chore: make dev-docker reduce transfer context data size

.woodpecker.env

@@ -1,4 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=096ba683b62ab19ee7ff5dabe1225506ef50713c
-WEB_BRANCH=stable-7.1
+WEB_COMMITID=2cee98bb27fab223fc4ce2455f5483ce7767ff1a
+WEB_BRANCH=main
 

.woodpecker.star

@@ -75,11 +75,11 @@ OC_FED_DOMAIN = "%s:10200" % FED_OC_SERVER_NAME
 event = {
     "base": {
         "event": ["push", "manual"],
-        "branch": "stable-*",
+        "branch": "main",
     },
     "cron": {
         "event": "cron",
-        "branch": "stable-*",
+        "branch": "main",
     },
     "pull_request": {
         "event": "pull_request",
@@ -403,10 +403,9 @@ config = {
         "architectures": ["arm64", "amd64"],
         "production": {
             # NOTE: need to be updated if new production releases are determined
-            "tags": ["2.0", "4.0", "7.2"],
+            "tags": ["2.0", "4.0"],
             # NOTE: need to be set to true if patch releases are made from stable-X-branches
-            "skip_rolling": False,
-            "skip_daily": True,
+            "skip_rolling": "false",
             "repo": docker_repo_slug,
             "build_type": "production",
         },
@@ -1723,7 +1722,7 @@ def dockerReleases(ctx):
             docker_releases.append("rolling")
 
         # on non tag events, do daily build
-    elif not config["dockerReleases"]["production"]["skip_daily"]:
+    else:
         docker_releases.append("daily")
 
     for releaseConfigName in docker_releases:
@@ -1814,7 +1813,7 @@ def dockerRelease(ctx, repo, build_type):
                 "name": "dryrun",
                 "image": PLUGINS_DOCKER_BUILDX,
                 "settings": {
-                    "context": ".",
+                    "context": "..",
                     "dry_run": True,
                     "platforms": "linux/amd64",  # do dry run only on the native platform
                     "repo": "%s,quay.io/%s,registry.heinlein.group/%s" % (repo, repo, repo),
@@ -1837,7 +1836,7 @@ def dockerRelease(ctx, repo, build_type):
                 "name": "build-and-push",
                 "image": PLUGINS_DOCKER_BUILDX,
                 "settings": {
-                    "context": ".",
+                    "context": "..",
                     "repo": "%s,quay.io/%s,registry.heinlein.group/%s" % (repo, repo, repo),
                     "platforms": "linux/amd64,linux/arm64",  # we can add remote builders
                     "auto_tag": False if build_type == "daily" else True,
@@ -2085,7 +2084,6 @@ def readyReleaseGo():
                 "image": READY_RELEASE_GO,
                 "settings": {
                     "git_email": "devops@opencloud.eu",
-                    "release_branch": "stable-7.2",
                     "forge_type": "github",
                     "forge_token": {
                         "from_secret": "github_token",

CHANGELOG.md

@@ -1,29 +1,5 @@
 # Changelog
 
-## [7.2.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.0) - 2026-06-24
-
-### ❤️ Thanks to all contributors! ❤️
-
-@Heiko-Pohl, @JammingBen, @ScharfViktor, @aduffeck, @butonic, @dragonchaser, @kulmann, @rhafer
-
-### 🐛 Bug Fixes
-
-- [stable-7.2] Backport fixes from main [[#2999](https://github.com/opencloud-eu/opencloud/pull/2999)]
-- fix(idp): aarch64 build [[#2906](https://github.com/opencloud-eu/opencloud/pull/2906)]
-- use ldap instead of ldaps internally [[#2880](https://github.com/opencloud-eu/opencloud/pull/2880)]
-
-### 📚 Documentation
-
-- Rename role_name from "guest" to "user-light"  [[#2912](https://github.com/opencloud-eu/opencloud/pull/2912)]
-
-### 📦️ Dependencies
-
-- [full-ci] chore: bump web to v7.1.2 [[#3012](https://github.com/opencloud-eu/opencloud/pull/3012)]
-- [full-ci] chore: bump web to v7.1.1 [[#2998](https://github.com/opencloud-eu/opencloud/pull/2998)]
-- bump reva to latest main [[#2922](https://github.com/opencloud-eu/opencloud/pull/2922)]
-- build(deps-dev): bump webpack-manifest-plugin from 5.0.0 to 6.0.1 in /services/idp [[#2884](https://github.com/opencloud-eu/opencloud/pull/2884)]
-- build(deps): bump axios from 1.16.0 to 1.16.1 in /services/idp [[#2883](https://github.com/opencloud-eu/opencloud/pull/2883)]
-
 ## [7.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.1.0) - 2026-06-02
 
 ### ❤️ Thanks to all contributors! ❤️

Dockerfile

@@ -21,14 +21,15 @@ COPY ./ /opencloud/
 WORKDIR /opencloud/opencloud
 RUN make node-generate-prod
 
-FROM quay.io/opencloudeu/golang-ci:1.25 AS build
+FROM golang:1.24-alpine AS build
+RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev
 
 COPY --from=generate /opencloud /opencloud
 
 WORKDIR /opencloud/opencloud
 RUN make go-generate build ENABLE_VIPS=true
 
-FROM alpine:3.24
+FROM alpine:3.23
 
 RUN apk add --no-cache attr ca-certificates curl mailcap tree vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf

go.mod

@@ -33,7 +33,7 @@ require (
 	github.com/go-micro/plugins/v4/store/nats-js-kv v0.0.0-20240726082623-6831adfdcdc4
 	github.com/go-micro/plugins/v4/wrapper/monitoring/prometheus v1.2.0
 	github.com/go-micro/plugins/v4/wrapper/trace/opentelemetry v1.2.0
-	github.com/go-playground/validator/v10 v10.30.3
+	github.com/go-playground/validator/v10 v10.30.2
 	github.com/go-resty/resty/v2 v2.17.2
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
@@ -64,7 +64,7 @@ require (
 	github.com/open-policy-agent/opa v1.15.2
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
 	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d
-	github.com/opencloud-eu/reva/v2 v2.46.6
+	github.com/opencloud-eu/reva/v2 v2.46.2
 	github.com/opensearch-project/opensearch-go/v4 v4.6.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
@@ -102,7 +102,7 @@ require (
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
-	golang.org/x/crypto v0.52.0
+	golang.org/x/crypto v0.51.0
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/image v0.40.0
 	golang.org/x/net v0.55.0
@@ -288,6 +288,7 @@ require (
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/minio/minio-go/v7 v7.1.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
@@ -314,7 +315,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
-	github.com/pablodz/inotifywaitgo v0.0.12 // indirect
+	github.com/pablodz/inotifywaitgo v0.0.9 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
@@ -411,3 +412,6 @@ replace go-micro.dev/v4 => github.com/butonic/go-micro/v4 v4.11.1-0.202411151126
 exclude github.com/mattn/go-sqlite3 v2.0.3+incompatible
 
 replace github.com/go-micro/plugins/v4/store/nats-js-kv => github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a
+
+// to get the logger injection (https://github.com/pablodz/inotifywaitgo/pull/11)
+replace github.com/pablodz/inotifywaitgo v0.0.9 => github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9

go.sum

@@ -449,8 +449,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
-github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
+github.com/go-playground/validator/v10 v10.30.2 h1:JiFIMtSSHb2/XBUbWM4i/MpeQm9ZK2xqPNk8vgvu5JQ=
+github.com/go-playground/validator/v10 v10.30.2/go.mod h1:mAf2pIOVXjTEBrwUMGKkCWKKPs9NheYGabeB04txQSc=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8=
@@ -857,6 +857,8 @@ github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0Qu
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mna/pigeon v1.3.0 h1:/3fzVrl1C2RK3x04tyL+ribn+3S3VSEFFbCFLmRPAoc=
@@ -946,10 +948,12 @@ github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-202505121527
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a/go.mod h1:pjcozWijkNPbEtX5SIQaxEW/h8VAVZYTLx+70bmB3LY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89 h1:W1ms+lP5lUUIzjRGDg93WrQfZJZCaV1ZP3KeyXi8bzY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89/go.mod h1:vigJkNss1N2QEceCuNw/ullDehncuJNFB6mEnzfq9UI=
+github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9 h1:dIftlX03Bzfbujhp9B54FbgER0VBDWJi/w8RBxJlzxU=
+github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9/go.mod h1:JWyDC6H+5oZRdUJUgKuaye+8Ph5hEs6HVzVoPKzWSGI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d h1:JcqGDiyrcaQwVyV861TUyQgO7uEmsjkhfm7aQd84dOw=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.46.6 h1:Q20wE4A2OpWVyDnRaC4KW1+nzo+DQaK+RK5y3RFnWIg=
-github.com/opencloud-eu/reva/v2 v2.46.6/go.mod h1:RoFQt+u7edxwzHr1IZ2Y6VaDinMiRPQupAvMBy3WVmE=
+github.com/opencloud-eu/reva/v2 v2.46.2 h1:1MNSZj8e2DEMGrzORvTlyCrwYQPnCgtRuPQT+bzD4DM=
+github.com/opencloud-eu/reva/v2 v2.46.2/go.mod h1:V1bwCQXM1pGmswtjdSJVIweA9Vv5EmtUZr/7Cm5086A=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4 h1:l2oB/RctH+t8r7QBj5p8thfEHCM/jF35aAY3WQ3hADI=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -968,8 +972,6 @@ github.com/orcaman/concurrent-map v1.0.0/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CF
 github.com/ovh/go-ovh v1.1.0/go.mod h1:AxitLZ5HBRPyUd+Zl60Ajaag+rNTdVXWIkzfrVuTXWA=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c h1:rp5dCmg/yLR3mgFuSOe4oEnDDmGLROTvMragMUXpTQw=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c/go.mod h1:X07ZCGwUbLaax7L0S3Tw4hpejzu63ZrrQiUe6W0hcy0=
-github.com/pablodz/inotifywaitgo v0.0.12 h1:DVJJTFMDlSAdO46yisPF2vzozs/r+4k6ih8MVghq78M=
-github.com/pablodz/inotifywaitgo v0.0.12/go.mod h1:JWyDC6H+5oZRdUJUgKuaye+8Ph5hEs6HVzVoPKzWSGI=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
@@ -1360,8 +1362,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=

opencloud/Makefile

@@ -17,10 +17,7 @@ include ../.make/docs.mk
 
 .PHONY: dev-docker
 dev-docker:
-	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev ..
-
-dev-docker-with-workspace:
-	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev --build-arg SRCDIR=opencloud ../..
+	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev ../..
 
 .PHONY: dev-docker-multiarch
 dev-docker-multiarch:
@@ -31,7 +28,7 @@ dev-docker-multiarch:
 	docker buildx rm opencloudbuilder || true
 	docker buildx create --platform linux/arm64,linux/amd64 --name opencloudbuilder
 	docker buildx use opencloudbuilder
-	docker buildx build --platform linux/arm64,linux/amd64 --output type=docker --file docker/Dockerfile.multiarch --tag opencloudeu/opencloud:dev-multiarch ..
+	docker buildx build --platform linux/arm64,linux/amd64 --output type=docker --file docker/Dockerfile.multiarch --tag opencloudeu/opencloud:dev-multiarch ../..
 	docker buildx rm opencloudbuilder
 
 .PHONY: debug-docker

opencloud/docker/Dockerfile.multiarch

@@ -1,19 +1,20 @@
-FROM quay.io/opencloudeu/golang-ci:1.25 AS build
+FROM golang:alpine3.23 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
 ARG STRING
 ARG EDITION="dev"
-ARG SRCDIR
+
+RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev
 
 WORKDIR /build
 RUN --mount=type=bind,target=/build,rw \
     --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache \
     GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
-    make -C ${SRCDIR:-.}/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist
+    make -C opencloud/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist
 
-FROM alpine:3.24
+FROM alpine:3.23
 ARG VERSION
 ARG REVISION
 ARG TARGETOS

opencloud/docker/Dockerfile.multiarch.dockerignore

@@ -0,0 +1,16 @@
+**/.git
+**/.svn
+**/.hg
+**/.DS_Store
+**/.idea
+**/.vscode
+**/node_modules
+**/.pnpm-store
+**/.yarn
+**/.cache
+**/tmp
+**/dist
+**/docs
+**/coverage.out
+**/coverage-*.out
+**/*.log

opencloud/pkg/command/posixfs.go

@@ -31,7 +31,6 @@ import (
 const (
 	parentIDAttrName = "user.oc.parentid"
 	idAttrName       = "user.oc.id"
-	nameAttrName     = "user.oc.name"
 	spaceIDAttrName  = "user.oc.space.id"
 	ownerIDAttrName  = "user.oc.owner.id"
 )
@@ -293,7 +292,7 @@ func checkSpaceID(spacePath string) {
 	}
 }
 
-func walkNodes(dir string, parentID string) int {
+func walkParentIDs(dir string, parentID string) int {
 	fixes := 0
 	entries, err := os.ReadDir(dir)
 	if err != nil {
@@ -308,7 +307,6 @@ func walkNodes(dir string, parentID string) int {
 			continue
 		}
 
-		// Check if the parent ID attribute matches the expected parent ID, if not, fix it.
 		actualParentID, err := xattr.Get(fullPath, parentIDAttrName)
 		if err != nil || string(actualParentID) != parentID {
 			err = xattr.Set(fullPath, parentIDAttrName, []byte(parentID))
@@ -316,22 +314,7 @@ func walkNodes(dir string, parentID string) int {
 				logFailure("Failed to fix parent ID for '%s': %v", fullPath, err)
 			} else {
 				spinner.Pause()
-				fmt.Printf("  + Fixed parent ID for '%s'", fullPath)
-				spinner.Unpause()
-				fixes++
-				restartRequired = true
-			}
-		}
-
-		// Check that the name attribute matches the actual name of the file/directory, if not, fix it.
-		nameAttr, err := xattr.Get(fullPath, nameAttrName)
-		if err != nil || string(nameAttr) != entry.Name() {
-			err = xattr.Set(fullPath, nameAttrName, []byte(entry.Name()))
-			if err != nil {
-				logFailure("Failed to fix name attribute for '%s': %v", fullPath, err)
-			} else {
-				spinner.Pause()
-				fmt.Printf("  + Fixed name attribute for '%s'", fullPath)
+				fmt.Printf("\n  + Fixed parent ID for '%s'\n", fullPath)
 				spinner.Unpause()
 				fixes++
 				restartRequired = true
@@ -344,14 +327,14 @@ func walkNodes(dir string, parentID string) int {
 				logFailure("Directory '%s' missing '%s', skipping its children", fullPath, idAttrName)
 				continue
 			}
-			walkNodes(fullPath, string(nodeID))
+			walkParentIDs(fullPath, string(nodeID))
 		}
 	}
 	return fixes
 }
 
 func checkNodeIDs(spacePath string) {
-	spinner.Message(" - checking nodes")
+	spinner.Message(" - checking parent IDs")
 
 	rootID, err := xattr.Get(spacePath, idAttrName)
 	if err != nil || len(rootID) == 0 {
@@ -359,11 +342,11 @@ func checkNodeIDs(spacePath string) {
 		return
 	}
 
-	fixes := walkNodes(spacePath, string(rootID))
+	fixes := walkParentIDs(spacePath, string(rootID))
 
 	if fixes > 0 {
 		spinner.Pause()
-		fmt.Printf("\n  ✓ Fixed %d incorrect node attributes in %s\n", fixes, filepath.Base(spacePath))
+		fmt.Printf("\n  ✓ Fixed %d incorrect parent IDs in %s\n", fixes, filepath.Base(spacePath))
 		spinner.Unpause()
 	}
 }

pkg/nats/options.go

@@ -1,20 +0,0 @@
-package nats
-
-import (
-	"crypto/tls"
-
-	"github.com/nats-io/nats.go"
-)
-
-func Secure(enableTLS, insecure bool, rootCA string) nats.Option {
-	if enableTLS {
-		if rootCA != "" {
-			return nats.RootCAs(rootCA)
-		}
-		return nats.Secure(&tls.Config{
-			MinVersion:         tls.VersionTLS12,
-			InsecureSkipVerify: insecure,
-		})
-	}
-	return nil
-}

pkg/shared/shared_types.go

@@ -48,17 +48,14 @@ type HTTPServiceTLS struct {
 }
 
 type Cache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES" desc:"A comma separated list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"OC_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL" desc:"Time to live for events in the store. The duration can be set as number followed by a unit identifier like s, m or h." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided OC_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES" desc:"A comma separated list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"OC_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table              string        `yaml:"table" env:"OC_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL" desc:"Time to live for events in the store. The duration can be set as number followed by a unit identifier like s, m or h." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // Commons holds configuration that are common to all extensions. Each extension can then decide whether

pkg/version/version.go

@@ -34,7 +34,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "7.2.0-rc.1+dev"
+	LatestTag = "7.1.0+dev"
 
 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions

services/activitylog/pkg/command/server.go

@@ -9,7 +9,9 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/store"
 	"github.com/spf13/cobra"
+	microstore "go-micro.dev/v4/store"
 
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
@@ -75,6 +77,15 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}
 
+			evStore := store.Create(
+				store.Store(cfg.Store.Store),
+				store.TTL(cfg.Store.TTL),
+				microstore.Nodes(cfg.Store.Nodes...),
+				microstore.Database(cfg.Store.Database),
+				microstore.Table(cfg.Store.Table),
+				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
+			)
+
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
 			if err != nil {
 				logger.Error().Err(err).Msg("Failed to parse tls mode")
@@ -109,6 +120,7 @@ func Server(cfg *config.Config) *cobra.Command {
 					http.Context(ctx), // NOTE: not passing this "option" leads to a panic in go-micro
 					http.TraceProvider(tracerProvider),
 					http.Stream(evStream),
+					http.Store(evStore),
 					http.GatewaySelector(gatewaySelector),
 					http.HistoryClient(hClient),
 					http.ValueClient(vClient),

services/activitylog/pkg/config/config.go

@@ -50,15 +50,13 @@ type Events struct {
 
 // Store configures the store to use
 type Store struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;ACTIVITYLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;ACTIVITYLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"ACTIVITYLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;ACTIVITYLOG_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;ACTIVITYLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;ACTIVITYLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;ACTIVITYLOG_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;ACTIVITYLOG_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;ACTIVITYLOG_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided ACTIVITYLOG_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;ACTIVITYLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;ACTIVITYLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"ACTIVITYLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"ACTIVITYLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;ACTIVITYLOG_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;ACTIVITYLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;ACTIVITYLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // ServiceAccount is the configuration for the used service account

services/activitylog/pkg/config/defaults/defaultconfig.go

@@ -37,6 +37,7 @@ func DefaultConfig() *config.Config {
 			Store:    "nats-js-kv",
 			Nodes:    []string{"127.0.0.1:9233"},
 			Database: "activitylog",
+			Table:    "",
 		},
 		RevaGateway:     shared.DefaultRevaConfig().Address,
 		DefaultLanguage: "en",

services/activitylog/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("http reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/activitylog/pkg/server/http/server.go

