Research > Collabora: backend part for insert images from cloud (timeboxed 4pd)

[db-ot]

Description

Initial Checklist

• I understand this is a user story and questions should be posted in the Community Discussions
• I searched issues and couldn’t find anything (or linked relevant results below)

User Story

As a backend system, I want to expose an authenticated API that can be accessed from the Collabora frontend,
so that users can browse and insert images from OC - while researching how PROPFIND requests are used for resource discovery, since this mechanism is not yet fully understood.

Acceptance Criteria

• Investigate how PROPFIND requests are constructed and used in the Collabora frontend.
• Explore how to expose an authenticated API endpoint for image browsing and insertion.
• Evaluate how to generate and return a presigned download URL for image access.

Note ( @kulmann ): the web ui does everything on its own regarding image selection for the user. We have a wrapper around the collabora iframe. The collabora iframe only sends a trigger to the wrapper that it wants to insert an image. The wrapper can respond async with an image URL. For this, web only needs a presigned url / url that can be used without auth headers for the image selected by the user. -> downloadURL prop in all authenticated webdav propfinds would be a nice solution. Needs research if this can be added without a serious performance drop.

Definition of ready

• Everybody needs to understand the value written in the user story
• Acceptance criteria have to be defined
• All dependencies of the user story need to be identified
• Feature should be seen from an end user perspective
• Story has to be estimated
• Story points need to be less than 20

Definition of done

• Functional requirements
  • Functionality described in the user story works
  • Acceptance criteria are fulfilled
• Quality
  • Code review happened
  • CI is green (that includes new and existing automated tests)
  • Critical code received unit tests by the developer
• Non-functional requirements
  • No sonar cloud issues
• Configuration changes
  • The next branch of the OpenCloud charts is compatible

[rhafer]

@kulmann Could you clarify what exactly is needed here? IIUC the whole PostMessage thing (UI_InsertGraphic / Action_InsertGraphics) is happening client side between the OpenCloud Web UI and the Collabora UI.

I guess you mainly need some way to get an authenticated download URL for a specific fileid, after a file was selected in the file picker, that you can pass in the Action_InsertGraphic response, right?

[kulmann]

Action_InsertGraphics needs a URL to a file that doesn't need auth headers i.e. works without additional authentication. Presigned URLs would work for that. Would be nice to have the downloadURL webdav prop available for authenticated propfinds, like we have it always available for propfinds in public links.

[kulmann]

Is it still accurate that the story title makes this a timeboxed research? Or is the story actionable with my additions? If actionable: are the 2 storypoints still accurate?

[rhafer]

While working on this I looked into our existing solutions for similar problems and it seems nowadays there are at least three different ways of how we generated temporary download URLs for files in opencloud:

• The public-share service is able to generated a signature for password-protected links. The key used for the signature is deriving from the public-link password. And the signature is just signing the public-link token and an expiration timestamp (the expiration is hard coded to 30min). This is signature is used for the oc:downloadLink property. Also web seems to uses the same signature for constructing the requests to the thumbnailer when getting previews for password protect public link item (this works because the signature is not for the full URL but just for limited parts)

  The verification of that signature is done type the publicshares reva auth-manager (current used in the proxy, thumbnails and the ocdav services

• In order for being able to download uploaded files before they're transfered to the final storage location a sign urls is generated and add the BytesReceived event. This is used e.g. by the virus scanner to download files from the upload area. (verification of these signed urls happens in the datagateway)

• For being able to download "normal" files a signed url is constructed on the client side. The signing-key is requested via the /ocs/v[12].php/cloud/user/signing-key endpoint which returns a key valid for the requesting user, the keys do not see to have any expiry 🤨) .

  The verification of that signature is done in the signed_url_auth middleware in the proxy service.

We should get rid off at least the last mechanism (the client side signed urls). Generating a signed url on the server side and adding that to the oc:downloadURL property would allow us to have a reusable mechnism for the "insert opencloud image into office file" requested in this ticket use case as well as for the "normal download" from the webclient.