🎉 Release 3.4.0 (#1334)

* 🎉 Release 3.3.1

* 🎉 Release 3.3.1

* 🎉 Release 3.3.1

* 🎉 Release 3.3.1

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

* 🎉 Release 3.4.0

.dockerignore

@@ -1,6 +1,8 @@
 .bingo
 !.bingo/*.mod
 !.bingo/Variables.mk
+.git
 **/bin
-docs
 **/node_modules
+**/tmp
+docs

.woodpecker.env

@@ -1,3 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=534ae9eb496f4ecc1d15de9c23c042cf60ff8488
+WEB_COMMITID=636c9d41f100901c4f75509b3269dffaa94d8004
 WEB_BRANCH=main
+

.woodpecker.star

@@ -11,6 +11,7 @@ ALPINE_GIT = "alpine/git:latest"
 APACHE_TIKA = "apache/tika:2.8.0.0"
 CHKO_DOCKER_PUSHRM = "chko/docker-pushrm:1"
 COLLABORA_CODE = "collabora/code:24.04.5.1.1"
+OPEN_SEARCH = "opensearchproject/opensearch:2"
 INBUCKET_INBUCKET = "inbucket/inbucket"
 MINIO_MC = "minio/mc:RELEASE.2021-10-07T04-19-58Z"
 OC_CI_ALPINE = "owncloudci/alpine:latest"
@@ -33,6 +34,7 @@ PLUGINS_S3_CACHE = "plugins/s3-cache:1"
 PLUGINS_SLACK = "plugins/slack:1"
 REDIS = "redis:6-alpine"
 READY_RELEASE_GO = "woodpeckerci/plugin-ready-release-go:latest"
+OPENLDAP = "bitnamilegacy/openldap:2.6"
 
 DEFAULT_PHP_VERSION = "8.2"
 DEFAULT_NODEJS_VERSION = "20"
@@ -73,6 +75,10 @@ event = {
         "event": ["push", "manual"],
         "branch": "main",
     },
+    "cron": {
+        "event": "cron",
+        "branch": "main",
+    },
     "pull_request": {
         "event": "pull_request",
     },
@@ -113,7 +119,7 @@ config = {
             "skip": False,
             "withRemotePhp": [True],
             "emailNeeded": True,
-            "extraEnvironment": {
+            "extraTestEnvironment": {
                 "EMAIL_HOST": "email",
                 "EMAIL_PORT": "9000",
             },
@@ -207,7 +213,7 @@ config = {
             "skip": False,
             "withRemotePhp": [True],
             "emailNeeded": True,
-            "extraEnvironment": {
+            "extraTestEnvironment": {
                 "EMAIL_HOST": "email",
                 "EMAIL_PORT": "9000",
             },
@@ -250,7 +256,7 @@ config = {
             "withRemotePhp": [True],
             "federationServer": True,
             "emailNeeded": True,
-            "extraEnvironment": {
+            "extraTestEnvironment": {
                 "EMAIL_HOST": "email",
                 "EMAIL_PORT": "9000",
             },
@@ -300,6 +306,36 @@ config = {
                 "STORAGE_USERS_DRIVER": "decomposed",
             },
         },
+        "multiTenancy": {
+            "suites": [
+                "apiTenancy",
+            ],
+            "skip": False,
+            "withRemotePhp": [True],
+            "ldapNeeded": True,
+            "extraTestEnvironment": {
+                "USE_PREPARED_LDAP_USERS": True,
+            },
+            "extraServerEnvironment": {
+                "OC_LDAP_USER_SCHEMA_TENANT_ID": "departmentNumber",
+                "OC_LDAP_URI": "ldaps://ldap-server:1636",
+                "OC_LDAP_INSECURE": True,
+                "OC_LDAP_BIND_DN": "cn=admin,dc=opencloud,dc=eu",
+                "OC_LDAP_BIND_PASSWORD": "admin",
+                "OC_LDAP_GROUP_BASE_DN": "ou=groups,dc=opencloud,dc=eu",
+                "OC_LDAP_GROUP_SCHEMA_ID": "entryUUID",
+                "OC_LDAP_USER_BASE_DN": "ou=users,dc=opencloud,dc=eu",
+                "OC_LDAP_USER_FILTER": "(objectclass=inetOrgPerson)",
+                "OC_LDAP_USER_SCHEMA_ID": "entryUUID",
+                "OC_LDAP_DISABLE_USER_MECHANISM": "none",
+                "GRAPH_LDAP_SERVER_UUID": True,
+                "GRAPH_LDAP_GROUP_CREATE_BASE_DN": "ou=custom,ou=groups,dc=opencloud,dc=eu",
+                "GRAPH_LDAP_REFINT_ENABLED": True,
+                "FRONTEND_READONLY_USER_ATTRIBUTES": "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments",
+                "OC_LDAP_SERVER_WRITE_ENABLED": False,
+                "OC_EXCLUDE_RUN_SERVICES": "idm",
+            },
+        },
     },
     "apiTests": {
         "numberOfParts": 7,
@@ -310,7 +346,7 @@ config = {
         "part": {
             "skip": False,
             "totalParts": 4,  # divide and run all suites in parts (divide pipelines)
-            "xsuites": ["search", "app-provider", "app-provider-onlyOffice", "app-store", "keycloak", "oidc", "ocm", "a11y"],  # suites to skip
+            "xsuites": ["search", "app-provider", "app-provider-onlyOffice", "app-store", "keycloak", "oidc", "ocm", "a11y", "mobile-view"],  # suites to skip
         },
         "search": {
             "skip": False,
@@ -470,7 +506,7 @@ def main(ctx):
         ),
     )
 
-    pipelines = test_pipelines + build_release_pipelines
+    pipelines = test_pipelines + build_release_pipelines + notifyMatrix(ctx)
 
     # if ctx.build.event == "cron":
     #     pipelines = \
@@ -484,14 +520,6 @@ def main(ctx):
     #             pipelines,
     #         )
 
-    # always append notification step
-    pipelines.append(
-        pipelineDependsOn(
-            notify(ctx),
-            pipelines,
-        ),
-    )
-
     pipelineSanityChecks(pipelines)
     return pipelines
 
@@ -505,6 +533,7 @@ def cachePipeline(ctx, name, steps):
                 "event": ["push", "manual"],
                 "branch": ["main", "stable-*"],
             },
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -555,7 +584,12 @@ def testPipelines(ctx):
     if "skip" not in config["apiTests"] or not config["apiTests"]["skip"]:
         pipelines += apiTests(ctx)
 
-    pipelines += e2eTestPipeline(ctx) + multiServiceE2ePipeline(ctx)
+    enable_watch_fs = [False]
+    if ctx.build.event == "cron" or "full-ci" in ctx.build.title.lower():
+        enable_watch_fs.append(True)
+
+    for run_with_watch_fs_enabled in enable_watch_fs:
+        pipelines += e2eTestPipeline(ctx, run_with_watch_fs_enabled) + multiServiceE2ePipeline(ctx, run_with_watch_fs_enabled)
 
     if ("skip" not in config["k6LoadTests"] or not config["k6LoadTests"]["skip"]) and ("k6-test" in ctx.build.title.lower() or ctx.build.event == "cron"):
         pipelines += k6LoadTests(ctx)
@@ -569,6 +603,7 @@ def getGoBinForTesting(ctx):
                  cacheGoBin(),
         "when": [
             event["tag"],
+            event["cron"],
             {
                 "event": ["push", "manual"],
                 "branch": ["main", "stable-*"],
@@ -611,7 +646,7 @@ def cacheGoBin():
             "commands": [
                 ". ./.env",
                 "if $BIN_CACHE_FOUND; then exit 0; fi",
-                "tar -czvf %s /go/bin" % dirs["gobinTarPath"],
+                "tar -czf %s /go/bin" % dirs["gobinTarPath"],
             ],
         },
         {
@@ -647,7 +682,7 @@ def restoreGoBinCache():
             "name": "extract-go-bin-cache",
             "image": OC_UBUNTU,
             "commands": [
-                "tar -xvmf %s -C /" % dirs["gobinTarPath"],
+                "tar -xmf %s -C /" % dirs["gobinTarPath"],
             ],
         },
     ]
@@ -664,10 +699,36 @@ def testOpencloud(ctx):
             ],
             "environment": CI_HTTP_PROXY_ENV,
         },
+        {
+            "name": "open-search",
+            "image": OPEN_SEARCH,
+            "detach": True,
+            "environment": {
+                "discovery.type": "single-node",
+                "DISABLE_INSTALL_DEMO_CONFIG": True,
+                "DISABLE_SECURITY_PLUGIN": True,
+            },
+            "entrypoint": ["/usr/share/opensearch/opensearch-docker-entrypoint.sh", "opensearch"],
+        },
+        {
+            "name": "wait-for-open-search",
+            "image": OC_CI_ALPINE,
+            "commands": [
+                "bash -c '" +
+                "until curl -sS \"http://open-search:9200/_cat/health?h=status\" | grep \"green\\|yellow\"; do\n" +
+                "  echo \"Waiting for http://open-search:9200 to be healthy...\"\n" +
+                "  sleep 5\n" +
+                "done\n" +
+                "echo \"http://open-search:9200 healthy...\"\n" +
+                "'",
+            ],
+        },
         {
             "name": "test",
             "image": OC_CI_GOLANG,
-            "environment": CI_HTTP_PROXY_ENV,
+            "environment": {
+                "SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES": "http://open-search:9200",
+            },
             "commands": [
                 "mkdir -p cache/coverage",
                 "make test",
@@ -698,6 +759,7 @@ def testOpencloud(ctx):
         "steps": steps,
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -726,6 +788,7 @@ def scanOpencloud(ctx):
         "steps": steps,
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -746,6 +809,7 @@ def buildOpencloudBinaryForTesting(ctx):
                  rebuildBuildArtifactCache(ctx, dirs["opencloudBinArtifact"], dirs["opencloudBinPath"]),
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -794,6 +858,7 @@ def checkTestSuitesInExpectedFailures(ctx):
         ],
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -818,6 +883,7 @@ def checkGherkinLint(ctx):
         ],
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -886,6 +952,7 @@ def codestyle(ctx):
                 "depends_on": [],
                 "when": [
                     event["base"],
+                    event["cron"],
                     {
                         "event": "pull_request",
                         "path": {
@@ -903,8 +970,10 @@ def localApiTestPipeline(ctx):
     pipelines = []
 
     with_remote_php = [True]
+    enable_watch_fs = [False]
     if ctx.build.event == "cron" or "full-ci" in ctx.build.title.lower():
         with_remote_php.append(False)
+        enable_watch_fs.append(True)
 
     storages = ["posix"]
     if "[decomposed]" in ctx.build.title.lower():
@@ -913,7 +982,7 @@ def localApiTestPipeline(ctx):
     defaults = {
         "suites": {},
         "skip": False,
-        "extraEnvironment": {},
+        "extraTestEnvironment": {},
         "extraServerEnvironment": {},
         "storages": storages,
         "accounts_hash_difficulty": 4,
@@ -924,6 +993,8 @@ def localApiTestPipeline(ctx):
         "collaborationServiceNeeded": False,
         "extraCollaborationEnvironment": {},
         "withRemotePhp": with_remote_php,
+        "enableWatchFs": enable_watch_fs,
+        "ldapNeeded": False,
     }
 
     if "localApiTests" in config:
@@ -934,33 +1005,37 @@ def localApiTestPipeline(ctx):
                     params[item] = matrix[item] if item in matrix else defaults[item]
                 for storage in params["storages"]:
                     for run_with_remote_php in params["withRemotePhp"]:
-                        pipeline = {
-                            "name": "%s-%s%s-%s" % ("CLI" if name.startswith("cli") else "API", name, "-withoutRemotePhp" if not run_with_remote_php else "", "decomposed" if name.startswith("cli") else storage),
-                            "steps": restoreBuildArtifactCache(ctx, dirs["opencloudBinArtifact"], dirs["opencloudBinPath"]) +
-                                     (tikaService() if params["tikaNeeded"] else []) +
-                                     (waitForServices("online-offices", ["collabora:9980", "onlyoffice:443", "fakeoffice:8080"]) if params["collaborationServiceNeeded"] else []) +
-                                     (waitForClamavService() if params["antivirusNeeded"] else []) +
-                                     (waitForEmailService() if params["emailNeeded"] else []) +
-                                     opencloudServer(storage, params["accounts_hash_difficulty"], extra_server_environment = params["extraServerEnvironment"], with_wrapper = True, tika_enabled = params["tikaNeeded"]) +
-                                     (opencloudServer(storage, params["accounts_hash_difficulty"], deploy_type = "federation", extra_server_environment = params["extraServerEnvironment"]) if params["federationServer"] else []) +
-                                     ((wopiCollaborationService("fakeoffice") + wopiCollaborationService("collabora") + wopiCollaborationService("onlyoffice")) if params["collaborationServiceNeeded"] else []) +
-                                     (openCloudHealthCheck("wopi", ["wopi-collabora:9304", "wopi-onlyoffice:9304", "wopi-fakeoffice:9304"]) if params["collaborationServiceNeeded"] else []) +
-                                     localApiTests(name, params["suites"], storage, params["extraEnvironment"], run_with_remote_php) +
-                                     logRequests(),
-                            "services": (emailService() if params["emailNeeded"] else []) +
-                                        (clamavService() if params["antivirusNeeded"] else []) +
-                                        ((fakeOffice() + collaboraService() + onlyofficeService()) if params["collaborationServiceNeeded"] else []),
-                            "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
-                            "when": [
-                                event["base"],
-                                {
-                                    "event": "pull_request",
-                                    "path": {
-                                        "exclude": skipIfUnchanged(ctx, "acceptance-tests"),
+                        for run_with_watch_fs_enabled in params["enableWatchFs"]:
+                            pipeline = {
+                                "name": "%s-%s%s-%s%s" % ("CLI" if name.startswith("cli") else "API", name, "-withoutRemotePhp" if not run_with_remote_php else "", "decomposed" if name.startswith("cli") else storage, "-watchfs" if run_with_watch_fs_enabled else ""),
+                                "steps": restoreBuildArtifactCache(ctx, dirs["opencloudBinArtifact"], dirs["opencloudBinPath"]) +
+                                         (tikaService() if params["tikaNeeded"] else []) +
+                                         (waitForServices("online-offices", ["collabora:9980", "onlyoffice:443", "fakeoffice:8080"]) if params["collaborationServiceNeeded"] else []) +
+                                         (waitForClamavService() if params["antivirusNeeded"] else []) +
+                                         (waitForEmailService() if params["emailNeeded"] else []) +
+                                         (ldapService() if params["ldapNeeded"] else []) +
+                                         (waitForLdapService() if params["ldapNeeded"] else []) +
+                                         opencloudServer(storage, params["accounts_hash_difficulty"], extra_server_environment = params["extraServerEnvironment"], with_wrapper = True, tika_enabled = params["tikaNeeded"], watch_fs_enabled = run_with_watch_fs_enabled) +
+                                         (opencloudServer(storage, params["accounts_hash_difficulty"], deploy_type = "federation", extra_server_environment = params["extraServerEnvironment"], watch_fs_enabled = run_with_watch_fs_enabled) if params["federationServer"] else []) +
+                                         ((wopiCollaborationService("fakeoffice") + wopiCollaborationService("collabora") + wopiCollaborationService("onlyoffice")) if params["collaborationServiceNeeded"] else []) +
+                                         (openCloudHealthCheck("wopi", ["wopi-collabora:9304", "wopi-onlyoffice:9304", "wopi-fakeoffice:9304"]) if params["collaborationServiceNeeded"] else []) +
+                                         localApiTests(name, params["suites"], storage, params["extraTestEnvironment"], run_with_remote_php) +
+                                         logRequests(),
+                                "services": (emailService() if params["emailNeeded"] else []) +
+                                            (clamavService() if params["antivirusNeeded"] else []) +
+                                            ((fakeOffice() + collaboraService() + onlyofficeService()) if params["collaborationServiceNeeded"] else []),
+                                "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
+                                "when": [
+                                    event["base"],
+                                    event["cron"],
+                                    {
+                                        "event": "pull_request",
+                                        "path": {
+                                            "exclude": skipIfUnchanged(ctx, "acceptance-tests"),
+                                        },
                                     },
-                                },
-                            ],
-                        }
+                                ],
+                            }
                         pipelines.append(pipeline)
     return pipelines
 
@@ -1017,6 +1092,7 @@ def cs3ApiTests(ctx, storage, accounts_hash_difficulty = 4):
         "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -1130,6 +1206,7 @@ def wopiValidatorTests(ctx, storage, wopiServerType, accounts_hash_difficulty =
         "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -1139,7 +1216,7 @@ def wopiValidatorTests(ctx, storage, wopiServerType, accounts_hash_difficulty =
         ],
     }
 
-def coreApiTests(ctx, part_number = 1, number_of_parts = 1, with_remote_php = False, accounts_hash_difficulty = 4):
+def coreApiTests(ctx, part_number = 1, number_of_parts = 1, with_remote_php = False, accounts_hash_difficulty = 4, watch_fs_enabled = False):
     storage = "posix"
     if "[decomposed]" in ctx.build.title.lower():
         storage = "decomposed"
@@ -1148,9 +1225,9 @@ def coreApiTests(ctx, part_number = 1, number_of_parts = 1, with_remote_php = Fa
     expected_failures_file = "%s/expected-failures-API-on-%s-storage.md" % (test_dir, storage)
 
     return {
-        "name": "Core-API-Tests-%s%s-%s" % (part_number, "-withoutRemotePhp" if not with_remote_php else "", storage),
+        "name": "Core-API-Tests-%s%s-%s%s" % (part_number, "-withoutRemotePhp" if not with_remote_php else "", storage, "-watchfs" if watch_fs_enabled else ""),
         "steps": restoreBuildArtifactCache(ctx, dirs["opencloudBinArtifact"], dirs["opencloudBinPath"]) +
-                 opencloudServer(storage, accounts_hash_difficulty, with_wrapper = True) +
+                 opencloudServer(storage, accounts_hash_difficulty, with_wrapper = True, watch_fs_enabled = watch_fs_enabled) +
                  [
                      {
                          "name": "oC10ApiTests-%s" % part_number,
@@ -1181,6 +1258,7 @@ def coreApiTests(ctx, part_number = 1, number_of_parts = 1, with_remote_php = Fa
         "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
         "when": [
             event["base"],
+            event["cron"],
             {
                 "event": "pull_request",
                 "path": {
@@ -1196,21 +1274,25 @@ def apiTests(ctx):
     debugPartsEnabled = (len(debugParts) != 0)
 
     with_remote_php = [True]
+    enable_watch_fs = [False]
     if ctx.build.event == "cron" or "full-ci" in ctx.build.title.lower():
         with_remote_php.append(False)
+        enable_watch_fs.append(True)
 
     defaults = {
         "withRemotePhp": with_remote_php,
+        "enableWatchFs": enable_watch_fs,
     }
 
     for runPart in range(1, config["apiTests"]["numberOfParts"] + 1):
         for run_with_remote_php in defaults["withRemotePhp"]:
-            if not debugPartsEnabled or (debugPartsEnabled and runPart in debugParts):
-                pipelines.append(coreApiTests(ctx, runPart, config["apiTests"]["numberOfParts"], run_with_remote_php))
+            for run_with_watch_fs_enabled in defaults["enableWatchFs"]:
+                if not debugPartsEnabled or (debugPartsEnabled and runPart in debugParts):
+                    pipelines.append(coreApiTests(ctx, runPart, config["apiTests"]["numberOfParts"], run_with_remote_php, watch_fs_enabled = run_with_watch_fs_enabled))
 
     return pipelines
 
-def e2eTestPipeline(ctx):
+def e2eTestPipeline(ctx, watch_fs_enabled = False):
     defaults = {
         "skip": False,
         "suites": [],
@@ -1229,6 +1311,7 @@ def e2eTestPipeline(ctx):
 
     e2e_trigger = [
         event["base"],
+        event["cron"],
         {
             "event": "pull_request",
             "path": {
@@ -1280,7 +1363,7 @@ def e2eTestPipeline(ctx):
             restoreWebPnpmCache() + \
             restoreBrowsersCache() + \
             (tikaService() if params["tikaNeeded"] else []) + \
-            opencloudServer(storage, extra_server_environment = extra_server_environment, tika_enabled = params["tikaNeeded"])
+            opencloudServer(storage, extra_server_environment = extra_server_environment, tika_enabled = params["tikaNeeded"], watch_fs_enabled = watch_fs_enabled)
 
         step_e2e = {
             "name": "e2e-tests",
@@ -1312,7 +1395,7 @@ def e2eTestPipeline(ctx):
                     "bash run-e2e.sh %s --run-part %d" % (e2e_args, run_part),
                 ]
                 pipelines.append({
-                    "name": "e2e-tests-%s-%s-%s" % (name, run_part, storage),
+                    "name": "e2e-tests-%s-%s-%s%s" % (name, run_part, storage, "-watchfs" if watch_fs_enabled else ""),
                     "steps": steps_before + [run_e2e] + steps_after,
                     "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx) + buildWebCache(ctx)),
                     "when": e2e_trigger,
@@ -1320,7 +1403,7 @@ def e2eTestPipeline(ctx):
         else:
             step_e2e["commands"].append("bash run-e2e.sh %s" % e2e_args)
             pipelines.append({
-                "name": "e2e-tests-%s-%s" % (name, storage),
+                "name": "e2e-tests-%s-%s%s" % (name, storage, "-watchfs" if watch_fs_enabled else ""),
                 "steps": steps_before + [step_e2e] + steps_after,
                 "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx) + buildWebCache(ctx)),
                 "when": e2e_trigger,
@@ -1328,7 +1411,7 @@ def e2eTestPipeline(ctx):
 
     return pipelines
 
-def multiServiceE2ePipeline(ctx):
+def multiServiceE2ePipeline(ctx, watch_fs_enabled = False):
     pipelines = []
 
     defaults = {
@@ -1341,6 +1424,7 @@ def multiServiceE2ePipeline(ctx):
 
     e2e_trigger = [
         event["base"],
+        event["cron"],
         {
             "event": "pull_request",
             "path": {
@@ -1374,6 +1458,9 @@ def multiServiceE2ePipeline(ctx):
         "GRAPH_AVAILABLE_ROLES": "%s" % GRAPH_AVAILABLE_ROLES,
     }
 
+    if watch_fs_enabled:
+        extra_server_environment["STORAGE_USES_POSIX_WATCH_FS"] = True
+
     storage_users_environment = {
         "OC_CORS_ALLOW_ORIGINS": "%s,https://%s:9201" % (OC_URL, OC_SERVER_NAME),
         "STORAGE_USERS_JWT_SECRET": "some-opencloud-jwt-secret",
@@ -1433,6 +1520,7 @@ def multiServiceE2ePipeline(ctx):
             restoreBuildArtifactCache(ctx, dirs["opencloudBinArtifact"], dirs["opencloudBin"]) + \
             restoreWebCache() + \
             restoreWebPnpmCache() + \
+            restoreBrowsersCache() + \
             tikaService() + \
             opencloudServer(storage, extra_server_environment = extra_server_environment, tika_enabled = params["tikaNeeded"]) + \
             storage_users_services + \
@@ -1444,16 +1532,18 @@ def multiServiceE2ePipeline(ctx):
                     "HEADLESS": True,
                     "RETRY": "1",
                     "REPORT_TRACING": params["reportTracing"],
+                    "PLAYWRIGHT_BROWSERS_PATH": "%s/%s" % (dirs["base"], ".playwright"),
+                    "BROWSER": "chromium",
                 },
                 "commands": [
                     "cd %s/tests/e2e" % dirs["web"],
                     "bash run-e2e.sh %s" % e2e_args,
                 ],
-            }]
+            }] + \
+            uploadTracingResult(ctx)
 
-        uploadTracingResult(ctx) + \
         pipelines.append({
-            "name": "e2e-tests-multi-service",
+            "name": "e2e-tests-multi-service%s" % ("-watchfs" if watch_fs_enabled else ""),
             "steps": steps,
             "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx) + buildWebCache(ctx)),
             "when": e2e_trigger,
@@ -1600,6 +1690,7 @@ def dockerRelease(ctx, repo, build_type):
                     ],
                 },
                 "when": [
+                    event["cron"],
                     event["base"],
                     event["tag"],
                 ],
@@ -1607,6 +1698,7 @@ def dockerRelease(ctx, repo, build_type):
         ],
         "depends_on": depends_on,
         "when": [
+            event["cron"],
             event["base"],
             {
                 "event": "pull_request",
@@ -1656,6 +1748,7 @@ def binaryRelease(ctx, arch, depends_on = []):
                     "make -C opencloud release-finish",
                 ],
                 "when": [
+                    event["cron"],
                     event["base"],
                     event["tag"],
                 ],
@@ -1680,6 +1773,7 @@ def binaryRelease(ctx, arch, depends_on = []):
         ],
         "depends_on": depends_on,
         "when": [
+            event["cron"],
             event["base"],
             {
                 "event": "pull_request",
@@ -1810,6 +1904,7 @@ def releaseDockerReadme(repo, build_type):
             },
         ],
         "when": [
+            event["cron"],
             event["base"],
             event["tag"],
         ],
@@ -1850,38 +1945,56 @@ def makeGoGenerate(module):
         },
     ]
 
-def notify(ctx):
-    status = ["failure"]
-    channel = config["rocketchat"]["channel"]
-    if ctx.build.event == "cron":
-        status.append("success")
-        channel = config["rocketchat"]["channel_cron"]
-
-    return {
+def notifyMatrix(ctx):
+    result = [{
         "name": "chat-notifications",
         "skip_clone": True,
+        "runs_on": ["success", "failure"],
+        "depends_on": getPipelineNames(testPipelines(ctx)),
         "steps": [
             {
-                "name": "notify-rocketchat",
-                "image": PLUGINS_SLACK,
-                "settings": {
-                    "webhook": {},
-                    "channel": channel,
+                "name": "notify-matrix",
+                "image": OC_CI_GOLANG,
+                "environment": {
+                    "HTTP_PROXY": {
+                        "from_secret": "ci_http_proxy",
+                    },
+                    "HTTPS_PROXY": {
+                        "from_secret": "ci_http_proxy",
+                    },
+                    "MATRIX_HOME_SERVER": "matrix.org",
+                    "MATRIX_ROOM_ALIAS": {
+                        "from_secret": "opencloud-notifications-channel",
+                    },
+                    "MATRIX_USER": {
+                        "from_secret": "opencloud-notifications-user",
+                    },
+                    "MATRIX_PASSWORD": {
+                        "from_secret": "opencloud-notifications-user-password",
+                    },
+                    "QA_REPO": "https://github.com/opencloud-eu/qa.git",
+                    "QA_REPO_BRANCH": "main",
+                    "CI_WOODPECKER_URL": "https://ci.opencloud.eu/",
+                    "CI_REPO_ID": "3",
+                    "CI_WOODPECKER_TOKEN": "no-auth-needed-on-this-repo",
                 },
+                "commands": [
+                    "git clone --single-branch --branch $QA_REPO_BRANCH $QA_REPO /tmp/qa",
+                    "cd /tmp/qa/scripts/matrix-notification/",
+                    "go run matrix-notification.go",
+                ],
             },
         ],
-        "depends_on": [],
         "when": [
-            {
-                "event": ["push", "manual"],
-                "branch": ["main", "release-*"],
-            },
-            event["tag"],
+            event["cron"],
+            event["base"],
+            event["pull_request"],
         ],
-        "runs_on": status,
-    }
+    }]
 
-def opencloudServer(storage = "decomposed", accounts_hash_difficulty = 4, depends_on = [], deploy_type = "", extra_server_environment = {}, with_wrapper = False, tika_enabled = False):
+    return result
+
+def opencloudServer(storage = "decomposed", accounts_hash_difficulty = 4, depends_on = [], deploy_type = "", extra_server_environment = {}, with_wrapper = False, tika_enabled = False, watch_fs_enabled = False):
     user = "0:0"
     container_name = OC_SERVER_NAME
     environment = {
@@ -1974,6 +2087,9 @@ def opencloudServer(storage = "decomposed", accounts_hash_difficulty = 4, depend
         environment["SEARCH_EXTRACTOR_TIKA_TIKA_URL"] = "http://tika:9998"
         environment["SEARCH_EXTRACTOR_CS3SOURCE_INSECURE"] = True
 
+    if watch_fs_enabled:
+        environment["STORAGE_USES_POSIX_WATCH_FS"] = True
+
     # Pass in "default" accounts_hash_difficulty to not set this environment variable.
     # That will allow OpenCloud to use whatever its built-in default is.
     # Otherwise pass in a value from 4 to about 11 or 12 (default 4, for making regular tests fast)
@@ -2020,7 +2136,7 @@ def opencloudServer(storage = "decomposed", accounts_hash_difficulty = 4, depend
         },
         "commands": [
             "apt-get update",
-            "apt-get install -y inotify-tools",
+            "apt-get install -y inotify-tools xattr",
             "%s init --insecure true" % dirs["opencloudBin"],
             "cat $OC_CONFIG_DIR/opencloud.yaml",
             "cp tests/config/woodpecker/app-registry.yaml $OC_CONFIG_DIR/app-registry.yaml",
@@ -2279,6 +2395,7 @@ def checkStarlark(ctx):
         ],
         "depends_on": [],
         "when": [
+            event["cron"],
             event["base"],
             {
                 "event": "pull_request",
@@ -2342,6 +2459,7 @@ def genericCachePurge(flush_path):
             },
         ],
         "when": [
+            event["cron"],
             event["base"],
             event["pull_request"],
         ],
@@ -2522,6 +2640,7 @@ def litmus(ctx, storage):
         "services": redisForOCStorage(storage),
         "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx)),
         "when": [
+            event["cron"],
             event["base"],
             {
                 "event": "pull_request",
@@ -2710,7 +2829,7 @@ def generateWebCache(ctx):
                 ". ./.woodpecker.env",
                 "if $WEB_CACHE_FOUND; then exit 0; fi",
                 "if [ ! -d '%s' ]; then mkdir -p %s; fi" % (dirs["zip"], dirs["zip"]),
-                "tar -czvf %s webTestRunner" % dirs["webZip"],
+                "tar -czf %s webTestRunner" % dirs["webZip"],
             ],
         },
         {
@@ -2743,7 +2862,7 @@ def restoreWebCache():
         "name": "unzip-web-cache",
         "image": OC_UBUNTU,
         "commands": [
-            "tar -xvf %s -C ." % dirs["webZip"],
+            "tar -xf %s -C ." % dirs["webZip"],
         ],
     }]
 
@@ -2764,7 +2883,7 @@ def restoreWebPnpmCache(extra_commands = []):
         "commands": extra_commands + [
             "cd %s" % dirs["web"],
             "rm -rf .pnpm-store",
-            "tar -xvf %s" % dirs["webPnpmZip"],
+            "tar -xf %s" % dirs["webPnpmZip"],
             'npm install --silent --global --force "$(jq -r ".packageManager" < package.json)"',
             "pnpm config set store-dir ./.pnpm-store",
             "for i in $(seq 3); do pnpm install --no-frozen-lockfile && break || sleep 1; done",
@@ -2788,7 +2907,7 @@ def restoreBrowsersCache():
             "name": "unzip-browsers-cache",
             "image": OC_UBUNTU,
             "commands": [
-                "tar -xvf /woodpecker/src/github.com/opencloud-eu/opencloud/webTestRunner/playwright-browsers.tar.gz -C .",
+                "tar -xf /woodpecker/src/github.com/opencloud-eu/opencloud/webTestRunner/playwright-browsers.tar.gz -C .",
             ],
         },
     ]
@@ -2823,6 +2942,49 @@ def waitForClamavService():
         ],
     }]
 
+def ldapService():
+    return [
+        {
+            "name": "ldap-server",
+            "image": OPENLDAP,
+            "detach": True,
+            "environment": {
+                "BITNAMI_DEBUG": "true",
+                "LDAP_TLS_VERIFY_CLIENT": "never",
+                "LDAP_ENABLE_TLS": "yes",
+                "LDAP_TLS_CA_FILE": "/opt/bitnami/openldap/share/openldap.crt",
+                "LDAP_TLS_CERT_FILE": "/opt/bitnami/openldap/share/openldap.crt",
+                "LDAP_TLS_KEY_FILE": "/opt/bitnami/openldap/share/openldap.key",
+                "LDAP_ROOT": "dc=opencloud,dc=eu",
+                "LDAP_ADMIN_PASSWORD": "admin",
+            },
+            "commands": [
+                "mkdir -p /opt/bitnami/openldap/share",
+                "mkdir -p /tmp/custom-scripts",
+                "mkdir -p /tmp/ldif-files",
+                "cp tests/config/woodpecker/ldap/*.ldif /tmp/ldif-files/",
+                "cp tests/config/woodpecker/ldap/docker-entrypoint-override.sh /tmp/custom-scripts/",
+                "chmod +x /tmp/custom-scripts/docker-entrypoint-override.sh",
+                "ls -la /tmp/ldif-files/",
+                "/tmp/custom-scripts/docker-entrypoint-override.sh /opt/bitnami/scripts/openldap/run.sh",
+            ],
+            "backend_options": {
+                "docker": {
+                    "user": "0:0",
+                },
+            },
+        },
+    ]
+
+def waitForLdapService():
+    return [{
+        "name": "wait-for-ldap",
+        "image": OC_CI_WAIT_FOR,
+        "commands": [
+            "wait-for -it ldap-server:1636 -t 600",
+        ],
+    }]
+
 def fakeOffice():
     return [
         {

