🎉 Release 7.0.0 (#2802 )

* 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0
Merge pull request #2805 from michaelstingl/fix-2804-email-double-escape
2026-09-11 05:08:44 -04:00 · 2026-05-21 13:09:02 +02:00 · 2026-05-21 11:33:56 +02:00 · 2026-05-21 11:31:01 +02:00 · 2026-05-21 10:58:13 +02:00 · 2026-05-21 09:58:10 +02:00
304 changed files with 9903 additions and 13168 deletions
@@ -83,6 +83,12 @@ $(PIGEON): $(BINGO_DIR)/pigeon.mod
 	@echo "(re)installing $(GOBIN)/pigeon-v1.3.0"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=pigeon.mod -o=$(GOBIN)/pigeon-v1.3.0 "github.com/mna/pigeon"

+PROTOC_GEN_GO_GRPC := $(GOBIN)/protoc-gen-go-grpc-v1.81.0
+$(PROTOC_GEN_GO_GRPC): $(BINGO_DIR)/protoc-gen-go-grpc.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/protoc-gen-go-grpc-v1.81.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=protoc-gen-go-grpc.mod -o=$(GOBIN)/protoc-gen-go-grpc-v1.81.0 "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+
 PROTOC_GEN_GO := $(GOBIN)/protoc-gen-go-v1.28.1
 $(PROTOC_GEN_GO): $(BINGO_DIR)/protoc-gen-go.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
@@ -3,5 +3,3 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 go 1.23.4

 require github.com/gosexy/gettext v0.0.0-20160830220431-74466a0a0c4a // go-xgettext
-
-require github.com/jessevdk/go-flags v1.6.1 // indirect
@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.25.0
+
+require google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2
@@ -0,0 +1,6 @@
+google.golang.org/grpc v1.81.0 h1:W3G9N3KQf3BU+YuCtGKJk0CmxQNbAISICD/9AORxLIw=
+google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
@@ -30,6 +30,8 @@ MUTAGEN="${GOBIN}/mutagen-v0.18.1"

 PIGEON="${GOBIN}/pigeon-v1.3.0"

+PROTOC_GEN_GO_GRPC="${GOBIN}/protoc-gen-go-grpc-v1.81.0"
+
 PROTOC_GEN_GO="${GOBIN}/protoc-gen-go-v1.28.1"

 PROTOC_GEN_MICRO="${GOBIN}/protoc-gen-micro-v1.0.0"
@@ -8,15 +8,22 @@ exclude_paths:
  - 'docs/**'
  - '**/docs/**'
  - '**/pkg/proto/**'
+  - 'protogen/**'
+  - 'scripts/**'
  - 'idp/ui_config/**'
  - 'idp/scripts/**'
-  - 'settings/rollup.config.js'
-  - 'accounts/rollup.config.js'
+  - 'idp/src/**'
+  - 'devtools/**'
  - 'deployments/**'
  - 'tests/acceptance/expected-failures-*.md'
  - 'tests/acceptance/bootstrap/**'
  - 'tests/acceptance/TestHelpers/**'
  - 'tests/acceptance/scripts/run.sh'
  - 'vendor/**/*'
+  - 'vendor-bin/**'
  - 'tests/ocwrapper/vendor/**'
+  - '**/mocks/**'
+  - '**/pkg/config/**'
+  - '**/pkg/metrics/**'
+  - '**/pkg/revaconfig/**'
 ...
@@ -1,4 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=86cc6c0119bf551619699ae80d43a9be4fe3aae2
+WEB_COMMITID=9de6541fc8bb116fcc78b09da697563faa5e61bd
 WEB_BRANCH=main

@@ -10,6 +10,7 @@ docker_repo_slug = "opencloudeu/opencloud"
 ALPINE_GIT = "alpine/git:latest"
 APACHE_TIKA = "apache/tika:3.2.3.0-full"
 CHKO_DOCKER_PUSHRM = "chko/docker-pushrm:1"
+CODACY_COVERAGE_REPORTER = "codacy/codacy-coverage-reporter:14.1.3"
 COLLABORA_CODE = "collabora/code:24.04.5.1.1"
 OPEN_SEARCH = "opensearchproject/opensearch:2"
 INBUCKET_INBUCKET = "inbucket/inbucket"
@@ -371,7 +372,7 @@ config = {
            "skip": False,
            "suites": [
                "user-settings",
-                "file-action",
+                #"fileaction",
                "embed",
            ],
        },
@@ -384,7 +385,7 @@ config = {
                "shares",
                "search",
                "journeys",
-                "file-action",
+                #"file-action",
                "spaces",
            ],
            "tikaNeeded": True,
@@ -776,7 +777,8 @@ def restoreGoBinCache():
    ]

 def testOpencloud(ctx):
-    steps = skipCheckStep(ctx, "unit-tests") + evaluateWorkflowStep() + restoreGoBinCache() + makeGoGenerate("") + [
+    #steps = skipCheckStep(ctx, "unit-tests") + evaluateWorkflowStep() + restoreGoBinCache() + makeGoGenerate("") + [
+    steps = evaluateWorkflowStep() + restoreGoBinCache() + makeGoGenerate("") + [
        {
            "name": "golangci-lint",
            "image": OC_CI_GOLANG,
@@ -818,27 +820,24 @@ def testOpencloud(ctx):
                "SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES": "http://open-search:9200",
            },
            "commands": [
-                "mkdir -p cache/coverage",
                "make test",
-                "mv coverage.out cache/coverage/",
+                "mv coverage.out unit.coverage.out",
            ],
        },
        {
-            "name": "scan-result-cache",
-            "image": PLUGINS_S3,
-            "settings": {
-                "endpoint": CACHE_S3_SERVER,
-                "bucket": "cache",
-                "source": "cache/**/*",
-                "target": "%s/%s" % (repo_slug, ctx.build.commit + "-${CI_PIPELINE_NUMBER}"),
-                "path_style": True,
-                "access_key": {
-                    "from_secret": "cache_s3_access_key",
-                },
-                "secret_key": {
-                    "from_secret": "cache_s3_secret_key",
+            "name": "codacy-coverage",
+            "image": CODACY_COVERAGE_REPORTER,
+            "environment": {
+                "CODACY_API_TOKEN": {
+                    "from_secret": "codacy_api_token",
                },
+                "CODACY_ORGANIZATION_PROVIDER": "gh",
+                "CODACY_USERNAME": "opencloud-eu",
+                "CODACY_PROJECT_NAME": "opencloud",
            },
+            "commands": [
+                "/app/codacy-coverage-reporter report --force-coverage-parser go -r unit.coverage.out",
+            ],
        },
    ]

@@ -2300,6 +2299,8 @@ def opencloudServer(storage = "decomposed", depends_on = [], deploy_type = "", e
        "EVENTHISTORY_STORE": "memory",
        "OC_TRANSLATION_PATH": "%s/tests/config/translations" % dirs["base"],
        "ACTIVITYLOG_WRITE_BUFFER_DURATION": "0",  # Disable write buffer so that test expectations are met in time
+        # search grpc port needed for index cli tests
+        "SEARCH_GRPC_ADDR": "0.0.0.0:9220",
        # debug addresses required for running services health tests
        "ACTIVITYLOG_DEBUG_ADDR": "0.0.0.0:9197",
        "APP_PROVIDER_DEBUG_ADDR": "0.0.0.0:9165",
@@ -1,5 +1,52 @@
 # Changelog

+## [7.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.0.0) - 2026-05-21
+
+### ❤️ Thanks to all contributors! ❤️
+
+@AlexAndBear, @SAY-5, @ScharfViktor, @Svanvith, @butonic, @dragonchaser, @dschmidt, @fschade, @micbar, @michaelstingl, @rhafer
+
+### 💥 Breaking changes
+
+- Persist space memberships in share manager [[#2760](https://github.com/opencloud-eu/opencloud/pull/2760)]
+- [feature/guest-links] bump reva, add service user config to "sharing" service [[#2735](https://github.com/opencloud-eu/opencloud/pull/2735)]
+
+### 🔒 Security
+
+- fix: disallow thumbnails for tiff and jpeg2000 images [[#2758](https://github.com/opencloud-eu/opencloud/pull/2758)]
+
+### 🐛 Bug Fixes
+
+- fix(notifications): don't re-escape email vars for each recipient [[#2805](https://github.com/opencloud-eu/opencloud/pull/2805)]
+- fix: remove unnecessary error log it the oidc access token verify method is set to none [[#2795](https://github.com/opencloud-eu/opencloud/pull/2795)]
+- fix(debug): drop duplicate service field from probe fallback log [[#2786](https://github.com/opencloud-eu/opencloud/pull/2786)]
+- No registry lookup in cli [[#2755](https://github.com/opencloud-eu/opencloud/pull/2755)]
+- fix(webdav): register chi REPORT method in init to avoid race with settings [[#2712](https://github.com/opencloud-eu/opencloud/pull/2712)]
+- fix: use runner to start activitylog service [[#2748](https://github.com/opencloud-eu/opencloud/pull/2748)]
+- docs(search): fix force-rescan flag name in README [[#2747](https://github.com/opencloud-eu/opencloud/pull/2747)]
+
+### ✅ Tests
+
+- [full-ci] preview-tests. update fixtures for different processors [[#2767](https://github.com/opencloud-eu/opencloud/pull/2767)]
+- test: modify exclude list and add coverage upload [[#2762](https://github.com/opencloud-eu/opencloud/pull/2762)]
+- fix: cleaner debounce timer test [[#2743](https://github.com/opencloud-eu/opencloud/pull/2743)]
+
+### 📚 Documentation
+
+- Update README with LDAP certificate details [[#2759](https://github.com/opencloud-eu/opencloud/pull/2759)]
+
+### 📈 Enhancement
+
+- feat(graph): populate driveItem.webUrl per Libre Graph spec [[#2744](https://github.com/opencloud-eu/opencloud/pull/2744)]
+
+### 📦️ Dependencies
+
+- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 [[#2798](https://github.com/opencloud-eu/opencloud/pull/2798)]
+- build(deps): bump golang.org/x/image from 0.38.0 to 0.40.0 [[#2740](https://github.com/opencloud-eu/opencloud/pull/2740)]
+- build(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 [[#2750](https://github.com/opencloud-eu/opencloud/pull/2750)]
+- build(deps-dev): bump dotenv-expand from 12.0.3 to 13.0.0 in /services/idp [[#2710](https://github.com/opencloud-eu/opencloud/pull/2710)]
+- build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 [[#2739](https://github.com/opencloud-eu/opencloud/pull/2739)]
+
 ## [6.2.0](https://github.com/opencloud-eu/opencloud/releases/tag/v6.2.0) - 2026-05-11

 ### ❤️ Thanks to all contributors! ❤️
@@ -29,7 +29,7 @@ COPY --from=generate /opencloud /opencloud
 WORKDIR /opencloud/opencloud
 RUN make go-generate build ENABLE_VIPS=true

-FROM alpine:3.20
+FROM alpine:3.23

 RUN apk add --no-cache attr ca-certificates curl mailcap tree vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
@@ -0,0 +1,9 @@
+Bugfix: Don't re-escape notification email vars for each recipient
+
+When a notification went to several recipients in one call (e.g. a group
+invite to a space), each recipient past the first got subjects and bodies
+with one extra layer of HTML escaping. escapeStringMap mutated its input
+map, and the recipient loop reused the same map across iterations. It now
+returns a new map.
+
+https://github.com/opencloud-eu/opencloud/issues/2804
@@ -22,7 +22,7 @@ require (
 	github.com/ggwhite/go-masker v1.1.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/render v1.0.3
-	github.com/go-jose/go-jose/v3 v3.0.4
+	github.com/go-jose/go-jose/v3 v3.0.5
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3
 	github.com/go-micro/plugins/v4/client/grpc v1.2.1
@@ -57,15 +57,14 @@ require (
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/nats-io/nats-server/v2 v2.14.0
 	github.com/nats-io/nats.go v1.51.0
-	github.com/oklog/run v1.2.0
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.28.1
+	github.com/onsi/ginkgo/v2 v2.28.3
 	github.com/onsi/gomega v1.40.0
 	github.com/open-policy-agent/opa v1.15.2
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
 	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d
-	github.com/opencloud-eu/reva/v2 v2.44.0
+	github.com/opencloud-eu/reva/v2 v2.46.0
 	github.com/opensearch-project/opensearch-go/v4 v4.6.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
@@ -87,7 +86,7 @@ require (
 	github.com/testcontainers/testcontainers-go/modules/opensearch v0.42.0
 	github.com/theckman/yacspin v0.13.12
 	github.com/thejerf/suture/v4 v4.0.6
-	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/gjson v1.19.0
 	github.com/tidwall/sjson v1.2.5
 	github.com/tus/tusd/v2 v2.9.2
 	github.com/unrolled/secure v1.16.0
@@ -104,13 +103,13 @@ require (
 	go.opentelemetry.io/otel/sdk v1.43.0
 	go.opentelemetry.io/otel/trace v1.43.0
 	golang.org/x/crypto v0.50.0
-	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac
-	golang.org/x/image v0.38.0
-	golang.org/x/net v0.52.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/image v0.40.0
+	golang.org/x/net v0.53.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/term v0.42.0
-	golang.org/x/text v0.36.0
+	golang.org/x/text v0.37.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
@@ -180,7 +179,7 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/crewjam/httperr v0.2.0 // indirect
 	github.com/crewjam/saml v0.4.14 // indirect
-	github.com/cyphar/filepath-securejoin v0.5.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/deckarep/golang-set v1.8.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
@@ -205,8 +204,8 @@ require (
 	github.com/go-acme/lego/v4 v4.4.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.8.0 // indirect
-	github.com/go-git/go-git/v5 v5.18.0 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
+	github.com/go-git/go-git/v5 v5.19.1 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
@@ -239,7 +238,7 @@ require (
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
 	github.com/google/renameio/v2 v2.0.2 // indirect
 	github.com/gookit/goutil v0.7.4 // indirect
 	github.com/gorilla/handlers v1.5.1 // indirect
@@ -259,7 +258,7 @@ require (
 	github.com/juliangruber/go-intersect v1.1.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
 	github.com/kovidgoyal/go-shm v1.0.0 // indirect
@@ -308,6 +307,7 @@ require (
 	github.com/nats-io/nkeys v0.4.15 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
+	github.com/oklog/run v1.2.0 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect
@@ -321,7 +321,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
@@ -346,7 +346,7 @@ require (
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sethvargo/go-diceware v0.5.0 // indirect
 	github.com/sethvargo/go-password v0.3.1 // indirect
-	github.com/shamaton/msgpack/v2 v2.4.0 // indirect
+	github.com/shamaton/msgpack/v2 v2.4.1 // indirect
 	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 // indirect
@@ -377,9 +377,9 @@ require (
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.10 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.10 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.10 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.11 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.11 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.11 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
@@ -389,10 +389,10 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
@@ -267,8 +267,8 @@ github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1n
 github.com/cs3org/go-cs3apis v0.0.0-20260424072047-8d9ef7076ae9 h1:8WtMb7TKKx1AJM3j+uR+H25y4v+b8o8GIQg/2ooCyRo=
 github.com/cs3org/go-cs3apis v0.0.0-20260424072047-8d9ef7076ae9/go.mod h1:DedpcqXl193qF/08Y04IO0PpxyyMu8+GrkD6kWK2MEQ=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
-github.com/cyphar/filepath-securejoin v0.5.1 h1:eYgfMq5yryL4fbWfkLpFFy2ukSELzaJOTaUTuh+oF48=
-github.com/cyphar/filepath-securejoin v0.5.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -382,20 +382,20 @@ github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
-github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
-github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
+github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
@@ -576,8 +576,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/renameio/v2 v2.0.2 h1:qKZs+tfn+arruZZhQ7TKC/ergJunuJicWS6gLDt/dGw=
 github.com/google/renameio/v2 v2.0.2/go.mod h1:OX+G6WHHpHq3NVj7cAOleLOwJfcQ1s3uUJQCrr78SWo=
@@ -722,8 +722,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
-github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/kobergj/gowebdav v0.0.0-20250102091030-aa65266db202 h1:A1xJ2NKgiYFiaHiLl9B5yw/gUBACSs9crDykTS3GuQI=
@@ -935,8 +935,8 @@ github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/ginkgo/v2 v2.28.3 h1:4JvMdwtFU0imd8fHx25OJXoDMRexnf8v5NHKYSTTji4=
+github.com/onsi/ginkgo/v2 v2.28.3/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
@@ -952,8 +952,8 @@ github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9 h1:dIft
 github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9/go.mod h1:JWyDC6H+5oZRdUJUgKuaye+8Ph5hEs6HVzVoPKzWSGI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d h1:JcqGDiyrcaQwVyV861TUyQgO7uEmsjkhfm7aQd84dOw=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.44.0 h1:5SZRIjFzyc4e20dCJQbeZ15Lo7COvrSQ1jgjFVQWmRE=
-github.com/opencloud-eu/reva/v2 v2.44.0/go.mod h1:ZYjHYcg3rLInH81yNnC5GgS4I0JS9KRFVwxJptw1/CM=
+github.com/opencloud-eu/reva/v2 v2.46.0 h1:wYUHIHOsLP9vad/K19/52RRfoooeHUGY4BSeowNrbpY=
+github.com/opencloud-eu/reva/v2 v2.46.0/go.mod h1:fWAzVpZlJQEY/qeIrd9d3U+LpqY9JGsjJ2dc0a1jCEs=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4 h1:l2oB/RctH+t8r7QBj5p8thfEHCM/jF35aAY3WQ3hADI=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -988,8 +988,8 @@ github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJ
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
-github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -1110,8 +1110,8 @@ github.com/sethvargo/go-diceware v0.5.0 h1:exrQ7GpaBo00GqRVM1N8ChXSsi3oS7tjQiIeh
 github.com/sethvargo/go-diceware v0.5.0/go.mod h1:Lg1SyPS7yQO6BBgTN5r4f2MUDkqGfLWsOjHPY0kA8iw=
 github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1PYQZCJU=
 github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs=
-github.com/shamaton/msgpack/v2 v2.4.0 h1:O5Z08MRmbo0lA9o2xnQ4TXx6teJbPqEurqcCOQ8Oi/4=
-github.com/shamaton/msgpack/v2 v2.4.0/go.mod h1:6khjYnkx73f7VQU7wjcFS9DFjs+59naVWJv1TB7qdOI=
+github.com/shamaton/msgpack/v2 v2.4.1 h1:JtJ141QoQ3NqgPDsjq2v9VXlaON8SiQOwEaoNLEK/MQ=
+github.com/shamaton/msgpack/v2 v2.4.1/go.mod h1:6khjYnkx73f7VQU7wjcFS9DFjs+59naVWJv1TB7qdOI=
 github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
 github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
 github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
@@ -1202,8 +1202,8 @@ github.com/theckman/yacspin v0.13.12/go.mod h1:Rd2+oG2LmQi5f3zC3yeZAOl245z8QOvrH
 github.com/thejerf/suture/v4 v4.0.6 h1:QsuCEsCqb03xF9tPAsWAj8QOAJBgQI1c0VqJNaingg8=
 github.com/thejerf/suture/v4 v4.0.6/go.mod h1:gu9Y4dXNUWFrByqRt30Rm9/UZ0wzRSt9AJS6xu/ZGxU=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
@@ -1282,12 +1282,12 @@ github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
-go.etcd.io/etcd/api/v3 v3.6.10 h1:jlwjtELjA8yi2VWpOFH+0w0lGr3K6mVDyn0RDB9aaAY=
-go.etcd.io/etcd/api/v3 v3.6.10/go.mod h1:pdV4VeFmvhdNjB4LWRkC8ReLyRBAxUOze3GarMhE2sk=
-go.etcd.io/etcd/client/pkg/v3 v3.6.10 h1:tBT7podcPhuVbCVkAEzx8bC5I+aqxfLwBN8/As1arrA=
-go.etcd.io/etcd/client/pkg/v3 v3.6.10/go.mod h1:WEy3PpwbbEBVRdh1NVJYsuUe/8eyI21PNJRazeD8z/Y=
-go.etcd.io/etcd/client/v3 v3.6.10 h1:J598zJ+C/ZPvImypmq5waj84+bovePrlZERHklf34y0=
-go.etcd.io/etcd/client/v3 v3.6.10/go.mod h1:iHhUDUcEwaKs1YFq3MgmI9U4zhTVasp/vgdVbFf1RS8=
+go.etcd.io/etcd/api/v3 v3.6.11 h1:XFGTgrJ8nak3kB4NgMG8t7NT+lEeuuvKQAqUHKVgkWQ=
+go.etcd.io/etcd/api/v3 v3.6.11/go.mod h1:HYfTh0jyh+uFgp6gMbxJteIDYY97yMuYz85Rnw6Gy9o=
+go.etcd.io/etcd/client/pkg/v3 v3.6.11 h1:e41mp315Yn3QMGPmEzCyLsMINgJXTY/dX8kM++1csxU=
+go.etcd.io/etcd/client/pkg/v3 v3.6.11/go.mod h1:DysuMe/inqRyC/1tjRR6hReH/VV9Lufs27YKSKBWWJg=
+go.etcd.io/etcd/client/v3 v3.6.11 h1:LAByD96VmmeuairkvdAcE0RZnrmGz/q3ceeWePo9bwc=
+go.etcd.io/etcd/client/v3 v3.6.11/go.mod h1:vOTDMCo+fGPEClJqcFEFSqZ+8e7WKV7AyqJjX//HR2w=
 go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -1374,12 +1374,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac h1:l5+whBCLH3iH2ZNHYLbAe58bo7yrN4mVcnkHDYz5vvs=
-golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac/go.mod h1:hH+7mtFmImwwcMvScyxUhjuVHR3HGaDPMn9rMSUUbxo=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
+golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
+golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1401,8 +1401,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1453,8 +1453,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1584,8 +1584,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1646,8 +1646,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210112230658-8b4aab62c064/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
 golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1,4 +1,4 @@
-FROM golang:alpine3.22 AS build
+FROM golang:alpine3.23 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
@@ -14,7 +14,7 @@ RUN --mount=type=bind,target=/build,rw \
    GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
    make -C opencloud/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist

-FROM alpine:3.22
+FROM alpine:3.23
 ARG VERSION
 ARG REVISION
 ARG TARGETOS
@@ -85,12 +85,16 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 		return configlog.ReturnError(errors.New("cleanup is only implemented for the jsoncs3 share manager"))
 	}

+	l := logger()
+
+	zerolog.SetGlobalLevel(zerolog.InfoLevel)
+
 	rcfg := revaShareConfig(cfg.Sharing)
 	f, ok := registry.NewFuncs[driver]
 	if !ok {
 		return configlog.ReturnError(errors.New("Unknown share manager type '" + driver + "'"))
 	}
-	mgr, err := f(rcfg[driver].(map[string]any))
+	mgr, err := f(rcfg[driver].(map[string]any), l)
 	if err != nil {
 		return configlog.ReturnError(err)
 	}
@@ -115,10 +119,6 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 	if err != nil {
 		return configlog.ReturnError(err)
 	}
-
-	l := logger()
-
-	zerolog.SetGlobalLevel(zerolog.InfoLevel)
 	serviceUserCtx = l.WithContext(serviceUserCtx)

 	mgr.(*jsoncs3.Manager).CleanupStaleShares(serviceUserCtx)
@@ -272,6 +272,9 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 		Activitylog: Activitylog{
 			ServiceAccount: serviceAccount,
 		},
+		Sharing: Sharing{
+			ServiceAccount: serviceAccount,
+		},
 	}

 	if insecure {
@@ -204,7 +204,8 @@ type SettingsService struct {

 // Sharing is the configuration for the sharing service
 type Sharing struct {
-	Events Events
+	Events         Events
+	ServiceAccount ServiceAccount `yaml:"service_account"`
 }

 // StorageRegistry is the configuration for the storage registry
@@ -18,11 +18,10 @@ import (
 	graphMiddleware "github.com/opencloud-eu/opencloud/services/graph/pkg/middleware"
 )

-var handleProbe = func(mux *http.ServeMux, pattern string, h http.Handler, name string, logger log.Logger) {
+var handleProbe = func(mux *http.ServeMux, pattern string, h http.Handler, logger log.Logger) {
 	if h == nil {
 		h = handlers.NewCheckHandler(handlers.NewCheckHandlerConfiguration())
 		logger.Info().
-			Str("service", name).
 			Str("endpoint", pattern).
 			Msg("no probe provided, reverting to default (OK)")
 	}
@@ -30,8 +29,6 @@ var handleProbe = func(mux *http.ServeMux, pattern string, h http.Handler, name
 	mux.Handle(pattern, h)
 }

-//var probeHandler = func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) }
-
 // NewService initializes a new debug service.
 func NewService(opts ...Option) *http.Server {
 	dopts := newOptions(opts...)
@@ -45,8 +42,8 @@ func NewService(opts ...Option) *http.Server {
 		promhttp.Handler(),
 	))

-	handleProbe(mux, "/healthz", dopts.Health, dopts.Name, dopts.Logger) // healthiness check
-	handleProbe(mux, "/readyz", dopts.Ready, dopts.Name, dopts.Logger)   // readiness check
+	handleProbe(mux, "/healthz", dopts.Health, dopts.Logger) // healthiness check
+	handleProbe(mux, "/readyz", dopts.Ready, dopts.Logger)   // readiness check

 	if dopts.ConfigDump != nil {
 		mux.Handle("/config", dopts.ConfigDump)
@@ -34,7 +34,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "6.2.0+dev"
+	LatestTag = "7.0.0+dev"

 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions
@@ -627,13 +627,13 @@ type Bundle struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Id          string      `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" yaml:"id"`                                                      // @gotags: yaml:"id"
-	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty" yaml:"name"`                                                  // @gotags: yaml:"name"
-	Type        Bundle_Type `protobuf:"varint,3,opt,name=type,proto3,enum=opencloud.messages.settings.v0.Bundle_Type" json:"type,omitempty" yaml:"type"` // @gotags: yaml:"type"
-	Extension   string      `protobuf:"bytes,4,opt,name=extension,proto3" json:"extension,omitempty" yaml:"extension"`                                        // @gotags: yaml:"extension"
-	DisplayName string      `protobuf:"bytes,5,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty" yaml:"display_name"`                 // @gotags: yaml:"display_name"
-	Settings    []*Setting  `protobuf:"bytes,6,rep,name=settings,proto3" json:"settings,omitempty" yaml:"settings"`                                          // @gotags: yaml:"settings"
-	Resource    *Resource   `protobuf:"bytes,7,opt,name=resource,proto3" json:"resource,omitempty" yaml:"resource"`                                          // @gotags: yaml:"resource"
+	Id          string      `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`                                                      // @gotags: yaml:"id"
+	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`                                                  // @gotags: yaml:"name"
+	Type        Bundle_Type `protobuf:"varint,3,opt,name=type,proto3,enum=opencloud.messages.settings.v0.Bundle_Type" json:"type,omitempty"` // @gotags: yaml:"type"
+	Extension   string      `protobuf:"bytes,4,opt,name=extension,proto3" json:"extension,omitempty"`                                        // @gotags: yaml:"extension"
+	DisplayName string      `protobuf:"bytes,5,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`                 // @gotags: yaml:"display_name"
+	Settings    []*Setting  `protobuf:"bytes,6,rep,name=settings,proto3" json:"settings,omitempty"`                                          // @gotags: yaml:"settings"
+	Resource    *Resource   `protobuf:"bytes,7,opt,name=resource,proto3" json:"resource,omitempty"`                                          // @gotags: yaml:"resource"
 }

 func (x *Bundle) Reset() {
@@ -722,10 +722,10 @@ type Setting struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Id          string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" yaml:"id"`                                      // @gotags: yaml:"id"
-	Name        string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty" yaml:"name"`                                  // @gotags: yaml:"name"
-	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty" yaml:"display_name"` // @gotags: yaml:"display_name"
-	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty" yaml:"description"`                    // @gotags: yaml:"description"
+	Id          string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`                                      // @gotags: yaml:"id"
+	Name        string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`                                  // @gotags: yaml:"name"
+	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` // @gotags: yaml:"display_name"
+	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`                    // @gotags: yaml:"description"
 	// Types that are assignable to Value:
 	//
 	//	*Setting_IntValue
@@ -736,7 +736,7 @@ type Setting struct {
 	//	*Setting_PermissionValue
 	//	*Setting_MultiChoiceCollectionValue
 	Value    isSetting_Value `protobuf_oneof:"value"`
-	Resource *Resource       `protobuf:"bytes,11,opt,name=resource,proto3" json:"resource,omitempty" yaml:"resource"` // @gotags: yaml:"resource"
+	Resource *Resource       `protobuf:"bytes,11,opt,name=resource,proto3" json:"resource,omitempty"` // @gotags: yaml:"resource"
 }

 func (x *Setting) Reset() {
@@ -867,31 +867,31 @@ type isSetting_Value interface {
 }

 type Setting_IntValue struct {
-	IntValue *Int `protobuf:"bytes,5,opt,name=int_value,json=intValue,proto3,oneof" yaml:"int_value"` // @gotags: yaml:"int_value"
+	IntValue *Int `protobuf:"bytes,5,opt,name=int_value,json=intValue,proto3,oneof"` // @gotags: yaml:"int_value"
 }

 type Setting_StringValue struct {
-	StringValue *String `protobuf:"bytes,6,opt,name=string_value,json=stringValue,proto3,oneof" yaml:"string_value"` // @gotags: yaml:"string_value"
+	StringValue *String `protobuf:"bytes,6,opt,name=string_value,json=stringValue,proto3,oneof"` // @gotags: yaml:"string_value"
 }

 type Setting_BoolValue struct {
-	BoolValue *Bool `protobuf:"bytes,7,opt,name=bool_value,json=boolValue,proto3,oneof" yaml:"bool_value"` // @gotags: yaml:"bool_value"
+	BoolValue *Bool `protobuf:"bytes,7,opt,name=bool_value,json=boolValue,proto3,oneof"` // @gotags: yaml:"bool_value"
 }

 type Setting_SingleChoiceValue struct {
-	SingleChoiceValue *SingleChoiceList `protobuf:"bytes,8,opt,name=single_choice_value,json=singleChoiceValue,proto3,oneof" yaml:"single_choice_value"` // @gotags: yaml:"single_choice_value"
+	SingleChoiceValue *SingleChoiceList `protobuf:"bytes,8,opt,name=single_choice_value,json=singleChoiceValue,proto3,oneof"` // @gotags: yaml:"single_choice_value"
 }

 type Setting_MultiChoiceValue struct {
-	MultiChoiceValue *MultiChoiceList `protobuf:"bytes,9,opt,name=multi_choice_value,json=multiChoiceValue,proto3,oneof" yaml:"multi_choice_value"` // @gotags: yaml:"multi_choice_value"
+	MultiChoiceValue *MultiChoiceList `protobuf:"bytes,9,opt,name=multi_choice_value,json=multiChoiceValue,proto3,oneof"` // @gotags: yaml:"multi_choice_value"
 }

 type Setting_PermissionValue struct {
-	PermissionValue *Permission `protobuf:"bytes,10,opt,name=permission_value,json=permissionValue,proto3,oneof" yaml:"permission_value"` // @gotags: yaml:"permission_value"
+	PermissionValue *Permission `protobuf:"bytes,10,opt,name=permission_value,json=permissionValue,proto3,oneof"` // @gotags: yaml:"permission_value"
 }

 type Setting_MultiChoiceCollectionValue struct {
-	MultiChoiceCollectionValue *MultiChoiceCollection `protobuf:"bytes,12,opt,name=multi_choice_collection_value,json=multiChoiceCollectionValue,proto3,oneof" yaml:"multi_choice_collection_value"` // @gotags: yaml:"multi_choice_collection_value"
+	MultiChoiceCollectionValue *MultiChoiceCollection `protobuf:"bytes,12,opt,name=multi_choice_collection_value,json=multiChoiceCollectionValue,proto3,oneof"` // @gotags: yaml:"multi_choice_collection_value"
 }

 func (*Setting_IntValue) isSetting_Value() {}
@@ -913,11 +913,11 @@ type Int struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Default     int64  `protobuf:"varint,1,opt,name=default,proto3" json:"default,omitempty" yaml:"default"`        // @gotags: yaml:"default"
-	Min         int64  `protobuf:"varint,2,opt,name=min,proto3" json:"min,omitempty" yaml:"min"`                // @gotags: yaml:"min"
-	Max         int64  `protobuf:"varint,3,opt,name=max,proto3" json:"max,omitempty" yaml:"max"`                // @gotags: yaml:"max"
-	Step        int64  `protobuf:"varint,4,opt,name=step,proto3" json:"step,omitempty" yaml:"step"`              // @gotags: yaml:"step"
-	Placeholder string `protobuf:"bytes,5,opt,name=placeholder,proto3" json:"placeholder,omitempty" yaml:"placeholder"` // @gotags: yaml:"placeholder"
+	Default     int64  `protobuf:"varint,1,opt,name=default,proto3" json:"default,omitempty"`        // @gotags: yaml:"default"
+	Min         int64  `protobuf:"varint,2,opt,name=min,proto3" json:"min,omitempty"`                // @gotags: yaml:"min"
+	Max         int64  `protobuf:"varint,3,opt,name=max,proto3" json:"max,omitempty"`                // @gotags: yaml:"max"
+	Step        int64  `protobuf:"varint,4,opt,name=step,proto3" json:"step,omitempty"`              // @gotags: yaml:"step"
+	Placeholder string `protobuf:"bytes,5,opt,name=placeholder,proto3" json:"placeholder,omitempty"` // @gotags: yaml:"placeholder"
 }

 func (x *Int) Reset() {
@@ -992,11 +992,11 @@ type String struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Default     string `protobuf:"bytes,1,opt,name=default,proto3" json:"default,omitempty" yaml:"default"`                       // @gotags: yaml:"default"
-	Required    bool   `protobuf:"varint,2,opt,name=required,proto3" json:"required,omitempty" yaml:"required"`                    // @gotags: yaml:"required"
-	MinLength   int32  `protobuf:"varint,3,opt,name=min_length,json=minLength,proto3" json:"min_length,omitempty" yaml:"min_length"` // @gotags: yaml:"min_length"
-	MaxLength   int32  `protobuf:"varint,4,opt,name=max_length,json=maxLength,proto3" json:"max_length,omitempty" yaml:"max_length"` // @gotags: yaml:"max_length"
-	Placeholder string `protobuf:"bytes,5,opt,name=placeholder,proto3" json:"placeholder,omitempty" yaml:"placeholder"`               // @gotags: yaml:"placeholder"
+	Default     string `protobuf:"bytes,1,opt,name=default,proto3" json:"default,omitempty"`                       // @gotags: yaml:"default"
+	Required    bool   `protobuf:"varint,2,opt,name=required,proto3" json:"required,omitempty"`                    // @gotags: yaml:"required"
+	MinLength   int32  `protobuf:"varint,3,opt,name=min_length,json=minLength,proto3" json:"min_length,omitempty"` // @gotags: yaml:"min_length"
+	MaxLength   int32  `protobuf:"varint,4,opt,name=max_length,json=maxLength,proto3" json:"max_length,omitempty"` // @gotags: yaml:"max_length"
+	Placeholder string `protobuf:"bytes,5,opt,name=placeholder,proto3" json:"placeholder,omitempty"`               // @gotags: yaml:"placeholder"
 }

 func (x *String) Reset() {
@@ -1071,8 +1071,8 @@ type Bool struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Default bool   `protobuf:"varint,1,opt,name=default,proto3" json:"default,omitempty" yaml:"default"` // @gotags: yaml:"default"
-	Label   string `protobuf:"bytes,2,opt,name=label,proto3" json:"label,omitempty" yaml:"label"`      // @gotags: yaml:"label"
+	Default bool   `protobuf:"varint,1,opt,name=default,proto3" json:"default,omitempty"` // @gotags: yaml:"default"
+	Label   string `protobuf:"bytes,2,opt,name=label,proto3" json:"label,omitempty"`      // @gotags: yaml:"label"
 }

