfg := tablewriter.Config{
+		Header: tw.CellConfig{
+			Formatting: tw.CellFormatting{
+				AutoFormat: tw.Off,
+			},
+		},
+		Row: tw.CellConfig{
+			ColumnAligns: []tw.Align{
+				tw.AlignLeft,
+				tw.AlignRight,
+				tw.AlignRight,
+				tw.AlignRight,
+			},
+		},
+	}
+
+	table := tablewriter.NewTable(os.Stdout, tablewriter.WithConfig(cfg))
+	table.Header([]string{"Test", "Iterations", "dur/it", "total"})
 	for _, t := range []string{"lockedfile open(wo,c,t) close", "stat", "fopen(wo,t) write close", "fopen(ro) close", "fopen(ro) read close", "xattr-set", "xattr-get"} {
 		start := time.Now()
 		err := tests[t]()

opencloud/pkg/command/version.go

@@ -4,7 +4,8 @@ import (
 	"fmt"
 	"os"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/urfave/cli/v2"
 	mreg "go-micro.dev/v4/registry"
 
@@ -62,9 +63,8 @@ func VersionCommand(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

opencloud/pkg/runtime/service/service.go

@@ -480,8 +480,8 @@ func (s *Service) generateRunSet(cfg *occfg.Config) {
 // List running processes for the Service Controller.
 func (s *Service) List(_ struct{}, reply *string) error {
 	tableString := &strings.Builder{}
-	table := tablewriter.NewWriter(tableString)
-	table.SetHeader([]string{"Service"})
+	table := tablewriter.NewTable(tableString)
+	table.Header([]string{"Service"})
 
 	names := []string{}
 	for t := range s.serviceToken {

services/app-provider/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/app-provider/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/app-registry/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/app-registry/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/auth-app/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/auth-app/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/auth-basic/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/auth-bearer/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/auth-bearer/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/auth-machine/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/auth-machine/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/auth-service/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/auth-service/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/collaboration/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/collaboration/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/collaboration/pkg/service/grpc/v0/service.go

@@ -292,6 +292,10 @@ func (s *Service) addQueryToURL(baseURL string, req *appproviderv1beta1.OpenInAp
 		}
 	}
 
+	if strings.ToLower(s.config.App.Product) == "collabora" {
+		q.Add("closebutton", "false")
+	}
+
 	qs := q.Encode()
 	u.RawQuery = qs
 

services/collaboration/pkg/service/grpc/v0/service_test.go

@@ -190,16 +190,16 @@ var _ = Describe("Discovery", func() {
 				Expect(resp.GetAppUrl().GetFormParameters()["access_token_ttl"]).To(Equal(strconv.FormatInt(nowTime.Add(5*time.Hour).Unix()*1000, 10)))
 			},
 			Entry("Microsoft chat no lang", "Microsoft", "", false, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e"),
-			Entry("Collabora chat no lang", "Collabora", "", false, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e"),
+			Entry("Collabora chat no lang", "Collabora", "", false, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&closebutton=false"),
 			Entry("OnlyOffice chat no lang", "OnlyOffice", "", false, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e"),
 			Entry("Microsoft chat lang", "Microsoft", "de", false, "https://cloud.opencloud.test/hosting/wopi/word/edit?UI_LLCC=de-DE&WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e"),
-			Entry("Collabora chat lang", "Collabora", "de", false, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&lang=de-DE"),
+			Entry("Collabora chat lang", "Collabora", "de", false, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&closebutton=false&lang=de-DE"),
 			Entry("OnlyOffice chat lang", "OnlyOffice", "de", false, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&ui=de-DE"),
 			Entry("Microsoft no chat no lang", "Microsoft", "", true, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1"),
-			Entry("Collabora no chat no lang", "Collabora", "", true, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1"),
+			Entry("Collabora no chat no lang", "Collabora", "", true, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&closebutton=false&dchat=1"),
 			Entry("OnlyOffice no chat no lang", "OnlyOffice", "", true, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1"),
 			Entry("Microsoft no chat lang", "Microsoft", "de", true, "https://cloud.opencloud.test/hosting/wopi/word/edit?UI_LLCC=de-DE&WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1"),
-			Entry("Collabora no chat lang", "Collabora", "de", true, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1&lang=de-DE"),
+			Entry("Collabora no chat lang", "Collabora", "de", true, "https://cloud.opencloud.test/hosting/wopi/word/view?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&closebutton=false&dchat=1&lang=de-DE"),
 			Entry("OnlyOffice no chat lang", "OnlyOffice", "de", true, "https://cloud.opencloud.test/hosting/wopi/word/edit?WOPISrc=https%3A%2F%2Fwopi.opencloud.test%2Fwopi%2Ffiles%2F2f6ec18696dd1008106749bd94106e5cfad5c09e15de7b77088d03843e71b43e&dchat=1&ui=de-DE"),
 		)
 		It("Success with Wopi Proxy", func() {

services/frontend/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/frontend/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/gateway/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/gateway/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/graph/.mockery.yaml

@@ -16,11 +16,17 @@ packages:
             HTTPClient:
             Permissions:
             RoleService:
+            UsersUserProfilePhotoProvider:
     github.com/opencloud-eu/reva/v2/pkg/events:
         config:
             dir: "mocks"
         interfaces:
             Publisher:
+    github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata:
+        config:
+            dir: "mocks"
+        interfaces:
+            Storage:
     github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool:
         config:
             dir: "mocks"

services/graph/mocks/drive_item_permissions_provider.go

@@ -294,9 +294,9 @@ func (_c *DriveItemPermissionsProvider_Invite_Call) RunAndReturn(run func(contex
 	return _c
 }
 
-// ListPermissions provides a mock function with given fields: ctx, itemID, listFederatedRoles, selectRoles
-func (_m *DriveItemPermissionsProvider) ListPermissions(ctx context.Context, itemID *providerv1beta1.ResourceId, listFederatedRoles bool, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
-	ret := _m.Called(ctx, itemID, listFederatedRoles, selectRoles)
+// ListPermissions provides a mock function with given fields: ctx, itemID, listFederatedRoles, selectedAttrs
+func (_m *DriveItemPermissionsProvider) ListPermissions(ctx context.Context, itemID *providerv1beta1.ResourceId, listFederatedRoles bool, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+	ret := _m.Called(ctx, itemID, listFederatedRoles, selectedAttrs)
 
 	if len(ret) == 0 {
 		panic("no return value specified for ListPermissions")
@@ -304,17 +304,17 @@ func (_m *DriveItemPermissionsProvider) ListPermissions(ctx context.Context, ite
 
 	var r0 libregraph.CollectionOfPermissionsWithAllowedValues
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, bool, bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error)); ok {
-		return rf(ctx, itemID, listFederatedRoles, selectRoles)
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, bool, map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)); ok {
+		return rf(ctx, itemID, listFederatedRoles, selectedAttrs)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, bool, bool) libregraph.CollectionOfPermissionsWithAllowedValues); ok {
-		r0 = rf(ctx, itemID, listFederatedRoles, selectRoles)
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, bool, map[string]struct{}) libregraph.CollectionOfPermissionsWithAllowedValues); ok {
+		r0 = rf(ctx, itemID, listFederatedRoles, selectedAttrs)
 	} else {
 		r0 = ret.Get(0).(libregraph.CollectionOfPermissionsWithAllowedValues)
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ResourceId, bool, bool) error); ok {
-		r1 = rf(ctx, itemID, listFederatedRoles, selectRoles)
+	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ResourceId, bool, map[string]struct{}) error); ok {
+		r1 = rf(ctx, itemID, listFederatedRoles, selectedAttrs)
 	} else {
 		r1 = ret.Error(1)
 	}
@@ -331,14 +331,14 @@ type DriveItemPermissionsProvider_ListPermissions_Call struct {
 //   - ctx context.Context
 //   - itemID *providerv1beta1.ResourceId
 //   - listFederatedRoles bool
-//   - selectRoles bool
-func (_e *DriveItemPermissionsProvider_Expecter) ListPermissions(ctx interface{}, itemID interface{}, listFederatedRoles interface{}, selectRoles interface{}) *DriveItemPermissionsProvider_ListPermissions_Call {
-	return &DriveItemPermissionsProvider_ListPermissions_Call{Call: _e.mock.On("ListPermissions", ctx, itemID, listFederatedRoles, selectRoles)}
+//   - selectedAttrs map[string]struct{}
+func (_e *DriveItemPermissionsProvider_Expecter) ListPermissions(ctx interface{}, itemID interface{}, listFederatedRoles interface{}, selectedAttrs interface{}) *DriveItemPermissionsProvider_ListPermissions_Call {
+	return &DriveItemPermissionsProvider_ListPermissions_Call{Call: _e.mock.On("ListPermissions", ctx, itemID, listFederatedRoles, selectedAttrs)}
 }
 
-func (_c *DriveItemPermissionsProvider_ListPermissions_Call) Run(run func(ctx context.Context, itemID *providerv1beta1.ResourceId, listFederatedRoles bool, selectRoles bool)) *DriveItemPermissionsProvider_ListPermissions_Call {
+func (_c *DriveItemPermissionsProvider_ListPermissions_Call) Run(run func(ctx context.Context, itemID *providerv1beta1.ResourceId, listFederatedRoles bool, selectedAttrs map[string]struct{})) *DriveItemPermissionsProvider_ListPermissions_Call {
 	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(*providerv1beta1.ResourceId), args[2].(bool), args[3].(bool))
+		run(args[0].(context.Context), args[1].(*providerv1beta1.ResourceId), args[2].(bool), args[3].(map[string]struct{}))
 	})
 	return _c
 }
@@ -348,14 +348,14 @@ func (_c *DriveItemPermissionsProvider_ListPermissions_Call) Return(_a0 libregra
 	return _c
 }
 
-func (_c *DriveItemPermissionsProvider_ListPermissions_Call) RunAndReturn(run func(context.Context, *providerv1beta1.ResourceId, bool, bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error)) *DriveItemPermissionsProvider_ListPermissions_Call {
+func (_c *DriveItemPermissionsProvider_ListPermissions_Call) RunAndReturn(run func(context.Context, *providerv1beta1.ResourceId, bool, map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)) *DriveItemPermissionsProvider_ListPermissions_Call {
 	_c.Call.Return(run)
 	return _c
 }
 
-// ListSpaceRootPermissions provides a mock function with given fields: ctx, driveID
-func (_m *DriveItemPermissionsProvider) ListSpaceRootPermissions(ctx context.Context, driveID *providerv1beta1.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
-	ret := _m.Called(ctx, driveID)
+// ListSpaceRootPermissions provides a mock function with given fields: ctx, driveID, selectedAttrs
+func (_m *DriveItemPermissionsProvider) ListSpaceRootPermissions(ctx context.Context, driveID *providerv1beta1.ResourceId, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+	ret := _m.Called(ctx, driveID, selectedAttrs)
 
 	if len(ret) == 0 {
 		panic("no return value specified for ListSpaceRootPermissions")
@@ -363,17 +363,17 @@ func (_m *DriveItemPermissionsProvider) ListSpaceRootPermissions(ctx context.Con
 
 	var r0 libregraph.CollectionOfPermissionsWithAllowedValues
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error)); ok {
-		return rf(ctx, driveID)
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)); ok {
+		return rf(ctx, driveID, selectedAttrs)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId) libregraph.CollectionOfPermissionsWithAllowedValues); ok {
-		r0 = rf(ctx, driveID)
+	if rf, ok := ret.Get(0).(func(context.Context, *providerv1beta1.ResourceId, map[string]struct{}) libregraph.CollectionOfPermissionsWithAllowedValues); ok {
+		r0 = rf(ctx, driveID, selectedAttrs)
 	} else {
 		r0 = ret.Get(0).(libregraph.CollectionOfPermissionsWithAllowedValues)
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ResourceId) error); ok {
-		r1 = rf(ctx, driveID)
+	if rf, ok := ret.Get(1).(func(context.Context, *providerv1beta1.ResourceId, map[string]struct{}) error); ok {
+		r1 = rf(ctx, driveID, selectedAttrs)
 	} else {
 		r1 = ret.Error(1)
 	}
@@ -389,13 +389,14 @@ type DriveItemPermissionsProvider_ListSpaceRootPermissions_Call struct {
 // ListSpaceRootPermissions is a helper method to define mock.On call
 //   - ctx context.Context
 //   - driveID *providerv1beta1.ResourceId
-func (_e *DriveItemPermissionsProvider_Expecter) ListSpaceRootPermissions(ctx interface{}, driveID interface{}) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
-	return &DriveItemPermissionsProvider_ListSpaceRootPermissions_Call{Call: _e.mock.On("ListSpaceRootPermissions", ctx, driveID)}
+//   - selectedAttrs map[string]struct{}
+func (_e *DriveItemPermissionsProvider_Expecter) ListSpaceRootPermissions(ctx interface{}, driveID interface{}, selectedAttrs interface{}) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
+	return &DriveItemPermissionsProvider_ListSpaceRootPermissions_Call{Call: _e.mock.On("ListSpaceRootPermissions", ctx, driveID, selectedAttrs)}
 }
 
-func (_c *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call) Run(run func(ctx context.Context, driveID *providerv1beta1.ResourceId)) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
+func (_c *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call) Run(run func(ctx context.Context, driveID *providerv1beta1.ResourceId, selectedAttrs map[string]struct{})) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
 	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(*providerv1beta1.ResourceId))
+		run(args[0].(context.Context), args[1].(*providerv1beta1.ResourceId), args[2].(map[string]struct{}))
 	})
 	return _c
 }
@@ -405,7 +406,7 @@ func (_c *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call) Return(_a0
 	return _c
 }
 
-func (_c *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call) RunAndReturn(run func(context.Context, *providerv1beta1.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error)) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
+func (_c *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call) RunAndReturn(run func(context.Context, *providerv1beta1.ResourceId, map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)) *DriveItemPermissionsProvider_ListSpaceRootPermissions_Call {
 	_c.Call.Return(run)
 	return _c
 }