CHANGELOG.md

@@ -1,5 +1,88 @@
 # Changelog
 
+## [3.4.0](https://github.com/opencloud-eu/opencloud/releases/tag/v3.4.0) - 2025-09-02
+
+### ❤️ Thanks to all contributors! ❤️
+
+@ScharfViktor, @butonic, @dragonchaser, @fschade, @individual-it, @kulmann, @pbleser-oc, @prashant-gurung899, @rhafer, @tammi-23, @tylerlm
+
+### ✨ Features
+
+- feat: added capability for Edit Login Allowed [[#1406](https://github.com/opencloud-eu/opencloud/pull/1406)]
+- Search-service: add opensearch as distributed search backend [[#1290](https://github.com/opencloud-eu/opencloud/pull/1290)]
+- initial skel for user soft delete [[#1344](https://github.com/opencloud-eu/opencloud/pull/1344)]
+
+### 🐛 Bug Fixes
+
+- fix(antivirus): the file bytesize differs if the file is larger than … [[#1408](https://github.com/opencloud-eu/opencloud/pull/1408)]
+- Correct app store URL [[#1412](https://github.com/opencloud-eu/opencloud/pull/1412)]
+- ack tag events [[#1381](https://github.com/opencloud-eu/opencloud/pull/1381)]
+- fix(proxy): First login fails in auto provision setups [[#1353](https://github.com/opencloud-eu/opencloud/pull/1353)]
+
+### 📈 Enhancement
+
+- directly connect to frontend [[#1373](https://github.com/opencloud-eu/opencloud/pull/1373)]
+- Dockerfile cleanup [[#1352](https://github.com/opencloud-eu/opencloud/pull/1352)]
+- feat: add defaultAppId option for the web config.json [[#1354](https://github.com/opencloud-eu/opencloud/pull/1354)]
+
+### ✅ Tests
+
+- tests for collaborativePosixFS [[#1342](https://github.com/opencloud-eu/opencloud/pull/1342)]
+- [full-ci] add pipeline to send CI notifications to matrix [[#1249](https://github.com/opencloud-eu/opencloud/pull/1249)]
+
+### 📦️ Dependencies
+
+- [decomposed] bump-version-v3.4.0 [[#1442](https://github.com/opencloud-eu/opencloud/pull/1442)]
+- [full-ci] revaBump-2.37.0 [[#1433](https://github.com/opencloud-eu/opencloud/pull/1433)]
+- Use bitnamilegacy [[#1418](https://github.com/opencloud-eu/opencloud/pull/1418)]
+- build(deps): bump github.com/nats-io/nats.go from 1.44.0 to 1.45.0 [[#1401](https://github.com/opencloud-eu/opencloud/pull/1401)]
+- build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 [[#1400](https://github.com/opencloud-eu/opencloud/pull/1400)]
+- build(deps): bump github.com/olekukonko/tablewriter from 1.0.8 to 1.0.9 [[#1376](https://github.com/opencloud-eu/opencloud/pull/1376)]
+- build(deps): bump github.com/onsi/ginkgo/v2 from 2.24.0 to 2.25.1 [[#1396](https://github.com/opencloud-eu/opencloud/pull/1396)]
+- [full-ci] Bump reva to latest main [[#1372](https://github.com/opencloud-eu/opencloud/pull/1372)]
+- build(deps): bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 [[#1385](https://github.com/opencloud-eu/opencloud/pull/1385)]
+- build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 [[#1375](https://github.com/opencloud-eu/opencloud/pull/1375)]
+- build(deps): bump github.com/gookit/config/v2 from 2.2.6 to 2.2.7 [[#1359](https://github.com/opencloud-eu/opencloud/pull/1359)]
+- build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 [[#1356](https://github.com/opencloud-eu/opencloud/pull/1356)]
+- chore(dependencies): bump reva 19625996460b2e68da3bbaf539e554366c59e111 [[#1357](https://github.com/opencloud-eu/opencloud/pull/1357)]
+- build(deps): bump golang.org/x/image from 0.28.0 to 0.30.0 [[#1323](https://github.com/opencloud-eu/opencloud/pull/1323)]
+- build(deps): bump github.com/nats-io/nats-server/v2 from 2.11.6 to 2.11.7 [[#1339](https://github.com/opencloud-eu/opencloud/pull/1339)]
+- build(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 [[#1266](https://github.com/opencloud-eu/opencloud/pull/1266)]
+
+## [3.3.0](https://github.com/opencloud-eu/opencloud/releases/tag/v3.3.0) - 2025-08-12
+
+### ❤️ Thanks to all contributors! ❤️
+
+@ScharfViktor, @aduffeck, @michaelstingl
+
+### ✨ Features
+
+- Tenant [[#1274](https://github.com/opencloud-eu/opencloud/pull/1274)]
+
+### 📈 Enhancement
+
+- chore: bump web to v3.3.0 [[#1329](https://github.com/opencloud-eu/opencloud/pull/1329)]
+
+### ✅ Tests
+
+- multiTenancyTests [[#1313](https://github.com/opencloud-eu/opencloud/pull/1313)]
+
+### 📚 Documentation
+
+- Fix posix driver documentation in STORAGE_USERS_DRIVER description [[#1305](https://github.com/opencloud-eu/opencloud/pull/1305)]
+
+### 🐛 Bug Fixes
+
+- Improve indexing performance using batches [[#1306](https://github.com/opencloud-eu/opencloud/pull/1306)]
+- Do not run the timout func if the work func has run [[#1302](https://github.com/opencloud-eu/opencloud/pull/1302)]
+- Make sure to register prometheus collectors only once [[#1295](https://github.com/opencloud-eu/opencloud/pull/1295)]
+
+### 📦️ Dependencies
+
+- [decomposed] bump-version-v3.3.0 [[#1332](https://github.com/opencloud-eu/opencloud/pull/1332)]
+- [full-ci] Reva bump 2.36.0 [[#1328](https://github.com/opencloud-eu/opencloud/pull/1328)]
+- Bump reva [[#1315](https://github.com/opencloud-eu/opencloud/pull/1315)]
+
 ## [3.2.1](https://github.com/opencloud-eu/opencloud/releases/tag/v3.2.1) - 2025-07-30
 
 ### ❤️ Thanks to all contributors! ❤️

deployments/examples/opencloud_full/ldap.yml

@@ -26,7 +26,7 @@ services:
       OC_EXCLUDE_RUN_SERVICES: idm
 
   ldap-server:
-    image: bitnami/openldap:2.6
+    image: bitnamilegacy/openldap:2.6
     networks:
       opencloud-net:
     entrypoint: ["/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]

go.mod

@@ -13,8 +13,8 @@ require (
 	github.com/beevik/etree v1.5.1
 	github.com/blevesearch/bleve/v2 v2.5.2
 	github.com/cenkalti/backoff v2.2.1+incompatible
-	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/cs3org/go-cs3apis v0.0.0-20250703154118-810365dec814
+	github.com/coreos/go-oidc/v3 v3.15.0
+	github.com/cs3org/go-cs3apis v0.0.0-20250725064958-2d9caef4db2a
 	github.com/davidbyttow/govips/v2 v2.16.0
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
@@ -23,6 +23,7 @@ require (
 	github.com/ggwhite/go-masker v1.1.0
 	github.com/go-chi/chi/v5 v5.2.2
 	github.com/go-chi/render v1.0.3
+	github.com/go-jose/go-jose/v3 v3.0.4
 	github.com/go-ldap/ldap/v3 v3.4.11
 	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3
 	github.com/go-micro/plugins/v4/client/grpc v1.2.1
@@ -35,12 +36,12 @@ require (
 	github.com/go-micro/plugins/v4/wrapper/trace/opentelemetry v1.2.0
 	github.com/go-playground/validator/v10 v10.27.0
 	github.com/gofrs/uuid v4.4.0+incompatible
-	github.com/golang-jwt/jwt/v5 v5.2.3
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/golang/protobuf v1.5.4
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-tika v0.3.1
 	github.com/google/uuid v1.6.0
-	github.com/gookit/config/v2 v2.2.6
+	github.com/gookit/config/v2 v2.2.7
 	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1
 	github.com/invopop/validation v0.8.0
@@ -55,20 +56,21 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/mna/pigeon v1.3.0
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
-	github.com/nats-io/nats-server/v2 v2.11.6
-	github.com/nats-io/nats.go v1.43.0
+	github.com/nats-io/nats-server/v2 v2.11.7
+	github.com/nats-io/nats.go v1.45.0
 	github.com/oklog/run v1.2.0
-	github.com/olekukonko/tablewriter v1.0.8
+	github.com/olekukonko/tablewriter v1.0.9
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.23.4
-	github.com/onsi/gomega v1.37.0
+	github.com/onsi/ginkgo/v2 v2.25.2
+	github.com/onsi/gomega v1.38.2
 	github.com/open-policy-agent/opa v1.6.0
 	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76
-	github.com/opencloud-eu/reva/v2 v2.35.0
+	github.com/opencloud-eu/reva/v2 v2.37.0
+	github.com/opensearch-project/opensearch-go/v4 v4.5.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
-	github.com/prometheus/client_golang v1.22.0
+	github.com/prometheus/client_golang v1.23.0
 	github.com/r3labs/sse/v2 v2.10.0
 	github.com/riandyrn/otelchi v0.12.1
 	github.com/rogpeppe/go-internal v1.14.1
@@ -77,11 +79,14 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.14.0
 	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.0
 	github.com/test-go/testify v1.1.4
+	github.com/testcontainers/testcontainers-go v0.38.0
+	github.com/testcontainers/testcontainers-go/modules/opensearch v0.38.0
 	github.com/theckman/yacspin v0.13.12
 	github.com/thejerf/suture/v4 v4.0.6
 	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/sjson v1.2.5
 	github.com/tus/tusd/v2 v2.8.0
 	github.com/unrolled/secure v1.16.0
 	github.com/urfave/cli/v2 v2.27.7
@@ -97,17 +102,17 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0
 	go.opentelemetry.io/otel/sdk v1.37.0
 	go.opentelemetry.io/otel/trace v1.37.0
-	golang.org/x/crypto v0.40.0
+	golang.org/x/crypto v0.41.0
 	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac
-	golang.org/x/image v0.28.0
-	golang.org/x/net v0.42.0
+	golang.org/x/image v0.30.0
+	golang.org/x/net v0.43.0
 	golang.org/x/oauth2 v0.30.0
 	golang.org/x/sync v0.16.0
-	golang.org/x/term v0.33.0
-	golang.org/x/text v0.27.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822
-	google.golang.org/grpc v1.74.0
-	google.golang.org/protobuf v1.36.6
+	golang.org/x/term v0.34.0
+	golang.org/x/text v0.28.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7
+	google.golang.org/grpc v1.75.0
+	google.golang.org/protobuf v1.36.8
 	gopkg.in/yaml.v2 v2.4.0
 	gotest.tools/v3 v3.5.2
 	stash.kopano.io/kgol/rndm v1.1.2
@@ -116,9 +121,11 @@ require (
 require (
 	contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.1.5 // indirect
@@ -129,7 +136,6 @@ require (
 	github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go v1.55.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitly/go-simplejson v0.5.0 // indirect
 	github.com/bits-and-blooms/bitset v1.22.0 // indirect
@@ -152,14 +158,20 @@ require (
 	github.com/blevesearch/zapx/v16 v16.2.4 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
-	github.com/ceph/go-ceph v0.34.0 // indirect
+	github.com/ceph/go-ceph v0.35.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cevaris/ordered_map v0.0.0-20190319150403-3adeae072e73 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v1.0.0-rc.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/cornelk/hashmap v1.0.8 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/crewjam/httperr v0.2.0 // indirect
 	github.com/crewjam/saml v0.4.14 // indirect
@@ -170,11 +182,16 @@ require (
 	github.com/dgraph-io/ristretto v0.2.0 // indirect
 	github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/distribution/reference v0.6.0 // indirect
 	github.com/dlclark/regexp2 v1.4.0 // indirect
+	github.com/docker/docker v28.2.2+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/egirna/icap v0.0.0-20181108071049-d5ee18bd70bc // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/emvi/iso-639-1 v1.1.0 // indirect
+	github.com/emvi/iso-639-1 v1.1.1 // indirect
 	github.com/evanphx/json-patch/v5 v5.5.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -186,8 +203,7 @@ require (
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-git/go-git/v5 v5.13.2 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -195,6 +211,7 @@ require (
 	github.com/go-micro/plugins/v4/events/natsjs v1.2.2 // indirect
 	github.com/go-micro/plugins/v4/store/nats-js v1.2.1 // indirect
 	github.com/go-micro/plugins/v4/store/redis v1.2.1 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.5 // indirect
@@ -203,6 +220,7 @@ require (
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-test/deep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
@@ -219,82 +237,94 @@ require (
 	github.com/google/go-tpm v0.9.5 // indirect
 	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/renameio/v2 v2.0.0 // indirect
-	github.com/gookit/color v1.5.4 // indirect
-	github.com/gookit/goutil v0.6.18 // indirect
+	github.com/gookit/goutil v0.7.1 // indirect
 	github.com/gorilla/handlers v1.5.1 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
-	github.com/hashicorp/go-plugin v1.6.3 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/go-plugin v1.7.0 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/iancoleman/strcase v0.3.0 // indirect
 	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/juliangruber/go-intersect v1.1.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/libregraph/oidc-go v1.1.0 // indirect
 	github.com/longsleep/go-metrics v1.0.0 // indirect
 	github.com/longsleep/rndm v1.2.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mattn/go-sqlite3 v1.14.28 // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/maxymania/go-system v0.0.0-20170110133659-647cc364bf0b // indirect
 	github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103 // indirect
 	github.com/miekg/dns v1.1.57 // indirect
 	github.com/mileusna/useragent v1.3.5 // indirect
-	github.com/minio/crc64nvme v1.0.1 // indirect
+	github.com/minio/crc64nvme v1.0.2 // indirect
 	github.com/minio/highwayhash v1.0.3 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.0.94 // indirect
+	github.com/minio/minio-go/v7 v7.0.95 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nats-io/jwt/v2 v2.7.4 // indirect
 	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
-	github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6 // indirect
-	github.com/olekukonko/ll v0.0.8 // indirect
+	github.com/olekukonko/errors v1.1.0 // indirect
+	github.com/olekukonko/ll v0.0.9 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
 	github.com/pablodz/inotifywaitgo v0.0.9 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
-	github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
 	github.com/prometheus/alertmanager v0.28.1 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/prometheus/statsd_exporter v0.22.8 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/segmentio/kafka-go v0.4.48 // indirect
+	github.com/segmentio/kafka-go v0.4.49 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/sercand/kuberesolver/v5 v5.1.1 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/sethvargo/go-diceware v0.5.0 // indirect
 	github.com/sethvargo/go-password v0.3.1 // indirect
 	github.com/shamaton/msgpack/v2 v2.2.3 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.5 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 // indirect
 	github.com/skeema/knownhosts v1.3.0 // indirect
@@ -306,6 +336,8 @@ require (
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.14 // indirect
+	github.com/tklauser/numcpus v0.8.0 // indirect
 	github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208 // indirect
 	github.com/trustelem/zxcvbn v1.0.1 // indirect
 	github.com/vektah/gqlparser/v2 v2.5.28 // indirect
@@ -314,12 +346,12 @@ require (
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.2 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.2 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.2 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
@@ -328,13 +360,14 @@ require (
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/mod v0.25.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect

go.sum

@@ -43,7 +43,11 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Acconut/go-httptest-recorder v1.0.0 h1:TAv2dfnqp/l+SUvIaMAUK4GeN4+wqb6KZsFFFTGhoJg=
 github.com/Acconut/go-httptest-recorder v1.0.0/go.mod h1:CwQyhTH1kq/gLyWiRieo7c0uokpu3PXeyF/nZjUNtmM=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest/autorest v0.1.0/go.mod h1:AKyIcETwSUFxIcs/Wnq/C+kwCtlEYGUVd7FPNb2slmg=
 github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
 github.com/Azure/go-autorest/autorest/adal v0.1.0/go.mod h1:MeS4XhScH55IST095THyTxElntu7WqB7pNbZo8Q5G3E=
@@ -74,6 +78,8 @@ github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJ
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig v2.22.0+incompatible h1:z4yfnGrZ7netVz+0EDJ0Wi+5VZCSYp4Z0m2dk6cEM60=
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/MicahParks/keyfunc/v2 v2.1.0 h1:6ZXKb9Rp6qp1bDbJefnG7cTH8yMN1IC/4nf+GVjO99k=
@@ -128,8 +134,6 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkY
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.37.27/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
-github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/bbalet/stopwords v1.0.0 h1:0TnGycCtY0zZi4ltKoOGRFIlZHv0WqpoIGUsObjztfo=
 github.com/bbalet/stopwords v1.0.0/go.mod h1:sAWrQoDMfqARGIn4s6dp7OW7ISrshUD8IP2q3KoqPjc=
 github.com/beevik/etree v1.5.1 h1:TC3zyxYp+81wAmbsi8SWUpZCurbxa6S8RITYRSkNRwo=
@@ -190,8 +194,8 @@ github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dR
 github.com/bombsimon/logrusr/v3 v3.1.0 h1:zORbLM943D+hDMGgyjMhSAz/iDz86ZV72qaak/CA0zQ=
 github.com/bombsimon/logrusr/v3 v3.1.0/go.mod h1:PksPPgSFEL2I52pla2glgCyyd2OqOHAnFF5E+g8Ixco=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
-github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/butonic/go-micro/v4 v4.11.1-0.20241115112658-b5d4de5ed9b3 h1:h8Z0hBv5tg/uZMKu8V47+DKWYVQg0lYP8lXDQq7uRpE=
 github.com/butonic/go-micro/v4 v4.11.1-0.20241115112658-b5d4de5ed9b3/go.mod h1:eE/tD53n3KbVrzrWxKLxdkGw45Fg1qaNLWjpJMvIUF4=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
@@ -200,12 +204,14 @@ github.com/c-bata/go-prompt v0.2.5/go.mod h1:vFnjEGDIIA/Lib7giyE4E9c50Lvl8j0S+7F
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v4 v4.1.0/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
 github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/ceph/go-ceph v0.34.0 h1:C45yU8VRl0Rg+/I0qw5bzT337HG6DL0yBQ0VR6QHv4o=
-github.com/ceph/go-ceph v0.34.0/go.mod h1:otRLwpVgM81lK5zdGYOfr4OELdeS97luDBE/PjXAB5o=
+github.com/ceph/go-ceph v0.35.0 h1:wcDUbsjeNJ7OfbWCE7I5prqUL794uXchopw3IvrGQkk=
+github.com/ceph/go-ceph v0.35.0/go.mod h1:ILF8WKhQQ2p2YuX1oWigkmsfT39U8T/HS2NrqxExq2s=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -221,10 +227,18 @@ github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ
 github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cloudflare/cloudflare-go v0.14.0/go.mod h1:EnwdgGMaFOruiPZRFSgn+TsQ3hQ7C/YWzIGLeu5c304=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v1.0.0-rc.1 h1:83KIq4yy1erSRgOVHNk1HYdPvzdJ5CnsWaRoJX4C41E=
+github.com/containerd/platforms v1.0.0-rc.1/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
+github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
@@ -235,17 +249,21 @@ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfc
 github.com/cornelk/hashmap v1.0.8 h1:nv0AWgw02n+iDcawr5It4CjQIAcdMMKRrs10HOJYlrc=
 github.com/cornelk/hashmap v1.0.8/go.mod h1:RfZb7JO3RviW/rT6emczVuC/oxpdz4UsSB2LJSclR1k=
 github.com/cpu/goacmedns v0.1.1/go.mod h1:MuaouqEhPAHxsbqjgnck5zeghuwBP1dLnPoobeGqugQ=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo=
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
 github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
-github.com/cs3org/go-cs3apis v0.0.0-20250703154118-810365dec814 h1:bo0vg45RDYHOJn33XhfRB830gqrlQJoCQjqUkR2fiAk=
-github.com/cs3org/go-cs3apis v0.0.0-20250703154118-810365dec814/go.mod h1:DedpcqXl193qF/08Y04IO0PpxyyMu8+GrkD6kWK2MEQ=
+github.com/cs3org/go-cs3apis v0.0.0-20250725064958-2d9caef4db2a h1:4IvTz3MUno/nlgngdyZhkyxzJR/w7+H+2ZXoZQKidgg=
+github.com/cs3org/go-cs3apis v0.0.0-20250725064958-2d9caef4db2a/go.mod h1:DedpcqXl193qF/08Y04IO0PpxyyMu8+GrkD6kWK2MEQ=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
 github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM=
 github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
@@ -277,10 +295,18 @@ github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8
 github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8 h1:OtSeLS5y0Uy01jaKK4mA/WVIYtpzVm63vLVAPzJXigg=
 github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8/go.mod h1:apkPC/CR3s48O2D7Y++n1XWEpgPNNCjXYga3PPbJe2E=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.4.0 h1:F1rxgk7p4uKjwIQxBs9oAXe5CqrXlCduYEJvrF4u93E=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/dnsimple/dnsimple-go v0.63.0/go.mod h1:O5TJ0/U6r7AfT8niYNlmohpLbCSG+c71tQlGr9SeGrg=
+github.com/docker/docker v28.2.2+incompatible h1:CjwRSksz8Yo4+RmQ339Dp/D2tGO5JxwYeqtMOEe0LDw=
+github.com/docker/docker v28.2.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e h1:rcHHSQqzCgvlwP0I/fQ8rQMn/MpHE5gWSLdtpxtP6KQ=
@@ -288,14 +314,16 @@ github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e/go.mod h1:Byz
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
+github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/egirna/icap v0.0.0-20181108071049-d5ee18bd70bc h1:6IxmRbXV8WXVkcYcTzkU219A3UZeNMX/e6X2sve1wXA=
 github.com/egirna/icap v0.0.0-20181108071049-d5ee18bd70bc/go.mod h1:FdVN2WHg7zOHhJ7kZQdDorfFhIfqZaHttjAzDDvAXHE=
 github.com/elazarl/goproxy v1.4.0 h1:4GyuSbFa+s26+3rmYNSuUVsx+HgPrV1bk1jXI0l9wjM=
 github.com/elazarl/goproxy v1.4.0/go.mod h1:X/5W/t+gzDyLfHW4DrMdpjqYjpXsURlBt9lpBDxZZZQ=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/emvi/iso-639-1 v1.1.0 h1:EhZiYVA+ysa/b7+0T2DD9hcX7E/5sh4o1KyDAIPu7VE=
-github.com/emvi/iso-639-1 v1.1.0/go.mod h1:CSA53/Tx0xF9bk2DEA0Mr0wTdIxq7pqoVZgBOfoL5GI=
+github.com/emvi/iso-639-1 v1.1.1 h1:7jrl1Sqw9ZYWmCOaH+cpQotLbGr/khwlLPXlBvE8WXU=
+github.com/emvi/iso-639-1 v1.1.1/go.mod h1:CSA53/Tx0xF9bk2DEA0Mr0wTdIxq7pqoVZgBOfoL5GI=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -360,8 +388,8 @@ github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3I
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -430,6 +458,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
 github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobs/pretty v0.0.0-20180724170744-09732c25a95b/go.mod h1:Xo4aNUOrJnVruqWQJBtW6+bTBDTniY8yZum5rF3b5jw=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
@@ -459,8 +489,8 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69
 github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.3 h1:kkGXqQOBSDDWRhWNXTFpqGSCMyh/PLnqUvMGJPDJDs0=
-github.com/golang-jwt/jwt/v5 v5.2.3/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -517,6 +547,7 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -551,14 +582,12 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
-github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
-github.com/gookit/config/v2 v2.2.6 h1:8ZbkSr3gnFg1En8za9X3vldnZca3y3C7kaBLGsdLghE=
-github.com/gookit/config/v2 v2.2.6/go.mod h1:++APDf3Ebj6mjzW1ALkegvg1evQKyx4FpuQqQZ2s2WM=
-github.com/gookit/goutil v0.6.18 h1:MUVj0G16flubWT8zYVicIuisUiHdgirPAkmnfD2kKgw=
-github.com/gookit/goutil v0.6.18/go.mod h1:AY/5sAwKe7Xck+mEbuxj0n/bc3qwrGNe3Oeulln7zBA=
-github.com/gookit/ini/v2 v2.2.3 h1:nSbN+x9OfQPcMObTFP+XuHt8ev6ndv/fWWqxFhPMu2E=
-github.com/gookit/ini/v2 v2.2.3/go.mod h1:Vu6p7P7xcfmb8KYu3L0ek8bqu/Im63N81q208SCCZY4=
+github.com/gookit/config/v2 v2.2.7 h1:P58/uENzkDp7r7Hp8YSZxOhZ/F5a5Y/AzyhDUkQYa9A=
+github.com/gookit/config/v2 v2.2.7/go.mod h1:QST99HmkZXXD/HkZmOm1OXpgdAnc6Rl9syGl+u62Pi8=
+github.com/gookit/goutil v0.7.1 h1:AaFJPN9mrdeYBv8HOybri26EHGCC34WJVT7jUStGJsI=
+github.com/gookit/goutil v0.7.1/go.mod h1:vJS9HXctYTCLtCsZot5L5xF+O1oR17cDYO9R0HxBmnU=
+github.com/gookit/ini/v2 v2.3.2 h1:W6tzOGE6zOLQelH2xhcH8BIBZPtnEpJgQ+J6SsAKBSw=
+github.com/gookit/ini/v2 v2.3.2/go.mod h1:StKSqY5niArRwYBS8Z71+iWUt5ow47qt359sS9YQLYY=
 github.com/gophercloud/gophercloud v0.15.1-0.20210202035223-633d73521055/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075O6i+LY+pXsKCBsb4=
 github.com/gophercloud/gophercloud v0.16.0/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075O6i+LY+pXsKCBsb4=
 github.com/gophercloud/utils v0.0.0-20210216074907-f6de111f2eae/go.mod h1:wx8HMD8oQD0Ryhz6+6ykq75PJ79iPyEqYHfwZ4l7OsA=
@@ -592,8 +621,8 @@ github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVH
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
-github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
@@ -611,8 +640,8 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -648,14 +677,12 @@ github.com/jellydator/ttlcache/v2 v2.11.1/go.mod h1:RtE5Snf0/57e+2cLWFYWCCsLas2H
 github.com/jellydator/ttlcache/v3 v3.4.0 h1:YS4P125qQS0tNhtL6aeYkheEaB/m8HCqdMMP4mnWdTY=
 github.com/jellydator/ttlcache/v3 v3.4.0/go.mod h1:Hw9EgjymziQD3yGsQdf1FqFdpp7YjFMd4Srg5EJlgD4=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
-github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
@@ -683,12 +710,11 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
+github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kobergj/gowebdav v0.0.0-20250102091030-aa65266db202 h1:A1xJ2NKgiYFiaHiLl9B5yw/gUBACSs9crDykTS3GuQI=
 github.com/kobergj/gowebdav v0.0.0-20250102091030-aa65266db202/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
 github.com/kolo/xmlrpc v0.0.0-20200310150728-e0350524596b/go.mod h1:o03bZfuBwAXHetKXuInt4S7omeXUu62/A845kiycsSQ=
@@ -732,8 +758,12 @@ github.com/longsleep/go-metrics v1.0.0 h1:o2A6Dbu4MhLpZuL444WFoZzM7X7igewrj2Mouw
 github.com/longsleep/go-metrics v1.0.0/go.mod h1:w6QO1LBkVla70FZrrF6XcB0YN+jTEYugjkn3+6RYTSM=
 github.com/longsleep/rndm v1.2.0 h1:wPl+kIMyIUTUFW5+2b327DmM1Rlj+gmexsiyOTB7rzM=
 github.com/longsleep/rndm v1.2.0/go.mod h1:5qyvM6CXNteKgz6djqqwZOP4+KcPsewrfKyLWd1dCFY=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
@@ -762,8 +792,8 @@ github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
-github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mattn/go-tty v0.0.0-20180219170247-931426f7535a/go.mod h1:XPvLUNfbS4fJH25nqRHfWLMa1ONC8Amw+mIA639KxkE=
 github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -777,14 +807,14 @@ github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
 github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/mileusna/useragent v1.3.5 h1:SJM5NzBmh/hO+4LGeATKpaEX9+b4vcGg2qXGLiNGDws=
 github.com/mileusna/useragent v1.3.5/go.mod h1:3d8TOmwL/5I8pJjyVDteHtgDGcefrFUX4ccGOMKNYYc=
-github.com/minio/crc64nvme v1.0.1 h1:DHQPrYPdqK7jQG/Ls5CTBZWeex/2FMS3G5XGkycuFrY=
-github.com/minio/crc64nvme v1.0.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/crc64nvme v1.0.2 h1:6uO1UxGAD+kwqWWp7mBFsi5gAse66C4NXO8cmcVculg=
+github.com/minio/crc64nvme v1.0.2/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/highwayhash v1.0.3 h1:kbnuUMoHYyVl7szWjSxJnxw11k2U709jqFPPmIUyD6Q=
 github.com/minio/highwayhash v1.0.3/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.94 h1:1ZoksIKPyaSt64AVOyaQvhDOgVC3MfZsWM6mZXRUGtM=
-github.com/minio/minio-go/v7 v7.0.94/go.mod h1:71t2CqDt3ThzESgZUlU1rBN54mksGGlkLcFgguDnnAc=
+github.com/minio/minio-go/v7 v7.0.95 h1:ywOUPg+PebTMTzn9VDsoFJy32ZuARN9zhB+K3IYEvYU=
+github.com/minio/minio-go/v7 v7.0.95/go.mod h1:wOOX3uxS334vImCNRVyIDdXX9OsXDm89ToynKgqUKlo=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -803,6 +833,22 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mna/pigeon v1.3.0 h1:/3fzVrl1C2RK3x04tyL+ribn+3S3VSEFFbCFLmRPAoc=
 github.com/mna/pigeon v1.3.0/go.mod h1:SKQNHonx2q9U2QSSoPtMigExj+vQ1mOpL7UVFQF/IA0=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -812,6 +858,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -821,10 +869,10 @@ github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRW
 github.com/namedotcom/go v0.0.0-20180403034216-08470befbe04/go.mod h1:5sN+Lt1CaY4wsPvgQH/jsuJi4XO2ssZbdsIizr4CVC8=
 github.com/nats-io/jwt/v2 v2.7.4 h1:jXFuDDxs/GQjGDZGhNgH4tXzSUK6WQi2rsj4xmsNOtI=
 github.com/nats-io/jwt/v2 v2.7.4/go.mod h1:me11pOkwObtcBNR8AiMrUbtVOUGkqYjMQZ6jnSdVUIA=
-github.com/nats-io/nats-server/v2 v2.11.6 h1:4VXRjbTUFKEB+7UoaKL3F5Y83xC7MxPoIONOnGgpkHw=
-github.com/nats-io/nats-server/v2 v2.11.6/go.mod h1:2xoztlcb4lDL5Blh1/BiukkKELXvKQ5Vy29FPVRBUYs=
-github.com/nats-io/nats.go v1.43.0 h1:uRFZ2FEoRvP64+UUhaTokyS18XBCR/xM2vQZKO4i8ug=
-github.com/nats-io/nats.go v1.43.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nats-server/v2 v2.11.7 h1:lINWQ/Hb3cnaoHmWTjj/7WppZnaSh9C/1cD//nHCbms=
+github.com/nats-io/nats-server/v2 v2.11.7/go.mod h1:DchDPVzAsAPqhqm7VLedX0L7hjnV/SYtlmsl9F8U53s=
+github.com/nats-io/nats.go v1.45.0 h1:/wGPbnYXDM0pLKFjZTX+2JOw9TQPoIgTFrUaH97giwA=
+github.com/nats-io/nats.go v1.45.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
 github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
 github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@@ -843,33 +891,39 @@ github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+
 github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
 github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6 h1:r3FaAI0NZK3hSmtTDrBVREhKULp8oUeqLT5Eyl2mSPo=
-github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
-github.com/olekukonko/ll v0.0.8 h1:sbGZ1Fx4QxJXEqL/6IG8GEFnYojUSQ45dJVwN2FH2fc=
-github.com/olekukonko/ll v0.0.8/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
+github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5sM=
+github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI=
+github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/olekukonko/tablewriter v1.0.8 h1:f6wJzHg4QUtJdvrVPKco4QTrAylgaU0+b9br/lJxEiQ=
-github.com/olekukonko/tablewriter v1.0.8/go.mod h1:H428M+HzoUXC6JU2Abj9IT9ooRmdq9CxuDmKMtrOCMs=
+github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
+github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
-github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/ginkgo/v2 v2.25.2 h1:hepmgwx1D+llZleKQDMEvy8vIlCxMGt7W5ZxDjIEhsw=
+github.com/onsi/ginkgo/v2 v2.25.2/go.mod h1:43uiyQC4Ed2tkOzLsEYm7hnrb7UJTWHYNsuy3bG/snE=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/open-policy-agent/opa v1.6.0 h1:/S/cnNQJ2MUMNzizHPbisTWBHowmLkPrugY5jjkPlRQ=
 github.com/open-policy-agent/opa v1.6.0/go.mod h1:zFmw4P+W62+CWGYRDDswfVYSCnPo6oYaktQnfIaRFC4=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a h1:Sakl76blJAaM6NxylVkgSzktjo2dS504iDotEFJsh3M=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a/go.mod h1:pjcozWijkNPbEtX5SIQaxEW/h8VAVZYTLx+70bmB3LY=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76 h1:vD/EdfDUrv4omSFjrinT8Mvf+8D7f9g4vgQ2oiDrVUI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.35.0 h1:lKxGiI9yFD7MTeyFJa68BQD+DiB1rQvhC8QePa/Vlc4=
-github.com/opencloud-eu/reva/v2 v2.35.0/go.mod h1:UVPwuMjfgPekuh7unWavJSiPihgmk1GYF3xct0q3+X0=
+github.com/opencloud-eu/reva/v2 v2.37.0 h1:PKX425FaLlA7Zd5VG6XbHKdBoapJGFv/vc9+njJr/hs=
+github.com/opencloud-eu/reva/v2 v2.37.0/go.mod h1:aNiCrmC5jZJ/Nxqn1UaqyOTez1S7mDLWcpqPbPNYI6A=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opensearch-project/opensearch-go/v4 v4.5.0 h1:26XckmmF6MhlXt91Bu1yY6R51jy1Ns/C3XgIfvyeTRo=
+github.com/opensearch-project/opensearch-go/v4 v4.5.0/go.mod h1:VmFc7dqOEM3ZtLhrpleOzeq+cqUgNabqQG5gX0xId64=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
@@ -891,8 +945,8 @@ github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/9
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
-github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=
-github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
@@ -910,6 +964,8 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pquerna/cachecontrol v0.2.0 h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
 github.com/pquerna/cachecontrol v0.2.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
@@ -928,8 +984,8 @@ github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqr
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20170216185247-6f3806018612/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
@@ -949,8 +1005,8 @@ github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.35.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/prometheus/procfs v0.0.0-20170703101242-e645f4e5aaa8/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -961,8 +1017,8 @@ github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI=
 github.com/prometheus/statsd_exporter v0.22.8 h1:Qo2D9ZzaQG+id9i5NYNGmbf1aa/KxKbB9aKfMS+Yib0=
 github.com/prometheus/statsd_exporter v0.22.8/go.mod h1:/DzwbTEaFTE0Ojz5PqcSk6+PFHOPWGxdXVr6yC8eFOM=
@@ -997,8 +1053,8 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
 github.com/sacloud/libsacloud v1.36.2/go.mod h1:P7YAOVmnIn3DKHqCZcUKYUXmSwGBm3yS7IBEjKVSrjg=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.7.0.20210127161313-bd30bebeac4f/go.mod h1:CJJ5VAbozOl0yEw7nHB9+7BXTJbIn6h7W+f6Gau5IP8=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/segmentio/kafka-go v0.4.48 h1:9jyu9CWK4W5W+SroCe8EffbrRZVqAOkuaLd/ApID4Vs=
-github.com/segmentio/kafka-go v0.4.48/go.mod h1:HjF6XbOKh0Pjlkr5GVZxt6CsjjwnmhVOfURM5KMd8qg=
+github.com/segmentio/kafka-go v0.4.49 h1:GJiNX1d/g+kG6ljyJEoi9++PUMdXGAxb7JGPiDCuNmk=
+github.com/segmentio/kafka-go v0.4.49/go.mod h1:Y1gn60kzLEEaW28YshXyk2+VCUKbJ3Qr6DrnT3i4+9E=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
 github.com/sercand/kuberesolver/v5 v5.1.1 h1:CYH+d67G0sGBj7q5wLK61yzqJJ8gLLC8aeprPTHb6yY=
@@ -1013,6 +1069,8 @@ github.com/shamaton/msgpack/v2 v2.2.3 h1:uDOHmxQySlvlUYfQwdjxyybAOzjlQsD1Vjy+4jm
 github.com/shamaton/msgpack/v2 v2.2.3/go.mod h1:6khjYnkx73f7VQU7wjcFS9DFjs+59naVWJv1TB7qdOI=
 github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
 github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+github.com/shirou/gopsutil/v4 v4.25.5 h1:rtd9piuSMGeU8g1RMXjZs9y9luK5BwtnG7dZaQUJAsc=
+github.com/shirou/gopsutil/v4 v4.25.5/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c h1:aqg5Vm5dwtvL+YgDpBcK1ITf3o96N/K7/wsRXQnUTEs=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c/go.mod h1:owqhoLW1qZoYLZzLnBw+QkPP9WZnjlSWihhxAJC1+/M=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
@@ -1071,20 +1129,25 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8=
+github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tchap/go-patricia/v2 v2.3.2 h1:xTHFutuitO2zqKAQ5rCROYgUb7Or/+IC3fts9/Yc7nM=
 github.com/tchap/go-patricia/v2 v2.3.2/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/test-go/testify v1.1.4 h1:Tf9lntrKUMHiXQ07qBScBTSA0dhYQlu83hswqelv1iE=
 github.com/test-go/testify v1.1.4/go.mod h1:rH7cfJo/47vWGdi4GPj16x3/t1xGOj2YxzmNQzk2ghU=
+github.com/testcontainers/testcontainers-go v0.38.0 h1:d7uEapLcv2P8AvH8ahLqDMMxda2W9gQN1nRbHS28HBw=
+github.com/testcontainers/testcontainers-go v0.38.0/go.mod h1:C52c9MoHpWO+C4aqmgSU+hxlR5jlEayWtgYrb8Pzz1w=
+github.com/testcontainers/testcontainers-go/modules/opensearch v0.38.0 h1:+ndHb4j4SxJYSflYJZQen/8Cj4rjNT96toYFMCTQgd8=
+github.com/testcontainers/testcontainers-go/modules/opensearch v0.38.0/go.mod h1:IhutRBtJkqtEG9bTp4dYbaOuHkBqilBNGfVujlFo7/0=
 github.com/thanhpk/randstr v1.0.6 h1:psAOktJFD4vV9NEVb3qkhRSMvYh4ORRaj1+w/hn4B+o=
 github.com/thanhpk/randstr v1.0.6/go.mod h1:M/H2P1eNLZzlDwAzpkkkUvoyNNMbzRGhESZuEQk3r0U=
 github.com/theckman/yacspin v0.13.12 h1:CdZ57+n0U6JMuh2xqjnjRq5Haj6v1ner2djtLQRzJr4=
 github.com/theckman/yacspin v0.13.12/go.mod h1:Rd2+oG2LmQi5f3zC3yeZAOl245z8QOvrH4OPOJNZxLg=
 github.com/thejerf/suture/v4 v4.0.6 h1:QsuCEsCqb03xF9tPAsWAj8QOAJBgQI1c0VqJNaingg8=
 github.com/thejerf/suture/v4 v4.0.6/go.mod h1:gu9Y4dXNUWFrByqRt30Rm9/UZ0wzRSt9AJS6xu/ZGxU=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -1092,6 +1155,8 @@ github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JT
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
 github.com/tinylib/msgp v1.3.0/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
 github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
@@ -1122,6 +1187,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 github.com/vultr/govultr/v2 v2.0.0/go.mod h1:2PsEeg+gs3p/Fo5Pw8F9mv+DUBEOlrNZ8GmCTGmhOhs=
+github.com/wI2L/jsondiff v0.7.0 h1:1lH1G37GhBPqCfp/lrs91rf/2j3DktX6qYAKZkLuCQQ=
+github.com/wI2L/jsondiff v0.7.0/go.mod h1:KAEIojdQq66oJiHhDyQez2x+sRit0vIzC9KeK0yizxM=
 github.com/wk8/go-ordered-map v1.0.0 h1:BV7z+2PaK8LTSd/mWgY12HyMAo5CEgkHqbkVq2thqr8=
 github.com/wk8/go-ordered-map v1.0.0/go.mod h1:9ZIbRunKbuvfPKyBP1SIKLcXNlv74YCOZ3t3VTS6gRk=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -1141,8 +1208,6 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ
 github.com/xhit/go-simple-mail/v2 v2.16.0 h1:ouGy/Ww4kuaqu2E2UrDw7SvLaziWTB60ICLkIkNVccA=
 github.com/xhit/go-simple-mail/v2 v2.16.0/go.mod h1:b7P5ygho6SYE+VIqpxA6QkYfv4teeyG4MKqB3utRu98=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
@@ -1157,12 +1222,12 @@ github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQ
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I=
 go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM=
-go.etcd.io/etcd/api/v3 v3.6.2 h1:25aCkIMjUmiiOtnBIp6PhNj4KdcURuBak0hU2P1fgRc=
-go.etcd.io/etcd/api/v3 v3.6.2/go.mod h1:eFhhvfR8Px1P6SEuLT600v+vrhdDTdcfMzmnxVXXSbk=
-go.etcd.io/etcd/client/pkg/v3 v3.6.2 h1:zw+HRghi/G8fKpgKdOcEKpnBTE4OO39T6MegA0RopVU=
-go.etcd.io/etcd/client/pkg/v3 v3.6.2/go.mod h1:sbdzr2cl3HzVmxNw//PH7aLGVtY4QySjQFuaCgcRFAI=
-go.etcd.io/etcd/client/v3 v3.6.2 h1:RgmcLJxkpHqpFvgKNwAQHX3K+wsSARMXKgjmUSpoSKQ=
-go.etcd.io/etcd/client/v3 v3.6.2/go.mod h1:PL7e5QMKzjybn0FosgiWvCUDzvdChpo5UgGR4Sk4Gzc=
+go.etcd.io/etcd/api/v3 v3.6.4 h1:7F6N7toCKcV72QmoUKa23yYLiiljMrT4xCeBL9BmXdo=
+go.etcd.io/etcd/api/v3 v3.6.4/go.mod h1:eFhhvfR8Px1P6SEuLT600v+vrhdDTdcfMzmnxVXXSbk=
+go.etcd.io/etcd/client/pkg/v3 v3.6.4 h1:9HBYrjppeOfFjBjaMTRxT3R7xT0GLK8EJMVC4xg6ok0=
+go.etcd.io/etcd/client/pkg/v3 v3.6.4/go.mod h1:sbdzr2cl3HzVmxNw//PH7aLGVtY4QySjQFuaCgcRFAI=
+go.etcd.io/etcd/client/v3 v3.6.4 h1:YOMrCfMhRzY8NgtzUsHl8hC2EBSnuqbR3dh84Uryl7A=
+go.etcd.io/etcd/client/v3 v3.6.4/go.mod h1:jaNNHCyg2FdALyKWnd7hxZXZxZANb0+KGY+YQaEMISo=
 go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -1218,6 +1283,8 @@ go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20180621125126-a49355c7e3f8/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1239,8 +1306,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1256,8 +1323,8 @@ golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac/go.mod h1:hH+7mtFmImwwcMvScy
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.18.0/go.mod h1:4yyo5vMFQjVjUcVk4jEQcU9MGy/rulF5WvUILseCM2E=
-golang.org/x/image v0.28.0 h1:gdem5JW1OLS4FbkWgLO+7ZeFzYtL3xClb97GaUzYMFE=
-golang.org/x/image v0.28.0/go.mod h1:GUJYXtnGKEUgggyzh+Vxt+AviiCcyiwpsl8iQ8MvwGY=
+golang.org/x/image v0.30.0 h1:jD5RhkmVAnjqaCUXfbGBrn3lpxbknfN9w2UhHHU+5B4=
+golang.org/x/image v0.30.0/go.mod h1:SAEUTxCCMWSrJcCy/4HwavEsfZZJlYxeHLc6tTiAe/c=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1282,8 +1349,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1334,12 +1401,11 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1391,6 +1457,7 @@ golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1422,11 +1489,13 @@ golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201110211018-35f3e6cf4a65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1448,8 +1517,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1461,8 +1530,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1471,15 +1540,14 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1542,14 +1610,16 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -1605,10 +1675,10 @@ google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
 google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.19.1/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1624,8 +1694,8 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.74.0 h1:sxRSkyLxlceWQiqDofxDot3d4u7DyoHPc7SBXMj8gGY=
-google.golang.org/grpc v1.74.0/go.mod h1:NZUaK8dAMUfzhK6uxZ+9511LtOrk73UGWOFoNvz7z+s=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e h1:m7aQHHqd0q89mRwhwS9Bx2rjyl/hsFAeta+uGrHsQaU=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e/go.mod h1:gID3PKrg7pWKntu9Ss6zTLJ0ttC0X9IHgREOCZwbCVU=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1642,8 +1712,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v1 v1.1.0 h1:Arh75ttbsvlpVA7WtVpH4u9h6Zl46xuptxqLxPiSo4Y=
 gopkg.in/cenkalti/backoff.v1 v1.1.0/go.mod h1:J6Vskwqd+OMVJl8C33mmtxTBs2gyzfv7UDAkHu8BrjI=