 func (x *Bool) Reset() {
@@ -1126,7 +1126,7 @@ type SingleChoiceList struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Options []*ListOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty" yaml:"options"` // @gotags: yaml:"options"
+	Options []*ListOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty"` // @gotags: yaml:"options"
 }

 func (x *SingleChoiceList) Reset() {
@@ -1173,7 +1173,7 @@ type MultiChoiceList struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Options []*ListOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty" yaml:"options"` // @gotags: yaml:"options"
+	Options []*ListOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty"` // @gotags: yaml:"options"
 }

 func (x *MultiChoiceList) Reset() {
@@ -1220,9 +1220,9 @@ type ListOption struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Value        *ListOptionValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty" yaml:"value"`                                   // @gotags: yaml:"value"
-	Default      bool             `protobuf:"varint,2,opt,name=default,proto3" json:"default,omitempty" yaml:"default"`                              // @gotags: yaml:"default"
-	DisplayValue string           `protobuf:"bytes,3,opt,name=display_value,json=displayValue,proto3" json:"display_value,omitempty" yaml:"display_value"` // @gotags: yaml:"display_value"
+	Value        *ListOptionValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`                                   // @gotags: yaml:"value"
+	Default      bool             `protobuf:"varint,2,opt,name=default,proto3" json:"default,omitempty"`                              // @gotags: yaml:"default"
+	DisplayValue string           `protobuf:"bytes,3,opt,name=display_value,json=displayValue,proto3" json:"display_value,omitempty"` // @gotags: yaml:"display_value"
 }

 func (x *ListOption) Reset() {
@@ -1283,7 +1283,7 @@ type MultiChoiceCollection struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Options []*MultiChoiceCollectionOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty" yaml:"options"` // @gotags: yaml:"options"
+	Options []*MultiChoiceCollectionOption `protobuf:"bytes,1,rep,name=options,proto3" json:"options,omitempty"` // @gotags: yaml:"options"
 }

 func (x *MultiChoiceCollection) Reset() {
@@ -1330,10 +1330,10 @@ type MultiChoiceCollectionOption struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Value        *MultiChoiceCollectionOptionValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty" yaml:"value"`                                   // @gotags: yaml:"value"
-	Key          string                            `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty" yaml:"key"`                                       // @gotags: yaml:"key"
-	Attribute    string                            `protobuf:"bytes,3,opt,name=attribute,proto3" json:"attribute,omitempty" yaml:"attribute"`                           // @gotags: yaml:"attribute"
-	DisplayValue string                            `protobuf:"bytes,4,opt,name=display_value,json=displayValue,proto3" json:"display_value,omitempty" yaml:"display_value"` // @gotags: yaml:"display_value"
+	Value        *MultiChoiceCollectionOptionValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`                                   // @gotags: yaml:"value"
+	Key          string                            `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`                                       // @gotags: yaml:"key"
+	Attribute    string                            `protobuf:"bytes,3,opt,name=attribute,proto3" json:"attribute,omitempty"`                           // @gotags: yaml:"attribute"
+	DisplayValue string                            `protobuf:"bytes,4,opt,name=display_value,json=displayValue,proto3" json:"display_value,omitempty"` // @gotags: yaml:"display_value"
 }

 func (x *MultiChoiceCollectionOption) Reset() {
@@ -1474,15 +1474,15 @@ type isMultiChoiceCollectionOptionValue_Option interface {
 }

 type MultiChoiceCollectionOptionValue_IntValue struct {
-	IntValue *Int `protobuf:"bytes,1,opt,name=int_value,json=intValue,proto3,oneof" yaml:"int_value"` // @gotags: yaml:"int_value"
+	IntValue *Int `protobuf:"bytes,1,opt,name=int_value,json=intValue,proto3,oneof"` // @gotags: yaml:"int_value"
 }

 type MultiChoiceCollectionOptionValue_StringValue struct {
-	StringValue *String `protobuf:"bytes,2,opt,name=string_value,json=stringValue,proto3,oneof" yaml:"string_value"` // @gotags: yaml:"string_value"
+	StringValue *String `protobuf:"bytes,2,opt,name=string_value,json=stringValue,proto3,oneof"` // @gotags: yaml:"string_value"
 }

 type MultiChoiceCollectionOptionValue_BoolValue struct {
-	BoolValue *Bool `protobuf:"bytes,3,opt,name=bool_value,json=boolValue,proto3,oneof" yaml:"bool_value"` // @gotags: yaml:"bool_value"
+	BoolValue *Bool `protobuf:"bytes,3,opt,name=bool_value,json=boolValue,proto3,oneof"` // @gotags: yaml:"bool_value"
 }

 func (*MultiChoiceCollectionOptionValue_IntValue) isMultiChoiceCollectionOptionValue_Option() {}
@@ -1496,8 +1496,8 @@ type Permission struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Operation  Permission_Operation  `protobuf:"varint,1,opt,name=operation,proto3,enum=opencloud.messages.settings.v0.Permission_Operation" json:"operation,omitempty" yaml:"operation"`    // @gotags: yaml:"operation"
-	Constraint Permission_Constraint `protobuf:"varint,2,opt,name=constraint,proto3,enum=opencloud.messages.settings.v0.Permission_Constraint" json:"constraint,omitempty" yaml:"constraint"` // @gotags: yaml:"constraint"
+	Operation  Permission_Operation  `protobuf:"varint,1,opt,name=operation,proto3,enum=opencloud.messages.settings.v0.Permission_Operation" json:"operation,omitempty"`    // @gotags: yaml:"operation"
+	Constraint Permission_Constraint `protobuf:"varint,2,opt,name=constraint,proto3,enum=opencloud.messages.settings.v0.Permission_Constraint" json:"constraint,omitempty"` // @gotags: yaml:"constraint"
 }

 func (x *Permission) Reset() {
@@ -1552,12 +1552,12 @@ type Value struct {
 	unknownFields protoimpl.UnknownFields

 	// id is the id of the Value. It is generated on saving it.
-	Id       string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" yaml:"id"`                             // @gotags: yaml:"id"
-	BundleId string `protobuf:"bytes,2,opt,name=bundle_id,json=bundleId,proto3" json:"bundle_id,omitempty" yaml:"bundle_id"` // @gotags: yaml:"bundle_id"
+	Id       string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`                             // @gotags: yaml:"id"
+	BundleId string `protobuf:"bytes,2,opt,name=bundle_id,json=bundleId,proto3" json:"bundle_id,omitempty"` // @gotags: yaml:"bundle_id"
 	// setting_id is the id of the setting from within its bundle.
-	SettingId   string    `protobuf:"bytes,3,opt,name=setting_id,json=settingId,proto3" json:"setting_id,omitempty" yaml:"setting_id"`       // @gotags: yaml:"setting_id"
-	AccountUuid string    `protobuf:"bytes,4,opt,name=account_uuid,json=accountUuid,proto3" json:"account_uuid,omitempty" yaml:"account_uuid"` // @gotags: yaml:"account_uuid"
-	Resource    *Resource `protobuf:"bytes,5,opt,name=resource,proto3" json:"resource,omitempty" yaml:"resource"`                          // @gotags: yaml:"resource"
+	SettingId   string    `protobuf:"bytes,3,opt,name=setting_id,json=settingId,proto3" json:"setting_id,omitempty"`       // @gotags: yaml:"setting_id"
+	AccountUuid string    `protobuf:"bytes,4,opt,name=account_uuid,json=accountUuid,proto3" json:"account_uuid,omitempty"` // @gotags: yaml:"account_uuid"
+	Resource    *Resource `protobuf:"bytes,5,opt,name=resource,proto3" json:"resource,omitempty"`                          // @gotags: yaml:"resource"
 	// Types that are assignable to Value:
 	//
 	//	*Value_BoolValue
@@ -1682,23 +1682,23 @@ type isValue_Value interface {
 }

 type Value_BoolValue struct {
-	BoolValue bool `protobuf:"varint,6,opt,name=bool_value,json=boolValue,proto3,oneof" yaml:"bool_value"` // @gotags: yaml:"bool_value"
+	BoolValue bool `protobuf:"varint,6,opt,name=bool_value,json=boolValue,proto3,oneof"` // @gotags: yaml:"bool_value"
 }

 type Value_IntValue struct {
-	IntValue int64 `protobuf:"varint,7,opt,name=int_value,json=intValue,proto3,oneof" yaml:"int_value"` // @gotags: yaml:"int_value"
+	IntValue int64 `protobuf:"varint,7,opt,name=int_value,json=intValue,proto3,oneof"` // @gotags: yaml:"int_value"
 }

 type Value_StringValue struct {
-	StringValue string `protobuf:"bytes,8,opt,name=string_value,json=stringValue,proto3,oneof" yaml:"string_value"` // @gotags: yaml:"string_value"
+	StringValue string `protobuf:"bytes,8,opt,name=string_value,json=stringValue,proto3,oneof"` // @gotags: yaml:"string_value"
 }

 type Value_ListValue struct {
-	ListValue *ListValue `protobuf:"bytes,9,opt,name=list_value,json=listValue,proto3,oneof" yaml:"list_value"` // @gotags: yaml:"list_value"
+	ListValue *ListValue `protobuf:"bytes,9,opt,name=list_value,json=listValue,proto3,oneof"` // @gotags: yaml:"list_value"
 }

 type Value_CollectionValue struct {
-	CollectionValue *CollectionValue `protobuf:"bytes,10,opt,name=collection_value,json=collectionValue,proto3,oneof" yaml:"collection_value"` // @gotags: yaml:"collection_value"
+	CollectionValue *CollectionValue `protobuf:"bytes,10,opt,name=collection_value,json=collectionValue,proto3,oneof"` // @gotags: yaml:"collection_value"
 }

 func (*Value_BoolValue) isValue_Value() {}
@@ -1716,7 +1716,7 @@ type ListValue struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Values []*ListOptionValue `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty" yaml:"values"` // @gotags: yaml:"values"
+	Values []*ListOptionValue `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"` // @gotags: yaml:"values"
 }

 func (x *ListValue) Reset() {
@@ -1836,15 +1836,15 @@ type isListOptionValue_Option interface {
 }

 type ListOptionValue_StringValue struct {
-	StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof" yaml:"string_value"` // @gotags: yaml:"string_value"
+	StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof"` // @gotags: yaml:"string_value"
 }

 type ListOptionValue_IntValue struct {
-	IntValue int64 `protobuf:"varint,2,opt,name=int_value,json=intValue,proto3,oneof" yaml:"int_value"` // @gotags: yaml:"int_value"
+	IntValue int64 `protobuf:"varint,2,opt,name=int_value,json=intValue,proto3,oneof"` // @gotags: yaml:"int_value"
 }

 type ListOptionValue_BoolValue struct {
-	BoolValue bool `protobuf:"varint,3,opt,name=bool_value,json=boolValue,proto3,oneof" yaml:"bool_value"` // @gotags: yaml:"bool_value"
+	BoolValue bool `protobuf:"varint,3,opt,name=bool_value,json=boolValue,proto3,oneof"` // @gotags: yaml:"bool_value"
 }

 func (*ListOptionValue_StringValue) isListOptionValue_Option() {}
@@ -1858,7 +1858,7 @@ type CollectionValue struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Values []*CollectionOption `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty" yaml:"values"` // @gotags: yaml:"values"
+	Values []*CollectionOption `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"` // @gotags: yaml:"values"
 }

 func (x *CollectionValue) Reset() {
@@ -1906,7 +1906,7 @@ type CollectionOption struct {
 	unknownFields protoimpl.UnknownFields

 	// required
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty" yaml:"key"` // @gotags: yaml:"key"
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"` // @gotags: yaml:"key"
 	// Types that are assignable to Option:
 	//
 	//	*CollectionOption_IntValue
@@ -1987,15 +1987,15 @@ type isCollectionOption_Option interface {
 }

 type CollectionOption_IntValue struct {
-	IntValue int64 `protobuf:"varint,2,opt,name=int_value,json=intValue,proto3,oneof" yaml:"int_value"` // @gotags: yaml:"int_value"
+	IntValue int64 `protobuf:"varint,2,opt,name=int_value,json=intValue,proto3,oneof"` // @gotags: yaml:"int_value"
 }

 type CollectionOption_StringValue struct {
-	StringValue string `protobuf:"bytes,3,opt,name=string_value,json=stringValue,proto3,oneof" yaml:"string_value"` // @gotags: yaml:"string_value"
+	StringValue string `protobuf:"bytes,3,opt,name=string_value,json=stringValue,proto3,oneof"` // @gotags: yaml:"string_value"
 }

 type CollectionOption_BoolValue struct {
-	BoolValue bool `protobuf:"varint,4,opt,name=bool_value,json=boolValue,proto3,oneof" yaml:"bool_value"` // @gotags: yaml:"bool_value"
+	BoolValue bool `protobuf:"varint,4,opt,name=bool_value,json=boolValue,proto3,oneof"` // @gotags: yaml:"bool_value"
 }