services/graph/mocks/storage.go

@@ -0,0 +1,732 @@
+// Code generated by mockery. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	metadata "github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata"
+	mock "github.com/stretchr/testify/mock"
+
+	providerv1beta1 "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+)
+
+// Storage is an autogenerated mock type for the Storage type
+type Storage struct {
+	mock.Mock
+}
+
+type Storage_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Storage) EXPECT() *Storage_Expecter {
+	return &Storage_Expecter{mock: &_m.Mock}
+}
+
+// Backend provides a mock function with no fields
+func (_m *Storage) Backend() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Backend")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
+// Storage_Backend_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Backend'
+type Storage_Backend_Call struct {
+	*mock.Call
+}
+
+// Backend is a helper method to define mock.On call
+func (_e *Storage_Expecter) Backend() *Storage_Backend_Call {
+	return &Storage_Backend_Call{Call: _e.mock.On("Backend")}
+}
+
+func (_c *Storage_Backend_Call) Run(run func()) *Storage_Backend_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Storage_Backend_Call) Return(_a0 string) *Storage_Backend_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Storage_Backend_Call) RunAndReturn(run func() string) *Storage_Backend_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// CreateSymlink provides a mock function with given fields: ctx, oldname, newname
+func (_m *Storage) CreateSymlink(ctx context.Context, oldname string, newname string) error {
+	ret := _m.Called(ctx, oldname, newname)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateSymlink")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string) error); ok {
+		r0 = rf(ctx, oldname, newname)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Storage_CreateSymlink_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CreateSymlink'
+type Storage_CreateSymlink_Call struct {
+	*mock.Call
+}
+
+// CreateSymlink is a helper method to define mock.On call
+//   - ctx context.Context
+//   - oldname string
+//   - newname string
+func (_e *Storage_Expecter) CreateSymlink(ctx interface{}, oldname interface{}, newname interface{}) *Storage_CreateSymlink_Call {
+	return &Storage_CreateSymlink_Call{Call: _e.mock.On("CreateSymlink", ctx, oldname, newname)}
+}
+
+func (_c *Storage_CreateSymlink_Call) Run(run func(ctx context.Context, oldname string, newname string)) *Storage_CreateSymlink_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string), args[2].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_CreateSymlink_Call) Return(_a0 error) *Storage_CreateSymlink_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Storage_CreateSymlink_Call) RunAndReturn(run func(context.Context, string, string) error) *Storage_CreateSymlink_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Delete provides a mock function with given fields: ctx, path
+func (_m *Storage) Delete(ctx context.Context, path string) error {
+	ret := _m.Called(ctx, path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Delete")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = rf(ctx, path)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Storage_Delete_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Delete'
+type Storage_Delete_Call struct {
+	*mock.Call
+}
+
+// Delete is a helper method to define mock.On call
+//   - ctx context.Context
+//   - path string
+func (_e *Storage_Expecter) Delete(ctx interface{}, path interface{}) *Storage_Delete_Call {
+	return &Storage_Delete_Call{Call: _e.mock.On("Delete", ctx, path)}
+}
+
+func (_c *Storage_Delete_Call) Run(run func(ctx context.Context, path string)) *Storage_Delete_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_Delete_Call) Return(_a0 error) *Storage_Delete_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Storage_Delete_Call) RunAndReturn(run func(context.Context, string) error) *Storage_Delete_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Download provides a mock function with given fields: ctx, req
+func (_m *Storage) Download(ctx context.Context, req metadata.DownloadRequest) (*metadata.DownloadResponse, error) {
+	ret := _m.Called(ctx, req)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Download")
+	}
+
+	var r0 *metadata.DownloadResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, metadata.DownloadRequest) (*metadata.DownloadResponse, error)); ok {
+		return rf(ctx, req)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, metadata.DownloadRequest) *metadata.DownloadResponse); ok {
+		r0 = rf(ctx, req)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*metadata.DownloadResponse)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, metadata.DownloadRequest) error); ok {
+		r1 = rf(ctx, req)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_Download_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Download'
+type Storage_Download_Call struct {
+	*mock.Call
+}
+
+// Download is a helper method to define mock.On call
+//   - ctx context.Context
+//   - req metadata.DownloadRequest
+func (_e *Storage_Expecter) Download(ctx interface{}, req interface{}) *Storage_Download_Call {
+	return &Storage_Download_Call{Call: _e.mock.On("Download", ctx, req)}
+}
+
+func (_c *Storage_Download_Call) Run(run func(ctx context.Context, req metadata.DownloadRequest)) *Storage_Download_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(metadata.DownloadRequest))
+	})
+	return _c
+}
+
+func (_c *Storage_Download_Call) Return(_a0 *metadata.DownloadResponse, _a1 error) *Storage_Download_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_Download_Call) RunAndReturn(run func(context.Context, metadata.DownloadRequest) (*metadata.DownloadResponse, error)) *Storage_Download_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Init provides a mock function with given fields: ctx, name
+func (_m *Storage) Init(ctx context.Context, name string) error {
+	ret := _m.Called(ctx, name)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Init")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = rf(ctx, name)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Storage_Init_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Init'
+type Storage_Init_Call struct {
+	*mock.Call
+}
+
+// Init is a helper method to define mock.On call
+//   - ctx context.Context
+//   - name string
+func (_e *Storage_Expecter) Init(ctx interface{}, name interface{}) *Storage_Init_Call {
+	return &Storage_Init_Call{Call: _e.mock.On("Init", ctx, name)}
+}
+
+func (_c *Storage_Init_Call) Run(run func(ctx context.Context, name string)) *Storage_Init_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_Init_Call) Return(err error) *Storage_Init_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *Storage_Init_Call) RunAndReturn(run func(context.Context, string) error) *Storage_Init_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListDir provides a mock function with given fields: ctx, path
+func (_m *Storage) ListDir(ctx context.Context, path string) ([]*providerv1beta1.ResourceInfo, error) {
+	ret := _m.Called(ctx, path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListDir")
+	}
+
+	var r0 []*providerv1beta1.ResourceInfo
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]*providerv1beta1.ResourceInfo, error)); ok {
+		return rf(ctx, path)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) []*providerv1beta1.ResourceInfo); ok {
+		r0 = rf(ctx, path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*providerv1beta1.ResourceInfo)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_ListDir_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListDir'
+type Storage_ListDir_Call struct {
+	*mock.Call
+}
+
+// ListDir is a helper method to define mock.On call
+//   - ctx context.Context
+//   - path string
+func (_e *Storage_Expecter) ListDir(ctx interface{}, path interface{}) *Storage_ListDir_Call {
+	return &Storage_ListDir_Call{Call: _e.mock.On("ListDir", ctx, path)}
+}
+
+func (_c *Storage_ListDir_Call) Run(run func(ctx context.Context, path string)) *Storage_ListDir_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_ListDir_Call) Return(_a0 []*providerv1beta1.ResourceInfo, _a1 error) *Storage_ListDir_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_ListDir_Call) RunAndReturn(run func(context.Context, string) ([]*providerv1beta1.ResourceInfo, error)) *Storage_ListDir_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// MakeDirIfNotExist provides a mock function with given fields: ctx, name
+func (_m *Storage) MakeDirIfNotExist(ctx context.Context, name string) error {
+	ret := _m.Called(ctx, name)
+
+	if len(ret) == 0 {
+		panic("no return value specified for MakeDirIfNotExist")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = rf(ctx, name)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Storage_MakeDirIfNotExist_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'MakeDirIfNotExist'
+type Storage_MakeDirIfNotExist_Call struct {
+	*mock.Call
+}
+
+// MakeDirIfNotExist is a helper method to define mock.On call
+//   - ctx context.Context
+//   - name string
+func (_e *Storage_Expecter) MakeDirIfNotExist(ctx interface{}, name interface{}) *Storage_MakeDirIfNotExist_Call {
+	return &Storage_MakeDirIfNotExist_Call{Call: _e.mock.On("MakeDirIfNotExist", ctx, name)}
+}
+
+func (_c *Storage_MakeDirIfNotExist_Call) Run(run func(ctx context.Context, name string)) *Storage_MakeDirIfNotExist_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_MakeDirIfNotExist_Call) Return(_a0 error) *Storage_MakeDirIfNotExist_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Storage_MakeDirIfNotExist_Call) RunAndReturn(run func(context.Context, string) error) *Storage_MakeDirIfNotExist_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ReadDir provides a mock function with given fields: ctx, path
+func (_m *Storage) ReadDir(ctx context.Context, path string) ([]string, error) {
+	ret := _m.Called(ctx, path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ReadDir")
+	}
+
+	var r0 []string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]string, error)); ok {
+		return rf(ctx, path)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) []string); ok {
+		r0 = rf(ctx, path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_ReadDir_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ReadDir'
+type Storage_ReadDir_Call struct {
+	*mock.Call
+}
+
+// ReadDir is a helper method to define mock.On call
+//   - ctx context.Context
+//   - path string
+func (_e *Storage_Expecter) ReadDir(ctx interface{}, path interface{}) *Storage_ReadDir_Call {
+	return &Storage_ReadDir_Call{Call: _e.mock.On("ReadDir", ctx, path)}
+}
+
+func (_c *Storage_ReadDir_Call) Run(run func(ctx context.Context, path string)) *Storage_ReadDir_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_ReadDir_Call) Return(_a0 []string, _a1 error) *Storage_ReadDir_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_ReadDir_Call) RunAndReturn(run func(context.Context, string) ([]string, error)) *Storage_ReadDir_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ResolveSymlink provides a mock function with given fields: ctx, name
+func (_m *Storage) ResolveSymlink(ctx context.Context, name string) (string, error) {
+	ret := _m.Called(ctx, name)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ResolveSymlink")
+	}
+
+	var r0 string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (string, error)); ok {
+		return rf(ctx, name)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) string); ok {
+		r0 = rf(ctx, name)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, name)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_ResolveSymlink_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ResolveSymlink'
+type Storage_ResolveSymlink_Call struct {
+	*mock.Call
+}
+
+// ResolveSymlink is a helper method to define mock.On call
+//   - ctx context.Context
+//   - name string
+func (_e *Storage_Expecter) ResolveSymlink(ctx interface{}, name interface{}) *Storage_ResolveSymlink_Call {
+	return &Storage_ResolveSymlink_Call{Call: _e.mock.On("ResolveSymlink", ctx, name)}
+}
+
+func (_c *Storage_ResolveSymlink_Call) Run(run func(ctx context.Context, name string)) *Storage_ResolveSymlink_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_ResolveSymlink_Call) Return(_a0 string, _a1 error) *Storage_ResolveSymlink_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_ResolveSymlink_Call) RunAndReturn(run func(context.Context, string) (string, error)) *Storage_ResolveSymlink_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SimpleDownload provides a mock function with given fields: ctx, path
+func (_m *Storage) SimpleDownload(ctx context.Context, path string) ([]byte, error) {
+	ret := _m.Called(ctx, path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SimpleDownload")
+	}
+
+	var r0 []byte
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]byte, error)); ok {
+		return rf(ctx, path)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) []byte); ok {
+		r0 = rf(ctx, path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]byte)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_SimpleDownload_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SimpleDownload'
+type Storage_SimpleDownload_Call struct {
+	*mock.Call
+}
+
+// SimpleDownload is a helper method to define mock.On call
+//   - ctx context.Context
+//   - path string
+func (_e *Storage_Expecter) SimpleDownload(ctx interface{}, path interface{}) *Storage_SimpleDownload_Call {
+	return &Storage_SimpleDownload_Call{Call: _e.mock.On("SimpleDownload", ctx, path)}
+}
+
+func (_c *Storage_SimpleDownload_Call) Run(run func(ctx context.Context, path string)) *Storage_SimpleDownload_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_SimpleDownload_Call) Return(_a0 []byte, _a1 error) *Storage_SimpleDownload_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_SimpleDownload_Call) RunAndReturn(run func(context.Context, string) ([]byte, error)) *Storage_SimpleDownload_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SimpleUpload provides a mock function with given fields: ctx, uploadpath, content
+func (_m *Storage) SimpleUpload(ctx context.Context, uploadpath string, content []byte) error {
+	ret := _m.Called(ctx, uploadpath, content)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SimpleUpload")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, []byte) error); ok {
+		r0 = rf(ctx, uploadpath, content)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Storage_SimpleUpload_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SimpleUpload'
+type Storage_SimpleUpload_Call struct {
+	*mock.Call
+}
+
+// SimpleUpload is a helper method to define mock.On call
+//   - ctx context.Context
+//   - uploadpath string
+//   - content []byte
+func (_e *Storage_Expecter) SimpleUpload(ctx interface{}, uploadpath interface{}, content interface{}) *Storage_SimpleUpload_Call {
+	return &Storage_SimpleUpload_Call{Call: _e.mock.On("SimpleUpload", ctx, uploadpath, content)}
+}
+
+func (_c *Storage_SimpleUpload_Call) Run(run func(ctx context.Context, uploadpath string, content []byte)) *Storage_SimpleUpload_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string), args[2].([]byte))
+	})
+	return _c
+}
+
+func (_c *Storage_SimpleUpload_Call) Return(_a0 error) *Storage_SimpleUpload_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Storage_SimpleUpload_Call) RunAndReturn(run func(context.Context, string, []byte) error) *Storage_SimpleUpload_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Stat provides a mock function with given fields: ctx, path
+func (_m *Storage) Stat(ctx context.Context, path string) (*providerv1beta1.ResourceInfo, error) {
+	ret := _m.Called(ctx, path)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Stat")
+	}
+
+	var r0 *providerv1beta1.ResourceInfo
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*providerv1beta1.ResourceInfo, error)); ok {
+		return rf(ctx, path)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) *providerv1beta1.ResourceInfo); ok {
+		r0 = rf(ctx, path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*providerv1beta1.ResourceInfo)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_Stat_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Stat'
+type Storage_Stat_Call struct {
+	*mock.Call
+}
+
+// Stat is a helper method to define mock.On call
+//   - ctx context.Context
+//   - path string
+func (_e *Storage_Expecter) Stat(ctx interface{}, path interface{}) *Storage_Stat_Call {
+	return &Storage_Stat_Call{Call: _e.mock.On("Stat", ctx, path)}
+}
+
+func (_c *Storage_Stat_Call) Run(run func(ctx context.Context, path string)) *Storage_Stat_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *Storage_Stat_Call) Return(_a0 *providerv1beta1.ResourceInfo, _a1 error) *Storage_Stat_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_Stat_Call) RunAndReturn(run func(context.Context, string) (*providerv1beta1.ResourceInfo, error)) *Storage_Stat_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Upload provides a mock function with given fields: ctx, req
+func (_m *Storage) Upload(ctx context.Context, req metadata.UploadRequest) (*metadata.UploadResponse, error) {
+	ret := _m.Called(ctx, req)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Upload")
+	}
+
+	var r0 *metadata.UploadResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, metadata.UploadRequest) (*metadata.UploadResponse, error)); ok {
+		return rf(ctx, req)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, metadata.UploadRequest) *metadata.UploadResponse); ok {
+		r0 = rf(ctx, req)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*metadata.UploadResponse)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, metadata.UploadRequest) error); ok {
+		r1 = rf(ctx, req)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Storage_Upload_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Upload'
+type Storage_Upload_Call struct {
+	*mock.Call
+}
+
+// Upload is a helper method to define mock.On call
+//   - ctx context.Context
+//   - req metadata.UploadRequest
+func (_e *Storage_Expecter) Upload(ctx interface{}, req interface{}) *Storage_Upload_Call {
+	return &Storage_Upload_Call{Call: _e.mock.On("Upload", ctx, req)}
+}
+
+func (_c *Storage_Upload_Call) Run(run func(ctx context.Context, req metadata.UploadRequest)) *Storage_Upload_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(metadata.UploadRequest))
+	})
+	return _c
+}
+
+func (_c *Storage_Upload_Call) Return(_a0 *metadata.UploadResponse, _a1 error) *Storage_Upload_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Storage_Upload_Call) RunAndReturn(run func(context.Context, metadata.UploadRequest) (*metadata.UploadResponse, error)) *Storage_Upload_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewStorage creates a new instance of Storage. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewStorage(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Storage {
+	mock := &Storage{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

services/graph/mocks/users_user_profile_photo_provider.go

@@ -0,0 +1,191 @@
+// Code generated by mockery. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+	io "io"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// UsersUserProfilePhotoProvider is an autogenerated mock type for the UsersUserProfilePhotoProvider type
+type UsersUserProfilePhotoProvider struct {
+	mock.Mock
+}
+
+type UsersUserProfilePhotoProvider_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *UsersUserProfilePhotoProvider) EXPECT() *UsersUserProfilePhotoProvider_Expecter {
+	return &UsersUserProfilePhotoProvider_Expecter{mock: &_m.Mock}
+}
+
+// DeletePhoto provides a mock function with given fields: ctx, id
+func (_m *UsersUserProfilePhotoProvider) DeletePhoto(ctx context.Context, id string) error {
+	ret := _m.Called(ctx, id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for DeletePhoto")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = rf(ctx, id)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// UsersUserProfilePhotoProvider_DeletePhoto_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeletePhoto'
+type UsersUserProfilePhotoProvider_DeletePhoto_Call struct {
+	*mock.Call
+}
+
+// DeletePhoto is a helper method to define mock.On call
+//   - ctx context.Context
+//   - id string
+func (_e *UsersUserProfilePhotoProvider_Expecter) DeletePhoto(ctx interface{}, id interface{}) *UsersUserProfilePhotoProvider_DeletePhoto_Call {
+	return &UsersUserProfilePhotoProvider_DeletePhoto_Call{Call: _e.mock.On("DeletePhoto", ctx, id)}
+}
+
+func (_c *UsersUserProfilePhotoProvider_DeletePhoto_Call) Run(run func(ctx context.Context, id string)) *UsersUserProfilePhotoProvider_DeletePhoto_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_DeletePhoto_Call) Return(_a0 error) *UsersUserProfilePhotoProvider_DeletePhoto_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_DeletePhoto_Call) RunAndReturn(run func(context.Context, string) error) *UsersUserProfilePhotoProvider_DeletePhoto_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// GetPhoto provides a mock function with given fields: ctx, id
+func (_m *UsersUserProfilePhotoProvider) GetPhoto(ctx context.Context, id string) ([]byte, error) {
+	ret := _m.Called(ctx, id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetPhoto")
+	}
+
+	var r0 []byte
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]byte, error)); ok {
+		return rf(ctx, id)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) []byte); ok {
+		r0 = rf(ctx, id)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]byte)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, id)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// UsersUserProfilePhotoProvider_GetPhoto_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetPhoto'
+type UsersUserProfilePhotoProvider_GetPhoto_Call struct {
+	*mock.Call
+}
+
+// GetPhoto is a helper method to define mock.On call
+//   - ctx context.Context
+//   - id string
+func (_e *UsersUserProfilePhotoProvider_Expecter) GetPhoto(ctx interface{}, id interface{}) *UsersUserProfilePhotoProvider_GetPhoto_Call {
+	return &UsersUserProfilePhotoProvider_GetPhoto_Call{Call: _e.mock.On("GetPhoto", ctx, id)}
+}
+
+func (_c *UsersUserProfilePhotoProvider_GetPhoto_Call) Run(run func(ctx context.Context, id string)) *UsersUserProfilePhotoProvider_GetPhoto_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_GetPhoto_Call) Return(_a0 []byte, _a1 error) *UsersUserProfilePhotoProvider_GetPhoto_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_GetPhoto_Call) RunAndReturn(run func(context.Context, string) ([]byte, error)) *UsersUserProfilePhotoProvider_GetPhoto_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UpdatePhoto provides a mock function with given fields: ctx, id, r
+func (_m *UsersUserProfilePhotoProvider) UpdatePhoto(ctx context.Context, id string, r io.Reader) error {
+	ret := _m.Called(ctx, id, r)
+
+	if len(ret) == 0 {
+		panic("no return value specified for UpdatePhoto")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, io.Reader) error); ok {
+		r0 = rf(ctx, id, r)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// UsersUserProfilePhotoProvider_UpdatePhoto_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UpdatePhoto'
+type UsersUserProfilePhotoProvider_UpdatePhoto_Call struct {
+	*mock.Call
+}
+
+// UpdatePhoto is a helper method to define mock.On call
+//   - ctx context.Context
+//   - id string
+//   - r io.Reader
+func (_e *UsersUserProfilePhotoProvider_Expecter) UpdatePhoto(ctx interface{}, id interface{}, r interface{}) *UsersUserProfilePhotoProvider_UpdatePhoto_Call {
+	return &UsersUserProfilePhotoProvider_UpdatePhoto_Call{Call: _e.mock.On("UpdatePhoto", ctx, id, r)}
+}
+
+func (_c *UsersUserProfilePhotoProvider_UpdatePhoto_Call) Run(run func(ctx context.Context, id string, r io.Reader)) *UsersUserProfilePhotoProvider_UpdatePhoto_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(string), args[2].(io.Reader))
+	})
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_UpdatePhoto_Call) Return(_a0 error) *UsersUserProfilePhotoProvider_UpdatePhoto_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *UsersUserProfilePhotoProvider_UpdatePhoto_Call) RunAndReturn(run func(context.Context, string, io.Reader) error) *UsersUserProfilePhotoProvider_UpdatePhoto_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewUsersUserProfilePhotoProvider creates a new instance of UsersUserProfilePhotoProvider. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewUsersUserProfilePhotoProvider(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *UsersUserProfilePhotoProvider {
+	mock := &UsersUserProfilePhotoProvider{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

services/graph/pkg/command/unified_roles.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 
 	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/renderer"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/urfave/cli/v2"
 