opencloud/Makefile

@@ -17,8 +17,7 @@ include ../.make/docs.mk
 
 .PHONY: dev-docker
 dev-docker:
-	$(MAKE) --no-print-directory release-linux-docker-$(GOARCH)
-	docker build -f docker/Dockerfile.linux.$(GOARCH) -t opencloudeu/opencloud:dev .
+	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev ..
 
 .PHONY: dev-docker-multiarch
 dev-docker-multiarch:

opencloud/docker/Dockerfile.linux.amd64

@@ -1,43 +0,0 @@
-FROM amd64/alpine:3.21
-
-ARG VERSION=""
-ARG REVISION=""
-
-RUN apk add --no-cache attr bash ca-certificates curl inotify-tools libc6-compat mailcap tree vips patch && \
-	echo 'hosts: files dns' >| /etc/nsswitch.conf
-
-LABEL maintainer="openCloud GmbH <devops@opencloud.eu>" \
-  org.opencontainers.image.title="OpenCloud" \
-  org.opencontainers.image.vendor="OpenCloud GmbH" \
-  org.opencontainers.image.authors="OpenCloud GmbH" \
-  org.opencontainers.image.description="OpenCloud is a modern file-sync and share platform" \
-  org.opencontainers.image.licenses="Apache-2.0" \
-  org.opencontainers.image.documentation="https://github.com/opencloud-eu/opencloud" \
-  org.opencontainers.image.url="https://hub.docker.com/r/opencloud-eu/opencloud" \
-  org.opencontainers.image.source="https://github.com/opencloud-eu/opencloud" \
-  org.opencontainers.image.version="${VERSION}" \
-  org.opencontainers.image.revision="${REVISION}"
-
-RUN addgroup -g 1000 -S opencloud-group && \
-  adduser -S --ingroup opencloud-group --uid 1000 opencloud-user --home /var/lib/opencloud
-
-RUN mkdir -p /var/lib/opencloud && \
-# Pre-create the web directory to avoid permission issues
- mkdir -p /var/lib/opencloud/web/assets/apps && \
- chown -R opencloud-user:opencloud-group /var/lib/opencloud && \
- chmod -R 751 /var/lib/opencloud && \
- mkdir -p /etc/opencloud && \
- chown -R opencloud-user:opencloud-group /etc/opencloud && \
- chmod -R 751 /etc/opencloud
-
-VOLUME [ "/var/lib/opencloud", "/etc/opencloud" ]
-WORKDIR /var/lib/opencloud
-
-USER 1000
-
-EXPOSE 9200/tcp
-
-ENTRYPOINT ["/usr/bin/opencloud"]
-CMD ["server"]
-
-COPY dist/binaries/opencloud-linux-amd64 /usr/bin/opencloud

opencloud/docker/Dockerfile.linux.arm64

@@ -1,43 +0,0 @@
-FROM arm64v8/alpine:3.21
-
-ARG VERSION=""
-ARG REVISION=""
-
-RUN apk add --no-cache attr bash ca-certificates curl inotify-tools libc6-compat mailcap tree vips patch && \
-	echo 'hosts: files dns' >| /etc/nsswitch.conf
-
-LABEL maintainer="openCloud GmbH <devops@opencloud.eu>" \
-  org.opencontainers.image.title="OpenCloud" \
-  org.opencontainers.image.vendor="OpenCloud GmbH" \
-  org.opencontainers.image.authors="OpenCloud GmbH" \
-  org.opencontainers.image.description="OpenCloud a modern file-sync and share platform" \
-  org.opencontainers.image.licenses="Apache-2.0" \
-  org.opencontainers.image.documentation="https://github.com/opencloud-eu/opencloud" \
-  org.opencontainers.image.url="https://hub.docker.com/r/opencloud-eu/opencloud" \
-  org.opencontainers.image.source="https://github.com/opencloud-eu/opencloud" \
-  org.opencontainers.image.version="${VERSION}" \
-  org.opencontainers.image.revision="${REVISION}"
-
-RUN addgroup -g 1000 -S opencloud-group && \
-  adduser -S --ingroup opencloud-group --uid 1000 opencloud-user --home /var/lib/opencloud
-
-RUN mkdir -p /var/lib/opencloud && \
-# Pre-create the web directory to avoid permission issues
- mkdir -p /var/lib/opencloud/web/assets/apps && \
- chown -R opencloud-user:opencloud-group /var/lib/opencloud && \
- chmod -R 751 /var/lib/opencloud && \
- mkdir -p /etc/opencloud && \
- chown -R opencloud-user:opencloud-group /etc/opencloud && \
- chmod -R 751 /etc/opencloud
-
-VOLUME [ "/var/lib/opencloud", "/etc/opencloud" ]
-WORKDIR /var/lib/opencloud
-
-USER 1000
-
-EXPOSE 9200/tcp
-
-ENTRYPOINT ["/usr/bin/opencloud"]
-CMD ["server"]
-
-COPY dist/binaries/opencloud-linux-arm64 /usr/bin/opencloud

opencloud/docker/Dockerfile.multiarch

@@ -6,13 +6,14 @@ ARG STRING
 
 RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev
 
-COPY ../ /opencloud/
-
 WORKDIR /opencloud
-RUN GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
-    make -C opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true
+RUN --mount=type=bind,target=/opencloud \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache \
+    GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
+    make -C opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist
 
-FROM alpine:3.20
+FROM alpine:3.21
 ARG VERSION
 ARG REVISION
 ARG TARGETOS
@@ -55,4 +56,4 @@ EXPOSE 9200/tcp
 ENTRYPOINT ["/usr/bin/opencloud"]
 CMD ["server"]
 
-COPY --from=build /opencloud/opencloud/dist/binaries/opencloud-linux-${TARGETARCH} /usr/bin/opencloud
+COPY --from=build /dist/binaries/opencloud-linux-${TARGETARCH} /usr/bin/opencloud

pkg/conversions/conversions.go

@@ -0,0 +1,24 @@
+package conversions
+
+import (
+	"encoding/json"
+)
+
+func To[T any](v any) (T, error) {
+	var t T
+
+	if v == nil {
+		return t, nil
+	}
+
+	j, err := json.Marshal(v)
+	if err != nil {
+		return t, err
+	}
+
+	if err := json.Unmarshal(j, &t); err != nil {
+		return t, err
+	}
+
+	return t, nil
+}

pkg/version/version.go

@@ -16,7 +16,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "3.2.0+dev"
+	LatestTag = "3.4.0+dev"
 
 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions

services/activitylog/pkg/service/l10n/locale/ca/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Ivan Fustero, 2025\n"
 "Language-Team: Catalan (https://app.transifex.com/opencloud-eu/teams/204053/ca/)\n"

services/activitylog/pkg/service/l10n/locale/de/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Jörn Friedrich Dreyer <jfd@butonic.de>, 2025\n"
 "Language-Team: German (https://app.transifex.com/opencloud-eu/teams/204053/de/)\n"

services/activitylog/pkg/service/l10n/locale/es/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Elías Martín, 2025\n"
 "Language-Team: Spanish (https://app.transifex.com/opencloud-eu/teams/204053/es/)\n"

services/activitylog/pkg/service/l10n/locale/fr/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: eric_G <junk.eg@free.fr>, 2025\n"
 "Language-Team: French (https://app.transifex.com/opencloud-eu/teams/204053/fr/)\n"

services/activitylog/pkg/service/l10n/locale/it/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Simone Broglia, 2025\n"
 "Language-Team: Italian (https://app.transifex.com/opencloud-eu/teams/204053/it/)\n"

services/activitylog/pkg/service/l10n/locale/ko/LC_MESSAGES/activitylog.po

@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Junghyuk Kwon <kwon@junghy.uk>, 2025\n"
 "Language-Team: Korean (https://app.transifex.com/opencloud-eu/teams/204053/ko/)\n"

services/activitylog/pkg/service/l10n/locale/nl/LC_MESSAGES/activitylog.po

@@ -0,0 +1,102 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Stephan Paternotte <stephan@paternottes.net>, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-08-22 00:02+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Stephan Paternotte <stephan@paternottes.net>, 2025\n"
+"Language-Team: Dutch (https://app.transifex.com/opencloud-eu/teams/204053/nl/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: nl\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#: pkg/service/response.go:44
+msgid "description"
+msgstr "beschrijving"
+
+#: pkg/service/response.go:43
+msgid "display name"
+msgstr "weergavenaam"
+
+#: pkg/service/response.go:42
+msgid "expiration date"
+msgstr "verloopdatum"
+
+#: pkg/service/response.go:41
+msgid "password"
+msgstr "wachtwoord"
+
+#: pkg/service/response.go:40
+msgid "permission"
+msgstr "machtiging"
+
+#: pkg/service/response.go:39
+msgid "some field"
+msgstr "een veld"
+
+#: pkg/service/response.go:26
+msgid "{resource} was downloaded via public link {token}"
+msgstr "{resource} is gedownload via openbare link {token}"
+
+#: pkg/service/response.go:24
+msgid "{user} added {resource} to {folder}"
+msgstr "{user} heeft {resource} toegevoegd aan {folder}"
+
+#: pkg/service/response.go:36
+msgid "{user} added {sharee} as member of {space}"
+msgstr "{user} heeft {sharee} als lid toegevoegd van {space}"
+
+#: pkg/service/response.go:27
+msgid "{user} deleted {resource} from {folder}"
+msgstr "{user} heeft {resource} verwijderd van {folder}"
+
+#: pkg/service/response.go:28
+msgid "{user} moved {resource} to {folder}"
+msgstr "{user} heeft {resource} verplaatst naar {folder}"
+
+#: pkg/service/response.go:35
+msgid "{user} removed link to {resource}"
+msgstr "{user} heeft link naar {resource} verwijderd"
+
+#: pkg/service/response.go:32
+msgid "{user} removed {sharee} from {resource}"
+msgstr "{user} heeft {sharee} verwijderd van {resource}"
+
+#: pkg/service/response.go:37
+msgid "{user} removed {sharee} from {space}"
+msgstr "{user} heeft {sharee} verwijderd van {space}"
+
+#: pkg/service/response.go:29
+msgid "{user} renamed {oldResource} to {resource}"
+msgstr "{user} heeft {oldResource} hernoemd tot {resource}"
+
+#: pkg/service/response.go:33
+msgid "{user} shared {resource} via link"
+msgstr "{user} heeft {resource} gedeeld via link"
+
+#: pkg/service/response.go:30
+msgid "{user} shared {resource} with {sharee}"
+msgstr "{user} heeft {resource} gedeeld met {sharee}"
+
+#: pkg/service/response.go:34
+msgid "{user} updated {field} for a link {token} on {resource}"
+msgstr "{user} heeft {field} bijgewerkt voor een link {token} op {resource}"
+
+#: pkg/service/response.go:31
+msgid "{user} updated {field} for the {resource}"
+msgstr "{user} heeft {field} bijgewerkt voor {resource}"
+
+#: pkg/service/response.go:25
+msgid "{user} updated {resource} in {folder}"
+msgstr "{user} heeft {resource} bijgewerkt in {folder}"

services/activitylog/pkg/service/l10n/locale/ru/LC_MESSAGES/activitylog.po

@@ -0,0 +1,103 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Savely Krasovsky, 2025
+# Lulufox, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-08-22 00:02+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Lulufox, 2025\n"
+"Language-Team: Russian (https://app.transifex.com/opencloud-eu/teams/204053/ru/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: ru\n"
+"Plural-Forms: nplurals=4; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<12 || n%100>14) ? 1 : n%10==0 || (n%10>=5 && n%10<=9) || (n%100>=11 && n%100<=14)? 2 : 3);\n"
+
+#: pkg/service/response.go:44
+msgid "description"
+msgstr "Описание"
+
+#: pkg/service/response.go:43
+msgid "display name"
+msgstr "Отображаемое имя"
+
+#: pkg/service/response.go:42
+msgid "expiration date"
+msgstr "Дата истечения срока"
+
+#: pkg/service/response.go:41
+msgid "password"
+msgstr "Пароль"
+
+#: pkg/service/response.go:40
+msgid "permission"
+msgstr "Разрешение"
+
+#: pkg/service/response.go:39
+msgid "some field"
+msgstr "Какое-то поле"
+
+#: pkg/service/response.go:26
+msgid "{resource} was downloaded via public link {token}"
+msgstr "{resource} был загружен через публичную ссылку {token}"
+
+#: pkg/service/response.go:24
+msgid "{user} added {resource} to {folder}"
+msgstr "{user} добавил(-ла) {resource} в{folder}"
+
+#: pkg/service/response.go:36
+msgid "{user} added {sharee} as member of {space}"
+msgstr "{user} добавил(-а) {sharee} как члена {space}"
+
+#: pkg/service/response.go:27
+msgid "{user} deleted {resource} from {folder}"
+msgstr "{user} удалил(-а) {resource} из {folder}"
+
+#: pkg/service/response.go:28
+msgid "{user} moved {resource} to {folder}"
+msgstr "{user} перенес(-ла) {resource} в {folder}"
+
+#: pkg/service/response.go:35
+msgid "{user} removed link to {resource}"
+msgstr "{user} удалил(-а) ссылку на {resource}"
+
+#: pkg/service/response.go:32
+msgid "{user} removed {sharee} from {resource}"
+msgstr "{user} забрал у {sharee} доступ к {resource}"
+
+#: pkg/service/response.go:37
+msgid "{user} removed {sharee} from {space}"
+msgstr "{user} удалил {sharee} из участников {space}"
+
+#: pkg/service/response.go:29
+msgid "{user} renamed {oldResource} to {resource}"
+msgstr "{user} переименовал {oldResource} в {resource}"
+
+#: pkg/service/response.go:33
+msgid "{user} shared {resource} via link"
+msgstr "{user} предоставил(-а) совместный доступ к {resource} по ссылке"
+
+#: pkg/service/response.go:30
+msgid "{user} shared {resource} with {sharee}"
+msgstr "{user} предоставил(-а) совместный доступ к {resource} для {sharee}"
+
+#: pkg/service/response.go:34
+msgid "{user} updated {field} for a link {token} on {resource}"
+msgstr "{user} обновил(-а) {field} для ссылки {token} на {resource}"
+
+#: pkg/service/response.go:31
+msgid "{user} updated {field} for the {resource}"
+msgstr "{user} обновил(-а) {field} у {resource}"
+
+#: pkg/service/response.go:25
+msgid "{user} updated {resource} in {folder}"
+msgstr "{user} обновил(-а) {resource} в {folder}"

services/activitylog/pkg/service/l10n/locale/zh/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: YQS Yang, 2025\n"
 "Language-Team: Chinese (https://app.transifex.com/opencloud-eu/teams/204053/zh/)\n"

services/antivirus/pkg/service/service.go

@@ -231,19 +231,21 @@ func (av Antivirus) process(ev events.StartPostprocessingStep) (scanners.Result,
 		return scanners.Result{ScanTime: time.Now()}, nil
 	}
 
+	filesize := ev.Filesize
 	headers := make(map[string]string)
 	switch {
 	case av.maxScanSize == 0:
 		// there is no size limit
 		break
-	case av.config.MaxScanSizeMode == config.MaxScanSizeModeSkip && ev.Filesize > av.maxScanSize:
+	case av.config.MaxScanSizeMode == config.MaxScanSizeModeSkip && filesize > av.maxScanSize:
 		// skip the file if it is bigger than the max scan size
-		av.log.Info().Str("uploadid", ev.UploadID).Uint64("filesize", ev.Filesize).
+		av.log.Info().Str("uploadid", ev.UploadID).Uint64("filesize", filesize).
 			Msg("Skipping file to be virus scanned, file size is bigger than max scan size.")
 		return scanners.Result{ScanTime: time.Now()}, nil
-	case av.config.MaxScanSizeMode == config.MaxScanSizeModePartial && ev.Filesize > av.maxScanSize:
+	case av.config.MaxScanSizeMode == config.MaxScanSizeModePartial && filesize > av.maxScanSize:
 		// set the range header to only download the first maxScanSize bytes
 		headers["Range"] = fmt.Sprintf("bytes=0-%d", av.maxScanSize-1)
+		filesize = av.maxScanSize // inform the scanner that we are only scanning part of the file
 	}
 
 	var err error
@@ -265,7 +267,7 @@ func (av Antivirus) process(ev events.StartPostprocessingStep) (scanners.Result,
 
 	av.log.Debug().Str("uploadid", ev.UploadID).Msg("Downloaded file successfully, starting virusscan")
 
-	res, err := av.scanner.Scan(scanners.Input{Body: rrc, Size: int64(ev.Filesize), Url: ev.URL, Name: ev.Filename})
+	res, err := av.scanner.Scan(scanners.Input{Body: rrc, Size: int64(filesize), Url: ev.URL, Name: ev.Filename})
 	if err != nil {
 		av.log.Error().Err(err).Str("uploadid", ev.UploadID).Msg("error scanning file")
 	}

services/auth-basic/pkg/config/config.go

@@ -84,6 +84,7 @@ type LDAPProvider struct {
 
 type LDAPUserSchema struct {
 	ID              string `yaml:"id" env:"OC_LDAP_USER_SCHEMA_ID;AUTH_BASIC_LDAP_USER_SCHEMA_ID" desc:"LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID." introductionVersion:"1.0.0"`
+	TenantID        string `yaml:"tenant_id" env:"OC_LDAP_USER_SCHEMA_TENANT_ID;AUTH_BASIC_LDAP_USER_SCHEMA_TENANT_ID" desc:"LDAP Attribute to use for the tenant ID of users. This is used to identify the tenant of a user in a multi-tenant environment." introductionVersion:"%%NEXT%%"`
 	IDIsOctetString bool   `yaml:"id_is_octet_string" env:"OC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING;AUTH_BASIC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING" desc:"Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the user IDs." introductionVersion:"1.0.0"`
 	Mail            string `yaml:"mail" env:"OC_LDAP_USER_SCHEMA_MAIL;AUTH_BASIC_LDAP_USER_SCHEMA_MAIL" desc:"LDAP Attribute to use for the email address of users." introductionVersion:"1.0.0"`
 	DisplayName     string `yaml:"display_name" env:"OC_LDAP_USER_SCHEMA_DISPLAYNAME;AUTH_BASIC_LDAP_USER_SCHEMA_DISPLAYNAME" desc:"LDAP Attribute to use for the displayname of users." introductionVersion:"1.0.0"`

services/auth-basic/pkg/revaconfig/config.go

@@ -77,6 +77,7 @@ func ldapConfigFromString(cfg config.LDAPProvider) map[string]interface{} {
 		"idp":                     cfg.IDP,
 		"user_schema": map[string]interface{}{
 			"id":              cfg.UserSchema.ID,
+			"tenantId":        cfg.UserSchema.TenantID,
 			"idIsOctetString": cfg.UserSchema.IDIsOctetString,
 			"mail":            cfg.UserSchema.Mail,
 			"displayName":     cfg.UserSchema.DisplayName,

services/frontend/pkg/config/config.go

@@ -38,16 +38,17 @@ type Config struct {
 	DisableSSE                     bool   `yaml:"disable_sse" env:"OC_DISABLE_SSE;FRONTEND_DISABLE_SSE" desc:"When set to true, clients are informed that the Server-Sent Events endpoint is not accessible." introductionVersion:"1.0.0"`
 	DefaultLinkPermissions         int    `yaml:"default_link_permissions" env:"FRONTEND_DEFAULT_LINK_PERMISSIONS" desc:"Defines the default permissions a link is being created with. Possible values are 0 (= internal link, for instance members only) and 1 (= public link with viewer permissions). Defaults to 1." introductionVersion:"1.0.0"`
 
-	PublicURL              string      `yaml:"public_url" env:"OC_URL;FRONTEND_PUBLIC_URL" desc:"The public facing URL of the OpenCloud frontend." introductionVersion:"1.0.0"`
-	MaxConcurrency         int         `yaml:"max_concurrency" env:"OC_MAX_CONCURRENCY;FRONTEND_MAX_CONCURRENCY" desc:"Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used." introductionVersion:"1.0.0"`
-	AppHandler             AppHandler  `yaml:"app_handler"`
-	Archiver               Archiver    `yaml:"archiver"`
-	DataGateway            DataGateway `yaml:"data_gateway"`
-	OCS                    OCS         `yaml:"ocs"`
-	Checksums              Checksums   `yaml:"checksums"`
-	ReadOnlyUserAttributes []string    `yaml:"read_only_user_attributes" env:"FRONTEND_READONLY_USER_ATTRIBUTES" desc:"A list of user attributes to indicate as read-only. Supported values: 'user.onPremisesSamAccountName' (username), 'user.displayName', 'user.mail', 'user.passwordProfile' (password), 'user.appRoleAssignments' (role), 'user.memberOf' (groups), 'user.accountEnabled' (login allowed), 'drive.quota' (quota). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	LDAPServerWriteEnabled bool        `yaml:"ldap_server_write_enabled" env:"OC_LDAP_SERVER_WRITE_ENABLED;FRONTEND_LDAP_SERVER_WRITE_ENABLED" desc:"Allow creating, modifying and deleting LDAP users via the GRAPH API. This can only be set to 'true' when keeping default settings for the LDAP user and group attribute types (the 'OC_LDAP_USER_SCHEMA_* and 'OC_LDAP_GROUP_SCHEMA_* variables)." introductionVersion:"1.0.0"`
-	FullTextSearch         bool        `yaml:"full_text_search" env:"FRONTEND_FULL_TEXT_SEARCH_ENABLED" desc:"Set to true to signal the web client that full-text search is enabled." introductionVersion:"1.0.0"`
+	PublicURL                string      `yaml:"public_url" env:"OC_URL;FRONTEND_PUBLIC_URL" desc:"The public facing URL of the OpenCloud frontend." introductionVersion:"1.0.0"`
+	MaxConcurrency           int         `yaml:"max_concurrency" env:"OC_MAX_CONCURRENCY;FRONTEND_MAX_CONCURRENCY" desc:"Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used." introductionVersion:"1.0.0"`
+	AppHandler               AppHandler  `yaml:"app_handler"`
+	Archiver                 Archiver    `yaml:"archiver"`
+	DataGateway              DataGateway `yaml:"data_gateway"`
+	OCS                      OCS         `yaml:"ocs"`
+	Checksums                Checksums   `yaml:"checksums"`
+	ReadOnlyUserAttributes   []string    `yaml:"read_only_user_attributes" env:"FRONTEND_READONLY_USER_ATTRIBUTES" desc:"A list of user attributes to indicate as read-only. Supported values: 'user.onPremisesSamAccountName' (username), 'user.displayName', 'user.mail', 'user.passwordProfile' (password), 'user.appRoleAssignments' (role), 'user.memberOf' (groups), 'user.accountEnabled' (login allowed), 'drive.quota' (quota). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	LDAPServerWriteEnabled   bool        `yaml:"ldap_server_write_enabled" env:"OC_LDAP_SERVER_WRITE_ENABLED;FRONTEND_LDAP_SERVER_WRITE_ENABLED" desc:"Allow creating, modifying and deleting LDAP users via the GRAPH API. This can only be set to 'true' when keeping default settings for the LDAP user and group attribute types (the 'OC_LDAP_USER_SCHEMA_* and 'OC_LDAP_GROUP_SCHEMA_* variables)." introductionVersion:"1.0.0"`
+	EditLoginAllowedDisabled bool        `yaml:"edit_login_allowed_disabled" env:"FRONTEND_EDIT_LOGIN_ALLOWED_DISABLED" desc:"Used to set if login is allowed/forbidden for for User." introductionVersion:"3.4.0"`
+	FullTextSearch           bool        `yaml:"full_text_search" env:"FRONTEND_FULL_TEXT_SEARCH_ENABLED" desc:"Set to true to signal the web client that full-text search is enabled." introductionVersion:"1.0.0"`
 
 	Middleware Middleware `yaml:"middleware"`
 

services/frontend/pkg/revaconfig/config.go

@@ -224,6 +224,7 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 									"create_disabled":               !cfg.LDAPServerWriteEnabled,
 									"delete_disabled":               !cfg.LDAPServerWriteEnabled,
 									"change_password_self_disabled": changePasswordDisabled,
+									"edit_login_allowed_disabled":   cfg.EditLoginAllowedDisabled,
 								},
 							},
 							"checksums": map[string]interface{}{

services/graph/pkg/config/config.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"context"
+	"time"
 
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 )
@@ -39,6 +40,8 @@ type Config struct {
 	Context context.Context `yaml:"-"`
 
 	Metadata Metadata `yaml:"metadata_config"`
+
+	UserSoftDeleteRetentionTime time.Duration `yaml:"user_soft_delete_retention_time" env:"GRAPH_USER_SOFT_DELETE_RETENTION_TIME" desc:"The time after which a soft-deleted user is permanently deleted. If set to 0 (default), there is no soft delete retention time and users are deleted immediately after being soft-deleted. If set to a positive value, the user will be kept in the system for that duration before being permanently deleted." introductionVersion:"%%NEXT%%"`
 }
 
 type Spaces struct {
@@ -73,6 +76,7 @@ type LDAP struct {
 	UserNameAttribute        string `yaml:"user_name_attribute" env:"OC_LDAP_USER_SCHEMA_USERNAME;GRAPH_LDAP_USER_NAME_ATTRIBUTE" desc:"LDAP Attribute to use for username of users." introductionVersion:"1.0.0"`
 	UserIDAttribute          string `yaml:"user_id_attribute" env:"OC_LDAP_USER_SCHEMA_ID;GRAPH_LDAP_USER_UID_ATTRIBUTE" desc:"LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID." introductionVersion:"1.0.0"`
 	UserIDIsOctetString      bool   `yaml:"user_id_is_octet_string" env:"OC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING;GRAPH_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING" desc:"Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is required when using the 'objectGUID' attribute of Active Directory for the user ID's." introductionVersion:"1.0.0"`
+	UserTenantIDAttribute    string `yaml:"user_tenant_id_attribute" env:"OC_LDAP_USER_SCHEMA_TENANT_ID;GRAPH_LDAP_USER_SCHEMA_TENANT_ID" desc:"LDAP Attribute to use for the tenant ID of users. This is used to identify the tenant of a user in a multi-tenant environment." introductionVersion:"%%NEXT%%"`
 	UserTypeAttribute        string `yaml:"user_type_attribute" env:"OC_LDAP_USER_SCHEMA_USER_TYPE;GRAPH_LDAP_USER_TYPE_ATTRIBUTE" desc:"LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'openCloudUserType'." introductionVersion:"1.0.0"`
 	UserEnabledAttribute     string `yaml:"user_enabled_attribute" env:"OC_LDAP_USER_ENABLED_ATTRIBUTE;GRAPH_USER_ENABLED_ATTRIBUTE" desc:"LDAP Attribute to use as a flag telling if the user is enabled or disabled." introductionVersion:"1.0.0"`
 	DisableUserMechanism     string `yaml:"disable_user_mechanism" env:"OC_LDAP_DISABLE_USER_MECHANISM;GRAPH_DISABLE_USER_MECHANISM" desc:"An option to control the behavior for disabling users. Supported options are 'none', 'attribute' and 'group'. If set to 'group', disabling a user via API will add the user to the configured group for disabled users, if set to 'attribute' this will be done in the ldap user entry, if set to 'none' the disable request is not processed. Default is 'attribute'." introductionVersion:"1.0.0"`

services/graph/pkg/config/defaults/defaultconfig.go

@@ -96,6 +96,7 @@ func DefaultConfig() *config.Config {
 				// FIXME: switch this to some more widely available attribute by default
 				//        ideally this needs to	be constant for the lifetime of a users
 				UserIDAttribute:           "openCloudUUID",
+				UserTenantIDAttribute:     "",
 				UserTypeAttribute:         "openCloudUserType",
 				UserEnabledAttribute:      "openCloudUserEnabled",
 				DisableUserMechanism:      "attribute",
@@ -130,6 +131,7 @@ func DefaultConfig() *config.Config {
 			StorageAddress: "eu.opencloud.api.storage-system",
 			SystemUserIDP:  "internal",
 		},
+		UserSoftDeleteRetentionTime: 0,
 	}
 }
 

services/graph/pkg/identity/cs3.go

@@ -10,12 +10,12 @@ import (
 	cs3group "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
 	cs3user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/shared"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 )
 
 var (
@@ -44,7 +44,7 @@ func (i *CS3) UpdateUser(ctx context.Context, nameOrID string, user libregraph.U
 }
 
