feat: implement remote attachment creation

Signed-off-by: Luka Trovic <luka@nextcloud.com>

Author: luka-nextcloud

appinfo/routes.php

@@ -169,6 +169,7 @@
 
 		['name' => 'attachment_ocs#getAll', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments', 'verb' => 'GET'],
 		['name' => 'attachment_ocs#create', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachment', 'verb' => 'POST'],
+		['name' => 'attachment_ocs#acceptRemote', 'url' => '/api/v{apiVersion}/cards/{cardId}/remote-attachment', 'verb' => 'POST'],
 		['name' => 'attachment_ocs#update', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}', 'verb' => 'PUT'],
 		['name' => 'attachment_ocs#delete', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{type}:{attachmentId}', 'verb' => 'DELETE'],
 		['name' => 'attachment_ocs#restore', 'url' => '/api/v{apiVersion}/cards/{cardId}/attachments/{attachmentId}/restore', 'verb' => 'PUT'],

lib/Controller/AttachmentOcsController.php

@@ -12,7 +12,9 @@
 use OCA\Deck\NotImplementedException;
 use OCA\Deck\Service\AttachmentService;
 use OCA\Deck\Service\BoardService;
+use OCA\Deck\Service\ExternalBoardService;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\IRequest;
@@ -23,6 +25,7 @@ public function __construct(
 		IRequest $request,
 		private AttachmentService $attachmentService,
 		private BoardService $boardService,
+		private ExternalBoardService $externalBoardService,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -37,19 +40,33 @@ private function ensureLocalBoard(?int $boardId): void {
 	}
 
 	#[NoAdminRequired]
+	#[PublicPage]
 	public function getAll(int $cardId, ?int $boardId = null): DataResponse {
-		$this->ensureLocalBoard($boardId);
+		$board = $this->boardService->find($boardId, false);
+		if ($board->getExternalId()) {
+			return new DataResponse($this->externalBoardService->getAttachmentsFromRemote($board, $cardId));
+		}
 		$attachment = $this->attachmentService->findAll($cardId, true);
 		return new DataResponse($attachment);
 	}
 
 	#[NoAdminRequired]
 	public function create(int $cardId, string $type, string $data = '', ?int $boardId = null): DataResponse {
-		$this->ensureLocalBoard($boardId);
+		$board = $this->boardService->find($boardId, false);
+		if ($board->getExternalId()) {
+			return new DataResponse($this->externalBoardService->createAttachmentForRemote($board, $cardId));
+		}
 		$attachment = $this->attachmentService->create($cardId, $type, $data);
 		return new DataResponse($attachment);
 	}
 
+	#[NoAdminRequired]
+	#[PublicPage]
+	public function acceptRemote(int $cardId, string $token): DataResponse {
+		$this->attachmentService->acceptRemoteAttachment($cardId, $token);
+		return new DataResponse([]);
+	}
+
 	#[NoAdminRequired]
 	public function update(int $cardId, int $attachmentId, string $data, string $type = 'file', ?int $boardId = null): DataResponse {
 		$this->ensureLocalBoard($boardId);

lib/Service/AttachmentService.php

@@ -11,6 +11,7 @@
 use OCA\Deck\AppInfo\Application;
 use OCA\Deck\BadRequestException;
 use OCA\Deck\Cache\AttachmentCacheHelper;
+use OCA\Deck\Cron\ScanFederatedAttachment;
 use OCA\Deck\Db\Acl;
 use OCA\Deck\Db\Attachment;
 use OCA\Deck\Db\AttachmentMapper;
@@ -19,10 +20,13 @@
 use OCA\Deck\InvalidAttachmentType;
 use OCA\Deck\NoPermissionException;
 use OCA\Deck\NotFoundException;
+use OCA\Deck\Sharing\DeckShareProvider;
 use OCA\Deck\StatusException;
 use OCA\Deck\Validators\AttachmentServiceValidator;
 use OCP\AppFramework\Db\IMapperException;
 use OCP\AppFramework\Http\Response;
+use OCP\BackgroundJob\IJobList;
+use OCP\Federation\ICloudIdManager;
 use OCP\IL10N;
 use OCP\IUserManager;
 use Psr\Container\ContainerExceptionInterface;
@@ -44,6 +48,9 @@ public function __construct(
 		private readonly IL10N $l10n,
 		private readonly ActivityManager $activityManager,
 		private readonly AttachmentServiceValidator $attachmentServiceValidator,
+		private readonly DeckShareProvider $deckShareProvider,
+		private readonly ICloudIdManager $cloudIdManager,
+		private readonly IJobList $jobList,
 	) {
 		// Register shipped attachment services
 		// TODO: move this to a plugin based approach once we have different types of attachments
@@ -205,6 +212,21 @@ public function create(int $cardId, string $type, string $data = '') {
 		return $attachment;
 	}
 