@@ -81,6 +81,7 @@ func Server(opts ...Option) (http.Service, error) {
 		svc.Logger(options.Logger),
 		svc.Stream(options.Stream),
 		svc.Mux(mux),
+		svc.Store(options.Store),
 		svc.Config(options.Config),
 		svc.GatewaySelector(options.GatewaySelector),
 		svc.TraceProvider(options.TraceProvider),

services/activitylog/pkg/service/options.go

@@ -11,6 +11,7 @@ import (
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	microstore "go-micro.dev/v4/store"
 	"go.opentelemetry.io/otel/trace"
 )
 
@@ -24,6 +25,7 @@ type Options struct {
 	TraceProvider       trace.TracerProvider
 	Stream              events.Stream
 	RegisteredEvents    []events.Unmarshaller
+	Store               microstore.Store
 	GatewaySelector     pool.Selectable[gateway.GatewayAPIClient]
 	Mux                 *chi.Mux
 	HistoryClient       ehsvc.EventHistoryService
@@ -67,6 +69,13 @@ func RegisteredEvents(e []events.Unmarshaller) Option {
 	}
 }
 
+// Store configures the store to use
+func Store(store microstore.Store) Option {
+	return func(o *Options) {
+		o.Store = store
+	}
+}
+
 // GatewaySelector adds a grpc client selector for the gateway service
 func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
 	return func(o *Options) {

services/activitylog/pkg/service/service.go

@@ -2,7 +2,6 @@ package service
 
 import (
 	"context"
-	"crypto/tls"
 	"encoding/base32"
 	"encoding/json"
 	"fmt"
@@ -167,18 +166,6 @@ func New(opts ...Option) (*ActivitylogService, error) {
 	natsOptions := nats.Options{
 		Servers: o.Config.Store.Nodes,
 	}
-	if o.Config.Store.EnableTLS {
-		if o.Config.Store.TLSRootCACertificate != "" {
-			// when root ca is configured use it. an insecure flag is ignored.
-			nats.RootCAs(o.Config.Store.TLSRootCACertificate)(&natsOptions)
-		} else {
-			// enable tls and use insecure flag
-			nats.Secure(&tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Config.Store.TLSInsecure})(&natsOptions)
-		}
-	}
-	if o.Config.Store.AuthUsername != "" && o.Config.Store.AuthPassword != "" {
-		nats.UserInfo(o.Config.Store.AuthUsername, o.Config.Store.AuthPassword)(&natsOptions)
-	}
 	conn, err := natsOptions.Connect()
 	if err != nil {
 		return nil, err

services/antivirus/pkg/server/debug/server.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -19,14 +18,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
 		WithCheck("antivirus reachability", func(ctx context.Context) error {
 			cfg := options.Config
 			switch cfg.Scanner.Type {

services/audit/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,14 +13,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/clientlog/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,14 +13,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/clientlog/pkg/service/service.go

@@ -83,8 +83,7 @@ EventLoop:
 			if !ok {
 				break EventLoop
 			}
-
-			go cl.processEvent(event)
+			cl.processEvent(event)
 
 			if cl.stopped.Load() {
 				break EventLoop

services/collaboration/pkg/command/server.go

@@ -101,9 +101,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
-				store.TLSEnabled(cfg.Store.EnableTLS),
-				store.TLSInsecure(cfg.Store.TLSInsecure),
-				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)
 
 			gr := runner.NewGroup()

services/collaboration/pkg/config/store.go

@@ -4,14 +4,11 @@ import "time"
 
 // Store configures the store to use
 type Store struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;COLLABORATION_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;COLLABORATION_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"COLLABORATION_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"COLLABORATION_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;COLLABORATION_STORE_TTL" desc:"Time to live for events in the store. Defaults to '30m' (30 minutes). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;COLLABORATION_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;COLLABORATION_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;COLLABORATION_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;COLLABORATION_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;COLLABORATION_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided COLLABORATION_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;COLLABORATION_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;COLLABORATION_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"COLLABORATION_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"COLLABORATION_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;COLLABORATION_STORE_TTL" desc:"Time to live for events in the store. Defaults to '30m' (30 minutes). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;COLLABORATION_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;COLLABORATION_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/eventhistory/pkg/command/server.go

@@ -71,9 +71,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
-				store.TLSEnabled(cfg.Store.EnableTLS),
-				store.TLSInsecure(cfg.Store.TLSInsecure),
-				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)
 
 			service := grpc.NewService(

services/eventhistory/pkg/config/config.go

@@ -36,16 +36,13 @@ type GRPCConfig struct {
 
 // Store configures the store to use
 type Store struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;EVENTHISTORY_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;EVENTHISTORY_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"EVENTHISTORY_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"EVENTHISTORY_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;EVENTHISTORY_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;EVENTHISTORY_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;EVENTHISTORY_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;EVENTHISTORY_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;EVENTHISTORY_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;EVENTHISTORY_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided EVENTHISTORY_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;EVENTHISTORY_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;EVENTHISTORY_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"EVENTHISTORY_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"EVENTHISTORY_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;EVENTHISTORY_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;EVENTHISTORY_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;EVENTHISTORY_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // Events combines the configuration options for the event bus.

services/eventhistory/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/frontend/pkg/config/config.go

@@ -121,29 +121,26 @@ type DataGateway struct {
 }
 
 type OCS struct {
-	Prefix                        string        `yaml:"prefix" env:"FRONTEND_OCS_PREFIX" desc:"URL path prefix for the OCS service. Note that the string must not start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	SharePrefix                   string        `yaml:"share_prefix" env:"FRONTEND_OCS_SHARE_PREFIX" desc:"Path prefix for shares as part of a CS3 resource. Note that the path must start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	HomeNamespace                 string        `yaml:"home_namespace" env:"FRONTEND_OCS_PERSONAL_NAMESPACE" desc:"Home namespace identifier." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	AdditionalInfoAttribute       string        `yaml:"additional_info_attribute" env:"FRONTEND_OCS_ADDITIONAL_INFO_ATTRIBUTE" desc:"Additional information attribute for the user like {{.Mail}}." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	StatCacheType                 string        `yaml:"stat_cache_type" env:"OC_CACHE_STORE;FRONTEND_OCS_STAT_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheNodes                []string      `yaml:"stat_cache_nodes" env:"OC_CACHE_STORE_NODES;FRONTEND_OCS_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE_NODES, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheDatabase             string        `yaml:"stat_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	StatCacheTable                string        `yaml:"stat_cache_table" env:"FRONTEND_OCS_STAT_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	StatCacheTTL                  time.Duration `yaml:"stat_cache_ttl" env:"OC_CACHE_TTL;FRONTEND_OCS_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_TTL, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheDisablePersistence   bool          `yaml:"stat_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheAuthUsername         string        `yaml:"stat_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheAuthPassword         string        `yaml:"stat_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheEnableTLS            bool          `yaml:"stat_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;FRONTEND_OCS_STAT_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	StatCacheTLSInsecure          bool          `yaml:"stat_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;FRONTEND_OCS_STAT_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	StatCacheTLSRootCACertificate string        `yaml:"stat_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;FRONTEND_OCS_STAT_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided FRONTEND_OCS_STAT_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Prefix                      string        `yaml:"prefix" env:"FRONTEND_OCS_PREFIX" desc:"URL path prefix for the OCS service. Note that the string must not start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	SharePrefix                 string        `yaml:"share_prefix" env:"FRONTEND_OCS_SHARE_PREFIX" desc:"Path prefix for shares as part of a CS3 resource. Note that the path must start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	HomeNamespace               string        `yaml:"home_namespace" env:"FRONTEND_OCS_PERSONAL_NAMESPACE" desc:"Home namespace identifier." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	AdditionalInfoAttribute     string        `yaml:"additional_info_attribute" env:"FRONTEND_OCS_ADDITIONAL_INFO_ATTRIBUTE" desc:"Additional information attribute for the user like {{.Mail}}." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	StatCacheType               string        `yaml:"stat_cache_type" env:"OC_CACHE_STORE;FRONTEND_OCS_STAT_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheNodes              []string      `yaml:"stat_cache_nodes" env:"OC_CACHE_STORE_NODES;FRONTEND_OCS_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE_NODES, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheDatabase           string        `yaml:"stat_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	StatCacheTable              string        `yaml:"stat_cache_table" env:"FRONTEND_OCS_STAT_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	StatCacheTTL                time.Duration `yaml:"stat_cache_ttl" env:"OC_CACHE_TTL;FRONTEND_OCS_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_TTL, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheDisablePersistence bool          `yaml:"stat_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheAuthUsername       string        `yaml:"stat_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheAuthPassword       string        `yaml:"stat_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
 
 	CacheWarmupDriver                    string             `yaml:"cache_warmup_driver,omitempty"`  // not supported by the OpenCloud product, therefore not part of docs
 	CacheWarmupDrivers                   CacheWarmupDrivers `yaml:"cache_warmup_drivers,omitempty"` // not supported by the OpenCloud product, therefore not part of docs
-	EnableDenials                        bool               `yaml:"enable_denials" env:"FRONTEND_OCS_ENABLE_DENIALS" desc:"EXPERIMENTAL: enable the feature to deny access on folders." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	ListOCMShares                        bool               `yaml:"list_ocm_shares" env:"OC_ENABLE_OCM;FRONTEND_OCS_LIST_OCM_SHARES" desc:"Include OCM shares when listing shares. See the OCM service documentation for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_LIST_OCM_SHARES, the OCS API is deprecated" deprecationReplacement:""`
-	IncludeOCMSharees                    bool               `yaml:"include_ocm_sharees" env:"OC_ENABLE_OCM;FRONTEND_OCS_INCLUDE_OCM_SHAREES" desc:"Include OCM sharees when listing sharees." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_INCLUDE_OCM_SHAREES, the OCS API is deprecated" deprecationReplacement:""`
-	PublicShareMustHavePassword          bool               `yaml:"public_sharing_share_must_have_password" env:"OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords on all public shares." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
-	WriteablePublicShareMustHavePassword bool               `yaml:"public_sharing_writeableshare_must_have_password" env:"OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords for writable shares. Only effective if the setting for 'passwords on all public shares' is set to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_PUBLIC_WRITABLE_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	EnableDenials                        bool               `yaml:"enable_denials" env:"FRONTEND_OCS_ENABLE_DENIALS" desc:"EXPERIMENTAL: enable the feature to deny access on folders." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	ListOCMShares                        bool               `yaml:"list_ocm_shares" env:"OC_ENABLE_OCM;FRONTEND_OCS_LIST_OCM_SHARES" desc:"Include OCM shares when listing shares. See the OCM service documentation for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_LIST_OCM_SHARES, the OCS API is deprecated" deprecationReplacement:""`
+	IncludeOCMSharees                    bool               `yaml:"include_ocm_sharees" env:"OC_ENABLE_OCM;FRONTEND_OCS_INCLUDE_OCM_SHAREES" desc:"Include OCM sharees when listing sharees." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_INCLUDE_OCM_SHAREES, the OCS API is deprecated" deprecationReplacement:""`
+	PublicShareMustHavePassword          bool               `yaml:"public_sharing_share_must_have_password" env:"OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords on all public shares." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	WriteablePublicShareMustHavePassword bool               `yaml:"public_sharing_writeableshare_must_have_password" env:"OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords for writable shares. Only effective if the setting for 'passwords on all public shares' is set to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_PUBLIC_WRITABLE_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
 	ShowUserEmailInResults               bool               `yaml:"show_email_in_results" env:"OC_SHOW_USER_EMAIL_IN_RESULTS" desc:"Include user email addresses in responses. If absent or set to false emails will be omitted from results. Please note that admin users can always see all email addresses." introductionVersion:"1.0.0"`
 }
 

services/frontend/pkg/revaconfig/config.go

@@ -164,17 +164,14 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 					"share_prefix":         cfg.OCS.SharePrefix,
 					"home_namespace":       cfg.OCS.HomeNamespace,
 					"stat_cache_config": map[string]any{
-						"cache_store":                   cfg.OCS.StatCacheType,
-						"cache_nodes":                   cfg.OCS.StatCacheNodes,
-						"cache_database":                cfg.OCS.StatCacheDatabase,
-						"cache_table":                   cfg.OCS.StatCacheTable,
-						"cache_ttl":                     cfg.OCS.StatCacheTTL,
-						"cache_disable_persistence":     cfg.OCS.StatCacheDisablePersistence,
-						"cache_auth_username":           cfg.OCS.StatCacheAuthUsername,
-						"cache_auth_password":           cfg.OCS.StatCacheAuthPassword,
-						"cache_tls_enabled":             cfg.OCS.StatCacheEnableTLS,
-						"cache_tls_insecure":            cfg.OCS.StatCacheTLSInsecure,
-						"cache_tls_root_ca_certificate": cfg.OCS.StatCacheTLSRootCACertificate,
+						"cache_store":               cfg.OCS.StatCacheType,
+						"cache_nodes":               cfg.OCS.StatCacheNodes,
+						"cache_database":            cfg.OCS.StatCacheDatabase,
+						"cache_table":               cfg.OCS.StatCacheTable,
+						"cache_ttl":                 cfg.OCS.StatCacheTTL,
+						"cache_disable_persistence": cfg.OCS.StatCacheDisablePersistence,
+						"cache_auth_username":       cfg.OCS.StatCacheAuthUsername,
+						"cache_auth_password":       cfg.OCS.StatCacheAuthPassword,
 					},
 					"prefix":                    cfg.OCS.Prefix,
 					"additional_info_attribute": cfg.OCS.AdditionalInfoAttribute,

services/frontend/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/gateway/pkg/config/config.go

@@ -84,18 +84,11 @@ type Cache struct {
 	ProviderCacheDisablePersistence   bool          `yaml:"provider_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_PROVIDER_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the provider cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
 	ProviderCacheAuthUsername         string        `yaml:"provider_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_PROVIDER_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 	ProviderCacheAuthPassword         string        `yaml:"provider_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_PROVIDER_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	ProviderCacheEnableTLS            bool          `yaml:"provider_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;GATEWAY_PROVIDER_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	ProviderCacheTLSInsecure          bool          `yaml:"provider_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GATEWAY_PROVIDER_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	ProviderCacheTLSRootCACertificate string        `yaml:"provider_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GATEWAY_PROVIDER_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GATEWAY_PROVIDER_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
-
-	CreateHomeCacheStore                string        `yaml:"create_home_cache_store" env:"OC_CACHE_STORE;GATEWAY_CREATE_HOME_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	CreateHomeCacheNodes                []string      `yaml:"create_home_cache_nodes" env:"OC_CACHE_STORE_NODES;GATEWAY_CREATE_HOME_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	CreateHomeCacheDatabase             string        `yaml:"create_home_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	CreateHomeCacheTTL                  time.Duration `yaml:"create_home_cache_ttl" env:"OC_CACHE_TTL;GATEWAY_CREATE_HOME_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	CreateHomeCacheDisablePersistence   bool          `yaml:"create_home_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_CREATE_HOME_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the create home cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	CreateHomeCacheAuthUsername         string        `yaml:"create_home_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_CREATE_HOME_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	CreateHomeCacheAuthPassword         string        `yaml:"create_home_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_CREATE_HOME_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	CreateHomeCacheEnableTLS            bool          `yaml:"create_home_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;GATEWAY_CREATE_HOME_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	CreateHomeCacheTLSInsecure          bool          `yaml:"create_home_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GATEWAY_CREATE_HOME_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	CreateHomeCacheTLSRootCACertificate string        `yaml:"create_home_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GATEWAY_CREATE_HOME_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GATEWAY_CREATE_HOME_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	CreateHomeCacheStore              string        `yaml:"create_home_cache_store" env:"OC_CACHE_STORE;GATEWAY_CREATE_HOME_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	CreateHomeCacheNodes              []string      `yaml:"create_home_cache_nodes" env:"OC_CACHE_STORE_NODES;GATEWAY_CREATE_HOME_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	CreateHomeCacheDatabase           string        `yaml:"create_home_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	CreateHomeCacheTTL                time.Duration `yaml:"create_home_cache_ttl" env:"OC_CACHE_TTL;GATEWAY_CREATE_HOME_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	CreateHomeCacheDisablePersistence bool          `yaml:"create_home_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_CREATE_HOME_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the create home cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	CreateHomeCacheAuthUsername       string        `yaml:"create_home_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_CREATE_HOME_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	CreateHomeCacheAuthPassword       string        `yaml:"create_home_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_CREATE_HOME_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/gateway/pkg/revaconfig/config.go

@@ -45,15 +45,15 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]a
 					"groupprovidersvc": cfg.GroupsEndpoint,
 					"permissionssvc":   cfg.PermissionsEndpoint,
 					// sharing is located on the sharing service
-					"usershareprovidersvc":              cfg.SharingEndpoint,
-					"publicshareprovidersvc":            cfg.SharingEndpoint,
-					"ocmshareprovidersvc":               cfg.OCMEndpoint,
-					"ocminvitemanagersvc":               cfg.OCMEndpoint,
-					"ocmproviderauthorizersvc":          cfg.OCMEndpoint,
-					"ocmcoresvc":                        cfg.OCMEndpoint,
+					"usershareprovidersvc":          cfg.SharingEndpoint,
+					"publicshareprovidersvc":        cfg.SharingEndpoint,
+					"ocmshareprovidersvc":           cfg.OCMEndpoint,
+					"ocminvitemanagersvc":           cfg.OCMEndpoint,
+					"ocmproviderauthorizersvc":      cfg.OCMEndpoint,
+					"ocmcoresvc":                    cfg.OCMEndpoint,
 					"use_common_space_root_share_logic": true,
-					"commit_share_to_storage_grant":     cfg.CommitShareToStorageGrant,
-					"share_folder":                      cfg.ShareFolder, // ShareFolder is the location where to create shares in the recipient's storage provider.
+				"commit_share_to_storage_grant":    cfg.CommitShareToStorageGrant,
+					"share_folder":                  cfg.ShareFolder, // ShareFolder is the location where to create shares in the recipient's storage provider.
 					// other
 					"disable_home_creation_on_login": cfg.DisableHomeCreationOnLogin,
 					"datagateway":                    strings.TrimRight(cfg.FrontendPublicURL, "/") + "/data",
@@ -71,17 +71,14 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]a
 						"cache_auth_password": cfg.Cache.ProviderCacheAuthPassword,
 					},
 					"create_personal_space_cache_config": map[string]any{
-						"cache_store":                   cfg.Cache.CreateHomeCacheStore,
-						"cache_nodes":                   cfg.Cache.CreateHomeCacheNodes,
-						"cache_database":                cfg.Cache.CreateHomeCacheDatabase,
-						"cache_table":                   "create_personal_space",
-						"cache_ttl":                     cfg.Cache.CreateHomeCacheTTL,
-						"cache_disable_persistence":     cfg.Cache.CreateHomeCacheDisablePersistence,
-						"cache_auth_username":           cfg.Cache.CreateHomeCacheAuthUsername,
-						"cache_auth_password":           cfg.Cache.CreateHomeCacheAuthPassword,
-						"cache_tls_enabled":             cfg.Cache.CreateHomeCacheEnableTLS,
-						"cache_tls_insecure":            cfg.Cache.CreateHomeCacheTLSInsecure,
-						"cache_tls_root_ca_certificate": cfg.Cache.CreateHomeCacheTLSRootCACertificate,
+						"cache_store":               cfg.Cache.CreateHomeCacheStore,
+						"cache_nodes":               cfg.Cache.CreateHomeCacheNodes,
+						"cache_database":            cfg.Cache.CreateHomeCacheDatabase,
+						"cache_table":               "create_personal_space",
+						"cache_ttl":                 cfg.Cache.CreateHomeCacheTTL,
+						"cache_disable_persistence": cfg.Cache.CreateHomeCacheDisablePersistence,
+						"cache_auth_username":       cfg.Cache.CreateHomeCacheAuthUsername,
+						"cache_auth_password":       cfg.Cache.CreateHomeCacheAuthPassword,
 					},
 				},
 				"authregistry": map[string]any{

services/gateway/pkg/server/debug/server.go

@@ -18,7 +18,6 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if options.Config.Cache.ProviderCacheStore == "nats-js-kv" && len(options.Config.Cache.ProviderCacheNodes) > 0 {
-				// no secureOption because we cannot yet configure tls for the cache store
 				return checks.NewNatsCheck(options.Config.Cache.ProviderCacheNodes[0])(ctx)
 			}
 			return nil

services/graph/pkg/command/server.go

@@ -4,11 +4,9 @@ import (
 	"context"
 	"fmt"
 	"os/signal"
-	"strings"
 