 // GetUser implements the Backend Interface.
-func (i *CS3) GetUser(ctx context.Context, userID string, _ *godata.GoDataRequest) (*libregraph.User, error) {
+func (i *CS3) GetUser(ctx context.Context, nameOrId string, _ *godata.GoDataRequest) (*libregraph.User, error) {
 	logger := i.Logger.SubloggerWithRequestID(ctx)
 	logger.Debug().Str("backend", "cs3").Msg("GetUser")
 	gatewayClient, err := i.GatewaySelector.Next()
@@ -53,22 +53,43 @@ func (i *CS3) GetUser(ctx context.Context, userID string, _ *godata.GoDataReques
 		return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
 	}
 
+	// Try to get the user by username first
 	res, err := gatewayClient.GetUserByClaim(ctx, &cs3user.GetUserByClaimRequest{
-		Claim: "userid", // FIXME add consts to reva
-		Value: userID,
+		Claim: "username", // FIXME add consts to reva
+		Value: nameOrId,
 	})
 
 	switch {
 	case err != nil:
-		logger.Error().Str("backend", "cs3").Err(err).Str("userid", userID).Msg("error sending get user by claim id grpc request: transport error")
+		logger.Error().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request: transport error")
+		return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
+	case res.GetStatus().GetCode() == cs3rpc.Code_CODE_OK:
+		return CreateUserModelFromCS3(res.GetUser()), nil
+	case res.GetStatus().GetCode() == cs3rpc.Code_CODE_NOT_FOUND:
+		// If the user was not found by username, try to get it by user ID
+	default:
+		logger.Debug().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request")
+		return nil, errorcode.New(errorcode.GeneralException, res.GetStatus().GetMessage())
+
+	}
+
+	// If the user was not found by username, try to get it by user ID
+	res, err = gatewayClient.GetUserByClaim(ctx, &cs3user.GetUserByClaimRequest{
+		Claim: "userid", // FIXME add consts to reva
+		Value: nameOrId,
+	})
+	switch {
+	case err != nil:
+		logger.Error().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request: transport error")
 		return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
 	case res.GetStatus().GetCode() != cs3rpc.Code_CODE_OK:
 		if res.GetStatus().GetCode() == cs3rpc.Code_CODE_NOT_FOUND {
 			return nil, errorcode.New(errorcode.ItemNotFound, res.GetStatus().GetMessage())
 		}
-		logger.Debug().Str("backend", "cs3").Err(err).Str("userid", userID).Msg("error sending get user by claim id grpc request")
+		logger.Debug().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request")
 		return nil, errorcode.New(errorcode.GeneralException, res.GetStatus().GetMessage())
 	}
+
 	return CreateUserModelFromCS3(res.GetUser()), nil
 }
 
@@ -167,7 +188,7 @@ func (i *CS3) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*lib
 
 // CreateGroup implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) CreateGroup(ctx context.Context, group libregraph.Group) (*libregraph.Group, error) {
-	return nil, errorcode.New(errorcode.NotSupported, "not implemented")
+	return nil, errNotImplemented
 }
 
 // GetGroup implements the Backend Interface.
@@ -202,25 +223,25 @@ func (i *CS3) GetGroup(ctx context.Context, groupID string, queryParam url.Value
 
 // DeleteGroup implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) DeleteGroup(ctx context.Context, id string) error {
-	return errorcode.New(errorcode.NotSupported, "not implemented")
+	return errNotImplemented
 }
 
 // UpdateGroupName implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) UpdateGroupName(ctx context.Context, groupID string, groupName string) error {
-	return errorcode.New(errorcode.NotSupported, "not implemented")
+	return errNotImplemented
 }
 
 // GetGroupMembers implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) GetGroupMembers(ctx context.Context, groupID string, _ *godata.GoDataRequest) ([]*libregraph.User, error) {
-	return nil, errorcode.New(errorcode.NotSupported, "not implemented")
+	return nil, errNotImplemented
 }
 
 // AddMembersToGroup implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) AddMembersToGroup(ctx context.Context, groupID string, memberID []string) error {
-	return errorcode.New(errorcode.NotSupported, "not implemented")
+	return errNotImplemented
 }
 
 // RemoveMemberFromGroup implements the Backend Interface. It's currently not supported for the CS3 backend
 func (i *CS3) RemoveMemberFromGroup(ctx context.Context, groupID string, memberID string) error {
-	return errorcode.New(errorcode.NotSupported, "not implemented")
+	return errNotImplemented
 }

services/graph/pkg/identity/ldap.go

@@ -15,6 +15,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/libregraph/idm/pkg/ldapdn"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	ctxpkg "github.com/opencloud-eu/reva/v2/pkg/ctx"
 
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
@@ -80,6 +81,7 @@ type LDAP struct {
 type userAttributeMap struct {
 	displayName    string
 	id             string
+	tenantId       string
 	mail           string
 	userName       string
 	givenName      string
@@ -115,6 +117,7 @@ func NewLDAPBackend(lc ldap.Client, config config.LDAP, logger *log.Logger) (*LD
 	uam := userAttributeMap{
 		displayName:    config.UserDisplayNameAttribute,
 		id:             config.UserIDAttribute,
+		tenantId:       config.UserTenantIDAttribute,
 		mail:           config.UserEmailAttribute,
 		userName:       config.UserNameAttribute,
 		accountEnabled: config.UserEnabledAttribute,
@@ -614,7 +617,17 @@ func (i *LDAP) FilterUsers(ctx context.Context, oreq *godata.GoDataRequest, filt
 			i.userAttributeMap.displayName, search,
 		)
 	}
-	userFilter = fmt.Sprintf("(&%s(objectClass=%s)%s%s)", i.userFilter, i.userObjectClass, queryFilter, userFilter)
+
+	// apply tenant filter if applicable
+	var tenantFilter string
+	if i.userAttributeMap.tenantId != "" {
+		currentUser, ok := ctxpkg.ContextGetUser(ctx)
+		if ok && currentUser.Id.GetTenantId() != "" {
+			tenantFilter = fmt.Sprintf("(%s=%s)", i.userAttributeMap.tenantId, ldap.EscapeFilter(currentUser.Id.GetTenantId()))
+		}
+	}
+
+	userFilter = fmt.Sprintf("(&%s(objectClass=%s)%s%s%s)", i.userFilter, i.userObjectClass, queryFilter, userFilter, tenantFilter)
 	searchRequest := ldap.NewSearchRequest(
 		i.userBaseDN, i.userScope, ldap.NeverDerefAliases, 0, 0, false,
 		userFilter,

services/graph/pkg/l10n/locale/ca/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Ivan Fustero, 2025\n"
 "Language-Team: Catalan (https://app.transifex.com/opencloud-eu/teams/204053/ca/)\n"

services/graph/pkg/l10n/locale/de/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Jörn Friedrich Dreyer <jfd@butonic.de>, 2025\n"
 "Language-Team: German (https://app.transifex.com/opencloud-eu/teams/204053/de/)\n"

services/graph/pkg/l10n/locale/es/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Elías Martín, 2025\n"
 "Language-Team: Spanish (https://app.transifex.com/opencloud-eu/teams/204053/es/)\n"

services/graph/pkg/l10n/locale/fr/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: eric_G <junk.eg@free.fr>, 2025\n"
 "Language-Team: French (https://app.transifex.com/opencloud-eu/teams/204053/fr/)\n"

services/graph/pkg/l10n/locale/it/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Simone Broglia, 2025\n"
 "Language-Team: Italian (https://app.transifex.com/opencloud-eu/teams/204053/it/)\n"

services/graph/pkg/l10n/locale/ko/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: gapho shin, 2025\n"
 "Language-Team: Korean (https://app.transifex.com/opencloud-eu/teams/204053/ko/)\n"

services/graph/pkg/l10n/locale/nl/LC_MESSAGES/graph.po

@@ -0,0 +1,138 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Stephan Paternotte <stephan@paternottes.net>, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-08-25 00:01+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Stephan Paternotte <stephan@paternottes.net>, 2025\n"
+"Language-Team: Dutch (https://app.transifex.com/opencloud-eu/teams/204053/nl/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: nl\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. UnifiedRole Editor, Role DisplayName (resolves directly)
+#. UnifiedRole EditorListGrants, Role DisplayName (resolves directly)
+#. UnifiedRole SpaseEditor, Role DisplayName (resolves directly)
+#. UnifiedRole FileEditor, Role DisplayName (resolves directly)
+#. UnifiedRole FileEditorListGrants, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:116 pkg/unifiedrole/roles.go:122
+#: pkg/unifiedrole/roles.go:128 pkg/unifiedrole/roles.go:140
+#: pkg/unifiedrole/roles.go:146
+msgid "Can edit"
+msgstr "Kan bewerken"
+
+#. UnifiedRole SpaseEditorWithoutVersions, Role DisplayName (resolves
+#. directly)
+#: pkg/unifiedrole/roles.go:134
+msgid "Can edit without versions"
+msgstr "Kan bewerken zonder versies"
+
+#. UnifiedRole Manager, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:158
+msgid "Can manage"
+msgstr "Kan beheren"
+
+#. UnifiedRole EditorLite, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:152
+msgid "Can upload"
+msgstr "Kan uploaden"
+
+#. UnifiedRole Viewer, Role DisplayName (resolves directly)
+#. UnifiedRole Viewer, Role DisplayName (resolves directly)
+#. UnifiedRole SpaseViewer, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:98 pkg/unifiedrole/roles.go:104
+#: pkg/unifiedrole/roles.go:110
+msgid "Can view"
+msgstr "Kan weergeven"
+
+#. UnifiedRole SecureViewer, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:164
+msgid "Can view (secure)"
+msgstr "Kan weergeven (beveiligd)"
+
+#. UnifiedRole FullDenial, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:170
+msgid "Cannot access"
+msgstr "Heeft geen toegang"
+
+#. UnifiedRole FullDenial, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:167
+msgid "Deny all access."
+msgstr "Alle toegang weigeren."
+
+#. default description for new spaces
+#: pkg/service/v0/spacetemplates.go:32
+msgid "Here you can add a description for this Space."
+msgstr "Hier kun je een beschrijving voor deze ruimte toevoegen."
+
+#. UnifiedRole Viewer, Role Description (resolves directly)
+#. UnifiedRole SpaceViewer, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:95 pkg/unifiedrole/roles.go:107
+msgid "View and download."
+msgstr "Weergeven en downloaden."
+
+#. UnifiedRole SecureViewer, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:161
+msgid "View only documents, images and PDFs. Watermarks will be applied."
+msgstr ""
+"Alleen documenten, afbeeldingen en PDF's weergeven. Met toepassing van "
+"watermerken."
+
+#. UnifiedRole FileEditor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:137
+msgid "View, download and edit."
+msgstr "Weergeven, downloaden en bewerken."
+
+#. UnifiedRole ViewerListGrants, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:101
+msgid "View, download and show all invited people."
+msgstr "Weergeven, downloaden en alle genodigde personen zien."
+
+#. UnifiedRole EditorLite, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:149
+msgid "View, download and upload."
+msgstr "Weergeven, downloaden en uploaden."
+
+#. UnifiedRole FileEditorListGrants, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:143
+msgid "View, download, edit and show all invited people."
+msgstr "Weergeven, downloaden, bewerken en alle genodigde personen zien."
+
+#. UnifiedRole Editor, Role Description (resolves directly)
+#. UnifiedRole SpaseEditorWithoutVersions, Role Description (resolves
+#. directly)
+#: pkg/unifiedrole/roles.go:113 pkg/unifiedrole/roles.go:131
+msgid "View, download, upload, edit, add and delete."
+msgstr "Weergeven, downloaden, uploaden, bewerken, toevoegen en verwijderen."
+
+#. UnifiedRole Manager, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:155
+msgid "View, download, upload, edit, add, delete and manage members."
+msgstr ""
+"Weergeven, downloaden, uploaden, bewerken, toevoegen, verwijderen en leden "
+"beheren."
+
+#. UnifiedRoleListGrants Editor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:119
+msgid "View, download, upload, edit, add, delete and show all invited people."
+msgstr ""
+"Weergeven, downloaden, uploaden, bewerken, toevoegen, verwijderen en alle "
+"genodigde personen zien."
+
+#. UnifiedRole SpaseEditor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:125
+msgid "View, download, upload, edit, add, delete including the history."
+msgstr ""
+"Weergeven, downloaden, uploaden, bewerken, toevoegen, verwijderen, incl. "
+"geschiedenis."

services/graph/pkg/l10n/locale/ru/LC_MESSAGES/graph.po

@@ -0,0 +1,140 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Savely Krasovsky, 2025
+# Lulufox, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-09-01 00:01+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Lulufox, 2025\n"
+"Language-Team: Russian (https://app.transifex.com/opencloud-eu/teams/204053/ru/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: ru\n"
+"Plural-Forms: nplurals=4; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<12 || n%100>14) ? 1 : n%10==0 || (n%10>=5 && n%10<=9) || (n%100>=11 && n%100<=14)? 2 : 3);\n"
+
+#. UnifiedRole Editor, Role DisplayName (resolves directly)
+#. UnifiedRole EditorListGrants, Role DisplayName (resolves directly)
+#. UnifiedRole SpaseEditor, Role DisplayName (resolves directly)
+#. UnifiedRole FileEditor, Role DisplayName (resolves directly)
+#. UnifiedRole FileEditorListGrants, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:116 pkg/unifiedrole/roles.go:122
+#: pkg/unifiedrole/roles.go:128 pkg/unifiedrole/roles.go:140
+#: pkg/unifiedrole/roles.go:146
+msgid "Can edit"
+msgstr "Может редактировать"
+
+#. UnifiedRole SpaseEditorWithoutVersions, Role DisplayName (resolves
+#. directly)
+#: pkg/unifiedrole/roles.go:134
+msgid "Can edit without versions"
+msgstr "Может редактировать без версионирования"
+
+#. UnifiedRole Manager, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:158
+msgid "Can manage"
+msgstr "Может управлять"
+
+#. UnifiedRole EditorLite, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:152
+msgid "Can upload"
+msgstr "Может загружать"
+
+#. UnifiedRole Viewer, Role DisplayName (resolves directly)
+#. UnifiedRole Viewer, Role DisplayName (resolves directly)
+#. UnifiedRole SpaseViewer, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:98 pkg/unifiedrole/roles.go:104
+#: pkg/unifiedrole/roles.go:110
+msgid "Can view"
+msgstr "Можно смотреть"
+
+#. UnifiedRole SecureViewer, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:164
+msgid "Can view (secure)"
+msgstr "Можно смотреть (защищено)"
+
+#. UnifiedRole FullDenial, Role DisplayName (resolves directly)
+#: pkg/unifiedrole/roles.go:170
+msgid "Cannot access"
+msgstr "Не имеет доступа"
+
+#. UnifiedRole FullDenial, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:167
+msgid "Deny all access."
+msgstr "Отказать во всех доступах"
+
+#. default description for new spaces
+#: pkg/service/v0/spacetemplates.go:32
+msgid "Here you can add a description for this Space."
+msgstr "Здесь вы можете добавить описание для Пространства"
+
+#. UnifiedRole Viewer, Role Description (resolves directly)
+#. UnifiedRole SpaceViewer, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:95 pkg/unifiedrole/roles.go:107
+msgid "View and download."
+msgstr "Просмотреть и скачать"
+
+#. UnifiedRole SecureViewer, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:161
+msgid "View only documents, images and PDFs. Watermarks will be applied."
+msgstr ""
+"Просмотреть только документы, изображения и файлы PDF. Будут присутствовать "
+"вотермарки."
+
+#. UnifiedRole FileEditor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:137
+msgid "View, download and edit."
+msgstr "Просмотреть, скачать и редактировать."
+
+#. UnifiedRole ViewerListGrants, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:101
+msgid "View, download and show all invited people."
+msgstr "Просмотреть, скачать и показать всех приглашенных людей."
+
+#. UnifiedRole EditorLite, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:149
+msgid "View, download and upload."
+msgstr "Просмотреть, скачать и загрузить."
+
+#. UnifiedRole FileEditorListGrants, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:143
+msgid "View, download, edit and show all invited people."
+msgstr ""
+"Просмотреть, скачать, отредактировать и показать всех приглашенных людей."
+
+#. UnifiedRole Editor, Role Description (resolves directly)
+#. UnifiedRole SpaseEditorWithoutVersions, Role Description (resolves
+#. directly)
+#: pkg/unifiedrole/roles.go:113 pkg/unifiedrole/roles.go:131
+msgid "View, download, upload, edit, add and delete."
+msgstr "Просмотреть, скачать, загрузить, редактировать, добавить и удалить."
+
+#. UnifiedRole Manager, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:155
+msgid "View, download, upload, edit, add, delete and manage members."
+msgstr ""
+"Просмотреть, скачать, загрузить, редактировать, добавить, удалить и "
+"управлять командой."
+
+#. UnifiedRoleListGrants Editor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:119
+msgid "View, download, upload, edit, add, delete and show all invited people."
+msgstr ""
+"Просмотреть, скачать, загрузить, редактировать, добавить, удалить и показать"
+" всех приглашенных людей."
+
+#. UnifiedRole SpaseEditor, Role Description (resolves directly)
+#: pkg/unifiedrole/roles.go:125
+msgid "View, download, upload, edit, add, delete including the history."
+msgstr ""
+"Просмотреть, скачать, загрузить, редактировать, добавить, удалить включая "
+"историю."

services/graph/pkg/l10n/locale/zh/LC_MESSAGES/graph.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: YQS Yang, 2025\n"
 "Language-Team: Chinese (https://app.transifex.com/opencloud-eu/teams/204053/zh/)\n"

services/graph/pkg/service/v0/users.go

@@ -12,11 +12,13 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/CiscoM31/godata"
 	invitepb "github.com/cs3org/go-cs3apis/cs3/ocm/invite/v1beta1"
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	v1beta1 "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 	"github.com/google/uuid"
@@ -606,6 +608,8 @@ func getUserLanguage(ctx context.Context, valueService settingssvc.ValueService,
 
 // DeleteUser implements the Service interface.
 func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
+	purgeUser := r.Header.Get("Prefer") == "purge"
+
 	logger := g.logger.SubloggerWithRequestID(r.Context())
 	logger.Debug().Msg("calling delete user")
 	sanitizedPath := strings.TrimPrefix(r.URL.Path, "/graph/v1.0/")
@@ -638,14 +642,23 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	e := events.UserDeleted{UserID: user.GetId()}
-	if currentUser, ok := revactx.ContextGetUser(r.Context()); ok {
-		if currentUser.GetId().GetOpaqueId() == user.GetId() {
-			logger.Debug().Msg("could not delete user: self deletion forbidden")
-			errorcode.NotAllowed.Render(w, r, http.StatusForbidden, "self deletion forbidden")
-			return
-		}
-		e.Executant = currentUser.GetId()
+	if g.config.UserSoftDeleteRetentionTime > 0 && purgeUser && user.GetAccountEnabled() {
+		logger.Debug().Msg("could not delete user: purgeUser is set but user is still enabled")
+		errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "user should be hard deleted, but is still enabled, please soft delete first")
+		return
+	}
+
+	currentUser, ok := revactx.ContextGetUser(r.Context())
+	if !ok {
+		logger.Debug().Msg("could not delete user: user not in context")
+		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "user not in context")
+		return
+	}
+
+	if currentUser.GetId().GetOpaqueId() == user.GetId() {
+		logger.Debug().Msg("could not delete user: self deletion forbidden")
+		errorcode.NotAllowed.Render(w, r, http.StatusForbidden, "self deletion forbidden")
+		return
 	}
 
 	if g.gatewaySelector != nil {
@@ -692,34 +705,60 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
 					return
 				}
 			}
-			purgeFlag := utils.AppendPlainToOpaque(nil, "purge", "")
-			_, err := client.DeleteStorageSpace(r.Context(), &storageprovider.DeleteStorageSpaceRequest{
-				Opaque: purgeFlag,
-				Id: &storageprovider.StorageSpaceId{
-					OpaqueId: sp.Id.OpaqueId,
-				},
-			})
-			if err != nil {
-				// transport error, log as error
-				logger.Error().Err(err).Msg("could not delete homespace: transport error")
-				errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "could not delete homespace, aborting")
-				return
+			// the space will if the system does not have a UserSoftDeleteRetentionTime configured, e.g. SoftDelete disabled
+			if g.config.UserSoftDeleteRetentionTime == 0 || (purgeUser && !user.GetAccountEnabled()) {
+				purgeSpaceFlag := utils.AppendPlainToOpaque(nil, "purge", "")
+				_, err := client.DeleteStorageSpace(r.Context(), &storageprovider.DeleteStorageSpaceRequest{
+					Opaque: purgeSpaceFlag,
+					Id: &storageprovider.StorageSpaceId{
+						OpaqueId: sp.Id.OpaqueId,
+					},
+				})
+				if err != nil {
+					// transport error, log as error
+					logger.Error().Err(err).Msg("could not delete homespace: transport error")
+					errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "could not delete homespace, aborting")
+					return
+				}
 			}
 			break
 		}
 	}
 
-	logger.Debug().Str("id", user.GetId()).Msg("calling delete user on backend")
-	err = g.identityBackend.DeleteUser(r.Context(), user.GetId())
+	if g.config.UserSoftDeleteRetentionTime == 0 || (purgeUser && !user.GetAccountEnabled()) {
+		logger.Debug().Str("id", user.GetId()).Msg("calling delete user on backend")
+		err = g.identityBackend.DeleteUser(r.Context(), user.GetId())
 
-	if err != nil {
-		logger.Debug().Err(err).Msg("could not delete user: backend error")
-		errorcode.RenderError(w, r, err)
-		return
+		if err != nil {
+			logger.Debug().Err(err).Msg("could not delete user: backend error")
+			errorcode.RenderError(w, r, err)
+			return
+		}
+	} else {
+		logger.Debug().Str("id", user.GetId()).Msg("calling soft delete user on backend")
+		userUpdate := *libregraph.NewUserUpdate()
+		userUpdate.AccountEnabled = libregraph.PtrBool(false)
+		g.identityBackend.UpdateUser(r.Context(), user.GetId(), userUpdate)
 	}
 
-	g.publishEvent(r.Context(), e)
-
+	if g.config.UserSoftDeleteRetentionTime == 0 ||
+		(g.config.UserSoftDeleteRetentionTime > 0 && purgeUser && !user.GetAccountEnabled()) {
+		e := events.UserDeleted{UserID: user.GetId()}
+		e.Executant = currentUser.GetId()
+		g.publishEvent(r.Context(), e)
+	} else {
+		e := events.UserSoftDeleted{
+			UserID:        user.GetId(),
+			RetentionTime: g.config.UserSoftDeleteRetentionTime,
+			Timestamp: &v1beta1.Timestamp{
+				Seconds: uint64(time.Now().Unix()),
+				Nanos:   uint32(time.Now().Nanosecond()),
+			},
+			Reason: "User deleted via Graph API", // TODO: this needs a proper implementation through the request
+		}
+		e.Executant = currentUser.GetId()
+		g.publishEvent(r.Context(), e)
+	}
 	render.Status(r, http.StatusNoContent)
 	render.NoContent(w, r)
 }

services/graph/pkg/service/v0/users_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"time"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
@@ -1014,6 +1015,107 @@ var _ = Describe("Users", func() {
 			})
 		})
 
+		Describe("SoftDeleteUser", func() {
+			var (
+				user *libregraph.User
+				//userUpdate   *libregraph.UserUpdate
+				expectedUser *libregraph.User
+			)
+
+			BeforeEach(func() {
+				cfg.UserSoftDeleteRetentionTime = 30 * 24 * time.Hour // 30 days
+				user = libregraph.NewUser("Display Name", "user")
+				user.SetMail("user@example.com")
+				user.SetId("/users/user")
+
+				//userUpdate = libregraph.NewUserUpdate()
+
+				expectedUser = libregraph.NewUser("Display Name", "user")
+				expectedUser.SetMail(user.GetMail())
+				expectedUser.SetId(user.GetId())
+
+				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(user, nil)
+			})
+
+			It("soft deletes a user", func() {
+				otheruser := &userv1beta1.User{
+					Id: &userv1beta1.UserId{
+						OpaqueId: "otheruser",
+					},
+				}
+
+				lu := libregraph.User{}
+				lu.SetId(otheruser.Id.OpaqueId)
+				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(&lu, nil)
+				identityBackend.On("DeleteUser", mock.Anything, mock.Anything).Return(nil)
+				identityBackend.On("UpdateUser", mock.Anything, mock.Anything, mock.Anything).Return(&lu, nil)
+				gatewayClient.On("DeleteStorageSpace", mock.Anything, mock.Anything).Return(&provider.DeleteStorageSpaceResponse{
+					Status: status.NewOK(ctx),
+				}, nil)
+				gatewayClient.On("ListStorageSpaces", mock.Anything, mock.Anything, mock.Anything).Return(&provider.ListStorageSpacesResponse{
+					Status: status.NewOK(ctx),
+					StorageSpaces: []*provider.StorageSpace{
+						{
+							Opaque:    &typesv1beta1.Opaque{},
+							Id:        &provider.StorageSpaceId{OpaqueId: "drive1"},
+							Root:      &provider.ResourceId{SpaceId: "space", OpaqueId: "space"},
+							SpaceType: "personal",
+							Owner:     otheruser,
+						},
+					},
+				}, nil)
+
+				r := httptest.NewRequest(http.MethodDelete, "/graph/v1.0/users/{userid}", nil)
+				rctx := chi.NewRouteContext()
+				rctx.URLParams.Add("userID", lu.GetId())
+				r = r.WithContext(context.WithValue(revactx.ContextSetUser(ctx, currentUser), chi.RouteCtxKey, rctx))
+				svc.DeleteUser(rr, r)
+
+				Expect(rr.Code).To(Equal(http.StatusNoContent))
+				gatewayClient.AssertNumberOfCalls(GinkgoT(), "DeleteStorageSpace", 0) // 2 calls for the home space. first trash, then purge
+
+			})
+
+			It("hard deletes the user", func() {
+				otheruser := &userv1beta1.User{
+					Id: &userv1beta1.UserId{
+						OpaqueId: "otheruser",
+					},
+				}
+
+				lu := libregraph.User{}
+				lu.SetId(otheruser.Id.OpaqueId)
+				identityBackend.On("GetUser", mock.Anything, mock.Anything, mock.Anything).Return(&lu, nil)
+				identityBackend.On("DeleteUser", mock.Anything, mock.Anything).Return(nil)
+				identityBackend.On("UpdateUser", mock.Anything, mock.Anything, mock.Anything).Return(&lu, nil)
+				gatewayClient.On("DeleteStorageSpace", mock.Anything, mock.Anything).Return(&provider.DeleteStorageSpaceResponse{
+					Status: status.NewOK(ctx),
+				}, nil)
+				gatewayClient.On("ListStorageSpaces", mock.Anything, mock.Anything, mock.Anything).Return(&provider.ListStorageSpacesResponse{
+					Status: status.NewOK(ctx),
+					StorageSpaces: []*provider.StorageSpace{
+						{
+							Opaque:    &typesv1beta1.Opaque{},
+							Id:        &provider.StorageSpaceId{OpaqueId: "drive1"},
+							Root:      &provider.ResourceId{SpaceId: "space", OpaqueId: "space"},
+							SpaceType: "personal",
+							Owner:     otheruser,
+						},
+					},
+				}, nil)
+
+				r := httptest.NewRequest(http.MethodDelete, "/graph/v1.0/users/{userid}", nil)
+				r.Header.Set("Prefer", "purge") // this header is used to indicate a hard delete
+				rctx := chi.NewRouteContext()
+				rctx.URLParams.Add("userID", lu.GetId())
+				r = r.WithContext(context.WithValue(revactx.ContextSetUser(ctx, currentUser), chi.RouteCtxKey, rctx))
+				svc.DeleteUser(rr, r)
+
+				Expect(rr.Code).To(Equal(http.StatusNoContent))
+				gatewayClient.AssertNumberOfCalls(GinkgoT(), "DeleteStorageSpace", 0) // 0 calls for the home space. since we are "just" soft deleting
+			})
+		})
+
 		Describe("PatchUser", func() {
 			var (
 				user                      *libregraph.User

services/idm/ldif/base.ldif.tmpl

@@ -31,6 +31,7 @@ displayName: Admin
 description: An admin for this OpenCloud instance.
 mail: admin@example.org
 openCloudUUID: {{ .ID }}
+openCloudTenantId: {{ .TenantID }}
 openCloudExternalIdentity:  $ {{ .Issuer }} $ {{ .ID }}
 {{ else -}}
 dn: uid={{ .Name }},ou=sysusers,o=libregraph-idm

services/idm/ldif/demousers.ldif.tmpl

@@ -15,6 +15,7 @@ mail: alan@example.org
 openCloudUserEnabled: TRUE
 openCloudUUID: b1f74ec4-dd7e-11ef-a543-03775734d0f7
 openCloudExternalIdentity:  $ {{.}} $ b1f74ec4-dd7e-11ef-a543-03775734d0f7
+openCloudTenantId: cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
 
 dn: uid=lynn,ou=users,o=libregraph-idm
@@ -34,6 +35,7 @@ mail: lynn@example.org
 openCloudUserEnabled: TRUE
 openCloudUUID: 60708dda-e897-11ef-919f-bbb7437d6ec2
 openCloudExternalIdentity:  $ {{.}} $ 60708dda-e897-11ef-919f-bbb7437d6ec2
+openCloudTenantId: cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
 
 dn: uid=mary,ou=users,o=libregraph-idm
@@ -53,6 +55,7 @@ mail: mary@example.org
 openCloudUserEnabled: TRUE
 openCloudUUID: 056fc874-dd7f-11ef-ba84-af6fca4b7289
 openCloudExternalIdentity:  $ {{.}} $ 056fc874-dd7f-11ef-ba84-af6fca4b7289
+openCloudTenantId: cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
 
 dn: uid=margaret,ou=users,o=libregraph-idm
@@ -72,6 +75,7 @@ mail: margaret@example.org
 openCloudUserEnabled: TRUE
 openCloudUUID: 801abee4-dd7f-11ef-a324-83f55a754b62
 openCloudExternalIdentity:  $ {{.}} $ 801abee4-dd7f-11ef-a324-83f55a754b62
+openCloudTenantId: cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
 
 dn: uid=dennis,ou=users,o=libregraph-idm
@@ -91,6 +95,7 @@ mail: dennis@example.org
 openCloudUserEnabled: TRUE
 openCloudUUID: cd88bf9a-dd7f-11ef-a609-7f78deb2345f
 openCloudExternalIdentity:  $ {{.}} $ cd88bf9a-dd7f-11ef-a609-7f78deb2345f
+openCloudTenantId: cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
 
 dn: cn=users,ou=groups,o=libregraph-idm

services/idm/pkg/command/server.go

@@ -132,6 +132,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 		Name     string
 		Password string
 		ID       string
+		TenantID string
 		Issuer   string
 	}
 