 func (*CollectionOption_IntValue) isCollectionOption_Option() {}
@@ -1,673 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        (unknown)
-// source: opencloud/messages/store/v0/store.proto
-
-package v0
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type Field struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// type of value e.g string, int, int64, bool, float64
-	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	// the actual value
-	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-}
-
-func (x *Field) Reset() {
-	*x = Field{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Field) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Field) ProtoMessage() {}
-
-func (x *Field) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Field.ProtoReflect.Descriptor instead.
-func (*Field) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *Field) GetType() string {
-	if x != nil {
-		return x.Type
-	}
-	return ""
-}
-
-func (x *Field) GetValue() string {
-	if x != nil {
-		return x.Value
-	}
-	return ""
-}
-
-type Record struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// key of the recorda
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	// value in the record
-	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-	// time.Duration (signed int64 nanoseconds)
-	Expiry int64 `protobuf:"varint,3,opt,name=expiry,proto3" json:"expiry,omitempty"`
-	// the associated metadata
-	Metadata map[string]*Field `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-}
-
-func (x *Record) Reset() {
-	*x = Record{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Record) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Record) ProtoMessage() {}
-
-func (x *Record) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Record.ProtoReflect.Descriptor instead.
-func (*Record) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *Record) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *Record) GetValue() []byte {
-	if x != nil {
-		return x.Value
-	}
-	return nil
-}
-
-func (x *Record) GetExpiry() int64 {
-	if x != nil {
-		return x.Expiry
-	}
-	return 0
-}
-
-func (x *Record) GetMetadata() map[string]*Field {
-	if x != nil {
-		return x.Metadata
-	}
-	return nil
-}
-
-type ReadOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Database string            `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
-	Table    string            `protobuf:"bytes,2,opt,name=table,proto3" json:"table,omitempty"`
-	Prefix   bool              `protobuf:"varint,3,opt,name=prefix,proto3" json:"prefix,omitempty"`
-	Suffix   bool              `protobuf:"varint,4,opt,name=suffix,proto3" json:"suffix,omitempty"`
-	Limit    uint64            `protobuf:"varint,5,opt,name=limit,proto3" json:"limit,omitempty"`
-	Offset   uint64            `protobuf:"varint,6,opt,name=offset,proto3" json:"offset,omitempty"`
-	Where    map[string]*Field `protobuf:"bytes,7,rep,name=where,proto3" json:"where,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-}
-
-func (x *ReadOptions) Reset() {
-	*x = ReadOptions{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ReadOptions) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ReadOptions) ProtoMessage() {}
-
-func (x *ReadOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ReadOptions.ProtoReflect.Descriptor instead.
-func (*ReadOptions) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *ReadOptions) GetDatabase() string {
-	if x != nil {
-		return x.Database
-	}
-	return ""
-}
-
-func (x *ReadOptions) GetTable() string {
-	if x != nil {
-		return x.Table
-	}
-	return ""
-}
-
-func (x *ReadOptions) GetPrefix() bool {
-	if x != nil {
-		return x.Prefix
-	}
-	return false
-}
-
-func (x *ReadOptions) GetSuffix() bool {
-	if x != nil {
-		return x.Suffix
-	}
-	return false
-}
-
-func (x *ReadOptions) GetLimit() uint64 {
-	if x != nil {
-		return x.Limit
-	}
-	return 0
-}
-
-func (x *ReadOptions) GetOffset() uint64 {
-	if x != nil {
-		return x.Offset
-	}
-	return 0
-}
-
-func (x *ReadOptions) GetWhere() map[string]*Field {
-	if x != nil {
-		return x.Where
-	}
-	return nil
-}
-
-type WriteOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Database string `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
-	Table    string `protobuf:"bytes,2,opt,name=table,proto3" json:"table,omitempty"`
-	// time.Time
-	Expiry int64 `protobuf:"varint,3,opt,name=expiry,proto3" json:"expiry,omitempty"`
-	// time.Duration
-	Ttl int64 `protobuf:"varint,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
-}
-
-func (x *WriteOptions) Reset() {
-	*x = WriteOptions{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *WriteOptions) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*WriteOptions) ProtoMessage() {}
-
-func (x *WriteOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use WriteOptions.ProtoReflect.Descriptor instead.
-func (*WriteOptions) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *WriteOptions) GetDatabase() string {
-	if x != nil {
-		return x.Database
-	}
-	return ""
-}
-
-func (x *WriteOptions) GetTable() string {
-	if x != nil {
-		return x.Table
-	}
-	return ""
-}
-
-func (x *WriteOptions) GetExpiry() int64 {
-	if x != nil {
-		return x.Expiry
-	}
-	return 0
-}
-
-func (x *WriteOptions) GetTtl() int64 {
-	if x != nil {
-		return x.Ttl
-	}
-	return 0
-}
-
-type DeleteOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Database string `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
-	Table    string `protobuf:"bytes,2,opt,name=table,proto3" json:"table,omitempty"`
-}
-
-func (x *DeleteOptions) Reset() {
-	*x = DeleteOptions{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DeleteOptions) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteOptions) ProtoMessage() {}
-
-func (x *DeleteOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteOptions.ProtoReflect.Descriptor instead.
-func (*DeleteOptions) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *DeleteOptions) GetDatabase() string {
-	if x != nil {
-		return x.Database
-	}
-	return ""
-}
-
-func (x *DeleteOptions) GetTable() string {
-	if x != nil {
-		return x.Table
-	}
-	return ""
-}
-
-type ListOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Database string `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
-	Table    string `protobuf:"bytes,2,opt,name=table,proto3" json:"table,omitempty"`
-	Prefix   string `protobuf:"bytes,3,opt,name=prefix,proto3" json:"prefix,omitempty"`
-	Suffix   string `protobuf:"bytes,4,opt,name=suffix,proto3" json:"suffix,omitempty"`
-	Limit    uint64 `protobuf:"varint,5,opt,name=limit,proto3" json:"limit,omitempty"`
-	Offset   uint64 `protobuf:"varint,6,opt,name=offset,proto3" json:"offset,omitempty"`
-}
-
-func (x *ListOptions) Reset() {
-	*x = ListOptions{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListOptions) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListOptions) ProtoMessage() {}
-
-func (x *ListOptions) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_store_v0_store_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListOptions.ProtoReflect.Descriptor instead.
-func (*ListOptions) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_store_v0_store_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *ListOptions) GetDatabase() string {
-	if x != nil {
-		return x.Database
-	}
-	return ""
-}
-
-func (x *ListOptions) GetTable() string {
-	if x != nil {
-		return x.Table
-	}
-	return ""
-}
-
-func (x *ListOptions) GetPrefix() string {
-	if x != nil {
-		return x.Prefix
-	}
-	return ""
-}
-
-func (x *ListOptions) GetSuffix() string {
-	if x != nil {
-		return x.Suffix
-	}
-	return ""
-}
-
-func (x *ListOptions) GetLimit() uint64 {
-	if x != nil {
-		return x.Limit
-	}
-	return 0
-}
-
-func (x *ListOptions) GetOffset() uint64 {
-	if x != nil {
-		return x.Offset
-	}
-	return 0
-}
-
-var File_opencloud_messages_store_v0_store_proto protoreflect.FileDescriptor
-
-var file_opencloud_messages_store_v0_store_proto_rawDesc = []byte{
-	0x0a, 0x27, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x6d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x30, 0x2f, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x6f, 0x70, 0x65, 0x6e, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x22, 0x31, 0x0a, 0x05, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xf8, 0x01, 0x0a, 0x06, 0x52, 0x65,
-	0x63, 0x6f, 0x72, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x16, 0x0a, 0x06,
-	0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x79, 0x12, 0x4d, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f,
-	0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x2e, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x1a, 0x5f, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x38, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x76, 0x30, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x22, 0xc6, 0x02, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x4f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
-	0x12, 0x14, 0x0a, 0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x16,
-	0x0a, 0x06, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06,
-	0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x0a, 0x06,
-	0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x6f, 0x66,
-	0x66, 0x73, 0x65, 0x74, 0x12, 0x49, 0x0a, 0x05, 0x77, 0x68, 0x65, 0x72, 0x65, 0x18, 0x07, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
-	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76,
-	0x30, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x57, 0x68,
-	0x65, 0x72, 0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x77, 0x68, 0x65, 0x72, 0x65, 0x1a,
-	0x5c, 0x0a, 0x0a, 0x57, 0x68, 0x65, 0x72, 0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
-	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x38, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22,
-	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x46, 0x69, 0x65,
-	0x6c, 0x64, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x6a, 0x0a,
-	0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1a, 0x0a,
-	0x08, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x61, 0x62,
-	0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x12,
-	0x16, 0x0a, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52,
-	0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x74, 0x6c, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x74, 0x74, 0x6c, 0x22, 0x41, 0x0a, 0x0d, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x64, 0x61,
-	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x61,
-	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x22, 0x9d, 0x01, 0x0a,
-	0x0b, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1a, 0x0a, 0x08,
-	0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x61, 0x62, 0x6c,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x16,
-	0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x12, 0x14,
-	0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6c,
-	0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x42, 0x4c, 0x5a, 0x4a,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x67, 0x65, 0x6e, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x6f,
-	0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x30, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
-}
-
-var (
-	file_opencloud_messages_store_v0_store_proto_rawDescOnce sync.Once
-	file_opencloud_messages_store_v0_store_proto_rawDescData = file_opencloud_messages_store_v0_store_proto_rawDesc
-)
-
-func file_opencloud_messages_store_v0_store_proto_rawDescGZIP() []byte {
-	file_opencloud_messages_store_v0_store_proto_rawDescOnce.Do(func() {
-		file_opencloud_messages_store_v0_store_proto_rawDescData = protoimpl.X.CompressGZIP(file_opencloud_messages_store_v0_store_proto_rawDescData)
-	})
-	return file_opencloud_messages_store_v0_store_proto_rawDescData
-}
-
-var file_opencloud_messages_store_v0_store_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_opencloud_messages_store_v0_store_proto_goTypes = []interface{}{
-	(*Field)(nil),         // 0: opencloud.messages.store.v0.Field
-	(*Record)(nil),        // 1: opencloud.messages.store.v0.Record
-	(*ReadOptions)(nil),   // 2: opencloud.messages.store.v0.ReadOptions
-	(*WriteOptions)(nil),  // 3: opencloud.messages.store.v0.WriteOptions
-	(*DeleteOptions)(nil), // 4: opencloud.messages.store.v0.DeleteOptions
-	(*ListOptions)(nil),   // 5: opencloud.messages.store.v0.ListOptions
-	nil,                   // 6: opencloud.messages.store.v0.Record.MetadataEntry
-	nil,                   // 7: opencloud.messages.store.v0.ReadOptions.WhereEntry
-}
-var file_opencloud_messages_store_v0_store_proto_depIdxs = []int32{
-	6, // 0: opencloud.messages.store.v0.Record.metadata:type_name -> opencloud.messages.store.v0.Record.MetadataEntry
-	7, // 1: opencloud.messages.store.v0.ReadOptions.where:type_name -> opencloud.messages.store.v0.ReadOptions.WhereEntry
-	0, // 2: opencloud.messages.store.v0.Record.MetadataEntry.value:type_name -> opencloud.messages.store.v0.Field
-	0, // 3: opencloud.messages.store.v0.ReadOptions.WhereEntry.value:type_name -> opencloud.messages.store.v0.Field
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
-}
-
-func init() { file_opencloud_messages_store_v0_store_proto_init() }
-func file_opencloud_messages_store_v0_store_proto_init() {
-	if File_opencloud_messages_store_v0_store_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_opencloud_messages_store_v0_store_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Field); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_store_v0_store_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Record); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_store_v0_store_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadOptions); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_store_v0_store_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteOptions); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_store_v0_store_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteOptions); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_store_v0_store_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListOptions); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_opencloud_messages_store_v0_store_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   8,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_opencloud_messages_store_v0_store_proto_goTypes,
-		DependencyIndexes: file_opencloud_messages_store_v0_store_proto_depIdxs,
-		MessageInfos:      file_opencloud_messages_store_v0_store_proto_msgTypes,
-	}.Build()
-	File_opencloud_messages_store_v0_store_proto = out.File
-	file_opencloud_messages_store_v0_store_proto_rawDesc = nil
-	file_opencloud_messages_store_v0_store_proto_goTypes = nil
-	file_opencloud_messages_store_v0_store_proto_depIdxs = nil
-}
@@ -1,15 +0,0 @@
-// Code generated by protoc-gen-micro. DO NOT EDIT.
-// source: opencloud/messages/store/v0/store.proto
-
-package v0
-
-import (
-	fmt "fmt"
-	proto "google.golang.org/protobuf/proto"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
@@ -1,43 +0,0 @@
-{
-  "swagger": "2.0",
-  "info": {
-    "title": "opencloud/messages/store/v0/store.proto",
-    "version": "version not set"
-  },
-  "consumes": [
-    "application/json"
-  ],
-  "produces": [
-    "application/json"
-  ],
-  "paths": {},
-  "definitions": {
-    "protobufAny": {
-      "type": "object",
-      "properties": {
-        "@type": {
-          "type": "string"
-        }
-      },
-      "additionalProperties": {}
-    },
-    "rpcStatus": {
-      "type": "object",
-      "properties": {
-        "code": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "message": {
-          "type": "string"
-        },
-        "details": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/protobufAny"
-          }
-        }
-      }
-    }
-  }
-}
@@ -0,0 +1,167 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/eventhistory/v0/eventhistory.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	EventHistoryService_GetEvents_FullMethodName        = "/opencloud.services.eventhistory.v0.EventHistoryService/GetEvents"
+	EventHistoryService_GetEventsForUser_FullMethodName = "/opencloud.services.eventhistory.v0.EventHistoryService/GetEventsForUser"
+)
+
+// EventHistoryServiceClient is the client API for EventHistoryService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// A Service for storing events
+type EventHistoryServiceClient interface {
+	// returns the specified events
+	GetEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (*GetEventsResponse, error)
+	// returns all events for the specified userID
+	GetEventsForUser(ctx context.Context, in *GetEventsForUserRequest, opts ...grpc.CallOption) (*GetEventsResponse, error)
+}
+
+type eventHistoryServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewEventHistoryServiceClient(cc grpc.ClientConnInterface) EventHistoryServiceClient {
+	return &eventHistoryServiceClient{cc}
+}
+
+func (c *eventHistoryServiceClient) GetEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (*GetEventsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetEventsResponse)
+	err := c.cc.Invoke(ctx, EventHistoryService_GetEvents_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *eventHistoryServiceClient) GetEventsForUser(ctx context.Context, in *GetEventsForUserRequest, opts ...grpc.CallOption) (*GetEventsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetEventsResponse)
+	err := c.cc.Invoke(ctx, EventHistoryService_GetEventsForUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// EventHistoryServiceServer is the server API for EventHistoryService service.
+// All implementations must embed UnimplementedEventHistoryServiceServer
+// for forward compatibility.
+//
+// A Service for storing events
+type EventHistoryServiceServer interface {
+	// returns the specified events
+	GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error)
+	// returns all events for the specified userID
+	GetEventsForUser(context.Context, *GetEventsForUserRequest) (*GetEventsResponse, error)
+	mustEmbedUnimplementedEventHistoryServiceServer()
+}
+
+// UnimplementedEventHistoryServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedEventHistoryServiceServer struct{}
+
+func (UnimplementedEventHistoryServiceServer) GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetEvents not implemented")
+}
+func (UnimplementedEventHistoryServiceServer) GetEventsForUser(context.Context, *GetEventsForUserRequest) (*GetEventsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetEventsForUser not implemented")
+}
+func (UnimplementedEventHistoryServiceServer) mustEmbedUnimplementedEventHistoryServiceServer() {}
+func (UnimplementedEventHistoryServiceServer) testEmbeddedByValue()                             {}
+
+// UnsafeEventHistoryServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to EventHistoryServiceServer will
+// result in compilation errors.
+type UnsafeEventHistoryServiceServer interface {
+	mustEmbedUnimplementedEventHistoryServiceServer()
+}
+
+func RegisterEventHistoryServiceServer(s grpc.ServiceRegistrar, srv EventHistoryServiceServer) {
+	// If the following call panics, it indicates UnimplementedEventHistoryServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&EventHistoryService_ServiceDesc, srv)
+}
+
+func _EventHistoryService_GetEvents_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetEventsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(EventHistoryServiceServer).GetEvents(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: EventHistoryService_GetEvents_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(EventHistoryServiceServer).GetEvents(ctx, req.(*GetEventsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _EventHistoryService_GetEventsForUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetEventsForUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(EventHistoryServiceServer).GetEventsForUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: EventHistoryService_GetEventsForUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(EventHistoryServiceServer).GetEventsForUser(ctx, req.(*GetEventsForUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// EventHistoryService_ServiceDesc is the grpc.ServiceDesc for EventHistoryService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var EventHistoryService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.eventhistory.v0.EventHistoryService",
+	HandlerType: (*EventHistoryServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetEvents",
+			Handler:    _EventHistoryService_GetEvents_Handler,
+		},
+		{
+			MethodName: "GetEventsForUser",
+			Handler:    _EventHistoryService_GetEventsForUser_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/eventhistory/v0/eventhistory.proto",
+}
@@ -0,0 +1,121 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/policies/v0/policies.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	PoliciesProvider_Evaluate_FullMethodName = "/opencloud.services.policies.v0.policiesProvider/Evaluate"
+)
+
+// PoliciesProviderClient is the client API for PoliciesProvider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type PoliciesProviderClient interface {
+	Evaluate(ctx context.Context, in *EvaluateRequest, opts ...grpc.CallOption) (*EvaluateResponse, error)
+}
+
+type policiesProviderClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewPoliciesProviderClient(cc grpc.ClientConnInterface) PoliciesProviderClient {
+	return &policiesProviderClient{cc}
+}
+
+func (c *policiesProviderClient) Evaluate(ctx context.Context, in *EvaluateRequest, opts ...grpc.CallOption) (*EvaluateResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(EvaluateResponse)
+	err := c.cc.Invoke(ctx, PoliciesProvider_Evaluate_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// PoliciesProviderServer is the server API for PoliciesProvider service.
+// All implementations must embed UnimplementedPoliciesProviderServer
+// for forward compatibility.
+type PoliciesProviderServer interface {
+	Evaluate(context.Context, *EvaluateRequest) (*EvaluateResponse, error)
+	mustEmbedUnimplementedPoliciesProviderServer()
+}
+
+// UnimplementedPoliciesProviderServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPoliciesProviderServer struct{}
+
+func (UnimplementedPoliciesProviderServer) Evaluate(context.Context, *EvaluateRequest) (*EvaluateResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Evaluate not implemented")
+}
+func (UnimplementedPoliciesProviderServer) mustEmbedUnimplementedPoliciesProviderServer() {}
+func (UnimplementedPoliciesProviderServer) testEmbeddedByValue()                          {}
+
+// UnsafePoliciesProviderServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to PoliciesProviderServer will
+// result in compilation errors.
+type UnsafePoliciesProviderServer interface {
+	mustEmbedUnimplementedPoliciesProviderServer()
+}
+
+func RegisterPoliciesProviderServer(s grpc.ServiceRegistrar, srv PoliciesProviderServer) {
+	// If the following call panics, it indicates UnimplementedPoliciesProviderServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&PoliciesProvider_ServiceDesc, srv)
+}
+
+func _PoliciesProvider_Evaluate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EvaluateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PoliciesProviderServer).Evaluate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PoliciesProvider_Evaluate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PoliciesProviderServer).Evaluate(ctx, req.(*EvaluateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// PoliciesProvider_ServiceDesc is the grpc.ServiceDesc for PoliciesProvider service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var PoliciesProvider_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.policies.v0.policiesProvider",
+	HandlerType: (*PoliciesProviderServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Evaluate",
+			Handler:    _PoliciesProvider_Evaluate_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/policies/v0/policies.proto",
+}
@@ -0,0 +1,261 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/search/v0/search.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	SearchProvider_Search_FullMethodName     = "/opencloud.services.search.v0.SearchProvider/Search"
+	SearchProvider_IndexSpace_FullMethodName = "/opencloud.services.search.v0.SearchProvider/IndexSpace"
+)
+
+// SearchProviderClient is the client API for SearchProvider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type SearchProviderClient interface {
+	Search(ctx context.Context, in *SearchRequest, opts ...grpc.CallOption) (*SearchResponse, error)
+	IndexSpace(ctx context.Context, in *IndexSpaceRequest, opts ...grpc.CallOption) (*IndexSpaceResponse, error)
+}
+
+type searchProviderClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewSearchProviderClient(cc grpc.ClientConnInterface) SearchProviderClient {
+	return &searchProviderClient{cc}
+}
+
+func (c *searchProviderClient) Search(ctx context.Context, in *SearchRequest, opts ...grpc.CallOption) (*SearchResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SearchResponse)
+	err := c.cc.Invoke(ctx, SearchProvider_Search_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *searchProviderClient) IndexSpace(ctx context.Context, in *IndexSpaceRequest, opts ...grpc.CallOption) (*IndexSpaceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(IndexSpaceResponse)
+	err := c.cc.Invoke(ctx, SearchProvider_IndexSpace_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// SearchProviderServer is the server API for SearchProvider service.
+// All implementations must embed UnimplementedSearchProviderServer
+// for forward compatibility.
+type SearchProviderServer interface {
+	Search(context.Context, *SearchRequest) (*SearchResponse, error)
+	IndexSpace(context.Context, *IndexSpaceRequest) (*IndexSpaceResponse, error)
+	mustEmbedUnimplementedSearchProviderServer()
+}
+
+// UnimplementedSearchProviderServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSearchProviderServer struct{}
+
+func (UnimplementedSearchProviderServer) Search(context.Context, *SearchRequest) (*SearchResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Search not implemented")
+}
+func (UnimplementedSearchProviderServer) IndexSpace(context.Context, *IndexSpaceRequest) (*IndexSpaceResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method IndexSpace not implemented")
+}
+func (UnimplementedSearchProviderServer) mustEmbedUnimplementedSearchProviderServer() {}
+func (UnimplementedSearchProviderServer) testEmbeddedByValue()                        {}
+
+// UnsafeSearchProviderServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to SearchProviderServer will
+// result in compilation errors.
+type UnsafeSearchProviderServer interface {
+	mustEmbedUnimplementedSearchProviderServer()
+}
+
+func RegisterSearchProviderServer(s grpc.ServiceRegistrar, srv SearchProviderServer) {
+	// If the following call panics, it indicates UnimplementedSearchProviderServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&SearchProvider_ServiceDesc, srv)
+}
+
+func _SearchProvider_Search_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SearchRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SearchProviderServer).Search(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SearchProvider_Search_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SearchProviderServer).Search(ctx, req.(*SearchRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SearchProvider_IndexSpace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(IndexSpaceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SearchProviderServer).IndexSpace(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SearchProvider_IndexSpace_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SearchProviderServer).IndexSpace(ctx, req.(*IndexSpaceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// SearchProvider_ServiceDesc is the grpc.ServiceDesc for SearchProvider service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var SearchProvider_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.search.v0.SearchProvider",
+	HandlerType: (*SearchProviderServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Search",
+			Handler:    _SearchProvider_Search_Handler,
+		},
+		{
+			MethodName: "IndexSpace",
+			Handler:    _SearchProvider_IndexSpace_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/search/v0/search.proto",
+}
+
+const (
+	IndexProvider_Search_FullMethodName = "/opencloud.services.search.v0.IndexProvider/Search"
+)
+
+// IndexProviderClient is the client API for IndexProvider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type IndexProviderClient interface {
+	Search(ctx context.Context, in *SearchIndexRequest, opts ...grpc.CallOption) (*SearchIndexResponse, error)
+}
+
+type indexProviderClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewIndexProviderClient(cc grpc.ClientConnInterface) IndexProviderClient {
+	return &indexProviderClient{cc}
+}
+
+func (c *indexProviderClient) Search(ctx context.Context, in *SearchIndexRequest, opts ...grpc.CallOption) (*SearchIndexResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SearchIndexResponse)
+	err := c.cc.Invoke(ctx, IndexProvider_Search_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// IndexProviderServer is the server API for IndexProvider service.
+// All implementations must embed UnimplementedIndexProviderServer
+// for forward compatibility.
+type IndexProviderServer interface {
+	Search(context.Context, *SearchIndexRequest) (*SearchIndexResponse, error)
+	mustEmbedUnimplementedIndexProviderServer()
+}
+
+// UnimplementedIndexProviderServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedIndexProviderServer struct{}
+
+func (UnimplementedIndexProviderServer) Search(context.Context, *SearchIndexRequest) (*SearchIndexResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Search not implemented")
+}
+func (UnimplementedIndexProviderServer) mustEmbedUnimplementedIndexProviderServer() {}
+func (UnimplementedIndexProviderServer) testEmbeddedByValue()                       {}
+
+// UnsafeIndexProviderServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to IndexProviderServer will
+// result in compilation errors.
+type UnsafeIndexProviderServer interface {
+	mustEmbedUnimplementedIndexProviderServer()
+}
+
+func RegisterIndexProviderServer(s grpc.ServiceRegistrar, srv IndexProviderServer) {
+	// If the following call panics, it indicates UnimplementedIndexProviderServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&IndexProvider_ServiceDesc, srv)
+}
+
+func _IndexProvider_Search_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SearchIndexRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IndexProviderServer).Search(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: IndexProvider_Search_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IndexProviderServer).Search(ctx, req.(*SearchIndexRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// IndexProvider_ServiceDesc is the grpc.ServiceDesc for IndexProvider service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var IndexProvider_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.search.v0.IndexProvider",
+	HandlerType: (*IndexProviderServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Search",
+			Handler:    _IndexProvider_Search_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/search/v0/search.proto",
+}
@@ -0,0 +1,922 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/settings/v0/settings.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	BundleService_SaveBundle_FullMethodName              = "/opencloud.services.settings.v0.BundleService/SaveBundle"
+	BundleService_GetBundle_FullMethodName               = "/opencloud.services.settings.v0.BundleService/GetBundle"
+	BundleService_ListBundles_FullMethodName             = "/opencloud.services.settings.v0.BundleService/ListBundles"
+	BundleService_AddSettingToBundle_FullMethodName      = "/opencloud.services.settings.v0.BundleService/AddSettingToBundle"
+	BundleService_RemoveSettingFromBundle_FullMethodName = "/opencloud.services.settings.v0.BundleService/RemoveSettingFromBundle"
+)
+
+// BundleServiceClient is the client API for BundleService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type BundleServiceClient interface {
+	SaveBundle(ctx context.Context, in *SaveBundleRequest, opts ...grpc.CallOption) (*SaveBundleResponse, error)
+	GetBundle(ctx context.Context, in *GetBundleRequest, opts ...grpc.CallOption) (*GetBundleResponse, error)
+	ListBundles(ctx context.Context, in *ListBundlesRequest, opts ...grpc.CallOption) (*ListBundlesResponse, error)
+	AddSettingToBundle(ctx context.Context, in *AddSettingToBundleRequest, opts ...grpc.CallOption) (*AddSettingToBundleResponse, error)
+	RemoveSettingFromBundle(ctx context.Context, in *RemoveSettingFromBundleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type bundleServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewBundleServiceClient(cc grpc.ClientConnInterface) BundleServiceClient {
+	return &bundleServiceClient{cc}
+}
+
+func (c *bundleServiceClient) SaveBundle(ctx context.Context, in *SaveBundleRequest, opts ...grpc.CallOption) (*SaveBundleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SaveBundleResponse)
+	err := c.cc.Invoke(ctx, BundleService_SaveBundle_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *bundleServiceClient) GetBundle(ctx context.Context, in *GetBundleRequest, opts ...grpc.CallOption) (*GetBundleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetBundleResponse)
+	err := c.cc.Invoke(ctx, BundleService_GetBundle_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *bundleServiceClient) ListBundles(ctx context.Context, in *ListBundlesRequest, opts ...grpc.CallOption) (*ListBundlesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListBundlesResponse)
+	err := c.cc.Invoke(ctx, BundleService_ListBundles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *bundleServiceClient) AddSettingToBundle(ctx context.Context, in *AddSettingToBundleRequest, opts ...grpc.CallOption) (*AddSettingToBundleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AddSettingToBundleResponse)
+	err := c.cc.Invoke(ctx, BundleService_AddSettingToBundle_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *bundleServiceClient) RemoveSettingFromBundle(ctx context.Context, in *RemoveSettingFromBundleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, BundleService_RemoveSettingFromBundle_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// BundleServiceServer is the server API for BundleService service.
+// All implementations must embed UnimplementedBundleServiceServer
+// for forward compatibility.
+type BundleServiceServer interface {
+	SaveBundle(context.Context, *SaveBundleRequest) (*SaveBundleResponse, error)
+	GetBundle(context.Context, *GetBundleRequest) (*GetBundleResponse, error)
+	ListBundles(context.Context, *ListBundlesRequest) (*ListBundlesResponse, error)
+	AddSettingToBundle(context.Context, *AddSettingToBundleRequest) (*AddSettingToBundleResponse, error)
+	RemoveSettingFromBundle(context.Context, *RemoveSettingFromBundleRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedBundleServiceServer()
+}
+
+// UnimplementedBundleServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedBundleServiceServer struct{}
+
+func (UnimplementedBundleServiceServer) SaveBundle(context.Context, *SaveBundleRequest) (*SaveBundleResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SaveBundle not implemented")
+}
+func (UnimplementedBundleServiceServer) GetBundle(context.Context, *GetBundleRequest) (*GetBundleResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetBundle not implemented")
+}
+func (UnimplementedBundleServiceServer) ListBundles(context.Context, *ListBundlesRequest) (*ListBundlesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListBundles not implemented")
+}
+func (UnimplementedBundleServiceServer) AddSettingToBundle(context.Context, *AddSettingToBundleRequest) (*AddSettingToBundleResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method AddSettingToBundle not implemented")
+}
+func (UnimplementedBundleServiceServer) RemoveSettingFromBundle(context.Context, *RemoveSettingFromBundleRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method RemoveSettingFromBundle not implemented")
+}
+func (UnimplementedBundleServiceServer) mustEmbedUnimplementedBundleServiceServer() {}
+func (UnimplementedBundleServiceServer) testEmbeddedByValue()                       {}
+
+// UnsafeBundleServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to BundleServiceServer will
+// result in compilation errors.
+type UnsafeBundleServiceServer interface {
+	mustEmbedUnimplementedBundleServiceServer()
+}
+
+func RegisterBundleServiceServer(s grpc.ServiceRegistrar, srv BundleServiceServer) {
+	// If the following call panics, it indicates UnimplementedBundleServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&BundleService_ServiceDesc, srv)
+}
+
+func _BundleService_SaveBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SaveBundleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BundleServiceServer).SaveBundle(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BundleService_SaveBundle_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BundleServiceServer).SaveBundle(ctx, req.(*SaveBundleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _BundleService_GetBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetBundleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BundleServiceServer).GetBundle(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BundleService_GetBundle_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BundleServiceServer).GetBundle(ctx, req.(*GetBundleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _BundleService_ListBundles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListBundlesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BundleServiceServer).ListBundles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BundleService_ListBundles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BundleServiceServer).ListBundles(ctx, req.(*ListBundlesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _BundleService_AddSettingToBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddSettingToBundleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BundleServiceServer).AddSettingToBundle(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BundleService_AddSettingToBundle_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BundleServiceServer).AddSettingToBundle(ctx, req.(*AddSettingToBundleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _BundleService_RemoveSettingFromBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveSettingFromBundleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BundleServiceServer).RemoveSettingFromBundle(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BundleService_RemoveSettingFromBundle_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BundleServiceServer).RemoveSettingFromBundle(ctx, req.(*RemoveSettingFromBundleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// BundleService_ServiceDesc is the grpc.ServiceDesc for BundleService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var BundleService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.settings.v0.BundleService",
+	HandlerType: (*BundleServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "SaveBundle",
+			Handler:    _BundleService_SaveBundle_Handler,
+		},
+		{
+			MethodName: "GetBundle",
+			Handler:    _BundleService_GetBundle_Handler,
+		},
+		{
+			MethodName: "ListBundles",
+			Handler:    _BundleService_ListBundles_Handler,
+		},
+		{
+			MethodName: "AddSettingToBundle",
+			Handler:    _BundleService_AddSettingToBundle_Handler,
+		},
+		{
+			MethodName: "RemoveSettingFromBundle",
+			Handler:    _BundleService_RemoveSettingFromBundle_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/settings/v0/settings.proto",
+}
+
+const (
+	ValueService_SaveValue_FullMethodName                   = "/opencloud.services.settings.v0.ValueService/SaveValue"
+	ValueService_GetValue_FullMethodName                    = "/opencloud.services.settings.v0.ValueService/GetValue"
+	ValueService_ListValues_FullMethodName                  = "/opencloud.services.settings.v0.ValueService/ListValues"
+	ValueService_GetValueByUniqueIdentifiers_FullMethodName = "/opencloud.services.settings.v0.ValueService/GetValueByUniqueIdentifiers"
+)
+
+// ValueServiceClient is the client API for ValueService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ValueServiceClient interface {
+	SaveValue(ctx context.Context, in *SaveValueRequest, opts ...grpc.CallOption) (*SaveValueResponse, error)
+	GetValue(ctx context.Context, in *GetValueRequest, opts ...grpc.CallOption) (*GetValueResponse, error)
+	ListValues(ctx context.Context, in *ListValuesRequest, opts ...grpc.CallOption) (*ListValuesResponse, error)
+	GetValueByUniqueIdentifiers(ctx context.Context, in *GetValueByUniqueIdentifiersRequest, opts ...grpc.CallOption) (*GetValueResponse, error)
+}
+
+type valueServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewValueServiceClient(cc grpc.ClientConnInterface) ValueServiceClient {
+	return &valueServiceClient{cc}
+}
+
+func (c *valueServiceClient) SaveValue(ctx context.Context, in *SaveValueRequest, opts ...grpc.CallOption) (*SaveValueResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SaveValueResponse)
+	err := c.cc.Invoke(ctx, ValueService_SaveValue_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *valueServiceClient) GetValue(ctx context.Context, in *GetValueRequest, opts ...grpc.CallOption) (*GetValueResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetValueResponse)
+	err := c.cc.Invoke(ctx, ValueService_GetValue_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *valueServiceClient) ListValues(ctx context.Context, in *ListValuesRequest, opts ...grpc.CallOption) (*ListValuesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListValuesResponse)
+	err := c.cc.Invoke(ctx, ValueService_ListValues_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *valueServiceClient) GetValueByUniqueIdentifiers(ctx context.Context, in *GetValueByUniqueIdentifiersRequest, opts ...grpc.CallOption) (*GetValueResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetValueResponse)
+	err := c.cc.Invoke(ctx, ValueService_GetValueByUniqueIdentifiers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ValueServiceServer is the server API for ValueService service.
+// All implementations must embed UnimplementedValueServiceServer
+// for forward compatibility.
+type ValueServiceServer interface {
+	SaveValue(context.Context, *SaveValueRequest) (*SaveValueResponse, error)
+	GetValue(context.Context, *GetValueRequest) (*GetValueResponse, error)
+	ListValues(context.Context, *ListValuesRequest) (*ListValuesResponse, error)
+	GetValueByUniqueIdentifiers(context.Context, *GetValueByUniqueIdentifiersRequest) (*GetValueResponse, error)
+	mustEmbedUnimplementedValueServiceServer()
+}
+
+// UnimplementedValueServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedValueServiceServer struct{}
+
+func (UnimplementedValueServiceServer) SaveValue(context.Context, *SaveValueRequest) (*SaveValueResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SaveValue not implemented")
+}
+func (UnimplementedValueServiceServer) GetValue(context.Context, *GetValueRequest) (*GetValueResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetValue not implemented")
+}
+func (UnimplementedValueServiceServer) ListValues(context.Context, *ListValuesRequest) (*ListValuesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListValues not implemented")
+}
+func (UnimplementedValueServiceServer) GetValueByUniqueIdentifiers(context.Context, *GetValueByUniqueIdentifiersRequest) (*GetValueResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetValueByUniqueIdentifiers not implemented")
+}
+func (UnimplementedValueServiceServer) mustEmbedUnimplementedValueServiceServer() {}
+func (UnimplementedValueServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeValueServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ValueServiceServer will
+// result in compilation errors.
+type UnsafeValueServiceServer interface {
+	mustEmbedUnimplementedValueServiceServer()
+}
+
+func RegisterValueServiceServer(s grpc.ServiceRegistrar, srv ValueServiceServer) {
+	// If the following call panics, it indicates UnimplementedValueServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ValueService_ServiceDesc, srv)
+}
+
+func _ValueService_SaveValue_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SaveValueRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ValueServiceServer).SaveValue(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ValueService_SaveValue_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ValueServiceServer).SaveValue(ctx, req.(*SaveValueRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ValueService_GetValue_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetValueRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ValueServiceServer).GetValue(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ValueService_GetValue_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ValueServiceServer).GetValue(ctx, req.(*GetValueRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ValueService_ListValues_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListValuesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ValueServiceServer).ListValues(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ValueService_ListValues_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ValueServiceServer).ListValues(ctx, req.(*ListValuesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ValueService_GetValueByUniqueIdentifiers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetValueByUniqueIdentifiersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ValueServiceServer).GetValueByUniqueIdentifiers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ValueService_GetValueByUniqueIdentifiers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ValueServiceServer).GetValueByUniqueIdentifiers(ctx, req.(*GetValueByUniqueIdentifiersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ValueService_ServiceDesc is the grpc.ServiceDesc for ValueService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ValueService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.settings.v0.ValueService",
+	HandlerType: (*ValueServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "SaveValue",
+			Handler:    _ValueService_SaveValue_Handler,
+		},
+		{
+			MethodName: "GetValue",
+			Handler:    _ValueService_GetValue_Handler,
+		},
+		{
+			MethodName: "ListValues",
+			Handler:    _ValueService_ListValues_Handler,
+		},
+		{
+			MethodName: "GetValueByUniqueIdentifiers",
+			Handler:    _ValueService_GetValueByUniqueIdentifiers_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/settings/v0/settings.proto",
+}
+
+const (
+	RoleService_ListRoles_FullMethodName                   = "/opencloud.services.settings.v0.RoleService/ListRoles"
+	RoleService_ListRoleAssignments_FullMethodName         = "/opencloud.services.settings.v0.RoleService/ListRoleAssignments"
+	RoleService_ListRoleAssignmentsFiltered_FullMethodName = "/opencloud.services.settings.v0.RoleService/ListRoleAssignmentsFiltered"
+	RoleService_AssignRoleToUser_FullMethodName            = "/opencloud.services.settings.v0.RoleService/AssignRoleToUser"
+	RoleService_RemoveRoleFromUser_FullMethodName          = "/opencloud.services.settings.v0.RoleService/RemoveRoleFromUser"
+)
+
+// RoleServiceClient is the client API for RoleService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type RoleServiceClient interface {
+	ListRoles(ctx context.Context, in *ListBundlesRequest, opts ...grpc.CallOption) (*ListBundlesResponse, error)
+	ListRoleAssignments(ctx context.Context, in *ListRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListRoleAssignmentsResponse, error)
+	ListRoleAssignmentsFiltered(ctx context.Context, in *ListRoleAssignmentsFilteredRequest, opts ...grpc.CallOption) (*ListRoleAssignmentsResponse, error)
+	AssignRoleToUser(ctx context.Context, in *AssignRoleToUserRequest, opts ...grpc.CallOption) (*AssignRoleToUserResponse, error)
+	RemoveRoleFromUser(ctx context.Context, in *RemoveRoleFromUserRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type roleServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewRoleServiceClient(cc grpc.ClientConnInterface) RoleServiceClient {
+	return &roleServiceClient{cc}
+}
+
+func (c *roleServiceClient) ListRoles(ctx context.Context, in *ListBundlesRequest, opts ...grpc.CallOption) (*ListBundlesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListBundlesResponse)
+	err := c.cc.Invoke(ctx, RoleService_ListRoles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *roleServiceClient) ListRoleAssignments(ctx context.Context, in *ListRoleAssignmentsRequest, opts ...grpc.CallOption) (*ListRoleAssignmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRoleAssignmentsResponse)
+	err := c.cc.Invoke(ctx, RoleService_ListRoleAssignments_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *roleServiceClient) ListRoleAssignmentsFiltered(ctx context.Context, in *ListRoleAssignmentsFilteredRequest, opts ...grpc.CallOption) (*ListRoleAssignmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRoleAssignmentsResponse)
+	err := c.cc.Invoke(ctx, RoleService_ListRoleAssignmentsFiltered_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *roleServiceClient) AssignRoleToUser(ctx context.Context, in *AssignRoleToUserRequest, opts ...grpc.CallOption) (*AssignRoleToUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AssignRoleToUserResponse)
+	err := c.cc.Invoke(ctx, RoleService_AssignRoleToUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *roleServiceClient) RemoveRoleFromUser(ctx context.Context, in *RemoveRoleFromUserRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, RoleService_RemoveRoleFromUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// RoleServiceServer is the server API for RoleService service.
+// All implementations must embed UnimplementedRoleServiceServer
+// for forward compatibility.
+type RoleServiceServer interface {
+	ListRoles(context.Context, *ListBundlesRequest) (*ListBundlesResponse, error)
+	ListRoleAssignments(context.Context, *ListRoleAssignmentsRequest) (*ListRoleAssignmentsResponse, error)
+	ListRoleAssignmentsFiltered(context.Context, *ListRoleAssignmentsFilteredRequest) (*ListRoleAssignmentsResponse, error)
+	AssignRoleToUser(context.Context, *AssignRoleToUserRequest) (*AssignRoleToUserResponse, error)
+	RemoveRoleFromUser(context.Context, *RemoveRoleFromUserRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedRoleServiceServer()
+}
+
+// UnimplementedRoleServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRoleServiceServer struct{}
+
+func (UnimplementedRoleServiceServer) ListRoles(context.Context, *ListBundlesRequest) (*ListBundlesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRoles not implemented")
+}
+func (UnimplementedRoleServiceServer) ListRoleAssignments(context.Context, *ListRoleAssignmentsRequest) (*ListRoleAssignmentsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRoleAssignments not implemented")
+}
+func (UnimplementedRoleServiceServer) ListRoleAssignmentsFiltered(context.Context, *ListRoleAssignmentsFilteredRequest) (*ListRoleAssignmentsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRoleAssignmentsFiltered not implemented")
+}
+func (UnimplementedRoleServiceServer) AssignRoleToUser(context.Context, *AssignRoleToUserRequest) (*AssignRoleToUserResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method AssignRoleToUser not implemented")
+}
+func (UnimplementedRoleServiceServer) RemoveRoleFromUser(context.Context, *RemoveRoleFromUserRequest) (*emptypb.Empty, error) {
+	return nil, status.Error(codes.Unimplemented, "method RemoveRoleFromUser not implemented")
+}
+func (UnimplementedRoleServiceServer) mustEmbedUnimplementedRoleServiceServer() {}
+func (UnimplementedRoleServiceServer) testEmbeddedByValue()                     {}
+
+// UnsafeRoleServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RoleServiceServer will
+// result in compilation errors.
+type UnsafeRoleServiceServer interface {
+	mustEmbedUnimplementedRoleServiceServer()
+}
+
+func RegisterRoleServiceServer(s grpc.ServiceRegistrar, srv RoleServiceServer) {
+	// If the following call panics, it indicates UnimplementedRoleServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RoleService_ServiceDesc, srv)
+}
+
+func _RoleService_ListRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListBundlesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RoleServiceServer).ListRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RoleService_ListRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RoleServiceServer).ListRoles(ctx, req.(*ListBundlesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RoleService_ListRoleAssignments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRoleAssignmentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RoleServiceServer).ListRoleAssignments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RoleService_ListRoleAssignments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RoleServiceServer).ListRoleAssignments(ctx, req.(*ListRoleAssignmentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RoleService_ListRoleAssignmentsFiltered_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRoleAssignmentsFilteredRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RoleServiceServer).ListRoleAssignmentsFiltered(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RoleService_ListRoleAssignmentsFiltered_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RoleServiceServer).ListRoleAssignmentsFiltered(ctx, req.(*ListRoleAssignmentsFilteredRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RoleService_AssignRoleToUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AssignRoleToUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RoleServiceServer).AssignRoleToUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RoleService_AssignRoleToUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RoleServiceServer).AssignRoleToUser(ctx, req.(*AssignRoleToUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RoleService_RemoveRoleFromUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveRoleFromUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RoleServiceServer).RemoveRoleFromUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RoleService_RemoveRoleFromUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RoleServiceServer).RemoveRoleFromUser(ctx, req.(*RemoveRoleFromUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RoleService_ServiceDesc is the grpc.ServiceDesc for RoleService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RoleService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.settings.v0.RoleService",
+	HandlerType: (*RoleServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListRoles",
+			Handler:    _RoleService_ListRoles_Handler,
+		},
+		{
+			MethodName: "ListRoleAssignments",
+			Handler:    _RoleService_ListRoleAssignments_Handler,
+		},
+		{
+			MethodName: "ListRoleAssignmentsFiltered",
+			Handler:    _RoleService_ListRoleAssignmentsFiltered_Handler,
+		},
+		{
+			MethodName: "AssignRoleToUser",
+			Handler:    _RoleService_AssignRoleToUser_Handler,
+		},
+		{
+			MethodName: "RemoveRoleFromUser",
+			Handler:    _RoleService_RemoveRoleFromUser_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/settings/v0/settings.proto",
+}
+
+const (
+	PermissionService_ListPermissions_FullMethodName           = "/opencloud.services.settings.v0.PermissionService/ListPermissions"
+	PermissionService_ListPermissionsByResource_FullMethodName = "/opencloud.services.settings.v0.PermissionService/ListPermissionsByResource"
+	PermissionService_GetPermissionByID_FullMethodName         = "/opencloud.services.settings.v0.PermissionService/GetPermissionByID"
+)
+
+// PermissionServiceClient is the client API for PermissionService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type PermissionServiceClient interface {
+	ListPermissions(ctx context.Context, in *ListPermissionsRequest, opts ...grpc.CallOption) (*ListPermissionsResponse, error)
+	ListPermissionsByResource(ctx context.Context, in *ListPermissionsByResourceRequest, opts ...grpc.CallOption) (*ListPermissionsByResourceResponse, error)
+	GetPermissionByID(ctx context.Context, in *GetPermissionByIDRequest, opts ...grpc.CallOption) (*GetPermissionByIDResponse, error)
+}
+
+type permissionServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewPermissionServiceClient(cc grpc.ClientConnInterface) PermissionServiceClient {
+	return &permissionServiceClient{cc}
+}
+
+func (c *permissionServiceClient) ListPermissions(ctx context.Context, in *ListPermissionsRequest, opts ...grpc.CallOption) (*ListPermissionsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListPermissionsResponse)
+	err := c.cc.Invoke(ctx, PermissionService_ListPermissions_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *permissionServiceClient) ListPermissionsByResource(ctx context.Context, in *ListPermissionsByResourceRequest, opts ...grpc.CallOption) (*ListPermissionsByResourceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListPermissionsByResourceResponse)
+	err := c.cc.Invoke(ctx, PermissionService_ListPermissionsByResource_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *permissionServiceClient) GetPermissionByID(ctx context.Context, in *GetPermissionByIDRequest, opts ...grpc.CallOption) (*GetPermissionByIDResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetPermissionByIDResponse)
+	err := c.cc.Invoke(ctx, PermissionService_GetPermissionByID_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// PermissionServiceServer is the server API for PermissionService service.
+// All implementations must embed UnimplementedPermissionServiceServer
+// for forward compatibility.
+type PermissionServiceServer interface {
+	ListPermissions(context.Context, *ListPermissionsRequest) (*ListPermissionsResponse, error)
+	ListPermissionsByResource(context.Context, *ListPermissionsByResourceRequest) (*ListPermissionsByResourceResponse, error)
+	GetPermissionByID(context.Context, *GetPermissionByIDRequest) (*GetPermissionByIDResponse, error)
+	mustEmbedUnimplementedPermissionServiceServer()
+}
+
+// UnimplementedPermissionServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPermissionServiceServer struct{}
+
+func (UnimplementedPermissionServiceServer) ListPermissions(context.Context, *ListPermissionsRequest) (*ListPermissionsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPermissions not implemented")
+}
+func (UnimplementedPermissionServiceServer) ListPermissionsByResource(context.Context, *ListPermissionsByResourceRequest) (*ListPermissionsByResourceResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPermissionsByResource not implemented")
+}
+func (UnimplementedPermissionServiceServer) GetPermissionByID(context.Context, *GetPermissionByIDRequest) (*GetPermissionByIDResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetPermissionByID not implemented")
+}
+func (UnimplementedPermissionServiceServer) mustEmbedUnimplementedPermissionServiceServer() {}
+func (UnimplementedPermissionServiceServer) testEmbeddedByValue()                           {}
+
+// UnsafePermissionServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to PermissionServiceServer will
+// result in compilation errors.
+type UnsafePermissionServiceServer interface {
+	mustEmbedUnimplementedPermissionServiceServer()
+}
+
+func RegisterPermissionServiceServer(s grpc.ServiceRegistrar, srv PermissionServiceServer) {
+	// If the following call panics, it indicates UnimplementedPermissionServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&PermissionService_ServiceDesc, srv)
+}
+
+func _PermissionService_ListPermissions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPermissionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PermissionServiceServer).ListPermissions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PermissionService_ListPermissions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PermissionServiceServer).ListPermissions(ctx, req.(*ListPermissionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PermissionService_ListPermissionsByResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPermissionsByResourceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PermissionServiceServer).ListPermissionsByResource(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PermissionService_ListPermissionsByResource_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PermissionServiceServer).ListPermissionsByResource(ctx, req.(*ListPermissionsByResourceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PermissionService_GetPermissionByID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetPermissionByIDRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PermissionServiceServer).GetPermissionByID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PermissionService_GetPermissionByID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PermissionServiceServer).GetPermissionByID(ctx, req.(*GetPermissionByIDRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// PermissionService_ServiceDesc is the grpc.ServiceDesc for PermissionService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var PermissionService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.settings.v0.PermissionService",
+	HandlerType: (*PermissionServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListPermissions",
+			Handler:    _PermissionService_ListPermissions_Handler,
+		},
+		{
+			MethodName: "ListPermissionsByResource",
+			Handler:    _PermissionService_ListPermissionsByResource_Handler,
+		},
+		{
+			MethodName: "GetPermissionByID",
+			Handler:    _PermissionService_GetPermissionByID_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/settings/v0/settings.proto",
+}
@@ -1,937 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        (unknown)
-// source: opencloud/services/store/v0/store.proto
-
-package v0
-
-import (
-	_ "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options"
-	v0 "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/store/v0"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type ReadRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key     string          `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Options *v0.ReadOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
-}
-
-func (x *ReadRequest) Reset() {
-	*x = ReadRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ReadRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ReadRequest) ProtoMessage() {}
-
-func (x *ReadRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ReadRequest.ProtoReflect.Descriptor instead.
-func (*ReadRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *ReadRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *ReadRequest) GetOptions() *v0.ReadOptions {
-	if x != nil {
-		return x.Options
-	}
-	return nil
-}
-
-type ReadResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Records []*v0.Record `protobuf:"bytes,1,rep,name=records,proto3" json:"records,omitempty"`
-}
-
-func (x *ReadResponse) Reset() {
-	*x = ReadResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ReadResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ReadResponse) ProtoMessage() {}
-
-func (x *ReadResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ReadResponse.ProtoReflect.Descriptor instead.
-func (*ReadResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *ReadResponse) GetRecords() []*v0.Record {
-	if x != nil {
-		return x.Records
-	}
-	return nil
-}
-
-type WriteRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Record  *v0.Record       `protobuf:"bytes,1,opt,name=record,proto3" json:"record,omitempty"`
-	Options *v0.WriteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
-}
-
-func (x *WriteRequest) Reset() {
-	*x = WriteRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *WriteRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*WriteRequest) ProtoMessage() {}
-
-func (x *WriteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use WriteRequest.ProtoReflect.Descriptor instead.
-func (*WriteRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *WriteRequest) GetRecord() *v0.Record {
-	if x != nil {
-		return x.Record
-	}
-	return nil
-}
-
-func (x *WriteRequest) GetOptions() *v0.WriteOptions {
-	if x != nil {
-		return x.Options
-	}
-	return nil
-}
-
-type WriteResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *WriteResponse) Reset() {
-	*x = WriteResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *WriteResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*WriteResponse) ProtoMessage() {}
-
-func (x *WriteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use WriteResponse.ProtoReflect.Descriptor instead.
-func (*WriteResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{3}
-}
-
-type DeleteRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key     string            `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Options *v0.DeleteOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
-}
-
-func (x *DeleteRequest) Reset() {
-	*x = DeleteRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DeleteRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteRequest) ProtoMessage() {}
-
-func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
-func (*DeleteRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *DeleteRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *DeleteRequest) GetOptions() *v0.DeleteOptions {
-	if x != nil {
-		return x.Options
-	}
-	return nil
-}
-
-type DeleteResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *DeleteResponse) Reset() {
-	*x = DeleteResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DeleteResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DeleteResponse) ProtoMessage() {}
-
-func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
-func (*DeleteResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{5}
-}
-
-type ListRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Options *v0.ListOptions `protobuf:"bytes,1,opt,name=options,proto3" json:"options,omitempty"`
-}
-
-func (x *ListRequest) Reset() {
-	*x = ListRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListRequest) ProtoMessage() {}
-
-func (x *ListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
-func (*ListRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *ListRequest) GetOptions() *v0.ListOptions {
-	if x != nil {
-		return x.Options
-	}
-	return nil
-}
-
-type ListResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Keys []string `protobuf:"bytes,2,rep,name=keys,proto3" json:"keys,omitempty"`
-}
-
-func (x *ListResponse) Reset() {
-	*x = ListResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListResponse) ProtoMessage() {}
-
-func (x *ListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
-func (*ListResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *ListResponse) GetKeys() []string {
-	if x != nil {
-		return x.Keys
-	}
-	return nil
-}
-
-type DatabasesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *DatabasesRequest) Reset() {
-	*x = DatabasesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DatabasesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DatabasesRequest) ProtoMessage() {}
-
-func (x *DatabasesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DatabasesRequest.ProtoReflect.Descriptor instead.
-func (*DatabasesRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{8}
-}
-
-type DatabasesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Databases []string `protobuf:"bytes,1,rep,name=databases,proto3" json:"databases,omitempty"`
-}
-
-func (x *DatabasesResponse) Reset() {
-	*x = DatabasesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DatabasesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DatabasesResponse) ProtoMessage() {}
-
-func (x *DatabasesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DatabasesResponse.ProtoReflect.Descriptor instead.
-func (*DatabasesResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{9}
-}
-
-func (x *DatabasesResponse) GetDatabases() []string {
-	if x != nil {
-		return x.Databases
-	}
-	return nil
-}
-
-type TablesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Database string `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
-}
-
-func (x *TablesRequest) Reset() {
-	*x = TablesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TablesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TablesRequest) ProtoMessage() {}
-
-func (x *TablesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TablesRequest.ProtoReflect.Descriptor instead.
-func (*TablesRequest) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{10}
-}
-
-func (x *TablesRequest) GetDatabase() string {
-	if x != nil {
-		return x.Database
-	}
-	return ""
-}
-
-type TablesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Tables []string `protobuf:"bytes,1,rep,name=tables,proto3" json:"tables,omitempty"`
-}
-
-func (x *TablesResponse) Reset() {
-	*x = TablesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_services_store_v0_store_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TablesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TablesResponse) ProtoMessage() {}
-
-func (x *TablesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_services_store_v0_store_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TablesResponse.ProtoReflect.Descriptor instead.
-func (*TablesResponse) Descriptor() ([]byte, []int) {
-	return file_opencloud_services_store_v0_store_proto_rawDescGZIP(), []int{11}
-}
-
-func (x *TablesResponse) GetTables() []string {
-	if x != nil {
-		return x.Tables
-	}
-	return nil
-}
-
-var File_opencloud_services_store_v0_store_proto protoreflect.FileDescriptor
-
-var file_opencloud_services_store_v0_store_proto_rawDesc = []byte{
-	0x0a, 0x27, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x30, 0x2f, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x6f, 0x70, 0x65, 0x6e, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x1a, 0x27, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2f, 0x76, 0x30, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2d, 0x67, 0x65, 0x6e, 0x2d, 0x6f, 0x70, 0x65, 0x6e,
-	0x61, 0x70, 0x69, 0x76, 0x32, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x61, 0x6e,
-	0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x63, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x42, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e,
-	0x52, 0x65, 0x61, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x22, 0x4d, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x22, 0x90, 0x01, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x3b, 0x0a, 0x06, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
-	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
-	0x76, 0x30, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x06, 0x72, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x12, 0x43, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30,
-	0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x0f, 0x0a, 0x0d, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x67, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x44, 0x0a, 0x07, 0x6f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
-	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x22, 0x10, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x51, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x42, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x28, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x22,
-	0x12, 0x0a, 0x10, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x22, 0x31, 0x0a, 0x11, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x61, 0x74, 0x61,
-	0x62, 0x61, 0x73, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x64, 0x61, 0x74,
-	0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x22, 0x2b, 0x0a, 0x0d, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x64, 0x61, 0x74, 0x61, 0x62,
-	0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x62,
-	0x61, 0x73, 0x65, 0x22, 0x28, 0x0a, 0x0e, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x32, 0xe1, 0x04,
-	0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x5d, 0x0a, 0x04, 0x52, 0x65, 0x61, 0x64, 0x12,
-	0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65,
-	0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
-	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x60, 0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12,
-	0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x57, 0x72,
-	0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x63, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x12, 0x2a, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b,
-	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5f, 0x0a,
-	0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x76, 0x30, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x6c,
-	0x0a, 0x09, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x12, 0x2d, 0x2e, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61,
-	0x73, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73,
-	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x63, 0x0a, 0x06,
-	0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x2a, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f,
-	0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x2e, 0x76, 0x30, 0x2e, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x30,
-	0x2e, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x42, 0xef, 0x02, 0x5a, 0x49, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x67, 0x65, 0x6e,
-	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x30, 0x92,
-	0x41, 0xa0, 0x02, 0x12, 0xb6, 0x01, 0x0a, 0x0f, 0x4f, 0x70, 0x65, 0x6e, 0x43, 0x6c, 0x6f, 0x75,
-	0x64, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x22, 0x51, 0x0a, 0x0e, 0x4f, 0x70, 0x65, 0x6e, 0x43,
-	0x6c, 0x6f, 0x75, 0x64, 0x20, 0x47, 0x6d, 0x62, 0x48, 0x12, 0x29, 0x68, 0x74, 0x74, 0x70, 0x73,
-	0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x1a, 0x14, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x40, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x65, 0x75, 0x2a, 0x49, 0x0a, 0x0a, 0x41, 0x70,
-	0x61, 0x63, 0x68, 0x65, 0x2d, 0x32, 0x2e, 0x30, 0x12, 0x3b, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
-	0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c,
-	0x6f, 0x75, 0x64, 0x2f, 0x62, 0x6c, 0x6f, 0x62, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x4c, 0x49,
-	0x43, 0x45, 0x4e, 0x53, 0x45, 0x32, 0x05, 0x31, 0x2e, 0x30, 0x2e, 0x30, 0x2a, 0x02, 0x01, 0x02,
-	0x32, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73,
-	0x6f, 0x6e, 0x3a, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
-	0x6a, 0x73, 0x6f, 0x6e, 0x72, 0x3d, 0x0a, 0x10, 0x44, 0x65, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65,
-	0x72, 0x20, 0x4d, 0x61, 0x6e, 0x75, 0x61, 0x6c, 0x12, 0x29, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
-	0x2f, 0x2f, 0x64, 0x6f, 0x63, 0x73, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
-	0x2e, 0x65, 0x75, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_opencloud_services_store_v0_store_proto_rawDescOnce sync.Once
-	file_opencloud_services_store_v0_store_proto_rawDescData = file_opencloud_services_store_v0_store_proto_rawDesc
-)
-
-func file_opencloud_services_store_v0_store_proto_rawDescGZIP() []byte {
-	file_opencloud_services_store_v0_store_proto_rawDescOnce.Do(func() {
-		file_opencloud_services_store_v0_store_proto_rawDescData = protoimpl.X.CompressGZIP(file_opencloud_services_store_v0_store_proto_rawDescData)
-	})
-	return file_opencloud_services_store_v0_store_proto_rawDescData
-}
-
-var file_opencloud_services_store_v0_store_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
-var file_opencloud_services_store_v0_store_proto_goTypes = []interface{}{
-	(*ReadRequest)(nil),       // 0: opencloud.services.store.v0.ReadRequest
-	(*ReadResponse)(nil),      // 1: opencloud.services.store.v0.ReadResponse
-	(*WriteRequest)(nil),      // 2: opencloud.services.store.v0.WriteRequest
-	(*WriteResponse)(nil),     // 3: opencloud.services.store.v0.WriteResponse
-	(*DeleteRequest)(nil),     // 4: opencloud.services.store.v0.DeleteRequest
-	(*DeleteResponse)(nil),    // 5: opencloud.services.store.v0.DeleteResponse
-	(*ListRequest)(nil),       // 6: opencloud.services.store.v0.ListRequest
-	(*ListResponse)(nil),      // 7: opencloud.services.store.v0.ListResponse
-	(*DatabasesRequest)(nil),  // 8: opencloud.services.store.v0.DatabasesRequest
-	(*DatabasesResponse)(nil), // 9: opencloud.services.store.v0.DatabasesResponse
-	(*TablesRequest)(nil),     // 10: opencloud.services.store.v0.TablesRequest
-	(*TablesResponse)(nil),    // 11: opencloud.services.store.v0.TablesResponse
-	(*v0.ReadOptions)(nil),    // 12: opencloud.messages.store.v0.ReadOptions
-	(*v0.Record)(nil),         // 13: opencloud.messages.store.v0.Record
-	(*v0.WriteOptions)(nil),   // 14: opencloud.messages.store.v0.WriteOptions
-	(*v0.DeleteOptions)(nil),  // 15: opencloud.messages.store.v0.DeleteOptions
-	(*v0.ListOptions)(nil),    // 16: opencloud.messages.store.v0.ListOptions
-}
-var file_opencloud_services_store_v0_store_proto_depIdxs = []int32{
-	12, // 0: opencloud.services.store.v0.ReadRequest.options:type_name -> opencloud.messages.store.v0.ReadOptions
-	13, // 1: opencloud.services.store.v0.ReadResponse.records:type_name -> opencloud.messages.store.v0.Record
-	13, // 2: opencloud.services.store.v0.WriteRequest.record:type_name -> opencloud.messages.store.v0.Record
-	14, // 3: opencloud.services.store.v0.WriteRequest.options:type_name -> opencloud.messages.store.v0.WriteOptions
-	15, // 4: opencloud.services.store.v0.DeleteRequest.options:type_name -> opencloud.messages.store.v0.DeleteOptions
-	16, // 5: opencloud.services.store.v0.ListRequest.options:type_name -> opencloud.messages.store.v0.ListOptions
-	0,  // 6: opencloud.services.store.v0.Store.Read:input_type -> opencloud.services.store.v0.ReadRequest
-	2,  // 7: opencloud.services.store.v0.Store.Write:input_type -> opencloud.services.store.v0.WriteRequest
-	4,  // 8: opencloud.services.store.v0.Store.Delete:input_type -> opencloud.services.store.v0.DeleteRequest
-	6,  // 9: opencloud.services.store.v0.Store.List:input_type -> opencloud.services.store.v0.ListRequest
-	8,  // 10: opencloud.services.store.v0.Store.Databases:input_type -> opencloud.services.store.v0.DatabasesRequest
-	10, // 11: opencloud.services.store.v0.Store.Tables:input_type -> opencloud.services.store.v0.TablesRequest
-	1,  // 12: opencloud.services.store.v0.Store.Read:output_type -> opencloud.services.store.v0.ReadResponse
-	3,  // 13: opencloud.services.store.v0.Store.Write:output_type -> opencloud.services.store.v0.WriteResponse
-	5,  // 14: opencloud.services.store.v0.Store.Delete:output_type -> opencloud.services.store.v0.DeleteResponse
-	7,  // 15: opencloud.services.store.v0.Store.List:output_type -> opencloud.services.store.v0.ListResponse
-	9,  // 16: opencloud.services.store.v0.Store.Databases:output_type -> opencloud.services.store.v0.DatabasesResponse
-	11, // 17: opencloud.services.store.v0.Store.Tables:output_type -> opencloud.services.store.v0.TablesResponse
-	12, // [12:18] is the sub-list for method output_type
-	6,  // [6:12] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
-}
-
-func init() { file_opencloud_services_store_v0_store_proto_init() }
-func file_opencloud_services_store_v0_store_proto_init() {
-	if File_opencloud_services_store_v0_store_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_opencloud_services_store_v0_store_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*WriteResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DatabasesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DatabasesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TablesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_services_store_v0_store_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TablesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_opencloud_services_store_v0_store_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   12,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_opencloud_services_store_v0_store_proto_goTypes,
-		DependencyIndexes: file_opencloud_services_store_v0_store_proto_depIdxs,
-		MessageInfos:      file_opencloud_services_store_v0_store_proto_msgTypes,
-	}.Build()
-	File_opencloud_services_store_v0_store_proto = out.File
-	file_opencloud_services_store_v0_store_proto_rawDesc = nil
-	file_opencloud_services_store_v0_store_proto_goTypes = nil
-	file_opencloud_services_store_v0_store_proto_depIdxs = nil
-}
@@ -1,254 +0,0 @@
-// Code generated by protoc-gen-micro. DO NOT EDIT.
-// source: opencloud/services/store/v0/store.proto
-
-package v0
-
-import (
-	fmt "fmt"
-	_ "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options"
-	_ "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/store/v0"
-	proto "google.golang.org/protobuf/proto"
-	math "math"
-)
-
-import (
-	context "context"
-	api "go-micro.dev/v4/api"
-	client "go-micro.dev/v4/client"
-	server "go-micro.dev/v4/server"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ api.Endpoint
-var _ context.Context
-var _ client.Option
-var _ server.Option
-
-// Api Endpoints for Store service
-
-func NewStoreEndpoints() []*api.Endpoint {
-	return []*api.Endpoint{}
-}
-
-// Client API for Store service
-
-type StoreService interface {
-	Read(ctx context.Context, in *ReadRequest, opts ...client.CallOption) (*ReadResponse, error)
-	Write(ctx context.Context, in *WriteRequest, opts ...client.CallOption) (*WriteResponse, error)
-	Delete(ctx context.Context, in *DeleteRequest, opts ...client.CallOption) (*DeleteResponse, error)
-	List(ctx context.Context, in *ListRequest, opts ...client.CallOption) (Store_ListService, error)
-	Databases(ctx context.Context, in *DatabasesRequest, opts ...client.CallOption) (*DatabasesResponse, error)
-	Tables(ctx context.Context, in *TablesRequest, opts ...client.CallOption) (*TablesResponse, error)
-}
-
-type storeService struct {
-	c    client.Client
-	name string
-}
-
-func NewStoreService(name string, c client.Client) StoreService {
-	return &storeService{
-		c:    c,
-		name: name,
-	}
-}
-
-func (c *storeService) Read(ctx context.Context, in *ReadRequest, opts ...client.CallOption) (*ReadResponse, error) {
-	req := c.c.NewRequest(c.name, "Store.Read", in)
-	out := new(ReadResponse)
-	err := c.c.Call(ctx, req, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *storeService) Write(ctx context.Context, in *WriteRequest, opts ...client.CallOption) (*WriteResponse, error) {
-	req := c.c.NewRequest(c.name, "Store.Write", in)
-	out := new(WriteResponse)
-	err := c.c.Call(ctx, req, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *storeService) Delete(ctx context.Context, in *DeleteRequest, opts ...client.CallOption) (*DeleteResponse, error) {
-	req := c.c.NewRequest(c.name, "Store.Delete", in)
-	out := new(DeleteResponse)
-	err := c.c.Call(ctx, req, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *storeService) List(ctx context.Context, in *ListRequest, opts ...client.CallOption) (Store_ListService, error) {
-	req := c.c.NewRequest(c.name, "Store.List", &ListRequest{})
-	stream, err := c.c.Stream(ctx, req, opts...)
-	if err != nil {
-		return nil, err
-	}
-	if err := stream.Send(in); err != nil {
-		return nil, err
-	}
-	return &storeServiceList{stream}, nil
-}
-
-type Store_ListService interface {
-	Context() context.Context
-	SendMsg(interface{}) error
-	RecvMsg(interface{}) error
-	CloseSend() error
-	Close() error
-	Recv() (*ListResponse, error)
-}
-
-type storeServiceList struct {
-	stream client.Stream
-}
-
-func (x *storeServiceList) CloseSend() error {
-	return x.stream.CloseSend()
-}
-
-func (x *storeServiceList) Close() error {
-	return x.stream.Close()
-}
-
-func (x *storeServiceList) Context() context.Context {
-	return x.stream.Context()
-}
-
-func (x *storeServiceList) SendMsg(m interface{}) error {
-	return x.stream.Send(m)
-}
-
-func (x *storeServiceList) RecvMsg(m interface{}) error {
-	return x.stream.Recv(m)
-}
-
-func (x *storeServiceList) Recv() (*ListResponse, error) {
-	m := new(ListResponse)
-	err := x.stream.Recv(m)
-	if err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *storeService) Databases(ctx context.Context, in *DatabasesRequest, opts ...client.CallOption) (*DatabasesResponse, error) {
-	req := c.c.NewRequest(c.name, "Store.Databases", in)
-	out := new(DatabasesResponse)
-	err := c.c.Call(ctx, req, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *storeService) Tables(ctx context.Context, in *TablesRequest, opts ...client.CallOption) (*TablesResponse, error) {
-	req := c.c.NewRequest(c.name, "Store.Tables", in)
-	out := new(TablesResponse)
-	err := c.c.Call(ctx, req, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// Server API for Store service
-
-type StoreHandler interface {
-	Read(context.Context, *ReadRequest, *ReadResponse) error
-	Write(context.Context, *WriteRequest, *WriteResponse) error
-	Delete(context.Context, *DeleteRequest, *DeleteResponse) error
-	List(context.Context, *ListRequest, Store_ListStream) error
-	Databases(context.Context, *DatabasesRequest, *DatabasesResponse) error
-	Tables(context.Context, *TablesRequest, *TablesResponse) error
-}
-
-func RegisterStoreHandler(s server.Server, hdlr StoreHandler, opts ...server.HandlerOption) error {
-	type store interface {
-		Read(ctx context.Context, in *ReadRequest, out *ReadResponse) error
-		Write(ctx context.Context, in *WriteRequest, out *WriteResponse) error
-		Delete(ctx context.Context, in *DeleteRequest, out *DeleteResponse) error
-		List(ctx context.Context, stream server.Stream) error
-		Databases(ctx context.Context, in *DatabasesRequest, out *DatabasesResponse) error
-		Tables(ctx context.Context, in *TablesRequest, out *TablesResponse) error
-	}
-	type Store struct {
-		store
-	}
-	h := &storeHandler{hdlr}
-	return s.Handle(s.NewHandler(&Store{h}, opts...))
-}
-
-type storeHandler struct {
-	StoreHandler
-}
-
-func (h *storeHandler) Read(ctx context.Context, in *ReadRequest, out *ReadResponse) error {
-	return h.StoreHandler.Read(ctx, in, out)
-}
-
-func (h *storeHandler) Write(ctx context.Context, in *WriteRequest, out *WriteResponse) error {
-	return h.StoreHandler.Write(ctx, in, out)
-}
-
-func (h *storeHandler) Delete(ctx context.Context, in *DeleteRequest, out *DeleteResponse) error {
-	return h.StoreHandler.Delete(ctx, in, out)
-}
-
-func (h *storeHandler) List(ctx context.Context, stream server.Stream) error {
-	m := new(ListRequest)
-	if err := stream.Recv(m); err != nil {
-		return err
-	}
-	return h.StoreHandler.List(ctx, m, &storeListStream{stream})
-}
-
-type Store_ListStream interface {
-	Context() context.Context
-	SendMsg(interface{}) error
-	RecvMsg(interface{}) error
-	Close() error
-	Send(*ListResponse) error
-}
-
-type storeListStream struct {
-	stream server.Stream
-}
-
-func (x *storeListStream) Close() error {
-	return x.stream.Close()
-}
-
-func (x *storeListStream) Context() context.Context {
-	return x.stream.Context()
-}
-
-func (x *storeListStream) SendMsg(m interface{}) error {
-	return x.stream.Send(m)
-}
-
-func (x *storeListStream) RecvMsg(m interface{}) error {
-	return x.stream.Recv(m)
-}
-
-func (x *storeListStream) Send(m *ListResponse) error {
-	return x.stream.Send(m)
-}
-
-func (h *storeHandler) Databases(ctx context.Context, in *DatabasesRequest, out *DatabasesResponse) error {
-	return h.StoreHandler.Databases(ctx, in, out)
-}
-
-func (h *storeHandler) Tables(ctx context.Context, in *TablesRequest, out *TablesResponse) error {
-	return h.StoreHandler.Tables(ctx, in, out)
-}
@@ -1,242 +0,0 @@
-{
-  "swagger": "2.0",
-  "info": {
-    "title": "OpenCloud store",
-    "version": "1.0.0",
-    "contact": {
-      "name": "OpenCloud GmbH",
-      "url": "https://github.com/opencloud-eu/opencloud",
-      "email": "support@opencloud.eu"
-    },
-    "license": {
-      "name": "Apache-2.0",
-      "url": "https://github.com/opencloud-eu/opencloud/blob/main/LICENSE"
-    }
-  },
-  "tags": [
-    {
-      "name": "Store"
-    }
-  ],
-  "schemes": [
-    "http",
-    "https"
-  ],
-  "consumes": [
-    "application/json"
-  ],
-  "produces": [
-    "application/json"
-  ],
-  "paths": {},
-  "definitions": {
-    "protobufAny": {
-      "type": "object",
-      "properties": {
-        "@type": {
-          "type": "string"
-        }
-      },
-      "additionalProperties": {}
-    },
-    "rpcStatus": {
-      "type": "object",
-      "properties": {
-        "code": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "message": {
-          "type": "string"
-        },
-        "details": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/protobufAny"
-          }
-        }
-      }
-    },
-    "v0DatabasesResponse": {
-      "type": "object",
-      "properties": {
-        "databases": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "v0DeleteOptions": {
-      "type": "object",
-      "properties": {
-        "database": {
-          "type": "string"
-        },
-        "table": {
-          "type": "string"
-        }
-      }
-    },
-    "v0DeleteResponse": {
-      "type": "object"
-    },
-    "v0Field": {
-      "type": "object",
-      "properties": {
-        "type": {
-          "type": "string",
-          "title": "type of value e.g string, int, int64, bool, float64"
-        },
-        "value": {
-          "type": "string",
-          "title": "the actual value"
-        }
-      }
-    },
-    "v0ListOptions": {
-      "type": "object",
-      "properties": {
-        "database": {
-          "type": "string"
-        },
-        "table": {
-          "type": "string"
-        },
-        "prefix": {
-          "type": "string"
-        },
-        "suffix": {
-          "type": "string"
-        },
-        "limit": {
-          "type": "string",
-          "format": "uint64"
-        },
-        "offset": {
-          "type": "string",
-          "format": "uint64"
-        }
-      }
-    },
-    "v0ListResponse": {
-      "type": "object",
-      "properties": {
-        "keys": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "v0ReadOptions": {
-      "type": "object",
-      "properties": {
-        "database": {
-          "type": "string"
-        },
-        "table": {
-          "type": "string"
-        },
-        "prefix": {
-          "type": "boolean"
-        },
-        "suffix": {
-          "type": "boolean"
-        },
-        "limit": {
-          "type": "string",
-          "format": "uint64"
-        },
-        "offset": {
-          "type": "string",
-          "format": "uint64"
-        },
-        "where": {
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/v0Field"
-          }
-        }
-      }
-    },
-    "v0ReadResponse": {
-      "type": "object",
-      "properties": {
-        "records": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/v0Record"
-          }
-        }
-      }
-    },
-    "v0Record": {
-      "type": "object",
-      "properties": {
-        "key": {
-          "type": "string",
-          "title": "key of the recorda"
-        },
-        "value": {
-          "type": "string",
-          "format": "byte",
-          "title": "value in the record"
-        },
-        "expiry": {
-          "type": "string",
-          "format": "int64",
-          "title": "time.Duration (signed int64 nanoseconds)"
-        },
-        "metadata": {
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/v0Field"
-          },
-          "title": "the associated metadata"
-        }
-      }
-    },
-    "v0TablesResponse": {
-      "type": "object",
-      "properties": {
-        "tables": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "v0WriteOptions": {
-      "type": "object",
-      "properties": {
-        "database": {
-          "type": "string"
-        },
-        "table": {
-          "type": "string"
-        },
-        "expiry": {
-          "type": "string",
-          "format": "int64",
-          "title": "time.Time"
-        },
-        "ttl": {
-          "type": "string",
-          "format": "int64",
-          "title": "time.Duration"
-        }
-      }
-    },
-    "v0WriteResponse": {
-      "type": "object"
-    }
-  },
-  "externalDocs": {
-    "description": "Developer Manual",
-    "url": "https://docs.opencloud.eu/services/store/"
-  }
-}
@@ -0,0 +1,127 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ThumbnailService_GetThumbnail_FullMethodName = "/opencloud.services.thumbnails.v0.ThumbnailService/GetThumbnail"
+)
+
+// ThumbnailServiceClient is the client API for ThumbnailService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// A Service for handling thumbnail generation
+type ThumbnailServiceClient interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error)
+}
+
+type thumbnailServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewThumbnailServiceClient(cc grpc.ClientConnInterface) ThumbnailServiceClient {
+	return &thumbnailServiceClient{cc}
+}
+
+func (c *thumbnailServiceClient) GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetThumbnailResponse)
+	err := c.cc.Invoke(ctx, ThumbnailService_GetThumbnail_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ThumbnailServiceServer is the server API for ThumbnailService service.
+// All implementations must embed UnimplementedThumbnailServiceServer
+// for forward compatibility.
+//
+// A Service for handling thumbnail generation
+type ThumbnailServiceServer interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error)
+	mustEmbedUnimplementedThumbnailServiceServer()
+}
+
+// UnimplementedThumbnailServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedThumbnailServiceServer struct{}
+
+func (UnimplementedThumbnailServiceServer) GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetThumbnail not implemented")
+}
+func (UnimplementedThumbnailServiceServer) mustEmbedUnimplementedThumbnailServiceServer() {}
+func (UnimplementedThumbnailServiceServer) testEmbeddedByValue()                          {}
+
+// UnsafeThumbnailServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ThumbnailServiceServer will
+// result in compilation errors.
+type UnsafeThumbnailServiceServer interface {
+	mustEmbedUnimplementedThumbnailServiceServer()
+}
+
+func RegisterThumbnailServiceServer(s grpc.ServiceRegistrar, srv ThumbnailServiceServer) {
+	// If the following call panics, it indicates UnimplementedThumbnailServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ThumbnailService_ServiceDesc, srv)
+}
+
+func _ThumbnailService_GetThumbnail_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetThumbnailRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ThumbnailServiceServer).GetThumbnail(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ThumbnailService_GetThumbnail_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ThumbnailServiceServer).GetThumbnail(ctx, req.(*GetThumbnailRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ThumbnailService_ServiceDesc is the grpc.ServiceDesc for ThumbnailService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ThumbnailService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.thumbnails.v0.ThumbnailService",
+	HandlerType: (*ThumbnailServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetThumbnail",
+			Handler:    _ThumbnailService_GetThumbnail_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/thumbnails/v0/thumbnails.proto",
+}
@@ -6,6 +6,12 @@ plugins:
    opt:
      - paths=source_relative

