UPSTREAM BASELINE: nextcloud/spreed v22.0.12 (без изменений)

Источник: https://github.com/nextcloud/spreed/archive/refs/tags/v22.0.12.tar.gz
С этого коммита ветка официального Nextcloud Talk отрезана (решение владельца 2026-07-06).
Все дальнейшие изменения — только наши; версии релизов: 22.0.12-f7.N.

lib/Middleware/Attribute/AllowWithoutParticipantWhenPendingInvitation.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getRoomByInvite()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class AllowWithoutParticipantWhenPendingInvitation extends RequireRoom {
+}

lib/Middleware/Attribute/FederationSupported.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getRoom()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class FederationSupported {
+}

lib/Middleware/Attribute/RequireAuthenticatedParticipant.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * Allows logged-in users and federated participants
+ * @see InjectionMiddleware::getLoggedIn()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireAuthenticatedParticipant extends RequireParticipant {
+}

lib/Middleware/Attribute/RequireCallEnabled.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\CanUseTalkMiddleware;
+
+/**
+ * Attribute to check limit endpoint access when the app config start_calls is not enabled
+ * @see CanUseTalkMiddleware::beforeController()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireCallEnabled {
+}

lib/Middleware/Attribute/RequireFederatedParticipant.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedInOrGuest()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireFederatedParticipant extends RequireParticipant {
+	public function __construct(
+		protected ?string $sessionIdParameter = 'sessionId',
+	) {
+	}
+
+	/**
+	 * On some federated requests the sessionId of the federated_user is included
+	 * and should be used to inject a participant with the correct session object
+	 */
+	public function getSessionIdParameter(): ?string {
+		return $this->sessionIdParameter;
+	}
+}

lib/Middleware/Attribute/RequireLoggedInModeratorParticipant.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedIn()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireLoggedInModeratorParticipant extends RequireModeratorParticipant {
+}

lib/Middleware/Attribute/RequireLoggedInParticipant.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedIn()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireLoggedInParticipant extends RequireParticipant {
+}

lib/Middleware/Attribute/RequireModeratorOrNoLobby.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::checkLobbyState()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireModeratorOrNoLobby extends RequireRoom {
+}

lib/Middleware/Attribute/RequireModeratorParticipant.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedInOrGuest()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireModeratorParticipant extends RequireParticipant {
+}

lib/Middleware/Attribute/RequireParticipant.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedInOrGuest()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireParticipant extends RequireRoom {
+}

lib/Middleware/Attribute/RequireParticipantOrLoggedInAndListedConversation.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getLoggedInOrGuest()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireParticipantOrLoggedInAndListedConversation extends RequireRoom {
+}

lib/Middleware/Attribute/RequirePermission.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::checkPermission()
+ */
+#[Attribute(Attribute::TARGET_METHOD | Attribute::IS_REPEATABLE)]
+class RequirePermission {
+
+	public const CHAT = 'chat';
+	public const START_CALL = 'call-start';
+
+	public function __construct(
+		protected string $permission,
+	) {
+	}
+
+	public function getPermission(): string {
+		return $this->permission;
+	}
+}

lib/Middleware/Attribute/RequireReadWriteConversation.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::checkReadOnlyState()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireReadWriteConversation extends RequireRoom {
+}

lib/Middleware/Attribute/RequireRoom.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+use OCA\Talk\Middleware\InjectionMiddleware;
+
+/**
+ * @see InjectionMiddleware::getRoom()
+ */
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireRoom {
+}