+	public function acceptRemoteAttachment(int $cardId, string $token): void {
+		$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
+
+		$userId = $this->permissionService->getUserId();
+		if (!$this->cloudIdManager->isValidCloudId($userId)) {
+			throw new NoPermissionException('Only federated user is allowed');
+		}
+
+		$externalShare = $this->deckShareProvider->ensureAcceptRemoteShare($token, $this->cloudIdManager->resolveCloudId($userId)->getRemote());
+		$this->jobList->add(ScanFederatedAttachment::class, [
+			'cardId' => $cardId,
+			'shareId' => $externalShare->getId(),
+		]);
+	}
+
 	/**
 	 * Apply import side effects to keep attachment behavior consistent with regular create flow.
 	 */

lib/Service/ExternalBoardService.php

@@ -32,6 +32,7 @@ public function __construct(
 		private BoardMapper $boardMapper,
 		private IURLGenerator $urlGenerator,
 		private DeckShareProvider $deckShareProvider,
+		private FilesAppService $filesAppService,
 		private ?string $userId,
 	) {
 	}
@@ -600,7 +601,7 @@ public function localizeRemoteAttachments(Board $localBoard, array $attachments)
 				$attachments[$i]['extendedData']['attachmentCreator']['displayName'] = $createdByUser->getCloudId()->getId();
 			}
 			if (!empty($attachment['extendedData']['shareToken'])) {
-				$file = $this->deckShareProvider->ensureAcceptRemoteShare($attachment['extendedData']['shareToken'], $ownerCloudId->getRemote());
+				$file = $this->deckShareProvider->getRemoteFile($attachment['extendedData']['shareToken'], $ownerCloudId->getRemote());
 
 				if (empty($file)) {
 					unset($attachments[$i]);
@@ -627,44 +628,22 @@ public function getAttachmentsFromRemote(Board $localBoard, int $cardId): array
 		return $this->localizeRemoteAttachments($localBoard, $attachments);
 	}
 
-	public function createAttachmentOnRemote(Board $localBoard, int $cardId, string $type, string $data = '', ?array $uploadedFile = null): array {
+	public function createAttachmentForRemote(Board $localBoard, int $cardId): array {
 		$this->configService->ensureFederationEnabled();
 		$this->permissionService->checkPermission($this->boardMapper, $localBoard->getId(), Acl::PERMISSION_EDIT, $this->userId, false, false);
 		$shareToken = $localBoard->getShareToken();
 		$participantCloudId = $this->cloudIdManager->getCloudId($this->userId, null);
 		$ownerCloudId = $this->cloudIdManager->resolveCloudId($localBoard->getOwner());
-		$url = $ownerCloudId->getRemote() . '/ocs/v2.php/apps/deck/api/v1.0/cards/' . $cardId . '/attachment';
-		if ($uploadedFile !== null) {
-			$content = fopen($uploadedFile['tmp_name'], 'rb');
-			if ($content === false) {
-				throw new Exception('Could not read uploaded file');
-			}
-			$params = [
-				[
-					'name' => 'boardId',
-					'contents' => (string)$localBoard->getExternalId(),
-				],
-				[
-					'name' => 'file',
-					'contents' => $content,
-					'filename' => $uploadedFile['name'],
-				],
-				[
-					'name' => 'type',
-					'contents' => $type,
-				],
-				[
-					'name' => 'data',
-					'contents' => $data,
-				],
-			];
-			$resp = $this->proxy->post($participantCloudId->getId(), $shareToken, $url, ['multipart' => $params]);
-			return $this->proxy->getOcsData($resp);
-		}
+
+		// Upload and create remote share
+		$shareWithFederatedId = $ownerCloudId->getId();
+		$fileShareToken = $this->filesAppService->createForRemote($shareWithFederatedId);
+
+		$url = $ownerCloudId->getRemote() . '/ocs/v2.php/apps/deck/api/v1.0/cards/' . $cardId . '/remote-attachment';
 		$resp = $this->proxy->post($participantCloudId->getId(), $shareToken, $url, [
 			'boardId' => $localBoard->getExternalId(),
-			'type' => $type,
-			'data' => $data,
+			'cardId' => $cardId,
+			'token' => $fileShareToken,
 		]);
 		return $this->proxy->getOcsData($resp);
 	}