@@ -151,12 +152,16 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 	}
 
 	if cfg.AdminUserID != "" {
-		serviceUsers = append(serviceUsers, svcUser{
+		adminUser := svcUser{
 			Name:     "admin",
 			Password: cfg.ServiceUserPasswords.OCAdmin,
 			ID:       cfg.AdminUserID,
 			Issuer:   cfg.DemoUsersIssuerUrl,
-		})
+		}
+		if cfg.CreateDemoUsers {
+			adminUser.TenantID = "cd22ea13-f6b4-4f5f-a2c2-69b5a0f07a8b"
+		}
+		serviceUsers = append(serviceUsers, adminUser)
 	}
 
 	bdb := &ldbbolt.LdbBolt{}

services/notifications/pkg/email/l10n/locale/ca/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Ivan Fustero, 2025\n"
 "Language-Team: Catalan (https://app.transifex.com/opencloud-eu/teams/204053/ca/)\n"

services/notifications/pkg/email/l10n/locale/de/LC_MESSAGES/notifications.po

@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Jonas, 2025\n"
 "Language-Team: German (https://app.transifex.com/opencloud-eu/teams/204053/de/)\n"

services/notifications/pkg/email/l10n/locale/es/LC_MESSAGES/notifications.po

@@ -0,0 +1,160 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Elías Martín, 2025
+# miguel tapias, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-09-02 00:01+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: miguel tapias, 2025\n"
+"Language-Team: Spanish (https://app.transifex.com/opencloud-eu/teams/204053/es/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: es\n"
+"Plural-Forms: nplurals=3; plural=n == 1 ? 0 : n != 0 && n % 1000000 == 0 ? 1 : 2;\n"
+
+#. UnsharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:65
+msgid "Click here to check it: {ShareLink}"
+msgstr "Clic aquí para revisarlo: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .CallToAction }}
+#. SharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:23 pkg/email/templates.go:50
+msgid "Click here to view it: {ShareLink}"
+msgstr "Clic aquí para verlo: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:19
+msgid "Hello {ShareGrantee}"
+msgstr "Hola {ShareGrantee}"
+
+#. ShareExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:32
+msgid "Hello {ShareGrantee},"
+msgstr "Hola {ShareGrantee},"
+
+#. SharedSpace email template, resolves via {{ .Greeting }}
+#. UnsharedSpace email template, resolves via {{ .Greeting }}
+#. MembershipExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:46 pkg/email/templates.go:59
+#: pkg/email/templates.go:74
+msgid "Hello {SpaceGrantee},"
+msgstr "Hola {SpaceGrantee},"
+
+#. Grouped email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:118
+msgid "Hi {DisplayName},"
+msgstr "Bienvenido {DisplayName},"
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{ .Greeting
+#. }}
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .Greeting }}
+#: pkg/email/templates.go:87 pkg/email/templates.go:104
+msgid "Hi,"
+msgstr "¡Hola!,"
+
+#. MembershipExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:72
+msgid "Membership of '{SpaceName}' expired at {ExpiredAt}"
+msgstr "La membresía de '{SpaceName}' expiró el {ExpiredAt}"
+
+#. Grouped email template, Subject field (resolves directly)
+#: pkg/email/templates.go:116
+msgid "Report"
+msgstr "Reporte"
+
+#. ScienceMeshInviteTokenGenerated email template, Subject field (resolves
+#. directly)
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, Subject
+#. field (resolves directly)
+#: pkg/email/templates.go:85 pkg/email/templates.go:102
+msgid "ScienceMesh: {InitiatorName} wants to collaborate with you"
+msgstr "ScienceMesh: {InitiatorName} quiere colaborar contigo"
+
+#. ShareExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:30
+msgid "Share to '{ShareFolder}' expired at {ExpiredAt}"
+msgstr "La compartición de '{ShareFolder}' expiró el {ExpiredAt}"
+
+#. MembershipExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:76
+msgid ""
+"Your membership of space {SpaceName} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this membership has expired you still might have access through other shares and/or space memberships"
+msgstr ""
+
+#. ShareExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:34
+msgid ""
+"Your share to {ShareFolder} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this share has been revoked you still might have access through other shares and/or space memberships."
+msgstr ""
+
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .MessageBody }}
+#: pkg/email/templates.go:106
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"Please visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{
+#. .MessageBody }}
+#: pkg/email/templates.go:89
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"To accept the invite, please visit the following URL:\n"
+"{ShareLink}\n"
+"\n"
+"Alternatively, you can visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+
+#. ShareCreated email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:21
+msgid "{ShareSharer} has shared \"{ShareFolder}\" with you."
+msgstr "{ShareSharer} ha compartido \"{ShareFolder}\" contigo."
+
+#. ShareCreated email template, Subject field (resolves directly)
+#: pkg/email/templates.go:17
+msgid "{ShareSharer} shared '{ShareFolder}' with you"
+msgstr "{ShareSharer} compartió '{ShareFolder}' contigo"
+
+#. SharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:48
+msgid "{SpaceSharer} has invited you to join \"{SpaceName}\"."
+msgstr "{SpaceSharer} te ha invitado a unirte a \"{SpaceName}\"."
+
+#. UnsharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:61
+msgid ""
+"{SpaceSharer} has removed you from \"{SpaceName}\".\n"
+"\n"
+"You might still have access through your other groups or direct membership."
+msgstr ""
+
+#. SharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:44
+msgid "{SpaceSharer} invited you to join {SpaceName}"
+msgstr "{SpaceSharer} te invitó para unirte a {SpaceName}"
+
+#. UnsharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:57
+msgid "{SpaceSharer} removed you from {SpaceName}"
+msgstr "{SpaceSharer} te eliminó de {SpaceName}"

services/notifications/pkg/email/l10n/locale/fr/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: eric_G <junk.eg@free.fr>, 2025\n"
 "Language-Team: French (https://app.transifex.com/opencloud-eu/teams/204053/fr/)\n"

services/notifications/pkg/email/l10n/locale/it/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Simone Broglia, 2025\n"
 "Language-Team: Italian (https://app.transifex.com/opencloud-eu/teams/204053/it/)\n"

services/notifications/pkg/email/l10n/locale/ko/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: gapho shin, 2025\n"
 "Language-Team: Korean (https://app.transifex.com/opencloud-eu/teams/204053/ko/)\n"

services/notifications/pkg/email/l10n/locale/nl/LC_MESSAGES/notifications.po

@@ -0,0 +1,179 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Stephan Paternotte <stephan@paternottes.net>, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-08-25 00:01+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Stephan Paternotte <stephan@paternottes.net>, 2025\n"
+"Language-Team: Dutch (https://app.transifex.com/opencloud-eu/teams/204053/nl/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: nl\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. UnsharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:65
+msgid "Click here to check it: {ShareLink}"
+msgstr "Klik hier om het te controleren: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .CallToAction }}
+#. SharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:23 pkg/email/templates.go:50
+msgid "Click here to view it: {ShareLink}"
+msgstr "Klik hier om het te bekijken: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:19
+msgid "Hello {ShareGrantee}"
+msgstr "Beste {ShareGrantee}"
+
+#. ShareExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:32
+msgid "Hello {ShareGrantee},"
+msgstr "Beste {ShareGrantee},"
+
+#. SharedSpace email template, resolves via {{ .Greeting }}
+#. UnsharedSpace email template, resolves via {{ .Greeting }}
+#. MembershipExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:46 pkg/email/templates.go:59
+#: pkg/email/templates.go:74
+msgid "Hello {SpaceGrantee},"
+msgstr "Beste {SpaceGrantee},"
+
+#. Grouped email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:118
+msgid "Hi {DisplayName},"
+msgstr "Hallo {DisplayName},"
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{ .Greeting
+#. }}
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .Greeting }}
+#: pkg/email/templates.go:87 pkg/email/templates.go:104
+msgid "Hi,"
+msgstr "Hallo,"
+
+#. MembershipExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:72
+msgid "Membership of '{SpaceName}' expired at {ExpiredAt}"
+msgstr "Lidmaatschap van '{SpaceName}' is verlopen op {ExpiredAt}"
+
+#. Grouped email template, Subject field (resolves directly)
+#: pkg/email/templates.go:116
+msgid "Report"
+msgstr "Rapportage"
+
+#. ScienceMeshInviteTokenGenerated email template, Subject field (resolves
+#. directly)
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, Subject
+#. field (resolves directly)
+#: pkg/email/templates.go:85 pkg/email/templates.go:102
+msgid "ScienceMesh: {InitiatorName} wants to collaborate with you"
+msgstr "ScienceMesh: {InitiatorName} wil met je samenwerken"
+
+#. ShareExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:30
+msgid "Share to '{ShareFolder}' expired at {ExpiredAt}"
+msgstr "Share '{ShareFolder}' is verlopen op {ExpiredAt}"
+
+#. MembershipExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:76
+msgid ""
+"Your membership of space {SpaceName} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this membership has expired you still might have access through other shares and/or space memberships"
+msgstr ""
+"Jouw lidmaatschap van ruimte {SpaceName} is verlopen op {ExpiredAt}\n"
+"\n"
+"Hoewel dit lidmaatschap is verlopen, kun je mogelijk nog steeds toegang hebben via andere shares en/of ruimtelidmaatschappen."
+
+#. ShareExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:34
+msgid ""
+"Your share to {ShareFolder} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this share has been revoked you still might have access through other shares and/or space memberships."
+msgstr ""
+"Jouw toegang tot {ShareFolder} is verlopen op {ExpiredAt}\n"
+"\n"
+"Hoewel de toegang is ingetrokken, kun je mogelijk nog steeds toegang hebben via andere shares en/of ruimtelidmaatschappen."
+
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .MessageBody }}
+#: pkg/email/templates.go:106
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"Please visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+"{ShareSharer} ({ShareSharerMail}) wil samenwerkingsbronnen met je delen.\n"
+"Open je federatie-instellingen en gebruik de volgende gegevens.:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{
+#. .MessageBody }}
+#: pkg/email/templates.go:89
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"To accept the invite, please visit the following URL:\n"
+"{ShareLink}\n"
+"\n"
+"Alternatively, you can visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+"{ShareSharer} ({ShareSharerMail}) wil samenwerkingsbronnen met je delen.\n"
+"Open de volgende URL om de uitnodiging te accepteren:\n"
+"{ShareLink}\n"
+"\n"
+"Alternatief kun je je federatie-instellingen openen en de volgende gegevens gebruiken.:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+
+#. ShareCreated email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:21
+msgid "{ShareSharer} has shared \"{ShareFolder}\" with you."
+msgstr "{ShareSharer} heeft \"{ShareFolder}\" met jou gedeeld."
+
+#. ShareCreated email template, Subject field (resolves directly)
+#: pkg/email/templates.go:17
+msgid "{ShareSharer} shared '{ShareFolder}' with you"
+msgstr "{ShareSharer} deelt '{ShareFolder}' met jou"
+
+#. SharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:48
+msgid "{SpaceSharer} has invited you to join \"{SpaceName}\"."
+msgstr "{SpaceSharer} heeft je uitgenodigd om deel te nemen in \"{SpaceName}\"."
+
+#. UnsharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:61
+msgid ""
+"{SpaceSharer} has removed you from \"{SpaceName}\".\n"
+"\n"
+"You might still have access through your other groups or direct membership."
+msgstr ""
+"{SpaceSharer} heeft jou verwijderd uit \"{SpaceName}\".\n"
+"\n"
+"Je hebt mogelijk nog steeds toegang via andere groepen of directe lidmaatschap."
+
+#. SharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:44
+msgid "{SpaceSharer} invited you to join {SpaceName}"
+msgstr "{SpaceSharer} heeft jou uitgenodigd om deel te nemen in {SpaceName}"
+
+#. UnsharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:57
+msgid "{SpaceSharer} removed you from {SpaceName}"
+msgstr "{SpaceSharer} heeft jou verwijderd uit {SpaceName}"

services/notifications/pkg/email/l10n/locale/ru/LC_MESSAGES/notifications.po

@@ -0,0 +1,179 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Savely Krasovsky, 2025
+# Lulufox, 2025
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2025-08-26 00:01+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Lulufox, 2025\n"
+"Language-Team: Russian (https://app.transifex.com/opencloud-eu/teams/204053/ru/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: ru\n"
+"Plural-Forms: nplurals=4; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<12 || n%100>14) ? 1 : n%10==0 || (n%10>=5 && n%10<=9) || (n%100>=11 && n%100<=14)? 2 : 3);\n"
+
+#. UnsharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:65
+msgid "Click here to check it: {ShareLink}"
+msgstr "Нажмите для проверки: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .CallToAction }}
+#. SharedSpace email template, resolves via {{ .CallToAction }}
+#: pkg/email/templates.go:23 pkg/email/templates.go:50
+msgid "Click here to view it: {ShareLink}"
+msgstr "Нажмите для просмотра: {ShareLink}"
+
+#. ShareCreated email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:19
+msgid "Hello {ShareGrantee}"
+msgstr "Здравствуйте, {ShareGrantee}"
+
+#. ShareExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:32
+msgid "Hello {ShareGrantee},"
+msgstr "Здравствуйте, {ShareGrantee},"
+
+#. SharedSpace email template, resolves via {{ .Greeting }}
+#. UnsharedSpace email template, resolves via {{ .Greeting }}
+#. MembershipExpired email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:46 pkg/email/templates.go:59
+#: pkg/email/templates.go:74
+msgid "Hello {SpaceGrantee},"
+msgstr "Здравствуйте, {SpaceGrantee},"
+
+#. Grouped email template, resolves via {{ .Greeting }}
+#: pkg/email/templates.go:118
+msgid "Hi {DisplayName},"
+msgstr "Привет, {DisplayName},"
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{ .Greeting
+#. }}
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .Greeting }}
+#: pkg/email/templates.go:87 pkg/email/templates.go:104
+msgid "Hi,"
+msgstr "Привет"
+
+#. MembershipExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:72
+msgid "Membership of '{SpaceName}' expired at {ExpiredAt}"
+msgstr "Членство в '{SpaceName}' истекло {ExpiredAt}"
+
+#. Grouped email template, Subject field (resolves directly)
+#: pkg/email/templates.go:116
+msgid "Report"
+msgstr "Пожаловаться"
+
+#. ScienceMeshInviteTokenGenerated email template, Subject field (resolves
+#. directly)
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, Subject
+#. field (resolves directly)
+#: pkg/email/templates.go:85 pkg/email/templates.go:102
+msgid "ScienceMesh: {InitiatorName} wants to collaborate with you"
+msgstr "ScienceMesh: {InitiatorName} хочет сотрудничать с вами"
+
+#. ShareExpired email template, Subject field (resolves directly)
+#: pkg/email/templates.go:30
+msgid "Share to '{ShareFolder}' expired at {ExpiredAt}"
+msgstr "Совместный доступ к '{ShareFolder}' истек {ExpiredAt}"
+
+#. MembershipExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:76
+msgid ""
+"Your membership of space {SpaceName} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this membership has expired you still might have access through other shares and/or space memberships"
+msgstr ""
+"Ваше членство в пространстве {SpaceName} истекло {ExpiredAt}\n"
+"\n"
+"Не смотря на это, у вас может сохраняться доступ через ресурсы совместного доступа и/или членство в других пространствах."
+
+#. ShareExpired email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:34
+msgid ""
+"Your share to {ShareFolder} has expired at {ExpiredAt}\n"
+"\n"
+"Even though this share has been revoked you still might have access through other shares and/or space memberships."
+msgstr ""
+"Ваш совместный доступ к {ShareFolder} истек {ExpiredAt}\n"
+"\n"
+"Не смотря на это, у вас может сохраняться доступ через другие ресурсы совместного доступа и/или членство в пространствах."
+
+#. ScienceMeshInviteTokenGeneratedWithoutShareLink email template, resolves
+#. via {{ .MessageBody }}
+#: pkg/email/templates.go:106
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"Please visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+"{ShareSharer} ({ShareSharerMail}) хочет начать совместно использовать ресурсы вместе с Вами.\n"
+"Пожалуйста, перейдите в свои федеративные настройки и используйте следующие параметры:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+
+#. ScienceMeshInviteTokenGenerated email template, resolves via {{
+#. .MessageBody }}
+#: pkg/email/templates.go:89
+msgid ""
+"{ShareSharer} ({ShareSharerMail}) wants to start sharing collaboration resources with you.\n"
+"To accept the invite, please visit the following URL:\n"
+"{ShareLink}\n"
+"\n"
+"Alternatively, you can visit your federation settings and use the following details:\n"
+"  Token: {Token}\n"
+"  ProviderDomain: {ProviderDomain}"
+msgstr ""
+"{ShareSharer} ({ShareSharerMail}) хочет начать совместно использовать ресурсы вместе с Вами.\n"
+"Чтобы принять приглашение, перейдите по ссылкеL:\n"
+"{ShareLink}\n"
+"Или перейдите в свои федеративные настройки и используйте следующие параметры:\n"
+"Token: {Token}\n"
+"ProviderDomain: {ProviderDomain}"
+
+#. ShareCreated email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:21
+msgid "{ShareSharer} has shared \"{ShareFolder}\" with you."
+msgstr "{ShareSharer} предоставил вам совместный доступ к \"{ShareFolder}\"."
+
+#. ShareCreated email template, Subject field (resolves directly)
+#: pkg/email/templates.go:17
+msgid "{ShareSharer} shared '{ShareFolder}' with you"
+msgstr "{ShareSharer} предоставил(-а) вам совместный доступ к '{ShareFolder}'"
+
+#. SharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:48
+msgid "{SpaceSharer} has invited you to join \"{SpaceName}\"."
+msgstr "{SpaceSharer} пригласил(-а) Вас присоединиться к \"{SpaceName}\"."
+
+#. UnsharedSpace email template, resolves via {{ .MessageBody }}
+#: pkg/email/templates.go:61
+msgid ""
+"{SpaceSharer} has removed you from \"{SpaceName}\".\n"
+"\n"
+"You might still have access through your other groups or direct membership."
+msgstr ""
+"{SpaceSharer} удалил(-а) вас из \"{SpaceName}\".\n"
+"\n"
+"Вы всё ещё можете иметь доступ через ваши другие группы или прямое членство."
+
+#. SharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:44
+msgid "{SpaceSharer} invited you to join {SpaceName}"
+msgstr "{SpaceSharer} пригласил(-а) Вас присоединиться к \"{SpaceName}\"."
+
+#. UnsharedSpace email template, Subject field (resolves directly)
+#: pkg/email/templates.go:57
+msgid "{SpaceSharer} removed you from {SpaceName}"
+msgstr "{SpaceSharer} исключил(-а) Вас из {SpaceName}"

services/notifications/pkg/email/l10n/locale/sv/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Davis Kaza, 2025\n"
 "Language-Team: Swedish (https://app.transifex.com/opencloud-eu/teams/204053/sv/)\n"

services/notifications/pkg/email/l10n/locale/zh/LC_MESSAGES/notifications.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-07-30 00:01+0000\n"
+"POT-Creation-Date: 2025-08-19 00:01+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: YQS Yang, 2025\n"
 "Language-Team: Chinese (https://app.transifex.com/opencloud-eu/teams/204053/zh/)\n"

services/postprocessing/pkg/metrics/metrics.go

@@ -11,6 +11,50 @@ var (
 
 	// Subsystem defines the subsystem for the defines metrics.
 	Subsystem = "postprocessing"
+
+	buildInfo = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "build_info",
+		Help:      "Build information",
+	}, []string{"version"})
+	eventsOutstandingAcks = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_outstanding_acks",
+		Help:      "Number of outstanding acks for events",
+	})
+	eventsUnprocessed = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_unprocessed",
+		Help:      "Number of unprocessed events",
+	})
+	eventsRedelivered = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_redelivered",
+		Help:      "Number of redelivered events",
+	})
+	inProgress = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "in_progress",
+		Help:      "Number of postprocessing events in progress",
+	})
+	finished = promauto.NewCounterVec(prometheus.CounterOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "finished",
+		Help:      "Number of finished postprocessing events",
+	}, []string{"status"})
+	duration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "duration_seconds",
+		Help:      "Duration of postprocessing operations in seconds",
+		Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60, 120, 300, 600, 1200},
+	}, []string{"status"})
 )
 
 // Metrics defines the available metrics of this service.
@@ -28,49 +72,13 @@ type Metrics struct {
 // New initializes the available metrics.
 func New() *Metrics {
 	m := &Metrics{
-		BuildInfo: promauto.NewGaugeVec(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "build_info",
-			Help:      "Build information",
-		}, []string{"version"}),
-		EventsOutstandingAcks: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_outstanding_acks",
-			Help:      "Number of outstanding acks for events",
-		}),
-		EventsUnprocessed: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_unprocessed",
-			Help:      "Number of unprocessed events",
-		}),
-		EventsRedelivered: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_redelivered",
-			Help:      "Number of redelivered events",
-		}),
-		InProgress: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "in_progress",
-			Help:      "Number of postprocessing events in progress",
-		}),
-		Finished: promauto.NewCounterVec(prometheus.CounterOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "finished",
-			Help:      "Number of finished postprocessing events",
-		}, []string{"status"}),
-		Duration: promauto.NewHistogramVec(prometheus.HistogramOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "duration_seconds",
-			Help:      "Duration of postprocessing operations in seconds",
-			Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60, 120, 300, 600, 1200},
-		}, []string{"status"}),
+		BuildInfo:             buildInfo,
+		EventsOutstandingAcks: eventsOutstandingAcks,
+		EventsUnprocessed:     eventsUnprocessed,
+		EventsRedelivered:     eventsRedelivered,
+		InProgress:            inProgress,
+		Finished:              finished,
+		Duration:              duration,
 	}
 
 	return m

services/proxy/pkg/config/csp.yaml

@@ -4,7 +4,7 @@ directives:
   connect-src:
     - '''self'''
     - 'blob:'
-    - 'https://raw.githubusercontent.com/opencloud-eu/awesome/'
+    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
   default-src:
     - '''none'''
   font-src:
@@ -19,7 +19,7 @@ directives:
     - '''self'''
     - 'data:'
     - 'blob:'
-    - 'https://raw.githubusercontent.com/opencloud-eu/awesome/'
+    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
   manifest-src:
     - '''self'''
   media-src:

services/proxy/pkg/middleware/account_resolver.go

@@ -11,6 +11,7 @@ import (
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/user/backend"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles"
 
+	cs3user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/oidc"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
@@ -125,7 +126,8 @@ func (m accountResolver) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 				return
 			}
 			m.logger.Debug().Interface("claims", claims).Msg("Autoprovisioning user")
-			newuser, err := m.userProvider.CreateUserFromClaims(req.Context(), claims)
+			var newuser *cs3user.User
+			newuser, err = m.userProvider.CreateUserFromClaims(req.Context(), claims)
 			if err != nil {
 				m.logger.Error().Err(err).Msg("Autoprovisioning user failed")
 				w.WriteHeader(http.StatusInternalServerError)

services/search/pkg/config/config.go

@@ -28,6 +28,7 @@ type Config struct {
 	Engine                     Engine                `yaml:"engine"`
 	Extractor                  Extractor             `yaml:"extractor"`
 	ContentExtractionSizeLimit uint64                `yaml:"content_extraction_size_limit" env:"SEARCH_CONTENT_EXTRACTION_SIZE_LIMIT" desc:"Maximum file size in bytes that is allowed for content extraction." introductionVersion:"1.0.0"`
+	BatchSize                  int                   `yaml:"batch_size" env:"SEARCH_BATCH_SIZE" desc:"The number of documents to process in a single batch. Defaults to 500." introductionVersion:"1.0.0"`
 
 	ServiceAccount ServiceAccount `yaml:"service_account"`
 

services/search/pkg/config/defaults/defaultconfig.go

@@ -39,6 +39,11 @@ func DefaultConfig() *config.Config {
 			Bleve: config.EngineBleve{
 				Datapath: filepath.Join(defaults.BaseDataPath(), "search"),
 			},
+			OpenSearch: config.EngineOpenSearch{
+				ResourceIndex: config.EngineOpenSearchResourceIndex{
+					Name: "opencloud-resource",
+				},
+			},
 		},
 		Extractor: config.Extractor{
 			Type:             "basic",
@@ -58,6 +63,7 @@ func DefaultConfig() *config.Config {
 			AckWait:          1 * time.Minute,
 		},
 		ContentExtractionSizeLimit: 20 * 1024 * 1024, // Limit content extraction to <20MB files by default
+		BatchSize:                  500,
 	}
 }
 

services/search/pkg/config/engine.go

@@ -1,12 +1,47 @@
 package config
 
+import (
+	"net/http"
+	"time"
+)
+
 // Engine defines which search engine to use
 type Engine struct {
-	Type  string      `yaml:"type" env:"SEARCH_ENGINE_TYPE" desc:"Defines which search engine to use. Defaults to 'bleve'. Supported values are: 'bleve'." introductionVersion:"1.0.0"`
-	Bleve EngineBleve `yaml:"bleve"`
+	Type       string           `yaml:"type" env:"SEARCH_ENGINE_TYPE" desc:"Defines which search engine to use. Defaults to 'bleve'. Supported values are: 'bleve'." introductionVersion:"1.0.0"`
+	Bleve      EngineBleve      `yaml:"bleve"`
+	OpenSearch EngineOpenSearch `yaml:"open_search"`
 }
 
 // EngineBleve configures the bleve engine
 type EngineBleve struct {
 	Datapath string `yaml:"data_path" env:"SEARCH_ENGINE_BLEVE_DATA_PATH" desc:"The directory where the filesystem will store search data. If not defined, the root directory derives from $OC_BASE_DATA_PATH/search." introductionVersion:"1.0.0"`
 }
+
+// EngineOpenSearch configures the OpenSearch engine
+type EngineOpenSearch struct {
+	Client        EngineOpenSearchClient        `yaml:"client"`
+	ResourceIndex EngineOpenSearchResourceIndex `yaml:"resource_index"`
+}
+
+// EngineOpenSearchResourceIndex defines the OpenSearch index for resources
+type EngineOpenSearchResourceIndex struct {
+	Name string `yaml:"name" env:"SEARCH_ENGINE_OPEN_SEARCH_RESOURCE_INDEX_NAME" desc:"The name of the OpenSearch index for resources." introductionVersion:"%%NEXT%%"`
+}
+
+// EngineOpenSearchClient configures the OpenSearch client
+type EngineOpenSearchClient struct {
+	Addresses             []string      `yaml:"addresses" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES" desc:"The addresses of the OpenSearch nodes.." introductionVersion:"%%NEXT%%"`
+	Username              string        `yaml:"username" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_USERNAME" desc:"Username for HTTP Basic Authentication." introductionVersion:"%%NEXT%%"`
+	Password              string        `yaml:"password" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_PASSWORD" desc:"Password for HTTP Basic Authentication." introductionVersion:"%%NEXT%%"`
+	Header                http.Header   `yaml:"header" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_HEADER" desc:"HTTP headers to include in requests." introductionVersion:"%%NEXT%%"`
+	CACert                []byte        `yaml:"ca_cert" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_CA_CERT" desc:"CA certificate for TLS connections." introductionVersion:"%%NEXT%%"`
+	RetryOnStatus         []int         `yaml:"retry_on_status" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_RETRY_ON_STATUS" desc:"HTTP status codes that trigger a retry." introductionVersion:"%%NEXT%%"`
+	DisableRetry          bool          `yaml:"disable_retry" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_DISABLE_RETRY" desc:"Disable retries on errors." introductionVersion:"%%NEXT%%"`
+	EnableRetryOnTimeout  bool          `yaml:"enable_retry_on_timeout" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ENABLE_RETRY_ON_TIMEOUT" desc:"Enable retries on timeout." introductionVersion:"%%NEXT%%"`
+	MaxRetries            int           `yaml:"max_retries" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_MAX_RETRIES" desc:"Maximum number of retries for requests." introductionVersion:"%%NEXT%%"`
+	CompressRequestBody   bool          `yaml:"compress_request_body" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_COMPRESS_REQUEST_BODY" desc:"Compress request bodies." introductionVersion:"%%NEXT%%"`
+	DiscoverNodesOnStart  bool          `yaml:"discover_nodes_on_start" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_DISCOVER_NODES_ON_START" desc:"Discover nodes on service start." introductionVersion:"%%NEXT%%"`
+	DiscoverNodesInterval time.Duration `yaml:"discover_nodes_interval" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_DISCOVER_NODES_INTERVAL" desc:"Interval for discovering nodes." introductionVersion:"%%NEXT%%"`
+	EnableMetrics         bool          `yaml:"enable_metrics" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ENABLE_METRICS" desc:"Enable metrics collection." introductionVersion:"%%NEXT%%"`
+	EnableDebugLogger     bool          `yaml:"enable_debug_logger" env:"SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ENABLE_DEBUG_LOGGER" desc:"Enable debug logging." introductionVersion:"%%NEXT%%"`
+}

services/search/pkg/engine/bleve.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/blevesearch/bleve/v2"
@@ -20,10 +21,11 @@ import (
 	"github.com/blevesearch/bleve/v2/mapping"
 	"github.com/blevesearch/bleve/v2/search/query"
 	storageProvider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
 	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	searchMessage "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
@@ -32,10 +34,16 @@ import (
 	searchQuery "github.com/opencloud-eu/opencloud/services/search/pkg/query"
 )
 
+const _batchSize = 500
+
 // Bleve represents a search engine which utilizes bleve to search and store resources.
 type Bleve struct {
 	index        bleve.Index
 	queryCreator searchQuery.Creator[query.Query]
+	batch        *bleve.Batch
+	batchSize    int
+	m            sync.Mutex // batch operations in bleve are not thread-safe
+	log          log.Logger
 }
 
 // NewBleveIndex returns a new bleve index
@@ -60,10 +68,11 @@ func NewBleveIndex(root string) (bleve.Index, error) {
 }
 
 // NewBleveEngine creates a new Bleve instance
-func NewBleveEngine(index bleve.Index, queryCreator searchQuery.Creator[query.Query]) *Bleve {
+func NewBleveEngine(index bleve.Index, queryCreator searchQuery.Creator[query.Query], log log.Logger) *Bleve {
 	return &Bleve{
 		index:        index,
 		queryCreator: queryCreator,
+		log:          log,
 	}
 }
 
@@ -233,8 +242,60 @@ func (b *Bleve) Search(ctx context.Context, sir *searchService.SearchIndexReques
 	}, nil
 }
 
+func (b *Bleve) StartBatch(batchSize int) error {
+	b.m.Lock()
+	defer b.m.Unlock()
+
+	if batchSize <= 0 {
+		return errors.New("batch size must be greater than 0")
+	}
+
+	if b.batch != nil {
+		b.log.Debug().Msg("reusing another batch that has already been started")
+		return nil
+	}
+
+	b.log.Debug().Msg("Starting new batch")
+	b.batch = b.index.NewBatch()
+	b.batchSize = batchSize
+	return nil
+}
+
+func (b *Bleve) EndBatch() error {
+	b.m.Lock()
+	defer b.m.Unlock()
+
+	if b.batch == nil {
+		return errors.New("no batch started")
+	}
+
+	b.log.Debug().Int("size", b.batch.Size()).Msg("Ending batch")
+	if err := b.index.Batch(b.batch); err != nil {
+		return err
+	}
+
+	b.batch = nil
+	return nil
+}
+
 // Upsert indexes or stores Resource data fields.
 func (b *Bleve) Upsert(id string, r Resource) error {
+	b.m.Lock()
+	defer b.m.Unlock()
+
+	if b.batch != nil {
+		if err := b.batch.Index(id, r); err != nil {
+			return err
+		}
+		if b.batch.Size() >= b.batchSize {
+			b.log.Debug().Int("size", b.batch.Size()).Msg("Committing batch")
+			if err := b.index.Batch(b.batch); err != nil {
+				return err
+			}
+			b.batch = b.index.NewBatch()
+		}
+		return nil
+	}
 	return b.index.Index(id, r)
 }
 
@@ -298,6 +359,19 @@ func (b *Bleve) Restore(id string) error {
 
 // Purge removes a resource from the index, irreversible operation.
 func (b *Bleve) Purge(id string) error {
+	b.m.Lock()
+	defer b.m.Unlock()
+
+	if b.batch != nil {
+		b.batch.Delete(id)
+		if b.batch.Size() >= b.batchSize {
+			if err := b.index.Batch(b.batch); err != nil {
+				return err
+			}
+			b.batch = b.index.NewBatch()
+		}
+		return nil
+	}
 	return b.index.Delete(id)
 }
 
@@ -452,7 +526,7 @@ func (b *Bleve) updateEntity(id string, mutateFunc func(r *Resource)) (*Resource
 
 	mutateFunc(it)
 
-	return it, b.index.Index(it.ID, it)
+	return it, b.Upsert(id, *it)
 }
 
 func (b *Bleve) setDeleted(id string, deleted bool) error {
@@ -468,6 +542,7 @@ func (b *Bleve) setDeleted(id string, deleted bool) error {
 			bleve.NewQueryStringQuery("RootID:"+it.RootID),
 			bleve.NewQueryStringQuery("Path:"+escapeQuery(it.Path+"/*")),
 		)
+
 		bleveReq := bleve.NewSearchRequest(q)
 		bleveReq.Size = math.MaxInt
 		bleveReq.Fields = []string{"*"}
@@ -476,6 +551,8 @@ func (b *Bleve) setDeleted(id string, deleted bool) error {
 			return err
 		}
 
+		b.StartBatch(_batchSize)
+		defer b.EndBatch()
 		for _, h := range res.Hits {
 			_, err := b.updateEntity(h.ID, func(r *Resource) {
 				r.Deleted = deleted
@@ -484,6 +561,7 @@ func (b *Bleve) setDeleted(id string, deleted bool) error {
 				return err
 			}
 		}
+		b.EndBatch()
 	}
 
 	return nil

services/search/pkg/engine/bleve_test.go

@@ -8,9 +8,10 @@ import (
 	sprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	searchmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
 	searchsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/search/v0"
 	"github.com/opencloud-eu/opencloud/services/search/pkg/content"
@@ -53,6 +54,7 @@ var _ = Describe("Bleve", func() {
 		rootResource   engine.Resource
 		parentResource engine.Resource
 		childResource  engine.Resource
+		childResource2 engine.Resource
 	)
 
 	BeforeEach(func() {
@@ -62,7 +64,7 @@ var _ = Describe("Bleve", func() {
 		idx, err = bleveSearch.NewMemOnly(mapping)
 		Expect(err).ToNot(HaveOccurred())
 
-		eng = engine.NewBleveEngine(idx, bleve.DefaultCreator)
+		eng = engine.NewBleveEngine(idx, bleve.DefaultCreator, log.Logger{})
 		Expect(err).ToNot(HaveOccurred())
 
 		rootResource = engine.Resource{
@@ -89,11 +91,20 @@ var _ = Describe("Bleve", func() {
 			Type:     uint64(sprovider.ResourceType_RESOURCE_TYPE_FILE),
 			Document: content.Document{Name: "child.pdf"},
 		}
+
+		childResource2 = engine.Resource{
+			ID:       "1$2!5",
+			ParentID: parentResource.ID,
+			RootID:   rootResource.ID,
+			Path:     "./parent d!r/child2.pdf",
+			Type:     uint64(sprovider.ResourceType_RESOURCE_TYPE_FILE),
+			Document: content.Document{Name: "child2.pdf"},
+		}
 	})
 
 	Describe("New", func() {
 		It("returns a new index instance", func() {
-			b := engine.NewBleveEngine(idx, bleve.DefaultCreator)
+			b := engine.NewBleveEngine(idx, bleve.DefaultCreator, log.Logger{})
 			Expect(b).ToNot(BeNil())
 		})
 	})
@@ -486,6 +497,55 @@ var _ = Describe("Bleve", func() {
 		})
 	})
 
+	Describe("StartBatch", func() {
+		It("starts a new batch", func() {
+			err := eng.StartBatch(100)
+			Expect(err).ToNot(HaveOccurred())
+
+			err = eng.Upsert(childResource.ID, childResource)
+			Expect(err).ToNot(HaveOccurred())
+
+			count, err := idx.DocCount()
+			Expect(err).ToNot(HaveOccurred())
+			Expect(count).To(Equal(uint64(0)))
+
+			err = eng.EndBatch()
+			Expect(err).ToNot(HaveOccurred())
+
+			count, err = idx.DocCount()
+			Expect(err).ToNot(HaveOccurred())
+			Expect(count).To(Equal(uint64(1)))
+
+			query := bleveSearch.NewMatchQuery("child.pdf")
+			res, err := idx.Search(bleveSearch.NewSearchRequest(query))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(res.Hits.Len()).To(Equal(1))
+		})
+
+		It("doesn't overwrite batches that are already in progress", func() {
+			err := eng.StartBatch(100)
+			Expect(err).ToNot(HaveOccurred())
+
+			err = eng.Upsert(childResource.ID, childResource)
+			Expect(err).ToNot(HaveOccurred())
+
+			count, err := idx.DocCount()
+			Expect(err).ToNot(HaveOccurred())
+			Expect(count).To(Equal(uint64(0)))
+
+			err = eng.StartBatch(100)
+			Expect(err).ToNot(HaveOccurred())
+
+			err = eng.Upsert(childResource2.ID, childResource2)
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(eng.EndBatch()).To(Succeed())
+			count, err = idx.DocCount()
+			Expect(err).ToNot(HaveOccurred())
+			Expect(count).To(Equal(uint64(2)))
+		})
+	})
+
 	Describe("File type specific metadata", func() {
 
 		Context("with audio metadata", func() {

services/search/pkg/engine/engine.go

@@ -23,6 +23,9 @@ type Engine interface {
 	Restore(id string) error
 	Purge(id string) error
 	DocCount() (uint64, error)
+
+	StartBatch(batchSize int) error
+	EndBatch() error
 }
 
 // Resource is the entity that is stored in the index.

services/search/pkg/engine/mocks/engine.go

@@ -143,6 +143,50 @@ func (_c *Engine_DocCount_Call) RunAndReturn(run func() (uint64, error)) *Engine
 	return _c
 }
 
+// EndBatch provides a mock function for the type Engine
+func (_mock *Engine) EndBatch() error {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for EndBatch")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func() error); ok {
+		r0 = returnFunc()
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// Engine_EndBatch_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'EndBatch'
+type Engine_EndBatch_Call struct {
+	*mock.Call
+}
+
+// EndBatch is a helper method to define mock.On call
+func (_e *Engine_Expecter) EndBatch() *Engine_EndBatch_Call {
+	return &Engine_EndBatch_Call{Call: _e.mock.On("EndBatch")}
+}
+
+func (_c *Engine_EndBatch_Call) Run(run func()) *Engine_EndBatch_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Engine_EndBatch_Call) Return(err error) *Engine_EndBatch_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *Engine_EndBatch_Call) RunAndReturn(run func() error) *Engine_EndBatch_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Move provides a mock function for the type Engine
 func (_mock *Engine) Move(id string, parentid string, target string) error {
 	ret := _mock.Called(id, parentid, target)
@@ -376,6 +420,57 @@ func (_c *Engine_Search_Call) RunAndReturn(run func(ctx context.Context, req *v0
 	return _c
 }
 