+  - name: go-grpc
+    path: ../../.bingo/protoc-gen-go-grpc
+    out: ../gen/
+    opt:
+      - paths=source_relative
+
  - name: micro
    path: ../../.bingo/protoc-gen-micro
    out: ../gen/
@@ -1,56 +0,0 @@
-syntax = "proto3";
-
-package opencloud.messages.store.v0;
-
-option go_package = "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/store/v0";
-
-message Field {
-	// type of value e.g string, int, int64, bool, float64
-	string type = 1;
-	// the actual value
-	string value = 2;
-}
-
-message Record {
-	// key of the recorda
-	string key = 1;
-	// value in the record
-	bytes value = 2;
-	// time.Duration (signed int64 nanoseconds)
-	int64 expiry = 3;
-	// the associated metadata
-	map<string,Field> metadata = 4;
-}
-
-message ReadOptions {
-	string database = 1;
-	string table = 2;
-	bool prefix   = 3;
-	bool suffix   = 4;
-	uint64 limit  = 5;
-	uint64 offset = 6;
-	map<string,Field> where = 7;
-}
-
-message WriteOptions {
-	string database = 1;
-	string table = 2;
-	// time.Time
-	int64 expiry = 3;
-	// time.Duration
-	int64 ttl = 4;
-}
-
-message DeleteOptions {
-	string database = 1;
-	string table = 2;
-}
-
-message ListOptions {
-	string database = 1;
-	string table = 2;
-	string prefix   = 3;
-	string suffix   = 4;
-	uint64 limit  = 5;
-	uint64 offset = 6;
-}
@@ -1,87 +0,0 @@
-syntax = "proto3";
-
-package opencloud.services.store.v0;
-
-option go_package = "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/service/store/v0";
-
-import "opencloud/messages/store/v0/store.proto";
-import "protoc-gen-openapiv2/options/annotations.proto";
-
-option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
-  info: {
-    title: "OpenCloud store";
-    version: "1.0.0";
-    contact: {
-      name: "OpenCloud GmbH";
-      url: "https://github.com/opencloud-eu/opencloud";
-      email: "support@opencloud.eu";
-    };
-    license: {
-      name: "Apache-2.0";
-      url: "https://github.com/opencloud-eu/opencloud/blob/main/LICENSE";
-    };
-  };
-  schemes: HTTP;
-  schemes: HTTPS;
-  consumes: "application/json";
-  produces: "application/json";
-  external_docs: {
-    description: "Developer Manual";
-    url: "https://docs.opencloud.eu/services/store/";
-  };
-};
-
-service Store {
-	rpc Read(ReadRequest) returns (ReadResponse) {};
-	rpc Write(WriteRequest) returns (WriteResponse) {};
-	rpc Delete(DeleteRequest) returns (DeleteResponse) {};
-	rpc List(ListRequest) returns (stream ListResponse) {};
-	rpc Databases(DatabasesRequest) returns (DatabasesResponse) {};
-	rpc Tables(TablesRequest) returns (TablesResponse) {};
-}
-
-message ReadRequest {
-	string key                                 = 1;
-	opencloud.messages.store.v0.ReadOptions options = 2;
-}
-
-message ReadResponse {
-	repeated opencloud.messages.store.v0.Record records = 1;
-}
-
-message WriteRequest {
-	opencloud.messages.store.v0.Record record        = 1;
-	opencloud.messages.store.v0.WriteOptions options = 2;
-}
-
-message WriteResponse {}
-
-message DeleteRequest {
-	string key                                   = 1;
-	opencloud.messages.store.v0.DeleteOptions options = 2;
-}
-
-message DeleteResponse {}
-
-message ListRequest {
-	opencloud.messages.store.v0.ListOptions options = 1;
-}
-
-message ListResponse {
-	reserved 1; //repeated Record records = 1;
-	repeated string keys = 2;
-}
-
-message DatabasesRequest {}
-
-message DatabasesResponse {
-	repeated string databases = 1;
-}
-
-message TablesRequest {
-	string database = 1;
-}
-
-message TablesResponse {
-	repeated string tables = 1;
-}
@@ -4,8 +4,8 @@ import (
 	"context"
 	"fmt"

-	"github.com/oklog/run"
 	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/pkg/runner"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
@@ -62,7 +62,7 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}

-			gr := run.Group{}
+			gr := runner.NewGroup()
 			ctx, cancel := context.WithCancel(cmd.Context())

 			mtrcs := metrics.New()
@@ -132,23 +132,7 @@ func Server(cfg *config.Config) *cobra.Command {
 					return err
 				}

-				gr.Add(func() error {
-					return svc.Run()
-				}, func(err error) {
-					if err == nil {
-						logger.Info().
-							Str("transport", "http").
-							Str("server", cfg.Service.Name).
-							Msg("Shutting down server")
-					} else {
-						logger.Error().Err(err).
-							Str("transport", "http").
-							Str("server", cfg.Service.Name).
-							Msg("Shutting down server")
-					}
-
-					cancel()
-				})
+				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", svc))
 			}

 			{
@@ -162,13 +146,18 @@ func Server(cfg *config.Config) *cobra.Command {
 					return err
 				}

-				gr.Add(debugServer.ListenAndServe, func(_ error) {
-					_ = debugServer.Shutdown(ctx)
-					cancel()
-				})
+				gr.Add(runner.NewGolangHttpServerRunner(cfg.Service.Name+".debug", debugServer))
 			}

-			return gr.Run()
+			grResults := gr.Run(ctx)
+
+			// return the first non-nil error found in the results
+			for _, grResult := range grResults {
+				if grResult.RunnerError != nil {
+					return grResult.RunnerError
+				}
+			}
+			return nil
 		},
 	}
 }
@@ -63,7 +63,7 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 		"tags":              true,
 		"archivers":         archivers,
 		"app_providers":     appProviders,
-		"favorites":         true,
+		"favorites":         false,
 		"full_text_search":  cfg.FullTextSearch,
 	}

@@ -51,7 +51,8 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]a
 					"ocminvitemanagersvc":           cfg.OCMEndpoint,
 					"ocmproviderauthorizersvc":      cfg.OCMEndpoint,
 					"ocmcoresvc":                    cfg.OCMEndpoint,
-					"commit_share_to_storage_grant": cfg.CommitShareToStorageGrant,
+					"use_common_space_root_share_logic": true,
+				"commit_share_to_storage_grant":    cfg.CommitShareToStorageGrant,
 					"share_folder":                  cfg.ShareFolder, // ShareFolder is the location where to create shares in the recipient's storage provider.
 					// other
 					"disable_home_creation_on_login": cfg.DisableHomeCreationOnLogin,
@@ -1137,7 +1137,7 @@ func (i *LDAP) expandLDAPAttributeEntries(ctx context.Context, e *ldap.Entry, at
 		ue, err := i.getUserByDN(entryDN, searchTerm)
 		if err != nil {
 			// Ignore errors when reading a specific entry fails, just log them and continue
-			logger.Debug().Err(err).Str("entry", entryDN).Msg("error reading attribute member entry")
+			logger.Warn().Err(err).Str("entry", entryDN).Msg("error reading attribute member entry")
 			continue
 		}
 		result = append(result, ue)
@@ -3,6 +3,7 @@ package svc
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/url"
 	"slices"
@@ -91,6 +92,10 @@ type ListPermissionsQueryOptions struct {

 // NewDriveItemPermissionsService creates a new DriveItemPermissionsService
 func NewDriveItemPermissionsService(logger log.Logger, gatewaySelector pool.Selectable[gateway.GatewayAPIClient], identityCache cache.IdentityCache, config *config.Config) (DriveItemPermissionsService, error) {
+	publicBaseURL, err := url.Parse(config.Spaces.WebDavBase)
+	if err != nil {
+		return DriveItemPermissionsService{}, fmt.Errorf("could not parse graph.spaces.webdav_base: %w", err)
+	}
 	return DriveItemPermissionsService{
 		BaseGraphService: BaseGraphService{
 			logger:          &log.Logger{Logger: logger.With().Str("graph api", "DrivesDriveItemService").Logger()},
@@ -98,6 +103,7 @@ func NewDriveItemPermissionsService(logger log.Logger, gatewaySelector pool.Sele
 			identityCache:   identityCache,
 			config:          config,
 			availableRoles:  unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(config.UnifiedRoles.AvailableRoles...)),
+			publicBaseURL:   publicBaseURL,
 		},
 	}, nil
 }
@@ -245,10 +251,6 @@ func (s DriveItemPermissionsService) Invite(ctx context.Context, resourceId *sto

 	if shareid != "" {
 		permission.Id = conversions.ToPointer(shareid)
-	} else if IsSpaceRoot(statResponse.GetInfo().GetId()) {
-		// permissions on a space root are not handled by a share manager so
-		// they don't get a share-id
-		permission.SetId(identitySetToSpacePermissionID(permission.GetGrantedToV2()))
 	}

 	if expiration != nil {
@@ -405,7 +407,7 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID

 	driveItems := make(driveItemsByResourceID, 1)
 	// we can use the statResponse to build the drive item before fetching the shares
-	item, err := cs3ResourceToDriveItem(s.logger, statResponse.GetInfo())
+	item, err := cs3ResourceToDriveItem(s.logger, s.publicBaseURL, statResponse.GetInfo())
 	if err != nil {
 		return collectionOfPermissions, err
 	}
@@ -414,12 +416,12 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 	var permissionsCount int

 	if IsSpaceRoot(statResponse.GetInfo().GetId()) {
-		var permissions []libregraph.Permission
-		permissions, permissionsCount, err = s.getSpaceRootPermissions(ctx, statResponse.GetInfo().GetSpace().GetId(), queryOptions.NoValues)
+		driveItems, err = s.listSpaceRootUserShares(ctx, []*collaboration.Filter{
+			share.ResourceIDFilter(itemID),
+		}, driveItems)
 		if err != nil {
 			return collectionOfPermissions, err
 		}
-		collectionOfPermissions.Value = permissions
 	} else {
 		// "normal" driveItem, populate user  permissions via share providers
 		driveItems, err = s.listUserShares(ctx, []*collaboration.Filter{
@@ -535,12 +537,10 @@ func (s DriveItemPermissionsService) DeletePermission(ctx context.Context, itemI
 	}

 	switch permissionType {
-	case User:
+	case User, Space:
 		return s.removeUserShare(ctx, permissionID)
 	case Public:
 		return s.removePublicShare(ctx, permissionID)
-	case Space:
-		return s.removeSpacePermission(ctx, permissionID, sharedResourceID)
 	case OCM:
 		return s.removeOCMPermission(ctx, permissionID)
 	default:
@@ -24,7 +24,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/stretchr/testify/mock"
 	"github.com/tidwall/gjson"
-	"google.golang.org/grpc"

 	roleconversions "github.com/opencloud-eu/reva/v2/pkg/conversions"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
@@ -391,6 +390,25 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
 		})
+		It("sends SpaceRootFilter(false) when listing shares for a non-space-root item", func() {
+			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
+			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
+			gatewayClient.On("ListShares",
+				mock.Anything,
+				mock.MatchedBy(func(req *collaboration.ListSharesRequest) bool {
+					for _, f := range req.Filters {
+						if f.Type == collaboration.Filter_TYPE_SPACE_ROOT && !f.GetSpaceRoot() {
+							return true
+						}
+					}
+					return false
+				}),
+			).Return(listSharesResponse, nil)
+
+			_, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, svc.ListPermissionsQueryOptions{})
+			Expect(err).ToNot(HaveOccurred())
+			gatewayClient.AssertExpectations(GinkgoT())
+		})
 		It("returns one permission per share", func() {
 			statResponse.Info.PermissionSet = roleconversions.NewEditorRole().CS3ResourcePermissions()
 			listSharesResponse.Shares = []*collaboration.Share{
@@ -442,6 +460,8 @@ var _ = Describe("DriveItemPermissionsService", func() {
 		})
 		It("returns role denied", func() {
 			statResponse.Info.PermissionSet = roleconversions.NewManagerRole().CS3ResourcePermissions()
+			statResponse.Info.Type = provider.ResourceType_RESOURCE_TYPE_CONTAINER
+
 			listSharesResponse.Shares = []*collaboration.Share{
 				{
 					Id: &collaboration.ShareId{OpaqueId: "1"},
@@ -666,6 +686,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			}

 			gatewayClient.On("ListStorageSpaces", mock.Anything, mock.Anything).Return(listSpacesResponse, nil)
+			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(&collaboration.ListSharesResponse{Status: status.NewOK(ctx)}, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
 			statResponse.Info.Id = listSpacesResponse.StorageSpaces[0].Root
 			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
@@ -765,12 +786,10 @@ var _ = Describe("DriveItemPermissionsService", func() {

 			gatewayClient.On("RemoveShare",
 				mock.Anything,
-				mock.Anything,
-			).Return(func(ctx context.Context, in *collaboration.RemoveShareRequest, opts ...grpc.CallOption) (*collaboration.RemoveShareResponse, error) {
-				Expect(in.Ref.GetKey()).ToNot(BeNil())
-				Expect(in.Ref.GetKey().GetGrantee().GetUserId().GetOpaqueId()).To(Equal("userid"))
-				return &collaboration.RemoveShareResponse{Status: status.NewOK(ctx)}, nil
-			})
+				mock.MatchedBy(func(req *collaboration.RemoveShareRequest) bool {
+					return req.GetRef().GetId().GetOpaqueId() == "shareid"
+				}),
+			).Return(&collaboration.RemoveShareResponse{Status: status.NewOK(ctx)}, nil)

 			err := driveItemPermissionsService.DeletePermission(context.Background(),
 				&provider.ResourceId{
@@ -778,7 +797,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 					SpaceId:   "2",
 					OpaqueId:  "2",
 				},
-				"u:userid",
+				"shareid",
 			)
 			Expect(err).ToNot(HaveOccurred())
 		})
@@ -1045,24 +1064,40 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			Expect(res).To(BeZero())
 		})
 		It("fails to update the space permissions for a space share when setting a file specific role", func() {
-			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
 			getPublicShareMockResponse.Share = nil
 			getPublicShareMockResponse.Status = status.NewNotFound(ctx, "not found")
 			gatewayClient.On("GetPublicShare", mock.Anything, mock.Anything).Return(getPublicShareMockResponse, nil)

-			gatewayClient.On("ListStorageSpaces", mock.Anything, mock.Anything).Return(listSpacesResponse, nil)
-
-			statResponse.Info.Id = listSpacesResponse.StorageSpaces[0].Root
-			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
-			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
-
-			driveItemPermission.SetRoles([]string{unifiedrole.UnifiedRoleFileEditorID})
 			spaceId := &provider.ResourceId{
 				StorageId: "1",
 				SpaceId:   "2",
 				OpaqueId:  "2",
 			}
-			res, err := driveItemPermissionsService.UpdatePermission(ctx, spaceId, "u:userid", driveItemPermission)
+			statResponse.Info.Id = spaceId
+			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
+
+			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(&collaboration.ListSharesResponse{
+				Status: status.NewOK(ctx),
+				Shares: []*collaboration.Share{
+					{
+						Id:         &collaboration.ShareId{OpaqueId: "spaceShareId"},
+						ResourceId: spaceId,
+						Grantee: &provider.Grantee{
+							Type: provider.GranteeType_GRANTEE_TYPE_USER,
+							Id: &provider.Grantee_UserId{
+								UserId: &userpb.UserId{OpaqueId: "userid"},
+							},
+						},
+						Permissions: &collaboration.SharePermissions{
+							Permissions: roleconversions.NewSpaceViewerRole().CS3ResourcePermissions(),
+						},
+					},
+				},
+			}, nil)
+			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
+
+			driveItemPermission.SetRoles([]string{unifiedrole.UnifiedRoleFileEditorID})
+			res, err := driveItemPermissionsService.UpdatePermission(ctx, spaceId, "spaceShareId", driveItemPermission)
 			Expect(err).To(MatchError(errorcode.New(errorcode.InvalidRequest, "role not applicable to this resource")))
 			Expect(res).To(BeZero())
 		})
@@ -49,22 +49,7 @@ type BaseGraphService struct {
 	identityCache   cache.IdentityCache
 	config          *config.Config
 	availableRoles  []*libregraph.UnifiedRoleDefinition
-}
-
-func (g BaseGraphService) getSpaceRootPermissions(ctx context.Context, spaceID *storageprovider.StorageSpaceId, countOnly bool) ([]libregraph.Permission, int, error) {
-	gatewayClient, err := g.gatewaySelector.Next()
-
-	if err != nil {
-		g.logger.Debug().Err(err).Msg("selecting gatewaySelector failed")
-		return nil, 0, err
-	}
-	space, err := utils.GetSpace(ctx, spaceID.GetOpaqueId(), gatewayClient)
-	if err != nil {
-		return nil, 0, errorcode.FromUtilsStatusCodeError(err)
-	}
-
-	perm, count := g.cs3SpacePermissionsToLibreGraph(ctx, space, countOnly, APIVersion_1_Beta_1)
-	return perm, count, nil
+	publicBaseURL   *url.URL
 }

 func (g BaseGraphService) getDriveItem(ctx context.Context, ref *storageprovider.Reference) (*libregraph.DriveItem, error) {
@@ -81,7 +66,7 @@ func (g BaseGraphService) getDriveItem(ctx context.Context, ref *storageprovider
 		refStr, _ := storagespace.FormatReference(ref)
 		return nil, fmt.Errorf("could not stat %s: %s", refStr, res.GetStatus().GetMessage())
 	}
-	return cs3ResourceToDriveItem(g.logger, res.GetInfo())
+	return cs3ResourceToDriveItem(g.logger, g.publicBaseURL, res.GetInfo())
 }

 func (g BaseGraphService) CS3ReceivedSharesToDriveItems(ctx context.Context, receivedShares []*collaboration.ReceivedShare) ([]libregraph.DriveItem, error) {
@@ -269,6 +254,17 @@ func (g BaseGraphService) libreGraphPermissionFromCS3PublicShare(createdLink *li
 }

 func (g BaseGraphService) listUserShares(ctx context.Context, filters []*collaboration.Filter, driveItems driveItemsByResourceID) (driveItemsByResourceID, error) {
+	return g.listSharesWithSpaceRootFilter(ctx, false, filters, driveItems)
+}
+
+// listSpaceRootUserShares lists user/group shares whose resource is a space root (i.e. space
+// memberships). It uses SpaceRootFilter(true) so only space-root shares are returned, mirroring
+// how listUserShares works for regular file/folder shares.
+func (g BaseGraphService) listSpaceRootUserShares(ctx context.Context, filters []*collaboration.Filter, driveItems driveItemsByResourceID) (driveItemsByResourceID, error) {
+	return g.listSharesWithSpaceRootFilter(ctx, true, filters, driveItems)
+}
+
+func (g BaseGraphService) listSharesWithSpaceRootFilter(ctx context.Context, spaceRoot bool, filters []*collaboration.Filter, driveItems driveItemsByResourceID) (driveItemsByResourceID, error) {
 	gatewayClient, err := g.gatewaySelector.Next()
 	if err != nil {
 		g.logger.Error().Err(err).Msg("could not select next gateway client")
@@ -278,6 +274,7 @@ func (g BaseGraphService) listUserShares(ctx context.Context, filters []*collabo
 	concreteFilters := []*collaboration.Filter{
 		share.UserGranteeFilter(),
 		share.GroupGranteeFilter(),
+		share.SpaceRootFilter(spaceRoot),
 	}
 	concreteFilters = append(concreteFilters, filters...)