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/log"
-	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/runner"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -52,9 +50,13 @@ func Server(cfg *config.Config) *cobra.Command {
 			var kv jetstream.KeyValue
 			// Allow to run without a NATS store (e.g. for the standalone Education provisioning service)
 			if len(cfg.Store.Nodes) > 0 {
-				// Connect to NATS servers
-				secureOption := natspkg.Secure(cfg.Store.EnableTLS, cfg.Store.TLSInsecure, cfg.Store.TLSRootCACertificate)
-				conn, err := nats.Connect(strings.Join(cfg.Store.Nodes, ","), secureOption, nats.UserInfo(cfg.Store.AuthUsername, cfg.Store.AuthPassword))
+				//Connect to NATS servers
+				natsOptions := nats.Options{
+					Servers:  cfg.Store.Nodes,
+					User:     cfg.Store.AuthUsername,
+					Password: cfg.Store.AuthPassword,
+				}
+				conn, err := natsOptions.Connect()
 				if err != nil {
 					return err
 				}

services/graph/pkg/config/cache.go

@@ -4,15 +4,12 @@ import "time"
 
 // Cache defines the available configuration for a cache store
 type Cache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;GRAPH_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;GRAPH_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"GRAPH_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"GRAPH_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;GRAPH_CACHE_TTL" desc:"Time to live for cache records in the graph. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GRAPH_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;GRAPH_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;GRAPH_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;GRAPH_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GRAPH_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GRAPH_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;GRAPH_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;GRAPH_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"GRAPH_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table              string        `yaml:"table" env:"GRAPH_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;GRAPH_CACHE_TTL" desc:"Time to live for cache records in the graph. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GRAPH_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;GRAPH_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;GRAPH_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/graph/pkg/config/config.go

@@ -172,11 +172,8 @@ type Metadata struct {
 
 // Store configures the store to use
 type Store struct {
-	Nodes                []string `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;GRAPH_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string   `yaml:"database" env:"GRAPH_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	AuthUsername         string   `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;GRAPH_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string   `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;GRAPH_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool     `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;GRAPH_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool     `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;GRAPH_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string   `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;GRAPH_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Nodes        []string `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;GRAPH_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string   `yaml:"database" env:"GRAPH_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	AuthUsername string   `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;GRAPH_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string   `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;GRAPH_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/graph/pkg/server/debug/server.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -33,13 +32,8 @@ func Server(opts ...Option) (*http.Server, error) {
 
 	// only check nats if really needed
 	if options.Config.Events.Endpoint != "" {
-		secureOption := nats.Secure(
-			options.Config.Events.EnableTLS,
-			options.Config.Events.TLSInsecure,
-			options.Config.Events.TLSRootCACertificate,
-		)
 		readyHandlerConfiguration = readyHandlerConfiguration.
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 	}
 
 	return debug.NewService(

services/graph/pkg/service/v0/api_driveitem_permissions.go

@@ -22,6 +22,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/publicshare"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
@@ -29,14 +30,16 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 
-	"github.com/opencloud-eu/opencloud/pkg/conversions"
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	l10n_pkg "github.com/opencloud-eu/opencloud/services/graph/pkg/l10n"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
+
+	"github.com/opencloud-eu/opencloud/pkg/conversions"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/cache"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/validate"
 )
@@ -752,8 +755,16 @@ func (api DriveItemPermissionsApi) ListPermissions(w http.ResponseWriter, r *htt
 
 	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
 	w.Header().Add("Content-Language", loc)
-	for i := range permissions.LibreGraphPermissionsRolesAllowedValues {
-		permissions.LibreGraphPermissionsRolesAllowedValues[i] = unifiedrole.LocalizeRole(&permissions.LibreGraphPermissionsRolesAllowedValues[i], loc)
+	if loc != "" && loc != "en" {
+		err := l10n_pkg.TranslateEntity(loc, "en", permissions,
+			l10n.TranslateEach("LibreGraphPermissionsRolesAllowedValues",
+				l10n.TranslateField("Description"),
+				l10n.TranslateField("DisplayName"),
+			),
+		)
+		if err != nil {
+			api.logger.Error().Err(err).Msg("tranlation error")
+		}
 	}
 
 	render.Status(r, http.StatusOK)
@@ -795,8 +806,16 @@ func (api DriveItemPermissionsApi) ListSpaceRootPermissions(w http.ResponseWrite
 
 	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
 	w.Header().Add("Content-Language", loc)
-	for i := range permissions.LibreGraphPermissionsRolesAllowedValues {
-		permissions.LibreGraphPermissionsRolesAllowedValues[i] = unifiedrole.LocalizeRole(&permissions.LibreGraphPermissionsRolesAllowedValues[i], loc)
+	if loc != "" && loc != "en" {
+		err := l10n_pkg.TranslateEntity(loc, "en", permissions,
+			l10n.TranslateEach("LibreGraphPermissionsRolesAllowedValues",
+				l10n.TranslateField("Description"),
+				l10n.TranslateField("DisplayName"),
+			),
+		)
+		if err != nil {
+			api.logger.Error().Err(err).Msg("tranlation error")
+		}
 	}
 
 	render.Status(r, http.StatusOK)

services/graph/pkg/service/v0/drives.go

@@ -1119,7 +1119,7 @@ func (g Graph) DeleteDrive(w http.ResponseWriter, r *http.Request) {
 		return
 	case cs3rpc.Code_CODE_PERMISSION_DENIED:
 		logger.Debug().Interface("id", rid).Msg("could not delete drive: permission denied")
-		errorcode.AccessDenied.Render(w, r, http.StatusForbidden, "permission denied")
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
 		return
 	case cs3rpc.Code_CODE_NOT_FOUND:
 		logger.Debug().Interface("id", rid).Msg("could not delete drive: drive not found")

services/graph/pkg/service/v0/rolemanagement.go

@@ -7,17 +7,14 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 
-	"github.com/opencloud-eu/opencloud/pkg/l10n"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
 )
 
 // GetRoleDefinitions a list of permission roles than can be used when sharing with users or groups
 func (g Graph) GetRoleDefinitions(w http.ResponseWriter, r *http.Request) {
-	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
-	w.Header().Add("Content-Language", loc)
 	render.Status(r, http.StatusOK)
-	render.JSON(w, r, unifiedrole.LocalizeRoles(g.availableRoles, loc))
+	render.JSON(w, r, g.availableRoles)
 }
 
 // GetRoleDefinition a permission role than can be used when sharing with users or groups
@@ -35,8 +32,6 @@ func (g Graph) GetRoleDefinition(w http.ResponseWriter, r *http.Request) {
 		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, err.Error())
 		return
 	}
-	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
-	w.Header().Add("Content-Language", loc)
 	render.Status(r, http.StatusOK)
-	render.JSON(w, r, unifiedrole.LocalizeRole(role, loc))
+	render.JSON(w, r, role)
 }

services/graph/pkg/service/v0/rolemanagement_test.go

@@ -1,170 +0,0 @@
-package svc_test
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
-	"google.golang.org/grpc"
-
-	"github.com/opencloud-eu/opencloud/pkg/shared"
-	"github.com/opencloud-eu/opencloud/services/graph/mocks"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
-	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
-)
-
-var _ = Describe("RoleManagement", func() {
-	var (
-		svc             service.Service
-		gatewayClient   *cs3mocks.GatewayAPIClient
-		gatewaySelector pool.Selectable[gateway.GatewayAPIClient]
-		eventsPublisher mocks.Publisher
-		permSvc         mocks.Permissions
-		cfg             *config.Config
-		rr              *httptest.ResponseRecorder
-		ctx             context.Context
-	)
-
-	BeforeEach(func() {
-		rr = httptest.NewRecorder()
-		ctx = context.Background()
-
-		cfg = defaults.FullDefaultConfig()
-		cfg.Identity.LDAP.CACert = ""
-		cfg.TokenManager.JWTSecret = "loremipsum"
-		cfg.Commons = &shared.Commons{}
-		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
-
-		pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
-		gatewayClient = &cs3mocks.GatewayAPIClient{}
-		gatewaySelector = pool.GetSelector[gateway.GatewayAPIClient](
-			"GatewaySelector",
-			"eu.opencloud.api.gateway",
-			func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
-				return gatewayClient
-			},
-		)
-		eventsPublisher = mocks.Publisher{}
-		permSvc = mocks.Permissions{}
-
-		var err error
-		svc, err = service.NewService(
-			service.Config(cfg),
-			service.WithGatewaySelector(gatewaySelector),
-			service.EventsPublisher(&eventsPublisher),
-			service.PermissionService(&permSvc),
-		)
-		Expect(err).ToNot(HaveOccurred())
-	})
-
-	Describe("GetRoleDefinitions", func() {
-		It("returns all available roles in English when no Accept-Language is set", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusOK))
-
-			var roles []libregraph.UnifiedRoleDefinition
-			Expect(json.Unmarshal(rr.Body.Bytes(), &roles)).To(Succeed())
-			Expect(roles).NotTo(BeEmpty())
-
-			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
-			Expect(viewer).NotTo(BeNil())
-			Expect(viewer.GetDisplayName()).To(Equal("Can view"))
-		})
-
-		It("returns translated roles when Accept-Language is German", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
-			r.Header.Set("Accept-Language", "de")
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusOK))
-			Expect(rr.Header().Get("Content-Language")).To(Equal("de"))
-
-			var roles []libregraph.UnifiedRoleDefinition
-			Expect(json.Unmarshal(rr.Body.Bytes(), &roles)).To(Succeed())
-
-			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
-			Expect(viewer).NotTo(BeNil())
-			Expect(viewer.GetDisplayName()).To(Equal("Kann anzeigen"))
-			Expect(viewer.GetDescription()).To(Equal("Ansehen und herunterladen."))
-		})
-
-		It("does not mutate the global buildInRoles after a German request", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
-			r.Header.Set("Accept-Language", "de")
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-			Expect(rr.Code).To(Equal(http.StatusOK))
-
-			// A second request without a locale must still return English
-			rr2 := httptest.NewRecorder()
-			r2 := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
-			r2 = r2.WithContext(ctx)
-			svc.ServeHTTP(rr2, r2)
-			Expect(rr2.Code).To(Equal(http.StatusOK))
-
-			var roles []libregraph.UnifiedRoleDefinition
-			Expect(json.Unmarshal(rr2.Body.Bytes(), &roles)).To(Succeed())
-			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
-			Expect(viewer).NotTo(BeNil())
-			Expect(viewer.GetDisplayName()).To(Equal("Can view"))
-		})
-	})
-
-	Describe("GetRoleDefinition", func() {
-		It("returns a single role in English when no Accept-Language is set", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/"+unifiedrole.UnifiedRoleViewerID, nil)
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusOK))
-			var role libregraph.UnifiedRoleDefinition
-			Expect(json.Unmarshal(rr.Body.Bytes(), &role)).To(Succeed())
-			Expect(role.GetDisplayName()).To(Equal("Can view"))
-		})
-
-		It("returns a single role translated when Accept-Language is German", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/"+unifiedrole.UnifiedRoleViewerID, nil)
-			r.Header.Set("Accept-Language", "de")
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusOK))
-			Expect(rr.Header().Get("Content-Language")).To(Equal("de"))
-			var role libregraph.UnifiedRoleDefinition
-			Expect(json.Unmarshal(rr.Body.Bytes(), &role)).To(Succeed())
-			Expect(role.GetDisplayName()).To(Equal("Kann anzeigen"))
-			Expect(role.GetDescription()).To(Equal("Ansehen und herunterladen."))
-		})
-
-		It("returns 404 for an unknown roleID", func() {
-			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/unknown-role-id", nil)
-			r = r.WithContext(ctx)
-			svc.ServeHTTP(rr, r)
-
-			Expect(rr.Code).To(Equal(http.StatusNotFound))
-		})
-	})
-})
-
-// findRoleByID returns the first role with the given ID from the slice, or nil.
-func findRoleByID(roles []libregraph.UnifiedRoleDefinition, id string) *libregraph.UnifiedRoleDefinition {
-	for i := range roles {
-		if roles[i].GetId() == id {
-			return &roles[i]
-		}
-	}
-	return nil
-}

services/graph/pkg/unifiedrole/roles.go

@@ -6,11 +6,11 @@ import (
 	"strings"
 
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-	"github.com/opencloud-eu/reva/v2/pkg/conversions"
 	"google.golang.org/protobuf/proto"
 
+	"github.com/opencloud-eu/reva/v2/pkg/conversions"
+
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
-	graphl10n "github.com/opencloud-eu/opencloud/services/graph/pkg/l10n"
 )
 
 const (
@@ -546,46 +546,6 @@ func weightRoles(roleSet []*libregraph.UnifiedRoleDefinition, constraints string
 	return roleSet
 }
 
-// cloneRole returns a shallow struct copy of r with independent allocations for
-// the Description and DisplayName pointer fields — the only fields mutated by
-// TranslateEntity. All other fields (Id, LibreGraphWeight, RolePermissions) are
-// either read-only or stripped before rendering, so sharing their values is safe.
-func cloneRole(r *libregraph.UnifiedRoleDefinition) libregraph.UnifiedRoleDefinition {
-	c := *r
-	if r.Description != nil {
-		s := *r.Description
-		c.Description = &s
-	}
-	if r.DisplayName != nil {
-		s := *r.DisplayName
-		c.DisplayName = &s
-	}
-	return c
-}
-
-// LocalizeRole returns a translated, independent copy of a single role definition.
-// The global buildInRoles singleton is never modified.
-func LocalizeRole(r *libregraph.UnifiedRoleDefinition, locale string) libregraph.UnifiedRoleDefinition {
-	c := cloneRole(r)
-	if locale != "" && locale != "en" {
-		_ = graphl10n.TranslateEntity(locale, "en", &c,
-			l10n.TranslateField("Description"),
-			l10n.TranslateField("DisplayName"),
-		)
-	}
-	return c
-}
-
-// LocalizeRoles returns a translated, independent copy of each role definition.
-// The global buildInRoles singleton is never modified.
-func LocalizeRoles(roles []*libregraph.UnifiedRoleDefinition, locale string) []libregraph.UnifiedRoleDefinition {
-	out := make([]libregraph.UnifiedRoleDefinition, len(roles))
-	for i, r := range roles {
-		out[i] = LocalizeRole(r, locale)
-	}
-	return out
-}
-
 // GetAllowedResourceActions returns the allowed resource actions for the provided role by condition
 func GetAllowedResourceActions(role *libregraph.UnifiedRoleDefinition, condition string) []string {
 	if role == nil {

services/graph/pkg/unifiedrole/roles_test.go

@@ -2,7 +2,6 @@ package unifiedrole_test
 
 import (
 	"slices"
-	"sync"
 	"testing"
 
 	. "github.com/onsi/gomega"
@@ -268,84 +267,3 @@ func TestGetAllowedResourceActions(t *testing.T) {
 		})
 	}
 }
-
-func TestLocalizeRole_English(t *testing.T) {
-	g := NewWithT(t)
-	original := unifiedrole.RoleViewer
-
-	result := unifiedrole.LocalizeRole(original, "en")
-
-	// Strings are unchanged for English
-	g.Expect(result.GetDisplayName()).To(Equal(original.GetDisplayName()))
-	g.Expect(result.GetDescription()).To(Equal(original.GetDescription()))
-
-	// Result is an independent copy — mutating it must not touch the global
-	translated := "mutated"
-	result.DisplayName = &translated
-	g.Expect(original.GetDisplayName()).NotTo(Equal("mutated"))
-}
-
-func TestLocalizeRole_German(t *testing.T) {
-	g := NewWithT(t)
-	original := unifiedrole.RoleViewer
-
-	result := unifiedrole.LocalizeRole(original, "de")
-
-	g.Expect(result.GetDisplayName()).To(Equal("Kann anzeigen"))
-	g.Expect(result.GetDescription()).To(Equal("Ansehen und herunterladen."))
-
-	// Global singleton must be untouched
-	g.Expect(original.GetDisplayName()).NotTo(Equal("Kann anzeigen"))
-	g.Expect(original.GetDescription()).NotTo(Equal("Ansehen und herunterladen."))
-}
-
-func TestLocalizeRole_EmptyLocale(t *testing.T) {
-	g := NewWithT(t)
-	original := unifiedrole.RoleViewer
-
-	result := unifiedrole.LocalizeRole(original, "")
-
-	// Empty locale falls back to source strings
-	g.Expect(result.GetDisplayName()).To(Equal(original.GetDisplayName()))
-	g.Expect(result.GetDescription()).To(Equal(original.GetDescription()))
-}
-
-func TestLocalizeRoles_German(t *testing.T) {
-	g := NewWithT(t)
-	roles := unifiedrole.BuildInRoles
-
-	results := unifiedrole.LocalizeRoles(roles, "de")
-
-	g.Expect(results).To(HaveLen(len(roles)))
-
-	// Every result is a value (not a pointer)
-	for i, r := range results {
-		// Id is preserved
-		g.Expect(r.GetId()).To(Equal(roles[i].GetId()))
-		// Global singleton is not mutated
-		g.Expect(roles[i].GetDisplayName()).NotTo(Equal(r.GetDisplayName()),
-			"global displayName for role %s was mutated", r.GetId())
-	}
-}
-
-func TestLocalizeRole_ConcurrentCallsDoNotRace(t *testing.T) {
-	// Run with -race to detect data races on the global buildInRoles strings.
-	const goroutines = 20
-	var wg sync.WaitGroup
-	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
-		locale := "de"
-		if i%2 == 0 {
-			locale = "fr"
-		}
-		go func(loc string) {
-			defer wg.Done()
-			_ = unifiedrole.LocalizeRoles(unifiedrole.BuildInRoles, loc)
-		}(locale)
-	}
-	wg.Wait()
-
-	// After all concurrent translations the globals must still hold English strings
-	g := NewWithT(t)
-	g.Expect(unifiedrole.RoleViewer.GetDisplayName()).To(Equal("Can view"))
-}