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
@@ -54,12 +56,17 @@ func listUnifiedRoles(cfg *config.Config) *cli.Command {
 		Name:  "list",
 		Usage: "list available unified roles",
 		Action: func(c *cli.Context) error {
-			tbl := tablewriter.NewWriter(os.Stdout)
-			tbl.SetRowLine(true)
-			tbl.SetAutoMergeCellsByColumnIndex([]int{0}) // rowspan should only affect the first column
+			r := tw.Rendition{
+				Settings: tw.Settings{
+					Separators: tw.Separators{
+						BetweenRows: tw.On,
+					},
+				},
+			}
+			tbl := tablewriter.NewTable(os.Stdout, tablewriter.WithRenderer(renderer.NewBlueprint(r)))
 
 			headers := []string{"Name", "UID", "Enabled", "Description", "Condition", "Allowed resource actions"}
-			tbl.SetHeader(headers)
+			tbl.Header(headers)
 
 			for _, definition := range unifiedrole.GetRoles(unifiedrole.RoleFilterAll()) {
 				const enabled = "enabled"

services/graph/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/graph/pkg/config/config.go

@@ -37,6 +37,8 @@ type Config struct {
 	ServiceAccount ServiceAccount `yaml:"service_account"`
 
 	Context context.Context `yaml:"-"`
+
+	Metadata Metadata `yaml:"metadata_config"`
 }
 
 type Spaces struct {
@@ -153,3 +155,13 @@ type ServiceAccount struct {
 	ServiceAccountID     string `yaml:"service_account_id" env:"OC_SERVICE_ACCOUNT_ID;GRAPH_SERVICE_ACCOUNT_ID" desc:"The ID of the service account the service should use. See the 'auth-service' service description for more details." introductionVersion:"1.0.0"`
 	ServiceAccountSecret string `yaml:"service_account_secret" env:"OC_SERVICE_ACCOUNT_SECRET;GRAPH_SERVICE_ACCOUNT_SECRET" desc:"The service account secret." introductionVersion:"1.0.0"`
 }
+
+// Metadata configures the metadata store to use
+type Metadata struct {
+	GatewayAddress string `yaml:"gateway_addr" env:"GRAPH_STORAGE_GATEWAY_GRPC_ADDR;STORAGE_GATEWAY_GRPC_ADDR" desc:"GRPC address of the STORAGE-SYSTEM service." introductionVersion:"%%NEXT%%"`
+	StorageAddress string `yaml:"storage_addr" env:"GRAPH_STORAGE_GRPC_ADDR;STORAGE_GRPC_ADDR" desc:"GRPC address of the STORAGE-SYSTEM service." introductionVersion:"%%NEXT%%"`
+
+	SystemUserID     string `yaml:"system_user_id" env:"OC_SYSTEM_USER_ID;GRAPH_SYSTEM_USER_ID" desc:"ID of the OpenCloud STORAGE-SYSTEM system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format." introductionVersion:"%%NEXT%%"`
+	SystemUserIDP    string `yaml:"system_user_idp" env:"OC_SYSTEM_USER_IDP;GRAPH_SYSTEM_USER_IDP" desc:"IDP of the OpenCloud STORAGE-SYSTEM system user." introductionVersion:"%%NEXT%%"`
+	SystemUserAPIKey string `yaml:"system_user_api_key" env:"OC_SYSTEM_USER_API_KEY" desc:"API key for the STORAGE-SYSTEM system user." introductionVersion:"%%NEXT%%"`
+}

services/graph/pkg/config/defaults/defaultconfig.go

@@ -125,6 +125,11 @@ func DefaultConfig() *config.Config {
 		UnifiedRoles: config.UnifiedRoles{
 			AvailableRoles: nil, // will be populated with defaults in EnsureDefaults
 		},
+		Metadata: config.Metadata{
+			GatewayAddress: "eu.opencloud.api.storage-system",
+			StorageAddress: "eu.opencloud.api.storage-system",
+			SystemUserIDP:  "internal",
+		},
 	}
 }
 
@@ -191,6 +196,15 @@ func EnsureDefaults(cfg *config.Config) {
 			cfg.UnifiedRoles.AvailableRoles = append(cfg.UnifiedRoles.AvailableRoles, definition.GetId())
 		}
 	}
+
+	if cfg.Metadata.SystemUserAPIKey == "" && cfg.Commons != nil && cfg.Commons.SystemUserAPIKey != "" {
+		cfg.Metadata.SystemUserAPIKey = cfg.Commons.SystemUserAPIKey
+	}
+
+	if cfg.Metadata.SystemUserID == "" && cfg.Commons != nil && cfg.Commons.SystemUserID != "" {
+		cfg.Metadata.SystemUserID = cfg.Commons.SystemUserID
+	}
+
 }
 
 // Sanitize sanitized the configuration

services/graph/pkg/identity/ldap/reconnect.go

@@ -1,381 +0,0 @@
-package ldap
-
-// LDAP automatic reconnection mechanism, inspired by:
-// https://gist.github.com/emsearcy/cba3295d1a06d4c432ab4f6173b65e4f#file-ldap_snippet-go
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-ldap/ldap/v3"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-)
-
-var (
-	errMaxRetries = errors.New("max retries")
-)
-
-type ldapConnection struct {
-	Conn  *ldap.Conn
-	Error error
-}
-
-// ConnWithReconnect implements the ldap.Client interface
-type ConnWithReconnect struct {
-	conn    chan ldapConnection
-	reset   chan *ldap.Conn
-	retries int
-	logger  *log.Logger
-}
-
-type Config struct {
-	URI          string
-	BindDN       string
-	BindPassword string
-	TLSConfig    *tls.Config
-}
-
-func NewLDAPWithReconnect(logger *log.Logger, config Config) ConnWithReconnect {
-	conn := ConnWithReconnect{
-		conn:    make(chan ldapConnection),
-		reset:   make(chan *ldap.Conn),
-		retries: 1,
-		logger:  logger,
-	}
-	go conn.ldapAutoConnect(config)
-	return conn
-}
-
-func (c ConnWithReconnect) Search(sr *ldap.SearchRequest) (*ldap.SearchResult, error) {
-	conn, err := c.GetConnection()
-
-	if err != nil {
-		return nil, err
-	}
-
-	var res *ldap.SearchResult
-	for try := 0; try <= c.retries; try++ {
-		res, err = conn.Search(sr)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return res, err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return nil, err
-		}
-		c.logger.Debug().Msg("retrying LDAP Search")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return nil, ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) Add(a *ldap.AddRequest) error {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return err
-	}
-	for try := 0; try <= c.retries; try++ {
-		err = conn.Add(a)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return err
-		}
-		c.logger.Debug().Msg("retrying LDAP Add")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) Del(d *ldap.DelRequest) error {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return err
-	}
-
-	for try := 0; try <= c.retries; try++ {
-		err = conn.Del(d)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return err
-		}
-		c.logger.Debug().Msg("retrying LDAP Del")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) Modify(m *ldap.ModifyRequest) error {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return err
-	}
-
-	for try := 0; try <= c.retries; try++ {
-		err = conn.Modify(m)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return err
-		}
-		c.logger.Debug().Msg("retrying LDAP Modify")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) PasswordModify(m *ldap.PasswordModifyRequest) (*ldap.PasswordModifyResult, error) {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return nil, err
-	}
-
-	var res *ldap.PasswordModifyResult
-	for try := 0; try <= c.retries; try++ {
-		res, err = conn.PasswordModify(m)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return res, err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return nil, err
-		}
-		c.logger.Debug().Msg("retrying LDAP Password Modify")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return nil, ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) ModifyDN(m *ldap.ModifyDNRequest) error {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return err
-	}
-
-	for try := 0; try <= c.retries; try++ {
-		err = conn.ModifyDN(m)
-		if !ldap.IsErrorWithCode(err, ldap.ErrorNetwork) {
-			// non network error, return it to the client
-			return err
-		}
-
-		c.logger.Debug().Msgf("Network Error. attempt %d", try)
-		conn, err = c.reconnect(conn)
-		if err != nil {
-			return err
-		}
-		c.logger.Debug().Msg("retrying LDAP ModifyDN")
-	}
-	// if we get here we reached the maximum retries. So return an error
-	return ldap.NewError(ldap.ErrorNetwork, errMaxRetries)
-}
-
-func (c ConnWithReconnect) GetConnection() (*ldap.Conn, error) {
-	conn := <-c.conn
-	if conn.Conn != nil && !ldap.IsErrorWithCode(conn.Error, ldap.ErrorNetwork) {
-		c.logger.Debug().Msg("using existing Connection")
-		return conn.Conn, conn.Error
-	}
-	return c.reconnect(conn.Conn)
-}
-
-func (c ConnWithReconnect) ldapAutoConnect(config Config) {
-	var (
-		l   *ldap.Conn
-		err error
-	)
-
-	for {
-		select {
-		case resConn := <-c.reset:
-			// Only close the connection and reconnect if the current
-			// connection, matches the one we got via the reset channel.
-			// If they differ we already reconnected
-			if l != nil && l == resConn {
-				c.logger.Debug().Msgf("closing connection %v", &l)
-				l.Close()
-			}
-			if l == resConn || l == nil {
-				c.logger.Debug().Msg("reconnecting to LDAP")
-				l, err = c.ldapConnect(config)
-			} else {
-				c.logger.Debug().Msg("already reconnected")
-			}
-		case c.conn <- ldapConnection{l, err}:
-		}
-	}
-}
-
-func (c ConnWithReconnect) ldapConnect(config Config) (*ldap.Conn, error) {
-	c.logger.Debug().Msgf("Connecting to %s", config.URI)
-
-	var err error
-	var l *ldap.Conn
-	if config.TLSConfig != nil {
-		l, err = ldap.DialURL(config.URI, ldap.DialWithTLSConfig(config.TLSConfig))
-	} else {
-		l, err = ldap.DialURL(config.URI)
-	}
-
-	if err != nil {
-		c.logger.Error().Err(err).Msg("could not get ldap Connection")
-	} else {
-		c.logger.Debug().Msg("LDAP Connected")
-		if config.BindDN != "" {
-			c.logger.Debug().Msgf("Binding as %s", config.BindDN)
-			err = l.Bind(config.BindDN, config.BindPassword)
-			if err != nil {
-				c.logger.Error().Err(err).Msg("Bind failed")
-				l.Close()
-				return nil, err
-			}
-
-		}
-	}
-
-	return l, err
-}
-
-func (c ConnWithReconnect) reconnect(resetConn *ldap.Conn) (*ldap.Conn, error) {
-	c.logger.Debug().Msg("LDAP connection reset")
-	c.reset <- resetConn
-	c.logger.Debug().Msg("Waiting for new connection")
-	result := <-c.conn
-	return result.Conn, result.Error
-}
-
-// Remaining methods to fulfill ldap.Client interface
-
-func (c ConnWithReconnect) Start() {}
-
-func (c ConnWithReconnect) StartTLS(*tls.Config) error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-// Close implements the ldap.Client interface
-func (c ConnWithReconnect) Close() (err error) {
-	conn, err := c.GetConnection()
-
-	if err != nil {
-		return err
-	}
-	return conn.Close()
-}
-
-// GetLastError implements the ldap.Client interface
-func (c ConnWithReconnect) GetLastError() error {
-	conn, err := c.GetConnection()
-
-	if err != nil {
-		return err
-	}
-	return conn.GetLastError()
-}
-
-func (c ConnWithReconnect) IsClosing() bool {
-	return false
-}
-
-func (c ConnWithReconnect) SetTimeout(time.Duration) {}
-
-func (c ConnWithReconnect) Bind(username, password string) error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-func (c ConnWithReconnect) UnauthenticatedBind(username string) error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-func (c ConnWithReconnect) SimpleBind(*ldap.SimpleBindRequest) (*ldap.SimpleBindResult, error) {
-	return nil, ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-func (c ConnWithReconnect) ExternalBind() error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-func (c ConnWithReconnect) ModifyWithResult(m *ldap.ModifyRequest) (*ldap.ModifyResult, error) {
-	conn, err := c.GetConnection()
-	if err != nil {
-		return nil, err
-	}
-
-	return conn.ModifyWithResult(m)
-}
-
-func (c ConnWithReconnect) Compare(dn, attribute, value string) (bool, error) {
-	return false, ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-func (c ConnWithReconnect) SearchWithPaging(searchRequest *ldap.SearchRequest, pagingSize uint32) (*ldap.SearchResult, error) {
-	return nil, ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-// SearchAsync implements the ldap.Client interface
-func (c ConnWithReconnect) SearchAsync(ctx context.Context, searchRequest *ldap.SearchRequest, bufferSize int) ldap.Response {
-	// unimplemented
-	return nil
-}
-
-// NTLMUnauthenticatedBind implements the ldap.Client interface
-func (c ConnWithReconnect) NTLMUnauthenticatedBind(domain, username string) error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-// TLSConnectionState implements the ldap.Client interface
-func (c ConnWithReconnect) TLSConnectionState() (tls.ConnectionState, bool) {
-	return tls.ConnectionState{}, false
-}
-
-// Unbind implements the ldap.Client interface
-func (c ConnWithReconnect) Unbind() error {
-	return ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-// DirSync implements the ldap.Client interface
-func (c ConnWithReconnect) DirSync(searchRequest *ldap.SearchRequest, flags, maxAttrCount int64, cookie []byte) (*ldap.SearchResult, error) {
-	return nil, ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}
-
-// DirSyncAsync implements the ldap.Client interface
-func (c ConnWithReconnect) DirSyncAsync(ctx context.Context, searchRequest *ldap.SearchRequest, bufferSize int, flags, maxAttrCount int64, cookie []byte) ldap.Response {
-	// unimplemented
-	return nil
-}
-
-// Syncrepl implements the ldap.Client interface
-func (c ConnWithReconnect) Syncrepl(ctx context.Context, searchRequest *ldap.SearchRequest, bufferSize int, mode ldap.ControlSyncRequestMode, cookie []byte, reloadHint bool) ldap.Response {
-	// unimplemented
-	return nil
-}
-
-// Extended implements the ldap.Client interface
-func (c ConnWithReconnect) Extended(_ *ldap.ExtendedRequest) (*ldap.ExtendedResponse, error) {
-	return nil, ldap.NewError(ldap.LDAPResultNotSupported, fmt.Errorf("not implemented"))
-}

services/graph/pkg/server/http/server.go

@@ -8,6 +8,7 @@ import (
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
 	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata"
 	"github.com/pkg/errors"
 	"go-micro.dev/v4"
 	"go-micro.dev/v4/events"
@@ -128,9 +129,21 @@ func Server(opts ...Option) (http.Service, error) {
 
 	hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
 
+	storage, err := metadata.NewCS3Storage(
+		options.Config.Metadata.GatewayAddress,
+		options.Config.Metadata.StorageAddress,
+		options.Config.Metadata.SystemUserID,
+		options.Config.Metadata.SystemUserIDP,
+		options.Config.Metadata.SystemUserAPIKey,
+	)
+	if err != nil {
+		return http.Service{}, fmt.Errorf("could not initialize metadata storage: %w", err)
+	}
+
 	var handle svc.Service
 	handle, err = svc.NewService(
 		svc.Context(options.Context),
+		svc.MetadataStorage(storage),
 		svc.Logger(options.Logger),
 		svc.Config(options.Config),
 		svc.Middleware(middlewares...),

services/graph/pkg/service/v0/api_driveitem_permissions.go

@@ -6,7 +6,9 @@ import (
 	"net/http"
 	"net/url"
 	"slices"
+	"strings"
 
+	"github.com/CiscoM31/godata"
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	grouppb "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
@@ -40,16 +42,17 @@ import (
 )
 
 const (
-	invalidIdMsg       = "invalid driveID or itemID"
-	parseDriveIDErrMsg = "could not parse driveID"
+	invalidIdMsg              = "invalid driveID or itemID"
+	parseDriveIDErrMsg        = "could not parse driveID"
+	federatedRolesODataFilter = "@libre.graph.permissions.roles.allowedValues/rolePermissions/any(p:contains(p/condition, '@Subject.UserType==\"Federated\"'))"
 )
 