@@ -562,9 +559,7 @@ func (g BaseGraphService) cs3OCMSharesToDriveItems(ctx context.Context, shares [
 func (g BaseGraphService) cs3UserShareToPermission(ctx context.Context, share *collaboration.Share, roleCondition string) (*libregraph.Permission, error) {
 	perm := libregraph.Permission{}
 	perm.SetRoles([]string{})
-	if roleCondition != unifiedrole.UnifiedRoleConditionDrive {
-		perm.SetId(share.GetId().GetOpaqueId())
-	}
+	perm.SetId(share.GetId().GetOpaqueId())
 	grantedTo := libregraph.SharePointIdentitySet{}
 	switch share.GetGrantee().GetType() {
 	case storageprovider.GranteeType_GRANTEE_TYPE_USER:
@@ -578,9 +573,6 @@ func (g BaseGraphService) cs3UserShareToPermission(ctx context.Context, share *c
 			return nil, errorcode.New(errorcode.GeneralException, err.Error())
 		default:
 			grantedTo.SetUser(user)
-			if roleCondition == unifiedrole.UnifiedRoleConditionDrive {
-				perm.SetId("u:" + user.GetId())
-			}
 		}
 	case storageprovider.GranteeType_GRANTEE_TYPE_GROUP:
 		group, err := groupIdToIdentity(ctx, g.identityCache, share.Grantee.GetGroupId().GetOpaqueId())
@@ -593,9 +585,6 @@ func (g BaseGraphService) cs3UserShareToPermission(ctx context.Context, share *c
 			return nil, errorcode.New(errorcode.GeneralException, err.Error())
 		default:
 			grantedTo.SetGroup(group)
-			if roleCondition == unifiedrole.UnifiedRoleConditionDrive {
-				perm.SetId("g:" + group.GetId())
-			}
 		}
 	}

@@ -926,35 +915,6 @@ func (g BaseGraphService) removeUserShare(ctx context.Context, permissionID stri
 	return nil
 }

-func (g BaseGraphService) removeSpacePermission(ctx context.Context, permissionID string, resourceId *storageprovider.ResourceId) error {
-	grantee, err := spacePermissionIdToCS3Grantee(permissionID)
-	if err != nil {
-		return err
-	}
-
-	gatewayClient, err := g.gatewaySelector.Next()
-	if err != nil {
-		g.logger.Debug().Err(err).Msg("selecting gatewaySelector failed")
-		return err
-	}
-	removeShareResp, err := gatewayClient.RemoveShare(ctx, &collaboration.RemoveShareRequest{
-		Ref: &collaboration.ShareReference{
-			Spec: &collaboration.ShareReference_Key{
-				Key: &collaboration.ShareKey{
-					ResourceId: resourceId,
-					Grantee:    &grantee,
-				},
-			},
-		},
-	})
-	if err := errorcode.FromCS3Status(removeShareResp.GetStatus(), err); err != nil {
-		return err
-	}
-
-	// We need to return an untyped nil here otherwise the error==nil check won't work
-	return nil
-}
-
 func (g BaseGraphService) getOCMPermissionResourceID(ctx context.Context, permissionID string) (*storageprovider.ResourceId, error) {
 	cs3Share, err := g.getCS3OCMShareByID(ctx, permissionID)
 	if err != nil {
@@ -1070,20 +1030,19 @@ func (g BaseGraphService) getPermissionByID(ctx context.Context, permissionID st
 		}
 		return permission, publicShare.GetResourceId(), nil
 	case IsSpaceRoot(itemID):
-		// itemID is referencing a spaceroot this is a space permission. Handle
-		// that here and get space id
-		resourceInfo, err := utils.GetResourceByID(ctx, itemID, gatewayClient)
+		// itemID is referencing a space root — use the share manager to look up the permission
+		driveItems := make(driveItemsByResourceID)
+		driveItems, err = g.listSpaceRootUserShares(ctx, []*collaboration.Filter{
+			share.ResourceIDFilter(itemID),
+		}, driveItems)
 		if err != nil {
 			return nil, nil, err
 		}
-
-		perms, _, err := g.getSpaceRootPermissions(ctx, resourceInfo.GetSpace().GetId(), false)
-		if err != nil {
-			return nil, nil, err
-		}
-		for _, p := range perms {
-			if p.GetId() == permissionID {
-				return &p, itemID, nil
+		for _, item := range driveItems {
+			for i := range item.Permissions {
+				if item.Permissions[i].GetId() == permissionID {
+					return &item.Permissions[i], itemID, nil
+				}
 			}
 		}
 	case errors.As(err, &errcode) && errcode.GetCode() == errorcode.ItemNotFound:
@@ -1238,29 +1197,10 @@ func (g BaseGraphService) updateUserShare(ctx context.Context, permissionID stri
 	}

 	var cs3UpdateShareReq collaboration.UpdateShareRequest
-	// When updating a space root we need to reference the share by resourceId and grantee
-	if IsSpaceRoot(itemID) {
-		grantee, err := spacePermissionIdToCS3Grantee(permissionID)
-		if err != nil {
-			g.logger.Debug().Err(err).Str("permissionid", permissionID).Msg("failed to parse space permission id")
-			return nil, err
-		}
-		cs3UpdateShareReq.Share = &collaboration.Share{
-			ResourceId: itemID,
-			Grantee:    &grantee,
-		}
-		cs3UpdateShareReq.Opaque = &types.Opaque{
-			Map: map[string]*types.OpaqueEntry{
-				"spacegrant": {},
-			},
-		}
-		cs3UpdateShareReq.Opaque = utils.AppendPlainToOpaque(cs3UpdateShareReq.Opaque, "spacetype", _spaceTypeProject)
-	} else {
-		cs3UpdateShareReq.Share = &collaboration.Share{
-			Id: &collaboration.ShareId{
-				OpaqueId: permissionID,
-			},
-		}
+	cs3UpdateShareReq.Share = &collaboration.Share{
+		Id: &collaboration.ShareId{
+			OpaqueId: permissionID,
+		},
 	}
 	fieldmask := []string{}
 	if expiration, ok := newPermission.GetExpirationDateTimeOk(); ok {
@@ -15,8 +15,6 @@ import (
 	"time"

 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	grouppb "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
-	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
@@ -206,7 +204,7 @@ func (g Graph) GetRootDriveChildren(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	files, err := formatDriveItems(g.logger, lRes.GetInfos())
+	files, err := formatDriveItems(g.logger, g.publicBaseURL, lRes.GetInfos())
 	if err != nil {
 		g.logger.Error().Err(err).Msg("error encoding response as json")
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
@@ -271,7 +269,7 @@ func (g Graph) GetDriveItem(w http.ResponseWriter, r *http.Request) {
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, res.GetStatus().GetMessage())
 		return
 	}
-	driveItem, err := cs3ResourceToDriveItem(g.logger, res.GetInfo())
+	driveItem, err := cs3ResourceToDriveItem(g.logger, g.publicBaseURL, res.GetInfo())
 	if err != nil {
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
 		return
@@ -339,7 +337,7 @@ func (g Graph) GetDriveItemChildren(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	files, err := formatDriveItems(g.logger, res.GetInfos())
+	files, err := formatDriveItems(g.logger, g.publicBaseURL, res.GetInfos())
 	if err != nil {
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
 		return
@@ -349,35 +347,6 @@ func (g Graph) GetDriveItemChildren(w http.ResponseWriter, r *http.Request) {
 	render.JSON(w, r, &ListResponse{Value: files})
 }

-func spacePermissionIdToCS3Grantee(permissionID string) (storageprovider.Grantee, error) {
-	// the permission ID for space permission is made of two parts
-	// the grantee type ('u' or user, 'g' for group) and the user or group id
-	var grantee storageprovider.Grantee
-	parts := strings.SplitN(permissionID, ":", 2)
-	if len(parts) != 2 {
-		return grantee, errorcode.New(errorcode.InvalidRequest, "invalid space permission id")
-	}
-	switch parts[0] {
-	case "u":
-		grantee.Type = storageprovider.GranteeType_GRANTEE_TYPE_USER
-		grantee.Id = &storageprovider.Grantee_UserId{
-			UserId: &userpb.UserId{
-				OpaqueId: parts[1],
-			},
-		}
-	case "g":
-		grantee.Type = storageprovider.GranteeType_GRANTEE_TYPE_GROUP
-		grantee.Id = &storageprovider.Grantee_GroupId{
-			GroupId: &grouppb.GroupId{
-				OpaqueId: parts[1],
-			},
-		}
-	default:
-		return grantee, errorcode.New(errorcode.InvalidRequest, "invalid space permission id")
-	}
-	return grantee, nil
-}
-
 func (g Graph) getRemoteItem(ctx context.Context, root *storageprovider.ResourceId, baseURL *url.URL) (*libregraph.RemoteItem, error) {
 	gatewayClient, err := g.gatewaySelector.Next()
 	if err != nil {
@@ -416,10 +385,10 @@ func (g Graph) getRemoteItem(ctx context.Context, root *storageprovider.Resource
 	return item, nil
 }

-func formatDriveItems(logger *log.Logger, mds []*storageprovider.ResourceInfo) ([]*libregraph.DriveItem, error) {
+func formatDriveItems(logger *log.Logger, publicBaseURL *url.URL, mds []*storageprovider.ResourceInfo) ([]*libregraph.DriveItem, error) {
 	responses := make([]*libregraph.DriveItem, 0, len(mds))
 	for i := range mds {
-		res, err := cs3ResourceToDriveItem(logger, mds[i])
+		res, err := cs3ResourceToDriveItem(logger, publicBaseURL, mds[i])
 		if err != nil {
 			return nil, err
 		}
@@ -433,7 +402,7 @@ func cs3TimestampToTime(t *types.Timestamp) time.Time {
 	return time.Unix(int64(t.GetSeconds()), int64(t.GetNanos()))
 }

-func cs3ResourceToDriveItem(logger *log.Logger, res *storageprovider.ResourceInfo) (*libregraph.DriveItem, error) {
+func cs3ResourceToDriveItem(logger *log.Logger, publicBaseURL *url.URL, res *storageprovider.ResourceInfo) (*libregraph.DriveItem, error) {
 	size := new(int64)
 	*size = int64(res.GetSize()) // TODO lurking overflow: make size of libregraph drive item use uint64

@@ -442,6 +411,10 @@ func cs3ResourceToDriveItem(logger *log.Logger, res *storageprovider.ResourceInf
 		Size: size,
 	}

+	webURL := *publicBaseURL
+	webURL.Path = path.Join(webURL.Path, "f", storagespace.FormatResourceID(res.GetId()))
+	driveItem.WebUrl = libregraph.PtrString(webURL.String())
+
 	if name := path.Base(res.GetPath()); name != "" {
 		driveItem.Name = &name
 	}
@@ -461,14 +434,22 @@ func cs3ResourceToDriveItem(logger *log.Logger, res *storageprovider.ResourceInf
 		parentRef.SetPath(path.Dir(res.GetPath()))
 		driveItem.ParentReference = parentRef
 	}
-	if res.GetType() == storageprovider.ResourceType_RESOURCE_TYPE_FILE && res.GetMimeType() != "" {
+	switch res.GetType() {
+	case storageprovider.ResourceType_RESOURCE_TYPE_FILE:
+		mimeType := res.GetMimeType()
+		if mimeType == "" {
+			mimeType = "application/octet-stream"
+		}
 		// We cannot use a libregraph.File here because the openapi codegenerator autodetects 'File' as a go type ...
 		driveItem.File = &libregraph.OpenGraphFile{
-			MimeType: &res.MimeType,
+			MimeType: &mimeType,
+		}
+	case storageprovider.ResourceType_RESOURCE_TYPE_CONTAINER:
+		if IsSpaceRoot(res.GetId()) {
+			driveItem.SetRoot(map[string]any{})
+		} else {
+			driveItem.SetFolder(libregraph.Folder{})
 		}
-	}
-	if res.GetType() == storageprovider.ResourceType_RESOURCE_TYPE_CONTAINER {
-		driveItem.Folder = &libregraph.Folder{}
 	}

 	if res.GetArbitraryMetadata() != nil {
@@ -0,0 +1,44 @@
+package svc
+
+import (
+	"net/url"
+	"testing"
+
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+)
+
+func TestCS3ResourceToDriveItemPopulatesWebUrl(t *testing.T) {
+	logger := log.NewLogger()
+	res := &provider.ResourceInfo{
+		Id: &provider.ResourceId{
+			StorageId: "storage-1",
+			SpaceId:   "space-1",
+			OpaqueId:  "item-1",
+		},
+		Type: provider.ResourceType_RESOURCE_TYPE_CONTAINER,
+	}
+
+	t.Run("public base URL without path", func(t *testing.T) {
+		base, err := url.Parse("https://example.com")
+		require.NoError(t, err)
+
+		item, err := cs3ResourceToDriveItem(&logger, base, res)
+		require.NoError(t, err)
+		require.NotNil(t, item.WebUrl)
+		assert.Equal(t, "https://example.com/f/storage-1$space-1%21item-1", *item.WebUrl)
+	})
+
+	t.Run("public base URL with path prefix", func(t *testing.T) {
+		base, err := url.Parse("https://example.com/cloud")
+		require.NoError(t, err)
+
+		item, err := cs3ResourceToDriveItem(&logger, base, res)
+		require.NoError(t, err)
+		require.NotNil(t, item.WebUrl)
+		assert.Equal(t, "https://example.com/cloud/f/storage-1$space-1%21item-1", *item.WebUrl)
+	})
+}
@@ -94,7 +94,7 @@ func (g Graph) FollowDriveItem(w http.ResponseWriter, r *http.Request) {
 		}
 	}

-	driveItem, err := cs3ResourceToDriveItem(g.logger, statRes.GetInfo())
+	driveItem, err := cs3ResourceToDriveItem(g.logger, g.publicBaseURL, statRes.GetInfo())
 	if err != nil {
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
 		return
@@ -9,8 +9,8 @@ import (
 	"strings"

 	"github.com/CiscoM31/godata"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"

 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
@@ -250,7 +250,7 @@ func (g Graph) GetGroup(w http.ResponseWriter, r *http.Request) {
 		Msg("calling get group on backend")
 	group, err := g.identityBackend.GetGroup(r.Context(), groupID, r.URL.Query())
 	if err != nil {
-		logger.Debug().Err(err).Msg("could not get group: backend error")
+		logger.Error().Err(err).Msg("could not get group: backend error")
 		errorcode.RenderError(w, r, err)
 		return
 	}
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -154,12 +155,18 @@ func NewService(opts ...Option) (Graph, error) { //nolint:maintidx
 		cache.IdentityCacheWithGroupsTTL(time.Duration(options.Config.Spaces.GroupsCacheTTL)),
 	)

+	publicBaseURL, err := url.Parse(options.Config.Spaces.WebDavBase)
+	if err != nil {
+		return Graph{}, fmt.Errorf("could not parse graph.spaces.webdav_base: %w", err)
+	}
+
 	baseGraphService := BaseGraphService{
 		logger:          &options.Logger,
 		identityCache:   identityCache,
 		gatewaySelector: options.GatewaySelector,
 		config:          options.Config,
 		availableRoles:  unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(options.Config.UnifiedRoles.AvailableRoles...)),
+		publicBaseURL:   publicBaseURL,
 	}

 	drivesDriveItemService, err := NewDrivesDriveItemService(options.Logger, options.GatewaySelector)
@@ -10,6 +10,7 @@ import (
 	ocm "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
 	"github.com/go-chi/render"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/share"

 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/thumbnails/pkg/thumbnail"
@@ -41,7 +42,11 @@ func (g Graph) listSharedWithMe(ctx context.Context, expandThumbnails bool) ([]l
 		return nil, err
 	}

-	listReceivedSharesResponse, err := gatewayClient.ListReceivedShares(ctx, &collaboration.ListReceivedSharesRequest{})
+	listReceivedSharesResponse, err := gatewayClient.ListReceivedShares(ctx, &collaboration.ListReceivedSharesRequest{
+		Filters: []*collaboration.Filter{
+			share.SpaceRootFilter(false),
+		},
+	})
 	if err := errorcode.FromCS3Status(listReceivedSharesResponse.GetStatus(), err); err != nil {
 		g.logger.Error().Err(err).Msg("listing shares failed")
 		return nil, err
@@ -36,7 +36,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/userstate"
-	ocsettingssvc "github.com/opencloud-eu/opencloud/services/settings/pkg/service/v0"
 	"github.com/opencloud-eu/opencloud/services/settings/pkg/store/defaults"
 )

@@ -421,10 +420,10 @@ func (g Graph) PostUser(w http.ResponseWriter, r *http.Request) {
 		// to all new users for now, as create Account request does not have any role field
 		if _, err = g.roleService.AssignRoleToUser(r.Context(), &settingssvc.AssignRoleToUserRequest{
 			AccountUuid: *u.Id,
-			RoleId:      ocsettingssvc.BundleUUIDRoleUser,
+			RoleId:      defaults.BundleUUIDRoleUser,
 		}); err != nil {
 			// log as error, admin eventually needs to do something
-			logger.Error().Err(err).Str("id", *u.Id).Str("role", ocsettingssvc.BundleUUIDRoleUser).Msg("could not create user: role assignment failed")
+			logger.Error().Err(err).Str("id", *u.Id).Str("role", defaults.BundleUUIDRoleUser).Msg("could not create user: role assignment failed")
 			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "role assignment failed")
 			return
 		}
@@ -6,4 +6,16 @@ It is mainly targeted at small OpenCloud installations. For larger setups it is

 IDM listens on port 9235 by default. In the default configuration it only accepts TLS-protected connections (LDAPS). The BaseDN of the LDAP tree is `o=libregraph-idm`. IDM gives LDAP write permissions to a single user (DN: `uid=libregraph,ou=sysusers,o=libregraph-idm`). Any other authenticated user has read-only access. IDM stores its data in a boltdb file `idm/idm.boltdb` inside the OpenCloud base data directory.

+The internal LDAP certificate and key are stored as `ldap.crt` and `ldap.key` in the IDM data directory. By default, these certificates expire after 12 months. When the certificate has expired, IDM can no longer establish valid TLS connections and requests that depend on LDAP may fail with `500 Internal Server Error`.
+
+To renew the internal LDAP certificate, stop or restart the OpenCloud container after deleting the expired certificate and key:
+
+```bash
+cd .opencloud/idm
+rm ldap.crt ldap.key
+docker compose restart
+```
+
+The certificate and key are automatically regenerated when the container starts again. For more details, see [Internal LibreIDM cert expires](https://docs.opencloud.eu/docs/admin/resources/common-issues/#internal-libreidm-cert-expires).
+
 Note: IDM is limited in its functionality. It only supports a subset of the LDAP operations (namely `BIND`, `SEARCH`, `ADD`, `MODIFY`, `DELETE`). Also, IDM currently does not do any schema verification (like. structural vs. auxiliary object classes, require and option attributes, syntax checks, …). Therefore it is not meant as a general purpose LDAP server.
@@ -30,13 +30,13 @@
  },
  "dependencies": {
    "@material-ui/core": "^4.12.4",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.7.0",
    "@types/react": "^17.0.91",
    "@types/react-dom": "^17.0.26",
    "@types/react-redux": "^7.1.34",
    "@types/redux-logger": "^3.0.13",
-    "axios": "^1.15.0",
-    "i18next": "^26.0.4",
+    "axios": "^1.16.0",
+    "i18next": "^26.1.0",
    "i18next-browser-languagedetector": "^8.2.1",
    "i18next-resources-to-backend": "^1.2.1",
    "query-string": "^9.3.1",
@@ -60,8 +60,8 @@
    "css-loader": "^7.1.4",
    "css-minimizer-webpack-plugin": "^8.0.0",
    "dotenv": "17.4.2",
-    "dotenv-expand": "^12.0.3",
-    "html-webpack-plugin": "^5.6.6",
+    "dotenv-expand": "^13.0.0",
+    "html-webpack-plugin": "^5.6.7",
    "i18next-conv": "^15.1.2",
    "i18next-parser": "^9.4.0",
    "license-checker-rseidelsohn": "4.4.2",
@@ -74,7 +74,7 @@
    "react-dev-utils": "^12.0.1",
    "resolve": "^1.22.12",
    "resolve-url-loader": "^5.0.0",
-    "sass-loader": "^16.0.7",
+    "sass-loader": "^16.0.8",
    "source-map-explorer": "^2.5.3",
    "typescript": "^5.9.3",
    "url-loader": "4.1.1",
@@ -84,7 +84,9 @@
  },
  "pnpm": {
    "overrides": {
-      "serialize-javascript@<7.0.3": ">=7.0.3"
+      "fast-uri": ">=3.1.2",
+      "serialize-javascript@<7.0.3": ">=7.0.3",
+      "@xmldom/xmldom": ">=0.8.13"
    }
  },
  "packageManager": "pnpm@9.15.4"
@@ -5,7 +5,9 @@ settings:
  excludeLinksFromLockfile: false

 overrides:
+  fast-uri: '>=3.1.2'
  serialize-javascript@<7.0.3: '>=7.0.3'
+  '@xmldom/xmldom': '>=0.8.13'

 importers:

@@ -15,8 +17,8 @@ importers:
        specifier: ^4.12.4
        version: 4.12.4(@types/react@17.0.91)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)
      '@types/node':
-        specifier: ^25.6.0
-        version: 25.6.0
+        specifier: ^25.7.0
+        version: 25.7.0
      '@types/react':
        specifier: ^17.0.91
        version: 17.0.91
@@ -30,11 +32,11 @@ importers:
        specifier: ^3.0.13
        version: 3.0.13
      axios:
-        specifier: ^1.15.0
-        version: 1.15.0
+        specifier: ^1.16.0
+        version: 1.16.0
      i18next:
-        specifier: ^26.0.4
-        version: 26.0.4(typescript@5.9.3)
+        specifier: ^26.1.0
+        version: 26.1.0(typescript@5.9.3)
      i18next-browser-languagedetector:
        specifier: ^8.2.1
        version: 8.2.1
@@ -52,7 +54,7 @@ importers:
        version: 17.0.2(react@17.0.2)
      react-i18next:
        specifier: ^15.7.4
-        version: 15.7.4(i18next@26.0.4(typescript@5.9.3))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.9.3)
+        version: 15.7.4(i18next@26.1.0(typescript@5.9.3))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.9.3)
      react-redux:
        specifier: ^8.1.3
        version: 8.1.3(@types/react-dom@17.0.26(@types/react@17.0.91))(@types/react@17.0.91)(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(redux@4.2.1)
@@ -100,11 +102,11 @@ importers:
        specifier: 17.4.2
        version: 17.4.2
      dotenv-expand:
-        specifier: ^12.0.3
-        version: 12.0.3
+        specifier: ^13.0.0
+        version: 13.0.0
      html-webpack-plugin:
-        specifier: ^5.6.6
-        version: 5.6.6(webpack@5.105.2)
+        specifier: ^5.6.7
+        version: 5.6.7(webpack@5.105.2)
      i18next-conv:
        specifier: ^15.1.2
        version: 15.1.2
@@ -134,7 +136,7 @@ importers:
        version: 11.2.0(postcss@8.5.9)
      react-dev-utils:
        specifier: ^12.0.1
-        version: 12.0.1(eslint@7.32.0)(typescript@5.9.3)(vue-template-compiler@2.7.16)(webpack@5.105.2)
+        version: 12.0.1(eslint@7.32.0)(typescript@5.9.3)(webpack@5.105.2)
      resolve:
        specifier: ^1.22.12
        version: 1.22.12
@@ -142,8 +144,8 @@ importers:
        specifier: ^5.0.0
        version: 5.0.0
      sass-loader:
-        specifier: ^16.0.7
-        version: 16.0.7(webpack@5.105.2)
+        specifier: ^16.0.8
+        version: 16.0.8(webpack@5.105.2)
      source-map-explorer:
        specifier: ^2.5.3
        version: 2.5.3
@@ -285,8 +287,8 @@ packages:
    resolution: {integrity: sha512-llL88JShoCsth8fF8R4SJnIn+WLvR6ccFxu1H3FlMhDontdcmZWf2HgIZ7AIqV3Xcck1idlohrN4EUBQz6klbw==}
    engines: {node: '>=6.9.0'}

-  '@babel/parser@7.29.2':
-    resolution: {integrity: sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==}
+  '@babel/parser@7.29.3':
+    resolution: {integrity: sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==}
    engines: {node: '>=6.0.0'}
    hasBin: true

@@ -1529,8 +1531,8 @@ packages:
  '@types/minimatch@3.0.5':
    resolution: {integrity: sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==}

-  '@types/node@25.6.0':
-    resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==}
+  '@types/node@25.7.0':
+    resolution: {integrity: sha512-z+pdZyxE+RTQE9AcboAZCb4otwcrvgHD+GlBpPgn0emDVt0ohrTMhAwlr2Wd9nZ+nihhYFxO2pThz3C5qSu2Eg==}

  '@types/parse-json@4.0.2':
    resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==}
@@ -1580,6 +1582,7 @@ packages:

  '@ungap/structured-clone@1.3.0':
    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
+    deprecated: Potential CWE-502 - Update to 1.3.1 or higher

  '@webassemblyjs/ast@1.14.1':
    resolution: {integrity: sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==}
@@ -1626,10 +1629,9 @@ packages:
  '@webassemblyjs/wast-printer@1.14.1':
    resolution: {integrity: sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==}

-  '@xmldom/xmldom@0.8.12':
-    resolution: {integrity: sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==}
-    engines: {node: '>=10.0.0'}
-    deprecated: this version has critical issues, please update to the latest version
+  '@xmldom/xmldom@0.9.10':
+    resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==}
+    engines: {node: '>=14.6'}

  '@xtuc/ieee754@1.2.0':
    resolution: {integrity: sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==}
@@ -1692,15 +1694,9 @@ packages:
    peerDependencies:
      ajv: ^8.8.2

-  ajv@6.14.0:
-    resolution: {integrity: sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==}
-
  ajv@6.15.0:
    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}

-  ajv@8.18.0:
-    resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
-
  ajv@8.20.0:
    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}

@@ -1787,8 +1783,8 @@ packages:
    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
    engines: {node: '>= 0.4'}

-  axios@1.15.0:
-    resolution: {integrity: sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}

  b4a@1.8.0:
    resolution: {integrity: sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==}
@@ -2210,9 +2206,6 @@ packages:
    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
    engines: {node: '>= 0.4'}

-  de-indent@1.0.2:
-    resolution: {integrity: sha512-e/1zu3xH5MQryN2zdVaF0OrdNLUbvWxzMbi+iNA6Bky7l1RoP8a2fIbRocyHclXt/arDrrR6lL3TqFD9pMQTsg==}
-
  debug@2.6.9:
    resolution: {integrity: sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==}
    peerDependencies:
@@ -2306,12 +2299,8 @@ packages:
  dot-case@3.0.4:
    resolution: {integrity: sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==}

-  dotenv-expand@12.0.3:
-    resolution: {integrity: sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==}
-    engines: {node: '>=12'}
-
-  dotenv@16.4.7:
-    resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
+  dotenv-expand@13.0.0:
+    resolution: {integrity: sha512-aBfBS8eYIeXmpHI9ThIlA7/WLq+SLt18iXUZhb52rW89QLKQFoIpPG1bPeewoPZsTyjSSO3T7234FBVUM1V2rA==}
    engines: {node: '>=12'}

  dotenv@17.4.2:
@@ -2520,8 +2509,8 @@ packages:
  fast-levenshtein@2.0.6:
    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}

-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}

  fastq@1.20.1:
    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
@@ -2566,8 +2555,8 @@ packages:
  flatted@3.4.2:
    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}

-  follow-redirects@1.15.11:
-    resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==}
+  follow-redirects@1.16.0:
+    resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
    engines: {node: '>=4.0'}
    peerDependencies:
      debug: '*'
@@ -2779,8 +2768,8 @@ packages:
  hashish@0.0.4:
    resolution: {integrity: sha512-xyD4XgslstNAs72ENaoFvgMwtv8xhiDtC2AtzCG+8yF7W/Knxxm9BX+e2s25mm+HxMKh0rBmXVOEGF3zNImXvA==}

-  hasown@2.0.2:
-    resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
+  hasown@2.0.3:
+    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
    engines: {node: '>= 0.4'}

  he@1.2.0:
@@ -2811,8 +2800,8 @@ packages:
  html-parse-stringify@3.0.1:
    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}

-  html-webpack-plugin@5.6.6:
-    resolution: {integrity: sha512-bLjW01UTrvoWTJQL5LsMRo1SypHW80FTm12OJRSnr3v6YHNhfe+1r0MYUZJMACxnCHURVnBWRwAsWs2yPU9Ezw==}
+  html-webpack-plugin@5.6.7:
+    resolution: {integrity: sha512-md+vXtdCAe60s1k6AU3dUyMJnDxUyQAwfwPKoLisvgUF1IXjtlLsk2se54+qfL9Mdm26bbwvjJybpNx48NKRLw==}
    engines: {node: '>=10.13.0'}
    peerDependencies:
      '@rspack/core': 0.x || 1.x
@@ -2857,8 +2846,8 @@ packages:
      typescript:
        optional: true

-  i18next@26.0.4:
-    resolution: {integrity: sha512-gXF7U9bfioXPLv7mw8Qt2nfO7vij5MyINvPgVv99pX3fL1Y01pw2mKBFrlYpRxRCl2wz3ISenj6VsMJT2isfuA==}
+  i18next@26.1.0:
+    resolution: {integrity: sha512-dIU6td04DvQuIqVst5S9g0GviTmhZ0DYD4b9ociVGJmuCa5vZ2de/t+Enf4olvj87mF8Y2lwjNQBwC9QZsvzKQ==}
    peerDependencies:
      typescript: ^5 || ^6
    peerDependenciesMeta:
@@ -4273,8 +4262,8 @@ packages:
  sanitize.css@13.0.0:
    resolution: {integrity: sha512-ZRwKbh/eQ6w9vmTjkuG0Ioi3HBwPFce0O+v//ve+aOq1oeCy7jMV2qzzAlpsNuqpqCBjjriM1lbtZbF/Q8jVyA==}

-  sass-loader@16.0.7:
-    resolution: {integrity: sha512-w6q+fRHourZ+e+xA1kcsF27iGM6jdB8teexYCfdUw0sYgcDNeZESnDNT9sUmmPm3ooziwUJXGwZJSTF3kOdBfA==}
+  sass-loader@16.0.8:
+    resolution: {integrity: sha512-hcov4ZwZJIGbEuyNr9EmiTmZueyrxSToE6GOzoZnq5JM7ecRO7ttyvilPn+VmRsqiP16+VYZzVnGZj/hzZgKBA==}
    engines: {node: '>= 18.12.0'}
    peerDependencies:
      '@rspack/core': 0.x || ^1.0.0 || ^2.0.0-0
@@ -4317,8 +4306,8 @@ packages:
    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
    hasBin: true