services/nats/pkg/server/debug/server.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -15,17 +14,12 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Nats.EnableTLS,
-		options.Config.Nats.TLSSkipVerifyClientCert,
-		options.Config.Nats.TLSCert,
-	)
 	// For nats readiness and liveness checks are identical
 	// the nats server will neither be healthy nor ready when it can not reach the nats server/cluster
 	checkHandler := handlers.NewCheckHandler(
 		handlers.NewCheckHandlerConfiguration().
 			WithLogger(options.Logger).
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Nats.Host+":"+strconv.Itoa(options.Config.Nats.Port), secureOption)),
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Nats.Host+":"+strconv.Itoa(options.Config.Nats.Port))),
 	)
 
 	return debug.NewService(

services/notifications/pkg/command/server.go

@@ -130,9 +130,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
-				store.TLSEnabled(cfg.Store.EnableTLS),
-				store.TLSInsecure(cfg.Store.TLSInsecure),
-				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)
 
 			svc := service.NewEventsNotifier(evts, channel, logger, gatewaySelector, valueService,

services/notifications/pkg/config/config.go

@@ -70,14 +70,11 @@ type ServiceAccount struct {
 
 // Store configures the store to use
 type Store struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;NOTIFICATIONS_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;NOTIFICATIONS_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"NOTIFICATIONS_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"NOTIFICATIONS_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;NOTIFICATIONS_STORE_TTL" desc:"Time to live for notifications in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;NOTIFICATIONS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;NOTIFICATIONS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;NOTIFICATIONS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;NOTIFICATIONS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;NOTIFICATIONS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;NOTIFICATIONS_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;NOTIFICATIONS_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"NOTIFICATIONS_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"NOTIFICATIONS_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;NOTIFICATIONS_STORE_TTL" desc:"Time to live for notifications in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;NOTIFICATIONS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;NOTIFICATIONS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/notifications/pkg/server/debug/server.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -15,14 +14,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Notifications.Events.EnableTLS,
-		options.Config.Notifications.Events.TLSInsecure,
-		options.Config.Notifications.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint)).
 		WithCheck("smtp-check", checks.NewTCPCheck(options.Config.Notifications.SMTP.Host+":"+strconv.Itoa(options.Config.Notifications.SMTP.Port)))
 
 	return debug.NewService(

services/ocm/pkg/revaconfig/config.go

@@ -81,7 +81,6 @@ func OCMConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]any {
 					"events": map[string]any{
 						"natsaddress":          cfg.Events.Endpoint,
 						"natsclusterid":        cfg.Events.Cluster,
-						"enabletls":            cfg.Events.EnableTLS,
 						"tlsinsecure":          cfg.Events.TLSInsecure,
 						"tlsrootcacertificate": cfg.Events.TLSRootCACertificate,
 						"authusername":         cfg.Events.AuthUsername,

services/ocm/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
 	return debug.NewService(

services/ocs/pkg/config/config.go

@@ -31,12 +31,9 @@ type Config struct {
 
 // SigningKeys is a store configuration.
 type SigningKeys struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel' and 'nats-js-kv'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_CACHE_STORE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel' and 'nats-js-kv'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/ocs/pkg/server/debug/server.go

@@ -21,7 +21,6 @@ func Server(opts ...Option) (*http.Server, error) {
 	readyHandlerConfiguration := healthHandlerConfiguration.
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if len(options.Config.SigningKeys.Nodes) > 0 {
-				// no secureOption because we cannot configure it
 				return checks.NewNatsCheck(options.Config.SigningKeys.Nodes[0])(ctx)
 			}
 			return nil

services/ocs/pkg/server/http/server.go

@@ -44,9 +44,6 @@ func Server(opts ...Option) (http.Service, error) {
 		microstore.Database("proxy"),
 		microstore.Table("signing-keys"),
 		store.Authentication(options.Config.SigningKeys.AuthUsername, options.Config.SigningKeys.AuthPassword),
-		store.TLSEnabled(options.Config.SigningKeys.EnableTLS),
-		store.TLSInsecure(options.Config.SigningKeys.TLSInsecure),
-		store.TLSRootCA(options.Config.SigningKeys.TLSRootCACertificate),
 	)
 
 	handle := svc.NewService(

services/policies/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/postprocessing/pkg/command/server.go

@@ -56,9 +56,6 @@ func Server(cfg *config.Config) *cobra.Command {
 					microstore.Database(cfg.Store.Database),
 					microstore.Table(cfg.Store.Table),
 					store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
-					store.TLSEnabled(cfg.Store.EnableTLS),
-					store.TLSInsecure(cfg.Store.TLSInsecure),
-					store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 				)
 
 				svc, err := service.NewPostprocessingService(ctx, logger, st, traceProvider, cfg)

services/postprocessing/pkg/config/config.go

@@ -59,14 +59,11 @@ type Debug struct {
 
 // Store configures the store to use
 type Store struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;POSTPROCESSING_STORE" desc:"The type of the store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;POSTPROCESSING_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"POSTPROCESSING_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"POSTPROCESSING_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;POSTPROCESSING_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;POSTPROCESSING_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;POSTPROCESSING_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;POSTPROCESSING_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;POSTPROCESSING_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;POSTPROCESSING_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided POSTPROCESSING_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;POSTPROCESSING_STORE" desc:"The type of the store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;POSTPROCESSING_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"POSTPROCESSING_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"POSTPROCESSING_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;POSTPROCESSING_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;POSTPROCESSING_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;POSTPROCESSING_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/postprocessing/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,14 +13,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Postprocessing.Events.EnableTLS,
-		options.Config.Postprocessing.Events.TLSInsecure,
-		options.Config.Postprocessing.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/proxy/README.md

@@ -194,7 +194,7 @@ role_assignment:
               claim_value: mySpaceAdminRole
             - role_name: user
               claim_value: myUserRole
-            - role_name: user-light
+            - role_name: guest
               claim_value: myGuestRole
 ```
 
@@ -223,7 +223,7 @@ The default `role_claim` (or `PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM`) is `roles`. The
   claim_value: opencloudSpaceAdmin
 - role_name: user
   claim_value: opencloudUser
-- role_name: user-light
+- role_name: guest
   claim_value: opencloudcloudGuest
 ```
 

services/proxy/pkg/command/server.go

@@ -66,9 +66,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Table(cfg.OIDC.UserinfoCache.Table),
 				store.DisablePersistence(cfg.OIDC.UserinfoCache.DisablePersistence),
 				store.Authentication(cfg.OIDC.UserinfoCache.AuthUsername, cfg.OIDC.UserinfoCache.AuthPassword),
-				store.TLSEnabled(cfg.OIDC.UserinfoCache.EnableTLS),
-				store.TLSInsecure(cfg.OIDC.UserinfoCache.TLSInsecure),
-				store.TLSRootCA(cfg.OIDC.UserinfoCache.TLSRootCACertificate),
 			)
 
 			signingKeyStore := store.Create(
@@ -79,9 +76,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Table("signing-keys"),
 				store.DisablePersistence(cfg.PreSignedURL.SigningKeys.DisablePersistence),
 				store.Authentication(cfg.PreSignedURL.SigningKeys.AuthUsername, cfg.PreSignedURL.SigningKeys.AuthPassword),
-				store.TLSEnabled(cfg.PreSignedURL.SigningKeys.EnableTLS),
-				store.TLSInsecure(cfg.PreSignedURL.SigningKeys.TLSInsecure),
-				store.TLSRootCA(cfg.PreSignedURL.SigningKeys.TLSRootCACertificate),
 			)
 
 			logger := log.Configure(cfg.Service.Name, cfg.Commons, cfg.LogLevel)

services/proxy/pkg/config/config.go

@@ -132,17 +132,14 @@ type JWKS struct {
 
 // Cache is a TTL cache configuration.
 type Cache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_OIDC_USERINFO_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_OIDC_USERINFO_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"PROXY_OIDC_USERINFO_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_OIDC_USERINFO_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_OIDC_USERINFO_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_OIDC_USERINFO_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_OIDC_USERINFO_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;PROXY_OIDC_USERINFO_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;PROXY_OIDC_USERINFO_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;PROXY_OIDC_USERINFO_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided PROXY_OIDC_USERINFO_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_OIDC_USERINFO_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_OIDC_USERINFO_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table              string        `yaml:"table" env:"PROXY_OIDC_USERINFO_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_OIDC_USERINFO_CACHE_TTL" desc:"Default time to live for user info in the user info cache. This value is only applied when the token expiration cannot be extracted from the access tokens (e.g. when non-JWT access tokes are used). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_OIDC_USERINFO_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_OIDC_USERINFO_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_OIDC_USERINFO_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // RoleAssignment contains the configuration for how to assign roles to users during login
@@ -192,15 +189,12 @@ type PreSignedURL struct {
 
 // SigningKeys is a store configuration.
 type SigningKeys struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel', 'nats-js-kv' and 'opencloudstoreservice' (deprecated). See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_DISABLE_PERSISTENCE" desc:"Disables persistence of the store. Only applies when store type 'nats-js-kv' is configured. Defaults to true." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel', 'nats-js-kv' and 'opencloudstoreservice' (deprecated). See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_DISABLE_PERSISTENCE" desc:"Disables persistence of the store. Only applies when store type 'nats-js-kv' is configured. Defaults to true." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // ClaimsSelectorConf is the config for the claims-selector

services/proxy/pkg/middleware/create_home.go

@@ -11,7 +11,6 @@ import (
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
-	"github.com/opencloud-eu/opencloud/services/proxy/pkg/router"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
@@ -49,13 +48,9 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	ctx, span := m.tracer.Start(req.Context(), fmt.Sprintf("%s %s", req.Method, req.URL.Path), trace.WithSpanKind(trace.SpanKindServer))
 	req = req.WithContext(ctx)
 	defer span.End()
-	next := func() {
+	if !m.shouldServe(req) {
 		span.End()
 		m.next.ServeHTTP(w, req)
-	}
-
-	if !m.shouldServe(req) {
-		next()
 		return
 	}
 
@@ -68,10 +63,6 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	createHomeReq := &provider.CreateHomeRequest{}
 	u, ok := revactx.ContextGetUser(ctx)
 	if ok {
-		if u.GetId().GetType() == userv1beta1.UserType_USER_TYPE_LIGHTWEIGHT || u.GetId().GetType() == userv1beta1.UserType_USER_TYPE_SERVICE {
-			next()
-			return
-		}
 		roleIDs, err := m.getUserRoles(u)
 		if err != nil {
 			m.logger.Error().Err(err).Str("userid", u.Id.OpaqueId).Msg("failed to get roles for user")
@@ -97,12 +88,12 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 			}
 		}
 	}
-	next()
+	span.End()
+	m.next.ServeHTTP(w, req)
 }
 
 func (m createHome) shouldServe(req *http.Request) bool {
-	ri := router.ContextRoutingInfo(req.Context())
-	return req.Header.Get(revactx.TokenHeader) != "" && !ri.IsRouteUnprotected()
+	return req.Header.Get(revactx.TokenHeader) != ""
 }
 
 func (m createHome) getUserRoles(user *userv1beta1.User) ([]string, error) {

services/proxy/pkg/server/debug/server.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/config"
@@ -22,13 +21,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	var configDumpFunc http.HandlerFunc = configDump(options.Config)
 	return debug.NewService(

services/search/pkg/search/service.go

@@ -535,7 +535,7 @@ func (s *Service) IndexSpace(spaceID *provider.StorageSpaceId, forceRescan bool)
 // TrashItem marks the item as deleted.
 func (s *Service) TrashItem(rID *provider.ResourceId) {
 	if err := s.engine.Delete(storagespace.FormatResourceID(rID)); err != nil {
-		s.logger.Info().Err(err).Interface("Id", rID).Msg("failed to remove item from index")
+		s.logger.Error().Err(err).Interface("Id", rID).Msg("failed to remove item from index")
 	}
 }
 

services/search/pkg/server/debug/server.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -20,13 +19,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
 		WithCheck("tika-check", func(ctx context.Context) error {
 			if options.Config.Extractor.Type == "tika" {
 				u, err := url.Parse(options.Config.Extractor.Tika.TikaURL)

services/settings/pkg/config/config.go

@@ -55,16 +55,13 @@ type Metadata struct {
 
 // Cache configures the cache of the Metadata store
 type Cache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;SETTINGS_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;SETTINGS_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	FileTable            string        `yaml:"files_table" env:"SETTINGS_FILE_CACHE_TABLE" desc:"The database table the store should use for the file cache." introductionVersion:"1.0.0"`
-	DirectoryTable       string        `yaml:"directories_table" env:"SETTINGS_DIRECTORY_CACHE_TABLE" desc:"The database table the store should use for the directory cache." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;SETTINGS_CACHE_TTL" desc:"Default time to live for entries in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;SETTINGS_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;SETTINGS_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;SETTINGS_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;SETTINGS_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;SETTINGS_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;SETTINGS_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SETTINGS_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;SETTINGS_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;SETTINGS_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	FileTable          string        `yaml:"files_table" env:"SETTINGS_FILE_CACHE_TABLE" desc:"The database table the store should use for the file cache." introductionVersion:"1.0.0"`
+	DirectoryTable     string        `yaml:"directories_table" env:"SETTINGS_DIRECTORY_CACHE_TABLE" desc:"The database table the store should use for the directory cache." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;SETTINGS_CACHE_TTL" desc:"Default time to live for entries in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;SETTINGS_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;SETTINGS_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;SETTINGS_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/settings/pkg/store/metadata/cache.go

@@ -140,9 +140,6 @@ func (c *CachedMDC) Init(ctx context.Context, id string) error {
 		microstore.Table(c.cfg.Metadata.Cache.DirectoryTable),
 		store.DisablePersistence(c.cfg.Metadata.Cache.DisablePersistence),
 		store.Authentication(c.cfg.Metadata.Cache.AuthUsername, c.cfg.Metadata.Cache.AuthPassword),
-		store.TLSEnabled(c.cfg.Metadata.Cache.EnableTLS),
-		store.TLSInsecure(c.cfg.Metadata.Cache.TLSInsecure),
-		store.TLSRootCA(c.cfg.Metadata.Cache.TLSRootCACertificate),
 	)
 	c.filesCache = store.Create(
 		store.Store(c.cfg.Metadata.Cache.Store),
@@ -152,9 +149,6 @@ func (c *CachedMDC) Init(ctx context.Context, id string) error {
 		microstore.Table(c.cfg.Metadata.Cache.FileTable),
 		store.DisablePersistence(c.cfg.Metadata.Cache.DisablePersistence),
 		store.Authentication(c.cfg.Metadata.Cache.AuthUsername, c.cfg.Metadata.Cache.AuthPassword),
-		store.TLSEnabled(c.cfg.Metadata.Cache.EnableTLS),
-		store.TLSInsecure(c.cfg.Metadata.Cache.TLSInsecure),
-		store.TLSRootCA(c.cfg.Metadata.Cache.TLSRootCACertificate),
 	)
 	return c.next.Init(ctx, id)
 }

services/sharing/pkg/config/config.go

@@ -155,7 +155,6 @@ type Events struct {
 	EnableTLS         bool   `yaml:"enable_tls" env:"OC_EVENTS_ENABLE_TLS;SHARING_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
 	AuthUsername      string `yaml:"auth_username" env:"OC_EVENTS_AUTH_USERNAME;SHARING_EVENTS_AUTH_USERNAME" desc:"Username for the events broker." introductionVersion:"1.0.0"`
 	AuthPassword      string `yaml:"auth_password" env:"OC_EVENTS_AUTH_PASSWORD;SHARING_EVENTS_AUTH_PASSWORD" desc:"Password for the events broker." introductionVersion:"1.0.0"`
-	// TODO use TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"OC_EVENTS_TLS_ROOT_CA_CERTIFICATE;SHARING_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SHARING_EVENTS_TLS_INSECURE will be seen as false." introductionVersion:"1.0.0"`
 }
 
 // PasswordPolicy configures reva password policy

services/sharing/pkg/revaconfig/config.go

@@ -83,7 +83,6 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 							"events": map[string]any{
 								"natsaddress":          cfg.Events.Addr,
 								"natsclusterid":        cfg.Events.ClusterID,
-								"enabletls":            cfg.Events.EnableTLS,
 								"tlsinsecure":          cfg.Events.TLSInsecure,
 								"tlsrootcacertificate": cfg.Events.TLSRootCaCertPath,
 								"authusername":         cfg.Events.AuthUsername,

services/sharing/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,14 +13,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCaCertPath,
-	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))
 
 	return debug.NewService(

services/sse/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/sse/pkg/service/service.go

@@ -49,19 +49,17 @@ func (s SSE) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // ListenForEvents listens for events
 func (s SSE) ListenForEvents() {
 	for e := range s.evChannel {
-		go func() {
-			switch ev := e.Event.(type) {
-			default:
-				s.l.Error().Interface("event", ev).Msg("unhandled event")
-			case events.SendSSE:
-				for _, uid := range ev.UserIDs {
-					s.sse.Publish(uid, &sse.Event{
-						Event: []byte(ev.Type),
-						Data:  ev.Message,
-					})
-				}
+		switch ev := e.Event.(type) {
+		default:
+			s.l.Error().Interface("event", ev).Msg("unhandled event")
+		case events.SendSSE:
+			for _, uid := range ev.UserIDs {
+				s.sse.Publish(uid, &sse.Event{
+					Event: []byte(ev.Type),
+					Data:  ev.Message,
+				})
 			}
-		}()
+		}
 	}
 }
 

services/storage-system/pkg/config/config.go

@@ -77,14 +77,11 @@ type DecomposedDriver struct {
 
 // Cache holds cache config
 type Cache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_SYSTEM_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_SYSTEM_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_SYSTEM_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_SYSTEM_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_SYSTEM_CACHE_AUTH_USERNAME" desc:"Username for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_SYSTEM_CACHE_AUTH_PASSWORD" desc:"Password for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_SYSTEM_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_SYSTEM_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_SYSTEM_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_SYSTEM_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_SYSTEM_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_SYSTEM_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_SYSTEM_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_SYSTEM_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_SYSTEM_CACHE_AUTH_USERNAME" desc:"Username for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_SYSTEM_CACHE_AUTH_PASSWORD" desc:"Password for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }

services/storage-system/pkg/revaconfig/config.go

@@ -165,16 +165,13 @@ func metadataDrivers(localEndpoint string, cfg *config.Config) map[string]any {
 			"cache_database": "system",
 		},
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FileMetadataCache.Store,
-			"cache_nodes":                   cfg.FileMetadataCache.Nodes,
-			"cache_database":                cfg.FileMetadataCache.Database,
-			"cache_ttl":                     cfg.FileMetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FileMetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FileMetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FileMetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FileMetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FileMetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FileMetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FileMetadataCache.Store,
+			"cache_nodes":               cfg.FileMetadataCache.Nodes,
+			"cache_database":            cfg.FileMetadataCache.Database,
+			"cache_ttl":                 cfg.FileMetadataCache.TTL,
+			"cache_disable_persistence": cfg.FileMetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FileMetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FileMetadataCache.AuthPassword,
 		},
 	}
 

services/storage-users/pkg/config/config.go

@@ -223,35 +223,27 @@ type Events struct {
 	NumConsumers      int    `yaml:"num_consumers" env:"STORAGE_USERS_EVENTS_NUM_CONSUMERS" desc:"The amount of concurrent event consumers to start. Event consumers are used for post-processing files. Multiple consumers increase parallelisation, but will also increase CPU and memory demands. The setting has no effect when the OC_ASYNC_UPLOADS is set to false. The default and minimum value is 1." introductionVersion:"1.0.0"`
 	AuthUsername      string `yaml:"username" env:"OC_EVENTS_AUTH_USERNAME;STORAGE_USERS_EVENTS_AUTH_USERNAME" desc:"The username to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
 	AuthPassword      string `yaml:"password" env:"OC_EVENTS_AUTH_PASSWORD;STORAGE_USERS_EVENTS_AUTH_PASSWORD" desc:"The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
-	// TODO use TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"OC_EVENTS_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_EVENTS_TLS_INSECURE will be seen as false." introductionVersion:"1.0.0"`
 }
 