 // DriveItemPermissionsProvider contains the methods related to handling permissions on drive items
 type DriveItemPermissionsProvider interface {
 	Invite(ctx context.Context, resourceId *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error)
 	SpaceRootInvite(ctx context.Context, driveID *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error)
-	ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
-	ListSpaceRootPermissions(ctx context.Context, driveID *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
+	ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles bool, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
+	ListSpaceRootPermissions(ctx context.Context, driveID *storageprovider.ResourceId, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
 	DeletePermission(ctx context.Context, itemID *storageprovider.ResourceId, permissionID string) error
 	DeleteSpaceRootPermission(ctx context.Context, driveID *storageprovider.ResourceId, permissionID string) error
 	UpdatePermission(ctx context.Context, itemID *storageprovider.ResourceId, permissionID string, newPermission libregraph.Permission) (libregraph.Permission, error)
@@ -341,7 +344,7 @@ func (s DriveItemPermissionsService) SpaceRootInvite(ctx context.Context, driveI
 }
 
 // ListPermissions lists the permissions of a driveItem
-func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles bool, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
 	collectionOfPermissions := libregraph.CollectionOfPermissionsWithAllowedValues{}
 	gatewayClient, err := s.gatewaySelector.Next()
 	if err != nil {
@@ -362,9 +365,14 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 	permissionSet := statResponse.GetInfo().GetPermissionSet()
 	allowedActions := unifiedrole.CS3ResourcePermissionsToLibregraphActions(permissionSet)
 
-	collectionOfPermissions = libregraph.CollectionOfPermissionsWithAllowedValues{
-		LibreGraphPermissionsActionsAllowedValues: allowedActions,
-		LibreGraphPermissionsRolesAllowedValues: conversions.ToValueSlice(
+	collectionOfPermissions = libregraph.CollectionOfPermissionsWithAllowedValues{}
+
+	if _, ok := selectedAttrs["@libre.graph.permissions.actions.allowedValues"]; ok || len(selectedAttrs) == 0 {
+		collectionOfPermissions.LibreGraphPermissionsActionsAllowedValues = allowedActions
+	}
+
+	if _, ok := selectedAttrs["@libre.graph.permissions.roles.allowedValues"]; ok || len(selectedAttrs) == 0 {
+		collectionOfPermissions.LibreGraphPermissionsRolesAllowedValues = conversions.ToValueSlice(
 			unifiedrole.GetRolesByPermissions(
 				unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(s.config.UnifiedRoles.AvailableRoles...)),
 				allowedActions,
@@ -372,7 +380,7 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 				listFederatedRoles,
 				false,
 			),
-		),
+		)
 	}
 
 	for i, definition := range collectionOfPermissions.LibreGraphPermissionsRolesAllowedValues {
@@ -381,10 +389,8 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 		collectionOfPermissions.LibreGraphPermissionsRolesAllowedValues[i] = definition
 	}
 
-	if selectRoles {
-		// drop the actions
-		collectionOfPermissions.LibreGraphPermissionsActionsAllowedValues = nil
-		// no need to fetch shares, we are only interested in the roles
+	if len(selectedAttrs) > 0 {
+		// no need to fetch shares, we are only interested allowedActions and/or allowedRoles
 		return collectionOfPermissions, nil
 	}
 
@@ -438,7 +444,7 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 }
 
 // ListSpaceRootPermissions handles ListPermissions request on project spaces
-func (s DriveItemPermissionsService) ListSpaceRootPermissions(ctx context.Context, driveID *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+func (s DriveItemPermissionsService) ListSpaceRootPermissions(ctx context.Context, driveID *storageprovider.ResourceId, selectedAttrs map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
 	collectionOfPermissions := libregraph.CollectionOfPermissionsWithAllowedValues{}
 	gatewayClient, err := s.gatewaySelector.Next()
 	if err != nil {
@@ -456,7 +462,7 @@ func (s DriveItemPermissionsService) ListSpaceRootPermissions(ctx context.Contex
 	}
 
 	rootResourceID := space.GetRoot()
-	return s.ListPermissions(ctx, rootResourceID, false, false) // federated roles are not supported for spaces
+	return s.ListPermissions(ctx, rootResourceID, false, selectedAttrs) // federated roles are not supported for spaces
 }
 
 // DeletePermission deletes a permission from a drive item
@@ -701,14 +707,26 @@ func (api DriveItemPermissionsApi) ListPermissions(w http.ResponseWriter, r *htt
 		return
 	}
 
-	var listFederatedRoles bool
-	if GetFilterParam(r) == "@libre.graph.permissions.roles.allowedValues/rolePermissions/any(p:contains(p/condition, '@Subject.UserType==\"Federated\"'))" {
-		listFederatedRoles = true
+	sanitizedPath := strings.TrimPrefix(r.URL.Path, "/graph/v1.0/")
+	odataReq, err := godata.ParseRequest(r.Context(), sanitizedPath, r.URL.Query())
+	if err != nil {
+		api.logger.Debug().Err(err).Interface("query", r.URL.Query()).Msg("Error parsing ListPermissionRequest: query error")
+		errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, err.Error())
+		return
 	}
 
-	var selectRoles bool
-	if GetSelectParam(r) == "@libre.graph.permissions.roles.allowedValues" {
-		selectRoles = true
+	var listFederatedRoles bool
+	if odataReq.Query.Filter != nil {
+		if odataReq.Query.Filter.RawValue == federatedRolesODataFilter {
+			listFederatedRoles = true
+		}
+	}
+
+	selectRoles, err := api.listPermissionsQuerySelectValues(odataReq.Query)
+	if err != nil {
+		api.logger.Debug().Err(err).Interface("query", r.URL.Query()).Msg("Error parsing ListPermissionRequest: query error")
+		errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, err.Error())
+		return
 	}
 
 	ctx := r.Context()
@@ -746,8 +764,23 @@ func (api DriveItemPermissionsApi) ListSpaceRootPermissions(w http.ResponseWrite
 		return
 	}
 
+	sanitizedPath := strings.TrimPrefix(r.URL.Path, "/graph/v1.0/")
+	odataReq, err := godata.ParseRequest(r.Context(), sanitizedPath, r.URL.Query())
+	if err != nil {
+		api.logger.Debug().Err(err).Interface("query", r.URL.Query()).Msg("Error parsing ListPermissionRequest: query error")
+		errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	selected, err := api.listPermissionsQuerySelectValues(odataReq.Query)
+	if err != nil {
+		api.logger.Debug().Err(err).Interface("query", r.URL.Query()).Msg("Error parsing ListPermissionRequest: query error")
+		errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, err.Error())
+		return
+	}
+
 	ctx := r.Context()
-	permissions, err := api.driveItemPermissionsService.ListSpaceRootPermissions(ctx, &driveID)
+	permissions, err := api.driveItemPermissionsService.ListSpaceRootPermissions(ctx, &driveID, selected)
 
 	if err != nil {
 		errorcode.RenderError(w, r, err)
@@ -903,3 +936,19 @@ func (api DriveItemPermissionsApi) UpdateSpaceRootPermission(w http.ResponseWrit
 	render.Status(r, http.StatusOK)
 	render.JSON(w, r, &updatedPermission)
 }
+
+func (api DriveItemPermissionsApi) listPermissionsQuerySelectValues(odataQuery *godata.GoDataQuery) (map[string]struct{}, error) {
+	selectedAttrs := map[string]struct{}{}
+	if odataQuery.Select != nil {
+		for _, item := range odataQuery.Select.SelectItems {
+			// for now we only support a limitted set of $select attributes
+			if item.Segments[0].Value == "@libre.graph.permissions.roles.allowedValues" || item.Segments[0].Value == "@libre.graph.permissions.actions.allowedValues" {
+				selectedAttrs[item.Segments[0].Value] = struct{}{}
+			} else {
+				api.logger.Debug().Msg("Error parsing ListPermissionRequest: unsupported select item")
+				return selectedAttrs, errorcode.New(errorcode.InvalidRequest, "unsupported select item")
+			}
+		}
+	}
+	return selectedAttrs, nil
+}

services/graph/pkg/service/v0/api_driveitem_permissions_test.go

@@ -20,8 +20,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/stretchr/testify/mock"
 	"github.com/tidwall/gjson"
 	"google.golang.org/grpc"
@@ -385,7 +385,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, false)
+			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, map[string]struct{}{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -433,7 +433,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, false)
+			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, map[string]struct{}{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -472,7 +472,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := service.ListPermissions(context.Background(), itemID, false, false)
+			permissions, err := service.ListPermissions(context.Background(), itemID, false, map[string]struct{}{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -508,7 +508,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, false)
+			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, map[string]struct{}{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -555,7 +555,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
 			statResponse.Info.Id = listSpacesResponse.StorageSpaces[0].Root
 			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
-			permissions, err := driveItemPermissionsService.ListSpaceRootPermissions(context.Background(), driveId)
+			permissions, err := driveItemPermissionsService.ListSpaceRootPermissions(context.Background(), driveId, map[string]struct{}{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 		})
@@ -1268,7 +1268,7 @@ var _ = Describe("DriveItemPermissionsApi", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			mockProvider.On("ListPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).
-				Return(func(ctx context.Context, itemid *provider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+				Return(func(ctx context.Context, itemid *provider.ResourceId, listFederatedRoles bool, selected map[string]struct{}) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
 					Expect(listFederatedRoles).To(Equal(false))
 					Expect(storagespace.FormatResourceID(itemid)).To(Equal("1$2!3"))
 					return libregraph.CollectionOfPermissionsWithAllowedValues{}, nil

services/graph/pkg/service/v0/api_users_user_profile_photo.go

@@ -0,0 +1,166 @@
+package svc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/render"
+	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
+)
+
+type (
+	// UsersUserProfilePhotoProvider is the interface that defines the methods for the user profile photo service
+	UsersUserProfilePhotoProvider interface {
+		// GetPhoto retrieves the requested photo
+		GetPhoto(ctx context.Context, id string) ([]byte, error)
+
+		// UpdatePhoto retrieves the requested photo
+		UpdatePhoto(ctx context.Context, id string, r io.Reader) error
+
+		// DeletePhoto deletes the requested photo
+		DeletePhoto(ctx context.Context, id string) error
+	}
+)
+
+var (
+	// profilePhotoSpaceID is the space ID for the profile photo
+	profilePhotoSpaceID = "f2bdd61a-da7c-49fc-8203-0558109d1b4f"
+
+	// ErrNoBytes is returned when no bytes are found
+	ErrNoBytes = errors.New("no bytes")
+
+	// ErrInvalidContentType is returned when the content type is invalid
+	ErrInvalidContentType = errors.New("invalid content type")
+
+	// ErrMissingArgument is returned when a required argument is missing
+	ErrMissingArgument = errors.New("required argument is missing")
+)
+
+// UsersUserProfilePhotoService is the implementation of the UsersUserProfilePhotoProvider interface
+type UsersUserProfilePhotoService struct {
+	storage metadata.Storage
+}
+
+// NewUsersUserProfilePhotoService creates a new UsersUserProfilePhotoService
+func NewUsersUserProfilePhotoService(storage metadata.Storage) (UsersUserProfilePhotoService, error) {
+	if err := storage.Init(context.Background(), profilePhotoSpaceID); err != nil {
+		return UsersUserProfilePhotoService{}, err
+	}
+
+	return UsersUserProfilePhotoService{
+		storage: storage,
+	}, nil
+}
+
+// GetPhoto retrieves the requested photo
+func (s UsersUserProfilePhotoService) GetPhoto(ctx context.Context, id string) ([]byte, error) {
+	return s.storage.SimpleDownload(ctx, id)
+}
+
+// DeletePhoto deletes the requested photo
+func (s UsersUserProfilePhotoService) DeletePhoto(ctx context.Context, id string) error {
+	return s.storage.Delete(ctx, id)
+}
+
+// UpdatePhoto updates the requested photo
+func (s UsersUserProfilePhotoService) UpdatePhoto(ctx context.Context, id string, r io.Reader) error {
+	if id == "" {
+		return fmt.Errorf("%w: %s", ErrMissingArgument, "id")
+	}
+
+	photo, err := io.ReadAll(r)
+	if err != nil {
+		return err
+	}
+
+	if len(photo) == 0 {
+		return ErrNoBytes
+	}
+
+	contentType := http.DetectContentType(photo)
+	if !strings.HasPrefix(contentType, "image/") {
+		return fmt.Errorf("%w: %s", ErrInvalidContentType, contentType)
+	}
+
+	return s.storage.SimpleUpload(ctx, id, photo)
+}
+
+// UsersUserProfilePhotoApi contains all photo related api endpoints
+type UsersUserProfilePhotoApi struct {
+	logger                       log.Logger
+	usersUserProfilePhotoService UsersUserProfilePhotoProvider
+}
+
+// NewUsersUserProfilePhotoApi creates a new UsersUserProfilePhotoApi
+func NewUsersUserProfilePhotoApi(usersUserProfilePhotoService UsersUserProfilePhotoProvider, logger log.Logger) (UsersUserProfilePhotoApi, error) {
+	return UsersUserProfilePhotoApi{
+		logger:                       log.Logger{Logger: logger.With().Str("graph api", "UsersUserProfilePhotoApi").Logger()},
+		usersUserProfilePhotoService: usersUserProfilePhotoService,
+	}, nil
+}
+
+// GetProfilePhoto creates a handler which renders the corresponding photo
+func (api UsersUserProfilePhotoApi) GetProfilePhoto(h HTTPDataHandler[string]) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		v, ok := h(w, r)
+		if !ok {
+			return
+		}
+
+		photo, err := api.usersUserProfilePhotoService.GetPhoto(r.Context(), v)
+		if err != nil {
+			api.logger.Debug().Err(err)
+			errorcode.GeneralException.Render(w, r, http.StatusNotFound, "failed to get photo")
+			return
+		}
+
+		render.Status(r, http.StatusOK)
+		_, _ = w.Write(photo)
+	}
+}
+
+// UpsertProfilePhoto creates a handler which updates or creates the corresponding photo
+func (api UsersUserProfilePhotoApi) UpsertProfilePhoto(h HTTPDataHandler[string]) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		v, ok := h(w, r)
+		if !ok {
+			return
+		}
+
+		if err := api.usersUserProfilePhotoService.UpdatePhoto(r.Context(), v, r.Body); err != nil {
+			api.logger.Debug().Err(err)
+			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "failed to update photo")
+			return
+		}
+		defer func() {
+			_ = r.Body.Close()
+		}()
+
+		render.Status(r, http.StatusOK)
+	}
+}
+
+// DeleteProfilePhoto creates a handler which deletes the corresponding photo
+func (api UsersUserProfilePhotoApi) DeleteProfilePhoto(h HTTPDataHandler[string]) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		v, ok := h(w, r)
+		if !ok {
+			return
+		}
+
+		if err := api.usersUserProfilePhotoService.DeletePhoto(r.Context(), v); err != nil {
+			api.logger.Debug().Err(err)
+			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "failed to delete photo")
+			return
+		}
+
+		render.Status(r, http.StatusOK)
+	}
+}

services/graph/pkg/service/v0/api_users_user_profile_photo_test.go

@@ -0,0 +1,144 @@
+package svc_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/graph/mocks"
+	svc "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
+)
+
+func TestNewUsersUserProfilePhotoService(t *testing.T) {
+	storage := mocks.NewStorage(t)
+	storage.EXPECT().Init(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, id string) error { return nil })
+
+	service, err := svc.NewUsersUserProfilePhotoService(storage)
+	assert.NoError(t, err)
+
+	t.Run("UpdatePhoto", func(t *testing.T) {
+		t.Run("reports an error if id is empty", func(t *testing.T) {
+			err := service.UpdatePhoto(context.Background(), "", bytes.NewReader([]byte{}))
+			assert.ErrorIs(t, err, svc.ErrMissingArgument)
+		})
+
+		t.Run("reports an error if the reader does not contain any bytes", func(t *testing.T) {
+			err := service.UpdatePhoto(context.Background(), "123", bytes.NewReader([]byte{}))
+			assert.ErrorIs(t, err, svc.ErrNoBytes)
+		})
+
+		t.Run("reports an error if data is not an image", func(t *testing.T) {
+			err := service.UpdatePhoto(context.Background(), "234", bytes.NewReader([]byte("not an image")))
+			assert.ErrorIs(t, err, svc.ErrInvalidContentType)
+		})
+	})
+}
+
+func TestUsersUserProfilePhotoApi(t *testing.T) {
+	var (
+		serviceProvider = mocks.NewUsersUserProfilePhotoProvider(t)
+		dataProvider    = func(w http.ResponseWriter, r *http.Request) (string, bool) {
+			return "123", true
+		}
+	)
+
+	api, err := svc.NewUsersUserProfilePhotoApi(serviceProvider, log.NopLogger())
+	assert.NoError(t, err)
+
+	t.Run("GetProfilePhoto", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		ep := api.GetProfilePhoto(dataProvider)
+
+		t.Run("fails if photo provider errors", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().GetPhoto(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string) ([]byte, error) {
+				return nil, errors.New("any")
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusNotFound, w.Code)
+		})
+
+		t.Run("successfully returns the requested photo", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().GetPhoto(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string) ([]byte, error) {
+				return []byte("photo"), nil
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusOK, w.Code)
+			assert.Equal(t, "photo", w.Body.String())
+		})
+	})
+
+	t.Run("DeleteProfilePhoto", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/", nil)
+		ep := api.DeleteProfilePhoto(dataProvider)
+
+		t.Run("fails if photo provider errors", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().DeletePhoto(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string) error {
+				return errors.New("any")
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusInternalServerError, w.Code)
+		})
+
+		t.Run("successfully deletes the requested photo", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().DeletePhoto(mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string) error {
+				return nil
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusOK, w.Code)
+		})
+	})
+
+	t.Run("UpsertProfilePhoto", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodPut, "/", strings.NewReader("body"))
+		ep := api.UpsertProfilePhoto(dataProvider)
+
+		t.Run("fails if photo provider errors", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().UpdatePhoto(mock.Anything, mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string, r io.Reader) error {
+				return errors.New("any")
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusInternalServerError, w.Code)
+		})
+
+		t.Run("successfully upserts the photo", func(t *testing.T) {
+			w := httptest.NewRecorder()
+
+			serviceProvider.EXPECT().UpdatePhoto(mock.Anything, mock.Anything, mock.Anything).RunAndReturn(func(ctx context.Context, s string, r io.Reader) error {
+				return nil
+			}).Once()
+
+			ep.ServeHTTP(w, r)
+
+			assert.Equal(t, http.StatusOK, w.Code)
+		})
+	})
+}