lib/Service/FilesAppService.php

@@ -302,27 +302,53 @@ public function create(Attachment $attachment) {
 		$share->setSharedBy($this->userId);
 		$share = $this->shareManager->createShare($share);
 
-		// Create share for federated users
-		$boardId = $this->cardMapper->findBoardId($attachment->getCardId());
-		foreach ($this->permissionService->findUsers($boardId) as $user) {
-			if (!$user instanceof FederatedUser) {
-				continue;
-			}
-			$remoteShare = $this->shareManager->newShare();
-			$remoteShare->setParent((int)$share->getId());
-			$remoteShare->setNode($target);
-			$remoteShare->setShareType(ISHARE::TYPE_REMOTE);
-			$remoteShare->setSharedWith($user->getUID());
-			$remoteShare->setPermissions(Constants::PERMISSION_READ);
-			$remoteShare->setSharedBy($this->userId);
-			$this->shareManager->createShare($remoteShare);
-		}
-
 		$attachment->setId((int)$share->getId());
 		$attachment->setData($target->getName());
 		return $attachment;
 	}
 
+	public function createForRemote(string $federatedCloudId) {
+		$file = $this->getUploadedFile();
+		$fileName = $file['name'];
+		$this->validateFilename($fileName);
+
+		$userFolder = $this->rootFolder->getUserFolder($this->userId);
+		try {
+			$folder = $userFolder->get($this->configService->getAttachmentFolder());
+		} catch (NotFoundException) {
+			$folder = $userFolder->newFolder($this->configService->getAttachmentFolder());
+		}
+
+		if ($folder->isShared()) {
+			$folderName = $userFolder->getNonExistingName($this->configService->getAttachmentFolder());
+			$folder = $userFolder->newFolder($folderName);
+			$this->configService->setAttachmentFolder($this->userId, $folderName);
+		}
+
+		if (!$folder instanceof Folder || $folder->isShared()) {
+			throw new NotFoundException('No target folder found');
+		}
+
+		$fileName = $folder->getNonExistingName($fileName);
+		$target = $folder->newFile($fileName);
+		$content = fopen($file['tmp_name'], 'rb');
+		if ($content === false) {
+			throw new StatusException('Could not read file');
+		}
+		$target->putContent($content);
+
+		$share = $this->shareManager->newShare();
+		$share->setNode($target);
+		$share->setShareType(IShare::TYPE_REMOTE);
+		$share->setSharedWith($federatedCloudId);
+		$share->setPermissions(Constants::PERMISSION_READ);
+		$share->setSharedBy($this->userId);
+		$share->setShareOwner($this->userId);
+
+		$createdShare = $this->shareManager->createShare($share);
+		return $createdShare->getToken();
+	}
+
 	/**
 	 * Ensure the file exists in the owner’s Deck attachment folder, link it to the
 	 * Reuse file/share when already present