lib/Middleware/CanUseTalkMiddleware.php

@@ -0,0 +1,195 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware;
+
+use OCA\Talk\Config;
+use OCA\Talk\Controller\HostedSignalingServerController;
+use OCA\Talk\Controller\RecordingController;
+use OCA\Talk\Controller\SignalingController;
+use OCA\Talk\Exceptions\ForbiddenException;
+use OCA\Talk\Middleware\Attribute\RequireCallEnabled;
+use OCA\Talk\Middleware\Exceptions\CanNotUseTalkException;
+use OCA\Talk\Middleware\Exceptions\UnsupportedClientVersionException;
+use OCA\Talk\Room;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\RedirectResponse;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+use OCP\AppFramework\OCS\OCSException;
+use OCP\AppFramework\OCSController;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\IUserSession;
+
+class CanUseTalkMiddleware extends Middleware {
+	public const TALK_DESKTOP_MIN_VERSION = '1.0.0';
+	/**
+	 * Actual version was 0.16.0 but otherwise the logic would differ in the version check,
+	 * so we simply bump the recording consent version as well
+	 */
+	public const TALK_DESKTOP_MIN_VERSION_RECORDING_CONSENT = '1.0.0';
+	public const TALK_DESKTOP_MIN_VERSION_E2EE_CALLS = '1.1.0';
+
+	public const TALK_ANDROID_MIN_VERSION = '15.0.0';
+	public const TALK_ANDROID_MIN_VERSION_RECORDING_CONSENT = '18.0.0';
+	public const TALK_ANDROID_MIN_VERSION_E2EE_CALLS = '99.0.0';
+
+	public const TALK_IOS_MIN_VERSION = '15.0.0';
+	public const TALK_IOS_MIN_VERSION_RECORDING_CONSENT = '18.0.0';
+
+	// Talk iOS >= 23 handles the configuration flag for E2EE and shows a appropiate message
+	// Support for E2EE on Talk iOS is still pending
+	public const TALK_IOS_MIN_VERSION_E2EE_CALLS = '23.0.0';
+
+
+	public function __construct(
+		protected IUserSession $userSession,
+		protected IGroupManager $groupManager,
+		protected Config $talkConfig,
+		protected IConfig $serverConfig,
+		protected IRequest $request,
+		protected IURLGenerator $url,
+	) {
+	}
+
+	/**
+	 * @throws CanNotUseTalkException
+	 * @throws UnsupportedClientVersionException
+	 */
+	#[\Override]
+	public function beforeController(Controller $controller, string $methodName): void {
+		if ($this->request->isUserAgent([
+			IRequest::USER_AGENT_TALK_DESKTOP,
+			IRequest::USER_AGENT_TALK_ANDROID,
+			IRequest::USER_AGENT_TALK_IOS,
+		])) {
+			if ($this->request->isUserAgent([IRequest::USER_AGENT_TALK_DESKTOP])) {
+				$this->throwIfUnsupportedClientVersion('desktop', $this->request->getHeader('USER_AGENT'));
+			} elseif ($this->request->isUserAgent([IRequest::USER_AGENT_TALK_ANDROID])) {
+				$this->throwIfUnsupportedClientVersion('android', $this->request->getHeader('USER_AGENT'));
+			} elseif ($this->request->isUserAgent([IRequest::USER_AGENT_TALK_IOS])) {
+				$this->throwIfUnsupportedClientVersion('ios', $this->request->getHeader('USER_AGENT'));
+			}
+		}
+
+		$user = $this->userSession->getUser();
+		if ($user instanceof IUser && $this->talkConfig->isDisabledForUser($user)) {
+			if ($methodName === 'getWelcomeMessage'
+				&& ($controller instanceof SignalingController
+					|| $controller instanceof RecordingController)
+				&& $this->groupManager->isAdmin($user->getUID())) {
+				return;
+			}
+
+			if ($controller instanceof HostedSignalingServerController
+				&& $this->groupManager->isAdmin($user->getUID())) {
+				return;
+			}
+
+			throw new CanNotUseTalkException();
+		}
+
+		$reflectionMethod = new \ReflectionMethod($controller, $methodName);
+		$hasAttribute = !empty($reflectionMethod->getAttributes(RequireCallEnabled::class));
+
+		if ($hasAttribute
+			&& ((int)$this->serverConfig->getAppValue('spreed', 'start_calls')) === Room::START_CALL_NOONE) {
+			throw new CanNotUseTalkException();
+		}
+	}
+
+	/**
+	 * @throws \Exception
+	 */
+	#[\Override]
+	public function afterException(Controller $controller, string $methodName, \Exception $exception): Response {
+		if ($exception instanceof UnsupportedClientVersionException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException($exception->getMinVersion(), Http::STATUS_UPGRADE_REQUIRED);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		if ($exception instanceof CanNotUseTalkException
+			|| $exception instanceof ForbiddenException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException($exception->getMessage(), Http::STATUS_FORBIDDEN);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		throw $exception;
+	}
+
+	/**
+	 * @param string $client
+	 * @param string $userAgent
+	 * @throws UnsupportedClientVersionException
+	 */
+	protected function throwIfUnsupportedClientVersion(string $client, string $userAgent): void {
+		$configMinVersion = $this->serverConfig->getAppValue('spreed', 'minimum.supported.' . $client . '.version');
+
+		if ($client === 'desktop') {
+			$versionRegex = IRequest::USER_AGENT_TALK_DESKTOP;
+			$minVersion = self::TALK_DESKTOP_MIN_VERSION;
+
+			if ($this->talkConfig->isCallEndToEndEncryptionEnabled()) {
+				$minVersion = self::TALK_DESKTOP_MIN_VERSION_E2EE_CALLS;
+			} elseif ($this->talkConfig->recordingConsentRequired()) {
+				$minVersion = self::TALK_DESKTOP_MIN_VERSION_RECORDING_CONSENT;
+			}
+		} elseif ($client === 'android') {
+			$versionRegex = IRequest::USER_AGENT_TALK_ANDROID;
+			$minVersion = self::TALK_ANDROID_MIN_VERSION;
+
+			if ($this->talkConfig->isCallEndToEndEncryptionEnabled()) {
+				$minVersion = self::TALK_ANDROID_MIN_VERSION_E2EE_CALLS;
+			} elseif ($this->talkConfig->recordingConsentRequired()) {
+				$minVersion = self::TALK_ANDROID_MIN_VERSION_RECORDING_CONSENT;
+			}
+		} elseif ($client === 'ios') {
+			$versionRegex = IRequest::USER_AGENT_TALK_IOS;
+			$minVersion = self::TALK_IOS_MIN_VERSION;
+
+			if ($this->talkConfig->isCallEndToEndEncryptionEnabled()) {
+				$minVersion = self::TALK_IOS_MIN_VERSION_E2EE_CALLS;
+			} elseif ($this->talkConfig->recordingConsentRequired()) {
+				$minVersion = self::TALK_IOS_MIN_VERSION_RECORDING_CONSENT;
+			}
+		} else {
+			return;
+		}
+
+		preg_match($versionRegex, $userAgent, $matches);
+
+		if (isset($matches[1])) {
+			$clientVersion = $matches[1];
+			if (str_contains($clientVersion, '-')) {
+				// Claim pre-releases being compatible with the final releases
+				$clientVersion = substr($clientVersion, 0, strpos($clientVersion, '-'));
+			}
+
+			// API requirement and safety net
+			if (version_compare($clientVersion, $minVersion, '<')) {
+				throw new UnsupportedClientVersionException($minVersion);
+			}
+
+			// Admin option to be more pushy
+			if ($configMinVersion && version_compare($clientVersion, $configMinVersion, '<')) {
+				throw new UnsupportedClientVersionException($configMinVersion);
+			}
+		}
+	}
+}