-  semver@7.7.4:
-    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+  semver@7.8.0:
+    resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==}
    engines: {node: '>=10'}
    hasBin: true

@@ -4556,8 +4545,8 @@ packages:
    resolution: {integrity: sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==}
    engines: {node: '>=6'}

-  tapable@2.3.2:
-    resolution: {integrity: sha512-1MOpMXuhGzGL5TTCZFItxCc0AARf1EZFQkGqMm7ERKj8+Hgr5oLvJOVFcC+lRmR8hCe2S3jC4T5D7Vg/d7/fhA==}
+  tapable@2.3.3:
+    resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
    engines: {node: '>=6'}

  teex@1.0.1:
@@ -4591,8 +4580,8 @@ packages:
      uglify-js:
        optional: true

-  terser@5.46.1:
-    resolution: {integrity: sha512-vzCjQO/rgUuK9sf8VJZvjqiqiHFaZLnOiimmUuOKODxWL8mm/xua7viT7aqX7dgPY60otQjUotzFMmCB4VdmqQ==}
+  terser@5.47.1:
+    resolution: {integrity: sha512-tPbLXTI6ohPASb/1YViL428oEHu6/qv1OxqYnfaonVCFHqx4+wCd95pHrQWsL5X4pl90CTyW9piSAsS2L0VoMw==}
    engines: {node: '>=10'}
    hasBin: true

@@ -4689,8 +4678,8 @@ packages:
  underscore.string@3.3.6:
    resolution: {integrity: sha512-VoC83HWXmCrF6rgkyxS9GHv8W9Q5nhMKho+OadDJGzL2oDYbYEppBaCMH6pFlwLeqj2QS+hhkw2kpXkSdD1JxQ==}

-  undici-types@7.19.2:
-    resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==}
+  undici-types@7.21.0:
+    resolution: {integrity: sha512-w9IMgQrz4O0YN1LtB7K5P63vhlIOvC7opSmouCJ+ZywlPAlO9gIkJ+otk6LvGpAs2wg4econaCz3TvQ9xPoyuQ==}

  undici@7.24.8:
    resolution: {integrity: sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ==}
@@ -4794,9 +4783,6 @@ packages:
    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
    engines: {node: '>=0.10.0'}

-  vue-template-compiler@2.7.16:
-    resolution: {integrity: sha512-AYbUWAJHLGGQM7+cNTELw+KsOG9nl2CnSv467WobS5Cv9uk3wFcnr1Etsz2sEIHEZvw1U+o9mRlEO6QbZvUPGQ==}
-
  walk-sync@2.2.0:
    resolution: {integrity: sha512-IC8sL7aB4/ZgFcGI2T1LczZeFWZ06b3zoHH7jBPyHxOtIIz1jppWHjjEXkOFvFojBVAK9pV7g47xOZ4LW3QLfg==}
    engines: {node: 8.* || >= 10.*}
@@ -4980,9 +4966,9 @@ snapshots:
      '@jridgewell/gen-mapping': 0.3.13
      '@jridgewell/trace-mapping': 0.3.31

-  '@apideck/better-ajv-errors@0.3.7(ajv@8.18.0)':
+  '@apideck/better-ajv-errors@0.3.7(ajv@8.20.0)':
    dependencies:
-      ajv: 8.18.0
+      ajv: 8.20.0
      jsonpointer: 5.0.1
      leven: 3.1.0

@@ -5007,7 +4993,7 @@ snapshots:
      '@babel/helper-compilation-targets': 7.28.6
      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.26.10)
      '@babel/helpers': 7.29.2
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/template': 7.28.6
      '@babel/traverse': 7.29.0
      '@babel/types': 7.29.0
@@ -5021,7 +5007,7 @@ snapshots:

  '@babel/generator@7.29.1':
    dependencies:
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/types': 7.29.0
      '@jridgewell/gen-mapping': 0.3.13
      '@jridgewell/trace-mapping': 0.3.31
@@ -5153,7 +5139,7 @@ snapshots:
      picocolors: 1.1.1
    optional: true

-  '@babel/parser@7.29.2':
+  '@babel/parser@7.29.3':
    dependencies:
      '@babel/types': 7.29.0

@@ -5810,7 +5796,7 @@ snapshots:
  '@babel/template@7.28.6':
    dependencies:
      '@babel/code-frame': 7.29.0
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/types': 7.29.0

  '@babel/traverse@7.29.0':
@@ -5818,7 +5804,7 @@ snapshots:
      '@babel/code-frame': 7.29.0
      '@babel/generator': 7.29.1
      '@babel/helper-globals': 7.28.0
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/template': 7.28.6
      '@babel/types': 7.29.0
      debug: 4.4.3
@@ -6278,7 +6264,7 @@ snapshots:

  '@jest/pattern@30.0.1':
    dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.7.0
      jest-regex-util: 30.0.1

  '@jest/schemas@30.0.5':
@@ -6291,7 +6277,7 @@ snapshots:
      '@jest/schemas': 30.0.5
      '@types/istanbul-lib-coverage': 2.0.6
      '@types/istanbul-reports': 3.0.4
-      '@types/node': 25.6.0
+      '@types/node': 25.7.0
      '@types/yargs': 17.0.35
      chalk: 4.1.2

@@ -6393,7 +6379,7 @@ snapshots:

  '@npmcli/fs@3.1.1':
    dependencies:
-      semver: 7.7.4
+      semver: 7.8.0

  '@pkgjs/parseargs@0.11.0':
    optional: true
@@ -6431,7 +6417,7 @@ snapshots:
    dependencies:
      serialize-javascript: 7.0.5
      smob: 1.6.1
-      terser: 5.46.1
+      terser: 5.47.1
    optionalDependencies:
      rollup: 2.80.0

@@ -6461,7 +6447,7 @@ snapshots:

  '@types/babel__core@7.20.5':
    dependencies:
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/types': 7.29.0
      '@types/babel__generator': 7.27.0
      '@types/babel__template': 7.4.4
@@ -6475,7 +6461,7 @@ snapshots:

  '@types/babel__template@7.4.4':
    dependencies:
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.3
      '@babel/types': 7.29.0
    optional: true

@@ -6519,9 +6505,9 @@ snapshots:

  '@types/minimatch@3.0.5': {}

-  '@types/node@25.6.0':
+  '@types/node@25.7.0':
    dependencies:
-      undici-types: 7.19.2
+      undici-types: 7.21.0

  '@types/parse-json@4.0.2': {}

@@ -6646,7 +6632,7 @@ snapshots:
      '@webassemblyjs/ast': 1.14.1
      '@xtuc/long': 4.2.2

-  '@xmldom/xmldom@0.8.12': {}
+  '@xmldom/xmldom@0.9.10': {}

  '@xtuc/ieee754@1.2.0': {}

@@ -6679,48 +6665,32 @@ snapshots:
      loader-utils: 2.0.4
      regex-parser: 2.3.1

-  ajv-formats@2.1.1(ajv@8.18.0):
+  ajv-formats@2.1.1(ajv@8.20.0):
    optionalDependencies:
-      ajv: 8.18.0
+      ajv: 8.20.0

-  ajv-keywords@3.5.2(ajv@6.14.0):
+  ajv-keywords@3.5.2(ajv@6.15.0):
    dependencies:
-      ajv: 6.14.0
+      ajv: 6.15.0

-  ajv-keywords@5.1.0(ajv@8.18.0):
+  ajv-keywords@5.1.0(ajv@8.20.0):
    dependencies:
-      ajv: 8.18.0
+      ajv: 8.20.0
      fast-deep-equal: 3.1.3

-  ajv@6.14.0:
-    dependencies:
-      fast-deep-equal: 3.1.3
-      fast-json-stable-stringify: 2.1.0
-      json-schema-traverse: 0.4.1
-      uri-js: 4.4.1
-
  ajv@6.15.0:
    dependencies:
      fast-deep-equal: 3.1.3
      fast-json-stable-stringify: 2.1.0
      json-schema-traverse: 0.4.1
      uri-js: 4.4.1
-    optional: true
-
-  ajv@8.18.0:
-    dependencies:
-      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
-      json-schema-traverse: 1.0.0
-      require-from-string: 2.0.2

  ajv@8.20.0:
    dependencies:
      fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
      json-schema-traverse: 1.0.0
      require-from-string: 2.0.2
-    optional: true

  ansi-colors@4.1.3:
    optional: true
@@ -6797,9 +6767,9 @@ snapshots:
    dependencies:
      possible-typed-array-names: 1.1.0

-  axios@1.15.0:
+  axios@1.16.0:
    dependencies:
-      follow-redirects: 1.15.11
+      follow-redirects: 1.16.0
      form-data: 4.0.5
      proxy-from-env: 2.1.0
    transitivePeerDependencies:
@@ -7051,7 +7021,7 @@ snapshots:

  cldr@7.9.0:
    dependencies:
-      '@xmldom/xmldom': 0.8.12
+      '@xmldom/xmldom': 0.9.10
      escodegen: 2.1.0
      esprima: 4.0.1
      memoizeasync: 1.1.0
@@ -7172,7 +7142,7 @@ snapshots:
      postcss-modules-scope: 3.2.1(postcss@8.5.9)
      postcss-modules-values: 4.0.0(postcss@8.5.9)
      postcss-value-parser: 4.2.0
-      semver: 7.7.4
+      semver: 7.8.0
    optionalDependencies:
      webpack: 5.105.2

@@ -7297,9 +7267,6 @@ snapshots:
      es-errors: 1.3.0
      is-data-view: 1.0.2

-  de-indent@1.0.2:
-    optional: true
-
  debug@2.6.9:
    dependencies:
      ms: 2.0.0
@@ -7397,11 +7364,9 @@ snapshots:
      no-case: 3.0.4
      tslib: 2.8.1

-  dotenv-expand@12.0.3:
+  dotenv-expand@13.0.0:
    dependencies:
-      dotenv: 16.4.7
-
-  dotenv@16.4.7: {}
+      dotenv: 17.4.2

  dotenv@17.4.2: {}

@@ -7439,7 +7404,7 @@ snapshots:
  enhanced-resolve@5.20.1:
    dependencies:
      graceful-fs: 4.2.11
-      tapable: 2.3.2
+      tapable: 2.3.3

  enquirer@2.4.1:
    dependencies:
@@ -7487,7 +7452,7 @@ snapshots:
      has-property-descriptors: 1.0.2
      has-proto: 1.2.0
      has-symbols: 1.1.0
-      hasown: 2.0.2
+      hasown: 2.0.3
      internal-slot: 1.1.0
      is-array-buffer: 3.0.5
      is-callable: 1.2.7
@@ -7535,7 +7500,7 @@ snapshots:
      es-errors: 1.3.0
      get-intrinsic: 1.3.0
      has-tostringtag: 1.0.2
-      hasown: 2.0.2
+      hasown: 2.0.3

  es-to-primitive@1.3.0:
    dependencies:
@@ -7641,7 +7606,7 @@ snapshots:
      optionator: 0.9.4
      progress: 2.0.3
      regexpp: 3.2.0
-      semver: 7.7.4
+      semver: 7.8.0
      strip-ansi: 6.0.1
      strip-json-comments: 3.1.1
      table: 6.9.0
@@ -7706,7 +7671,7 @@ snapshots:
  fast-levenshtein@2.0.6:
    optional: true

-  fast-uri@3.1.0: {}
+  fast-uri@3.1.2: {}

  fastq@1.20.1:
    dependencies:
@@ -7755,7 +7720,7 @@ snapshots:
  flatted@3.4.2:
    optional: true

-  follow-redirects@1.15.11: {}
+  follow-redirects@1.16.0: {}

  for-each@0.3.5:
    dependencies:
@@ -7766,7 +7731,7 @@ snapshots:
      cross-spawn: 7.0.6
      signal-exit: 4.1.0

-  fork-ts-checker-webpack-plugin@6.5.3(eslint@7.32.0)(typescript@5.9.3)(vue-template-compiler@2.7.16)(webpack@5.105.2):
+  fork-ts-checker-webpack-plugin@6.5.3(eslint@7.32.0)(typescript@5.9.3)(webpack@5.105.2):
    dependencies:
      '@babel/code-frame': 7.29.0
      '@types/json-schema': 7.0.15
@@ -7779,20 +7744,19 @@ snapshots:
      memfs: 3.5.3
      minimatch: 3.1.5
      schema-utils: 2.7.0
-      semver: 7.7.4
+      semver: 7.8.0
      tapable: 1.1.3
      typescript: 5.9.3
      webpack: 5.105.2
    optionalDependencies:
      eslint: 7.32.0
-      vue-template-compiler: 2.7.16

  form-data@4.0.5:
    dependencies:
      asynckit: 0.4.0
      combined-stream: 1.0.8
      es-set-tostringtag: 2.1.0
-      hasown: 2.0.2
+      hasown: 2.0.3
      mime-types: 2.1.35

  fraction.js@5.3.4: {}
@@ -7859,7 +7823,7 @@ snapshots:
      call-bound: 1.0.4
      define-properties: 1.2.1
      functions-have-names: 1.2.3
-      hasown: 2.0.2
+      hasown: 2.0.3
      is-callable: 1.2.7

  functional-red-black-tree@1.0.1:
@@ -7883,7 +7847,7 @@ snapshots:
      get-proto: 1.0.1
      gopd: 1.2.0
      has-symbols: 1.1.0
-      hasown: 2.0.2
+      hasown: 2.0.3
      math-intrinsics: 1.1.0

  get-own-enumerable-property-symbols@3.0.2: {}
@@ -8029,7 +7993,7 @@ snapshots:
    dependencies:
      traverse: 0.6.11

-  hasown@2.0.2:
+  hasown@2.0.3:
    dependencies:
      function-bind: 1.1.2

@@ -8071,19 +8035,19 @@ snapshots:
      he: 1.2.0
      param-case: 3.0.4
      relateurl: 0.2.7
-      terser: 5.46.1
+      terser: 5.47.1

  html-parse-stringify@3.0.1:
    dependencies:
      void-elements: 3.1.0

-  html-webpack-plugin@5.6.6(webpack@5.105.2):
+  html-webpack-plugin@5.6.7(webpack@5.105.2):
    dependencies:
      '@types/html-minifier-terser': 6.1.0
      html-minifier-terser: 6.1.0
      lodash: 4.18.1
      pretty-error: 4.0.0
-      tapable: 2.3.2
+      tapable: 2.3.3
    optionalDependencies:
      webpack: 5.105.2

@@ -8150,9 +8114,7 @@ snapshots:
    optionalDependencies:
      typescript: 5.9.3

-  i18next@26.0.4(typescript@5.9.3):
-    dependencies:
-      '@babel/runtime': 7.29.2
+  i18next@26.1.0(typescript@5.9.3):
    optionalDependencies:
      typescript: 5.9.3

@@ -8195,7 +8157,7 @@ snapshots:
  internal-slot@1.1.0:
    dependencies:
      es-errors: 1.3.0
-      hasown: 2.0.2
+      hasown: 2.0.3
      side-channel: 1.1.0

  is-array-buffer@3.0.5:
@@ -8231,7 +8193,7 @@ snapshots:

  is-core-module@2.16.1:
    dependencies:
-      hasown: 2.0.2
+      hasown: 2.0.3

  is-data-view@1.0.2:
    dependencies:
@@ -8292,7 +8254,7 @@ snapshots:
      call-bound: 1.0.4
      gopd: 1.2.0
      has-tostringtag: 1.0.2
-      hasown: 2.0.2
+      hasown: 2.0.3

  is-regexp@1.0.0: {}

@@ -8367,7 +8329,7 @@ snapshots:
  jest-util@30.3.0:
    dependencies:
      '@jest/types': 30.3.0
-      '@types/node': 25.6.0
+      '@types/node': 25.7.0
      chalk: 4.1.2
      ci-info: 4.4.0
      graceful-fs: 4.2.11
@@ -8375,13 +8337,13 @@ snapshots:

  jest-worker@27.5.1:
    dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.7.0
      merge-stream: 2.0.0
      supports-color: 8.1.1

  jest-worker@30.3.0:
    dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.7.0
      '@ungap/structured-clone': 1.3.0
      jest-util: 30.3.0
      merge-stream: 2.0.0
@@ -8504,7 +8466,7 @@ snapshots:
      mkdirp: 1.0.4
      nopt: 7.2.1
      read-installed-packages: 2.0.1
-      semver: 7.7.4
+      semver: 7.8.0
      spdx-correct: 3.2.0
      spdx-expression-parse: 3.0.1
      spdx-satisfies: 5.0.1
@@ -8622,7 +8584,7 @@ snapshots:
  mini-css-extract-plugin@2.9.2(webpack@5.105.2):
    dependencies:
      schema-utils: 4.3.3
-      tapable: 2.3.2
+      tapable: 2.3.3
      webpack: 5.105.2

  minimatch@10.2.5:
@@ -8679,7 +8641,7 @@ snapshots:
    dependencies:
      hosted-git-info: 6.1.3
      is-core-module: 2.16.1
-      semver: 7.7.4
+      semver: 7.8.0
      validate-npm-package-license: 3.0.4

  normalize-path@3.0.0: {}
@@ -9002,7 +8964,7 @@ snapshots:
      loader-utils: 2.0.4
      postcss: 8.5.9
      schema-utils: 3.3.0
-      semver: 7.7.4
+      semver: 7.8.0
      webpack: 5.105.2

  postcss-logical@9.0.0(postcss@8.5.9):
@@ -9328,7 +9290,7 @@ snapshots:
      rimraf: 5.0.10
      underscore.string: 3.3.6

-  react-dev-utils@12.0.1(eslint@7.32.0)(typescript@5.9.3)(vue-template-compiler@2.7.16)(webpack@5.105.2):
+  react-dev-utils@12.0.1(eslint@7.32.0)(typescript@5.9.3)(webpack@5.105.2):
    dependencies:
      '@babel/code-frame': 7.29.0
      address: 1.2.2
@@ -9339,7 +9301,7 @@ snapshots:
      escape-string-regexp: 4.0.0
      filesize: 8.0.7
      find-up: 5.0.0
-      fork-ts-checker-webpack-plugin: 6.5.3(eslint@7.32.0)(typescript@5.9.3)(vue-template-compiler@2.7.16)(webpack@5.105.2)
+      fork-ts-checker-webpack-plugin: 6.5.3(eslint@7.32.0)(typescript@5.9.3)(webpack@5.105.2)
      global-modules: 2.0.0
      globby: 11.1.0
      gzip-size: 6.0.0
@@ -9371,11 +9333,11 @@ snapshots:

  react-error-overlay@6.1.0: {}

-  react-i18next@15.7.4(i18next@26.0.4(typescript@5.9.3))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.9.3):
+  react-i18next@15.7.4(i18next@26.1.0(typescript@5.9.3))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.9.3):
    dependencies:
      '@babel/runtime': 7.29.2
      html-parse-stringify: 3.0.1
-      i18next: 26.0.4(typescript@5.9.3)
+      i18next: 26.1.0(typescript@5.9.3)
      react: 17.0.2
    optionalDependencies:
      react-dom: 17.0.2(react@17.0.2)
@@ -9459,7 +9421,7 @@ snapshots:
      '@npmcli/fs': 3.1.1
      debug: 4.4.3
      read-package-json: 6.0.4
-      semver: 7.7.4
+      semver: 7.8.0
      slide: 1.1.6
    optionalDependencies:
      graceful-fs: 4.2.11
@@ -9659,7 +9621,7 @@ snapshots:

  sanitize.css@13.0.0: {}

-  sass-loader@16.0.7(webpack@5.105.2):
+  sass-loader@16.0.8(webpack@5.105.2):
    dependencies:
      neo-async: 2.6.2
    optionalDependencies:
@@ -9675,25 +9637,25 @@ snapshots:
  schema-utils@2.7.0:
    dependencies:
      '@types/json-schema': 7.0.15
-      ajv: 6.14.0
-      ajv-keywords: 3.5.2(ajv@6.14.0)
+      ajv: 6.15.0
+      ajv-keywords: 3.5.2(ajv@6.15.0)

  schema-utils@3.3.0:
    dependencies:
      '@types/json-schema': 7.0.15
-      ajv: 6.14.0
-      ajv-keywords: 3.5.2(ajv@6.14.0)
+      ajv: 6.15.0
+      ajv-keywords: 3.5.2(ajv@6.15.0)

  schema-utils@4.3.3:
    dependencies:
      '@types/json-schema': 7.0.15
-      ajv: 8.18.0
-      ajv-formats: 2.1.1(ajv@8.18.0)
-      ajv-keywords: 5.1.0(ajv@8.18.0)
+      ajv: 8.20.0
+      ajv-formats: 2.1.1(ajv@8.20.0)
+      ajv-keywords: 5.1.0(ajv@8.20.0)

  semver@6.3.1: {}

-  semver@7.7.4: {}
+  semver@7.8.0: {}

  seq@0.3.5:
    dependencies:
@@ -9993,7 +9955,7 @@ snapshots:

  tapable@1.1.3: {}

-  tapable@2.3.2: {}
+  tapable@2.3.3: {}

  teex@1.0.1:
    dependencies:
@@ -10021,10 +9983,10 @@ snapshots:
      '@jridgewell/trace-mapping': 0.3.31
      jest-worker: 27.5.1
      schema-utils: 4.3.3
-      terser: 5.46.1
+      terser: 5.47.1
      webpack: 5.105.2

-  terser@5.46.1:
+  terser@5.47.1:
    dependencies:
      '@jridgewell/source-map': 0.3.11
      acorn: 8.16.0
@@ -10147,7 +10109,7 @@ snapshots:
      sprintf-js: 1.1.3
      util-deprecate: 1.0.2

-  undici-types@7.19.2: {}
+  undici-types@7.21.0: {}

  undici@7.24.8: {}

@@ -10265,12 +10227,6 @@ snapshots:

  void-elements@3.1.0: {}

-  vue-template-compiler@2.7.16:
-    dependencies:
-      de-indent: 1.0.2
-      he: 1.2.0
-    optional: true
-
  walk-sync@2.2.0:
    dependencies:
      '@types/minimatch': 3.0.5
@@ -10287,7 +10243,7 @@ snapshots:

  webpack-manifest-plugin@5.0.0(webpack@5.105.2):
    dependencies:
-      tapable: 2.3.2
+      tapable: 2.3.3
      webpack: 5.105.2
      webpack-sources: 2.3.1

@@ -10326,7 +10282,7 @@ snapshots:
      mime-types: 2.1.35
      neo-async: 2.6.2
      schema-utils: 4.3.3
-      tapable: 2.3.2
+      tapable: 2.3.3
      terser-webpack-plugin: 5.4.0(webpack@5.105.2)
      watchpack: 2.5.1
      webpack-sources: 3.3.4
@@ -10410,7 +10366,7 @@ snapshots:

  workbox-build@7.4.0(@types/babel__core@7.20.5):
    dependencies:
-      '@apideck/better-ajv-errors': 0.3.7(ajv@8.18.0)
+      '@apideck/better-ajv-errors': 0.3.7(ajv@8.20.0)
      '@babel/core': 7.26.10
      '@babel/preset-env': 7.29.2(@babel/core@7.26.10)
      '@babel/runtime': 7.29.2
@@ -10419,7 +10375,7 @@ snapshots:
      '@rollup/plugin-replace': 2.4.2(rollup@2.80.0)
      '@rollup/plugin-terser': 0.4.4(rollup@2.80.0)
      '@surma/rollup-plugin-off-main-thread': 2.2.3
-      ajv: 8.18.0
+      ajv: 8.20.0
      common-tags: 1.8.2
      fast-json-stable-stringify: 2.1.0
      fs-extra: 9.1.0
@@ -204,8 +204,9 @@ func validateMime(incipit []byte) bool {
 }

 func escapeStringMap(vars map[string]string) map[string]string {
-	for k := range vars {
-		vars[k] = html.EscapeString(vars[k])
+	escaped := make(map[string]string, len(vars))
+	for k, v := range vars {
+		escaped[k] = html.EscapeString(v)
 	}
-	return vars
+	return escaped
 }
@@ -0,0 +1,25 @@
+package email
+
+import "testing"
+
+// Regression for #2804: escapeStringMap used to mutate its input map, and the
+// recipient render loop reuses that map across iterations.
+func TestEscapeStringMapDoesNotMutateInput(t *testing.T) {
+	const raw = "Test & Demo"
+	input := map[string]string{"SpaceName": raw}
+
+	first := escapeStringMap(input)
+	second := escapeStringMap(input)
+
+	if got, want := first["SpaceName"], "Test &amp; Demo"; got != want {
+		t.Errorf("first call: got %q, want %q", got, want)
+	}
+	if first["SpaceName"] != second["SpaceName"] {
+		t.Errorf("escapeStringMap not idempotent on shared input: first=%q second=%q",
+			first["SpaceName"], second["SpaceName"])
+	}
+	if input["SpaceName"] != raw {
+		t.Errorf("escapeStringMap mutated its input: got %q, want %q",
+			input["SpaceName"], raw)
+	}
+}
@@ -14,6 +14,6 @@ packages:
      UserRoleAssigner: {}
  go-micro.dev/v4/store:
    config:
-      dir: pkg/staticroutes/internal/backchannellogout/mocks
+      dir: pkg/staticroutes/backchannellogout/mocks
    interfaces:
      Store: {}
@@ -11,6 +11,12 @@ import (
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	"github.com/justinas/alice"

+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/signedurl"
+	"github.com/opencloud-eu/reva/v2/pkg/store"
+
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
 	"github.com/opencloud-eu/opencloud/pkg/log"
@@ -34,11 +40,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/user/backend"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/signedurl"
-	"github.com/opencloud-eu/reva/v2/pkg/store"

 	chimiddleware "github.com/go-chi/chi/v5/middleware"
 	"github.com/spf13/cobra"
@@ -298,6 +299,7 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 		middleware.DefaultAccessTokenTTL(cfg.OIDC.UserinfoCache.TTL),
 		middleware.HTTPClient(oidcHTTPClient),
 		middleware.OIDCIss(cfg.OIDC.Issuer),
+		middleware.AccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
 		middleware.OIDCClient(oidc.NewOIDCClient(
 			oidc.WithAccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
 			oidc.WithLogger(logger),
@@ -16,7 +16,8 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/oidc"
-	"github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes"
+	"github.com/opencloud-eu/opencloud/services/proxy/pkg/config"
+	bcl "github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes/backchannellogout"
 )

 const (
@@ -31,7 +32,6 @@ func NewOIDCAuthenticator(opts ...Option) *OIDCAuthenticator {
 	return &OIDCAuthenticator{
 		Logger:                  options.Logger,
 		userInfoCache:           options.UserInfoCache,
-		DefaultTokenCacheTTL:    options.DefaultAccessTokenTTL,
 		HTTPClient:              options.HTTPClient,
 		OIDCIss:                 options.OIDCIss,
 		oidcClient:              options.OIDCClient,
@@ -104,38 +104,49 @@ func (m *OIDCAuthenticator) getClaims(token string, req *http.Request) (map[stri
 	// always set an exp claim
 	claims["exp"] = expiration.Unix()
 	go func() {
-		if d, err := msgpack.Marshal(claims); err != nil {
+		d, err := msgpack.Marshal(claims)
+		if err != nil {
 			m.Logger.Error().Err(err).Msg("failed to marshal claims for userinfo cache")
-		} else {
-			err = m.userInfoCache.Write(&store.Record{
-				Key:    encodedHash,
-				Value:  d,
-				Expiry: time.Until(expiration),
-			})
-			if err != nil {
-				m.Logger.Error().Err(err).Msg("failed to write to userinfo cache")
-			}
+			return
+		}

-			// fail if creating the storage key fails,
-			// it means there is no subject and no session.
-			//
-			// ok: {key: ".sessionId"}
-			// ok: {key: "subject."}
-			// ok: {key: "subject.sessionId"}
-			// fail: {key: "."}
-			subjectSessionKey, err := staticroutes.NewRecordKey(aClaims.Subject, aClaims.SessionID)
-			if err != nil {
-				m.Logger.Error().Err(err).Msg("failed to build subject.session")
-				return
-			}
+		err = m.userInfoCache.Write(&store.Record{
+			Key:    encodedHash,
+			Value:  d,
+			Expiry: time.Until(expiration),
+		})
+		if err != nil {
+			m.Logger.Error().Err(err).Msg("failed to write to userinfo cache")
+		}

-			if err := m.userInfoCache.Write(&store.Record{
-				Key:    subjectSessionKey,
-				Value:  []byte(encodedHash),
-				Expiry: time.Until(expiration),
-			}); err != nil {
-				m.Logger.Error().Err(err).Msg("failed to write session lookup cache")
-			}
+		// fail if creating the storage key fails,
+		// it means there is no subject and no session.
+		//
+		// ok: {key: ".sessionId"}
+		// ok: {key: "subject."}
+		// ok: {key: "subject.sessionId"}
+		// fail: {key: "."}
+		subjectSessionKey, err := bcl.NewKey(aClaims.Subject, aClaims.SessionID)
+		switch {
+		// fails if the verify method is set to `none`, in that case the oidc client verification returns
+		// an empty oidcclient.RegClaimsWithSID but no err.
+		//
+		// revisit once:
+		//   - Authelia OpenID Connect Back-Channel Logout 1.0 is implemented,
+		//     e.g. https://www.authelia.com/roadmap/active/openid-connect-1.0-provider/#beta-9
+		case m.AccessTokenVerifyMethod == config.AccessTokenVerificationNone && errors.Is(err, bcl.ErrInvalidKey):
+			return
+		case err != nil:
+			m.Logger.Error().Err(err).Msg("failed to build subject.session")
+			return
+		}
+
+		if err := m.userInfoCache.Write(&store.Record{
+			Key:    subjectSessionKey,
+			Value:  []byte(encodedHash),
+			Expiry: time.Until(expiration),
+		}); err != nil {
+			m.Logger.Error().Err(err).Msg("failed to write session lookup cache")
 		}
 	}()

@@ -10,13 +10,11 @@ import (
 	"github.com/vmihailenco/msgpack/v5"
 	microstore "go-micro.dev/v4/store"

-	bcl "github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes/internal/backchannellogout"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
-)

-// NewRecordKey converts the subject and session to a base64 encoded key
-var NewRecordKey = bcl.NewKey
+	bcl "github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes/backchannellogout"
+)

 // backchannelLogout handles backchannel logout requests from the identity provider and invalidates the related sessions in the cache
 // spec: https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRequest
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"go-micro.dev/v4/store"

-	"github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes/internal/backchannellogout/mocks"
+	"github.com/opencloud-eu/opencloud/services/proxy/pkg/staticroutes/backchannellogout/mocks"
 )

 func mustNewKey(t *testing.T, subject, session string) string {
@@ -119,7 +119,7 @@ func (_c *UserBackend_Authenticate_Call) RunAndReturn(run func(ctx context.Conte
 }

 // CreateUserFromClaims provides a mock function for the type UserBackend
-func (_mock *UserBackend) CreateUserFromClaims(ctx context.Context, claims map[string]interface{}) (*userv1beta1.User, error) {
+func (_mock *UserBackend) CreateUserFromClaims(ctx context.Context, claims map[string]any) (*userv1beta1.User, error) {
 	ret := _mock.Called(ctx, claims)

 	if len(ret) == 0 {
@@ -128,17 +128,17 @@ func (_mock *UserBackend) CreateUserFromClaims(ctx context.Context, claims map[s

 	var r0 *userv1beta1.User
 	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, map[string]interface{}) (*userv1beta1.User, error)); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, map[string]any) (*userv1beta1.User, error)); ok {
 		return returnFunc(ctx, claims)
 	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, map[string]interface{}) *userv1beta1.User); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, map[string]any) *userv1beta1.User); ok {
 		r0 = returnFunc(ctx, claims)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(*userv1beta1.User)
 		}
 	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, map[string]interface{}) error); ok {
+	if returnFunc, ok := ret.Get(1).(func(context.Context, map[string]any) error); ok {
 		r1 = returnFunc(ctx, claims)
 	} else {
 		r1 = ret.Error(1)
@@ -153,20 +153,20 @@ type UserBackend_CreateUserFromClaims_Call struct {

 // CreateUserFromClaims is a helper method to define mock.On call
 //   - ctx context.Context
-//   - claims map[string]interface{}
+//   - claims map[string]any
 func (_e *UserBackend_Expecter) CreateUserFromClaims(ctx interface{}, claims interface{}) *UserBackend_CreateUserFromClaims_Call {
 	return &UserBackend_CreateUserFromClaims_Call{Call: _e.mock.On("CreateUserFromClaims", ctx, claims)}
 }

-func (_c *UserBackend_CreateUserFromClaims_Call) Run(run func(ctx context.Context, claims map[string]interface{})) *UserBackend_CreateUserFromClaims_Call {
+func (_c *UserBackend_CreateUserFromClaims_Call) Run(run func(ctx context.Context, claims map[string]any)) *UserBackend_CreateUserFromClaims_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 context.Context
 		if args[0] != nil {
 			arg0 = args[0].(context.Context)
 		}
-		var arg1 map[string]interface{}
+		var arg1 map[string]any
 		if args[1] != nil {
-			arg1 = args[1].(map[string]interface{})
+			arg1 = args[1].(map[string]any)
 		}
 		run(
 			arg0,
@@ -181,7 +181,7 @@ func (_c *UserBackend_CreateUserFromClaims_Call) Return(user *userv1beta1.User,
 	return _c
 }

-func (_c *UserBackend_CreateUserFromClaims_Call) RunAndReturn(run func(ctx context.Context, claims map[string]interface{}) (*userv1beta1.User, error)) *UserBackend_CreateUserFromClaims_Call {
+func (_c *UserBackend_CreateUserFromClaims_Call) RunAndReturn(run func(ctx context.Context, claims map[string]any) (*userv1beta1.User, error)) *UserBackend_CreateUserFromClaims_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -267,7 +267,7 @@ func (_c *UserBackend_GetUserByClaims_Call) RunAndReturn(run func(ctx context.Co
 }

 // SyncGroupMemberships provides a mock function for the type UserBackend
-func (_mock *UserBackend) SyncGroupMemberships(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) error {
+func (_mock *UserBackend) SyncGroupMemberships(ctx context.Context, user *userv1beta1.User, claims map[string]any) error {
 	ret := _mock.Called(ctx, user, claims)

 	if len(ret) == 0 {
@@ -275,7 +275,7 @@ func (_mock *UserBackend) SyncGroupMemberships(ctx context.Context, user *userv1
 	}

 	var r0 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]interface{}) error); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]any) error); ok {
 		r0 = returnFunc(ctx, user, claims)
 	} else {
 		r0 = ret.Error(0)
@@ -291,12 +291,12 @@ type UserBackend_SyncGroupMemberships_Call struct {
 // SyncGroupMemberships is a helper method to define mock.On call
 //   - ctx context.Context
 //   - user *userv1beta1.User
-//   - claims map[string]interface{}
+//   - claims map[string]any
 func (_e *UserBackend_Expecter) SyncGroupMemberships(ctx interface{}, user interface{}, claims interface{}) *UserBackend_SyncGroupMemberships_Call {
 	return &UserBackend_SyncGroupMemberships_Call{Call: _e.mock.On("SyncGroupMemberships", ctx, user, claims)}
 }

-func (_c *UserBackend_SyncGroupMemberships_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{})) *UserBackend_SyncGroupMemberships_Call {
+func (_c *UserBackend_SyncGroupMemberships_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any)) *UserBackend_SyncGroupMemberships_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 context.Context
 		if args[0] != nil {
@@ -306,9 +306,9 @@ func (_c *UserBackend_SyncGroupMemberships_Call) Run(run func(ctx context.Contex
 		if args[1] != nil {
 			arg1 = args[1].(*userv1beta1.User)
 		}
-		var arg2 map[string]interface{}
+		var arg2 map[string]any
 		if args[2] != nil {
-			arg2 = args[2].(map[string]interface{})
+			arg2 = args[2].(map[string]any)
 		}
 		run(
 			arg0,
@@ -324,13 +324,13 @@ func (_c *UserBackend_SyncGroupMemberships_Call) Return(err error) *UserBackend_
 	return _c
 }