services/graph/pkg/service/v0/application_test.go

@@ -11,6 +11,12 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	settingsmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/settings/v0"
 	settings "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
@@ -19,11 +25,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 type applicationList struct {
@@ -70,13 +71,19 @@ var _ = Describe("Applications", func() {
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 		cfg.Application.ID = "some-application-ID"
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 			service.WithRoleService(roleService),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("ListApplications", func() {

services/graph/pkg/service/v0/approleassignments_test.go

@@ -14,6 +14,13 @@ import (
 	"github.com/golang/protobuf/ptypes/empty"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	settingsmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/settings/v0"
 	settings "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
@@ -22,12 +29,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 type assignmentList struct {
@@ -80,13 +81,19 @@ var _ = Describe("AppRoleAssignments", func() {
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 		cfg.Application.ID = "some-application-ID"
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 			service.WithRoleService(roleService),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("ListAppRoleAssignments", func() {

services/graph/pkg/service/v0/data.go

@@ -0,0 +1,42 @@
+package svc
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/go-chi/chi/v5"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
+)
+
+// HTTPDataHandler returns data from the request, it should exit early and return false in the case of any error
+type HTTPDataHandler[T any] func(w http.ResponseWriter, r *http.Request) (T, bool)
+
+var (
+	// ErrNoUser is returned when no user is found
+	ErrNoUser = errors.New("no user found")
+)
+
+// GetUserIDFromCTX extracts the user from the request
+func GetUserIDFromCTX(w http.ResponseWriter, r *http.Request) (string, bool) {
+	u, ok := revactx.ContextGetUser(r.Context())
+	if !ok {
+		errorcode.GeneralException.Render(w, r, http.StatusMethodNotAllowed, ErrNoUser.Error())
+	}
+
+	return u.GetId().GetOpaqueId(), ok
+}
+
+func GetSlugValue(key string) HTTPDataHandler[string] {
+	return func(w http.ResponseWriter, r *http.Request) (string, bool) {
+		v, err := url.PathUnescape(chi.URLParam(r, key))
+		if err != nil {
+			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, fmt.Sprintf(`failed to get slug: "%s"`, key))
+		}
+
+		return v, err == nil
+	}
+}

services/graph/pkg/service/v0/driveitems_test.go

@@ -85,12 +85,18 @@ var _ = Describe("Driveitems", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("GetRootDriveChildren", func() {

services/graph/pkg/service/v0/educationclasses_test.go

@@ -14,6 +14,13 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	"github.com/opencloud-eu/opencloud/services/graph/mocks"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
@@ -21,12 +28,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 var _ = Describe("EducationClass", func() {
@@ -78,13 +79,19 @@ var _ = Describe("EducationClass", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 			service.WithIdentityEducationBackend(identityEducationBackend),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("GetEducationClasses", func() {
@@ -326,13 +333,19 @@ var _ = Describe("EducationClass", func() {
 				Expect(err).ToNot(HaveOccurred())
 
 				cfg.API.GroupMembersPatchLimit = 21
-				svc, _ = service.NewService(
+
+				mds := mocks.NewStorage(GinkgoT())
+				mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+				svc, err = service.NewService(
 					service.Config(cfg),
+					service.MetadataStorage(mds),
 					service.WithGatewaySelector(gatewaySelector),
 					service.EventsPublisher(&eventsPublisher),
 					service.WithIdentityBackend(identityBackend),
 					service.WithIdentityEducationBackend(identityEducationBackend),
 				)
+				Expect(err).ToNot(HaveOccurred())
 
 				r := httptest.NewRequest(http.MethodPatch, "/graph/v1.0/education/classes", bytes.NewBuffer(updatedClassJson))
 				rctx := chi.NewRouteContext()

services/graph/pkg/service/v0/educationschools_test.go

@@ -21,13 +21,15 @@ import (
 	"github.com/stretchr/testify/mock"
 	"google.golang.org/grpc"
 
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
+	"github.com/opencloud-eu/opencloud/services/graph/mocks"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 )
 
 type schoolList struct {
@@ -78,11 +80,17 @@ var _ = Describe("Schools", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.WithIdentityEducationBackend(identityEducationBackend),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("GetEducationSchools", func() {

services/graph/pkg/service/v0/educationuser_test.go

@@ -15,6 +15,14 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/graph/mocks"
@@ -22,13 +30,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 type educationUserList struct {
@@ -80,13 +81,19 @@ var _ = Describe("EducationUsers", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityEducationBackend(identityEducationBackend),
 			service.WithRoleService(roleService),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("GetEducationUsers", func() {

services/graph/pkg/service/v0/graph_test.go

@@ -17,13 +17,13 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/reva/v2/pkg/conversions"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/mock"
 	"github.com/tidwall/gjson"
@@ -80,12 +80,19 @@ var _ = Describe("Graph", func() {
 
 		eventsPublisher = mocks.Publisher{}
 		permissionService = mocks.Permissions{}
-		svc, _ = service.NewService(
+
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.PermissionService(&permissionService),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("NewService", func() {

services/graph/pkg/service/v0/groups_test.go

@@ -14,6 +14,13 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	settingsmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/settings/v0"
 	settings "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
@@ -23,12 +30,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 type groupList struct {
@@ -84,13 +85,19 @@ var _ = Describe("Groups", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 			service.PermissionService(permissionService),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("GetGroups", func() {
@@ -410,13 +417,18 @@ var _ = Describe("Groups", func() {
 				updatedGroupJson, err := json.Marshal(updatedGroup)
 				Expect(err).ToNot(HaveOccurred())
 
+				mds := mocks.NewStorage(GinkgoT())
+				mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
 				cfg.API.GroupMembersPatchLimit = 21
-				svc, _ = service.NewService(
+				svc, err = service.NewService(
 					service.Config(cfg),
+					service.MetadataStorage(mds),
 					service.WithGatewaySelector(gatewaySelector),
 					service.EventsPublisher(&eventsPublisher),
 					service.WithIdentityBackend(identityBackend),
 				)
+				Expect(err).ToNot(HaveOccurred())
 
 				r := httptest.NewRequest(http.MethodPatch, "/graph/v1.0/groups", bytes.NewBuffer(updatedGroupJson))
 				rctx := chi.NewRouteContext()

services/graph/pkg/service/v0/option.go

@@ -5,6 +5,11 @@ import (
 	"net/http"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/metadata"
+	"go.opentelemetry.io/otel/trace"
+
 	"github.com/opencloud-eu/opencloud/pkg/keycloak"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/roles"
@@ -13,9 +18,6 @@ import (
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"go.opentelemetry.io/otel/trace"
 )
 
 // Option defines a single option function.
@@ -41,6 +43,7 @@ type Options struct {
 	KeycloakClient           keycloak.Client
 	EventHistoryClient       ehsvc.EventHistoryService
 	TraceProvider            trace.TracerProvider
+	Storage                  metadata.Storage
 }
 
 // newOptions initializes the available default options.
@@ -179,3 +182,10 @@ func TraceProvider(val trace.TracerProvider) Option {
 		o.TraceProvider = val
 	}
 }
+
+// MetadataStorage provides a function to set the MetadataStorage option.
+func MetadataStorage(ms metadata.Storage) Option {
+	return func(o *Options) {
+		o.Storage = ms
+	}
+}

services/graph/pkg/service/v0/password_test.go

@@ -13,6 +13,14 @@ import (
 	"github.com/go-ldap/ldap/v3"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	"github.com/opencloud-eu/opencloud/services/graph/mocks"
@@ -21,13 +29,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 var _ = Describe("Users changing their own password", func() {
@@ -74,17 +75,25 @@ var _ = Describe("Users changing their own password", func() {
 			GroupIDAttribute:         "openCloudUUID",
 			GroupSearchScope:         "sub",
 		}
-		loggger := log.NewLogger()
-		identityBackend, err = identity.NewLDAPBackend(ldapClient, ldapConfig, &loggger)
+		logger := log.NewLogger()
+		identityBackend, err = identity.NewLDAPBackend(ldapClient, ldapConfig, &logger)
 		Expect(err).To(BeNil())
 
 		eventsPublisher = mocks.Publisher{}
-		svc, _ = service.NewService(
+
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.WithIdentityBackend(identityBackend),
 			service.EventsPublisher(&eventsPublisher),
 		)
+		Expect(err).ToNot(HaveOccurred())
+
 		user = &userv1beta1.User{
 			Id: &userv1beta1.UserId{
 				OpaqueId: "user",

services/graph/pkg/service/v0/service.go

@@ -17,11 +17,6 @@ import (
 	"github.com/jellydator/ttlcache/v3"
 	microstore "go-micro.dev/v4/store"
 
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/store"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-
 	ocldap "github.com/opencloud-eu/opencloud/pkg/ldap"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/registry"
@@ -29,9 +24,13 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/service/grpc"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/ldap"
 	graphm "github.com/opencloud-eu/opencloud/services/graph/pkg/middleware"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/store"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
 )
 
 const (
@@ -143,14 +142,46 @@ func NewService(opts ...Option) (Graph, error) { //nolint:maintidx
 		identity.IdentityCacheWithGroupsTTL(time.Duration(options.Config.Spaces.GroupsCacheTTL)),
 	)
 
+	baseGraphService := BaseGraphService{
+		logger:          &options.Logger,
+		identityCache:   identityCache,
+		gatewaySelector: options.GatewaySelector,
+		config:          options.Config,
+		availableRoles:  unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(options.Config.UnifiedRoles.AvailableRoles...)),
+	}
+
+	drivesDriveItemService, err := NewDrivesDriveItemService(options.Logger, options.GatewaySelector)
+	if err != nil {
+		return Graph{}, err
+	}
+
+	drivesDriveItemApi, err := NewDrivesDriveItemApi(drivesDriveItemService, baseGraphService, options.Logger)
+	if err != nil {
+		return Graph{}, err
+	}
+
+	driveItemPermissionsService, err := NewDriveItemPermissionsService(options.Logger, options.GatewaySelector, identityCache, options.Config)
+	if err != nil {
+		return Graph{}, err
+	}
+
+	driveItemPermissionsApi, err := NewDriveItemPermissionsApi(driveItemPermissionsService, options.Logger, options.Config)
+	if err != nil {
+		return Graph{}, err
+	}
+
+	usersUserProfilePhotoService, err := NewUsersUserProfilePhotoService(options.Storage)
+	if err != nil {
+		return Graph{}, err
+	}
+
+	usersUserProfilePhotoApi, err := NewUsersUserProfilePhotoApi(usersUserProfilePhotoService, options.Logger)
+	if err != nil {
+		return Graph{}, err
+	}
+
 	svc := Graph{
-		BaseGraphService: BaseGraphService{
-			logger:          &options.Logger,
-			identityCache:   identityCache,
-			gatewaySelector: options.GatewaySelector,
-			config:          options.Config,
-			availableRoles:  unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(options.Config.UnifiedRoles.AvailableRoles...)),
-		},
+		BaseGraphService:         baseGraphService,
 		mux:                      m,
 		specialDriveItemsCache:   spacePropertiesCache,
 		eventsPublisher:          options.EventsPublisher,
@@ -205,26 +236,6 @@ func NewService(opts ...Option) (Graph, error) { //nolint:maintidx
 		requireAdmin = options.RequireAdminMiddleware
 	}
 
-	drivesDriveItemService, err := NewDrivesDriveItemService(options.Logger, options.GatewaySelector)
-	if err != nil {
-		return svc, err
-	}
-
-	drivesDriveItemApi, err := NewDrivesDriveItemApi(drivesDriveItemService, svc.BaseGraphService, options.Logger)
-	if err != nil {
-		return svc, err
-	}
-
-	driveItemPermissionsService, err := NewDriveItemPermissionsService(options.Logger, options.GatewaySelector, identityCache, options.Config)
-	if err != nil {
-		return svc, err
-	}
-
-	driveItemPermissionsApi, err := NewDriveItemPermissionsApi(driveItemPermissionsService, options.Logger, options.Config)
-	if err != nil {
-		return svc, err
-	}
-
 	m.Route(options.Config.HTTP.Root, func(r chi.Router) {
 		r.Use(middleware.StripSlashes)
 
@@ -293,6 +304,12 @@ func NewService(opts ...Option) (Graph, error) { //nolint:maintidx
 				})
 				r.Get("/drives", svc.GetDrives(APIVersion_1))
 				r.Post("/changePassword", svc.ChangeOwnPassword)
+				r.Route("/photo/$value", func(r chi.Router) {
+					r.Get("/", usersUserProfilePhotoApi.GetProfilePhoto(GetUserIDFromCTX))
+					r.Put("/", usersUserProfilePhotoApi.UpsertProfilePhoto(GetUserIDFromCTX))
+					r.Patch("/", usersUserProfilePhotoApi.UpsertProfilePhoto(GetUserIDFromCTX))
+					r.Delete("/", usersUserProfilePhotoApi.DeleteProfilePhoto(GetUserIDFromCTX))
+				})
 			})
 			r.Route("/users", func(r chi.Router) {
 				r.Get("/", svc.GetUsers)
@@ -301,6 +318,9 @@ func NewService(opts ...Option) (Graph, error) { //nolint:maintidx
 					r.Get("/", svc.GetUser)
 					r.Get("/drive", svc.GetUserDrive)
 					r.Post("/exportPersonalData", svc.ExportPersonalData)
+					r.Route("/photo/$value", func(r chi.Router) {
+						r.Get("/", usersUserProfilePhotoApi.GetProfilePhoto(GetSlugValue("userID")))
+					})
 					r.With(requireAdmin).Delete("/", svc.DeleteUser)
 					r.With(requireAdmin).Patch("/", svc.PatchUser)
 					if svc.roleService != nil {
@@ -461,7 +481,7 @@ func setIdentityBackends(options Options, svc *Graph) error {
 				tlsConf.RootCAs = certs
 			}
 
-			conn := ldap.NewLDAPWithReconnect(&options.Logger,
+			conn := ldap.NewLDAPWithReconnect(
 				ldap.Config{
 					URI:          options.Config.Identity.LDAP.URI,
 					BindDN:       options.Config.Identity.LDAP.BindDN,
@@ -469,6 +489,7 @@ func setIdentityBackends(options Options, svc *Graph) error {
 					TLSConfig:    tlsConf,
 				},
 			)
+			conn.SetLogger(&options.Logger.Logger)
 			lb, err := identity.NewLDAPBackend(conn, options.Config.Identity.LDAP, &options.Logger)
 			if err != nil {
 				options.Logger.Error().Err(err).Msg("Error initializing LDAP Backend")

services/graph/pkg/service/v0/sharedbyme_test.go

@@ -17,6 +17,16 @@ import (
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/conversions"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/grpc"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	"github.com/opencloud-eu/opencloud/services/graph/mocks"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
@@ -25,15 +35,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/linktype"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
-	"github.com/opencloud-eu/reva/v2/pkg/conversions"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/stretchr/testify/mock"
-	"google.golang.org/grpc"
 )
 
 var _ = Describe("sharedbyme", func() {
@@ -245,12 +246,17 @@ var _ = Describe("sharedbyme", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.EventsPublisher(&eventsPublisher),
 			service.WithIdentityBackend(identityBackend),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	emptyListPublicSharesMock := func() {

services/graph/pkg/service/v0/sharedwithme_test.go

@@ -26,13 +26,15 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/proto"
 
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+
 	"github.com/opencloud-eu/opencloud/pkg/shared"
+	"github.com/opencloud-eu/opencloud/services/graph/mocks"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	identitymocks "github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
 	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	// "github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
 )
 
@@ -69,11 +71,17 @@ var _ = Describe("SharedWithMe", func() {
 		cfg.Commons = &shared.Commons{}
 		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
 
-		svc, _ = service.NewService(
+		mds := mocks.NewStorage(GinkgoT())
+		mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+		var err error
+		svc, err = service.NewService(
 			service.Config(cfg),
+			service.MetadataStorage(mds),
 			service.WithGatewaySelector(gatewaySelector),
 			service.WithIdentityBackend(identityBackend),
 		)
+		Expect(err).ToNot(HaveOccurred())
 	})
 