lib/Middleware/Exceptions/CanNotUseTalkException.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class CanNotUseTalkException extends \Exception {
+	public function __construct() {
+		parent::__construct('Can not use Talk', Http::STATUS_FORBIDDEN);
+	}
+}

lib/Middleware/Exceptions/FederationUnsupportedFeatureException.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class FederationUnsupportedFeatureException extends \Exception {
+	public function __construct(
+	) {
+		parent::__construct('Feature is unsupported for federation', Http::STATUS_UPGRADE_REQUIRED);
+	}
+}

lib/Middleware/Exceptions/LobbyException.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class LobbyException extends \Exception {
+	public function __construct() {
+		parent::__construct('The conversation is not open to join right now', Http::STATUS_FORBIDDEN);
+	}
+}

lib/Middleware/Exceptions/NotAModeratorException.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class NotAModeratorException extends \Exception {
+	public function __construct() {
+		parent::__construct('Not a moderator', Http::STATUS_FORBIDDEN);
+	}
+}

lib/Middleware/Exceptions/ReadOnlyException.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class ReadOnlyException extends \Exception {
+	public function __construct() {
+		parent::__construct('The conversation is read-only', Http::STATUS_FORBIDDEN);
+	}
+}

lib/Middleware/Exceptions/UnsupportedClientVersionException.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware\Exceptions;
+
+use OCP\AppFramework\Http;
+
+class UnsupportedClientVersionException extends \Exception {
+	public function __construct(
+		protected string $version,
+	) {
+		parent::__construct('Unsupported client version', Http::STATUS_UPGRADE_REQUIRED);
+	}
+
+	public function getMinVersion(): string {
+		return $this->version;
+	}
+}