 // FilemetadataCache holds cache config
 type FilemetadataCache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_FILEMETADATA_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_FILEMETADATA_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE;STORAGE_USERS_FILEMETADATA_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_FILEMETADATA_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_FILEMETADATA_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_USERS_FILEMETADATA_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_USERS_FILEMETADATA_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_FILEMETADATA_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_FILEMETADATA_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_FILEMETADATA_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_FILEMETADATA_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_FILEMETADATA_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_FILEMETADATA_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // IDCache holds cache config
 type IDCache struct {
-	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_ID_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_ID_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_ID_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens have no expiration. Defaults to 300s which is derived from the underlaying package though not explicitly set as default. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_ID_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_ID_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_ID_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_USERS_ID_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_USERS_ID_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_ID_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_ID_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store              string   `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_ID_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes              []string `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_ID_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database           string   `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	DisablePersistence bool     `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_ID_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername       string   `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_ID_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword       string   `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_ID_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // EOSDriver is the storage driver configuration when using 'eos' storage driver

services/storage-users/pkg/revaconfig/drivers.go

@@ -109,28 +109,21 @@ func Posix(cfg *config.Config, enableFSScan, enableFSWatch bool) map[string]any
 		"lock_cycle_duration_factor": cfg.Drivers.Posix.LockCycleDurationFactor,
 		"max_concurrency":            cfg.Drivers.Posix.MaxConcurrency,
 		"idcache": map[string]any{
-			"cache_store":                   cfg.IDCache.Store,
-			"cache_nodes":                   cfg.IDCache.Nodes,
-			"cache_database":                cfg.IDCache.Database,
-			"cache_ttl":                     cfg.IDCache.TTL,
-			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
-			"cache_auth_username":           cfg.IDCache.AuthUsername,
-			"cache_auth_password":           cfg.IDCache.AuthPassword,
-			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
-			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
+			"cache_store":               cfg.IDCache.Store,
+			"cache_nodes":               cfg.IDCache.Nodes,
+			"cache_database":            cfg.IDCache.Database,
+			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
+			"cache_auth_username":       cfg.IDCache.AuthUsername,
+			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FilemetadataCache.Store,
-			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
-			"cache_database":                cfg.FilemetadataCache.Database,
-			"cache_ttl":                     cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FilemetadataCache.Store,
+			"cache_nodes":               cfg.FilemetadataCache.Nodes,
+			"cache_database":            cfg.FilemetadataCache.Database,
+			"cache_ttl":                 cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -212,28 +205,21 @@ func Decomposed(cfg *config.Config) map[string]any {
 		"disable_versioning":          cfg.Drivers.Decomposed.DisableVersioning,
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FilemetadataCache.Store,
-			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
-			"cache_database":                cfg.FilemetadataCache.Database,
-			"cache_ttl":                     cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FilemetadataCache.Store,
+			"cache_nodes":               cfg.FilemetadataCache.Nodes,
+			"cache_database":            cfg.FilemetadataCache.Database,
+			"cache_ttl":                 cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]any{
-			"cache_store":                   cfg.IDCache.Store,
-			"cache_nodes":                   cfg.IDCache.Nodes,
-			"cache_database":                cfg.IDCache.Database,
-			"cache_ttl":                     cfg.IDCache.TTL,
-			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
-			"cache_auth_username":           cfg.IDCache.AuthUsername,
-			"cache_auth_password":           cfg.IDCache.AuthPassword,
-			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
-			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
+			"cache_store":               cfg.IDCache.Store,
+			"cache_nodes":               cfg.IDCache.Nodes,
+			"cache_database":            cfg.IDCache.Database,
+			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
+			"cache_auth_username":       cfg.IDCache.AuthUsername,
+			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -273,28 +259,21 @@ func DecomposedNoEvents(cfg *config.Config) map[string]any {
 		"disable_versioning":          cfg.Drivers.Decomposed.DisableVersioning,
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FilemetadataCache.Store,
-			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
-			"cache_database":                cfg.FilemetadataCache.Database,
-			"cache_ttl":                     cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FilemetadataCache.Store,
+			"cache_nodes":               cfg.FilemetadataCache.Nodes,
+			"cache_database":            cfg.FilemetadataCache.Database,
+			"cache_ttl":                 cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]any{
-			"cache_store":                   cfg.IDCache.Store,
-			"cache_nodes":                   cfg.IDCache.Nodes,
-			"cache_database":                cfg.IDCache.Database,
-			"cache_ttl":                     cfg.IDCache.TTL,
-			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
-			"cache_auth_username":           cfg.IDCache.AuthUsername,
-			"cache_auth_password":           cfg.IDCache.AuthPassword,
-			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
-			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
+			"cache_store":               cfg.IDCache.Store,
+			"cache_nodes":               cfg.IDCache.Nodes,
+			"cache_database":            cfg.IDCache.Database,
+			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
+			"cache_auth_username":       cfg.IDCache.AuthUsername,
+			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 	}
 }
@@ -336,28 +315,21 @@ func DecomposedS3(cfg *config.Config) map[string]any {
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"asyncfileuploads":            cfg.Drivers.DecomposedS3.AsyncUploads,
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FilemetadataCache.Store,
-			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
-			"cache_database":                cfg.FilemetadataCache.Database,
-			"cache_ttl":                     cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FilemetadataCache.Store,
+			"cache_nodes":               cfg.FilemetadataCache.Nodes,
+			"cache_database":            cfg.FilemetadataCache.Database,
+			"cache_ttl":                 cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]any{
-			"cache_store":                   cfg.IDCache.Store,
-			"cache_nodes":                   cfg.IDCache.Nodes,
-			"cache_database":                cfg.IDCache.Database,
-			"cache_ttl":                     cfg.IDCache.TTL,
-			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
-			"cache_auth_username":           cfg.IDCache.AuthUsername,
-			"cache_auth_password":           cfg.IDCache.AuthPassword,
-			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
-			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
+			"cache_store":               cfg.IDCache.Store,
+			"cache_nodes":               cfg.IDCache.Nodes,
+			"cache_database":            cfg.IDCache.Database,
+			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
+			"cache_auth_username":       cfg.IDCache.AuthUsername,
+			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -401,28 +373,21 @@ func DecomposedS3NoEvents(cfg *config.Config) map[string]any {
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"lock_cycle_duration_factor":  cfg.Drivers.DecomposedS3.LockCycleDurationFactor,
 		"filemetadatacache": map[string]any{
-			"cache_store":                   cfg.FilemetadataCache.Store,
-			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
-			"cache_database":                cfg.FilemetadataCache.Database,
-			"cache_ttl":                     cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
-			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
-			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
+			"cache_store":               cfg.FilemetadataCache.Store,
+			"cache_nodes":               cfg.FilemetadataCache.Nodes,
+			"cache_database":            cfg.FilemetadataCache.Database,
+			"cache_ttl":                 cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]any{
-			"cache_store":                   cfg.IDCache.Store,
-			"cache_nodes":                   cfg.IDCache.Nodes,
-			"cache_database":                cfg.IDCache.Database,
-			"cache_ttl":                     cfg.IDCache.TTL,
-			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
-			"cache_auth_username":           cfg.IDCache.AuthUsername,
-			"cache_auth_password":           cfg.IDCache.AuthPassword,
-			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
-			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
-			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
+			"cache_store":               cfg.IDCache.Store,
+			"cache_nodes":               cfg.IDCache.Nodes,
+			"cache_database":            cfg.IDCache.Database,
+			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
+			"cache_auth_username":       cfg.IDCache.AuthUsername,
+			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 	}
 }

services/storage-users/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,14 +13,9 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCaCertPath,
-	)
 	readyHandler := handlers.NewCheckHandler(handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)),
 	)
 

services/thumbnails/pkg/thumbnail/mimetypes_vips.go

@@ -2,6 +2,15 @@
 
 package thumbnail
 
+import "github.com/davidbyttow/govips/v2/vips"
+
+func init() {
+	// temporary remove TIFF and JP2K from go-vips' list of supported
+	// imagetypes
+	delete(vips.ImageTypes, vips.ImageTypeTIFF)
+	delete(vips.ImageTypes, vips.ImageTypeJP2K)
+}
+
 var (
 	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
 	SupportedMimeTypes = map[string]struct{}{
@@ -11,7 +20,6 @@ var (
 		"image/gif":                         {},
 		"image/bmp":                         {},
 		"image/x-ms-bmp":                    {},
-		"image/tiff":                        {},
 		"text/plain":                        {},
 		"audio/flac":                        {},
 		"audio/mpeg":                        {},

services/userlog/pkg/command/server.go

@@ -92,9 +92,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Persistence.Database),
 				microstore.Table(cfg.Persistence.Table),
 				store.Authentication(cfg.Persistence.AuthUsername, cfg.Persistence.AuthPassword),
-				store.TLSEnabled(cfg.Persistence.EnableTLS),
-				store.TLSInsecure(cfg.Persistence.TLSInsecure),
-				store.TLSRootCA(cfg.Persistence.TLSRootCACertificate),
 			)
 
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)

services/userlog/pkg/config/config.go

@@ -39,16 +39,13 @@ type Config struct {
 
 // Persistence configures the store to use
 type Persistence struct {
-	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;USERLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;USERLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database             string        `yaml:"database" env:"USERLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table                string        `yaml:"table" env:"USERLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;USERLOG_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;USERLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;USERLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;USERLOG_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
-	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;USERLOG_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
-	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;USERLOG_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided USERLOG_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;USERLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;USERLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database     string        `yaml:"database" env:"USERLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table        string        `yaml:"table" env:"USERLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;USERLOG_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;USERLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;USERLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 }
 
 // Events combines the configuration options for the event bus.

services/userlog/pkg/server/debug/server.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
-	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,13 +17,8 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))
 
-	secureOption := nats.Secure(
-		options.Config.Events.EnableTLS,
-		options.Config.Events.TLSInsecure,
-		options.Config.Events.TLSRootCACertificate,
-	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
 
 	return debug.NewService(
 		debug.Logger(options.Logger),

services/userlog/pkg/service/service.go

@@ -101,7 +101,7 @@ func (ul *UserlogService) MemorizeEvents(ch <-chan events.Event) {
 	for i := 0; i < ul.cfg.MaxConcurrency; i++ {
 		go func(ch <-chan events.Event) {
 			for event := range ch {
-				go ul.processEvent(event)
+				ul.processEvent(event)
 			}
 		}(ch)
 	}

services/web/Makefile

@@ -1,7 +1,7 @@
 SHELL := bash
 NAME := web
-WEB_ASSETS_VERSION = v7.1.2
-WEB_ASSETS_BRANCH = stable-7.1
+WEB_ASSETS_VERSION = v7.1.0
+WEB_ASSETS_BRANCH = main
 
 ifneq (, $(shell command -v go 2> /dev/null)) # suppress `command not found warnings` for non go targets in CI
 include ../../.bingo/Variables.mk

services/web/pkg/config/options.go

@@ -5,8 +5,8 @@ type Options struct {
 	AccountEditLink        *AccountEditLink    `json:"accountEditLink,omitempty" yaml:"accountEditLink"`
 	DisableFeedbackLink    bool                `json:"disableFeedbackLink,omitempty" yaml:"disableFeedbackLink" env:"WEB_OPTION_DISABLE_FEEDBACK_LINK" desc:"Set this option to 'true' to disable the feedback link in the top bar. Keeping it enabled by setting the value to 'false' or with the absence of the option, allows OpenCloud to get feedback from your user base through a dedicated survey website." introductionVersion:"1.0.0"`
 	FeedbackLink           *FeedbackLink       `json:"feedbackLink,omitempty" yaml:"feedbackLink"`
-	RunningOnEOS           bool                `json:"runningOnEos,omitempty" yaml:"runningOnEos" env:"WEB_OPTION_RUNNING_ON_EOS" desc:"Set this option to 'true' if running on an EOS storage backend (https://eos-web.web.cern.ch/eos-web/) to enable its specific features. Defaults to 'false'." introductionVersion:"1.0.0" deprecationVersion:"6.2.0" removalVersion:"7.2.0" deprecationInfo:"WEB_OPTION_RUNNING_ON_EOS is deprecated and will be removed in a future release."`
-	CernFeatures           bool                `json:"cernFeatures,omitempty" yaml:"cernFeatures" deprecationVersion:"6.2.0" removalVersion:"7.2.0"`
+	RunningOnEOS           bool                `json:"runningOnEos,omitempty" yaml:"runningOnEos" env:"WEB_OPTION_RUNNING_ON_EOS" desc:"Set this option to 'true' if running on an EOS storage backend (https://eos-web.web.cern.ch/eos-web/) to enable its specific features. Defaults to 'false'." introductionVersion:"1.0.0" deprecationVersion:"6.2.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"WEB_OPTION_RUNNING_ON_EOS is deprecated and will be removed in a future release."`
+	CernFeatures           bool                `json:"cernFeatures,omitempty" yaml:"cernFeatures" deprecationVersion:"6.2.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%"`
 	OpenFilesInNewTab      bool                `json:"openFilesInNewTab,omitempty" yaml:"openFilesInNewTab" env:"WEB_OPTION_OPEN_FILES_IN_NEW_TAB" desc:"Set this option to 'true' to open files in a new browser tab instead of navigating in the same tab. Defaults to 'false'." introductionVersion:"5.3.0"`
 	Upload                 *Upload             `json:"upload,omitempty" yaml:"upload"`
 	Editor                 *Editor             `json:"editor,omitempty" yaml:"editor"`

tests/acceptance/bootstrap/GraphContext.php

@@ -287,7 +287,9 @@ class GraphContext implements Context {
 	public function adminDeletesUserUsingTheGraphApi(string $user, ?string $byUser = null): ?ResponseInterface {
 		$credentials = $this->getAdminOrUserCredentials($byUser);
 		$userId = $this->featureContext->getAttributeOfCreatedUser($user, 'id');
-		$userId = $userId ?: $user;
+		if ($userId === null) {
+			throw new \RuntimeException("Cannot delete user '$user': no userId found");
+		}
 		return GraphHelper::deleteUserByUserId(
 			$this->featureContext->getBaseUrl(),
 			$this->featureContext->getStepLineRef(),

tests/acceptance/bootstrap/Provisioning.php

@@ -469,80 +469,6 @@ trait Provisioning {
 		$this->ldapCreatedUsers[] = $setting["userid"];
 	}
 
-	/**
-	 * Creates a user through the Graph API and replaces a stale existing user if needed.
-	 *
-	 * @param string $userName
-	 * @param string $password
-	 * @param string|null $email
-	 * @param string|null $displayName
-	 * @param string|null $byUser
-	 *
-	 * @return string
-	 * @throws Exception|GuzzleException
-	 */
-	private function createGraphUserWithReplacement(
-		string $userName,
-		string $password,
-		?string $email,
-		?string $displayName,
-		?string $byUser = null
-	): string {
-		$userName = $this->getActualUsername($userName);
-		$userName = \trim($userName);
-		if ($displayName === null) {
-			$displayName = $this->getDisplayNameForUser($userName);
-			if ($displayName === null) {
-				$displayName = $this->getDisplayNameForUser('regularuser');
-			}
-		}
-		if ($email === null) {
-			$email = $this->getEmailAddressForUser($userName);
-			if ($email === null) {
-				$email = \str_replace(["@", " "], "", $userName) . '@opencloud.eu';
-			}
-		}
-		$reqUser = $byUser ? $this->getActualUsername($byUser) : $this->getAdminUsername();
-		$response = GraphHelper::createUser(
-			$this->getBaseUrl(),
-			$this->getStepLineRef(),
-			$reqUser,
-			$this->getPasswordForUser($reqUser),
-			$userName,
-			$password,
-			$email,
-			$displayName,
-		);
-
-		if ($response->getStatusCode() === 409) {
-			$responseBody = $this->getJsonDecodedResponse($response);
-			if (($responseBody['error']['code'] ?? null) === 'nameAlreadyExists') {
-				$deleteResponse = $this->deleteUser($userName);
-				$this->theHTTPStatusCodeShouldBe(204, "", $deleteResponse);
-
-				$response = GraphHelper::createUser(
-					$this->getBaseUrl(),
-					$this->getStepLineRef(),
-					$reqUser,
-					$this->getPasswordForUser($reqUser),
-					$userName,
-					$password,
-					$email,
-					$displayName,
-				);
-			}
-		}
-
-		Assert::assertEquals(
-			201,
-			$response->getStatusCode(),
-			__METHOD__ . " cannot create user '$userName'.\nResponse:" .
-			json_encode($this->getJsonDecodedResponse($response))
-		);
-
-		return (string)$this->getJsonDecodedResponse($response)['id'];
-	}
-
 	/**
 	 * @param string $group group name
 	 *
@@ -655,7 +581,37 @@ trait Provisioning {
 					);
 				}
 			} else {
-				$userId = $this->createGraphUserWithReplacement($userName, $password, $email, $displayName);
+				// Use the same logic as userHasBeenCreated for email generation
+				if ($email === null) {
+					$email = $this->getEmailAddressForUser($userName);
+					if ($email === null) {
+						// escape @ & space if present in userId
+						$email = \str_replace(["@", " "], "", $userName) . '@opencloud.eu';
+					}
+				}
+
+				$userName = $this->getActualUsername($userName);
+				$userName = \trim($userName);
+
+				$response = GraphHelper::createUser(
+					$this->getBaseUrl(),
+					$this->getStepLineRef(),
+					$this->getAdminUsername(),
+					$this->getAdminPassword(),
+					$userName,
+					$password,
+					$email,
+					$displayName,
+				);
+
+				Assert::assertEquals(
+					201,
+					$response->getStatusCode(),
+					__METHOD__ . " cannot create user '$userName'.\nResponse:" .
+					json_encode($this->getJsonDecodedResponse($response))
+				);
+
+				$userId = $this->getJsonDecodedResponse($response)['id'];
 			}
 