 	Describe("ListSharedWithMe", func() {

services/graph/pkg/service/v0/users.go

@@ -557,8 +557,9 @@ func (g Graph) GetUser(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-
-	if !g.config.API.ShowUserEmailInResults {
+	
+	ctxHasFullPerms := g.contextUserHasFullAccountPerms(r.Context())
+	if !ctxHasFullPerms && !g.config.API.ShowUserEmailInResults {
 		user.Mail = nil
 	}
 

services/graph/pkg/service/v0/users_test.go

@@ -17,11 +17,11 @@ import (
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/stretchr/testify/mock"
 	"go-micro.dev/v4/client"
 	"google.golang.org/grpc"
@@ -95,8 +95,13 @@ var _ = Describe("Users", func() {
 
 	When("OCM is disabled", func() {
 		BeforeEach(func() {
-			svc, _ = service.NewService(
+			mds := mocks.NewStorage(GinkgoT())
+			mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+			var err error
+			svc, err = service.NewService(
 				service.Config(cfg),
+				service.MetadataStorage(mds),
 				service.WithGatewaySelector(gatewaySelector),
 				service.EventsPublisher(&eventsPublisher),
 				service.WithIdentityBackend(identityBackend),
@@ -104,6 +109,7 @@ var _ = Describe("Users", func() {
 				service.WithValueService(valueService),
 				service.PermissionService(permissionService),
 			)
+			Expect(err).ToNot(HaveOccurred())
 		})
 
 		Describe("GetMe", func() {
@@ -581,6 +587,7 @@ var _ = Describe("Users", func() {
 				user := &libregraph.User{}
 				user.SetId("user1")
 
+				permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(user, nil)
 				valueService.On("GetValueByUniqueIdentifiers", mock.Anything, mock.Anything, mock.Anything).
 					Return(&settings.GetValueResponse{
@@ -621,6 +628,7 @@ var _ = Describe("Users", func() {
 				user := &libregraph.User{}
 				user.SetId("user1")
 
+				permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(user, nil)
 				gatewayClient.On("GetQuota", mock.Anything, mock.Anything, mock.Anything).Return(&provider.GetQuotaResponse{
 					Status:     status.NewOK(ctx),
@@ -680,6 +688,7 @@ var _ = Describe("Users", func() {
 				user := &libregraph.User{}
 				user.SetId("user1")
 
+				permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(user, nil)
 				gatewayClient.On("GetQuota", mock.Anything, mock.Anything, mock.Anything).Return(&provider.GetQuotaResponse{
 					Status:     status.NewOK(ctx),
@@ -732,6 +741,7 @@ var _ = Describe("Users", func() {
 				user := &libregraph.User{}
 				user.SetId("user1")
 
+				permissionService.On("GetPermissionByID", mock.Anything, mock.Anything).Return(&settings.GetPermissionByIDResponse{}, nil)
 				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(user, nil)
 
 				assignments := []*settingsmsg.UserRoleAssignment{
@@ -901,13 +911,18 @@ var _ = Describe("Users", func() {
 
 						localCfg.API.UsernameMatch = usernameMatch
 
-						localSvc, _ := service.NewService(
+						mds := mocks.NewStorage(GinkgoT())
+						mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+						localSvc, err := service.NewService(
 							service.Config(localCfg),
+							service.MetadataStorage(mds),
 							service.WithGatewaySelector(gatewaySelector),
 							service.EventsPublisher(&eventsPublisher),
 							service.WithIdentityBackend(identityBackend),
 							service.WithRoleService(roleService),
 						)
+						Expect(err).ToNot(HaveOccurred())
 
 						return localSvc
 					}
@@ -1121,8 +1136,14 @@ var _ = Describe("Users", func() {
 	When("OCM is enabled", func() {
 		BeforeEach(func() {
 			cfg.IncludeOCMSharees = true
-			svc, _ = service.NewService(
+
+			mds := mocks.NewStorage(GinkgoT())
+			mds.EXPECT().Init(mock.Anything, mock.Anything).Return(nil)
+
+			var err error
+			svc, err = service.NewService(
 				service.Config(cfg),
+				service.MetadataStorage(mds),
 				service.WithGatewaySelector(gatewaySelector),
 				service.EventsPublisher(&eventsPublisher),
 				service.WithIdentityBackend(identityBackend),
@@ -1130,6 +1151,7 @@ var _ = Describe("Users", func() {
 				service.WithValueService(valueService),
 				service.PermissionService(permissionService),
 			)
+			Expect(err).ToNot(HaveOccurred())
 		})
 		Describe("GetUsers", func() {
 			It("does not list the federated users without a filter", func() {

services/graph/pkg/service/v0/utils.go

@@ -13,9 +13,9 @@ import (
 	collaboration "github.com/cs3org/go-cs3apis/cs3/sharing/collaboration/v1beta1"
 	ocm "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
 	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"golang.org/x/sync/errgroup"
 
 	"github.com/opencloud-eu/opencloud/pkg/log"
@@ -73,16 +73,6 @@ func GetDriveAndItemIDParam(r *http.Request, logger *log.Logger) (*storageprovid
 	return &driveID, &itemID, nil
 }
 
-// GetFilterParam returns the $filter query parameter from the request. If you need to parse the filter use godata.ParseRequest
-func GetFilterParam(r *http.Request) string {
-	return r.URL.Query().Get("$filter")
-}
-
-// GetSelectParam returns the $select query parameter from the request. If you need to parse the select filter use godata.ParseRequest
-func GetSelectParam(r *http.Request) string {
-	return r.URL.Query().Get("$select")
-}
-
 // GetGatewayClient returns a gateway client from the gatewaySelector.
 func (g Graph) GetGatewayClient(w http.ResponseWriter, r *http.Request) (gateway.GatewayAPIClient, bool) {
 	gatewayClient, err := g.gatewaySelector.Next()

services/groups/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/groups/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/idp/license-checker-clarifications.json

@@ -1,11 +1,11 @@
 {
-    "i18next-conv@14.1.0": {
+    "i18next-conv@15.1.1": {
         "licenses": "MIT",
         "licenseFile": "LICENSE.md",
         "licenseStart": "# MIT License",
         "licenseEnd": "========="
     },
-    "p-from-callback@1.0.1": {
+    "p-from-callback@2.0.0": {
         "licenses": "MIT",
         "licenseFile": "LICENSE.md",
         "licenseStart": "# MIT License",

services/idp/package.json

@@ -76,17 +76,17 @@
     "@material-ui/icons": "^4.11.3",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^11.2.7",
-    "@testing-library/user-event": "^14.5.2",
+    "@testing-library/user-event": "^14.6.1",
     "@types/jest": "^29.5.12",
-    "@types/node": "^20.14.11",
+    "@types/node": "^22.15.19",
     "@types/react": "^17.0.80",
     "@types/react-dom": "^17.0.25",
     "@types/react-redux": "^7.1.33",
     "@types/redux-logger": "^3.0.13",
-    "axios": "^1.7.7",
+    "axios": "^1.8.2",
     "classnames": "^2.5.1",
     "i18next": "^25.1.2",
-    "i18next-browser-languagedetector": "^7.2.1",
+    "i18next-browser-languagedetector": "^8.1.0",
     "i18next-http-backend": "^3.0.2",
     "i18next-resources-to-backend": "^1.2.1",
     "kpop": "https://download.kopano.io/community/kapp:/kpop-2.7.2.tgz",
@@ -132,8 +132,8 @@
     "eslint-webpack-plugin": "^3.2.0",
     "file-loader": "6.2.0",
     "html-webpack-plugin": "5.6.3",
-    "i18next-conv": "^14.1.0",
-    "i18next-parser": "^9.0.2",
+    "i18next-conv": "^15.1.1",
+    "i18next-parser": "^9.3.0",
     "jest": "29.7.0",
     "license-checker-rseidelsohn": "4.4.2",
     "mini-css-extract-plugin": "2.9.2",

services/idp/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/idp/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/invitations/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/invitations/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/ocdav/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/ocdav/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/ocs/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/ocs/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/policies/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/policies/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/proxy/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/search/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/search/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/settings/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/settings/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/sharing/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/sharing/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/storage-publiclink/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/storage-publiclink/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/storage-shares/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/storage-shares/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/storage-system/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/storage-system/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/storage-users/pkg/command/trash_bin.go

@@ -14,7 +14,8 @@ import (
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	"github.com/mohae/deepcopy"
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	zlog "github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/storage-users/pkg/config"
@@ -469,11 +470,10 @@ func itemType(it provider.ResourceType) string {
 	return itemType
 }
 
-func itemsTable(total int) *tw.Table {
-	table := tw.NewWriter(os.Stdout)
-	table.SetHeader([]string{"itemID", "path", "type", "delete at"})
-	table.SetAutoFormatHeaders(false)
-	table.SetFooter([]string{"", "", "", "total count: " + strconv.Itoa(total)})
+func itemsTable(total int) *tablewriter.Table {
+	table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+	table.Header([]string{"itemID", "path", "type", "delete at"})
+	table.Footer([]string{"", "", "", "total count: " + strconv.Itoa(total)})
 	return table
 }
 

services/storage-users/pkg/command/uploads.go

@@ -9,7 +9,8 @@ import (
 	"strings"
 	"time"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/urfave/cli/v2"
 
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
@@ -145,16 +146,15 @@ func ListUploadSessions(cfg *config.Config) *cli.Command {
 			}
 
 			var (
-				table *tw.Table
+				table *tablewriter.Table
 				raw   []Session
 			)
 
 			if !c.Bool("json") {
 				fmt.Println(buildInfo(filter))
 
-				table = tw.NewWriter(os.Stdout)
-				table.SetHeader([]string{"Space", "Upload Id", "Name", "Offset", "Size", "Executant", "Owner", "Expires", "Processing", "Scan Date", "Scan Result"})
-				table.SetAutoFormatHeaders(false)
+				table = tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+				table.Header([]string{"Space", "Upload Id", "Name", "Offset", "Size", "Executant", "Owner", "Expires", "Processing", "Scan Date", "Scan Result"})
 			}
 
 			for _, u := range uploads {

services/storage-users/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/storage-users/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/thumbnails/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/thumbnails/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/thumbnails/pkg/thumbnail/encoding.go

@@ -15,6 +15,7 @@ const (
 	typeGif  = "gif"
 	typeGgs  = "ggs"
 	typeGgp  = "ggp"
+	typeWebp = "webp"
 )
 
 // Encoder encodes the thumbnail to a specific format.
@@ -55,7 +56,7 @@ func EncoderForType(fileType string) (Encoder, error) {
 	switch strings.ToLower(fileType) {
 	case typePng, typeGgs, typeGgp:
 		return PngEncoder{}, nil
-	case typeJpg, typeJpeg:
+	case typeJpg, typeJpeg, typeWebp:
 		return JpegEncoder{}, nil
 	case typeGif:
 		return GifEncoder{}, nil
@@ -68,7 +69,7 @@ func EncoderForType(fileType string) (Encoder, error) {
 func GetExtForMime(fileType string) string {
 	ext := strings.TrimPrefix(strings.TrimSpace(strings.ToLower(fileType)), "image/")
 	switch ext {
-	case typeJpg, typeJpeg, typePng, typeGif:
+	case typeJpg, typeJpeg, typePng, typeGif, typeWebp:
 		return ext
 	case "application/vnd.geogebra.slides":
 		return typeGgs

services/thumbnails/pkg/thumbnail/generator.go

@@ -89,7 +89,7 @@ func (g GifGenerator) imageToPaletted(img image.Image, p color.Palette) *image.P
 // or nil if the type is not supported.
 func GeneratorFor(fileType, processorID string) (Generator, error) {
 	switch strings.ToLower(fileType) {
-	case typePng, typeJpg, typeJpeg, typeGgs, typeGgp:
+	case typePng, typeJpg, typeJpeg, typeGgs, typeGgp, typeWebp:
 		return NewSimpleGenerator(fileType, processorID)
 	case typeGif:
 		return NewGifGenerator(fileType, processorID)

services/thumbnails/pkg/thumbnail/mimetypes.go

@@ -0,0 +1,22 @@
+//go:build !enable_vips
+
+package thumbnail
+
+var (
+	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
+	SupportedMimeTypes = map[string]struct{}{
+		"image/png":                         {},
+		"image/jpg":                         {},
+		"image/jpeg":                        {},
+		"image/gif":                         {},
+		"image/bmp":                         {},
+		"image/x-ms-bmp":                    {},
+		"image/tiff":                        {},
+		"text/plain":                        {},
+		"audio/flac":                        {},
+		"audio/mpeg":                        {},
+		"audio/ogg":                         {},
+		"application/vnd.geogebra.slides":   {},
+		"application/vnd.geogebra.pinboard": {},
+	}
+)

services/thumbnails/pkg/thumbnail/mimetypes_vips.go

@@ -0,0 +1,23 @@
+//go:build enable_vips
+
+package thumbnail
+
+var (
+	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
+	SupportedMimeTypes = map[string]struct{}{
+		"image/png":                         {},
+		"image/jpg":                         {},
+		"image/jpeg":                        {},
+		"image/gif":                         {},
+		"image/bmp":                         {},
+		"image/x-ms-bmp":                    {},
+		"image/tiff":                        {},
+		"text/plain":                        {},
+		"audio/flac":                        {},
+		"audio/mpeg":                        {},
+		"audio/ogg":                         {},
+		"application/vnd.geogebra.slides":   {},
+		"application/vnd.geogebra.pinboard": {},
+		"image/webp":                        {},
+	}
+)

services/thumbnails/pkg/thumbnail/thumbnail.go

@@ -10,25 +10,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/thumbnails/pkg/thumbnail/storage"
 )
 
-var (
-	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
-	SupportedMimeTypes = map[string]struct{}{
-		"image/png":                         {},
-		"image/jpg":                         {},
-		"image/jpeg":                        {},
-		"image/gif":                         {},
-		"image/bmp":                         {},
-		"image/x-ms-bmp":                    {},
-		"image/tiff":                        {},
-		"text/plain":                        {},
-		"audio/flac":                        {},
-		"audio/mpeg":                        {},
-		"audio/ogg":                         {},
-		"application/vnd.geogebra.slides":   {},
-		"application/vnd.geogebra.pinboard": {},
-	}
-)
-
 // Request bundles information needed to generate a thumbnail for a file
 type Request struct {
 	Resolution image.Rectangle

services/users/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/users/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/web/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/web/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/webdav/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/webdav/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

services/webfinger/pkg/command/version.go

@@ -7,7 +7,8 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/registry"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 
-	tw "github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/tw"
 	"github.com/opencloud-eu/opencloud/services/webfinger/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -35,9 +36,8 @@ func Version(cfg *config.Config) *cli.Command {
 				return nil
 			}
 
