140cbb440e
chore(test): fix deprecated call or syntax
2026-06-13 19:01:40 +02:00
595273277b
test(e2e): webdav + nextcloud full e2e test coverage
...
add a full coverage of Webdav and Nextcloud
purpose: prepare move to Drives and ensure no regression at all
test scenarios are in docs/plan/BASELINE_TESTS_NC_WEBDAV.md
current existing bugs identified via these tests:
┌──────────┬─────────┬────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Bug │ Surface │ Pin location │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ G4/G5/K5 │ NC │ AlreadyExists → 500 instead of 412 (handle_move + trashbin restore) │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ G9 │ NC │ Folder DELETE not row-recursive — orphan descendants stay live │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ M5/M7 │ Native │ resolve_path_for_user mismatch — PUT writes, GET reads via lenient lookup, MOVE/DELETE can't find │
│ │ │ via strict │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ M8 │ Native │ COPY discards destination filename — collides with source │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ N2 │ Native │ LOCK creates the token, mutators don't check it — class-2 advertisement is aspirational │
└──────────┴─────────┴────────────────────────────────────────────────────────────────────────────────────────────────────┘
2026-06-13 19:01:40 +02:00
50ea406719
feat(OXICLOUD_DIRECT_PUT_MAX_BYTES): add a security limit on direct PUT
...
ensure files does not exeed OXICLOUD_MAX_UPLOAD_SIZE, prefer to deny from header rather consuming bandwidth
add OXICLOUD_DIRECT_PUT_MAX_BYTES for direct PUT (non chunked), admins can fine tune their prefered values
2026-06-09 11:06:44 +02:00
5e638691ad
security(upload): cap upload size to prevent memody/disk consumption
...
add OXICLOUD_CHUNK_MAX_BYTES which correspond to the max upload chunk allowed
(differs from OXICLOUD_MAX_UPLOAD_SIZE which is the max total size of a file)
hurl test validate the change
Streams the request body straight to the chunk file with peak heap of
~one HTTP frame, regardless of chunk size or the configured cap. The
`storage.chunk_max_bytes` config (env `OXICLOUD_CHUNK_MAX_BYTES`,
default 100 MB) bounds a single PUT — separate from `max_upload_size`
which governs whole-file uploads. Without this separation, a client
could submit a chunk up to the whole-file cap (10 GB default) and
monopolise server memory.
2026-06-09 09:26:33 +02:00
a3a8fdbf12
test: activate nextcloud on tests
2026-06-07 21:40:22 +02:00
00af0e8a89
feat(registraton): add anti enumeration (cannot know if an account already exists)
...
Important: anti-enumeration is active only if SMTP is defined, welcome email can be used
otherwise it is a classic registration with ok or conflic if account alrady exists
2026-06-03 00:35:25 +02:00
feaa066303
test(integration-test): fix issue with server start
2026-06-03 00:32:00 +02:00
6d70a7000e
security(external_user): protect unnecessary route access to external users
2026-06-03 00:32:00 +02:00
21c06da700
feat(magic-links): add rate limiting + archirecture documentation
2026-06-03 00:32:00 +02:00
03f63ad103
feat(external users): email sanity + mock SMTP
...
- SMTP has a mock to enable end to end test and validate the whole path
(via OXICLOUD_SMTP_MOCK)
- add email normalisation ( including punicode)
- api to share to external user
2026-06-03 00:31:59 +02:00
d2dedcbb00
fix(integration-test): ensure integration tests are runned on a separate DB to avoid polution
2026-05-31 23:53:40 +02:00
ea83891a61
feat(trash): move trash API to normalized version (with cursor, orderBy) + normalize Trash section to existing components
...
normalize also component to format badges (expiry, role, etc)
2026-05-30 00:49:32 +02:00
3362e277ab
feat(authz): check permission on read handlers + check create permission on folder
2026-05-21 20:30:53 +02:00
872abd4d27
test: add front end folder management test (creation, renaming, etc)
...
note: firefox test remove due to idempotence issue
2026-05-19 13:31:20 +02:00
78cb37b311
feat: check thumbnail cleanup on files deletion + correct ref counter
2026-05-13 15:55:38 +02:00
cc14ec53ee
ci(api-tests): add API test to CI
2026-05-11 10:53:59 +02:00
8ab537797a
test(api): add API test on contacts
...
next will be to add CI on it
2026-05-11 00:53:29 +02:00
Edouard Vanbelle