-func (_c *UserBackend_SyncGroupMemberships_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) error) *UserBackend_SyncGroupMemberships_Call {
+func (_c *UserBackend_SyncGroupMemberships_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any) error) *UserBackend_SyncGroupMemberships_Call {
 	_c.Call.Return(run)
 	return _c
 }

 // UpdateUserIfNeeded provides a mock function for the type UserBackend
-func (_mock *UserBackend) UpdateUserIfNeeded(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) error {
+func (_mock *UserBackend) UpdateUserIfNeeded(ctx context.Context, user *userv1beta1.User, claims map[string]any) error {
 	ret := _mock.Called(ctx, user, claims)

 	if len(ret) == 0 {
@@ -338,7 +338,7 @@ func (_mock *UserBackend) UpdateUserIfNeeded(ctx context.Context, user *userv1be
 	}

 	var r0 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]interface{}) error); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]any) error); ok {
 		r0 = returnFunc(ctx, user, claims)
 	} else {
 		r0 = ret.Error(0)
@@ -354,12 +354,12 @@ type UserBackend_UpdateUserIfNeeded_Call struct {
 // UpdateUserIfNeeded is a helper method to define mock.On call
 //   - ctx context.Context
 //   - user *userv1beta1.User
-//   - claims map[string]interface{}
+//   - claims map[string]any
 func (_e *UserBackend_Expecter) UpdateUserIfNeeded(ctx interface{}, user interface{}, claims interface{}) *UserBackend_UpdateUserIfNeeded_Call {
 	return &UserBackend_UpdateUserIfNeeded_Call{Call: _e.mock.On("UpdateUserIfNeeded", ctx, user, claims)}
 }

-func (_c *UserBackend_UpdateUserIfNeeded_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{})) *UserBackend_UpdateUserIfNeeded_Call {
+func (_c *UserBackend_UpdateUserIfNeeded_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any)) *UserBackend_UpdateUserIfNeeded_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 context.Context
 		if args[0] != nil {
@@ -369,9 +369,9 @@ func (_c *UserBackend_UpdateUserIfNeeded_Call) Run(run func(ctx context.Context,
 		if args[1] != nil {
 			arg1 = args[1].(*userv1beta1.User)
 		}
-		var arg2 map[string]interface{}
+		var arg2 map[string]any
 		if args[2] != nil {
-			arg2 = args[2].(map[string]interface{})
+			arg2 = args[2].(map[string]any)
 		}
 		run(
 			arg0,
@@ -387,7 +387,7 @@ func (_c *UserBackend_UpdateUserIfNeeded_Call) Return(err error) *UserBackend_Up
 	return _c
 }

-func (_c *UserBackend_UpdateUserIfNeeded_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) error) *UserBackend_UpdateUserIfNeeded_Call {
+func (_c *UserBackend_UpdateUserIfNeeded_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any) error) *UserBackend_UpdateUserIfNeeded_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -6,7 +6,7 @@ import (
 	cs3 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/middleware"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
-	settingsService "github.com/opencloud-eu/opencloud/services/settings/pkg/service/v0"
+	"github.com/opencloud-eu/opencloud/services/settings/pkg/store/defaults"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	"go-micro.dev/v4/metadata"
 )
@@ -44,9 +44,9 @@ func (d defaultRoleAssigner) UpdateUserRoleAssignment(ctx context.Context, user
 			// default user role. At least until proper roles are provided. See
 			// https://github.com/owncloud/ocis/issues/1825 for more context.
 			if user.Id.Type == cs3.UserType_USER_TYPE_PRIMARY || user.Id.Type == cs3.UserType_USER_TYPE_GUEST {
-				roleId := settingsService.BundleUUIDRoleUser
+				roleId := defaults.BundleUUIDRoleUser
 				if user.Id.Type == cs3.UserType_USER_TYPE_GUEST {
-					roleId = settingsService.BundleUUIDRoleGuest
+					roleId = defaults.BundleUUIDRoleGuest
 				}
 				d.logger.Info().Str("userid", user.Id.OpaqueId).Msg("user has no role assigned, assigning default user role")
 				ctx = metadata.Set(ctx, middleware.AccountID, user.Id.OpaqueId)
@@ -107,7 +107,7 @@ func (_c *UserRoleAssigner_ApplyUserRole_Call) RunAndReturn(run func(ctx context
 }

 // UpdateUserRoleAssignment provides a mock function for the type UserRoleAssigner
-func (_mock *UserRoleAssigner) UpdateUserRoleAssignment(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) (*userv1beta1.User, error) {
+func (_mock *UserRoleAssigner) UpdateUserRoleAssignment(ctx context.Context, user *userv1beta1.User, claims map[string]any) (*userv1beta1.User, error) {
 	ret := _mock.Called(ctx, user, claims)

 	if len(ret) == 0 {
@@ -116,17 +116,17 @@ func (_mock *UserRoleAssigner) UpdateUserRoleAssignment(ctx context.Context, use

 	var r0 *userv1beta1.User
 	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]interface{}) (*userv1beta1.User, error)); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]any) (*userv1beta1.User, error)); ok {
 		return returnFunc(ctx, user, claims)
 	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]interface{}) *userv1beta1.User); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *userv1beta1.User, map[string]any) *userv1beta1.User); ok {
 		r0 = returnFunc(ctx, user, claims)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(*userv1beta1.User)
 		}
 	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, *userv1beta1.User, map[string]interface{}) error); ok {
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *userv1beta1.User, map[string]any) error); ok {
 		r1 = returnFunc(ctx, user, claims)
 	} else {
 		r1 = ret.Error(1)
@@ -142,12 +142,12 @@ type UserRoleAssigner_UpdateUserRoleAssignment_Call struct {
 // UpdateUserRoleAssignment is a helper method to define mock.On call
 //   - ctx context.Context
 //   - user *userv1beta1.User
-//   - claims map[string]interface{}
+//   - claims map[string]any
 func (_e *UserRoleAssigner_Expecter) UpdateUserRoleAssignment(ctx interface{}, user interface{}, claims interface{}) *UserRoleAssigner_UpdateUserRoleAssignment_Call {
 	return &UserRoleAssigner_UpdateUserRoleAssignment_Call{Call: _e.mock.On("UpdateUserRoleAssignment", ctx, user, claims)}
 }

-func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{})) *UserRoleAssigner_UpdateUserRoleAssignment_Call {
+func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) Run(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any)) *UserRoleAssigner_UpdateUserRoleAssignment_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		var arg0 context.Context
 		if args[0] != nil {
@@ -157,9 +157,9 @@ func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) Run(run func(ctx conte
 		if args[1] != nil {
 			arg1 = args[1].(*userv1beta1.User)
 		}
-		var arg2 map[string]interface{}
+		var arg2 map[string]any
 		if args[2] != nil {
-			arg2 = args[2].(map[string]interface{})
+			arg2 = args[2].(map[string]any)
 		}
 		run(
 			arg0,
@@ -175,7 +175,7 @@ func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) Return(user1 *userv1be
 	return _c
 }

-func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]interface{}) (*userv1beta1.User, error)) *UserRoleAssigner_UpdateUserRoleAssignment_Call {
+func (_c *UserRoleAssigner_UpdateUserRoleAssignment_Call) RunAndReturn(run func(ctx context.Context, user *userv1beta1.User, claims map[string]any) (*userv1beta1.User, error)) *UserRoleAssigner_UpdateUserRoleAssignment_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -118,11 +118,11 @@ It can also be used to re-index all spaces:
 opencloud search index --all-spaces
 ```

-Please note that a reindex only picks up new files. Files that have already been indexed are not indexed again, even if the configuration or the whole extractor has been changed. To force a full reindex you need to use the `force-reindex` flag:
+Please note that a reindex only picks up new or changed files. Files that have already been indexed are not scanned again, even if the configuration or the whole extractor has been changed. To force a full rescan (re-running the extractor on every file) you need to use the `force-rescan` flag:


 ```shell
-opencloud search index --all-spaces --force-reindex
+opencloud search index --all-spaces --force-rescan
 ```

 ## Metrics
@@ -2,19 +2,20 @@ package command

 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"time"

 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
-	"github.com/opencloud-eu/opencloud/pkg/service/grpc"
-	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	searchsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/search/v0"
 	"github.com/opencloud-eu/opencloud/services/search/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/search/pkg/config/parser"

 	"github.com/spf13/cobra"
-	"go-micro.dev/v4/client"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
 )

 // Index is the entrypoint for the server command.
@@ -30,28 +31,36 @@ func Index(cfg *config.Config) *cobra.Command {
 			allSpacesFlag, _ := cmd.Flags().GetBool("all-spaces")
 			spaceFlag, _ := cmd.Flags().GetString("space")
 			forceRescanFlag, _ := cmd.Flags().GetBool("force-rescan")
+			endpointFlag, _ := cmd.Flags().GetString("endpoint")
+			insecureFlag, _ := cmd.Flags().GetBool("insecure")
 			if spaceFlag == "" && !allSpacesFlag {
 				return errors.New("either --space or --all-spaces is required")
 			}

-			traceProvider, err := tracing.GetTraceProvider(cmd.Context(), cfg.Commons.TracesExporter, cfg.Service.Name)
-			if err != nil {
-				return err
-			}
-			grpcClient, err := grpc.NewClient(
-				append(grpc.GetClientOptions(cfg.GRPCClientTLS),
-					grpc.WithTraceProvider(traceProvider),
-				)...,
-			)
-			if err != nil {
-				return err
+			var dialOpts []grpc.DialOption
+			if cfg.GRPCClientTLS.Mode == "insecure" || insecureFlag {
+				dialOpts = append(dialOpts, grpc.WithTransportCredentials(insecure.NewCredentials()))
+			} else {
+				dialOpts = append(dialOpts, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
+					MinVersion: tls.VersionTLS12,
+				})))
 			}

-			c := searchsvc.NewSearchProviderService("eu.opencloud.api.search", grpcClient)
-			_, err = c.IndexSpace(context.Background(), &searchsvc.IndexSpaceRequest{
+			conn, err := grpc.NewClient(endpointFlag, dialOpts...)
+			if err != nil {
+				return fmt.Errorf("failed to dial %s: %w", endpointFlag, err)
+			}
+			defer conn.Close()
+
+			c := searchsvc.NewSearchProviderClient(conn)
+
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+			defer cancel()
+
+			_, err = c.IndexSpace(ctx, &searchsvc.IndexSpaceRequest{
 				SpaceId:      spaceFlag,
 				ForceReindex: forceRescanFlag,
-			}, func(opts *client.CallOptions) { opts.RequestTimeout = 10 * time.Minute })
+			})
 			if err != nil {
 				fmt.Println("failed to index space: " + err.Error())
 				return err
@@ -75,6 +84,16 @@ func Index(cfg *config.Config) *cobra.Command {
 		false,
 		"force a rescan of all files, even if they are already indexed. This will make the indexing process much slower, but ensures that the index is up-to-date using the current search service configuration.",
 	)
+	indexCmd.Flags().String(
+		"endpoint",
+		"127.0.0.1:9220",
+		"the address of the search service gRPC endpoint.",
+	)
+	indexCmd.Flags().Bool(
+		"insecure",
+		false,
+		"disable TLS for the gRPC connection.",
+	)

 	return indexCmd
 }
@@ -81,35 +81,26 @@ var _ = Describe("SpaceDebouncer", func() {
 			}
 		}, log.NewLogger())

-		// Initial call to start the timers
+		// Reset the debounce timer every 50ms (shorter than the 100ms debounce
+		// duration) but stop before the 250ms timeout fires. Continuing past the
+		// timeout would race with the work function's cleanup of pending state:
+		// a Debounce call arriving right after the timeout fires would find
+		// pending empty and schedule a second workItem, breaking the assertion
+		// below that the work function is invoked exactly once.
 		debouncer.Debounce(spaceid, nil)
-
-		// Continuously reset the debounce timer using a ticker, at an interval
-		// shorter than the debounce time.
-		ticker := time.NewTicker(50 * time.Millisecond)
-		defer ticker.Stop()
-
-		done := make(chan bool)
-		go func() {
-			for {
-				select {
-				case <-done:
-					return
-				case <-ticker.C:
-					debouncer.Debounce(spaceid, nil)
-				}
+		for i := 0; i < 4 && callCount.Load() == 0; i++ {
+			time.Sleep(50 * time.Millisecond)
+			if callCount.Load() == 0 {
+				debouncer.Debounce(spaceid, nil)
 			}
-		}()
+		}

-		// The debounce timer (100ms) should be reset every 50ms and thus never fire.
-		// The timeout timer (250ms) should fire regardless.
+		// The debounce timer (100ms) was reset roughly every 50ms and should
+		// not have fired. The timeout timer (250ms) should fire regardless.
 		Eventually(func() int {
 			return int(callCount.Load())
 		}, "300ms").Should(Equal(1))

-		// Stop the ticker goroutine
-		close(done)
-
 		// And it should not fire again
 		Consistently(func() int {
 			return int(callCount.Load())
@@ -1,61 +1,13 @@
 package svc

 const (
-	// BundleUUIDRoleAdmin represents the admin role
-	BundleUUIDRoleAdmin = "71881883-1768-46bd-a24d-a356a2afdf7f"
-
-	// BundleUUIDRoleSpaceAdmin represents the space admin role
-	BundleUUIDRoleSpaceAdmin = "2aadd357-682c-406b-8874-293091995fdd"
-
-	// BundleUUIDRoleUser represents the user role.
-	BundleUUIDRoleUser = "d7beeea8-8ff4-406b-8fb6-ab2dd81e6b11"
-
-	// BundleUUIDRoleGuest represents the guest role.
-	BundleUUIDRoleGuest = "38071a68-456a-4553-846a-fa67bf5596cc"

 	// RoleManagementPermissionID is the hardcoded setting UUID for the role management permission
 	RoleManagementPermissionID string = "a53e601e-571f-4f86-8fec-d4576ef49c62"
-	// RoleManagementPermissionName is the hardcoded setting name for the role management permission
-	RoleManagementPermissionName string = "role-management"

 	// SettingsManagementPermissionID is the hardcoded setting UUID for the settings management permission
 	SettingsManagementPermissionID string = "3d58f441-4a05-42f8-9411-ef5874528ae1"
-	// SettingsManagementPermissionName is the hardcoded setting name for the settings management permission
-	SettingsManagementPermissionName string = "settings-management"
-
-	// SetSpaceQuotaPermissionID is the hardcoded setting UUID for the set space quota permission
-	SetSpaceQuotaPermissionID string = "4e6f9709-f9e7-44f1-95d4-b762d27b7896"
-	// SetSpaceQuotaPermissionName is the hardcoded setting name for the set space quota permission
-	SetSpaceQuotaPermissionName string = "set-space-quota"
-
-	// ListAllSpacesPermissionID is the hardcoded setting UUID for the list all spaces permission
-	ListAllSpacesPermissionID string = "016f6ddd-9501-4a0a-8ebe-64a20ee8ec82"
-	// ListAllSpacesPermissionName is the hardcoded setting name for the list all spaces permission
-	ListAllSpacesPermissionName string = "list-all-spaces"
-
-	// CreateSpacePermissionID is the hardcoded setting UUID for the create space permission
-	CreateSpacePermissionID string = "79e13b30-3e22-11eb-bc51-0b9f0bad9a58"
-	// CreateSpacePermissionName is the hardcoded setting name for the create space permission
-	CreateSpacePermissionName string = "create-space"
-
-	// SettingUUIDProfileLanguage is the hardcoded setting UUID for the user profile language
-	SettingUUIDProfileLanguage = "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f"

 	// AccountManagementPermissionID is the hardcoded setting UUID for the account management permission
 	AccountManagementPermissionID string = "8e587774-d929-4215-910b-a317b1e80f73"
-	// AccountManagementPermissionName is the hardcoded setting name for the account management permission
-	AccountManagementPermissionName string = "account-management"
-	// GroupManagementPermissionID is the hardcoded setting UUID for the group management permission
-	GroupManagementPermissionID string = "522adfbe-5908-45b4-b135-41979de73245"
-	// GroupManagementPermissionName is the hardcoded setting name for the group management permission
-	GroupManagementPermissionName string = "group-management"
-	// SelfManagementPermissionID is the hardcoded setting UUID for the self management permission
-	SelfManagementPermissionID string = "e03070e9-4362-4cc6-a872-1c7cb2eb2b8e"
-	// SelfManagementPermissionName is the hardcoded setting name for the self management permission
-	SelfManagementPermissionName string = "self-management"
-
-	// ChangeLogoPermissionID is the hardcoded setting UUID for the change-logo permission
-	ChangeLogoPermissionID string = "ed83fc10-1f54-4a9e-b5a7-fb517f5f3e01"
-	// ChangeLogoPermissionName is the hardcoded setting name for the change-logo permission
-	ChangeLogoPermissionName string = "change-logo"
 )
@@ -14,6 +14,8 @@ const (
 	BundleUUIDRoleUser = "d7beeea8-8ff4-406b-8fb6-ab2dd81e6b11"
 	// BundleUUIDRoleUserLight represents the user light role.
 	BundleUUIDRoleUserLight = "38071a68-456a-4553-846a-fa67bf5596cc"
+	// BundleUUIDRoleGuest represents the guest role.
+	BundleUUIDRoleGuest = "38071a68-456a-4553-846a-fa67bf5596cc"
 	// BundleUUIDProfile represents the user profile.
 	BundleUUIDProfile = "2a506de7-99bd-4f0d-994e-c38e72c28fd9"
 	// BundleUUIDServiceAccount represents the service account role.
@@ -18,7 +18,8 @@ type Config struct {
 	Reva         *shared.Reva  `yaml:"reva"`
 	Events       Events        `yaml:"events"`

-	SkipUserGroupsInToken bool `yaml:"skip_user_groups_in_token" env:"SHARING_SKIP_USER_GROUPS_IN_TOKEN" desc:"Disables the loading of user's group memberships from the reva access token." introductionVersion:"1.0.0"`
+	ServiceAccount        ServiceAccount `yaml:"service_account"`
+	SkipUserGroupsInToken bool           `yaml:"skip_user_groups_in_token" env:"SHARING_SKIP_USER_GROUPS_IN_TOKEN" desc:"Disables the loading of user's group memberships from the reva access token." introductionVersion:"1.0.0"`

 	UserSharingDriver              string               `yaml:"user_sharing_driver" env:"SHARING_USER_DRIVER" desc:"Driver to be used to persist shares. Supported values are 'jsoncs3', 'json', 'cs3' (deprecated) and 'owncloudsql'." introductionVersion:"1.0.0"`
 	UserSharingDrivers             UserSharingDrivers   `yaml:"user_sharing_drivers"`
@@ -100,6 +101,13 @@ type UserSharingJSONCS3Driver struct {
 	CacheTTL         int    `yaml:"cache_ttl" env:"SHARING_USER_JSONCS3_CACHE_TTL" desc:"TTL for the internal caches in seconds." introductionVersion:"1.0.0"`
 	MaxConcurrency   int    `yaml:"max_concurrency" env:"OC_MAX_CONCURRENCY;SHARING_USER_JSONCS3_MAX_CONCURRENCY" desc:"Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used." introductionVersion:"1.0.0"`
 }
+
+// ServiceAccount is the configuration for the used service account
+type ServiceAccount struct {
+	ServiceAccountID     string `yaml:"service_account_id" env:"OC_SERVICE_ACCOUNT_ID;SHARING_SERVICE_ACCOUNT" desc:"The ID of the service account the service should use. See the 'auth-service' service description for more details." introductionVersion:"7.0.0"`
+	ServiceAccountSecret string `yaml:"service_account_secret" env:"OC_SERVICE_ACCOUNT_SECRET;SHARING_SERVICE_ACCOUNT_SECRET" desc:"The service account secret." introductionVersion:"7.0.0"`
+}
+
 type PublicSharingDrivers struct {
 	JSON    PublicSharingJSONDriver    `yaml:"json"`
 	JSONCS3 PublicSharingJSONCS3Driver `yaml:"jsoncs3"`
@@ -58,5 +58,13 @@ func Validate(cfg *config.Config) error {
 		return shared.MissingSystemUserID(cfg.Service.Name)
 	}

+	if cfg.ServiceAccount.ServiceAccountID == "" {
+		return shared.MissingServiceAccountID(cfg.Service.Name)
+	}
+
+	if cfg.ServiceAccount.ServiceAccountSecret == "" {
+		return shared.MissingServiceAccountSecret(cfg.Service.Name)
+	}
+
 	return nil
 }
@@ -71,13 +71,15 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 							"machine_auth_apikey": cfg.UserSharingDrivers.CS3.SystemUserAPIKey,
 						},
 						"jsoncs3": map[string]any{
-							"gateway_addr":        cfg.Reva.Address,
-							"provider_addr":       cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
-							"service_user_id":     cfg.UserSharingDrivers.JSONCS3.SystemUserID,
-							"service_user_idp":    cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
-							"machine_auth_apikey": cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
-							"ttl":                 cfg.UserSharingDrivers.JSONCS3.CacheTTL,
-							"max_concurrency":     cfg.UserSharingDrivers.JSONCS3.MaxConcurrency,
+							"gateway_addr":           cfg.Reva.Address,
+							"provider_addr":          cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
+							"system_user_id":         cfg.UserSharingDrivers.JSONCS3.SystemUserID,
+							"system_user_idp":        cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
+							"machine_auth_apikey":    cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
+							"ttl":                    cfg.UserSharingDrivers.JSONCS3.CacheTTL,
+							"max_concurrency":        cfg.UserSharingDrivers.JSONCS3.MaxConcurrency,
+							"service_account_id":     cfg.ServiceAccount.ServiceAccountID,
+							"service_account_secret": cfg.ServiceAccount.ServiceAccountSecret,
 							"events": map[string]any{
 								"natsaddress":          cfg.Events.Addr,
 								"natsclusterid":        cfg.Events.ClusterID,
@@ -2,6 +2,15 @@

 package thumbnail

+import "github.com/davidbyttow/govips/v2/vips"
+
+func init() {
+	// temporary remove TIFF and JP2K from go-vips' list of supported
+	// imagetypes
+	delete(vips.ImageTypes, vips.ImageTypeTIFF)
+	delete(vips.ImageTypes, vips.ImageTypeJP2K)
+}
+
 var (
 	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
 	SupportedMimeTypes = map[string]struct{}{
@@ -11,7 +20,6 @@ var (
 		"image/gif":                         {},
 		"image/bmp":                         {},
 		"image/x-ms-bmp":                    {},
-		"image/tiff":                        {},
 		"text/plain":                        {},
 		"audio/flac":                        {},
 		"audio/mpeg":                        {},
@@ -1,6 +1,6 @@
 SHELL := bash
 NAME := web
-WEB_ASSETS_VERSION = v7.0.0
+WEB_ASSETS_VERSION = v7.0.1
 WEB_ASSETS_BRANCH = main

 ifneq (, $(shell command -v go 2> /dev/null)) # suppress `command not found warnings` for non go targets in CI
@@ -45,6 +45,11 @@ var (
 	}
 )

+// register the REPORT method at init so it cannot race with concurrent route setup in other services.
+func init() {
+	chi.RegisterMethod("REPORT")
+}
+
 // Service defines the extension handlers.
 type Service interface {
 	ServeHTTP(w http.ResponseWriter, r *http.Request)
@@ -93,9 +98,6 @@ func NewService(opts ...Option) (Service, error) {
 		svc.thumbnailsClient = nil
 	}

-	// register method with chi before any routing is set up
-	chi.RegisterMethod("REPORT")
-
 	m.Route(options.Config.HTTP.Root, func(r chi.Router) {

 		if !svc.config.DisablePreviews {
@@ -282,7 +282,8 @@ class CliContext implements Context {
 	 * @return void
 	 */
 	public function theAdministratorReindexesAllSpacesUsingTheCli(): void {
-		$command = "search index --all-spaces";
+		$endpoint = $this->featureContext->getBaseUrlHostName();
+		$command = "search index --all-spaces --endpoint $endpoint:9220 --insecure";
 		$body = [
 		  "command" => $command
 		];
@@ -298,7 +299,8 @@ class CliContext implements Context {
 	 */
 	public function theAdministratorReindexesASpaceUsingTheCli(string $spaceName): void {
 		$spaceId = $this->spacesContext->getSpaceIdByName($this->featureContext->getAdminUsername(), $spaceName);
-		$command = "search index --space $spaceId";
+		$endpoint = $this->featureContext->getBaseUrlHostName();
+		$command = "search index --space $spaceId --endpoint $endpoint:9220 --insecure";
 		$body = [
 		  "command" => $command
 		];
@@ -334,11 +336,12 @@ class CliContext implements Context {

 		$jsonResponse = $this->featureContext->getJsonDecodedResponse($response);

-		Assert::assertSame("OK", $jsonResponse["status"]);
+		Assert::assertSame("OK", $jsonResponse["status"], $jsonResponse["message"]);
 		Assert::assertSame(
 			0,
 			$jsonResponse["exitCode"],
 			"Expected exit code to be 0, but got " . $jsonResponse["exitCode"]
+			. ". Message: " . $jsonResponse["message"]
 		);
 	}

@@ -420,7 +420,7 @@ class SharingNgContext implements Context {
 		$expirationDateTime = (\array_key_exists('expirationDateTime', $rows))
 			? \date(DATE_RFC3339, \strtotime($rows['expirationDateTime'])) : null;

-		return GraphHelper::sendSharingInvitationForDrive(
+		$response = GraphHelper::sendSharingInvitationForDrive(
 			$this->featureContext->getBaseUrl(),
 			$this->featureContext->getStepLineRef(),
 			$user,
@@ -432,6 +432,10 @@ class SharingNgContext implements Context {
 			$permissionsAction,
 			$expirationDateTime
 		);
+		if ($response->getStatusCode() === 200) {
+			$this->featureContext->shareNgAddToCreatedUserGroupShares($response);
+		}
+		return $response;
 	}

 	/**
@@ -651,13 +655,7 @@ class SharingNgContext implements Context {
 		string $sharee,
 		TableNode $table
 	) {
-		$permissionID = "";
-		if ($shareType === "user") {
-			$permissionID = "u:" . $this->featureContext->getAttributeOfCreatedUser($sharee, 'id');
-		} elseif ($shareType === "group") {
-			$permissionID = "g:" . $this->featureContext->getAttributeOfCreatedGroup($sharee, 'id');
-		}
-
+		$permissionID = $this->featureContext->shareNgGetLastCreatedUserGroupShareID();
 		$this->featureContext->setResponse(
 			$this->updateResourceShare(
 				$user,
@@ -974,7 +972,6 @@ class SharingNgContext implements Context {
 	 * @param string $shareType (user|group|link)
 	 * @param string $space
 	 * @param string|null $resource
-	 * @param string|null $recipient
 	 *
 	 * @return ResponseInterface
 	 * @throws GuzzleException
@@ -984,29 +981,15 @@ class SharingNgContext implements Context {
 		string $sharer,
 		string $shareType,
 		string $space,
-		?string $resource = null,
-		?string $recipient = null
+		?string $resource = null
 	): ResponseInterface {
 		$spaceId = ($this->spacesContext->getSpaceByName($sharer, $space))["id"];
 		$itemId = (isset($resource)) ? $this->spacesContext->getResourceId($sharer, $space, $resource)
 		: $this->spacesContext->getResourceId($sharer, $space, $space);

-		$permissionID = "";
-
-		// if resource is not provided then it indicates a space share
-		// and the space shares are not stored
-		// so build the permission-id using the user or group id
-		if ($resource === null) {
-			if ($shareType === "user") {
-				$permissionID = "u:" . $this->featureContext->getAttributeOfCreatedUser($recipient, 'id');
-			} elseif ($shareType === "group") {
-				$permissionID = "g:" . $this->featureContext->getAttributeOfCreatedGroup($recipient, 'id');
-			}
-		} else {
-			$permissionID = ($shareType === 'link')
+		$permissionID = ($shareType === 'link')
 				? $this->featureContext->shareNgGetLastCreatedLinkShareID()
 				: $this->featureContext->shareNgGetLastCreatedUserGroupShareID();
-		}

 		return
 			GraphHelper::removeAccessToSpaceItem(
@@ -1040,12 +1023,18 @@ class SharingNgContext implements Context {
 	): ResponseInterface {
 		$spaceId = ($this->spacesContext->getSpaceByName($sharer, $space))["id"];

-		$permissionID = match ($shareType) {
-			'link' => $this->featureContext->shareNgGetLastCreatedLinkShareID(),
-			'user' => 'u:' . $this->featureContext->getAttributeOfCreatedUser($recipient, 'id'),
-			'group' => 'g:' . $this->featureContext->getAttributeOfCreatedGroup($recipient, 'id'),
-			default => throw new Exception("shareType '$shareType' does not match user|group|link "),
-		};
+		// if recipient is not provided, it means user tries to remove own access, then we need to get the user permission id
+		if ($shareType == 'user' && !isset($recipient)) {
+			$this->featureContext->shareNgAddToCreatedUserGroupShares($this->getDrivePermissionsList($sharer, $space));
+			$permissionID = $this->featureContext->shareNgGetLastCreatedUserGroupShareID();
+		} else {
+			$permissionID = match ($shareType) {
+				'link' => $this->featureContext->shareNgGetLastCreatedLinkShareID(),
+				'user' => $this->featureContext->shareNgGetLastCreatedUserGroupShareID(),
+				'group' => $this->featureContext->shareNgGetLastCreatedUserGroupShareID(),
+				default => throw new Exception("shareType '$shareType' does not match user|group|link "),
+			};
+		}

 		return
 			GraphHelper::removeAccessToSpace(
@@ -1078,7 +1067,7 @@ class SharingNgContext implements Context {
 		string $resource,
 		string $space
 	): void {
-		$response = $this->removeAccessToSpaceItem($sharer, $recipientType, $space, $resource);
+		$response = $this->removeAccessToSpaceItem($sharer, $recipientType, $space, $resource, $recipient);
 		$this->featureContext->theHTTPStatusCodeShouldBe(204, "", $response);
 	}

@@ -1195,6 +1184,44 @@ class SharingNgContext implements Context {
 		);
 	}

+	/**
+	 * @When /^user "([^"]*)" removes own access from space "([^"]*)" using root endpoint of the Graph API$/
+	 * @When /^user "([^"]*)" tries to remove own access from space "([^"]*)" using root endpoint of the Graph API$/
+	 *
+	 * @param string $user
+	 * @param string $space
+	 *
+	 * @return void
+	 * @throws JsonException
+	 * @throws GuzzleException
+	 */
+	public function userRemovesOwnAccessFromSpaceUsingGraphAPI(
+		string $user,
+		string $space
+	): void {
+		$this->featureContext->setResponse(
+			$this->removeAccessToSpace($user, 'user', $space)
+		);
+	}
+
+	/**
+	 * @Given /^user "([^"]*)" has removed own access from space "([^"]*)"$/
+	 *
+	 * @param string $user
+	 * @param string $space
+	 *
+	 * @return void
+	 * @throws JsonException
+	 * @throws GuzzleException
+	 */
+	public function userHasRemovedOwnAccessFromSpace(
+		string $user,
+		string $space
+	): void {
+		$response = $this->removeAccessToSpace($user, 'user', $space);
+		$this->featureContext->theHTTPStatusCodeShouldBe(204, "", $response);
+	}
+
 	/**
 	 * @When /^user "([^"]*)" removes the link from space "([^"]*)" using root endpoint of the Graph API$/
 	 *
@@ -1650,11 +1677,7 @@ class SharingNgContext implements Context {
 		TableNode $table
 	): void {
 		$bodyRows = $table->getRowsHash();
-		$permissionID = match ($bodyRows['shareType']) {
-			'user' => 'u:' . $this->featureContext->getAttributeOfCreatedUser($bodyRows['sharee'], 'id'),
-			'group' => 'g:' . $this->featureContext->getAttributeOfCreatedGroup($bodyRows['sharee'], 'id'),
-			default => throw new Exception("shareType {$bodyRows['shareType']} does not match user|group "),
-		};
+		$permissionID = $this->featureContext->shareNgGetLastCreatedUserGroupShareID();
 		$space = $bodyRows['space'];
 		$spaceId = ($this->spacesContext->getSpaceByName($user, $space))["id"];
 		$body = [];
@@ -342,6 +342,11 @@ _ocdav: api compatibility, return correct status code_
 - [coreApiWebdavPreviews/previews.feature:264](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/coreApiWebdavPreviews/previews.feature#L264)
 - [coreApiWebdavPreviews/previews.feature:265](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/coreApiWebdavPreviews/previews.feature#L265)

+
+#### [500 when user tries to delete group from space](https://github.com/opencloud-eu/opencloud/issues/2799)
+
+- [apiSharingNg1/removeAccessToDrive.feature:145](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/apiSharingNg1/removeAccessToDrive.feature#L145)
+
 ### Won't fix

 Not everything needs to be implemented for opencloud.
@@ -345,6 +345,10 @@ _ocdav: api compatibility, return correct status code_
 - [coreApiWebdavPreviews/previews.feature:264](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/coreApiWebdavPreviews/previews.feature#L264)
 - [coreApiWebdavPreviews/previews.feature:265](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/coreApiWebdavPreviews/previews.feature#L265)

+### TODO: adjust test
+
+- [apiSharingNg1/removeAccessToDrive.feature:145](https://github.com/opencloud-eu/opencloud/blob/main/tests/acceptance/features/apiSharingNg1/removeAccessToDrive.feature#L145)
+

 ### Won't fix

@@ -414,7 +414,7 @@ Feature: List a sharing permissions
                    },
                    "id": {
                      "type": "string",
-                      "pattern": "^u:%user_id_pattern%$"
+                      "pattern": "^%permissions_id_pattern%$"
                    },
                    "roles": {
                      "type": "array",
@@ -456,7 +456,7 @@ Feature: List a sharing permissions
                    },
                    "id": {
                      "type": "string",
-                      "pattern": "^u:%user_id_pattern%$"
+                      "pattern": "^%permissions_id_pattern%$"
                    },
                    "roles": {
                      "type": "array",
@@ -1428,7 +1428,7 @@ Feature: List a sharing permissions
                    },
                    "id": {
                      "type": "string",
-                      "pattern": "^u:%user_id_pattern%$"
+                      "pattern": "^%permissions_id_pattern%$"
                    },
                    "roles": {
                      "type": "array",
@@ -1470,7 +1470,7 @@ Feature: List a sharing permissions
                    },
                    "id": {
                      "type": "string",
-                      "pattern": "^u:%user_id_pattern%$"
+                      "pattern": "^%permissions_id_pattern%$"
                    },
                    "roles": {
                      "type": "array",
@@ -2769,4 +2769,4 @@ Feature: List a sharing permissions
          }
        }
      }
-      """
+      """
@@ -137,7 +137,7 @@ Feature: Remove access to a drive
  Scenario: user cannot remove himself from the project space if he is the last manager using root endpoint
    Given the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
    And user "Alice" has created a space "NewSpace" with the default quota using the Graph API
-    When user "Alice" tries to remove the access of user "Alice" from space "NewSpace" using root endpoint of the Graph API
+    When user "Alice" tries to remove own access from space "NewSpace" using root endpoint of the Graph API
    Then the HTTP status code should be "403"
    And the user "Alice" should have a space called "NewSpace"

@@ -152,7 +152,7 @@ Feature: Remove access to a drive
      | sharee          | group1   |
      | shareType       | group    |
      | permissionsRole | Manager  |
-    And user "Alice" has removed the access of user "Alice" from space "NewSpace"
+    And user "Alice" has removed own access from space "NewSpace"
    When user "Brian" tries to remove the access of group "group1" from space "NewSpace" using root endpoint of the Graph API
    Then the HTTP status code should be "403"
    And the user "Brian" should have a space called "NewSpace"
@@ -3407,7 +3407,7 @@ Feature: resources shared by user
                "name",
                "id",
                "eTag",
-                "folder",
+                "root",
                "lastModifiedDateTime",
                "size"
              ],
@@ -3415,7 +3415,7 @@ Feature: resources shared by user
                "name": {
                  "const": "."
                },
-                "folder": {
+                "root": {
                  "const": {}
                },
                "id": {
@@ -1777,7 +1777,7 @@ Feature: Send a sharing invitations
                },
                "id": {
                  "type": "string",
-                  "pattern": "^g:%group_id_pattern%$"
+                  "pattern": "^%permissions_id_pattern%$"
                },
                "roles": {
                  "type": "array",
@@ -278,7 +278,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -437,7 +437,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^g:%group_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -517,7 +517,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^g:%group_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -602,7 +602,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^g:%group_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -680,7 +680,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^g:%group_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -766,7 +766,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^g:%group_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -842,7 +842,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -918,7 +918,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -1000,7 +1000,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -1077,7 +1077,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -1159,7 +1159,7 @@ Feature: Update permission of a share
          },
          "id": {
            "type": "string",
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          },
          "roles": {
            "type": "array",
@@ -1417,7 +1417,7 @@ Feature: Update permission of a share
            }
          },
          "id": {
-            "pattern": "^u:%user_id_pattern%$"
+            "pattern": "^%permissions_id_pattern%$"
          }
        }
      }
@@ -9,6 +9,10 @@

 version: "2"

+run:
+  build-tags:
+    - libpathrs
+
 linters:
  enable:
    - asasalint
@@ -4,7 +4,54 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).

-## [Unreleased 0.5.z] ##
+## [Unreleased] ##
+
+## [0.6.1] - 2025-11-19 ##
+
+> At last up jumped the cunning spider, and fiercely held her fast.
+
+### Fixed ###
+- Our logic for deciding whether to use `openat2(2)` or fallback to an `O_PATH`
+  resolver would cache the result to avoid doing needless test runs of
+  `openat2(2)`. However, this causes issues when `pathrs-lite` is being used by
+  a program that applies new seccomp-bpf filters onto itself -- if the filter
+  denies `openat2(2)` then we would return that error rather than falling back
+  to the `O_PATH` resolver. To resolve this issue, we no longer cache the
+  result if `openat2(2)` was successful, only if there was an error.
+- A file descriptor leak in our `openat2` wrapper (when doing the necessary
+  `dup` for `RESOLVE_IN_ROOT`) has been removed.
+
+## [0.5.2] - 2025-11-19 ##
+
+> "Will you walk into my parlour?" said a spider to a fly.
+
+### Fixed ###
+- Our logic for deciding whether to use `openat2(2)` or fallback to an `O_PATH`
+  resolver would cache the result to avoid doing needless test runs of
+  `openat2(2)`. However, this causes issues when `pathrs-lite` is being used by
+  a program that applies new seccomp-bpf filters onto itself -- if the filter
+  denies `openat2(2)` then we would return that error rather than falling back
+  to the `O_PATH` resolver. To resolve this issue, we no longer cache the
+  result if `openat2(2)` was successful, only if there was an error.
+- A file descriptor leak in our `openat2` wrapper (when doing the necessary
+  `dup` for `RESOLVE_IN_ROOT`) has been removed.
+
+## [0.6.0] - 2025-11-03 ##
+
+> By the Power of Greyskull!
+
+### Breaking ###
+- The deprecated `MkdirAll`, `MkdirAllHandle`, `OpenInRoot`, `OpenatInRoot` and
+  `Reopen` wrappers have been removed. Please switch to using `pathrs-lite`
+  directly.
+
+### Added ###
+- `pathrs-lite` now has support for using libpathrs as a backend. This is
+  opt-in and can be enabled at build time with the `libpathrs` build tag. The
+  intention is to allow for downstream libraries and other projects to make use
+  of the pure-Go `github.com/cyphar/filepath-securejoin/pathrs-lite` package
+  and distributors can then opt-in to using `libpathrs` for the entire binary
+  if they wish.

 ## [0.5.1] - 2025-10-31 ##

@@ -383,7 +430,10 @@ This is our first release of `github.com/cyphar/filepath-securejoin`,
 containing a full implementation with a coverage of 93.5% (the only missing
 cases are the error cases, which are hard to mocktest at the moment).

-[Unreleased 0.5.z]: https://github.com/cyphar/filepath-securejoin/compare/v0.5.1...release-0.5
+[Unreleased]: https://github.com/cyphar/filepath-securejoin/compare/v0.6.1...HEAD
+[0.6.1]: https://github.com/cyphar/filepath-securejoin/compare/v0.6.0...v0.6.1
+[0.6.0]: https://github.com/cyphar/filepath-securejoin/compare/v0.5.0...v0.6.0
+[0.5.2]: https://github.com/cyphar/filepath-securejoin/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/cyphar/filepath-securejoin/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/cyphar/filepath-securejoin/compare/v0.4.1...v0.5.0
 [0.4.1]: https://github.com/cyphar/filepath-securejoin/compare/v0.4.0...v0.4.1
@@ -1 +1 @@
-0.5.1
+0.6.1
@@ -1,48 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-package securejoin
-
-import (
-	"github.com/cyphar/filepath-securejoin/pathrs-lite"
-)
-
-var (
-	// MkdirAll is a wrapper around [pathrs.MkdirAll].
-	//
-	// Deprecated: You should use [pathrs.MkdirAll] directly instead. This
-	// wrapper will be removed in filepath-securejoin v0.6.
-	MkdirAll = pathrs.MkdirAll
-
-	// MkdirAllHandle is a wrapper around [pathrs.MkdirAllHandle].
-	//
-	// Deprecated: You should use [pathrs.MkdirAllHandle] directly instead.
-	// This wrapper will be removed in filepath-securejoin v0.6.
-	MkdirAllHandle = pathrs.MkdirAllHandle
-
-	// OpenInRoot is a wrapper around [pathrs.OpenInRoot].
-	//
-	// Deprecated: You should use [pathrs.OpenInRoot] directly instead. This
-	// wrapper will be removed in filepath-securejoin v0.6.
-	OpenInRoot = pathrs.OpenInRoot
-
-	// OpenatInRoot is a wrapper around [pathrs.OpenatInRoot].
-	//
-	// Deprecated: You should use [pathrs.OpenatInRoot] directly instead. This
-	// wrapper will be removed in filepath-securejoin v0.6.
-	OpenatInRoot = pathrs.OpenatInRoot
-
-	// Reopen is a wrapper around [pathrs.Reopen].
-	//
-	// Deprecated: You should use [pathrs.Reopen] directly instead. This
-	// wrapper will be removed in filepath-securejoin v0.6.
-	Reopen = pathrs.Reopen
-)
@@ -1,33 +0,0 @@
-## `pathrs-lite` ##
-
-`github.com/cyphar/filepath-securejoin/pathrs-lite` provides a minimal **pure
-Go** implementation of the core bits of [libpathrs][]. This is not intended to
-be a complete replacement for libpathrs, instead it is mainly intended to be
-useful as a transition tool for existing Go projects.
-
-The long-term plan for `pathrs-lite` is to provide a build tag that will cause
-all `pathrs-lite` operations to call into libpathrs directly, thus removing
-code duplication for projects that wish to make use of libpathrs (and providing
-the ability for software packagers to opt-in to libpathrs support without
-needing to patch upstream).
-
-[libpathrs]: https://github.com/cyphar/libpathrs
-
-### License ###
-
-Most of this subpackage is licensed under the Mozilla Public License (version
-2.0). For more information, see the top-level [COPYING.md][] and
-[LICENSE.MPL-2.0][] files, as well as the individual license headers for each
-file.
-
-```
-Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-Copyright (C) 2024-2025 SUSE LLC
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, You can obtain one at https://mozilla.org/MPL/2.0/.
-```
-
-[COPYING.md]: ../COPYING.md
-[LICENSE.MPL-2.0]: ../LICENSE.MPL-2.0
@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-// Package pathrs (pathrs-lite) is a less complete pure Go implementation of
-// some of the APIs provided by [libpathrs].
-package pathrs
@@ -1,30 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-// Copyright (C) 2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-// Package assert provides some basic assertion helpers for Go.
-package assert
-
-import (
-	"fmt"
-)
-
-// Assert panics if the predicate is false with the provided argument.
-func Assert(predicate bool, msg any) {
-	if !predicate {
-		panic(msg)
-	}
-}
-
-// Assertf panics if the predicate is false and formats the message using the
-// same formatting as [fmt.Printf].
-//
-// [fmt.Printf]: https://pkg.go.dev/fmt#Printf
-func Assertf(predicate bool, fmtMsg string, args ...any) {
-	Assert(predicate, fmt.Sprintf(fmtMsg, args...))
-}
@@ -1,41 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-// Package internal contains unexported common code for filepath-securejoin.
-package internal
-
-import (
-	"errors"
-
-	"golang.org/x/sys/unix"
-)
-
-type xdevErrorish struct {
-	description string
-}
-
-func (err xdevErrorish) Error() string        { return err.description }
-func (err xdevErrorish) Is(target error) bool { return target == unix.EXDEV }
-
-var (
-	// ErrPossibleAttack indicates that some attack was detected.
-	ErrPossibleAttack error = xdevErrorish{"possible attack detected"}
-
-	// ErrPossibleBreakout indicates that during an operation we ended up in a
-	// state that could be a breakout but we detected it.
-	ErrPossibleBreakout error = xdevErrorish{"possible breakout detected"}
-
-	// ErrInvalidDirectory indicates an unlinked directory.
-	ErrInvalidDirectory = errors.New("wandered into deleted directory")
-
-	// ErrDeletedInode indicates an unlinked file (non-directory).
-	ErrDeletedInode = errors.New("cannot verify path of deleted inode")
-)
@@ -1,148 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-package fd
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/cyphar/filepath-securejoin/pathrs-lite/internal/gocompat"
-)
-
-// prepareAtWith returns -EBADF (an invalid fd) if dir is nil, otherwise using
-// the dir.Fd(). We use -EBADF because in filepath-securejoin we generally
-// don't want to allow relative-to-cwd paths. The returned path is an
-// *informational* string that describes a reasonable pathname for the given
-// *at(2) arguments. You must not use the full path for any actual filesystem
-// operations.
-func prepareAt(dir Fd, path string) (dirFd int, unsafeUnmaskedPath string) {
-	dirFd, dirPath := -int(unix.EBADF), "."
-	if dir != nil {
-		dirFd, dirPath = int(dir.Fd()), dir.Name()
-	}
-	if !filepath.IsAbs(path) {
-		// only prepend the dirfd path for relative paths
-		path = dirPath + "/" + path
-	}
-	// NOTE: If path is "." or "", the returned path won't be filepath.Clean,
-	// but that's okay since this path is either used for errors (in which case
-	// a trailing "/" or "/." is important information) or will be
-	// filepath.Clean'd later (in the case of fd.Openat).
-	return dirFd, path
-}
-
-// Openat is an [Fd]-based wrapper around unix.Openat.
-func Openat(dir Fd, path string, flags int, mode int) (*os.File, error) { //nolint:unparam // wrapper func
-	dirFd, fullPath := prepareAt(dir, path)
-	// Make sure we always set O_CLOEXEC.
-	flags |= unix.O_CLOEXEC
-	fd, err := unix.Openat(dirFd, path, flags, uint32(mode))
-	if err != nil {
-		return nil, &os.PathError{Op: "openat", Path: fullPath, Err: err}
-	}
-	runtime.KeepAlive(dir)
-	// openat is only used with lexically-safe paths so we can use
-	// filepath.Clean here, and also the path itself is not going to be used
-	// for actual path operations.
-	fullPath = filepath.Clean(fullPath)
-	return os.NewFile(uintptr(fd), fullPath), nil
-}
-
-// Fstatat is an [Fd]-based wrapper around unix.Fstatat.
-func Fstatat(dir Fd, path string, flags int) (unix.Stat_t, error) {
-	dirFd, fullPath := prepareAt(dir, path)
-	var stat unix.Stat_t
-	if err := unix.Fstatat(dirFd, path, &stat, flags); err != nil {
-		return stat, &os.PathError{Op: "fstatat", Path: fullPath, Err: err}
-	}
-	runtime.KeepAlive(dir)
-	return stat, nil
-}
-
-// Faccessat is an [Fd]-based wrapper around unix.Faccessat.
-func Faccessat(dir Fd, path string, mode uint32, flags int) error {
-	dirFd, fullPath := prepareAt(dir, path)
-	err := unix.Faccessat(dirFd, path, mode, flags)
-	if err != nil {
-		err = &os.PathError{Op: "faccessat", Path: fullPath, Err: err}
-	}
-	runtime.KeepAlive(dir)
-	return err
-}
-
-// Readlinkat is an [Fd]-based wrapper around unix.Readlinkat.
-func Readlinkat(dir Fd, path string) (string, error) {
-	dirFd, fullPath := prepareAt(dir, path)
-	size := 4096
-	for {
-		linkBuf := make([]byte, size)
-		n, err := unix.Readlinkat(dirFd, path, linkBuf)
-		if err != nil {
-			return "", &os.PathError{Op: "readlinkat", Path: fullPath, Err: err}
-		}
-		runtime.KeepAlive(dir)
-		if n != size {
-			return string(linkBuf[:n]), nil
-		}
-		// Possible truncation, resize the buffer.
-		size *= 2
-	}
-}
-
-const (
-	// STATX_MNT_ID_UNIQUE is provided in golang.org/x/sys@v0.20.0, but in order to
-	// avoid bumping the requirement for a single constant we can just define it
-	// ourselves.
-	_STATX_MNT_ID_UNIQUE = 0x4000 //nolint:revive // unix.* name
-
-	// We don't care which mount ID we get. The kernel will give us the unique
-	// one if it is supported. If the kernel doesn't support
-	// STATX_MNT_ID_UNIQUE, the bit is ignored and the returned request mask
-	// will only contain STATX_MNT_ID (if supported).
-	wantStatxMntMask = _STATX_MNT_ID_UNIQUE | unix.STATX_MNT_ID
-)
-
-var hasStatxMountID = gocompat.SyncOnceValue(func() bool {
-	var stx unix.Statx_t
-	err := unix.Statx(-int(unix.EBADF), "/", 0, wantStatxMntMask, &stx)
-	return err == nil && stx.Mask&wantStatxMntMask != 0
-})
-
-// GetMountID gets the mount identifier associated with the fd and path
-// combination. It is effectively a wrapper around fetching
-// STATX_MNT_ID{,_UNIQUE} with unix.Statx, but with a fallback to 0 if the
-// kernel doesn't support the feature.
-func GetMountID(dir Fd, path string) (uint64, error) {
-	// If we don't have statx(STATX_MNT_ID*) support, we can't do anything.
-	if !hasStatxMountID() {
-		return 0, nil
-	}
-
-	dirFd, fullPath := prepareAt(dir, path)
-
-	var stx unix.Statx_t
-	err := unix.Statx(dirFd, path, unix.AT_EMPTY_PATH|unix.AT_SYMLINK_NOFOLLOW, wantStatxMntMask, &stx)
-	if stx.Mask&wantStatxMntMask == 0 {
-		// It's not a kernel limitation, for some reason we couldn't get a
-		// mount ID. Assume it's some kind of attack.
-		err = fmt.Errorf("could not get mount id: %w", err)
-	}
-	if err != nil {
-		return 0, &os.PathError{Op: "statx(STATX_MNT_ID_...)", Path: fullPath, Err: err}
-	}
-	runtime.KeepAlive(dir)
-	return stx.Mnt_id, nil
-}
@@ -1,55 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-// Copyright (C) 2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-// Package fd provides a drop-in interface-based replacement of [*os.File] that
-// allows for things like noop-Close wrappers to be used.
-//
-// [*os.File]: https://pkg.go.dev/os#File
-package fd
-
-import (
-	"io"
-	"os"
-)
-
-// Fd is an interface that mirrors most of the API of [*os.File], allowing you
-// to create wrappers that can be used in place of [*os.File].
-//
-// [*os.File]: https://pkg.go.dev/os#File
-type Fd interface {
-	io.Closer
-	Name() string
-	Fd() uintptr
-}
-
-// Compile-time interface checks.
-var (
-	_ Fd = (*os.File)(nil)
-	_ Fd = noClose{}
-)
-
-type noClose struct{ inner Fd }
-
-func (f noClose) Name() string { return f.inner.Name() }
-func (f noClose) Fd() uintptr  { return f.inner.Fd() }
-
-func (f noClose) Close() error { return nil }
-
-// NopCloser returns an [*os.File]-like object where the [Close] method is now
-// a no-op.
-//
-// Note that for [*os.File] and similar objects, the Go garbage collector will
-// still call [Close] on the underlying file unless you use
-// [runtime.SetFinalizer] to disable this behaviour. This is up to the caller
-// to do (if necessary).
-//
-// [*os.File]: https://pkg.go.dev/os#File
-// [Close]: https://pkg.go.dev/io#Closer
-// [runtime.SetFinalizer]: https://pkg.go.dev/runtime#SetFinalizer
-func NopCloser(f Fd) Fd { return noClose{inner: f} }
@@ -1,78 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-package fd
-
-import (
-	"fmt"
-	"os"
-	"runtime"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/cyphar/filepath-securejoin/pathrs-lite/internal"
-)
-
-// DupWithName creates a new file descriptor referencing the same underlying
-// file, but with the provided name instead of fd.Name().
-func DupWithName(fd Fd, name string) (*os.File, error) {
-	fd2, err := unix.FcntlInt(fd.Fd(), unix.F_DUPFD_CLOEXEC, 0)
-	if err != nil {
-		return nil, os.NewSyscallError("fcntl(F_DUPFD_CLOEXEC)", err)
-	}
-	runtime.KeepAlive(fd)
-	return os.NewFile(uintptr(fd2), name), nil
-}
-
-// Dup creates a new file description referencing the same underlying file.
-func Dup(fd Fd) (*os.File, error) {
-	return DupWithName(fd, fd.Name())
-}
-
-// Fstat is an [Fd]-based wrapper around unix.Fstat.
-func Fstat(fd Fd) (unix.Stat_t, error) {
-	var stat unix.Stat_t
-	if err := unix.Fstat(int(fd.Fd()), &stat); err != nil {
-		return stat, &os.PathError{Op: "fstat", Path: fd.Name(), Err: err}
-	}
-	runtime.KeepAlive(fd)
-	return stat, nil
-}
-
-// Fstatfs is an [Fd]-based wrapper around unix.Fstatfs.
-func Fstatfs(fd Fd) (unix.Statfs_t, error) {
-	var statfs unix.Statfs_t
-	if err := unix.Fstatfs(int(fd.Fd()), &statfs); err != nil {
-		return statfs, &os.PathError{Op: "fstatfs", Path: fd.Name(), Err: err}
-	}
-	runtime.KeepAlive(fd)
-	return statfs, nil
-}
-
-// IsDeadInode detects whether the file has been unlinked from a filesystem and
-// is thus a "dead inode" from the kernel's perspective.
-func IsDeadInode(file Fd) error {
-	// If the nlink of a file drops to 0, there is an attacker deleting
-	// directories during our walk, which could result in weird /proc values.
-	// It's better to error out in this case.
-	stat, err := Fstat(file)
-	if err != nil {
-		return fmt.Errorf("check for dead inode: %w", err)
-	}
-	if stat.Nlink == 0 {
-		err := internal.ErrDeletedInode
-		if stat.Mode&unix.S_IFMT == unix.S_IFDIR {
-			err = internal.ErrInvalidDirectory
-		}
-		return fmt.Errorf("%w %q", err, file.Name())
-	}
-	return nil
-}
@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-package fd
-
-import (
-	"os"
-	"runtime"
-
-	"golang.org/x/sys/unix"
-)
-
-// Fsopen is an [Fd]-based wrapper around unix.Fsopen.
-func Fsopen(fsName string, flags int) (*os.File, error) {
-	// Make sure we always set O_CLOEXEC.
-	flags |= unix.FSOPEN_CLOEXEC
-	fd, err := unix.Fsopen(fsName, flags)
-	if err != nil {
-		return nil, os.NewSyscallError("fsopen "+fsName, err)
-	}
-	return os.NewFile(uintptr(fd), "fscontext:"+fsName), nil
-}
-
-// Fsmount is an [Fd]-based wrapper around unix.Fsmount.
-func Fsmount(ctx Fd, flags, mountAttrs int) (*os.File, error) {
-	// Make sure we always set O_CLOEXEC.
-	flags |= unix.FSMOUNT_CLOEXEC
-	fd, err := unix.Fsmount(int(ctx.Fd()), flags, mountAttrs)
-	if err != nil {
-		return nil, os.NewSyscallError("fsmount "+ctx.Name(), err)
-	}
-	return os.NewFile(uintptr(fd), "fsmount:"+ctx.Name()), nil
-}
-
-// OpenTree is an [Fd]-based wrapper around unix.OpenTree.
-func OpenTree(dir Fd, path string, flags uint) (*os.File, error) {
-	dirFd, fullPath := prepareAt(dir, path)
-	// Make sure we always set O_CLOEXEC.
-	flags |= unix.OPEN_TREE_CLOEXEC
-	fd, err := unix.OpenTree(dirFd, path, flags)
-	if err != nil {
-		return nil, &os.PathError{Op: "open_tree", Path: fullPath, Err: err}
-	}
-	runtime.KeepAlive(dir)
-	return os.NewFile(uintptr(fd), fullPath), nil
-}
@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-//go:build linux
-
-// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
-// Copyright (C) 2024-2025 SUSE LLC
-//
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-package fd
-
-import (
-	"errors"
-	"os"
-	"runtime"
-
-	"golang.org/x/sys/unix"
-)
-
-func scopedLookupShouldRetry(how *unix.OpenHow, err error) bool {
-	// RESOLVE_IN_ROOT (and RESOLVE_BENEATH) can return -EAGAIN if we resolve
-	// ".." while a mount or rename occurs anywhere on the system. This could
-	// happen spuriously, or as the result of an attacker trying to mess with
-	// us during lookup.
-	//
-	// In addition, scoped lookups have a "safety check" at the end of
-	// complete_walk which will return -EXDEV if the final path is not in the
-	// root.
-	return how.Resolve&(unix.RESOLVE_IN_ROOT|unix.RESOLVE_BENEATH) != 0 &&
-		(errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EXDEV))
-}
-
-// This is a fairly arbitrary limit we have just to avoid an attacker being
-// able to make us spin in an infinite retry loop -- callers can choose to
-// retry on EAGAIN if they prefer.
-const scopedLookupMaxRetries = 128
-
-// Openat2 is an [Fd]-based wrapper around unix.Openat2, but with some retry
-// logic in case of EAGAIN errors.
-func Openat2(dir Fd, path string, how *unix.OpenHow) (*os.File, error) {
-	dirFd, fullPath := prepareAt(dir, path)
-	// Make sure we always set O_CLOEXEC.
-	how.Flags |= unix.O_CLOEXEC
-	var tries int
-	for {
-		fd, err := unix.Openat2(dirFd, path, how)
-		if err != nil {
-			if scopedLookupShouldRetry(how, err) && tries < scopedLookupMaxRetries {
-				// We retry a couple of times to avoid the spurious errors, and
-				// if we are being attacked then returning -EAGAIN is the best
-				// we can do.
-				tries++
-				continue
-			}
-			return nil, &os.PathError{Op: "openat2", Path: fullPath, Err: err}
-		}
-		runtime.KeepAlive(dir)
-		return os.NewFile(uintptr(fd), fullPath), nil
-	}
-}
Author	SHA1	Message	Date
OpenCloud Devops	d3fab302a3	🎉 Release 7.0.0 (#2802 ) * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0	2026-05-21 13:09:02 +02:00
Ralf Haferkamp	a52de9fe9e	Merge pull request #2805 from michaelstingl/fix-2804-email-double-escape fix(notifications): don't re-escape email vars for each recipient	2026-05-21 11:33:56 +02:00
Viktor Scharf	c0418c2325	[full-ci] chore: bump reva to v2.46.0 (#2809 )	2026-05-21 11:31:01 +02:00
Ralf Haferkamp	734fd74f5c	Merge pull request #2798 from opencloud-eu/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5 build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5	2026-05-21 10:58:13 +02:00
Ralf Haferkamp	d6c1a76896	Merge pull request #2795 from fschade/fix-missing-oidc-sub-session fix: remove unnecessary error log it the oidc access token verify method is set to none	2026-05-21 09:58:10 +02:00
Michael Stingl	12206e3e70	fix(notifications): don't re-escape email vars for each recipient escapeStringMap mutated its input map. The recipient loop in eventsNotifier.render reuses that map across iterations, so each recipient past the first got values with one extra HTML escape layer. Return a new map instead. Fixes #2804 Signed-off-by: Michael Stingl <mail@michaelstingl.com>	2026-05-20 18:56:28 +02:00
Florian Schade	457284885b	fix: remove unnecessary error log it the oidc access token verify method is set to none	2026-05-20 15:11:03 +02:00
Christian Richter	1462301116	incorporate requested changes Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-05-20 14:14:00 +02:00
Christian Richter	0351adfe6b	change logger level Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-05-20 14:14:00 +02:00
OpenCloud Devops	0a0be61d82	🎉 Release 7.0.0-rc.0 (#2741 ) * 🎉 Release 6.2.1 * 🎉 Release 6.2.1 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 6.3.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0 * 🎉 Release 7.0.0-rc.0	2026-05-20 11:58:17 +02:00
Viktor Scharf	594c9bb2b6	[decomposed] chore: bump web to v7.0.1 (#2791 )	2026-05-20 11:35:17 +02:00
Viktor Scharf	a8885a3d4d	[full-ci] chore: bump reva to v2.45.0 (#2787 )	2026-05-20 10:17:25 +02:00
dependabot[bot]	03e87b9e8e	build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.4 to 3.0.5. - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5) --- updated-dependencies: - dependency-name: github.com/go-jose/go-jose/v3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-20 00:37:44 +00:00
Ralf Haferkamp	56a65e68b9	Merge pull request #2740 from opencloud-eu/dependabot/go_modules/golang.org/x/image-0.40.0 build(deps): bump golang.org/x/image from 0.38.0 to 0.40.0	2026-05-19 18:53:31 +02:00
dependabot[bot]	7b1b7e883c	build(deps): bump golang.org/x/image from 0.38.0 to 0.40.0 Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.40.0. - [Commits](https://github.com/golang/image/compare/v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/image dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-19 14:15:27 +00:00
Ralf Haferkamp	0601a80e19	remove remaining store proto stuff They were accidently reintroduce with a recent PR (https://github.com/opencloud-eu/opencloud/pull/2755)	2026-05-19 14:49:26 +02:00
Ralf Haferkamp	1265d33be5	Merge pull request #2750 from opencloud-eu/dependabot/go_modules/github.com/tidwall/gjson-1.19.0 build(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0	2026-05-19 12:24:34 +02:00
Ralf Haferkamp	33e33eaa36	Merge pull request #2786 from opencloud-eu/fix/duplicate-service-field-in-debug-log fix(debug): drop duplicate service field from probe fallback log	2026-05-19 12:13:39 +02:00
Dominik Schmidt	0ad6112dd2	chore(debug): remove leftover commented-out probeHandler	2026-05-19 11:13:59 +02:00
Dominik Schmidt	46a8dee126	fix(debug): drop duplicate service field from probe fallback log The base logger created by log.Configure already attaches a "service" field via its context. handleProbe added it a second time, producing JSON log entries with two "service" keys. Remove the redundant Str("service", name) and the now-unused name parameter.	2026-05-19 11:04:23 +02:00
Jörn Friedrich Dreyer	66fae3061d	Merge pull request #2755 from opencloud-eu/no-registry-lookup-in-cli No registry lookup in cli	2026-05-18 11:38:21 +02:00
Jörn Friedrich Dreyer	d6d70ec06c	Merge pull request #2756 from opencloud-eu/delete-unused-store-proto delete unused store proto	2026-05-18 11:24:33 +02:00
Ralf Haferkamp	6fffd29fc7	Merge pull request #2763 from rhafer/bumpjs chore: bump js dependencies in idp	2026-05-18 09:22:30 +02:00
Viktor Scharf	55dbd40324	[full-ci] preview-tests. update fixtures for different processors (#2767 ) * preview test: addapt fixtures * fix lint	2026-05-15 15:56:14 +02:00
Michael Barz	e7b2a88702	test: modify codacy exclude list	2026-05-14 16:39:17 +02:00
Michael Barz	ad1ce0d1ea	Merge pull request #2762 from opencloud-eu/codacy-tuning test: modify exclude list and add coverage upload	2026-05-14 15:52:39 +02:00
Michael Barz	12de3a8cd8	test: modify exclude list and add coverage upload	2026-05-14 11:32:59 +02:00
Ralf Haferkamp	f881cda052	chore: bump js dependencies in idp	2026-05-13 17:29:29 +02:00
Ralf Haferkamp	48808b3368	Merge pull request #2760 from opencloud-eu/feature/guest-links Persist space memberships in share manager	2026-05-13 16:53:33 +02:00
Anja Barz	b33249488c	Update README with correct Libregraph idm link	2026-05-13 15:18:57 +02:00
Anja Barz	4b4c33f5ce	Update README with LDAP certificate details Added information about LDAP certificate management and renewal process.	2026-05-13 15:18:57 +02:00
dependabot[bot]	e675e098ff	build(deps-dev): bump dotenv-expand in /services/idp Bumps [dotenv-expand](https://github.com/motdotla/dotenv-expand) from 12.0.3 to 13.0.0. - [Changelog](https://github.com/motdotla/dotenv-expand/blob/master/CHANGELOG.md) - [Commits](https://github.com/motdotla/dotenv-expand/compare/v12.0.3...v13.0.0) --- updated-dependencies: - dependency-name: dotenv-expand dependency-version: 13.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-13 15:06:17 +02:00
Andre Duffeck	de9b3ca001	Merge pull request #2758 from rhafer/no-tiff-vips fix: disallow thumbnails for tiff and jpeg2000 images	2026-05-13 14:47:11 +02:00
Ralf Haferkamp	0511ab2690	bump reva to latest main after feature/guest-links was merged	2026-05-13 14:39:31 +02:00
Ralf Haferkamp	f056326c4c	Merge remote-tracking branch 'origin/main' into feature/guest-links	2026-05-13 14:35:54 +02:00
Ralf Haferkamp	9dbe4decf8	chore: bump docker base image to alpine 3.23 (#2754 )	2026-05-13 14:13:27 +02:00
Jörn Friedrich Dreyer	2b1c4fe300	index command: allow passing insecure flag Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 14:00:19 +02:00
Jörn Friedrich Dreyer	13c7af7f7f	tests: set endpoint for index cli Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 13:52:26 +02:00
Ralf Haferkamp	c40629dd85	fix: disallow thumbnails for tiff and jpeg2000 images	2026-05-13 13:28:10 +02:00
Alexandv.scharf	d831a1caae	change: set capability favorites to false, for unadjusted clients (#2731 ) * change: introduce new capability favorites_v2 * change: omit not needed favorites_v2 capability * bump web commit id * skip favorite test --------- Co-authored-by: v.scharf <v.scharf@opencloud.eu>	2026-05-13 13:22:23 +02:00
Sai Asish Y	8b48501082	fix(webdav): register chi REPORT method in init to avoid race with concurrent route setup	2026-05-13 12:19:17 +02:00
Jörn Friedrich Dreyer	5854b602f1	make search index cli use grpc client Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 11:56:41 +02:00
Jörn Friedrich Dreyer	2124b6c657	generate grpc client stubs	2026-05-13 11:33:27 +02:00
Jörn Friedrich Dreyer	a79ea88773	delete unused store proto Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 11:05:32 +02:00
Jörn Friedrich Dreyer	5d7bfc9033	delete unused constants Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 10:54:00 +02:00
Jörn Friedrich Dreyer	fb4112dc68	update generated code Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>	2026-05-13 10:52:44 +02:00
Andre Duffeck	748f3bc89a	Merge pull request #2743 from opencloud-eu/fix-test fix: cleaner debounce timer test	2026-05-13 09:48:17 +02:00
Ralf Haferkamp	1e88251a2b	feat(sharing): Require service account to be configured for sharing service In order to be able to run migrations, the "sharing" service now needs the "service_account_id" and -"_secret" to be configured. This is a "breaking/backwards incompatible" change.	2026-05-13 09:23:54 +02:00
Ralf Haferkamp	59bd11d02a	chore: bump reva	2026-05-13 09:23:54 +02:00
Ralf Haferkamp	005c91a722	fix: use runner to start activitylog service activitylog was still using oklog run.Group{} for starting the service this cause issue during shutdown. Seems this service was overlooked when switching all the other services to use runner. Fixes: #2746	2026-05-13 09:22:04 +02:00
dependabot[bot]	af4feecc33	build(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 Bumps [github.com/tidwall/gjson](https://github.com/tidwall/gjson) from 1.18.0 to 1.19.0. - [Commits](https://github.com/tidwall/gjson/compare/v1.18.0...v1.19.0) --- updated-dependencies: - dependency-name: github.com/tidwall/gjson dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-12 20:32:29 +00:00
Dominik Schmidt	5b538e1f3f	Merge pull request #2744 from opencloud-eu/feat/driveitem-weburl feat(graph): populate driveItem.webUrl per Libre Graph spec	2026-05-12 20:50:11 +02:00
Dominik Schmidt	ae5c5ccb29	Merge pull request #2747 from opencloud-eu/fix/search-readme-force-rescan-flag docs(search): fix force-rescan flag name in README	2026-05-12 19:13:53 +02:00
Dominik Schmidt	426d768d59	docs(search): fix force-rescan flag name in README Closes #2721	2026-05-12 17:08:18 +02:00
Dominik Schmidt	a75d89d1b0	feat(graph): populate driveItem.webUrl per Libre Graph spec The Libre Graph spec declares webUrl on driveItem but cs3ResourceToDriveItem never set it. Build the /f/<resource-id> permalink off the configured public base URL (same source drives.go reads for drive.webUrl) and parse it once at service construction so callers can use it as a plain field.	2026-05-12 15:28:10 +02:00
Michael Barz	b4788ca45a	fix: cleaner debounce timer test	2026-05-12 08:46:33 +02:00
Michael Barz	ef6da04de2	Merge pull request #2739 from opencloud-eu/dependabot/go_modules/github.com/onsi/ginkgo/v2-2.28.3 build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3	2026-05-12 07:59:22 +02:00
dependabot[bot]	d15cd6f75b	build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.28.1 to 2.28.3. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.28.1...v2.28.3) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.28.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-11 22:37:15 +00:00
Ralf Haferkamp	393926bd73	Merge remote-tracking branch 'origin/main' into feature/guest-links	2026-05-11 15:39:27 +02:00
Ralf Haferkamp	173485cf44	Merge remote-tracking branch 'origin/main' into feature/guest-links	2026-04-29 10:24:57 +02:00
Ralf Haferkamp	066cef17c4	bump reva to feature/guest-links branch	2026-04-23 17:07:00 +02:00
v.scharf	3be224127e	adjust test	2026-04-23 17:07:00 +02:00
v.scharf	4536fb20ce	adjust tests	2026-04-23 17:07:00 +02:00
Ralf Haferkamp	44bbc07273	tests: Adjust acceptance test for recent Space sharing changes The `id` property of the `permissions` on a space root does not longer have that special `u:<userid>` format any. It now has the same format as the permission id on "normal" driveItems.	2026-04-23 17:07:00 +02:00
Ralf Haferkamp	ec8733ac52	graph: use share manager for managing space permissions This gets us rid of quite a bit of special casing for space permission. Also provides us with "real" permission IDs instead of those faked "u:<userid>" ones.	2026-04-23 17:07:00 +02:00
Ralf Haferkamp	fad0cc4828	Use filter to avoid including space membership in the sharedWithMe response	2026-04-23 17:07:00 +02:00
@@ -1 +1 @@
 .5.1
 .6.1