+// StartBatch provides a mock function for the type Engine
+func (_mock *Engine) StartBatch(batchSize int) error {
+	ret := _mock.Called(batchSize)
+
+	if len(ret) == 0 {
+		panic("no return value specified for StartBatch")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(int) error); ok {
+		r0 = returnFunc(batchSize)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// Engine_StartBatch_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'StartBatch'
+type Engine_StartBatch_Call struct {
+	*mock.Call
+}
+
+// StartBatch is a helper method to define mock.On call
+//   - batchSize int
+func (_e *Engine_Expecter) StartBatch(batchSize interface{}) *Engine_StartBatch_Call {
+	return &Engine_StartBatch_Call{Call: _e.mock.On("StartBatch", batchSize)}
+}
+
+func (_c *Engine_StartBatch_Call) Run(run func(batchSize int)) *Engine_StartBatch_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 int
+		if args[0] != nil {
+			arg0 = args[0].(int)
+		}
+		run(
+			arg0,
+		)
+	})
+	return _c
+}
+
+func (_c *Engine_StartBatch_Call) Return(err error) *Engine_StartBatch_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *Engine_StartBatch_Call) RunAndReturn(run func(batchSize int) error) *Engine_StartBatch_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Upsert provides a mock function for the type Engine
 func (_mock *Engine) Upsert(id string, r engine.Resource) error {
 	ret := _mock.Called(id, r)

services/search/pkg/metrics/metrics.go

@@ -11,6 +11,45 @@ var (
 
 	// Subsystem defines the subsystem for the defines metrics.
 	Subsystem = "search"
+
+	buildInfo = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "build_info",
+		Help:      "Build information",
+	}, []string{"version"})
+	eventsOutstandingAcks = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_outstanding_acks",
+		Help:      "Number of outstanding acks for events",
+	})
+	eventsUnprocessed = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_unprocessed",
+		Help:      "Number of unprocessed events",
+	})
+	eventsRedelivered = promauto.NewGauge(prometheus.GaugeOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "events_redelivered",
+		Help:      "Number of redelivered events",
+	})
+	searchDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "search_duration_seconds",
+		Help:      "Duration of search operations in seconds",
+		Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60},
+	}, []string{"status"})
+	indexDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "index_duration_seconds",
+		Help:      "Duration of indexing operations in seconds",
+		Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60, 120, 300, 600, 1200},
+	}, []string{"status"})
 )
 
 // Metrics defines the available metrics of this service.
@@ -27,44 +66,12 @@ type Metrics struct {
 // New initializes the available metrics.
 func New() *Metrics {
 	m := &Metrics{
-		BuildInfo: promauto.NewGaugeVec(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "build_info",
-			Help:      "Build information",
-		}, []string{"version"}),
-		EventsOutstandingAcks: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_outstanding_acks",
-			Help:      "Number of outstanding acks for events",
-		}),
-		EventsUnprocessed: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_unprocessed",
-			Help:      "Number of unprocessed events",
-		}),
-		EventsRedelivered: promauto.NewGauge(prometheus.GaugeOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "events_redelivered",
-			Help:      "Number of redelivered events",
-		}),
-		SearchDuration: promauto.NewHistogramVec(prometheus.HistogramOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "search_duration_seconds",
-			Help:      "Duration of search operations in seconds",
-			Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60},
-		}, []string{"status"}),
-		IndexDuration: promauto.NewHistogramVec(prometheus.HistogramOpts{
-			Namespace: Namespace,
-			Subsystem: Subsystem,
-			Name:      "index_duration_seconds",
-			Help:      "Duration of indexing operations in seconds",
-			Buckets:   []float64{0.1, 0.5, 1, 2.5, 5, 10, 30, 60, 120, 300, 600, 1200},
-		}, []string{"status"}),
+		BuildInfo:             buildInfo,
+		EventsOutstandingAcks: eventsOutstandingAcks,
+		EventsUnprocessed:     eventsUnprocessed,
+		EventsRedelivered:     eventsRedelivered,
+		SearchDuration:        searchDuration,
+		IndexDuration:         indexDuration,
 	}
 
 	return m

services/search/pkg/opensearch/backend.go

@@ -0,0 +1,338 @@
+package opensearch
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+
+	storageProvider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
+	searchMessage "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
+	searchService "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/search/v0"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/engine"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/convert"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+)
+
+var (
+	ErrUnhealthyCluster = fmt.Errorf("cluster is not healthy")
+)
+
+type Backend struct {
+	index  string
+	client *opensearchgoAPI.Client
+}
+
+func NewBackend(index string, client *opensearchgoAPI.Client) (*Backend, error) {
+	pingResp, err := client.Ping(context.TODO(), &opensearchgoAPI.PingReq{})
+	switch {
+	case err != nil:
+		return nil, fmt.Errorf("%w, failed to ping opensearch: %w", ErrUnhealthyCluster, err)
+	case pingResp.IsError():
+		return nil, fmt.Errorf("%w, failed to ping opensearch", ErrUnhealthyCluster)
+	}
+
+	// apply the index template
+	if err := IndexManagerLatest.Apply(context.TODO(), index, client); err != nil {
+		return nil, fmt.Errorf("failed to apply index template: %w", err)
+	}
+
+	// first check if the cluster is healthy
+
+	resp, err := client.Cluster.Health(context.TODO(), &opensearchgoAPI.ClusterHealthReq{
+		Indices: []string{index},
+		Params: opensearchgoAPI.ClusterHealthParams{
+			Local:   opensearchgoAPI.ToPointer(true),
+			Timeout: 5 * time.Second,
+		},
+	})
+	switch {
+	case err != nil:
+		return nil, fmt.Errorf("%w, failed to get cluster health: %w", ErrUnhealthyCluster, err)
+	case resp.TimedOut:
+		return nil, fmt.Errorf("%w, cluster health request timed out", ErrUnhealthyCluster)
+	case resp.Status != "green" && resp.Status != "yellow":
+		return nil, fmt.Errorf("%w, cluster health is not green or yellow: %s", ErrUnhealthyCluster, resp.Status)
+	}
+
+	return &Backend{index: index, client: client}, nil
+}
+
+func (be *Backend) Search(ctx context.Context, sir *searchService.SearchIndexRequest) (*searchService.SearchIndexResponse, error) {
+	boolQuery, err := convert.KQLToOpenSearchBoolQuery(sir.Query)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert KQL query to OpenSearch bool query: %w", err)
+	}
+
+	// filter out deleted resources
+	boolQuery.Filter(
+		osu.NewTermQuery[bool]("Deleted").Value(false),
+	)
+
+	if sir.Ref != nil {
+		// if a reference is provided, filter by the root ID
+		boolQuery.Filter(
+			osu.NewTermQuery[string]("RootID").Value(
+				storagespace.FormatResourceID(
+					&storageProvider.ResourceId{
+						StorageId: sir.Ref.GetResourceId().GetStorageId(),
+						SpaceId:   sir.Ref.GetResourceId().GetSpaceId(),
+						OpaqueId:  sir.Ref.GetResourceId().GetOpaqueId(),
+					},
+				),
+			),
+		)
+	}
+
+	searchParams := opensearchgoAPI.SearchParams{}
+
+	switch {
+	case sir.PageSize == -1:
+		searchParams.Size = conversions.ToPointer(1000)
+	case sir.PageSize == 0:
+		searchParams.Size = conversions.ToPointer(200)
+	default:
+		searchParams.Size = conversions.ToPointer(int(sir.PageSize))
+	}
+
+	req, err := osu.BuildSearchReq(&opensearchgoAPI.SearchReq{
+		Indices: []string{be.index},
+		Params:  searchParams,
+	},
+		boolQuery,
+		osu.SearchBodyParams{
+			Highlight: &osu.BodyParamHighlight{
+				PreTags:  []string{"<mark>"},
+				PostTags: []string{"</mark>"},
+				Fields: map[string]osu.BodyParamHighlight{
+					"Content": {},
+				},
+			},
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build search request: %w", err)
+	}
+
+	resp, err := be.client.Search(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to search: %w", err)
+	}
+
+	matches := make([]*searchMessage.Match, 0, len(resp.Hits.Hits))
+	totalMatches := resp.Hits.Total.Value
+	for _, hit := range resp.Hits.Hits {
+		match, err := convert.OpenSearchHitToMatch(hit)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert hit to match: %w", err)
+		}
+
+		if sir.Ref != nil {
+			hitPath := strings.TrimSuffix(match.GetEntity().GetRef().GetPath(), "/")
+			requestedPath := utils.MakeRelativePath(sir.Ref.Path)
+			isRoot := hitPath == requestedPath
+
+			if !isRoot && requestedPath != "." && !strings.HasPrefix(hitPath, requestedPath+"/") {
+				totalMatches--
+				continue
+			}
+		}
+
+		matches = append(matches, match)
+	}
+
+	return &searchService.SearchIndexResponse{
+		Matches:      matches,
+		TotalMatches: int32(totalMatches),
+	}, nil
+}
+
+func (be *Backend) Upsert(id string, r engine.Resource) error {
+	body, err := json.Marshal(r)
+	if err != nil {
+		return fmt.Errorf("failed to marshal resource: %w", err)
+	}
+
+	_, err = be.client.Index(context.TODO(), opensearchgoAPI.IndexReq{
+		Index:      be.index,
+		DocumentID: id,
+		Body:       bytes.NewReader(body),
+	})
+	if err != nil {
+		return fmt.Errorf("failed to index document: %w", err)
+	}
+
+	return nil
+}
+
+func (be *Backend) Move(id string, parentID string, target string) error {
+	return be.updateSelfAndDescendants(id, func(rootResource engine.Resource) *osu.BodyParamScript {
+		return &osu.BodyParamScript{
+			Source: `
+					if (ctx._source.ID == params.id ) { ctx._source.Name = params.newName; ctx._source.ParentID = params.parentID; }
+					ctx._source.Path = ctx._source.Path.replace(params.oldPath, params.newPath)
+				`,
+			Lang: "painless",
+			Params: map[string]any{
+				"id":       id,
+				"parentID": parentID,
+				"oldPath":  rootResource.Path,
+				"newPath":  utils.MakeRelativePath(target),
+				"newName":  path.Base(utils.MakeRelativePath(target)),
+			},
+		}
+	})
+}
+
+func (be *Backend) Delete(id string) error {
+	return be.updateSelfAndDescendants(id, func(_ engine.Resource) *osu.BodyParamScript {
+		return &osu.BodyParamScript{
+			Source: "ctx._source.Deleted = params.deleted",
+			Lang:   "painless",
+			Params: map[string]any{
+				"deleted": true,
+			},
+		}
+	})
+}
+
+func (be *Backend) Restore(id string) error {
+	return be.updateSelfAndDescendants(id, func(_ engine.Resource) *osu.BodyParamScript {
+		return &osu.BodyParamScript{
+			Source: "ctx._source.Deleted = params.deleted",
+			Lang:   "painless",
+			Params: map[string]any{
+				"deleted": false,
+			},
+		}
+	})
+}
+
+func (be *Backend) Purge(id string) error {
+	resource, err := be.getResource(id)
+	if err != nil {
+		return fmt.Errorf("failed to get resource: %w", err)
+	}
+
+	req, err := osu.BuildDocumentDeleteByQueryReq(
+		opensearchgoAPI.DocumentDeleteByQueryReq{
+			Indices: []string{be.index},
+			Params: opensearchgoAPI.DocumentDeleteByQueryParams{
+				WaitForCompletion: conversions.ToPointer(true),
+			},
+		},
+		osu.NewTermQuery[string]("Path").Value(resource.Path),
+	)
+	if err != nil {
+		return fmt.Errorf("failed to build delete by query request: %w", err)
+	}
+
+	resp, err := be.client.Document.DeleteByQuery(context.TODO(), req)
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to delete by query: %w", err)
+	case len(resp.Failures) != 0:
+		return fmt.Errorf("failed to delete by query, failures: %v", resp.Failures)
+	}
+
+	return nil
+}
+
+func (be *Backend) DocCount() (uint64, error) {
+	req, err := osu.BuildIndicesCountReq(
+		&opensearchgoAPI.IndicesCountReq{
+			Indices: []string{be.index},
+		},
+		osu.NewTermQuery[bool]("Deleted").Value(false),
+	)
+	if err != nil {
+		return 0, fmt.Errorf("failed to build count request: %w", err)
+	}
+
+	resp, err := be.client.Indices.Count(context.TODO(), req)
+	if err != nil {
+		return 0, fmt.Errorf("failed to count documents: %w", err)
+	}
+
+	return uint64(resp.Count), nil
+}
+
+func (be *Backend) updateSelfAndDescendants(id string, scriptProvider func(engine.Resource) *osu.BodyParamScript) error {
+	if scriptProvider == nil {
+		return fmt.Errorf("script cannot be nil")
+	}
+
+	resource, err := be.getResource(id)
+	if err != nil {
+		return fmt.Errorf("failed to get resource: %w", err)
+	}
+
+	req, err := osu.BuildUpdateByQueryReq(
+		opensearchgoAPI.UpdateByQueryReq{
+			Indices: []string{be.index},
+			Params: opensearchgoAPI.UpdateByQueryParams{
+				WaitForCompletion: conversions.ToPointer(true),
+			},
+		},
+		osu.NewTermQuery[string]("Path").Value(resource.Path),
+		osu.UpdateByQueryBodyParams{
+			Script: scriptProvider(resource),
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("failed to build update by query request: %w", err)
+	}
+
+	resp, err := be.client.UpdateByQuery(context.TODO(), req)
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to update by query: %w", err)
+	case len(resp.Failures) != 0:
+		return fmt.Errorf("failed to update by query, failures: %v", resp.Failures)
+	}
+
+	return nil
+}
+
+func (be *Backend) getResource(id string) (engine.Resource, error) {
+	req, err := osu.BuildSearchReq(
+		&opensearchgoAPI.SearchReq{
+			Indices: []string{be.index},
+		},
+		osu.NewIDsQuery(id),
+	)
+	if err != nil {
+		return engine.Resource{}, fmt.Errorf("failed to build search request: %w", err)
+	}
+
+	resp, err := be.client.Search(context.TODO(), req)
+	switch {
+	case err != nil:
+		return engine.Resource{}, fmt.Errorf("failed to search for resource: %w", err)
+	case resp.Hits.Total.Value == 0 || len(resp.Hits.Hits) == 0:
+		return engine.Resource{}, fmt.Errorf("document with id %s not found", id)
+	}
+
+	resource, err := conversions.To[engine.Resource](resp.Hits.Hits[0].Source)
+	if err != nil {
+		return engine.Resource{}, fmt.Errorf("failed to convert hit source: %w", err)
+	}
+
+	return resource, nil
+}
+
+func (be *Backend) StartBatch(_ int) error {
+	return nil // todo: implement batch processing
+}
+
+func (be *Backend) EndBatch() error {
+	return nil // todo: implement batch processing
+}

services/search/pkg/opensearch/backend_test.go

@@ -0,0 +1,253 @@
+package opensearch_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	opensearchgo "github.com/opensearch-project/opensearch-go/v4"
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/stretchr/testify/require"
+
+	searchService "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/search/v0"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/engine"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestNewBackend(t *testing.T) {
+	t.Run("fails to create if the cluster is not healthy", func(t *testing.T) {
+		client, err := opensearchgoAPI.NewClient(opensearchgoAPI.Config{
+			Client: opensearchgo.Config{
+				Addresses: []string{"http://localhost:1025"},
+			},
+		})
+		require.NoError(t, err, "failed to create OpenSearch client")
+
+		backend, err := opensearch.NewBackend("test-engine-new-engine", client)
+		require.Nil(t, backend)
+		require.ErrorIs(t, err, opensearch.ErrUnhealthyCluster)
+	})
+}
+
+func TestEngine_Search(t *testing.T) {
+	indexName := "opencloud-test-engine-search"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	document := opensearchtest.Testdata.Resources.File
+	tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+	tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+	t.Run("most simple search", func(t *testing.T) {
+		resp, err := backend.Search(t.Context(), &searchService.SearchIndexRequest{
+			Query: fmt.Sprintf(`"%s"`, document.Name),
+		})
+		require.NoError(t, err)
+		require.Len(t, resp.Matches, 1)
+		require.Equal(t, int32(1), resp.TotalMatches)
+		require.Equal(t, document.ID, fmt.Sprintf("%s$%s!%s", resp.Matches[0].Entity.Id.StorageId, resp.Matches[0].Entity.Id.SpaceId, resp.Matches[0].Entity.Id.OpaqueId))
+	})
+
+	t.Run("ignores files that are marked as deleted", func(t *testing.T) {
+		deletedDocument := opensearchtest.Testdata.Resources.File
+		deletedDocument.ID = "1$2!4"
+		deletedDocument.Deleted = true
+
+		tc.Require.DocumentCreate(indexName, deletedDocument.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, deletedDocument)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 2)
+
+		resp, err := backend.Search(t.Context(), &searchService.SearchIndexRequest{
+			Query: fmt.Sprintf(`"%s"`, document.Name),
+		})
+		require.NoError(t, err)
+		require.Len(t, resp.Matches, 1)
+		require.Equal(t, int32(1), resp.TotalMatches)
+		require.Equal(t, document.ID, fmt.Sprintf("%s$%s!%s", resp.Matches[0].Entity.Id.StorageId, resp.Matches[0].Entity.Id.SpaceId, resp.Matches[0].Entity.Id.OpaqueId))
+	})
+}
+
+func TestEngine_Upsert(t *testing.T) {
+	indexName := "opencloud-test-engine-upsert"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("upsert with full document", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		require.NoError(t, backend.Upsert(document.ID, document))
+
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+	})
+}
+
+func TestEngine_Move(t *testing.T) {
+	indexName := "opencloud-test-engine-move"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("moves the document to a new path", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		body := opensearchtest.JSONMustMarshal(t, map[string]any{
+			"query": map[string]any{
+				"ids": map[string]any{
+					"values": []string{document.ID},
+				},
+			},
+		})
+
+		resources := opensearchtest.SearchHitsMustBeConverted[engine.Resource](t, tc.Require.Search(indexName, strings.NewReader(body)).Hits)
+		require.Len(t, resources, 1)
+		require.Equal(t, document.Path, resources[0].Path)
+
+		document.Path = "./new/path/to/resource"
+		require.NoError(t, backend.Move(document.ID, document.ParentID, document.Path))
+
+		resources = opensearchtest.SearchHitsMustBeConverted[engine.Resource](t, tc.Require.Search(indexName, strings.NewReader(body)).Hits)
+		require.Len(t, resources, 1)
+		require.Equal(t, document.Path, resources[0].Path)
+	})
+}
+
+func TestEngine_Delete(t *testing.T) {
+	indexName := "opencloud-test-engine-delete"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("mark document as deleted", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		body := opensearchtest.JSONMustMarshal(t, map[string]any{
+			"query": map[string]any{
+				"term": map[string]any{
+					"Deleted": map[string]any{
+						"value": true,
+					},
+				},
+			},
+		})
+
+		tc.Require.IndicesCount([]string{indexName}, strings.NewReader(body), 0)
+
+		require.NoError(t, backend.Delete(document.ID))
+		tc.Require.IndicesCount([]string{indexName}, strings.NewReader(body), 1)
+	})
+}
+
+func TestEngine_Restore(t *testing.T) {
+	indexName := "opencloud-test-engine-restore"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("mark document as not deleted", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		document.Deleted = true
+		tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		body := opensearchtest.JSONMustMarshal(t, map[string]any{
+			"query": map[string]any{
+				"term": map[string]any{
+					"Deleted": map[string]any{
+						"value": true,
+					},
+				},
+			},
+		})
+
+		tc.Require.IndicesCount([]string{indexName}, strings.NewReader(body), 1)
+
+		require.NoError(t, backend.Restore(document.ID))
+		tc.Require.IndicesCount([]string{indexName}, strings.NewReader(body), 0)
+	})
+}
+
+func TestEngine_Purge(t *testing.T) {
+	indexName := "opencloud-test-engine-purge"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("purge with full document", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		require.NoError(t, backend.Purge(document.ID))
+
+		tc.Require.IndicesCount([]string{indexName}, nil, 0)
+	})
+}
+
+func TestEngine_DocCount(t *testing.T) {
+	indexName := "opencloud-test-engine-doc-count"
+	tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+	tc.Require.IndicesReset([]string{indexName})
+	tc.Require.IndicesCount([]string{indexName}, nil, 0)
+
+	defer tc.Require.IndicesDelete([]string{indexName})
+
+	backend, err := opensearch.NewBackend(indexName, tc.Client())
+	require.NoError(t, err)
+
+	t.Run("ignore deleted documents", func(t *testing.T) {
+		document := opensearchtest.Testdata.Resources.File
+		tc.Require.DocumentCreate(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, document)))
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		count, err := backend.DocCount()
+		require.NoError(t, err)
+		require.Equal(t, uint64(1), count)
+
+		tc.Require.Update(indexName, document.ID, strings.NewReader(opensearchtest.JSONMustMarshal(t, map[string]any{
+			"doc": map[string]any{
+				"Deleted": true,
+			},
+		})))
+
+		tc.Require.IndicesCount([]string{indexName}, nil, 1)
+
+		count, err = backend.DocCount()
+		require.NoError(t, err)
+		require.Equal(t, uint64(0), count)
+	})
+}

services/search/pkg/opensearch/index.go

@@ -0,0 +1,142 @@
+package opensearch
+
+import (
+	"bytes"
+	"context"
+	"embed"
+	"errors"
+	"fmt"
+	"path"
+	"reflect"
+
+	"github.com/go-jose/go-jose/v3/json"
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/tidwall/gjson"
+)
+
+var (
+	ErrManualActionRequired                  = errors.New("manual action required")
+	IndexManagerLatest                       = IndexIndexManagerResourceV1
+	IndexIndexManagerResourceV1 IndexManager = "resource_v1.json"
+)
+
+//go:embed internal/indexes/*.json
+var indexes embed.FS
+
+type IndexManager string
+
+func (m IndexManager) String() string {
+	b, err := m.MarshalJSON()
+	if err != nil {
+		return ""
+	}
+
+	return string(b)
+}
+
+func (m IndexManager) MarshalJSON() ([]byte, error) {
+	filePath := string(m)
+	body, err := indexes.ReadFile(path.Join("./internal/indexes", filePath))
+	switch {
+	case err != nil:
+		return nil, fmt.Errorf("failed to read index file %s: %w", filePath, err)
+	case len(body) <= 0:
+		return nil, fmt.Errorf("index file %s is empty", filePath)
+	}
+
+	return body, nil
+}
+
+func (m IndexManager) Apply(ctx context.Context, name string, client *opensearchgoAPI.Client) error {
+	localIndexB, err := m.MarshalJSON()
+	if err != nil {
+		return fmt.Errorf("failed to marshal index %s: %w", name, err)
+	}
+
+	indicesExistsResp, err := client.Indices.Exists(ctx, opensearchgoAPI.IndicesExistsReq{
+		Indices: []string{name},
+	})
+	switch {
+	case indicesExistsResp != nil && indicesExistsResp.StatusCode == 404:
+		break
+	case err != nil:
+		return fmt.Errorf("failed to check if index %s exists: %w", name, err)
+	case indicesExistsResp == nil:
+		return fmt.Errorf("indicesExistsResp is nil for index %s", name)
+	}
+
+	if indicesExistsResp.StatusCode == 200 {
+		resp, err := client.Indices.Get(ctx, opensearchgoAPI.IndicesGetReq{
+			Indices: []string{name},
+		})
+		if err != nil {
+			return fmt.Errorf("failed to get index %s: %w", name, err)
+		}
+
+		remoteIndex, ok := resp.Indices[name]
+		if !ok {
+			return fmt.Errorf("index %s not found in response", name)
+		}
+		remoteIndexB, err := json.Marshal(remoteIndex)
+		if err != nil {
+			return fmt.Errorf("failed to marshal index %s: %w", name, err)
+		}
+
+		localIndexJson := gjson.ParseBytes(localIndexB)
+		remoteIndexJson := gjson.ParseBytes(remoteIndexB)
+
+		compare := func(lvPath, rvPath string) (any, any, bool) {
+			lv := localIndexJson.Get(lvPath).Raw
+			rv := remoteIndexJson.Get(rvPath).Raw
+
+			var lvv, rvv interface{}
+			if err := json.Unmarshal([]byte(lv), &lvv); err != nil {
+				return nil, nil, false
+			}
+
+			if err := json.Unmarshal([]byte(rv), &rvv); err != nil {
+				return nil, nil, false
+			}
+
+			return lv, rv, reflect.DeepEqual(lvv, rvv)
+		}
+
+		var errs []error
+
+		for k := range localIndexJson.Get("settings").Map() {
+			if lv, rv, ok := compare("settings."+k, "settings.index."+k); !ok {
+				errs = append(errs, fmt.Errorf("settings.%s local %s, remote %s", k, lv, rv))
+			}
+		}
+
+		for k := range localIndexJson.Get("mappings.properties").Map() {
+			if _, _, ok := compare("mappings.properties."+k, "mappings.properties."+k); !ok {
+				errs = append(errs, fmt.Errorf("mappings.properties.%s", k))
+			}
+		}
+
+		if errs != nil {
+			return fmt.Errorf(
+				"index %s allready exists and is different from the requested version, %w: %w",
+				name,
+				ErrManualActionRequired,
+				errors.Join(errs...),
+			)
+		}
+
+		return nil // Index is already up to date, no action needed
+	}
+
+	createResp, err := client.Indices.Create(ctx, opensearchgoAPI.IndicesCreateReq{
+		Index: name,
+		Body:  bytes.NewReader(localIndexB),
+	})
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to create index %s: %w", name, err)
+	case !createResp.Acknowledged:
+		return fmt.Errorf("failed to create index %s: not acknowledged", name)
+	}
+
+	return nil
+}

services/search/pkg/opensearch/index_test.go

@@ -0,0 +1,63 @@
+package opensearch_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/sjson"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestIndexManager(t *testing.T) {
+	t.Run("index plausibility", func(t *testing.T) {
+		tests := []opensearchtest.TableTest[opensearch.IndexManager, struct{}]{
+			{
+				Name: "empty",
+				Got:  opensearch.IndexManagerLatest,
+			},
+		}
+		tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				indexName := "opencloud-test-resource"
+				tc.Require.IndicesReset([]string{indexName})
+
+				body, err := test.Got.MarshalJSON()
+				require.NoError(t, err)
+				require.NotEmpty(t, body)
+				require.NotEmpty(t, test.Got.String())
+				require.JSONEq(t, test.Got.String(), string(body))
+				require.NoError(t, test.Got.Apply(t.Context(), indexName, tc.Client()))
+			})
+		}
+	})
+
+	t.Run("does not create index if it already exists and is up to date", func(t *testing.T) {
+		indexManager := opensearch.IndexManagerLatest
+		indexName := "opencloud-test-resource"
+
+		tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+		tc.Require.IndicesReset([]string{indexName})
+		tc.Require.IndicesCreate(indexName, strings.NewReader(indexManager.String()))
+
+		require.NoError(t, indexManager.Apply(t.Context(), indexName, tc.Client()))
+	})
+
+	t.Run("fails to create index if it already exists but is not up to date", func(t *testing.T) {
+		indexManager := opensearch.IndexManagerLatest
+		indexName := "opencloud-test-resource"
+
+		tc := opensearchtest.NewDefaultTestClient(t, defaultConfig.Engine.OpenSearch.Client)
+		tc.Require.IndicesReset([]string{indexName})
+
+		body, err := sjson.Set(indexManager.String(), "settings.number_of_shards", "2")
+		require.NoError(t, err)
+		tc.Require.IndicesCreate(indexName, strings.NewReader(body))
+
+		require.ErrorIs(t, indexManager.Apply(t.Context(), indexName, tc.Client()), opensearch.ErrManualActionRequired)
+	})
+}

services/search/pkg/opensearch/internal/convert/kql_expand.go

@@ -0,0 +1,197 @@
+package convert
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	"github.com/opencloud-eu/opencloud/pkg/ast"
+)
+
+func ExpandKQL(nodes []ast.Node) ([]ast.Node, error) {
+	return kqlExpander{}.expand(nodes, "")
+}
+
+type kqlExpander struct{}
+
+func (e kqlExpander) expand(nodes []ast.Node, defaultKey string) ([]ast.Node, error) {
+	for i, node := range nodes {
+		rnode := reflect.ValueOf(node)
+
+		// we need to ensure that the node is a pointer to an ast.Node in every case
+		if rnode.Kind() != reflect.Ptr {
+			ptr := reflect.New(rnode.Type())
+			ptr.Elem().Set(rnode)
+			rnode = ptr
+			cnode, ok := rnode.Interface().(ast.Node)
+			if !ok {
+				return nil, fmt.Errorf("expected node to be of type ast.Node, got %T", rnode.Interface())
+			}
+
+			node = cnode    // Update the original node to the pointer
+			nodes[i] = node // Update the original slice with the pointer
+		}
+
+		var unfoldedNodes []ast.Node
+		switch cnode := node.(type) {
+		case *ast.GroupNode:
+			if cnode.Key != "" { // group nodes should not get a default key
+				cnode.Key = e.remapKey(cnode.Key, defaultKey)
+			}
+
+			groupNodes, err := e.expand(cnode.Nodes, cnode.Key)
+			if err != nil {
+				return nil, err
+			}
+			cnode.Nodes = groupNodes
+		case *ast.StringNode:
+			cnode.Key = e.remapKey(cnode.Key, defaultKey)
+			cnode.Value = e.lowerValue(cnode.Key, cnode.Value)
+			unfoldedNodes = e.unfoldValue(cnode.Key, cnode.Value)
+		case *ast.DateTimeNode:
+			cnode.Key = e.remapKey(cnode.Key, defaultKey)
+		case *ast.BooleanNode:
+			cnode.Key = e.remapKey(cnode.Key, defaultKey)
+		}
+
+		if unfoldedNodes != nil {
+			// Insert unfolded nodes at the current index
+			nodes = append(nodes[:i], append(unfoldedNodes, nodes[i+1:]...)...)
+			// Adjust index to account for new nodes
+			i += len(unfoldedNodes) - 1
+		}
+	}
+
+	return nodes, nil
+}
+
+func (_ kqlExpander) remapKey(current string, defaultKey string) string {
+	if defaultKey == "" {
+		defaultKey = "Name" // Set a default key if none is provided
+	}
+
+	key, ok := map[string]string{
+		"":          defaultKey, // Default case if current is empty
+		"rootid":    "RootID",
+		"path":      "Path",
+		"id":        "ID",
+		"name":      "Name",
+		"size":      "Size",
+		"mtime":     "Mtime",
+		"mediatype": "MimeType",
+		"type":      "Type",
+		"tag":       "Tags",
+		"tags":      "Tags",
+		"content":   "Content",
+		"hidden":    "Hidden",
+	}[current]
+	if !ok {
+		return current // Return the original key if not found
+	}
+
+	return key
+}
+
+func (_ kqlExpander) lowerValue(key, value string) string {
+	if slices.Contains([]string{"Hidden"}, key) {
+		return value // ignore certain keys and return the original value
+	}
+
+	return strings.ToLower(value)
+}
+
+func (_ kqlExpander) unfoldValue(key, value string) []ast.Node {
+	result, ok := map[string][]ast.Node{
+		"MimeType:file": {
+			&ast.OperatorNode{Value: "NOT"},
+			&ast.StringNode{Key: key, Value: "httpd/unix-directory"},
+		},
+		"MimeType:folder": {
+			&ast.StringNode{Key: key, Value: "httpd/unix-directory"},
+		},
+		"MimeType:document": {
+			&ast.GroupNode{Nodes: []ast.Node{
+				&ast.StringNode{Key: key, Value: "application/msword"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.openxmlformats-officedocument.wordprocessingml.document"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.openxmlformats-officedocument.wordprocessingml.form"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.oasis.opendocument.text"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "text/plain"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "text/markdown"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/rtf"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.apple.pages"},
+			}},
+		},
+		"MimeType:spreadsheet": {
+			&ast.GroupNode{Nodes: []ast.Node{
+				&ast.StringNode{Key: key, Value: "application/vnd.ms-excel"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.oasis.opendocument.spreadsheet"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "text/csv"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.oasis.opendocument.spreadshee"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.apple.numbers"},
+			}},
+		},
+		"MimeType:presentation": {
+			&ast.GroupNode{Nodes: []ast.Node{
+				&ast.StringNode{Key: key, Value: "application/vnd.openxmlformats-officedocument.presentationml.presentation"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.oasis.opendocument.presentation"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.ms-powerpoint"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/vnd.apple.keynote"},
+			}},
+		},
+		"MimeType:pdf": {
+			&ast.StringNode{Key: key, Value: "application/pdf"},
+		},
+		"MimeType:image": {
+			&ast.StringNode{Key: key, Value: "image/*"},
+		},
+		"MimeType:video": {
+			&ast.StringNode{Key: key, Value: "video/*"},
+		},
+		"MimeType:audio": {
+			&ast.StringNode{Key: key, Value: "audio/*"},
+		},
+		"MimeType:archive": {
+			&ast.GroupNode{Nodes: []ast.Node{
+				&ast.StringNode{Key: key, Value: "application/zip"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/gzip"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-gzip"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-7z-compressed"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-rar-compressed"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-tar"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-bzip2"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-bzip"},
+				&ast.OperatorNode{Value: "OR"},
+				&ast.StringNode{Key: key, Value: "application/x-tgz"},
+			}},
+		},
+	}[fmt.Sprintf("%s:%s", key, value)]
+	if !ok {
+		return nil
+	}
+
+	return result
+}