 			$this->addUserToCreatedUsersList($userName, $password, $displayName, $email, $userId ?? null);
@@ -1113,7 +1069,24 @@ trait Provisioning {
 				);
 			}
 		} else {
-			$userId = $this->createGraphUserWithReplacement($user, $password, $email, $displayName, $byUser);
+			$reqUser = $byUser ? $this->getActualUsername($byUser) : $this->getAdminUsername();
+			$response = GraphHelper::createUser(
+				$this->getBaseUrl(),
+				$this->getStepLineRef(),
+				$reqUser,
+				$this->getPasswordForUser($reqUser),
+				$user,
+				$password,
+				$email,
+				$displayName,
+			);
+			Assert::assertEquals(
+				201,
+				$response->getStatusCode(),
+				__METHOD__ . " cannot create user '$user'.\nResponse:" .
+				json_encode($this->getJsonDecodedResponse($response))
+			);
+			$userId = $this->getJsonDecodedResponse($response)['id'];
 		}
 
 		$this->addUserToCreatedUsersList($user, $password, $displayName, $email, $userId);
@@ -1736,6 +1709,7 @@ trait Provisioning {
 				$this->ocsApiVersion
 			);
 		} else {
+			// users can be deleted using the username in the GraphApi too
 			$response = $this->graphContext->adminDeletesUserUsingTheGraphApi($user);
 		}
 		return $response;

tests/acceptance/features/apiSpaces/disableAndDeleteSpaces.feature

@@ -63,28 +63,28 @@ Feature: Disabling and deleting space
   Scenario Outline: user cannot delete their own space without first disabling it
     Given the administrator has assigned the role "<user-role>" to user "Alice" using the Graph API
     When user "Alice" deletes a space "Project Moon"
-    Then the HTTP status code should be "<code>"
+    Then the HTTP status code should be "400"
     And the user "Alice" should have a space called "Project Moon"
     Examples:
-      | user-role   | code |
-      | Admin       | 400  |
-      | Space Admin | 400  |
-      | User        | 403  |
-      | User Light  | 403  |
+      | user-role   |
+      | Admin       |
+      | Space Admin |
+      | User        |
+      | User Light  |
 
 
-  Scenario Outline: user cannot delete their own disabled space via the Graph API
+  Scenario Outline: user can delete their own disabled space via the Graph API
     Given the administrator has assigned the role "<user-role>" to user "Alice" using the Graph API
     And user "Alice" has disabled a space "Project Moon"
     When user "Alice" deletes a space "Project Moon"
-    Then the HTTP status code should be "<code>"
-    And the user "Alice" <shouldOrNot> have a space called "Project Moon"
+    Then the HTTP status code should be "204"
+    And the user "Alice" should not have a space called "Project Moon"
     Examples:
-      | user-role   | code | shouldOrNot |
-      | Admin       | 204  | should not  |
-      | Space Admin | 204  | should not  |
-      | User        | 403  | should      |
-      | User Light  | 403  | should      |
+      | user-role   |
+      | Admin       |
+      | Space Admin |
+      | User        |
+      | User Light  |
 
 
   Scenario Outline: an admin and space manager can disable other space via the Graph API
@@ -134,7 +134,7 @@ Feature: Disabling and deleting space
 
   Scenario Outline: viewer and space editor cannot disable space
     When user "<user>" tries to disable a space "Project Moon" owned by user "Alice"
-    Then the HTTP status code should be "403"
+    Then the HTTP status code should be "404"
     And the user "<user>" should have a space called "Project Moon"
     Examples:
       | user  |

tests/acceptance/features/apiSpaces/spaceManagement.feature

@@ -152,14 +152,11 @@ Feature: Space management
 
   Scenario Outline: space admin user tries to disable the personal space
     When user "<user>" disables a space "Alice Hansen" owned by user "Alice"
-    Then the HTTP status code should be "<code>"
+    Then the HTTP status code should be "404"
     Examples:
-      | user  | code |
-      # Brian is Space Admin and can currently list all Personal Spaces, so he
-      # gets a 403 instead of a 404 here. This might change in the future see:
-      # https://github.com/opencloud-eu/opencloud/issues/2979
-      | Brian | 403  |
-      | Carol | 404  |
+      | user  |
+      | Brian |
+      | Carol |
 
 
   Scenario: space admin user deletes the project space

vendor/github.com/go-playground/validator/v10/.gitignore

@@ -30,4 +30,3 @@ _testmain.go
 cover.html
 README.html
 .idea
-.claude/

vendor/github.com/go-playground/validator/v10/.golangci.yaml

@@ -53,8 +53,3 @@ linters:
     - varnamelen
     - wrapcheck
     - wsl
-    - gomodguard
-  settings:
-    govet:
-      disable:
-        - inline

vendor/github.com/go-playground/validator/v10/CLAUDE.md

@@ -1,78 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Repository
-
-`github.com/go-playground/validator/v10` — struct and field validation library based on struct tags. The module path ends in `/v10`; changes must preserve v10 API compatibility. Contributions require test coverage (see `.github/CONTRIBUTING.md`).
-
-## Commands
-
-```bash
-make test              # go test -cover -race ./...
-make lint              # installs golangci-lint v2.0.2 if missing, then runs it
-make bench             # go test -run=NONE -bench=. -benchmem ./...
-
-# Single test / subtest
-go test -run TestName ./...
-go test -run TestName/subtest_name ./...
-
-# Single benchmark
-go test -run=NONE -bench=BenchmarkFieldSuccess -benchmem ./...
-```
-
-Tests live alongside source in the package root (`validator_test.go`, `benchmarks_test.go`); run them from the repo root. Non-standard validators and translations are separate packages (`./non-standard/validators`, `./translations/...`) and are included by `./...`.
-
-## Architecture
-
-The library compiles validation tags into cached execution plans, then runs them against values via reflection. Understanding three layers is enough to be productive:
-
-### 1. Registration & configuration — [validator_instance.go](validator_instance.go)
-`Validate` is the singleton entry point. It holds:
-- `validations` — tag → `FuncCtx` (the validator functions)
-- `aliases` — shorthand tag → expanded tag expression
-- `customFuncs` — `reflect.Type` → value extractor (for types like `sql.NullString` or anything implementing the `Valuer` interface, see [doc.go](doc.go))
-- `structLevelFuncs` — struct-level validators
-- `tagCache` and `structCache` — parsed-tag and parsed-struct caches (critical for performance; `Validate` is thread-safe and must be used as a singleton)
-
-Options live in [options.go](options.go) (`WithRequiredStructEnabled`, `WithPrivateFieldValidation`, etc.). `WithRequiredStructEnabled` is the forward-compatible default users should adopt before v11.
-
-### 2. Baked-in validators — [baked_in.go](baked_in.go)
-All built-in tags (`required`, `email`, `uuid`, `oneof`, `gt`, cross-field `eqfield`, etc.) are registered here as `Func`/`FuncCtx` receiving a `FieldLevel` (see [field_level.go](field_level.go)). `restrictedTags` enumerates names that cannot be overridden. Cross-field validators resolve the other field via `fl.GetStructFieldOK*` against the parent struct captured in the execution context.
-
-Adjacent data tables:
-- [regexes.go](regexes.go), [postcode_regexes.go](postcode_regexes.go) — compiled regexps used by validators
-- [country_codes.go](country_codes.go), [currency_codes.go](currency_codes.go), [language_codes.go](language_codes.go) — lookup tables
-
-When adding a new tag: register it in `bakedInValidators` in [baked_in.go](baked_in.go), add its description to the table in [README.md](README.md), and add tests in [validator_test.go](validator_test.go).
-
-### 3. Execution — [validator.go](validator.go) + [cache.go](cache.go)
-- [cache.go](cache.go) parses struct tags into `cField` and `cTag` linked lists once per type and stores them in `structCache`/`tagCache`. `cTag.typeof` (`typeDefault`, `typeOmitEmpty`, `typeDive`, `typeStructOnly`, `typeOr`, etc.) tells the executor what to do.
-- [validator.go](validator.go) contains the per-call `validate` struct (pooled via `sync.Pool`) and the `validateStruct` / `traverseField` mutual recursion. `ns`/`actualNs` are the accumulated dotted namespaces used in error paths; `dive`, `keys`, `endkeys` push/pop through slices/maps.
-
-Public entry points live on `Validate`: `Struct`, `StructCtx`, `StructPartial`, `StructExcept`, `StructFiltered`, `Var`, `VarWithValue`, and their `Ctx` variants.
-
-### Errors
-[errors.go](errors.go) defines `ValidationErrors` (a `[]FieldError`) and `InvalidValidationError`. Per [README.md](README.md) and [doc.go](doc.go), callers type-assert `err.(validator.ValidationErrors)` after checking `err != nil`. Only `InvalidValidationError` signals misuse (e.g. passing a non-struct to `Struct`).
-
-### Struct-level & field-level custom validators
-[struct_level.go](struct_level.go) and [field_level.go](field_level.go) define the contexts passed to user-registered functions. Struct-level validators report errors via `StructLevel.ReportError` / `ReportValidationErrors` — they operate on the whole struct instead of a single field.
-
-### Translations — [translations.go](translations.go) + [translations/](translations/)
-Each locale under `translations/<locale>` registers a human-readable message per tag against a `ut.Translator`. `FieldError.Translate(trans)` consumes the registered `TranslationFunc`. When adding a new tag with a translation, add an entry in each locale package — translations are parallel packages, not a single table.
-
-### Non-standard validators — [non-standard/validators/](non-standard/validators/)
-Opt-in validators (`NotBlank`) users register manually. Keep niche or opinionated validators here rather than expanding `baked_in.go`.
-
-## Performance-sensitive areas
-
-Validation is on the hot path for many users. When touching [cache.go](cache.go), [validator.go](validator.go), or `baked_in.go` hot functions:
-- Avoid allocations in the success path — several baked-in validators and the executor reuse pooled buffers (`validate.misc`, `str1`, `str2`).
-- Benchmarks in [benchmarks_test.go](benchmarks_test.go) gate regressions; run `make bench` before and after significant changes and include results in the PR if they move.
-
-## Conventions
-
-- Go module minimum version is pinned in [go.mod](go.mod); don't lower it.
-- Don't introduce new top-level exported types without need — most extension happens through `Register*` methods on `Validate`.
-- `restrictedTags` (in [baked_in.go](baked_in.go)) is intentionally a denylist for aliases and registrations; adding a tag with one of those names will break the parser.
-- Examples live under `_examples/` (underscore prefix excludes them from the module build). Keep them runnable as standalone `main` packages.

vendor/github.com/go-playground/validator/v10/README.md

@@ -51,8 +51,7 @@ Validator returns only InvalidValidationError for bad validation input, nil or V
 
 ```go
 err := validate.Struct(mystruct)
-var validationErrors validator.ValidationErrors
-errors.As(err, &validationErrors)
+validationErrors := err.(validator.ValidationErrors)
  ```
 
 Usage and documentation
@@ -129,7 +128,6 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | url | URL String |
 | http_url | HTTP(s) URL String |
 | https_url | HTTPS-only URL String |
-| origin | Web origin (URL with HTTP(S) scheme and host, but no path/query/fragment) |
 | url_encoded | URL Encoded |
 | urn_rfc2141 | Urn RFC 2141 String |
 
@@ -171,7 +169,6 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | bic_iso_9362_2014 | Business Identifier Code (ISO 9362:2014) |
 | bic | Business Identifier Code (ISO 9362:2022) |
 | bcp47_language_tag | Language tag (BCP 47) |
-| bcp47_strict_language_tag | Language tag (BCP 47), strictly following RFC 5646 |
 | btc_addr | Bitcoin Address |
 | btc_addr_bech32 | Bitcoin Bech32 Address (segwit) |
 | credit_card | Credit Card Number |
@@ -225,7 +222,7 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | sha384 | SHA384 hash |
 | sha512 | SHA512 hash |
 | ripemd128 | RIPEMD-128 hash |
-| ripemd160 | RIPEMD-160 hash |
+| ripemd128 | RIPEMD-160 hash |
 | tiger128 | TIGER128 hash |
 | tiger160 | TIGER160 hash |
 | tiger192 | TIGER192 hash |
@@ -253,13 +250,11 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | file | Existing File |
 | filepath | File Path |
 | image | Image |
-| mimetype | MIME Type |
 | isdefault | Is Default |
 | len | Length |
 | max | Maximum |
 | min | Minimum |
 | oneof | One Of |
-| noneof | None Of |
 | required | Required |
 | required_if | Required If |
 | required_unless | Required Unless |

vendor/github.com/go-playground/validator/v10/baked_in.go

@@ -3,6 +3,7 @@ package validator
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -15,9 +16,7 @@ import (
 	"net/url"
 	"os"
 	"reflect"
-	"regexp"
 	"runtime"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -142,7 +141,6 @@ var (
 		"http_url":                      isHttpURL,
 		"https_url":                     isHttpsURL,
 		"uri":                           isURI,
-		"origin":                        isOrigin,
 		"urn_rfc2141":                   isUrnRFC2141, // RFC 2141
 		"file":                          isFile,
 		"filepath":                      isFilePath,
@@ -161,7 +159,6 @@ var (
 		"startsnotwith":                 startsNotWith,
 		"endsnotwith":                   endsNotWith,
 		"image":                         isImage,
-		"mimetype":                      isMIMEType,
 		"isbn":                          isISBN,
 		"isbn10":                        isISBN10,
 		"isbn13":                        isISBN13,
@@ -220,8 +217,6 @@ var (
 		"unique":                        isUnique,
 		"oneof":                         isOneOf,
 		"oneofci":                       isOneOfCI,
-		"noneof":                        isNoneOf,
-		"noneofci":                      isNoneOfCI,
 		"html":                          isHTML,
 		"html_encoded":                  isHTMLEncoded,
 		"url_encoded":                   isURLEncoded,
@@ -245,7 +240,6 @@ var (
 		"iso4217":                       isIso4217,
 		"iso4217_numeric":               isIso4217Numeric,
 		"bcp47_language_tag":            isBCP47LanguageTag,
-		"bcp47_strict_language_tag":     isBCP47StrictLanguageTag,
 		"postcode_iso3166_alpha2":       isPostcodeByIso3166Alpha2,
 		"postcode_iso3166_alpha2_field": isPostcodeByIso3166Alpha2Field,
 		"bic_iso_9362_2014":             isIsoBic2014Format,
@@ -267,33 +261,6 @@ var (
 var (
 	oneofValsCache       = map[string][]string{}
 	oneofValsCacheRWLock = sync.RWMutex{}
-
-	// BCP47 language tag
-	// according to https://www.rfc-editor.org/rfc/bcp/bcp47.txt
-	bcp47LanguageTagRe = regexp.MustCompile(strings.Join([]string{
-		// group 1:
-		`^(`,
-		// irregular
-		`en-gb-oed|i-ami|i-bnn|i-default|i-enochian|i-hak|i-klingon|i-lux|i-mingo|i-navajo|i-pwn|i-tao|i-tay|i-tsu|`,
-		`sgn-be-fr|sgn-be-nl|sgn-ch-de|`,
-		// regular
-		`art-lojban|cel-gaulish|no-bok|no-nyn|zh-guoyu|zh-hakka|zh-min|zh-min-nan|zh-xiang|`,
-		// privateuse
-		`x-[a-z0-9]{1,8}`,
-		`)$`,
-
-		`|`,
-
-		// langtag
-		`^`,
-		`((?:[a-z]{2,3}(?:-[a-z]{3}){0,3})|[a-z]{4}|[a-z]{5,8})`, // group 2: language
-		`(?:-([a-z]{4}))?`,          // group 3: script
-		`(?:-([a-z]{2}|[0-9]{3}))?`, // group 4: region
-		`(?:-((?:[a-z0-9]{5,8}|[0-9][a-z0-9]{3})(?:-(?:[a-z0-9]{5,8}|[0-9][a-z0-9]{3}))*))?`, // group 5: variant
-		`(?:-((?:[a-wyz0-9](?:-[a-z0-9]{2,8})+)(?:-(?:[a-wyz0-9](?:-[a-z0-9]{2,8})+))*))?`,   // group 6: extension
-		`(?:-x(?:-[a-z0-9]{1,8})+)?`,
-		`$`,
-	}, ""))
 )
 
 func parseOneOfParam2(s string) []string {
@@ -340,8 +307,12 @@ func isOneOf(fl FieldLevel) bool {
 	default:
 		panic(fmt.Sprintf("Bad field type %s", field.Type()))
 	}
-
-	return slices.Contains(vals, v)
+	for i := 0; i < len(vals); i++ {
+		if vals[i] == v {
+			return true
+		}
+	}
+	return false
 }
 
 // isOneOfCI is the validation function for validating if the current field's value is one of the provided string values (case insensitive).
@@ -352,20 +323,13 @@ func isOneOfCI(fl FieldLevel) bool {
 	if field.Kind() != reflect.String {
 		panic(fmt.Sprintf("Bad field type %s", field.Type()))
 	}
-
-	return slices.ContainsFunc(vals, func(val string) bool {
-		return strings.EqualFold(val, field.String())
-	})
-}
-
-// isNoneOf validates that the current field's value is not one of the provided string or integer values
-func isNoneOf(fl FieldLevel) bool {
-	return !isOneOf(fl)
-}
-
-// isNoneOfCI validates that the current field's value is not one of the provided string values (case insensitive)
-func isNoneOfCI(fl FieldLevel) bool {
-	return !isOneOfCI(fl)
+	v := field.String()
+	for _, val := range vals {
+		if strings.EqualFold(val, v) {
+			return true
+		}
+	}
+	return false
 }
 
 // isUnique is the validation function for validating if each array|slice|map value is unique
@@ -1562,64 +1526,6 @@ func isURI(fl FieldLevel) bool {
 	panic(fmt.Sprintf("Bad field type %s", field.Type()))
 }
 
-// isOrigin checks if a field value is a valid web origin URL with HTTP(S) scheme and host defined, but no path, query, or fragment.
-func isOrigin(fl FieldLevel) bool {
-	field := fl.Field()
-
-	if field.Kind() == reflect.String {
-		s := field.String()
-
-		if len(s) == 0 {
-			return false
-		}
-
-		// Fragments with empty content ("#") are not detectable after parse and
-		// u.Fragment will be empty even if # is present in the URL.
-		if strings.Contains(s, "#") {
-			return false
-		}
-
-		u, err := url.Parse(s)
-		if err != nil {
-			return false
-		}
-
-		if u.Scheme != "http" && u.Scheme != "https" {
-			return false
-		}
-
-		if u.Path != "" || u.RawQuery != "" || u.ForceQuery || u.Fragment != "" {
-			return false
-		}
-
-		if u.User != nil {
-			return false
-		}
-
-		hostname := u.Hostname()
-		if hostname == "" {
-			return false
-		}
-		if net.ParseIP(hostname) == nil && !hostnameRegexRFC1123().MatchString(hostname) {
-			return false
-		}
-
-		portStr := u.Port()
-		if portStr != "" {
-			// Port 0 is reserved (RFC 6335) and has no valid use as an origin port.
-			// https://www.rfc-editor.org/rfc/rfc6335.html#section-6
-			port, portErr := strconv.ParseUint(portStr, 10, 16)
-			if portErr != nil || port == 0 {
-				return false
-			}
-		}
-
-		return true
-	}
-
-	panic(fmt.Sprintf("Bad field type %s", field.Type()))
-}
-
 // isURL is the validation function for validating if the current field's value is a valid URL.
 func isURL(fl FieldLevel) bool {
 	field := fl.Field()
@@ -1729,63 +1635,6 @@ func isFile(fl FieldLevel) bool {
 	panic(fmt.Sprintf("Bad field type %s", field.Type()))
 }
 
