feat: Implement IGlobalScaleService

lib/AppInfo/Application.php

@@ -19,7 +19,9 @@
 use OCA\GlobalSiteSelector\Listeners\UserDeleted;
 use OCA\GlobalSiteSelector\Listeners\UserLoggedOut;
 use OCA\GlobalSiteSelector\Listeners\UserLoggingIn;
+use OCA\GlobalSiteSelector\Master;
 use OCA\GlobalSiteSelector\PublicCapabilities;
+use OCA\GlobalSiteSelector\Service\GlobalScaleService;
 use OCA\GlobalSiteSelector\SetupChecks\LongJwtKeySetupCheck;
 use OCA\GlobalSiteSelector\Slave;
 use OCA\GlobalSiteSelector\UserBackend;
@@ -28,16 +30,17 @@
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\GlobalScale\IGlobalScaleService;
 use OCP\IRequest;
 use OCP\IUserManager;
 use OCP\IUserSession;
 use OCP\Security\CSP\AddContentSecurityPolicyEvent;
 use OCP\Server;
 use OCP\User\Events\BeforeUserDeletedEvent;
-use OCP\User\Events\BeforeUserLoggedInEvent;
 use OCP\User\Events\UserChangedEvent;
 use OCP\User\Events\UserCreatedEvent;
 use OCP\User\Events\UserDeletedEvent;
+use OCP\User\Events\UserLoggedInEvent;
 use OCP\User\Events\UserLoggedOutEvent;
 use Psr\Container\ContainerExceptionInterface;
 use Psr\Container\NotFoundExceptionInterface;
@@ -65,7 +68,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerCapability(PublicCapabilities::class);
 
 		// events on master
-		$context->registerEventListener(BeforeUserLoggedInEvent::class, UserLoggingIn::class);
+		$context->registerEventListener(UserLoggedInEvent::class, UserLoggingIn::class);
 		$context->registerEventListener(
 			AddContentSecurityPolicyEvent::class,
 			AddContentSecurityPolicyListener::class
@@ -80,6 +83,13 @@ public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(UserUpdatedEvent::class, UserChanged::class);
 
 		$context->registerSetupCheck(LongJwtKeySetupCheck::class);
+
+		// registerGlobalScaleService() and IGlobalScaleService only exist since Nextcloud
+		// 34.0.3, but this app still supports 32 and 33, see lib/Service/GlobalScaleService.php
+		if (interface_exists(IGlobalScaleService::class)) {
+			/** @psalm-suppress UndefinedInterfaceMethod */
+			$context->registerGlobalScaleService(GlobalScaleService::class);
+		}
 	}
 
 	/**
@@ -92,6 +102,7 @@ public function boot(IBootContext $context): void {
 
 		$context->injectFn(\Closure::fromCallable($this->registerUserBackendForSlave(...)));
 		$context->injectFn(\Closure::fromCallable($this->redirectToMasterLogin(...)));
+		$context->injectFn(\Closure::fromCallable($this->redirectToSlave(...)));
 	}
 
 	/**
@@ -179,4 +190,35 @@ private function redirectToMasterLogin(): void {
 			);
 		}
 	}
+
+	private function redirectToSlave(IRequest $request, Master $master, IUserSession $userSession): void {
+		/** only used in master mode */
+		if (!$this->globalSiteSelector->isMaster()) {
+			return;
+		}
+
+		if (!$userSession->isLoggedIn()) {
+			return;
+		}
+
+		// We should ignore oauth2 token endpoint (oauth can send the credentials as basic auth which will fail with apache auth)
+		$uri = $request->getPathInfo();
+		if (str_starts_with($uri, '/apps/oauth/api/v1/token') || str_starts_with($uri, '/apps/oauth2/authorize') || str_starts_with($uri, '/login/flow')) {
+			return;
+		}
+
+		$user = $userSession->getUser();
+		if ($user === null) {
+			return;
+		}
+
+		$this->logger->debug('new redirectToSlave');
+		$master->handleLoginRequest(
+			$user,
+			'',
+			true,
+		);
+
+		$this->logger->debug('ending redirectToSlave');
+	}
 }

lib/ConfigLexicon.php

@@ -18,6 +18,7 @@ class ConfigLexicon implements ILexicon {
 	public const GS_TOKENS = 'globalScaleTokens';
 	public const LOCAL_TOKEN = 'localToken';
 	public const REDIRECT_WEBDAV = 'redirectWebDAV';
+	public const SSO_USER_DATA = 'ssoUserData';
 
 	#[\Override]
 	public function getStrictness(): Strictness {
@@ -42,6 +43,7 @@ public function getAppConfigs(): array {
 	#[\Override]
 	public function getUserConfigs(): array {
 		return [
+			new Entry(key: self::SSO_USER_DATA, type: ValueType::ARRAY, defaultRaw: [], definition: 'formatted SAML/OIDC identity data, cached from the last login with an active SSO session', lazy: true),
 		];
 	}
 }

lib/Exceptions/IsLocalAdminException.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2025 Nextcloud GmbH
+ * SPDX-FileContributor: Carl Schwan
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\GlobalSiteSelector\Exceptions;
+
+class IsLocalAdminException extends \Exception {
+}

lib/Listeners/UserLoggingIn.php

@@ -13,24 +13,26 @@
 use OCA\GlobalSiteSelector\Master;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
-use OCP\User\Events\BeforeUserLoggedInEvent;
+use OCP\IRequest;
+use OCP\User\Events\UserLoggedInEvent;
 use Psr\Log\LoggerInterface;
 
 /**
- * @template-implements IEventListener<BeforeUserLoggedInEvent>
+ * @template-implements IEventListener<UserLoggedInEvent>
  */
 class UserLoggingIn implements IEventListener {
 
 	public function __construct(
 		private readonly GlobalSiteSelector $globalSiteSelector,
 		private readonly Master $master,
 		private readonly LoggerInterface $logger,
+		private readonly IRequest $request,
 	) {
 	}
 
 	#[\Override]
 	public function handle(Event $event): void {
-		if (!$event instanceof BeforeUserLoggedInEvent) {
+		if (!$event instanceof UserLoggedInEvent) {
 			return;
 		}
 
@@ -39,11 +41,15 @@ public function handle(Event $event): void {
 			return;
 		}
 
+		$uri = $this->request->getRequestUri();
+		if (str_ends_with($uri, '/apps/oauth/api/v1/token')) {
+			return;
+		}
+
 		$this->logger->debug('new BeforeUserLoggedInEvent event');
 		$this->master->handleLoginRequest(
-			$event->getUsername(),
+			$event->getUser(),
 			$event->getPassword(),
-			$event->getBackend()
 		);
 
 		$this->logger->debug('ending BeforeUserLoggedInEvent event');