services/search/pkg/opensearch/internal/convert/kql_expand_test.go

@@ -0,0 +1,607 @@
+package convert_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/convert"
+
+	"github.com/opencloud-eu/opencloud/pkg/ast"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestExpandKQLAST(t *testing.T) {
+	t.Run("always converts a value node to a pointer node", func(t *testing.T) {
+		tests := []opensearchtest.TableTest[[]ast.Node, []ast.Node]{
+			{
+				Name: "ast.node.V -> ast.node.PTR",
+				Got: []ast.Node{
+					&ast.StringNode{Key: "a"},
+					&ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "b"},
+					ast.OperatorNode{Value: "AND"},
+					&ast.DateTimeNode{Key: "c"},
+					&ast.OperatorNode{Value: "OR"},
+					ast.DateTimeNode{Key: "d"},
+					ast.OperatorNode{Value: "OR"},
+					&ast.BooleanNode{Key: "f"},
+					&ast.OperatorNode{Value: "NOT"},
+					ast.BooleanNode{Key: "g"},
+					ast.OperatorNode{Value: "NOT"},
+					&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+						&ast.StringNode{Key: "a"},
+						&ast.OperatorNode{Value: "AND"},
+						ast.StringNode{Key: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+							&ast.StringNode{Key: "a"},
+							&ast.OperatorNode{Value: "AND"},
+							ast.StringNode{Key: "b"},
+							&ast.OperatorNode{Value: "OR"},
+							&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+								&ast.StringNode{Key: "a"},
+								&ast.OperatorNode{Value: "AND"},
+								ast.StringNode{Key: "b"},
+							}},
+						}},
+					}},
+					ast.GroupNode{Key: "i", Nodes: []ast.Node{
+						ast.StringNode{Key: "a"},
+						ast.OperatorNode{Value: "AND"},
+						ast.StringNode{Key: "b"},
+						ast.OperatorNode{Value: "OR"},
+						ast.GroupNode{Key: "h", Nodes: []ast.Node{
+							ast.StringNode{Key: "a"},
+							ast.OperatorNode{Value: "AND"},
+							ast.StringNode{Key: "b"},
+							ast.OperatorNode{Value: "OR"},
+							ast.GroupNode{Key: "h", Nodes: []ast.Node{
+								ast.StringNode{Key: "a"},
+								ast.OperatorNode{Value: "AND"},
+								ast.StringNode{Key: "b"},
+							}},
+						}},
+					}},
+				},
+				Want: []ast.Node{
+					&ast.StringNode{Key: "a"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "b"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.DateTimeNode{Key: "c"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.DateTimeNode{Key: "d"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.BooleanNode{Key: "f"},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.BooleanNode{Key: "g"},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+						&ast.StringNode{Key: "a"},
+						&ast.OperatorNode{Value: "AND"},
+						&ast.StringNode{Key: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+							&ast.StringNode{Key: "a"},
+							&ast.OperatorNode{Value: "AND"},
+							&ast.StringNode{Key: "b"},
+							&ast.OperatorNode{Value: "OR"},
+							&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+								&ast.StringNode{Key: "a"},
+								&ast.OperatorNode{Value: "AND"},
+								&ast.StringNode{Key: "b"},
+							}},
+						}},
+					}},
+					&ast.GroupNode{Key: "i", Nodes: []ast.Node{
+						&ast.StringNode{Key: "a"},
+						&ast.OperatorNode{Value: "AND"},
+						&ast.StringNode{Key: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+							&ast.StringNode{Key: "a"},
+							&ast.OperatorNode{Value: "AND"},
+							&ast.StringNode{Key: "b"},
+							&ast.OperatorNode{Value: "OR"},
+							&ast.GroupNode{Key: "h", Nodes: []ast.Node{
+								&ast.StringNode{Key: "a"},
+								&ast.OperatorNode{Value: "AND"},
+								&ast.StringNode{Key: "b"},
+							}},
+						}},
+					}},
+				},
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				result, err := convert.ExpandKQL(test.Got)
+				require.NoError(t, err)
+				require.Equal(t, test.Want, result)
+			})
+		}
+	})
+
+	t.Run("remaps some keys", func(t *testing.T) {
+		var tests []opensearchtest.TableTest[[]ast.Node, []ast.Node]
+
+		for k, v := range map[string]string{
+			"":          "Name", // Default to "Name" if no key is provided
+			"rootid":    "RootID",
+			"path":      "Path",
+			"id":        "ID",
+			"name":      "Name",
+			"size":      "Size",
+			"mtime":     "Mtime",
+			"mediatype": "MimeType",
+			"type":      "Type",
+			"tag":       "Tags",
+			"tags":      "Tags",
+			"content":   "Content",
+			"hidden":    "Hidden",
+			"any":       "any", // Example of an unknown key that should remain unchanged
+		} {
+			tests = append(tests, opensearchtest.TableTest[[]ast.Node, []ast.Node]{
+				Name: fmt.Sprintf("%s -> %s", k, v),
+				Got: []ast.Node{
+					&ast.StringNode{Key: k},
+					&ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: k},
+					ast.OperatorNode{Value: "AND"},
+					&ast.DateTimeNode{Key: k},
+					&ast.OperatorNode{Value: "OR"},
+					ast.DateTimeNode{Key: k},
+					ast.OperatorNode{Value: "OR"},
+					&ast.BooleanNode{Key: k},
+					&ast.OperatorNode{Value: "NOT"},
+					ast.BooleanNode{Key: k},
+					ast.OperatorNode{Value: "NOT"},
+					&ast.GroupNode{Key: k, Nodes: []ast.Node{
+						&ast.StringNode{Key: k},
+						&ast.OperatorNode{Value: "AND"},
+						ast.StringNode{Key: k},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.GroupNode{Key: k, Nodes: []ast.Node{
+							&ast.StringNode{Key: k},
+							&ast.OperatorNode{Value: "AND"},
+							ast.StringNode{Key: k},
+							&ast.OperatorNode{Value: "OR"},
+							&ast.GroupNode{Key: k, Nodes: []ast.Node{
+								&ast.StringNode{Key: k},
+								&ast.OperatorNode{Value: "AND"},
+								ast.StringNode{Key: k},
+							}},
+						}},
+					}},
+				},
+				Want: []ast.Node{
+					&ast.StringNode{Key: v},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: v},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.DateTimeNode{Key: v},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.DateTimeNode{Key: v},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.BooleanNode{Key: v},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.BooleanNode{Key: v},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.GroupNode{Key: func() string {
+						switch {
+						case k == "":
+							return k
+						default:
+							return v
+						}
+					}(), Nodes: []ast.Node{
+						&ast.StringNode{Key: v},
+						&ast.OperatorNode{Value: "AND"},
+						&ast.StringNode{Key: v},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.GroupNode{Key: func() string {
+							switch {
+							case k == "":
+								return k
+							default:
+								return v
+							}
+						}(), Nodes: []ast.Node{
+							&ast.StringNode{Key: v},
+							&ast.OperatorNode{Value: "AND"},
+							&ast.StringNode{Key: v},
+							&ast.OperatorNode{Value: "OR"},
+							&ast.GroupNode{Key: func() string {
+								switch {
+								case k == "":
+									return k
+								default:
+									return v
+								}
+							}(), Nodes: []ast.Node{
+								&ast.StringNode{Key: v},
+								&ast.OperatorNode{Value: "AND"},
+								&ast.StringNode{Key: v},
+							}},
+						}},
+					}},
+				},
+			})
+		}
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				result, err := convert.ExpandKQL(test.Got)
+				require.NoError(t, err)
+				require.Equal(t, test.Want, result)
+			})
+		}
+	})
+
+	t.Run("lowercases some values", func(t *testing.T) {
+		tests := []opensearchtest.TableTest[[]ast.Node, []ast.Node]{
+			{
+				Name: "!Hidden: StringNode -> stringnode",
+				Got: []ast.Node{
+					ast.StringNode{Key: "aBc", Value: "StringNode"},
+					ast.GroupNode{Key: "GroupNode", Nodes: []ast.Node{
+						ast.StringNode{Key: "aBc", Value: "StringNode"},
+					}},
+				},
+				Want: []ast.Node{
+					&ast.StringNode{Key: "aBc", Value: "stringnode"},
+					&ast.GroupNode{Key: "GroupNode", Nodes: []ast.Node{
+						&ast.StringNode{Key: "aBc", Value: "stringnode"},
+					}},
+				},
+			},
+			{
+				Name: "Hidden: StringNode -> StringNode",
+				Got: []ast.Node{
+					ast.StringNode{Key: "Hidden", Value: "StringNode"},
+					ast.GroupNode{Key: "GroupNode", Nodes: []ast.Node{
+						ast.StringNode{Key: "Hidden", Value: "StringNode"},
+					}},
+				},
+				Want: []ast.Node{
+					&ast.StringNode{Key: "Hidden", Value: "StringNode"},
+					&ast.GroupNode{Key: "GroupNode", Nodes: []ast.Node{
+						&ast.StringNode{Key: "Hidden", Value: "StringNode"},
+					}},
+				},
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				result, err := convert.ExpandKQL(test.Got)
+				require.NoError(t, err)
+				require.Equal(t, test.Want, result)
+			})
+		}
+	})
+
+	t.Run("unfolds some values", func(t *testing.T) {
+		tests := []opensearchtest.TableTest[[]ast.Node, []ast.Node]{
+			{
+				Name: "MimeType:unknown",
+				Got: []ast.Node{
+					&ast.StringNode{Key: "MimeType", Value: "unknown"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.StringNode{Key: "MimeType", Value: "unknown"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:file",
+				Got: []ast.Node{
+					&ast.StringNode{Key: "MimeType", Value: "file"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.StringNode{Key: "MimeType", Value: "httpd/unix-directory"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:folder",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "folder"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "MimeType", Value: "httpd/unix-directory"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:document",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "document"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "MimeType", Value: "application/msword"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.openxmlformats-officedocument.wordprocessingml.document"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.openxmlformats-officedocument.wordprocessingml.form"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.oasis.opendocument.text"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "text/plain"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "text/markdown"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/rtf"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.apple.pages"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:spreadsheet",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "spreadsheet"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.ms-excel"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.oasis.opendocument.spreadsheet"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "text/csv"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.oasis.opendocument.spreadshee"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.apple.numbers"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:presentation",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "presentation"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.openxmlformats-officedocument.presentationml.presentation"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.oasis.opendocument.presentation"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.ms-powerpoint"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/vnd.apple.keynote"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:pdf",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "pdf"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "MimeType", Value: "application/pdf"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:image",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "image"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "MimeType", Value: "image/*"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:video",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "video"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "MimeType", Value: "video/*"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:audio",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "audio"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "MimeType", Value: "audio/*"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+			{
+				Name: "MimeType:archive",
+				Got: []ast.Node{
+					ast.BooleanNode{Key: "Deleted", Value: false},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Key: "MimeType", Value: "archive"},
+					ast.OperatorNode{Value: "AND"},
+					ast.StringNode{Value: "some-name"},
+				},
+				Want: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "MimeType", Value: "application/zip"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/gzip"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-gzip"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-7z-compressed"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-rar-compressed"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-tar"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-bzip2"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-bzip"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "MimeType", Value: "application/x-tgz"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "Name", Value: `some-name`},
+				},
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				if test.Skip {
+					t.Skip("Skipping test due to known issue")
+				}
+				result, err := convert.ExpandKQL(test.Got)
+				require.NoError(t, err)
+				require.EqualValues(t, test.Want, result)
+			})
+		}
+	})
+
+	t.Run("different cases", func(t *testing.T) {
+		tests := []opensearchtest.TableTest[[]ast.Node, []ast.Node]{
+			{
+				Name: "use the group node key as default key",
+				Got: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Key: "a", Nodes: []ast.Node{
+						&ast.StringNode{Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Key: "mediatype", Nodes: []ast.Node{
+						&ast.StringNode{Value: "file"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "mediatype", Value: "file"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+				},
+				Want: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "Name", Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Key: "a", Nodes: []ast.Node{
+						&ast.StringNode{Key: "a", Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Key: "MimeType", Nodes: []ast.Node{
+						&ast.OperatorNode{Value: "NOT"},
+						&ast.StringNode{Key: "MimeType", Value: "httpd/unix-directory"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.OperatorNode{Value: "NOT"},
+						&ast.StringNode{Key: "MimeType", Value: "httpd/unix-directory"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "d"},
+					}},
+				},
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.Name, func(t *testing.T) {
+				if test.Skip {
+					t.Skip("Skipping test due to known issue")
+				}
+				result, err := convert.ExpandKQL(test.Got)
+				require.NoError(t, err)
+				require.EqualValues(t, test.Want, result)
+			})
+		}
+	})
+}

services/search/pkg/opensearch/internal/convert/kql_query.go

@@ -0,0 +1,35 @@
+package convert
+
+import (
+	"fmt"
+
+	"github.com/opencloud-eu/opencloud/pkg/kql"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+)
+
+var (
+	ErrUnsupportedNodeType = fmt.Errorf("unsupported node type")
+)
+
+func KQLToOpenSearchBoolQuery(kqlQuery string) (*osu.BoolQuery, error) {
+	kqlAst, err := kql.Builder{}.Build(kqlQuery)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build query: %w", err)
+	}
+
+	kqlNodes, err := ExpandKQL(kqlAst.Nodes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to expand KQL AST nodes: %w", err)
+	}
+
+	builder, err := TranspileKQLToOpenSearch(kqlNodes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compile query: %w", err)
+	}
+
+	if q, ok := builder.(*osu.BoolQuery); !ok {
+		return osu.NewBoolQuery().Must(builder), nil
+	} else {
+		return q, nil
+	}
+}

services/search/pkg/opensearch/internal/convert/kql_query_test.go

@@ -0,0 +1 @@
+package convert_test

services/search/pkg/opensearch/internal/convert/kql_transpile.go

@@ -0,0 +1,147 @@
+package convert
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/opencloud-eu/opencloud/pkg/ast"
+	"github.com/opencloud-eu/opencloud/pkg/kql"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+)
+
+func TranspileKQLToOpenSearch(nodes []ast.Node) (osu.Builder, error) {
+	return kqlOpensearchTranspiler{}.Transpile(nodes)
+}
+
+type kqlOpensearchTranspiler struct{}
+
+func (t kqlOpensearchTranspiler) Transpile(nodes []ast.Node) (osu.Builder, error) {
+	q, err := t.transpile(nodes)
+	if err != nil {
+		return nil, err
+	}
+
+	return q, nil
+}
+
+func (t kqlOpensearchTranspiler) transpile(nodes []ast.Node) (osu.Builder, error) {
+	if len(nodes) == 0 {
+		return nil, fmt.Errorf("no nodes to compile")
+	}
+
+	if len(nodes) == 1 {
+		builder, err := t.toBuilder(nodes[0])
+		if err != nil {
+			return nil, fmt.Errorf("failed to get builder for single node: %w", err)
+		}
+		return builder, nil
+	}
+
+	boolQueryParams := &osu.BoolQueryParams{}
+	boolQuery := osu.NewBoolQuery().Params(boolQueryParams)
+	boolQueryAdd := boolQuery.Must
+	for i, node := range nodes {
+		nextOp := t.getOperatorValueAt(nodes, i+1)
+		prevOp := t.getOperatorValueAt(nodes, i-1)
+
+		switch {
+		case nextOp == kql.BoolOR:
+			boolQueryAdd = boolQuery.Should
+		case nextOp == kql.BoolAND:
+			boolQueryAdd = boolQuery.Must
+		case prevOp == kql.BoolNOT:
+			boolQueryAdd = boolQuery.MustNot
+		}
+
+		builder, err := t.toBuilder(node)
+		switch {
+		// if the node is not known, we skip it, such as an operator node
+		case errors.Is(err, ErrUnsupportedNodeType):
+			continue
+		case err != nil:
+			return nil, fmt.Errorf("failed to get builder for node %T: %w", node, err)
+		}
+
+		if _, ok := node.(*ast.OperatorNode); ok {
+			// operatorNodes are not builders, so we skip them
+			continue
+		}
+
+		if nextOp == kql.BoolOR {
+			// if there are should clauses, we set the minimum should match to 1
+			boolQueryParams.MinimumShouldMatch = 1
+		}
+
+		boolQueryAdd(builder)
+	}
+
+	return boolQuery, nil
+}
+
+func (t kqlOpensearchTranspiler) getOperatorValueAt(nodes []ast.Node, i int) string {
+	if i < 0 || i >= len(nodes) {
+		return ""
+	}
+
+	if opn, ok := nodes[i].(*ast.OperatorNode); ok {
+		return opn.Value
+	}
+
+	return ""
+}
+
+func (t kqlOpensearchTranspiler) toBuilder(node ast.Node) (osu.Builder, error) {
+	var builder osu.Builder
+
+	switch node := node.(type) {
+	case *ast.BooleanNode:
+		return osu.NewTermQuery[bool](node.Key).Value(node.Value), nil
+	case *ast.StringNode:
+		isWildcard := strings.Contains(node.Value, "*")
+		if isWildcard {
+			return osu.NewWildcardQuery(node.Key).Value(node.Value), nil
+		}
+
+		totalTerms := strings.Split(node.Value, " ")
+		isSingleTerm := len(totalTerms) == 1
+		isMultiTerm := len(totalTerms) >= 1
+		switch {
+		case isSingleTerm:
+			return osu.NewTermQuery[string](node.Key).Value(node.Value), nil
+		case isMultiTerm:
+			return osu.NewMatchPhraseQuery(node.Key).Query(node.Value), nil
+		}
+
+		return nil, fmt.Errorf("unsupported string node value: %s", node.Value)
+	case *ast.DateTimeNode:
+		if node.Operator == nil {
+			return builder, fmt.Errorf("date time node without operator: %w", ErrUnsupportedNodeType)
+		}
+
+		query := osu.NewRangeQuery[time.Time](node.Key)
+
+		switch node.Operator.Value {
+		case ">":
+			return query.Gt(node.Value), nil
+		case ">=":
+			return query.Gte(node.Value), nil
+		case "<":
+			return query.Lt(node.Value), nil
+		case "<=":
+			return query.Lte(node.Value), nil
+		}
+
+		return nil, fmt.Errorf("unsupported operator %s for date time node: %w", node.Operator.Value, ErrUnsupportedNodeType)
+	case *ast.GroupNode:
+		group, err := t.transpile(node.Nodes)
+		if err != nil {
+			return nil, fmt.Errorf("failed to build group: %w", err)
+		}
+
+		return group, nil
+	}
+
+	return nil, fmt.Errorf("%w: %T", ErrUnsupportedNodeType, node)
+}

services/search/pkg/opensearch/internal/convert/kql_transpile_test.go

@@ -0,0 +1,378 @@
+package convert_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/pkg/ast"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/convert"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestTranspileKQLToOpenSearch(t *testing.T) {
+	tests := []opensearchtest.TableTest[*ast.Ast, osu.Builder]{
+		// kql to os dsl - type tests
+		{
+			Name: "term query - string node",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+				},
+			},
+			Want: osu.NewTermQuery[string]("Name").Value("openCloud"),
+		},
+		{
+			Name: "term query - boolean node - true",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: true},
+				},
+			},
+			Want: osu.NewTermQuery[bool]("Deleted").Value(true),
+		},
+		{
+			Name: "term query - boolean node - false",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.BooleanNode{Key: "Deleted", Value: false},
+				},
+			},
+			Want: osu.NewTermQuery[bool]("Deleted").Value(false),
+		},
+		{
+			Name: "match-phrase query - string node",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "open cloud"},
+				},
+			},
+			Want: osu.NewMatchPhraseQuery("Name").Query(`open cloud`),
+		},
+		{
+			Name: "wildcard query - string node",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "open*"},
+				},
+			},
+			Want: osu.NewWildcardQuery("Name").Value("open*"),
+		},
+		{
+			Name: "bool query",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "Name", Value: "a"},
+						&ast.StringNode{Key: "Name", Value: "b"},
+					}},
+				},
+			},
+			Want: osu.NewBoolQuery().Must(
+				osu.NewTermQuery[string]("Name").Value("a"),
+				osu.NewTermQuery[string]("Name").Value("b"),
+			),
+		},
+		{
+			Name: "no bool query for single term",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "Name", Value: "any"},
+					}},
+				},
+			},
+			Want: osu.NewTermQuery[string]("Name").Value("any"),
+		},
+		{
+			Name: "range query >",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.DateTimeNode{
+						Key:      "Mtime",
+						Operator: &ast.OperatorNode{Value: ">"},
+						Value:    opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00"),
+					},
+				},
+			},
+			Want: osu.NewRangeQuery[time.Time]("Mtime").Gt(opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00")),
+		},
+		{
+			Name: "range query >=",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.DateTimeNode{
+						Key:      "Mtime",
+						Operator: &ast.OperatorNode{Value: ">="},
+						Value:    opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00"),
+					},
+				},
+			},
+			Want: osu.NewRangeQuery[time.Time]("Mtime").Gte(opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00")),
+		},
+		{
+			Name: "range query <",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.DateTimeNode{
+						Key:      "Mtime",
+						Operator: &ast.OperatorNode{Value: "<"},
+						Value:    opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00"),
+					},
+				},
+			},
+			Want: osu.NewRangeQuery[time.Time]("Mtime").Lt(opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00")),
+		},
+		{
+			Name: "range query <=",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.DateTimeNode{
+						Key:      "Mtime",
+						Operator: &ast.OperatorNode{Value: "<="},
+						Value:    opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00"),
+					},
+				},
+			},
+			Want: osu.NewRangeQuery[time.Time]("Mtime").Lte(opensearchtest.TimeMustParse(t, "2023-09-05T08:42:11.23554+02:00")),
+		},
+		// kql to os dsl - structure tests
+		{
+			Name: "[*]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+				},
+			},
+			Want: osu.NewTermQuery[string]("Name").Value("openCloud"),
+		},
+		{
+			Name: "[* *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+					&ast.StringNode{Key: "age", Value: "32"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Must(
+					osu.NewTermQuery[string]("Name").Value("openCloud"),
+					osu.NewTermQuery[string]("age").Value("32"),
+				),
+		},
+		{
+			Name: "[* AND *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "age", Value: "32"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Must(
+					osu.NewTermQuery[string]("Name").Value("openCloud"),
+					osu.NewTermQuery[string]("age").Value("32"),
+				),
+		},
+		{
+			Name: "[* OR *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "age", Value: "32"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+				Should(
+					osu.NewTermQuery[string]("Name").Value("openCloud"),
+					osu.NewTermQuery[string]("age").Value("32"),
+				),
+		},
+		{
+			Name: "[NOT *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.StringNode{Key: "age", Value: "32"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				MustNot(
+					osu.NewTermQuery[string]("age").Value("32"),
+				),
+		},
+		{
+			Name: "[* NOT *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.StringNode{Key: "age", Value: "32"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Must(
+					osu.NewTermQuery[string]("Name").Value("openCloud"),
+				).
+				MustNot(
+					osu.NewTermQuery[string]("age").Value("32"),
+				),
+		},
+		{
+			Name: "[* OR * OR *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "Name", Value: "openCloud"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "age", Value: "32"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "age", Value: "44"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+				Should(
+					osu.NewTermQuery[string]("Name").Value("openCloud"),
+					osu.NewTermQuery[string]("age").Value("32"),
+					osu.NewTermQuery[string]("age").Value("44"),
+				),
+		},
+		{
+			Name: "[* AND * OR *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "a", Value: "a"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "b", Value: "b"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "c", Value: "c"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+				Must(
+					osu.NewTermQuery[string]("a").Value("a"),
+				).
+				Should(
+					osu.NewTermQuery[string]("b").Value("b"),
+					osu.NewTermQuery[string]("c").Value("c"),
+				),
+		},
+		{
+			Name: "[* OR * AND *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "a", Value: "a"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "b", Value: "b"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "c", Value: "c"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+				Must(
+					osu.NewTermQuery[string]("b").Value("b"),
+					osu.NewTermQuery[string]("c").Value("c"),
+				).
+				Should(
+					osu.NewTermQuery[string]("a").Value("a"),
+				),
+		},
+		{
+			Name: "[* OR * AND *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "a", Value: "a"},
+					&ast.OperatorNode{Value: "OR"},
+					&ast.StringNode{Key: "b", Value: "b"},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "c", Value: "c"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+				Should(
+					osu.NewTermQuery[string]("a").Value("a"),
+				).
+				Must(
+					osu.NewTermQuery[string]("b").Value("b"),
+					osu.NewTermQuery[string]("c").Value("c"),
+				),
+		},
+		{
+			Name: "[[* OR * OR *] AND *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "a", Value: "a"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "b", Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "c"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.StringNode{Key: "d", Value: "d"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Must(
+					osu.NewBoolQuery().
+						Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+						Should(
+							osu.NewTermQuery[string]("a").Value("a"),
+							osu.NewTermQuery[string]("b").Value("b"),
+							osu.NewTermQuery[string]("c").Value("c"),
+						),
+					osu.NewTermQuery[string]("d").Value("d"),
+				),
+		},
+		{
+			Name: "[[* OR * OR *] AND NOT *]",
+			Got: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.GroupNode{Nodes: []ast.Node{
+						&ast.StringNode{Key: "a", Value: "a"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "b", Value: "b"},
+						&ast.OperatorNode{Value: "OR"},
+						&ast.StringNode{Key: "c", Value: "c"},
+					}},
+					&ast.OperatorNode{Value: "AND"},
+					&ast.OperatorNode{Value: "NOT"},
+					&ast.StringNode{Key: "d", Value: "d"},
+				},
+			},
+			Want: osu.NewBoolQuery().
+				Must(
+					osu.NewBoolQuery().
+						Params(&osu.BoolQueryParams{MinimumShouldMatch: 1}).
+						Should(
+							osu.NewTermQuery[string]("a").Value("a"),
+							osu.NewTermQuery[string]("b").Value("b"),
+							osu.NewTermQuery[string]("c").Value("c"),
+						),
+				).MustNot(
+				osu.NewTermQuery[string]("d").Value("d"),
+			),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			if test.Skip {
+				t.Skip("skipping test: " + test.Name)
+			}
+
+			dsl, err := convert.TranspileKQLToOpenSearch(test.Got.Nodes)
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, dsl))
+		})
+	}
+}

services/search/pkg/opensearch/internal/convert/opensearch.go

@@ -0,0 +1,98 @@
+package convert
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
+	searchMessage "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/engine"
+)
+
+func OpenSearchHitToMatch(hit opensearchgoAPI.SearchHit) (*searchMessage.Match, error) {
+	resource, err := conversions.To[engine.Resource](hit.Source)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert hit source: %w", err)
+	}
+
+	resourceRootID, err := storagespace.ParseID(resource.RootID)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceID, err := storagespace.ParseID(resource.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceParentID, _ := storagespace.ParseID(resource.ParentID)
+
+	match := &searchMessage.Match{
+		Score: hit.Score,
+		Entity: &searchMessage.Entity{
+			Ref: &searchMessage.Reference{
+				ResourceId: &searchMessage.ResourceID{
+					StorageId: resourceRootID.GetStorageId(),
+					SpaceId:   resourceRootID.GetSpaceId(),
+					OpaqueId:  resourceRootID.GetOpaqueId(),
+				},
+				Path: resource.Path,
+			},
+			Id: &searchMessage.ResourceID{
+				StorageId: resourceID.GetStorageId(),
+				SpaceId:   resourceID.GetSpaceId(),
+				OpaqueId:  resourceID.GetOpaqueId(),
+			},
+			Name: resource.Name,
+			ParentId: &searchMessage.ResourceID{
+				StorageId: resourceParentID.GetStorageId(),
+				SpaceId:   resourceParentID.GetSpaceId(),
+				OpaqueId:  resourceParentID.GetOpaqueId(),
+			},
+			Size:     resource.Size,
+			Type:     resource.Type,
+			MimeType: resource.MimeType,
+			Deleted:  resource.Deleted,
+			Tags:     resource.Tags,
+			Highlights: func() string {
+				contentHighlights, ok := hit.Highlight["Content"]
+				if !ok {
+					return ""
+				}
+
+				return strings.Join(contentHighlights[:], "; ")
+			}(),
+			Audio: func() *searchMessage.Audio {
+				if !strings.HasPrefix(resource.MimeType, "audio/") {
+					return nil
+				}
+
+				audio, _ := conversions.To[*searchMessage.Audio](resource.Audio)
+				return audio
+			}(),
+			Image: func() *searchMessage.Image {
+				image, _ := conversions.To[*searchMessage.Image](resource.Image)
+				return image
+			}(),
+			Location: func() *searchMessage.GeoCoordinates {
+				geoCoordinates, _ := conversions.To[*searchMessage.GeoCoordinates](resource.Location)
+				return geoCoordinates
+			}(),
+			Photo: func() *searchMessage.Photo {
+				photo, _ := conversions.To[*searchMessage.Photo](resource.Photo)
+				return photo
+			}(),
+		},
+	}
+
+	if mtime, err := time.Parse(time.RFC3339, resource.Mtime); err == nil {
+		match.Entity.LastModifiedTime = &timestamppb.Timestamp{Seconds: mtime.Unix(), Nanos: int32(mtime.Nanosecond())}
+	}
+
+	return match, nil
+}

services/search/pkg/opensearch/internal/convert/opensearch_test.go

@@ -0,0 +1,38 @@
+package convert_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
+	searchMessage "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/convert"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestOpenSearchHitToMatch(t *testing.T) {
+	resource := opensearchtest.Testdata.Resources.File
+	resource.MimeType = "audio/anything"
+
+	hit := opensearchgoAPI.SearchHit{
+		Score:  1.1,
+		Source: json.RawMessage(opensearchtest.JSONMustMarshal(t, resource)),
+	}
+	match, err := convert.OpenSearchHitToMatch(hit)
+	assert.NoError(t, err)
+	assert.Equal(t, hit.Score, match.Score)
+	assert.Equal(t, resource.Name, match.Entity.Name)
+	t.Parallel()
+	t.Run("converts the audio field to the expected type", func(t *testing.T) {
+		// searchMessage.Audio contains int64, int32 ... values that are converted to strings by the JSON marshaler,
+		// so we need to convert the resource.Audio to align the expectations for the JSON comparison.
+		audio, err := conversions.To[*searchMessage.Audio](resource.Audio)
+		assert.NoError(t, err)
+
+		assert.Equal(t, resource.Audio.Bitrate, match.Entity.Audio.Bitrate)
+		assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, audio), opensearchtest.JSONMustMarshal(t, match.Entity.Audio))
+	})
+}

services/search/pkg/opensearch/internal/indexes/resource_v1.json

@@ -0,0 +1,49 @@
+{
+  "settings": {
+    "number_of_shards": "1",
+    "number_of_replicas": "1",
+    "analysis": {
+      "analyzer": {
+        "path_hierarchy": {
+          "filter": [
+            "lowercase"
+          ],
+          "tokenizer": "path_hierarchy",
+          "type": "custom"
+        }
+      },
+      "tokenizer": {
+        "path_hierarchy": {
+          "type": "path_hierarchy"
+        }
+      }
+    }
+  },
+  "mappings": {
+    "properties": {
+      "ID": {
+        "type": "keyword"
+      },
+      "ParentID": {
+        "type": "keyword"
+      },
+      "RootID": {
+        "type": "keyword"
+      },
+      "MimeType": {
+        "type": "wildcard",
+        "doc_values": false
+      },
+      "Path": {
+        "type": "text",
+        "analyzer": "path_hierarchy"
+      },
+      "Deleted": {
+        "type": "boolean"
+      },
+      "Hidden": {
+        "type": "boolean"
+      }
+    }
+  }
+}

services/search/pkg/opensearch/internal/osu/osu.go

@@ -0,0 +1,128 @@
+package osu
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"dario.cat/mergo"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
+)
+
+type Builder interface {
+	json.Marshaler
+	Map() (map[string]any, error)
+}
+
+func newBase(v ...any) (map[string]any, error) {
+	base := make(map[string]any)
+	for _, value := range v {
+		data, err := conversions.To[map[string]any](value)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert value to map: %w", err)
+		}
+
+		if isEmpty(data) {
+			continue
+		}
+
+		if err := mergo.Merge(&base, data); err != nil {
+			return nil, fmt.Errorf("failed to merge value into base: %w", err)
+		}
+	}
+
+	return base, nil
+}
+
+func applyValue[T any](target map[string]any, key string, v T) {
+	if target == nil || isEmpty(key) || isEmpty(v) {
+		return
+	}
+
+	target[key] = v
+}
+
+func applyValues[T any](target map[string]any, values map[string]T) {
+	if target == nil || isEmpty(values) {
+		return
+	}
+
+	for k, v := range values {
+		applyValue[T](target, k, v)
+	}
+}
+
+func applyBuilder(target map[string]any, key string, builder Builder) error {
+	if target == nil || isEmpty(key) || isEmpty(builder) {
+		return nil
+	}
+
+	data, err := builder.Map()
+	if err != nil {
+		return fmt.Errorf("failed to map builder %s: %w", key, err)
+	}
+
+	if !isEmpty(data) {
+		target[key] = data
+	}
+
+	return nil
+}
+
+func applyBuilders(target map[string]any, key string, bs ...Builder) error {
+	if target == nil || isEmpty(key) || isEmpty(bs) {
+		return nil
+	}
+
+	builders := make([]map[string]any, 0, len(bs))
+	for _, builder := range bs {
+		data, err := builder.Map()
+		switch {
+		case err != nil:
+			return fmt.Errorf("failed to map builder %s: %w", key, err)
+		case isEmpty(data):
+			continue
+		default:
+			builders = append(builders, data)
+		}
+	}
+
+	if len(builders) > 0 {
+		target[key] = builders
+	}
+
+	return nil
+}
+
+func isEmpty(x any) bool {
+	switch {
+	case x == nil:
+		return true
+	case reflect.ValueOf(x).Kind() == reflect.Bool:
+		return false
+	case reflect.DeepEqual(x, reflect.Zero(reflect.TypeOf(x)).Interface()):
+		return true
+	case reflect.ValueOf(x).Kind() == reflect.Map && reflect.ValueOf(x).Len() == 0:
+		return true
+	default:
+		return false
+	}
+}
+
+func merge[T any](vals ...T) T {
+	base := make(map[string]any)
+
+	for _, val := range vals {
+		data, err := conversions.To[map[string]any](val)
+		if err != nil {
+			continue
+		}
+
+		_ = mergo.Merge(&base, data)
+	}
+
+	data, _ := conversions.To[T](base)
+
+	return data
+}

services/search/pkg/opensearch/internal/osu/query_bool.go

@@ -0,0 +1,87 @@
+package osu
+
+import (
+	"encoding/json"
+)
+
+type BoolQuery struct {
+	must    []Builder
+	mustNot []Builder
+	should  []Builder
+	filter  []Builder
+	params  *BoolQueryParams
+}
+
+type BoolQueryParams struct {
+	MinimumShouldMatch int16   `json:"minimum_should_match,omitempty"`
+	Boost              float32 `json:"boost,omitempty"`
+	Name               string  `json:"_name,omitempty"`
+}
+
+func NewBoolQuery() *BoolQuery {
+	return &BoolQuery{}
+}
+
+func (q *BoolQuery) Params(v *BoolQueryParams) *BoolQuery {
+	q.params = v
+	return q
+}
+
+func (q *BoolQuery) Must(v ...Builder) *BoolQuery {
+	q.must = append(q.must, v...)
+	return q
+}
+
+func (q *BoolQuery) MustNot(v ...Builder) *BoolQuery {
+	q.mustNot = append(q.mustNot, v...)
+	return q
+}
+
+func (q *BoolQuery) Should(v ...Builder) *BoolQuery {
+	q.should = append(q.should, v...)
+	return q
+}
+
+func (q *BoolQuery) Filter(v ...Builder) *BoolQuery {
+	q.filter = append(q.filter, v...)
+	return q
+}
+
+func (q *BoolQuery) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := applyBuilders(base, "must", q.must...); err != nil {
+		return nil, err
+	}
+
+	if err := applyBuilders(base, "must_not", q.mustNot...); err != nil {
+		return nil, err
+	}
+
+	if err := applyBuilders(base, "should", q.should...); err != nil {
+		return nil, err
+	}
+
+	if err := applyBuilders(base, "filter", q.filter...); err != nil {
+		return nil, err
+	}
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"bool": base,
+	}, nil
+}
+
+func (q *BoolQuery) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_bool_test.go