lib/Middleware/InjectionMiddleware.php

@@ -0,0 +1,450 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware;
+
+use OCA\Talk\Controller\AEnvironmentAwareOCSController;
+use OCA\Talk\Exceptions\CannotReachRemoteException;
+use OCA\Talk\Exceptions\ForbiddenException;
+use OCA\Talk\Exceptions\ParticipantNotFoundException;
+use OCA\Talk\Exceptions\PermissionsException;
+use OCA\Talk\Exceptions\RoomNotFoundException;
+use OCA\Talk\Federation\Authenticator;
+use OCA\Talk\Manager;
+use OCA\Talk\Middleware\Attribute\AllowWithoutParticipantWhenPendingInvitation;
+use OCA\Talk\Middleware\Attribute\FederationSupported;
+use OCA\Talk\Middleware\Attribute\RequireAuthenticatedParticipant;
+use OCA\Talk\Middleware\Attribute\RequireFederatedParticipant;
+use OCA\Talk\Middleware\Attribute\RequireLoggedInModeratorParticipant;
+use OCA\Talk\Middleware\Attribute\RequireLoggedInParticipant;
+use OCA\Talk\Middleware\Attribute\RequireModeratorOrNoLobby;
+use OCA\Talk\Middleware\Attribute\RequireModeratorParticipant;
+use OCA\Talk\Middleware\Attribute\RequireParticipant;
+use OCA\Talk\Middleware\Attribute\RequireParticipantOrLoggedInAndListedConversation;
+use OCA\Talk\Middleware\Attribute\RequirePermission;
+use OCA\Talk\Middleware\Attribute\RequireReadWriteConversation;
+use OCA\Talk\Middleware\Attribute\RequireRoom;
+use OCA\Talk\Middleware\Exceptions\FederationUnsupportedFeatureException;
+use OCA\Talk\Middleware\Exceptions\LobbyException;
+use OCA\Talk\Middleware\Exceptions\NotAModeratorException;
+use OCA\Talk\Middleware\Exceptions\ReadOnlyException;
+use OCA\Talk\Model\Attendee;
+use OCA\Talk\Model\InvitationMapper;
+use OCA\Talk\Model\Session;
+use OCA\Talk\Participant;
+use OCA\Talk\Room;
+use OCA\Talk\Service\BanService;
+use OCA\Talk\Service\ParticipantService;
+use OCA\Talk\TalkSession;
+use OCA\Talk\Webinary;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
+use OCP\AppFramework\Http\RedirectResponse;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+use OCP\AppFramework\OCS\OCSException;
+use OCP\AppFramework\OCSController;
+use OCP\Federation\ICloudIdManager;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\Security\Bruteforce\IThrottler;
+use OCP\Security\Bruteforce\MaxDelayReached;
+use Psr\Log\LoggerInterface;
+
+class InjectionMiddleware extends Middleware {
+	public function __construct(
+		protected IRequest $request,
+		protected ParticipantService $participantService,
+		protected TalkSession $talkSession,
+		protected Manager $manager,
+		protected ICloudIdManager $cloudIdManager,
+		protected IThrottler $throttler,
+		protected IURLGenerator $url,
+		protected InvitationMapper $invitationMapper,
+		protected Authenticator $federationAuthenticator,
+		protected BanService $banService,
+		protected LoggerInterface $logger,
+		protected ?string $userId,
+	) {
+	}
+
+	/**
+	 * @throws FederationUnsupportedFeatureException
+	 * @throws LobbyException
+	 * @throws NotAModeratorException
+	 * @throws ParticipantNotFoundException
+	 * @throws PermissionsException
+	 * @throws ReadOnlyException
+	 * @throws ForbiddenException
+	 * @throws RoomNotFoundException
+	 */
+	#[\Override]
+	public function beforeController(Controller $controller, string $methodName): void {
+		if (!$controller instanceof AEnvironmentAwareOCSController) {
+			return;
+		}
+
+		$reflectionMethod = new \ReflectionMethod($controller, $methodName);
+
+		$apiVersion = $this->request->getParam('apiVersion');
+		$controller->setAPIVersion((int)substr($apiVersion, 1));
+
+		if (!empty($reflectionMethod->getAttributes(AllowWithoutParticipantWhenPendingInvitation::class))) {
+			try {
+				$this->getRoomByInvite($controller);
+				return;
+			} catch (RoomNotFoundException|ParticipantNotFoundException) {
+				// Falling back to bellow checks
+			}
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireAuthenticatedParticipant::class))) {
+			$this->getLoggedInOrGuest($controller, false, requireFederationWhenNotLoggedIn: true);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireLoggedInParticipant::class))) {