-func detectFileMIMEType(field reflect.Value) (string, bool) {
-	switch field.Kind() {
-	case reflect.String:
-		filePath := field.String()
-		fileInfo, err := os.Stat(filePath)
-		if err != nil || fileInfo.IsDir() {
-			return "", false
-		}
-
-		file, err := os.Open(filePath)
-		if err != nil {
-			return "", false
-		}
-		defer func() {
-			_ = file.Close()
-		}()
-
-		mime, err := mimetype.DetectReader(file)
-		if err != nil {
-			return "", false
-		}
-
-		return mime.String(), true
-	}
-
-	panic(fmt.Sprintf("Bad field type %s", field.Type()))
-}
-
-func matchesMIMEType(mime, expected string) bool {
-	expectedType, expectedSubtype, ok := strings.Cut(strings.TrimSpace(expected), "/")
-	if !ok || expectedType == "" || expectedSubtype == "" {
-		return false
-	}
-
-	mimeType, mimeSubtype, ok := strings.Cut(mime, "/")
-	if !ok || mimeType == "" || mimeSubtype == "" {
-		return false
-	}
-
-	if expectedSubtype == "*" {
-		return mimeType == expectedType
-	}
-
-	return mimeType == expectedType && mimeSubtype == expectedSubtype
-}
-
-// isMIMEType is the validation function for validating if the current field's value contains the path to a file
-// whose detected MIME type matches the provided validator param in the form type/subtype or type/*.
-func isMIMEType(fl FieldLevel) bool {
-	mime, ok := detectFileMIMEType(fl.Field())
-	if !ok {
-		return false
-	}
-
-	return matchesMIMEType(mime, fl.Param())
-}
-
 // isImage is the validation function for validating if the current field's value contains the path to a valid image file
 func isImage(fl FieldLevel) bool {
 	mimetypes := map[string]bool{
@@ -1814,14 +1663,39 @@ func isImage(fl FieldLevel) bool {
 		"image/x-xpixmap":          true,
 		"image/x-xwindowdump":      true,
 	}
+	field := fl.Field()
 
-	mime, ok := detectFileMIMEType(fl.Field())
-	if !ok {
-		return false
+	switch field.Kind() {
+	case reflect.String:
+		filePath := field.String()
+		fileInfo, err := os.Stat(filePath)
+		if err != nil {
+			return false
+		}
+
+		if fileInfo.IsDir() {
+			return false
+		}
+
+		file, err := os.Open(filePath)
+		if err != nil {
+			return false
+		}
+		defer func() {
+			_ = file.Close()
+		}()
+
+		mime, err := mimetype.DetectReader(file)
+		if err != nil {
+			return false
+		}
+
+		if _, ok := mimetypes[mime.String()]; ok {
+			return true
+		}
 	}
 
-	_, ok = mimetypes[mime]
-	return ok
+	panic(fmt.Sprintf("Bad field type %s", field.Type()))
 }
 
 // isFilePath is the validation function for validating if the current field's value is a valid file path.
@@ -3207,150 +3081,6 @@ func isBCP47LanguageTag(fl FieldLevel) bool {
 	panic(fmt.Sprintf("Bad field type %s", field.Type()))
 }
 
-// isBCP47StrictLanguageTag is the validation function for validating if the current field's value is a valid BCP 47 language tag
-// according to https://www.rfc-editor.org/rfc/bcp/bcp47.txt
-func isBCP47StrictLanguageTag(fl FieldLevel) bool {
-	field := fl.Field()
-
-	if field.Kind() != reflect.String {
-		panic(fmt.Sprintf("Bad field type %s", field.Type()))
-	}
-
-	lower := strings.ToLower(field.String())
-	lowerTagDash := lower + "-"
-
-	m := bcp47LanguageTagRe.FindStringSubmatch(lower)
-	if m == nil {
-		return false
-	}
-
-	grandfatheredOrPrivateuse := m[1]
-	lang := m[2]
-	script := m[3]
-	region := m[4]
-	variant := m[5]
-	extension := m[6]
-
-	if grandfatheredOrPrivateuse != "" {
-		return true
-	}
-
-	// language      = 2*3ALPHA            ; shortest ISO 639 code
-	//                 ["-" extlang]       ; sometimes followed by
-	//                                     ; extended language subtags
-	//               / 4ALPHA              ; or reserved for future use
-	//               / 5*8ALPHA            ; or registered language subtag
-	switch n := len(lang); {
-	// 2*3ALPHA "-" extlang
-	case strings.Contains(lang, "-"):
-		parts := strings.Split(lang, "-")
-
-		baseLang := parts[0]
-		base, err := language.ParseBase(baseLang)
-		if err != nil {
-			return false
-		}
-		// base.String() normalizes the base to the shortest code
-		// for the language
-		if base.String() != baseLang {
-			return false
-		}
-
-		for _, e := range parts[1:] {
-			prefixes, ok := iana_subtag_registry_extlangs[e]
-			if !ok {
-				return false
-			}
-
-			if len(prefixes) > 0 {
-				found := false
-				for _, p := range prefixes {
-					if strings.HasPrefix(lowerTagDash, p) {
-						found = true
-						break
-					}
-				}
-				if !found {
-					return false
-				}
-			}
-		}
-	// 2*3ALPHA            ; shortest ISO 639 code
-	case n <= 3:
-		base, err := language.ParseBase(lang)
-		if err != nil {
-			return false
-		}
-
-		// base.String() normalizes the base to the shortest code
-		// for the language
-		if base.String() != lang {
-			return false
-		}
-	// 4ALPHA              ; or reserved for future use
-	case n == 4:
-		return false
-	// 5*8ALPHA            ; or registered language subtag
-	default:
-		// registered language subtag with 5+ characters.
-		// As of today there aren't any.
-		// https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry
-		return false
-	}
-
-	// script        = 4ALPHA              ; ISO 15924 code
-	if script != "" {
-		_, err := language.ParseScript(script)
-		if err != nil {
-			return false
-		}
-	}
-
-	//  region        = 2ALPHA              ; ISO 3166-1 code
-	//                  3DIGIT              ; UN M.49 code
-	if region != "" {
-		if len(region) == 2 {
-			_, err := language.ParseRegion(region)
-			if err != nil {
-				return false
-			}
-		} else {
-			// Can't use language.ParseRegion() here because not all
-			// UN M.49 region codes are allowed, just the subset present
-			// in the IANA subtag registry.
-			_, ok := iana_subtag_registry_m49_codes[region]
-			if !ok {
-				return false
-			}
-		}
-	}
-
-	//  variant       = 5*8alphanum         ; registered variants
-	//                  / (DIGIT 3alphanum)
-	if variant != "" {
-		for v := range strings.SplitSeq(variant, "-") {
-			_, err := language.ParseVariant(v)
-			if err != nil {
-				return false
-			}
-
-			_, ok := iana_subtag_registry_variants[v]
-			if !ok {
-				return false
-			}
-		}
-	}
-
-	if extension != "" {
-		_, err := language.ParseExtension(extension)
-		if err != nil {
-			return false
-		}
-	}
-
-	return true
-}
-
 // isIsoBic2014Format is the validation function for validating if the current field's value is a valid Business Identifier Code (SWIFT code), defined in ISO 9362 2014
 func isIsoBic2014Format(fl FieldLevel) bool {
 	bicString := fl.Field().String()
@@ -3505,9 +3235,59 @@ func isEIN(fl FieldLevel) bool {
 	return einRegex().MatchString(field.String())
 }
 
+func isValidateFn(fl FieldLevel) bool {
+	const defaultParam = `Validate`
+
+	field := fl.Field()
+	validateFn := cmp.Or(fl.Param(), defaultParam)
+
+	ok, err := tryCallValidateFn(field, validateFn)
+	if err != nil {
+		return false
+	}
+
+	return ok
+}
+
 var (
 	errMethodNotFound          = errors.New(`method not found`)
 	errMethodReturnNoValues    = errors.New(`method return o values (void)`)
 	errMethodReturnInvalidType = errors.New(`method should return invalid type`)
 )
 
+func tryCallValidateFn(field reflect.Value, validateFn string) (bool, error) {
+	method := field.MethodByName(validateFn)
+	if field.CanAddr() && !method.IsValid() {
+		method = field.Addr().MethodByName(validateFn)
+	}
+
+	if !method.IsValid() {
+		return false, fmt.Errorf("unable to call %q on type %q: %w",
+			validateFn, field.Type().String(), errMethodNotFound)
+	}
+
+	returnValues := method.Call([]reflect.Value{})
+	if len(returnValues) == 0 {
+		return false, fmt.Errorf("unable to use result of method %q on type %q: %w",
+			validateFn, field.Type().String(), errMethodReturnNoValues)
+	}
+
+	firstReturnValue := returnValues[0]
+
+	switch firstReturnValue.Kind() {
+	case reflect.Bool:
+		return firstReturnValue.Bool(), nil
+	case reflect.Interface:
+		errorType := reflect.TypeOf((*error)(nil)).Elem()
+
+		if firstReturnValue.Type().Implements(errorType) {
+			return firstReturnValue.IsNil(), nil
+		}
+
+		return false, fmt.Errorf("unable to use result of method %q on type %q: %w (got interface %v expect error)",
+			validateFn, field.Type().String(), errMethodReturnInvalidType, firstReturnValue.Type().String())
+	default:
+		return false, fmt.Errorf("unable to use result of method %q on type %q: %w (got %v expect error or bool)",
+			validateFn, field.Type().String(), errMethodReturnInvalidType, firstReturnValue.Type().String())
+	}
+}

vendor/github.com/go-playground/validator/v10/cache.go

@@ -144,7 +144,7 @@ func (v *Validate) extractStructCache(current reflect.Value, sName string) *cStr
 
 		if v.hasTagNameFunc {
 			name := v.tagNameFunc(fld)
-			if len(name) > 0 || v.omitBlankFieldNames {
+			if len(name) > 0 {
 				customName = name
 			}
 		}

vendor/github.com/go-playground/validator/v10/country_codes.go

@@ -1175,15 +1175,3 @@ var iso3166_2 = map[string]struct{}{
 	"ZW-BU": {}, "ZW-HA": {}, "ZW-MA": {}, "ZW-MC": {}, "ZW-ME": {},
 	"ZW-MI": {}, "ZW-MN": {}, "ZW-MS": {}, "ZW-MV": {}, "ZW-MW": {},
 }
-
-// Subset of UN M.49 region codes present in the IANA Language Subtag Registry:
-// https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry
-var iana_subtag_registry_m49_codes = map[string]struct{}{
-	"001": {}, "002": {}, "003": {}, "005": {}, "009": {},
-	"011": {}, "013": {}, "014": {}, "015": {}, "017": {},
-	"018": {}, "019": {}, "021": {}, "029": {}, "030": {},
-	"034": {}, "035": {}, "039": {}, "053": {}, "054": {},
-	"057": {}, "061": {}, "142": {}, "143": {}, "145": {},
-	"150": {}, "151": {}, "154": {}, "155": {}, "202": {},
-	"419": {},
-}

vendor/github.com/go-playground/validator/v10/doc.go

@@ -184,12 +184,6 @@ so the above will become excludesall=0x7C
 		Field `validate:"excludesall=0x7C"` // GOOD! Use the UTF-8 hex representation.
 	}
 
-# Build tags
-
-The library provides a build tag for build size optimizations. If you are not using
-`validateFn` you can add the `validator_novalidatefn` build tag to enabled better dead
-code elimination. With this build tag, any usage of `validateFn` tags will panic.
-
 # Baked In Validators and Tags
 
 Here is a list of the current built in validators:
@@ -552,24 +546,6 @@ Works the same as oneof but is case insensitive and therefore only accepts strin
 	Usage: oneofci=red green
 	       oneofci='red green' 'blue yellow'
 
-# None Of
-
-For strings, ints, and uints, noneof will ensure that the value is not one of
-the values in the parameter. The parameter should be a list of values separated by whitespace.
-Values may be strings or numbers. To inversely match strings with spaces in them, include the target string between single quotes.
-Kind of like an 'enum'.
-
-	Usage: noneof=red green
-	       noneof='red green' 'blue yellow'
-		   noneof=5 7 9
-
-
-# None Of Case Insensitive
-Works the same as noneof but is case insensitive and therefore only accepts strings.
-
-	Usage: noneofci=red green
-	       noneofci='red green' 'blue yellow'
-
 # Greater Than
 
 For numbers, this will ensure that the value is greater than the
@@ -993,16 +969,6 @@ This is done using os.Stat and github.com/gabriel-vasile/mimetype
 
 	Usage: image
 
-# MIME type path
-
-This validates that a string value contains a valid file path and that
-the file exists on the machine and matches the provided MIME type in the
-form type/subtype or type/*.
-This is done using os.Stat and github.com/gabriel-vasile/mimetype
-
-	Usage: mimetype=image/png
-	Usage: mimetype=image/*
-
 # File Path
 
 This validates that a string value contains a valid file path but does not
@@ -1476,14 +1442,6 @@ More information on https://pkg.go.dev/golang.org/x/text/language
 
 	Usage: bcp47_language_tag
 
-# BCP 47 Strict Language Tag
-
-This validates that a string value is a valid BCP 47 language tag strictly following RFC 5646 rules,
-unlike language.Parse which also accepts Unicode extensions.
-see https://www.rfc-editor.org/rfc/bcp/bcp47.txt
-
-	Usage: bcp47_strict_language_tag
-
 BIC (SWIFT code - 2022 standard)
 
 This validates that a string value is a valid Business Identifier Code (SWIFT code), defined in ISO 9362:2022.