@@ -0,0 +1,158 @@
+package osu_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestBoolQuery(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewBoolQuery(),
+			Want: nil,
+		},
+		{
+			Name: "with params",
+			Got: osu.NewBoolQuery().Params(&osu.BoolQueryParams{
+				MinimumShouldMatch: 10,
+				Boost:              10,
+				Name:               "some-name",
+			}),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"minimum_should_match": 10,
+					"boost":                10,
+					"_name":                "some-name",
+				},
+			},
+		},
+		{
+			Name: "must",
+			Got:  osu.NewBoolQuery().Must(osu.NewTermQuery[string]("name").Value("tom")),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"must": []map[string]any{
+						{
+							"term": map[string]any{
+								"name": map[string]any{
+									"value": "tom",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Name: "must_not",
+			Got:  osu.NewBoolQuery().MustNot(osu.NewTermQuery[string]("name").Value("tom")),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"must_not": []map[string]any{
+						{
+							"term": map[string]any{
+								"name": map[string]any{
+									"value": "tom",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Name: "should",
+			Got:  osu.NewBoolQuery().Should(osu.NewTermQuery[string]("name").Value("tom")),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"should": []map[string]any{
+						{
+							"term": map[string]any{
+								"name": map[string]any{
+									"value": "tom",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Name: "filter",
+			Got:  osu.NewBoolQuery().Filter(osu.NewTermQuery[string]("name").Value("tom")),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"filter": []map[string]any{
+						{
+							"term": map[string]any{
+								"name": map[string]any{
+									"value": "tom",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Name: "full",
+			Got: osu.NewBoolQuery().
+				Must(osu.NewTermQuery[string]("name").Value("tom")).
+				MustNot(osu.NewTermQuery[bool]("deleted").Value(true)).
+				Should(osu.NewTermQuery[string]("gender").Value("male")).
+				Filter(osu.NewTermQuery[int]("age").Value(42)),
+			Want: map[string]any{
+				"bool": map[string]any{
+					"must": []map[string]any{
+						{
+							"term": map[string]any{
+								"name": map[string]any{
+									"value": "tom",
+								},
+							},
+						},
+					},
+					"must_not": []map[string]any{
+						{
+							"term": map[string]any{
+								"deleted": map[string]any{
+									"value": true,
+								},
+							},
+						},
+					},
+					"should": []map[string]any{
+						{
+							"term": map[string]any{
+								"gender": map[string]any{
+									"value": "male",
+								},
+							},
+						},
+					},
+					"filter": []map[string]any{
+						{
+							"term": map[string]any{
+								"age": map[string]any{
+									"value": 42,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/query_full_text_match_phrase.go

@@ -0,0 +1,58 @@
+package osu
+
+import (
+	"encoding/json"
+)
+
+type MatchPhraseQuery struct {
+	field  string
+	query  string
+	params *MatchPhraseQueryParams
+}
+
+type MatchPhraseQueryParams struct {
+	Analyzer       string `json:"analyzer,omitempty"`
+	Slop           int    `json:"slop,omitempty"`
+	ZeroTermsQuery string `json:"zero_terms_query,omitempty"`
+}
+
+func NewMatchPhraseQuery(field string) *MatchPhraseQuery {
+	return &MatchPhraseQuery{field: field}
+}
+
+func (q *MatchPhraseQuery) Params(v *MatchPhraseQueryParams) *MatchPhraseQuery {
+	q.params = v
+	return q
+}
+
+func (q *MatchPhraseQuery) Query(v string) *MatchPhraseQuery {
+	q.query = v
+	return q
+}
+
+func (q *MatchPhraseQuery) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	applyValue(base, "query", q.query)
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"match_phrase": map[string]any{
+			q.field: base,
+		},
+	}, nil
+}
+
+func (q *MatchPhraseQuery) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_full_text_match_phrase_test.go

@@ -0,0 +1,72 @@
+package osu_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestNewMatchPhraseQuery(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewMatchPhraseQuery("empty"),
+			Want: nil,
+		},
+		{
+			Name: "with params",
+			Got: osu.NewMatchPhraseQuery("name").Params(&osu.MatchPhraseQueryParams{
+				Analyzer:       "analyzer",
+				Slop:           2,
+				ZeroTermsQuery: "all",
+			}),
+			Want: map[string]any{
+				"match_phrase": map[string]any{
+					"name": map[string]any{
+						"analyzer":         "analyzer",
+						"slop":             2,
+						"zero_terms_query": "all",
+					},
+				},
+			},
+		},
+		{
+			Name: "query",
+			Got:  osu.NewMatchPhraseQuery("name").Query("some match query"),
+			Want: map[string]any{
+				"match_phrase": map[string]any{
+					"name": map[string]any{
+						"query": "some match query",
+					},
+				},
+			},
+		},
+		{
+			Name: "full",
+			Got: osu.NewMatchPhraseQuery("name").Params(&osu.MatchPhraseQueryParams{
+				Analyzer:       "analyzer",
+				Slop:           2,
+				ZeroTermsQuery: "all",
+			}).Query("some match query"),
+			Want: map[string]any{
+				"match_phrase": map[string]any{
+					"name": map[string]any{
+						"query":            "some match query",
+						"analyzer":         "analyzer",
+						"slop":             2,
+						"zero_terms_query": "all",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/query_term_level_ids.go

@@ -0,0 +1,49 @@
+package osu
+
+import (
+	"encoding/json"
+	"slices"
+)
+
+type IDsQuery struct {
+	values []string
+	params *IDsQueryParams
+}
+
+type IDsQueryParams struct {
+	Boost float32 `json:"boost,omitempty"`
+}
+
+func NewIDsQuery(v ...string) *IDsQuery {
+	return &IDsQuery{values: slices.Compact(v)}
+}
+
+func (q *IDsQuery) Params(v *IDsQueryParams) *IDsQuery {
+	q.params = v
+	return q
+}
+
+func (q *IDsQuery) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	applyValue(base, "values", q.values)
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"ids": base,
+	}, nil
+}
+
+func (q *IDsQuery) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_term_level_ids_test.go

@@ -0,0 +1,45 @@
+package osu_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestIDsQuery(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewIDsQuery(),
+			Want: nil,
+		},
+		{
+			Name: "no params",
+			Got:  osu.NewIDsQuery("1", "2", "3", "3"),
+			Want: map[string]any{
+				"ids": map[string]any{
+					"values": []string{"1", "2", "3"},
+				},
+			},
+		},
+		{
+			Name: "ids",
+			Got:  osu.NewIDsQuery("1", "2", "3", "3").Params(&osu.IDsQueryParams{Boost: 1.0}),
+			Want: map[string]any{
+				"ids": map[string]any{
+					"values": []string{"1", "2", "3"},
+					"boost":  1.0,
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/query_term_level_range.go

@@ -0,0 +1,92 @@
+package osu
+
+import (
+	"encoding/json"
+	"errors"
+	"time"
+)
+
+type RangeQuery[T time.Time | string] struct {
+	field  string
+	gt     T
+	gte    T
+	lt     T
+	lte    T
+	params *RangeQueryParams
+}
+
+type RangeQueryParams struct {
+	Format   string  `json:"format,omitempty"`
+	Relation string  `json:"relation,omitempty"`
+	Boost    float32 `json:"boost,omitempty"`
+	TimeZone string  `json:"time_zone,omitempty"`
+}
+
+func NewRangeQuery[T time.Time | string](field string) *RangeQuery[T] {
+	return &RangeQuery[T]{field: field}
+}
+
+func (q *RangeQuery[T]) Params(v *RangeQueryParams) *RangeQuery[T] {
+	q.params = v
+	return q
+}
+
+func (q *RangeQuery[T]) Gt(v T) *RangeQuery[T] {
+	q.gt = v
+	return q
+}
+
+func (q *RangeQuery[T]) Gte(v T) *RangeQuery[T] {
+	q.gte = v
+	return q
+}
+
+func (q *RangeQuery[T]) Lt(v T) *RangeQuery[T] {
+	q.lt = v
+	return q
+}
+
+func (q *RangeQuery[T]) Lte(v T) *RangeQuery[T] {
+	q.lte = v
+	return q
+}
+
+func (q *RangeQuery[T]) Map() (map[string]any, error) {
+	if !isEmpty(q.gt) && !isEmpty(q.gte) {
+		return nil, errors.New("cannot set both gt and gte in RangeQuery")
+	}
+
+	if !isEmpty(q.lt) && !isEmpty(q.lte) {
+		return nil, errors.New("cannot set both lt and lte in RangeQuery")
+	}
+
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	applyValues(base, map[string]T{
+		"gt":  q.gt,
+		"gte": q.gte,
+		"lt":  q.lt,
+		"lte": q.lte,
+	})
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"range": map[string]any{
+			q.field: base,
+		},
+	}, nil
+}
+
+func (q *RangeQuery[T]) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_term_level_range_test.go

@@ -0,0 +1,164 @@
+package osu_test
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestRangeQuery(t *testing.T) {
+	now := time.Now()
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewRangeQuery[string]("empty"),
+			Want: nil,
+		},
+		{
+			Name: "gt string",
+			Got:  osu.NewRangeQuery[string]("created").Gt("2023-01-01T00:00:00Z"),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"gt": "2023-01-01T00:00:00Z",
+					},
+				},
+			},
+		},
+		{
+			Name: "gt time",
+			Got:  osu.NewRangeQuery[time.Time]("created").Gt(now),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"gt": now,
+					},
+				},
+			},
+		},
+		{
+			Name: "gte string",
+			Got:  osu.NewRangeQuery[string]("created").Gte("2023-01-01T00:00:00Z"),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"gte": "2023-01-01T00:00:00Z",
+					},
+				},
+			},
+		},
+		{
+			Name: "gte time",
+			Got:  osu.NewRangeQuery[time.Time]("created").Gte(now),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"gte": now,
+					},
+				},
+			},
+		},
+		{
+			Name: "gt & gte",
+			Got:  osu.NewRangeQuery[time.Time]("created").Gt(now).Gte(now),
+			Want: nil,
+			Err:  errors.New(""),
+		},
+		{
+			Name: "gt string",
+			Got:  osu.NewRangeQuery[string]("created").Lt("2023-01-01T00:00:00Z"),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"lt": "2023-01-01T00:00:00Z",
+					},
+				},
+			},
+		},
+		{
+			Name: "lt time",
+			Got:  osu.NewRangeQuery[time.Time]("created").Lt(now),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"lt": now,
+					},
+				},
+			},
+		},
+		{
+			Name: "lte string",
+			Got:  osu.NewRangeQuery[string]("created").Lte("2023-01-01T00:00:00Z"),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"lte": "2023-01-01T00:00:00Z",
+					},
+				},
+			},
+		},
+		{
+			Name: "lte time",
+			Got:  osu.NewRangeQuery[time.Time]("created").Lte(now),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"lte": now,
+					},
+				},
+			},
+		},
+		{
+			Name: "lt & lte",
+			Got:  osu.NewRangeQuery[time.Time]("created").Lt(now).Lte(now),
+			Want: nil,
+			Err:  errors.New(""),
+		},
+		{
+			Name: "with params",
+			Got: osu.NewRangeQuery[time.Time]("created").Params(&osu.RangeQueryParams{
+				Format:   "strict_date_optional_time",
+				Relation: "within",
+				Boost:    1.0,
+				TimeZone: "UTC",
+			}).Lte(now).Gte(now),
+			Want: map[string]any{
+				"range": map[string]any{
+					"created": map[string]any{
+						"lte":       now,
+						"gte":       now,
+						"format":    "strict_date_optional_time",
+						"relation":  "within",
+						"boost":     1.0,
+						"time_zone": "UTC",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			got, err := test.Got.MarshalJSON()
+			switch {
+			case test.Err != nil && test.Err.Error() == "": // Expecting any error
+				assert.Error(t, err)
+				assert.Nil(t, got)
+				return
+			case test.Err != nil && test.Err.Error() != "": // Expecting a specific error
+				assert.ErrorIs(t, test.Err, err)
+				assert.Nil(t, got)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), string(got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/query_term_level_term.go

@@ -0,0 +1,58 @@
+package osu
+
+import (
+	"encoding/json"
+)
+
+type TermQuery[T comparable] struct {
+	field  string
+	value  T
+	params *TermQueryParams
+}
+
+type TermQueryParams struct {
+	Boost           float32 `json:"boost,omitempty"`
+	CaseInsensitive bool    `json:"case_insensitive,omitempty"`
+	Name            string  `json:"_name,omitempty"`
+}
+
+func NewTermQuery[T comparable](field string) *TermQuery[T] {
+	return &TermQuery[T]{field: field}
+}
+
+func (q *TermQuery[T]) Params(v *TermQueryParams) *TermQuery[T] {
+	q.params = v
+	return q
+}
+
+func (q *TermQuery[T]) Value(v T) *TermQuery[T] {
+	q.value = v
+	return q
+}
+
+func (q *TermQuery[T]) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	applyValue(base, "value", q.value)
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"term": map[string]any{
+			q.field: base,
+		},
+	}, nil
+}
+
+func (q *TermQuery[T]) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_term_level_term_test.go

@@ -0,0 +1,55 @@
+package osu_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestTermQuery(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewTermQuery[string]("empty"),
+			Want: nil,
+		},
+		{
+			Name: "no params",
+			Got:  osu.NewTermQuery[bool]("deleted").Value(false),
+			Want: map[string]any{
+				"term": map[string]any{
+					"deleted": map[string]any{
+						"value": false,
+					},
+				},
+			},
+		},
+		{
+			Name: "with params",
+			Got: osu.NewTermQuery[bool]("deleted").Params(&osu.TermQueryParams{
+				Boost:           1.0,
+				CaseInsensitive: true,
+				Name:            "is-deleted",
+			}).Value(true),
+			Want: map[string]any{
+				"term": map[string]any{
+					"deleted": map[string]any{
+						"value":            true,
+						"boost":            1.0,
+						"case_insensitive": true,
+						"_name":            "is-deleted",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/query_term_level_wildcard.go

@@ -0,0 +1,58 @@
+package osu
+
+import (
+	"encoding/json"
+)
+
+type WildcardQuery struct {
+	field  string
+	value  string
+	params *WildcardQueryParams
+}
+
+type WildcardQueryParams struct {
+	Boost           float32 `json:"boost,omitempty"`
+	CaseInsensitive bool    `json:"case_insensitive,omitempty"`
+	Rewrite         string  `json:"rewrite,omitempty"`
+}
+
+func NewWildcardQuery(field string) *WildcardQuery {
+	return &WildcardQuery{field: field}
+}
+
+func (q *WildcardQuery) Params(v *WildcardQueryParams) *WildcardQuery {
+	q.params = v
+	return q
+}
+
+func (q *WildcardQuery) Value(v string) *WildcardQuery {
+	q.value = v
+	return q
+}
+
+func (q *WildcardQuery) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	applyValue(base, "value", q.value)
+
+	if isEmpty(base) {
+		return nil, nil
+	}
+
+	return map[string]any{
+		"wildcard": map[string]any{
+			q.field: base,
+		},
+	}, nil
+}
+
+func (q *WildcardQuery) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(data)
+}

services/search/pkg/opensearch/internal/osu/query_term_level_wildcard_test.go

@@ -0,0 +1,44 @@
+package osu_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestWildcardQuery(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "empty",
+			Got:  osu.NewWildcardQuery("empty"),
+			Want: nil,
+		},
+		{
+			Name: "wildcard",
+			Got: osu.NewWildcardQuery("name").Params(&osu.WildcardQueryParams{
+				Boost:           1.0,
+				CaseInsensitive: true,
+				Rewrite:         "top_terms_blended_freqs_N",
+			}).Value("opencl*"),
+			Want: map[string]any{
+				"wildcard": map[string]any{
+					"name": map[string]any{
+						"value":            "opencl*",
+						"boost":            1.0,
+						"case_insensitive": true,
+						"rewrite":          "top_terms_blended_freqs_N",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}

services/search/pkg/opensearch/internal/osu/request.go

@@ -0,0 +1,105 @@
+package osu
+
+import (
+	"bytes"
+	"encoding/json"
+
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+)
+
+type QueryReqBody[P any] struct {
+	query  Builder
+	params P
+}
+
+func NewQueryReqBody[P any](q Builder, p ...P) *QueryReqBody[P] {
+	return &QueryReqBody[P]{query: q, params: merge(p...)}
+}
+
+func (q QueryReqBody[O]) Map() (map[string]any, error) {
+	base, err := newBase(q.params)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := applyBuilder(base, "query", q.query); err != nil {
+		return nil, err
+	}
+
+	return base, nil
+}
+
+func (q QueryReqBody[O]) MarshalJSON() ([]byte, error) {
+	data, err := q.Map()
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(data)
+}
+
+//----------------------------------------------------------------------------//
+
+type BodyParamHighlight struct {
+	PreTags  []string                      `json:"pre_tags,omitempty"`
+	PostTags []string                      `json:"post_tags,omitempty"`
+	Fields   map[string]BodyParamHighlight `json:"fields,omitempty"`
+}
+
+type BodyParamScript struct {
+	Source string         `json:"source,omitempty"`
+	Lang   string         `json:"lang,omitempty"`
+	Params map[string]any `json:"params,omitempty"`
+}
+
+//----------------------------------------------------------------------------//
+
+func BuildSearchReq(req *opensearchgoAPI.SearchReq, q Builder, p ...SearchBodyParams) (*opensearchgoAPI.SearchReq, error) {
+	body, err := json.Marshal(NewQueryReqBody(q, p...))
+	if err != nil {
+		return nil, err
+	}
+	req.Body = bytes.NewReader(body)
+	return req, nil
+}
+
+type SearchBodyParams struct {
+	Highlight *BodyParamHighlight `json:"highlight,omitempty"`
+}
+
+//----------------------------------------------------------------------------//
+
+func BuildDocumentDeleteByQueryReq(req opensearchgoAPI.DocumentDeleteByQueryReq, q Builder) (opensearchgoAPI.DocumentDeleteByQueryReq, error) {
+	body, err := json.Marshal(NewQueryReqBody[any](q))
+	if err != nil {
+		return req, err
+	}
+	req.Body = bytes.NewReader(body)
+	return req, nil
+}
+
+//----------------------------------------------------------------------------//
+
+func BuildUpdateByQueryReq(req opensearchgoAPI.UpdateByQueryReq, q Builder, o ...UpdateByQueryBodyParams) (opensearchgoAPI.UpdateByQueryReq, error) {
+	body, err := json.Marshal(NewQueryReqBody(q, o...))
+	if err != nil {
+		return req, err
+	}
+	req.Body = bytes.NewReader(body)
+	return req, nil
+}
+
+type UpdateByQueryBodyParams struct {
+	Script *BodyParamScript `json:"script,omitempty"`
+}
+
+//----------------------------------------------------------------------------//
+
+func BuildIndicesCountReq(req *opensearchgoAPI.IndicesCountReq, q Builder) (*opensearchgoAPI.IndicesCountReq, error) {
+	body, err := json.Marshal(NewQueryReqBody[any](q))
+	if err != nil {
+		return nil, err
+	}
+	req.Body = bytes.NewReader(body)
+	return req, nil
+}

services/search/pkg/opensearch/internal/osu/request_test.go

@@ -0,0 +1,86 @@
+package osu_test
+
+import (
+	"io"
+	"testing"
+
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/osu"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+)
+
+func TestRequestBody(t *testing.T) {
+	tests := []opensearchtest.TableTest[osu.Builder, map[string]any]{
+		{
+			Name: "simple",
+			Got:  osu.NewQueryReqBody[any](osu.NewTermQuery[string]("name").Value("tom")),
+			Want: map[string]any{
+				"query": map[string]any{
+					"term": map[string]any{
+						"name": map[string]any{
+							"value": "tom",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), opensearchtest.JSONMustMarshal(t, test.Got))
+		})
+	}
+}
+
+func TestBuildSearchReq(t *testing.T) {
+	tests := []opensearchtest.TableTest[io.Reader, map[string]any]{
+		{
+			Name: "highlight",
+			Got: func() io.Reader {
+				req, _ := osu.BuildSearchReq(
+					&opensearchgoAPI.SearchReq{},
+					osu.NewTermQuery[string]("content").Value("content"),
+					osu.SearchBodyParams{
+						Highlight: &osu.BodyParamHighlight{
+							PreTags:  []string{"<b>"},
+							PostTags: []string{"</b>"},
+							Fields: map[string]osu.BodyParamHighlight{
+								"content": {},
+							},
+						},
+					},
+				)
+
+				return req.Body
+			}(),
+			Want: map[string]any{
+				"query": map[string]any{
+					"term": map[string]any{
+						"content": map[string]any{
+							"value": "content",
+						},
+					},
+				},
+				"highlight": map[string]any{
+					"pre_tags":  []string{"<b>"},
+					"post_tags": []string{"</b>"},
+					"fields": map[string]any{
+						"content": map[string]any{},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			body, err := io.ReadAll(test.Got)
+			require.NoError(t, err)
+			assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, test.Want), string(body))
+		})
+	}
+}

services/search/pkg/opensearch/internal/test/helper.go

@@ -0,0 +1,36 @@
+package opensearchtest
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
+)
+
+var TimeMustParse = func(t *testing.T, ts string) time.Time {
+	tp, err := time.Parse(time.RFC3339Nano, ts)
+	require.NoError(t, err, "failed to parse time %s", ts)
+
+	return tp
+}
+
+func JSONMustMarshal(t *testing.T, data any) string {
+	jsonData, err := json.Marshal(data)
+	require.NoError(t, err, "failed to marshal data to JSON")
+	return string(jsonData)
+}
+
+func SearchHitsMustBeConverted[T any](t *testing.T, hits []opensearchgoAPI.SearchHit) []T {
+	ts := make([]T, len(hits))
+	for i, hit := range hits {
+		resource, err := conversions.To[T](hit.Source)
+		require.NoError(t, err)
+		ts[i] = resource
+	}
+
+	return ts
+}

services/search/pkg/opensearch/internal/test/os.go

@@ -0,0 +1,256 @@
+package opensearchtest
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"testing"
+
+	opensearchgo "github.com/opensearch-project/opensearch-go/v4"
+	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/config"
+)
+
+type TestClient struct {
+	c       *opensearchgoAPI.Client
+	Require *testRequireClient
+}
+
+func NewDefaultTestClient(t *testing.T, cfg config.EngineOpenSearchClient) *TestClient {
+	client, err := opensearchgoAPI.NewClient(opensearchgoAPI.Config{
+		Client: opensearchgo.Config{
+			Addresses: cfg.Addresses,
+			Username:  cfg.Username,
+			Password:  cfg.Password,
+		},
+	})
+	require.NoError(t, err, "failed to create OpenSearch client")
+
+	return NewTestClient(t, client)
+}
+
+func NewTestClient(t *testing.T, client *opensearchgoAPI.Client) *TestClient {
+	tc := &TestClient{c: client}
+	trc := &testRequireClient{tc: tc, t: t}
+	tc.Require = trc
+
+	return tc
+}
+
+func (tc *TestClient) Client() *opensearchgoAPI.Client {
+	return tc.c
+}
+
+func (tc *TestClient) IndicesReset(ctx context.Context, indices []string) error {
+	indicesToDelete := make([]string, 0, len(indices))
+	for _, index := range indices {
+		exist, err := tc.IndicesExists(ctx, []string{index})
+		if err != nil {
+			return fmt.Errorf("failed to check if index %s exists: %w", index, err)
+		}
+
+		if !exist {
+			continue
+		}
+
+		indicesToDelete = append(indicesToDelete, index)
+	}
+
+	if len(indicesToDelete) == 0 {
+		// If no indices to delete, return nil
+		return nil
+	}
+
+	return tc.IndicesDelete(ctx, indicesToDelete)
+}
+
+func (tc *TestClient) IndicesExists(ctx context.Context, indices []string) (bool, error) {
+	if err := tc.IndicesRefresh(ctx, indices, []int{404}); err != nil {
+		return false, err
+	}
+
+	resp, err := tc.c.Indices.Exists(ctx, opensearchgoAPI.IndicesExistsReq{
+		Indices: indices,
+	})
+	switch {
+	case resp != nil && resp.StatusCode == 404:
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("failed to check if indices exist: %w", err)
+	case resp != nil && resp.IsError():
+		return false, fmt.Errorf("failed to check if indices exist: %s", resp.String())
+	default:
+		return true, nil
+	}
+}
+
+func (tc *TestClient) IndicesRefresh(ctx context.Context, indices []string, allow []int) error {
+	resp, err := tc.c.Indices.Refresh(ctx, &opensearchgoAPI.IndicesRefreshReq{
+		Indices: indices,
+	})
+
+	isAllowed := resp != nil
+	isAllowed = isAllowed && resp.Inspect().Response != nil
+	isAllowed = isAllowed && slices.Contains(allow, resp.Inspect().Response.StatusCode)
+
+	if err != nil && !isAllowed {
+		return fmt.Errorf("failed to refresh indices %v: %w", indices, err)
+	}
+
+	return nil
+}
+
+func (tc *TestClient) IndicesDelete(ctx context.Context, indices []string) error {
+	if err := tc.IndicesRefresh(ctx, indices, []int{}); err != nil {
+		return err
+	}
+
+	resp, err := tc.c.Indices.Delete(ctx, opensearchgoAPI.IndicesDeleteReq{
+		Indices: indices,
+	})
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to delete indices: %w", err)
+	case !resp.Acknowledged:
+		return errors.New("indices deletion not acknowledged")
+	default:
+		return nil
+	}
+}
+
+func (tc *TestClient) IndicesCreate(ctx context.Context, index string, body io.Reader) error {
+	resp, err := tc.c.Indices.Create(ctx, opensearchgoAPI.IndicesCreateReq{
+		Index: index,
+		Body:  body,
+	})
+
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to create index %s: %w", index, err)
+	case !resp.Acknowledged:
+		return fmt.Errorf("index creation not acknowledged for %s", index)
+	default:
+		return nil
+	}
+}
+
+func (tc *TestClient) IndicesCount(ctx context.Context, indices []string, body io.Reader) (int, error) {
+	if err := tc.IndicesRefresh(ctx, indices, []int{404}); err != nil {
+		return 0, err
+	}
+
+	resp, err := tc.c.Indices.Count(ctx, &opensearchgoAPI.IndicesCountReq{
+		Indices: indices,
+		Body:    body,
+	})
+
+	switch {
+	case err != nil:
+		return 0, fmt.Errorf("failed to count documents in indices: %w", err)
+	default:
+		return resp.Count, nil
+	}
+}
+
+func (tc *TestClient) DocumentCreate(ctx context.Context, index, id string, body io.Reader) error {
+	if err := tc.IndicesRefresh(ctx, []string{index}, []int{404}); err != nil {
+		return err
+	}
+
+	_, err := tc.c.Document.Create(ctx, opensearchgoAPI.DocumentCreateReq{
+		Index:      index,
+		DocumentID: id,
+		Body:       body,
+	})
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to create document in index %s: %w", index, err)
+	default:
+		return nil
+	}
+}
+
+func (tc *TestClient) Update(ctx context.Context, index, id string, body io.Reader) error {
+	if err := tc.IndicesRefresh(ctx, []string{index}, []int{404}); err != nil {
+		return err
+	}
+
+	_, err := tc.c.Update(ctx, opensearchgoAPI.UpdateReq{
+		Index:      index,
+		DocumentID: id,
+		Body:       body,
+	})
+	switch {
+	case err != nil:
+		return fmt.Errorf("failed to update document in index %s: %w", index, err)
+	default:
+		return nil
+	}
+}
+
+func (tc *TestClient) Search(ctx context.Context, index string, body io.Reader) (opensearchgoAPI.SearchHits, error) {
+	if err := tc.IndicesRefresh(ctx, []string{index}, []int{404}); err != nil {
+		return opensearchgoAPI.SearchHits{}, err
+	}
+
+	resp, err := tc.c.Search(ctx, &opensearchgoAPI.SearchReq{
+		Indices: []string{index},
+		Body:    body,
+	})
+	if err != nil {
+		return opensearchgoAPI.SearchHits{}, fmt.Errorf("failed to search in index %s: %w", index, err)
+	}
+
+	return resp.Hits, nil
+}
+
+type testRequireClient struct {
+	tc *TestClient
+	t  *testing.T
+}
+
+func (trc *testRequireClient) IndicesReset(indices []string) {
+	require.NoError(trc.t, trc.tc.IndicesReset(trc.t.Context(), indices))
+}
+
+func (trc *testRequireClient) IndicesRefresh(indices []string, ignore []int) {
+	require.NoError(trc.t, trc.tc.IndicesRefresh(trc.t.Context(), indices, ignore))
+}
+
+func (trc *testRequireClient) IndicesCreate(index string, body io.Reader) {
+	require.NoError(trc.t, trc.tc.IndicesCreate(trc.t.Context(), index, body))
+}
+
+func (trc *testRequireClient) IndicesDelete(indices []string) {
+	require.NoError(trc.t, trc.tc.IndicesDelete(trc.t.Context(), indices))
+}
+
+func (trc *testRequireClient) IndicesCount(indices []string, body io.Reader, expected int) {
+	count, err := trc.tc.IndicesCount(trc.t.Context(), indices, body)
+
+	switch {
+	case expected <= 0:
+		require.True(trc.t, count <= 0, "expected indices to have no documents, but got a count of %d", count)
+	default:
+		require.Equal(trc.t, expected, count, "expected indices to have %d documents, but got %d", expected, count)
+		require.NoError(trc.t, err, "expected indices to have documents, but got an error")
+	}
+}
+
+func (trc *testRequireClient) DocumentCreate(index, id string, body io.Reader) {
+	require.NoError(trc.t, trc.tc.DocumentCreate(trc.t.Context(), index, id, body))
+}
+
+func (trc *testRequireClient) Update(index, id string, body io.Reader) {
+	require.NoError(trc.t, trc.tc.Update(trc.t.Context(), index, id, body))
+}
+
+func (trc *testRequireClient) Search(index string, body io.Reader) opensearchgoAPI.SearchHits {
+	hits, err := trc.tc.Search(trc.t.Context(), index, body)
+	require.NoError(trc.t, err)
+	return hits
+}

services/search/pkg/opensearch/internal/test/suite.go

@@ -0,0 +1,99 @@
+package opensearchtest
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/modules/opensearch"
+	"github.com/testcontainers/testcontainers-go/wait"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/config/defaults"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/config/parser"
+)
+
+const (
+	openSearchImage = "opensearchproject/opensearch:2"
+)
+
+func SetupTests(ctx context.Context) (*config.Config, func(), error) {
+	cfg, err := setupDefaultConfig()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to setup default configuration: %w", err)
+	}
+
+	cleanupOpenSearch, err := setupOpenSearchTestContainer(ctx, cfg)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to setup OpenSearch test container: %w", err)
+	}
+
+	return cfg, cleanupOpenSearch, nil
+}
+
+func setupDefaultConfig() (*config.Config, error) {
+	cfg := defaults.DefaultConfig()
+	defaults.EnsureDefaults(cfg)
+
+	{ // parser.Validate requires these fields to be set even if they are not used in these tests.
+		cfg.TokenManager.JWTSecret = "any-jwt"
+		cfg.ServiceAccount.ServiceAccountID = "any-service-account-id"
+		cfg.ServiceAccount.ServiceAccountSecret = "any-service-account-secret"
+	}
+
+	if err := parser.ParseConfig(cfg); err != nil {
+		return nil, fmt.Errorf("failed to parse default configuration: %w", err)
+	}
+
+	return cfg, nil
+}
+
+func setupOpenSearchTestContainer(ctx context.Context, cfg *config.Config) (func(), error) {
+	usesExternalOpensearch := slices.Contains([]bool{
+		os.Getenv("CI") == "woodpecker",
+		os.Getenv("CI_SYSTEM_NAME") == "woodpecker",
+		os.Getenv("USE_TESTCONTAINERS") == "false",
+	}, true)
+	if usesExternalOpensearch {
+		return func() {}, nil
+	}
+
+	containerName := fmt.Sprintf("opencloud/test/%s", openSearchImage)
+	containerName = strings.Replace(containerName, "/", "__", -1)
+	containerName = strings.Replace(containerName, ":", "_", -1)
+	container, err := opensearch.Run(
+		ctx,
+		openSearchImage,
+		opensearch.WithUsername(cfg.Engine.OpenSearch.Client.Username),
+		opensearch.WithPassword(cfg.Engine.OpenSearch.Client.Password),
+		testcontainers.WithName(containerName),
+		testcontainers.WithReuseByName(containerName),
+		testcontainers.WithWaitStrategy(
+			wait.ForLog("ML configuration initialized successfully").
+				WithStartupTimeout(5*time.Second),
+		),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to start OpenSearch container: %w", err)
+	}
+
+	address, err := container.Address(ctx)
+	if err != nil {
+		_ = container.Terminate(ctx) // attempt to clean up the container
+		return nil, fmt.Errorf("failed to get OpenSearch container address: %w", err)
+	}
+
+	// Ensure the address is set in the default configuration.
+	cfg.Engine.OpenSearch.Client.Addresses = []string{address}
+
+	return func() {
+		err := container.Terminate(ctx)
+		if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "failed to terminate OpenSearch container: %v\n", err)
+		}
+	}, nil
+}

services/search/pkg/opensearch/internal/test/test.go

@@ -0,0 +1,9 @@
+package opensearchtest
+
+type TableTest[G any, W any] struct {
+	Name string
+	Got  G
+	Want W
+	Err  error
+	Skip bool
+}

services/search/pkg/opensearch/internal/test/testdata.go

@@ -0,0 +1,40 @@
+package opensearchtest
+
+import (
+	"embed"
+	"encoding/json"
+	"fmt"
+	"path"
+
+	"github.com/opencloud-eu/opencloud/services/search/pkg/engine"
+)
+
+//go:embed testdata/*.json
+var testdata embed.FS
+
+var Testdata = struct {
+	Resources resourceTestdata
+}{
+	Resources: resourceTestdata{
+		File: fromTestData[engine.Resource]("resource_file.json"),
+	},
+}
+
+type resourceTestdata struct {
+	File engine.Resource
+}
+
+func fromTestData[D any](name string) D {
+	name = path.Join("./testdata", name)
+	data, err := testdata.ReadFile(name)
+	if err != nil {
+		panic(fmt.Sprintf("failed to read testdata file %s: %v", name, err))
+	}
+
+	var d D
+	if json.Unmarshal(data, &d) != nil {
+		panic(fmt.Sprintf("failed to unmarshal testdata %s: %v", name, err))
+	}
+
+	return d
+}

services/search/pkg/opensearch/internal/test/testdata/resource_file.json

@@ -0,0 +1,55 @@
+{
+  "ID" : "1$2!3",
+  "Title" : "dumme title",
+  "Name" : "dummy name",
+  "Content" : "dummy content",
+  "Size" : 42,
+  "Mtime" : "2025-07-24 15:15:01.324093 +0200 CEST m=+0.000056251",
+  "MimeType" : "image/jpeg",
+  "Tags" : [ "dummy" ],
+  "audio" : {
+    "album" : "Some Album",
+    "albumArtist" : "Some AlbumArtist",
+    "artist" : "Some Artist",
+    "bitrate" : 192,
+    "composers" : "Some Composers",
+    "copyright" : "",
+    "disc" : 2,
+    "discCount" : 5,
+    "duration" : 225000,
+    "genre" : "Some Genre",
+    "hasDrm" : false,
+    "isVariableBitrate" : true,
+    "title" : "Some Title",
+    "track" : 34,
+    "trackCount" : 99,
+    "year" : 2004
+  },
+  "image" : {
+    "height" : 100,
+    "width" : 100
+  },
+  "location" : {
+    "altitude" : 1047.7,
+    "latitude" : 49.48675890884328,
+    "longitude" : 11.103870357204285
+  },
+  "photo" : {
+    "cameraMake" : "CameraMake",
+    "cameraModel" : "CameraMake",
+    "exposureDenominator" : 1,
+    "exposureNumerator" : 1,
+    "fNumber" : 1,
+    "focalLength" : 1,
+    "iso" : 1,
+    "orientation" : 1,
+    "takenDateTime" : "2018-01-01T12:34:56Z"
+  },
+  "omitempty" : "1$2!3",
+  "RootID" : "1$2!1",
+  "Path" : "./doc",
+  "ParentID" : "1$2!2",
+  "Type" : 1,
+  "Deleted" : false,
+  "Hidden" : false
+}