-			table := tw.NewWriter(os.Stdout)
-			table.SetHeader([]string{"Version", "Address", "Id"})
-			table.SetAutoFormatHeaders(false)
+			table := tablewriter.NewTable(os.Stdout, tablewriter.WithHeaderAutoFormat(tw.Off))
+			table.Header([]string{"Version", "Address", "Id"})
 			for _, s := range services {
 				for _, n := range s.Nodes {
 					table.Append([]string{s.Version, n.Address, n.Id})

tests/acceptance/TestHelpers/GraphHelper.php

@@ -2468,4 +2468,109 @@ class GraphHelper {
 			self::getRequestHeaders()
 		);
 	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 * @param string $source
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function addUserPhoto(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password,
+		string $source
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, "me/photo/\$value");
+		return HttpRequestHelper::put(
+			$url,
+			$xRequestId,
+			$user,
+			$password,
+			['Content-Type' => 'image/jpeg'],
+			$source
+		);
+	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function getUserPhoto(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, "me/photo/\$value");
+		return HttpRequestHelper::get(
+			$url,
+			$xRequestId,
+			$user,
+			$password
+		);
+	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 * @param string $source
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function changeUserPhoto(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password,
+		string $source
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, "me/photo/\$value");
+		return HttpRequestHelper::sendRequest(
+			$url,
+			$xRequestId,
+			"PATCH",
+			$user,
+			$password,
+			['Content-Type' => 'image/jpeg'],
+			$source
+		);
+	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function deleteUserPhoto(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, "me/photo/\$value");
+		return HttpRequestHelper::delete(
+			$url,
+			$xRequestId,
+			$user,
+			$password
+		);
+	}
 }

tests/acceptance/bootstrap/GraphContext.php

@@ -3178,4 +3178,145 @@ class GraphContext implements Context {
 
 		$this->featureContext->setResponse($response);
 	}
+
+	/**
+	 * @When /^user "([^"]*)" sets profile photo to "([^"]*)" using the Graph API$/
+	 *
+	 * @param string $user
+	 * @param string $photo
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userSetsUserProfilePhotoUsingTheGraphApi(
+		string $user,
+		string $photo
+	): void {
+		$source = \file_get_contents(
+			$this->featureContext->acceptanceTestsDirLocation() . $photo
+		);
+		$response = GraphHelper::addUserPhoto(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user),
+			$source
+		);
+		$this->featureContext->setResponse($response);
+	}
+
+	/**
+	 * @Given /^user "([^"]*)" has set the profile photo to "([^"]*)"$/
+	 *
+	 * @param string $user
+	 * @param string $photo
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 * @throws Exception
+	 */
+	public function theUserHasSetPhoto(string $user, string $photo): void {
+		$response = $this->userSetsUserProfilePhotoUsingTheGraphApi($user, $photo);
+		$this->featureContext->theHTTPStatusCodeShouldBe(200, '', $response);
+	}
+
+	/**
+	 * @When /^user "([^"]*)" (gets|tries to get) a profile photo using the Graph API$/
+	 *
+	 * @param string $user
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userShouldHasAProfilePhotoUsingTheGraphApi(string $user): void {
+		$response = GraphHelper::getUserPhoto(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user)
+		);
+		$this->featureContext->setResponse($response);
+	}
+
+	/**
+	 * @Then /^the profile photo should contain file "([^"]*)"$/
+	 *
+	 * @param string $file
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function profilePhotoShouldContainFile(string $file): void {
+		$source = \file_get_contents(
+			$this->featureContext->acceptanceTestsDirLocation() . $file
+		);
+		Assert::assertEquals(
+			$source,
+			$this->featureContext->getResponse()->getBody()->getContents(),
+			"The profile photo binary does not match expected content of $file"
+		);
+	}
+
+	/**
+	 * @Then /^for user "([^"]*)" the profile photo should contain file "([^"]*)"$/
+	 *
+	 * @param string $user
+	 * @param string $file
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function profilePhotoForUserShouldContainFile(string $user, string $file): void {
+		$this->featureContext->theHTTPStatusCodeShouldBe(
+			200,
+			"Expected response status code should be 200",
+			$this->userShouldHasAProfilePhotoUsingTheGraphApi($user)
+		);
+		$this->profilePhotoShouldContainFile($file);
+	}
+
+	/**
+	 * @When /^user "([^"]*)" changes the profile photo to "([^"]*)" using the Graph API$/
+	 *
+	 * @param string $user
+	 * @param string $photo
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userChangesUserProfilePhotoUsingTheGraphApi(
+		string $user,
+		string $photo
+	): void {
+		$source = \file_get_contents(
+			$this->featureContext->acceptanceTestsDirLocation() . $photo
+		);
+		$response = GraphHelper::changeUserPhoto(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user),
+			$source
+		);
+		$this->featureContext->setResponse($response);
+	}
+
+	/**
+	 * @When /^user "([^"]*)" deletes the profile photo using the Graph API$/
+	 *
+	 * @param string $user
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userDeletesAProfilePhotoUsingTheGraphApi(string $user): void {
+		$response = GraphHelper::deleteUserPhoto(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user)
+		);
+		$this->featureContext->setResponse($response);
+	}
+
 }

tests/acceptance/features/apiAntivirus/antivirus.feature

@@ -481,3 +481,13 @@ Feature: antivirus
       | Virus found in text.txt. Upload not possible. Virus: Eicar-Signature |
     And for user "Brian" the content of the file "/text.txt" of the space "new-space" should be "hello world"
     And for user "Alice" the content of the file "/text.txt" of the space "new-space" should be "hello world"
+
+
+  Scenario Outline: try adding a photo of the user containing the virus
+    When user "Alice" sets profile photo to "filesForUpload/filesWithVirus/eicar-image.jpeg" using the Graph API
+    Then the HTTP status code should be "200"
+    And user "Alice" should get a notification with subject "Virus found" and message:
+      | message                                                                      |
+      | Virus found in eicar-image.jpeg. Upload not possible. Virus: Eicar-Signature |
+    When user "Alice" tries to get a profile photo using the Graph API
+    Then the HTTP status code should be "404"

tests/acceptance/features/apiCollaboration/wopi.feature

@@ -1102,7 +1102,7 @@ Feature: collaboration (wopi)
         "properties": {
           "app_url": {
             "type": "string",
-            "pattern": "^.*\\?WOPISrc=.*wopi%2Ffiles%2F[a-fA-F0-9]{64}$"
+            "pattern": "^.*\\?WOPISrc=.*wopi%2Ffiles%2F[a-fA-F0-9]{64}(&.*)?$"
           },
           "method": {
             "const": "POST"

tests/acceptance/features/apiGraphUserGroup/userProfilePhoto.feature

@@ -0,0 +1,64 @@
+Feature: user profile photo
+  As a user, I want to provide my avatar to make my actions more visible
+
+  Background:
+    Given user "Alice" has been created with default attributes
+
+
+  Scenario Outline: add profile photo
+    When user "Alice" sets profile photo to "<file>" using the Graph API
+    Then the HTTP status code should be "<http-status-code>"
+    And for user "Alice" the profile photo should contain file "<file>"
+    Examples:
+      | file                                 | http-status-code |
+      | filesForUpload/testavatar.jpg        | 200              |
+      | filesForUpload/testavatar.png        | 200              |
+      | filesForUpload/example.gif           | 200              |
+      | filesForUpload/lorem.txt             | 400              |
+      | filesForUpload/simple.pdf            | 400              |
+      | filesForUpload/broken-image-file.png | 400              |
+
+
+  Scenario: user tries to get profile photo when none is set
+    When user "Alice" tries to get a profile photo using the Graph API
+    Then the HTTP status code should be "404"
+
+
+  Scenario Outline: get profile photo
+    Given user "Alice" has set the profile photo to "<file>"
+    When user "Alice" gets a profile photo using the Graph API
+    Then the HTTP status code should be "200"
+    And the profile photo should contain file "<file>"
+    Examples:
+      | file                          |
+      | filesForUpload/testavatar.jpg |
+      | filesForUpload/testavatar.png |
+      | filesForUpload/example.gif    |
+
+
+  Scenario Outline: change profile photo
+    Given user "Alice" has set the profile photo to "filesForUpload/testavatar.jpg"
+    When user "Alice" changes the profile photo to "<file>" using the Graph API
+    Then the HTTP status code should be "<http-status-code>"
+    And for user "Alice" the profile photo should contain file "<file>"
+    Examples:
+      | file                                 | http-status-code |
+      | filesForUpload/testavatar.jpg        | 200              |
+      | filesForUpload/testavatar.png        | 200              |
+      | filesForUpload/example.gif           | 200              |
+      | filesForUpload/lorem.txt             | 400              |
+      | filesForUpload/simple.pdf            | 400              |
+      | filesForUpload/broken-image-file.png | 400              |
+
+
+  Scenario Outline: delete profile photo
+    Given user "Alice" has set the profile photo to "<file>"
+    When user "Alice" deletes the profile photo using the Graph API
+    Then the HTTP status code should be "200"
+    When user "Alice" tries to get a profile photo using the Graph API
+    Then the HTTP status code should be "404"
+    Examples:
+      | file                          |
+      | filesForUpload/testavatar.jpg |
+      | filesForUpload/testavatar.png |
+      | filesForUpload/example.gif    |

tests/acceptance/filesForUpload/filesWithVirus/eicar-image.jpeg

@@ -0,0 +1 @@
+X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

vendor/github.com/aws/aws-sdk-go/aws/version.go

@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.55.6"
+const SDKVersion = "1.55.7"

vendor/github.com/aws/aws-sdk-go/service/s3/s3manager/download.go

@@ -290,13 +290,15 @@ type downloader struct {
 	in *s3.GetObjectInput
 	w  io.WriterAt
 
-	wg sync.WaitGroup
-	m  sync.Mutex
+	wg   sync.WaitGroup
+	m    sync.Mutex
+	once sync.Once
 
 	pos        int64
 	totalBytes int64
 	written    int64
 	err        error
+	etag       string
 
 	partBodyMaxRetries int
 }
@@ -424,6 +426,9 @@ func (d *downloader) downloadChunk(chunk dlchunk) error {
 
 	// Get the next byte range of data
 	in.Range = aws.String(chunk.ByteRange())
+	if in.VersionId == nil && d.etag != "" {
+		in.IfMatch = aws.String(d.etag)
+	}
 
 	var n int64
 	var err error
@@ -466,6 +471,9 @@ func (d *downloader) tryDownloadChunk(in *s3.GetObjectInput, w io.Writer) (int64
 		return 0, err
 	}
 	d.setTotalBytes(resp) // Set total if not yet set.
+	d.once.Do(func() {
+		d.etag = aws.StringValue(resp.ETag)
+	})
 
 	var src io.Reader = resp.Body
 	if d.cfg.BufferProvider != nil {

vendor/github.com/blevesearch/bleve/v2/document/field_geoshape.go

@@ -143,7 +143,27 @@ func NewGeoShapeFieldFromBytes(name string, arrayPositions []uint64,
 func NewGeoShapeFieldWithIndexingOptions(name string, arrayPositions []uint64,
 	coordinates [][][][]float64, typ string,
 	options index.FieldIndexingOptions) *GeoShapeField {
-	shape, encodedValue, err := geo.NewGeoJsonShape(coordinates, typ)
+	shape := &geojson.GeoShape{
+		Coordinates: coordinates,
+		Type:        typ,
+	}
+
+	return NewGeoShapeFieldFromShapeWithIndexingOptions(name,
+		arrayPositions, shape, options)
+}
+
+func NewGeoShapeFieldFromShapeWithIndexingOptions(name string, arrayPositions []uint64,
+	geoShape *geojson.GeoShape, options index.FieldIndexingOptions) *GeoShapeField {
+
+	var shape index.GeoJSON
+	var encodedValue []byte
+	var err error
+
+	if geoShape.Type == geo.CircleType {
+		shape, encodedValue, err = geo.NewGeoCircleShape(geoShape.Center, geoShape.Radius)
+	} else {
+		shape, encodedValue, err = geo.NewGeoJsonShape(geoShape.Coordinates, geoShape.Type)
+	}
 	if err != nil {
 		return nil
 	}
@@ -158,7 +178,9 @@ func NewGeoShapeFieldWithIndexingOptions(name string, arrayPositions []uint64,
 		return nil
 	}
 
-	options = options | DefaultGeoShapeIndexingOptions
+	// docvalues are always enabled for geoshape fields, even if the
+	// indexing options are set to not include docvalues.
+	options = options | index.DocValues
 
 	return &GeoShapeField{
 		shape:             shape,
@@ -174,7 +196,26 @@ func NewGeoShapeFieldWithIndexingOptions(name string, arrayPositions []uint64,
 func NewGeometryCollectionFieldWithIndexingOptions(name string,
 	arrayPositions []uint64, coordinates [][][][][]float64, types []string,
 	options index.FieldIndexingOptions) *GeoShapeField {
-	shape, encodedValue, err := geo.NewGeometryCollection(coordinates, types)
+	if len(coordinates) != len(types) {
+		return nil
+	}
+
+	shapes := make([]*geojson.GeoShape, len(types))
+	for i := range coordinates {
+		shapes[i] = &geojson.GeoShape{
+			Coordinates: coordinates[i],
+			Type:        types[i],
+		}
+	}
+
+	return NewGeometryCollectionFieldFromShapesWithIndexingOptions(name,
+		arrayPositions, shapes, options)
+}
+
+func NewGeometryCollectionFieldFromShapesWithIndexingOptions(name string,
+	arrayPositions []uint64, geoShapes []*geojson.GeoShape,
+	options index.FieldIndexingOptions) *GeoShapeField {
+	shape, encodedValue, err := geo.NewGeometryCollectionFromShapes(geoShapes)
 	if err != nil {
 		return nil
 	}
@@ -189,7 +230,9 @@ func NewGeometryCollectionFieldWithIndexingOptions(name string,
 		return nil
 	}
 
-	options = options | DefaultGeoShapeIndexingOptions
+	// docvalues are always enabled for geoshape fields, even if the
+	// indexing options are set to not include docvalues.
+	options = options | index.DocValues
 
 	return &GeoShapeField{
 		shape:             shape,
@@ -205,32 +248,15 @@ func NewGeometryCollectionFieldWithIndexingOptions(name string,
 func NewGeoCircleFieldWithIndexingOptions(name string, arrayPositions []uint64,
 	centerPoint []float64, radius string,
 	options index.FieldIndexingOptions) *GeoShapeField {
-	shape, encodedValue, err := geo.NewGeoCircleShape(centerPoint, radius)
-	if err != nil {
-		return nil
+
+	shape := &geojson.GeoShape{
+		Center: centerPoint,
+		Radius: radius,
+		Type:   geo.CircleType,
 	}
 
-	// extra glue bytes to work around the term splitting logic from interfering
-	// the custom encoding of the geoshape coordinates inside the docvalues.
-	encodedValue = append(geo.GlueBytes, append(encodedValue, geo.GlueBytes...)...)
-
-	// get the byte value for the circle.
-	value, err := shape.Value()
-	if err != nil {
-		return nil
-	}
-
-	options = options | DefaultGeoShapeIndexingOptions
-
-	return &GeoShapeField{
-		shape:             shape,
-		name:              name,
-		arrayPositions:    arrayPositions,
-		options:           options,
-		encodedValue:      encodedValue,
-		value:             value,
-		numPlainTextBytes: uint64(len(value)),
-	}
+	return NewGeoShapeFieldFromShapeWithIndexingOptions(name,
+		arrayPositions, shape, options)
 }
 
 // GeoShape is an implementation of the index.GeoShapeField interface.

vendor/github.com/blevesearch/bleve/v2/document/field_vector.go

@@ -109,7 +109,6 @@ func NewVectorField(name string, arrayPositions []uint64,
 func NewVectorFieldWithIndexingOptions(name string, arrayPositions []uint64,
 	vector []float32, dims int, similarity, vectorIndexOptimizedFor string,
 	options index.FieldIndexingOptions) *VectorField {
-	options = options | DefaultVectorIndexingOptions
 
 	return &VectorField{
 		name:                    name,

vendor/github.com/blevesearch/bleve/v2/geo/README.md

@@ -274,4 +274,10 @@ First, all of this geo code is a Go adaptation of the [Lucene 5.3.2 sandbox geo
 
 - All of the APIs will use float64 for lon/lat values.
 - When describing a point in function arguments or return values, we always use the order lon, lat.
-- High level APIs will use TopLeft and BottomRight to describe bounding boxes.  This may not map cleanly to min/max lon/lat when crossing the dateline.  The lower level APIs will use min/max lon/lat and require the higher-level code to split boxes accordingly.
+- High level APIs will use TopLeft and BottomRight to describe bounding boxes. This may not map cleanly to min/max lon/lat when crossing the dateline. The lower level APIs will use min/max lon/lat and require the higher-level code to split boxes accordingly.
+- Points and MultiPoints may only contain Points and MultiPoints.
+- LineStrings and MultiLineStrings may only contain Points and MultiPoints.
+- Polygons or MultiPolygons intersecting Polygons and MultiPolygons may return arbitrary results when the overlap is only an edge or a vertex.
+- Circles containing polygon will return a false positive result if all of the vertices of the polygon are within the circle, but the orientation of those points are clock-wise.
+- The edges of an Envelope follows the latitude and logitude lines instead of the shortest path on a globe.
+- Envelope intersecting queries with LineStrings, MultiLineStrings, Polygons and MultiPolygons implicitly converts the Envelope into a Polygon which changes the curvature of the edges causing inaccurate results for few edge cases.

vendor/github.com/blevesearch/bleve/v2/geo/geo_s2plugin_impl.go

@@ -396,8 +396,21 @@ func (pd *pointDistance) QueryTokens(s *S2SpatialAnalyzerPlugin) []string {
 // can be used later while filering the doc values.
 func NewGeometryCollection(coordinates [][][][][]float64,
 	typs []string) (index.GeoJSON, []byte, error) {
+	shapes := make([]*geojson.GeoShape, len(coordinates))
+	for i := range coordinates {
+		shapes[i] = &geojson.GeoShape{
+			Coordinates: coordinates[i],
+			Type:        typs[i],
+		}
+	}
 
-	return geojson.NewGeometryCollection(coordinates, typs)
+	return geojson.NewGeometryCollection(shapes)
+}
+
+func NewGeometryCollectionFromShapes(shapes []*geojson.GeoShape) (
+	index.GeoJSON, []byte, error) {
+
+	return geojson.NewGeometryCollection(shapes)
 }
 
 // NewGeoCircleShape instantiate a circle shape and

vendor/github.com/blevesearch/bleve/v2/geo/parse.go

@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"github.com/blevesearch/bleve/v2/util"
+	"github.com/blevesearch/geo/geojson"
 )
 
 // ExtractGeoPoint takes an arbitrary interface{} and tries it's best to
@@ -298,10 +299,15 @@ func ParseGeoShapeField(thing interface{}) (interface{}, string, error) {
 	return coordValue, strings.ToLower(shape), nil
 }
 
-func extractGeoShape(thing interface{}) ([][][][]float64, string, bool) {
+func extractGeoShape(thing interface{}) (*geojson.GeoShape, bool) {
+
 	coordValue, typ, err := ParseGeoShapeField(thing)
 	if err != nil {
-		return nil, "", false
+		return nil, false
+	}
+
+	if typ == CircleType {
+		return ExtractCircle(thing)
 	}
 
 	return ExtractGeoShapeCoordinates(coordValue, typ)
@@ -309,13 +315,12 @@ func extractGeoShape(thing interface{}) ([][][][]float64, string, bool) {
 