vendor/github.com/go-playground/validator/v10/language_codes.go

@@ -1,403 +0,0 @@
-package validator
-
-// Type: variant and their associated primary language prefixes from the
-// IANA Language Subtag Registry:
-// https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry
-var iana_subtag_registry_variants = map[string][]string{
-	"1606nict": {"frm"},
-	"1694acad": {"fr"},
-	"1901":     {"de"},
-	"1959acad": {"be"},
-	"1994":     {"sl-rozaj", "sl-rozaj-biske", "sl-rozaj-njiva", "sl-rozaj-osojs", "sl-rozaj-solba"},
-	"1996":     {"de"},
-	"abl1943":  {"pt-BR"},
-	"akhmimic": {"cop"},
-	"akuapem":  {"tw"},
-	"alalc97":  {},
-	"aluku":    {"djk"},
-	"anpezo":   {"lld"},
-	"ao1990":   {"pt", "gl"},
-	"aranes":   {"oc"},
-	"arevela":  {"hy"},
-	"arevmda":  {"hy"},
-	"arkaika":  {"eo"},
-	"asante":   {"tw"},
-	"auvern":   {"oc"},
-	"baku1926": {"az", "ba", "crh", "kk", "krc", "ky", "sah", "tk", "tt", "uz"},
-	"balanka":  {"blo"},
-	"barla":    {"kea"},
-	"basiceng": {"en"},
-	"bauddha":  {"sa"},
-	"bciav":    {"zbl"},
-	"bcizbl":   {"zbl"},
-	"biscayan": {"eu"},
-	"biske":    {"sl-rozaj"},
-	"blasl":    {"ase", "sgn-ase"},
-	"bohairic": {"cop"},
-	"bohoric":  {"sl"},
-	"boont":    {"en"},
-	"bornholm": {"da"},
-	"cisaup":   {"oc"},
-	"colb1945": {"pt"},
-	"cornu":    {"en"},
-	"creiss":   {"oc"},
-	"dajnko":   {"sl"},
-	"ekavsk":   {"sr", "sr-Latn", "sr-Cyrl"},
-	"emodeng":  {"en"},
-	"fascia":   {"lld"},
-	"fayyumic": {"cop"},
-	"fodom":    {"lld"},
-	"fonipa":   {},
-	"fonkirsh": {},
-	"fonnapa":  {},
-	"fonupa":   {},
-	"fonxsamp": {},
-	"gallo":    {"fr"},
-	"gascon":   {"oc"},
-	"gherd":    {"lld"},
-	"grclass":  {"oc", "oc-aranes", "oc-auvern", "oc-cisaup", "oc-creiss", "oc-gascon", "oc-lemosin", "oc-lengadoc", "oc-nicard", "oc-provenc", "oc-vivaraup"},
-	"grital":   {"oc", "oc-cisaup", "oc-nicard", "oc-provenc"},
-	"grmistr":  {"oc", "oc-aranes", "oc-auvern", "oc-cisaup", "oc-creiss", "oc-gascon", "oc-lemosin", "oc-lengadoc", "oc-nicard", "oc-provenc", "oc-vivaraup"},
-	"hanoi":    {"vi"},
-	"hepburn":  {"ja-Latn"},
-	"heploc":   {"ja-Latn-hepburn"},
-	"hognorsk": {"nn"},
-	"hsistemo": {"eo"},
-	"huett":    {"vi"},
-	"ijekavsk": {"sr", "sr-Latn", "sr-Cyrl"},
-	"itihasa":  {"sa"},
-	"ivanchov": {"bg"},
-	"jauer":    {"rm"},
-	"jyutping": {"yue"},
-	"kkcor":    {"kw"},
-	"kleinsch": {"kl", "kl-tunumiit"},
-	"kociewie": {"pl"},
-	"kscor":    {"kw"},
-	"laukika":  {"sa"},
-	"leidentr": {"egy"},
-	"lemosin":  {"oc"},
-	"lengadoc": {"oc"},
-	"lipaw":    {"sl-rozaj"},
-	"ltg1929":  {"ltg"},
-	"ltg2007":  {"ltg"},
-	"luna1918": {"ru"},
-	"lycopol":  {"cop"},
-	"mdcegyp":  {"egy"},
-	"mdctrans": {"egy"},
-	"mesokem":  {"cop"},
-	"metelko":  {"sl"},
-	"monoton":  {"el"},
-	"ndyuka":   {"djk"},
-	"nedis":    {"sl"},
-	"newfound": {"en-CA"},
-	"nicard":   {"oc"},
-	"njiva":    {"sl-rozaj"},
-	"nulik":    {"vo"},
-	"osojs":    {"sl-rozaj"},
-	"oxendict": {"en"},
-	"pahawh2":  {"mww", "hnj"},
-	"pahawh3":  {"mww", "hnj"},
-	"pahawh4":  {"mww", "hnj"},
-	"pamaka":   {"djk"},
-	"peano":    {"la"},
-	"pehoeji":  {"nan-Latn"},
-	"petr1708": {"ru"},
-	"pinyin":   {"zh-Latn", "bo-Latn"},
-	"polyton":  {"el"},
-	"provenc":  {"oc"},
-	"puter":    {"rm"},
-	"rigik":    {"vo"},
-	"rozaj":    {"sl"},
-	"rumgr":    {"rm"},
-	"sahidic":  {"cop"},
-	"saigon":   {"vi"},
-	"scotland": {"en"},
-	"scouse":   {"en"},
-	"simple":   {},
-	"solba":    {"sl-rozaj"},
-	"sotav":    {"kea"},
-	"spanglis": {"en", "es"},
-	"surmiran": {"rm"},
-	"sursilv":  {"rm"},
-	"sutsilv":  {"rm"},
-	"synnejyl": {"da"},
-	"tailo":    {"nan-Latn"},
-	"tarask":   {"be"},
-	"tongyong": {"zh-Latn"},
-	"tunumiit": {"kl"},
-	"uccor":    {"kw"},
-	"ucrcor":   {"kw"},
-	"ulster":   {"sco"},
-	"unifon":   {"en", "hup", "kyh", "tol", "yur"},
-	"vaidika":  {"sa"},
-	"valbadia": {"lld"},
-	"valencia": {"ca"},
-	"vallader": {"rm"},
-	"vecdruka": {"lv"},
-	"viennese": {"de"},
-	"vivaraup": {"oc"},
-	"wadegile": {"zh-Latn"},
-	"xsistemo": {"eo"},
-}
-
-// Type: extlang and their associated primary language prefixes from the
-// IANA Language Subtag Registry:
-// https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry
-var iana_subtag_registry_extlangs = map[string][]string{
-	"aao": {"ar"},
-	"abh": {"ar"},
-	"abv": {"ar"},
-	"acm": {"ar"},
-	"acq": {"ar"},
-	"acw": {"ar"},
-	"acx": {"ar"},
-	"acy": {"ar"},
-	"adf": {"ar"},
-	"ads": {"sgn"},
-	"aeb": {"ar"},
-	"aec": {"ar"},
-	"aed": {"sgn"},
-	"aen": {"sgn"},
-	"afb": {"ar"},
-	"afg": {"sgn"},
-	"ajp": {"ar"},
-	"ajs": {"sgn"},
-	"apc": {"ar"},
-	"apd": {"ar"},
-	"arb": {"ar"},
-	"arq": {"ar"},
-	"ars": {"ar"},
-	"ary": {"ar"},
-	"arz": {"ar"},
-	"ase": {"sgn"},
-	"asf": {"sgn"},
-	"asp": {"sgn"},
-	"asq": {"sgn"},
-	"asw": {"sgn"},
-	"auz": {"ar"},
-	"avl": {"ar"},
-	"ayh": {"ar"},
-	"ayl": {"ar"},
-	"ayn": {"ar"},
-	"ayp": {"ar"},
-	"bbz": {"ar"},
-	"bfi": {"sgn"},
-	"bfk": {"sgn"},
-	"bjn": {"ms"},
-	"bog": {"sgn"},
-	"bqn": {"sgn"},
-	"bqy": {"sgn"},
-	"btj": {"ms"},
-	"bve": {"ms"},
-	"bvl": {"sgn"},
-	"bvu": {"ms"},
-	"bzs": {"sgn"},
-	"cdo": {"zh"},
-	"cds": {"sgn"},
-	"cjy": {"zh"},
-	"cmn": {"zh"},
-	"cnp": {"zh"},
-	"coa": {"ms"},
-	"cpx": {"zh"},
-	"csc": {"sgn"},
-	"csd": {"sgn"},
-	"cse": {"sgn"},
-	"csf": {"sgn"},
-	"csg": {"sgn"},
-	"csl": {"sgn"},
-	"csn": {"sgn"},
-	"csp": {"zh"},
-	"csq": {"sgn"},
-	"csr": {"sgn"},
-	"csx": {"sgn"},
-	"czh": {"zh"},
-	"czo": {"zh"},
-	"doq": {"sgn"},
-	"dse": {"sgn"},
-	"dsl": {"sgn"},
-	"dsz": {"sgn"},
-	"dup": {"ms"},
-	"ecs": {"sgn"},
-	"ehs": {"sgn"},
-	"esl": {"sgn"},
-	"esn": {"sgn"},
-	"eso": {"sgn"},
-	"eth": {"sgn"},
-	"fcs": {"sgn"},
-	"fse": {"sgn"},
-	"fsl": {"sgn"},
-	"fss": {"sgn"},
-	"gan": {"zh"},
-	"gds": {"sgn"},
-	"gom": {"kok"},
-	"gse": {"sgn"},
-	"gsg": {"sgn"},
-	"gsm": {"sgn"},
-	"gss": {"sgn"},
-	"gus": {"sgn"},
-	"hab": {"sgn"},
-	"haf": {"sgn"},
-	"hak": {"zh"},
-	"hds": {"sgn"},
-	"hji": {"ms"},
-	"hks": {"sgn"},
-	"hnm": {"zh"},
-	"hos": {"sgn"},
-	"hps": {"sgn"},
-	"hsh": {"sgn"},
-	"hsl": {"sgn"},
-	"hsn": {"zh"},
-	"icl": {"sgn"},
-	"iks": {"sgn"},
-	"ils": {"sgn"},
-	"inl": {"sgn"},
-	"ins": {"sgn"},
-	"ise": {"sgn"},
-	"isg": {"sgn"},
-	"isr": {"sgn"},
-	"jak": {"ms"},
-	"jax": {"ms"},
-	"jcs": {"sgn"},
-	"jhs": {"sgn"},
-	"jks": {"sgn"},
-	"jls": {"sgn"},
-	"jos": {"sgn"},
-	"jsl": {"sgn"},
-	"jus": {"sgn"},
-	"kgi": {"sgn"},
-	"knn": {"kok"},
-	"kvb": {"ms"},
-	"kvk": {"sgn"},
-	"kvr": {"ms"},
-	"kxd": {"ms"},
-	"lbs": {"sgn"},
-	"lce": {"ms"},
-	"lcf": {"ms"},
-	"lgs": {"sgn"},
-	"liw": {"ms"},
-	"lls": {"sgn"},
-	"lsb": {"sgn"},
-	"lsc": {"sgn"},
-	"lsg": {"sgn"},
-	"lsl": {"sgn"},
-	"lsn": {"sgn"},
-	"lso": {"sgn"},
-	"lsp": {"sgn"},
-	"lst": {"sgn"},
-	"lsv": {"sgn"},
-	"lsw": {"sgn"},
-	"lsy": {"sgn"},
-	"ltg": {"lv"},
-	"luh": {"zh"},
-	"lvs": {"lv"},
-	"lws": {"sgn"},
-	"lzh": {"zh"},
-	"max": {"ms"},
-	"mdl": {"sgn"},
-	"meo": {"ms"},
-	"mfa": {"ms"},
-	"mfb": {"ms"},
-	"mfs": {"sgn"},
-	"min": {"ms"},
-	"mnp": {"zh"},
-	"mqg": {"ms"},
-	"mre": {"sgn"},
-	"msd": {"sgn"},
-	"msi": {"ms"},
-	"msr": {"sgn"},
-	"mui": {"ms"},
-	"mzc": {"sgn"},
-	"mzg": {"sgn"},
-	"mzy": {"sgn"},
-	"nan": {"zh"},
-	"nbs": {"sgn"},
-	"ncs": {"sgn"},
-	"nsi": {"sgn"},
-	"nsl": {"sgn"},
-	"nsp": {"sgn"},
-	"nsr": {"sgn"},
-	"nzs": {"sgn"},
-	"okl": {"sgn"},
-	"orn": {"ms"},
-	"ors": {"ms"},
-	"pel": {"ms"},
-	"pga": {"ar"},
-	"pgz": {"sgn"},
-	"pks": {"sgn"},
-	"prl": {"sgn"},
-	"prz": {"sgn"},
-	"psc": {"sgn"},
-	"psd": {"sgn"},
-	"pse": {"ms"},
-	"psg": {"sgn"},
-	"psl": {"sgn"},
-	"pso": {"sgn"},
-	"psp": {"sgn"},
-	"psr": {"sgn"},
-	"pys": {"sgn"},
-	"rib": {"sgn"},
-	"rms": {"sgn"},
-	"rnb": {"sgn"},
-	"rsi": {"sgn"},
-	"rsl": {"sgn"},
-	"rsm": {"sgn"},
-	"rsn": {"sgn"},
-	"sdl": {"sgn"},
-	"sfb": {"sgn"},
-	"sfs": {"sgn"},
-	"sgg": {"sgn"},
-	"sgx": {"sgn"},
-	"shu": {"ar"},
-	"sjc": {"zh"},
-	"slf": {"sgn"},
-	"sls": {"sgn"},
-	"sqk": {"sgn"},
-	"sqs": {"sgn"},
-	"sqx": {"sgn"},
-	"ssh": {"ar"},
-	"ssp": {"sgn"},
-	"ssr": {"sgn"},
-	"svk": {"sgn"},
-	"swc": {"sw"},
-	"swh": {"sw"},
-	"swl": {"sgn"},
-	"syy": {"sgn"},
-	"szs": {"sgn"},
-	"tmw": {"ms"},
-	"tse": {"sgn"},
-	"tsm": {"sgn"},
-	"tsq": {"sgn"},
-	"tss": {"sgn"},
-	"tsy": {"sgn"},
-	"tza": {"sgn"},
-	"ugn": {"sgn"},
-	"ugy": {"sgn"},
-	"ukl": {"sgn"},
-	"uks": {"sgn"},
-	"urk": {"ms"},
-	"uzn": {"uz"},
-	"uzs": {"uz"},
-	"vgt": {"sgn"},
-	"vkk": {"ms"},
-	"vkt": {"ms"},
-	"vsi": {"sgn"},
-	"vsl": {"sgn"},
-	"vsv": {"sgn"},
-	"wbs": {"sgn"},
-	"wuu": {"zh"},
-	"xki": {"sgn"},
-	"xml": {"sgn"},
-	"xmm": {"ms"},
-	"xms": {"sgn"},
-	"yds": {"sgn"},
-	"ygs": {"sgn"},
-	"yhs": {"sgn"},
-	"ysl": {"sgn"},
-	"ysm": {"sgn"},
-	"yue": {"zh"},
-	"zib": {"sgn"},
-	"zlm": {"ms"},
-	"zmi": {"ms"},
-	"zsl": {"sgn"},
-	"zsm": {"ms"},
-}

vendor/github.com/go-playground/validator/v10/no_validate_fn.go

@@ -1,60 +0,0 @@
-//go:build !validator_novalidatefn
-
-package validator
-
-import (
-	"cmp"
-	"fmt"
-	"reflect"
-)
-
-func isValidateFn(fl FieldLevel) bool {
-	const defaultParam = `Validate`
-
-	field := fl.Field()
-	validateFn := cmp.Or(fl.Param(), defaultParam)
-
-	ok, err := tryCallValidateFn(field, validateFn)
-	if err != nil {
-		return false
-	}
-
-	return ok
-}
-
-func tryCallValidateFn(field reflect.Value, validateFn string) (bool, error) {
-	method := field.MethodByName(validateFn)
-	if field.CanAddr() && !method.IsValid() {
-		method = field.Addr().MethodByName(validateFn)
-	}
-
-	if !method.IsValid() {
-		return false, fmt.Errorf("unable to call %q on type %q: %w",
-			validateFn, field.Type().String(), errMethodNotFound)
-	}
-
-	returnValues := method.Call([]reflect.Value{})
-	if len(returnValues) == 0 {
-		return false, fmt.Errorf("unable to use result of method %q on type %q: %w",
-			validateFn, field.Type().String(), errMethodReturnNoValues)
-	}
-
-	firstReturnValue := returnValues[0]
-
-	switch firstReturnValue.Kind() {
-	case reflect.Bool:
-		return firstReturnValue.Bool(), nil
-	case reflect.Interface:
-		errorType := reflect.TypeOf((*error)(nil)).Elem()
-
-		if firstReturnValue.Type().Implements(errorType) {
-			return firstReturnValue.IsNil(), nil
-		}
-
-		return false, fmt.Errorf("unable to use result of method %q on type %q: %w (got interface %v expect error)",
-			validateFn, field.Type().String(), errMethodReturnInvalidType, firstReturnValue.Type().String())
-	default:
-		return false, fmt.Errorf("unable to use result of method %q on type %q: %w (got %v expect error or bool)",
-			validateFn, field.Type().String(), errMethodReturnInvalidType, firstReturnValue.Type().String())
-	}
-}

vendor/github.com/go-playground/validator/v10/options.go

@@ -24,17 +24,3 @@ func WithPrivateFieldValidation() Option {
 		v.privateFieldValidation = true
 	}
 }
-
-// WithTagNameFuncBlankOmit makes a blank return from a RegisterTagNameFunc omit
-// the field from the error namespace instead of silently falling back to the
-// struct field name.
-//
-// This was made opt-in behaviour to maintain backward compatibility with
-// existing callers that rely on the fallback for error namespaces.
-//
-// It is recommended you enable this as it will be the default behaviour in v11+.
-func WithTagNameFuncBlankOmit() Option {
-	return func(v *Validate) {
-		v.omitBlankFieldNames = true
-	}
-}

vendor/github.com/go-playground/validator/v10/regexes.go

@@ -33,7 +33,7 @@ const (
 	uUID3RegexString                 = "^[0-9a-f]{8}-[0-9a-f]{4}-3[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}$"
 	uUID4RegexString                 = "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
 	uUID5RegexString                 = "^[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
-	uUIDRegexString                  = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+	uUIDRegexString                  = "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
 	uUID3RFC4122RegexString          = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-3[0-9a-fA-F]{3}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
 	uUID4RFC4122RegexString          = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
 	uUID5RFC4122RegexString          = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-5[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
@@ -56,12 +56,12 @@ const (
 	latitudeRegexString              = "^[-+]?([1-8]?\\d(\\.\\d+)?|90(\\.0+)?)$"
 	longitudeRegexString             = "^[-+]?(180(\\.0+)?|((1[0-7]\\d)|([1-9]?\\d))(\\.\\d+)?)$"
 	sSNRegexString                   = `^[0-9]{3}[ -]?(0[1-9]|[1-9][0-9])[ -]?([1-9][0-9]{3}|[0-9][1-9][0-9]{2}|[0-9]{2}[1-9][0-9]|[0-9]{3}[1-9])$`
-	hostnameRegexStringRFC952        = `^[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$`                     // https://tools.ietf.org/html/rfc952
-	hostnameRegexStringRFC1123       = `^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$`                  // accepts hostname starting with a digit https://tools.ietf.org/html/rfc1123
+	hostnameRegexStringRFC952        = `^[a-zA-Z]([a-zA-Z0-9\-]+[\.]?)*[a-zA-Z0-9]$`                                                                   // https://tools.ietf.org/html/rfc952
+	hostnameRegexStringRFC1123       = `^([a-zA-Z0-9]{1}[a-zA-Z0-9-]{0,62}){1}(\.[a-zA-Z0-9]{1}[a-zA-Z0-9-]{0,62})*?$`                                 // accepts hostname starting with a digit https://tools.ietf.org/html/rfc1123
 	fqdnRegexStringRFC1123           = `^([a-zA-Z0-9]{1}[a-zA-Z0-9-]{0,62})(\.[a-zA-Z0-9]{1}[a-zA-Z0-9-]{0,62})*?(\.[a-zA-Z]{1}[a-zA-Z0-9-]{0,62})\.?$` // same as hostnameRegexStringRFC1123 but must contain a non numerical TLD (possibly ending with '.')
-	btcAddressRegexString            = `^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$`                                                                              // bitcoin address
-	btcAddressUpperRegexStringBech32 = `^BC1[02-9AC-HJ-NP-Z]{7,76}$`                                                                                    // bitcoin bech32 address https://en.bitcoin.it/wiki/Bech32
-	btcAddressLowerRegexStringBech32 = `^bc1[02-9ac-hj-np-z]{7,76}$`                                                                                    // bitcoin bech32 address https://en.bitcoin.it/wiki/Bech32
+	btcAddressRegexString            = `^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$`                                                                             // bitcoin address
+	btcAddressUpperRegexStringBech32 = `^BC1[02-9AC-HJ-NP-Z]{7,76}$`                                                                                   // bitcoin bech32 address https://en.bitcoin.it/wiki/Bech32
+	btcAddressLowerRegexStringBech32 = `^bc1[02-9ac-hj-np-z]{7,76}$`                                                                                   // bitcoin bech32 address https://en.bitcoin.it/wiki/Bech32
 	ethAddressRegexString            = `^0x[0-9a-fA-F]{40}$`
 	ethAddressUpperRegexString       = `^0x[0-9A-F]{40}$`
 	ethAddressLowerRegexString       = `^0x[0-9a-f]{40}$`
@@ -77,7 +77,7 @@ const (
 	cveRegexString                   = `^CVE-(1999|2\d{3})-(0[^0]\d{2}|0\d[^0]\d{1}|0\d{2}[^0]|[1-9]{1}\d{3,})$` // CVE Format Id https://cve.mitre.org/cve/identifiers/syntaxchange.html
 	mongodbIdRegexString             = "^[a-f\\d]{24}$"
 	mongodbConnStringRegexString     = "^mongodb(\\+srv)?:\\/\\/(([a-zA-Z\\d]+):([a-zA-Z\\d$:\\/?#\\[\\]@]+)@)?(([a-z\\d.-]+)(:[\\d]+)?)((,(([a-z\\d.-]+)(:(\\d+))?))*)?(\\/[a-zA-Z-_]{1,64})?(\\?(([a-zA-Z]+)=([a-zA-Z\\d]+))(&(([a-zA-Z\\d]+)=([a-zA-Z\\d]+))?)*)?$"
-	cronRegexString                  = `^((@(annually|yearly|monthly|weekly|daily|hourly|reboot))|(@every (\d+(ns|us|µs|ms|s|m|h))+)|(([A-Za-z0-9*?][A-Za-z0-9*?/,#L-]+|[*?0-9])( +([A-Za-z0-9*?][A-Za-z0-9*?/,#L-]+|[*?0-9])){4,6}))$`
+	cronRegexString                  = `(@(annually|yearly|monthly|weekly|daily|hourly|reboot))|(@every (\d+(ns|us|µs|ms|s|m|h))+)|((((\d+,)+\d+|((\*|\d+)(\/|-)\d+)|\d+|\*) ?){5,7})`
 	spicedbIDRegexString             = `^(([a-zA-Z0-9/_|\-=+]{1,})|\*)$`
 	spicedbPermissionRegexString     = "^([a-z][a-z0-9_]{1,62}[a-z0-9])?$"
 	spicedbTypeRegexString           = "^([a-z][a-z0-9_]{1,61}[a-z0-9]/)?[a-z][a-z0-9_]{1,62}[a-z0-9]$"