 // ExtractGeometryCollection takes an interface{} and tries it's best to
 // interpret all the member geojson shapes within it.
-func ExtractGeometryCollection(thing interface{}) ([][][][][]float64, []string, bool) {
+func ExtractGeometryCollection(thing interface{}) ([]*geojson.GeoShape, bool) {
 	thingVal := reflect.ValueOf(thing)
 	if !thingVal.IsValid() {
-		return nil, nil, false
+		return nil, false
 	}
-	var rv [][][][][]float64
-	var types []string
+	var rv []*geojson.GeoShape
 	var f bool
 
 	if thingVal.Kind() == reflect.Map {
@@ -331,70 +336,74 @@ func ExtractGeometryCollection(thing interface{}) ([][][][][]float64, []string,
 				items := reflect.ValueOf(collection)
 
 				for j := 0; j < items.Len(); j++ {
-					coords, shape, found := extractGeoShape(items.Index(j).Interface())
+					shape, found := extractGeoShape(items.Index(j).Interface())
 					if found {
 						f = found
-						rv = append(rv, coords)
-						types = append(types, shape)
+						rv = append(rv, shape)
 					}
 				}
 			}
 		}
 	}
 
-	return rv, types, f
+	return rv, f
 }
 
 // ExtractCircle takes an interface{} and tries it's best to
 // interpret the center point coordinates and the radius for a
 // given circle shape.
-func ExtractCircle(thing interface{}) ([]float64, string, bool) {
+func ExtractCircle(thing interface{}) (*geojson.GeoShape, bool) {
 	thingVal := reflect.ValueOf(thing)
 	if !thingVal.IsValid() {
-		return nil, "", false
+		return nil, false
+	}
+
+	rv := &geojson.GeoShape{
+		Type:   CircleType,
+		Center: make([]float64, 0, 2),
 	}
-	var rv []float64
-	var radiusStr string
 
 	if thingVal.Kind() == reflect.Map {
 		iter := thingVal.MapRange()
 		for iter.Next() {
 
 			if iter.Key().String() == "radius" {
-				radiusStr = iter.Value().Interface().(string)
+				rv.Radius = iter.Value().Interface().(string)
 				continue
 			}
 
 			if iter.Key().String() == "coordinates" {
 				lng, lat, found := ExtractGeoPoint(iter.Value().Interface())
 				if !found {
-					return nil, radiusStr, false
+					return nil, false
 				}
-				rv = append(rv, lng)
-				rv = append(rv, lat)
+				rv.Center = append(rv.Center, lng, lat)
 			}
 		}
 	}
 
-	return rv, radiusStr, true
+	return rv, true
 }
 
 // ExtractGeoShapeCoordinates takes an interface{} and tries it's best to
 // interpret the coordinates for any of the given geoshape typ like
 // a point, multipoint, linestring, multilinestring, polygon, multipolygon,
 func ExtractGeoShapeCoordinates(coordValue interface{},
-	typ string) ([][][][]float64, string, bool) {
-	var rv [][][][]float64
+	typ string) (*geojson.GeoShape, bool) {
+	rv := &geojson.GeoShape{
+		Type: typ,
+	}
+
 	if typ == PointType {
 		point := extractCoordinates(coordValue)
 
 		// ignore the contents with invalid entry.
 		if len(point) < 2 {
-			return nil, typ, false
+			return nil, false
 		}
 
-		rv = [][][][]float64{{{point}}}
-		return rv, typ, true
+		rv.Coordinates = [][][][]float64{{{point}}}
+		return rv, true
 	}
 
 	if typ == MultiPointType || typ == LineStringType ||
@@ -403,19 +412,19 @@ func ExtractGeoShapeCoordinates(coordValue interface{},
 
 		// ignore the contents with invalid entry.
 		if len(coords) == 0 {
-			return nil, typ, false
+			return nil, false
 		}
 
 		if typ == EnvelopeType && len(coords) != 2 {
-			return nil, typ, false
+			return nil, false
 		}
 
 		if typ == LineStringType && len(coords) < 2 {
-			return nil, typ, false
+			return nil, false
 		}
 
-		rv = [][][][]float64{{coords}}
-		return rv, typ, true
+		rv.Coordinates = [][][][]float64{{coords}}
+		return rv, true
 	}
 
 	if typ == PolygonType || typ == MultiLineStringType {
@@ -423,33 +432,34 @@ func ExtractGeoShapeCoordinates(coordValue interface{},
 
 		// ignore the contents with invalid entry.
 		if len(coords) == 0 {
-			return nil, typ, false
+			return nil, false
 		}
 
 		if typ == PolygonType && len(coords[0]) < 3 ||
 			typ == MultiLineStringType && len(coords[0]) < 2 {
-			return nil, typ, false
+			return nil, false
 		}
 
-		rv = [][][][]float64{coords}
-		return rv, typ, true
+		rv.Coordinates = [][][][]float64{coords}
+		return rv, true
 	}
 
 	if typ == MultiPolygonType {
-		rv = extract4DCoordinates(coordValue)
+		coords := extract4DCoordinates(coordValue)
 
 		// ignore the contents with invalid entry.
-		if len(rv) == 0 || len(rv[0]) == 0 {
-			return nil, typ, false
+		if len(coords) == 0 || len(coords[0]) == 0 {
+			return nil, false
 
 		}
 
-		if len(rv[0][0]) < 3 {
-			return nil, typ, false
+		if len(coords[0][0]) < 3 {
+			return nil, false
 		}
 
-		return rv, typ, true
+		rv.Coordinates = coords
+		return rv, true
 	}
 
-	return rv, typ, false
+	return rv, false
 }

vendor/github.com/blevesearch/bleve/v2/index/scorch/event.go

@@ -71,3 +71,7 @@ var EventKindPreMergeCheck = EventKind(9)
 // EventKindIndexStart is fired when Index() is invoked which
 // creates a new Document object from an interface using the index mapping.
 var EventKindIndexStart = EventKind(10)
+
+// EventKindPurgerCheck is fired before the purge code is invoked and decides
+// whether to execute or not. For unit test purposes
+var EventKindPurgerCheck = EventKind(11)

vendor/github.com/blevesearch/bleve/v2/index/scorch/merge.go

@@ -81,6 +81,10 @@ OUTER:
 					// Retry instead of blocking/waiting here since a long wait
 					// can result in more segments introduced i.e. s.root will
 					// be updated.
+
+					// decrement the ref count since its no longer needed in this
+					// iteration
+					_ = ourSnapshot.DecRef()
 					continue OUTER
 				}
 
@@ -488,7 +492,11 @@ func closeNewMergedSegments(segs []segment.Segment) error {
 	return nil
 }
 
-func (s *Scorch) mergeSegmentBasesParallel(snapshot *IndexSnapshot, flushableObjs []*flushable) (*IndexSnapshot, []uint64, error) {
+// mergeAndPersistInMemorySegments takes an IndexSnapshot and a list of in-memory segments,
+// which are merged and persisted to disk concurrently. These are then introduced as
+// the new root snapshot in one-shot.
+func (s *Scorch) mergeAndPersistInMemorySegments(snapshot *IndexSnapshot,
+	flushableObjs []*flushable) (*IndexSnapshot, []uint64, error) {
 	atomic.AddUint64(&s.stats.TotMemMergeBeg, 1)
 
 	memMergeZapStartTime := time.Now()
@@ -507,7 +515,8 @@ func (s *Scorch) mergeSegmentBasesParallel(snapshot *IndexSnapshot, flushableObj
 	var em sync.Mutex
 	var errs []error
 
-	// deploy the workers to merge and flush the batches of segments parallely
+	// deploy the workers to merge and flush the batches of segments concurrently
+	// and create a new file segment
 	for i := 0; i < numFlushes; i++ {
 		wg.Add(1)
 		go func(segsBatch []segment.Segment, dropsBatch []*roaring.Bitmap, id int) {
@@ -527,6 +536,11 @@ func (s *Scorch) mergeSegmentBasesParallel(snapshot *IndexSnapshot, flushableObj
 				atomic.AddUint64(&s.stats.TotMemMergeErr, 1)
 				return
 			}
+			// to prevent accidental cleanup of this newly created file, mark it
+			// as ineligible for removal. this will be flipped back when the bolt
+			// is updated - which is valid, since the snapshot updated in bolt is
+			// cleaned up only if its zero ref'd (MB-66163 for more details)
+			s.markIneligibleForRemoval(filename)
 			newMergedSegmentIDs[id] = newSegmentID
 			newDocIDsSet[id] = newDocIDs
 			newMergedSegments[id], err = s.segPlugin.Open(path)
@@ -567,6 +581,8 @@ func (s *Scorch) mergeSegmentBasesParallel(snapshot *IndexSnapshot, flushableObj
 		atomic.StoreUint64(&s.stats.MaxMemMergeZapTime, memMergeZapTime)
 	}
 
+	// update the segmentMerge task with the newly merged + flushed segments which
+	// are to be introduced atomically.
 	sm := &segmentMerge{
 		id:               newMergedSegmentIDs,
 		new:              newMergedSegments,
@@ -575,6 +591,10 @@ func (s *Scorch) mergeSegmentBasesParallel(snapshot *IndexSnapshot, flushableObj
 		newCount:         newMergedCount,
 	}
 
+	// create a history map which maps the old in-memory segments with the specific
+	// persister worker (also the specific file segment its going to be part of)
+	// which flushed it out. This map will be used on the introducer side to out-ref
+	// the in-memory segments and also track the new tombstones if present.
 	for i, flushable := range flushableObjs {
 		for j, idx := range flushable.sbIdxs {
 			ss := snapshot.segment[idx]

vendor/github.com/blevesearch/bleve/v2/index/scorch/optimize_knn.go

@@ -137,8 +137,8 @@ func (o *OptimizeVR) Finish() error {
 }
 
 func (s *IndexSnapshotVectorReader) VectorOptimize(ctx context.Context,
-	octx index.VectorOptimizableContext) (index.VectorOptimizableContext, error) {
-
+	octx index.VectorOptimizableContext,
+) (index.VectorOptimizableContext, error) {
 	if s.snapshot.parent.segPlugin.Version() < VectorSearchSupportedSegmentVersion {
 		return nil, fmt.Errorf("vector search not supported for this index, "+
 			"index's segment version %v, supported segment version for vector search %v",
@@ -146,8 +146,9 @@ func (s *IndexSnapshotVectorReader) VectorOptimize(ctx context.Context,
 	}
 
 	if octx == nil {
-		octx = &OptimizeVR{snapshot: s.snapshot,
-			vrs: make(map[string][]*IndexSnapshotVectorReader),
+		octx = &OptimizeVR{
+			snapshot: s.snapshot,
+			vrs:      make(map[string][]*IndexSnapshotVectorReader),
 		}
 	}
 

vendor/github.com/blevesearch/bleve/v2/index/scorch/persister.go

@@ -228,7 +228,9 @@ OUTER:
 		case s.introducerNotifier <- w:
 		}
 
-		s.removeOldData() // might as well cleanup while waiting
+		if ok := s.fireEvent(EventKindPurgerCheck, 0); ok {
+			s.removeOldData() // might as well cleanup while waiting
+		}
 
 		atomic.AddUint64(&s.stats.TotPersistLoopWait, 1)
 
@@ -296,7 +298,9 @@ func (s *Scorch) pausePersisterForMergerCatchUp(lastPersistedEpoch uint64,
 	// 1. Too many older snapshots awaiting the clean up.
 	// 2. The merger could be lagging behind on merging the disk files.
 	if numFilesOnDisk > uint64(po.PersisterNapUnderNumFiles) {
-		s.removeOldData()
+		if ok := s.fireEvent(EventKindPurgerCheck, 0); ok {
+			s.removeOldData()
+		}
 		numFilesOnDisk, _, _ = s.diskFileStats(nil)
 	}
 
@@ -481,8 +485,9 @@ func (s *Scorch) persistSnapshotMaybeMerge(snapshot *IndexSnapshot, po *persiste
 		return false, nil
 	}
 
-	// drains out (after merging in memory) the segments in the flushSet parallely
-	newSnapshot, newSegmentIDs, err := s.mergeSegmentBasesParallel(snapshot, flushSet)
+	// the newSnapshot at this point would contain the newly created file segments
+	// and updated with the root.
+	newSnapshot, newSegmentIDs, err := s.mergeAndPersistInMemorySegments(snapshot, flushSet)
 	if err != nil {
 		return false, err
 	}
@@ -529,7 +534,7 @@ func (s *Scorch) persistSnapshotMaybeMerge(snapshot *IndexSnapshot, po *persiste
 		}
 	}
 
-	// append to the equiv the new segment
+	// append to the equiv the newly merged segments
 	for _, segment := range newSnapshot.segment {
 		if _, ok := newMergedSegmentIDs[segment.id]; ok {
 			equiv.segment = append(equiv.segment, &SegmentSnapshot{
@@ -538,7 +543,6 @@ func (s *Scorch) persistSnapshotMaybeMerge(snapshot *IndexSnapshot, po *persiste
 				deleted: nil, // nil since merging handled deletions
 				stats:   nil,
 			})
-			break
 		}
 	}
 
@@ -842,7 +846,7 @@ var (
 )
 
 func (s *Scorch) loadFromBolt() error {
-	return s.rootBolt.View(func(tx *bolt.Tx) error {
+	err := s.rootBolt.View(func(tx *bolt.Tx) error {
 		snapshots := tx.Bucket(boltSnapshotsBucket)
 		if snapshots == nil {
 			return nil
@@ -892,6 +896,16 @@ func (s *Scorch) loadFromBolt() error {
 		}
 		return nil
 	})
+	if err != nil {
+		return err
+	}
+
+	persistedSnapshots, err := s.rootBoltSnapshotMetaData()
+	if err != nil {
+		return err
+	}
+	s.checkPoints = persistedSnapshots
+	return nil
 }
 
 // LoadSnapshot loads the segment with the specified epoch
@@ -1113,7 +1127,10 @@ func getProtectedSnapshots(rollbackSamplingInterval time.Duration,
 	numSnapshotsToKeep int,
 	persistedSnapshots []*snapshotMetaData,
 ) map[uint64]time.Time {
-	lastPoint, protectedEpochs := getTimeSeriesSnapshots(numSnapshotsToKeep,
+	// keep numSnapshotsToKeep - 1 worth of time series snapshots, because we always
+	// must preserve the very latest snapshot in bolt as well to avoid accidental
+	// deletes of bolt entries and cleanups by the purger code.
+	lastPoint, protectedEpochs := getTimeSeriesSnapshots(numSnapshotsToKeep-1,
 		rollbackSamplingInterval, persistedSnapshots)
 	if len(protectedEpochs) < numSnapshotsToKeep {
 		numSnapshotsNeeded := numSnapshotsToKeep - len(protectedEpochs)
@@ -1276,7 +1293,7 @@ func (s *Scorch) removeOldZapFiles() error {
 // duration. This results in all of them being purged from the boltDB
 // and the next iteration of the removeOldData() would end up protecting
 // latest contiguous snapshot which is a poor pattern in the rollback checkpoints.
-// Hence we try to retain atleast retentionFactor portion worth of old snapshots
+// Hence we try to retain atmost retentionFactor portion worth of old snapshots
 // in such a scenario using the following function
 func getBoundaryCheckPoint(retentionFactor float64,
 	checkPoints []*snapshotMetaData, timeStamp time.Time,
@@ -1284,11 +1301,13 @@ func getBoundaryCheckPoint(retentionFactor float64,
 	if checkPoints != nil {
 		boundary := checkPoints[int(math.Floor(float64(len(checkPoints))*
 			retentionFactor))]
-		if timeStamp.Sub(boundary.timeStamp) < 0 {
-			// too less checkPoints would be left.
+		if timeStamp.Sub(boundary.timeStamp) > 0 {
+			// return the extended boundary which will dictate the older snapshots
+			// to be retained
 			return boundary.timeStamp
 		}
 	}
+
 	return timeStamp
 }
 
@@ -1300,7 +1319,10 @@ type snapshotMetaData struct {
 func (s *Scorch) rootBoltSnapshotMetaData() ([]*snapshotMetaData, error) {
 	var rv []*snapshotMetaData
 	currTime := time.Now()
-	expirationDuration := time.Duration(s.numSnapshotsToKeep) * s.rollbackSamplingInterval
+	// including the very latest snapshot there should be n snapshots, so the
+	// very last one would be tc - (n-1) * d
+	// for eg for n = 3 the checkpoints preserved should be tc, tc - d, tc - 2d
+	expirationDuration := time.Duration(s.numSnapshotsToKeep-1) * s.rollbackSamplingInterval
 
 	err := s.rootBolt.View(func(tx *bolt.Tx) error {
 		snapshots := tx.Bucket(boltSnapshotsBucket)
@@ -1309,6 +1331,7 @@ func (s *Scorch) rootBoltSnapshotMetaData() ([]*snapshotMetaData, error) {
 		}
 		sc := snapshots.Cursor()
 		var found bool
+		// traversal order - latest -> oldest epoch
 		for sk, _ := sc.Last(); sk != nil; sk, _ = sc.Prev() {
 			_, snapshotEpoch, err := decodeUvarintAscending(sk)
 			if err != nil {
@@ -1358,7 +1381,6 @@ func (s *Scorch) rootBoltSnapshotMetaData() ([]*snapshotMetaData, error) {
 					err = nil
 				}
 			}
-
 		}
 		return nil
 	})