+			$this->getLoggedIn($controller, false);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireLoggedInModeratorParticipant::class))) {
+			$this->getLoggedIn($controller, true);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireParticipantOrLoggedInAndListedConversation::class))) {
+			$this->getLoggedInOrGuest($controller, false, true);
+		}
+
+		$attributes = $reflectionMethod->getAttributes(RequireFederatedParticipant::class);
+		if (!empty($attributes)) {
+			$sessionIdParameter = $this->readSessionIdParameterFromAttributes($attributes);
+			$this->getLoggedInOrGuest($controller, false, sessionIdParameter: $sessionIdParameter);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireParticipant::class))) {
+			$this->getLoggedInOrGuest($controller, false);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireModeratorParticipant::class))) {
+			$this->getLoggedInOrGuest($controller, true);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireRoom::class))) {
+			$this->getRoom($controller);
+		}
+
+		if (empty($reflectionMethod->getAttributes(FederationSupported::class))) {
+			// When federation is not supported, the room needs to be local
+			$this->checkFederationSupport($controller);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireReadWriteConversation::class))) {
+			$this->checkReadOnlyState($controller);
+		}
+
+		if (!empty($reflectionMethod->getAttributes(RequireModeratorOrNoLobby::class))) {
+			$this->checkLobbyState($controller);
+		}
+
+		$requiredPermissions = $reflectionMethod->getAttributes(RequirePermission::class);
+		if ($requiredPermissions) {
+			foreach ($requiredPermissions as $attribute) {
+				/** @var RequirePermission $requirement */
+				$requirement = $attribute->newInstance();
+				$this->checkPermission($controller, $requirement->getPermission());
+			}
+		}
+	}
+
+	protected function readSessionIdParameterFromAttributes(array $attributes): ?string {
+		foreach ($attributes as $attribute) {
+			/** @var RequireFederatedParticipant $instance */
+			$instance = $attribute->newInstance();
+			if ($instance->getSessionIdParameter() !== null) {
+				return $instance->getSessionIdParameter();
+			}
+		}
+		return null;
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @throws ForbiddenException
+	 */
+	protected function getRoom(AEnvironmentAwareOCSController $controller): void {
+		$token = $this->request->getParam('token');
+		$room = $this->manager->getRoomByToken($token);
+		$controller->setRoom($room);
+
+		$this->banService->throwIfActorIsBanned($room, $this->userId);
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @param bool $moderatorRequired
+	 * @throws NotAModeratorException
+	 */
+	protected function getLoggedIn(AEnvironmentAwareOCSController $controller, bool $moderatorRequired): void {
+		$token = $this->request->getParam('token');
+		$sessionId = $this->talkSession->getSessionForRoom($token);
+		$room = $this->manager->getRoomForUserByToken($token, $this->userId, $sessionId);
+		$controller->setRoom($room);
+
+		$participant = $this->participantService->getParticipant($room, $this->userId, $sessionId);
+		$controller->setParticipant($participant);
+
+		$this->banService->throwIfActorIsBanned($room, $this->userId);
+
+		if ($moderatorRequired && !$participant->hasModeratorPermissions(false)) {
+			throw new NotAModeratorException();
+		}
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @param bool $moderatorRequired
+	 * @param bool $requireListedWhenNoParticipant
+	 * @throws NotAModeratorException
+	 * @throws ParticipantNotFoundException
+	 */
+	protected function getLoggedInOrGuest(
+		AEnvironmentAwareOCSController $controller,
+		bool $moderatorRequired,
+		bool $requireListedWhenNoParticipant = false,
+		bool $requireFederationWhenNotLoggedIn = false,
+		?string $sessionIdParameter = null,
+	): void {
+		if ($requireFederationWhenNotLoggedIn && $this->userId === null && !$this->federationAuthenticator->isFederationRequest()) {
+			throw new ParticipantNotFoundException();
+		}
+
+		if ($sessionIdParameter !== null && !$this->federationAuthenticator->isFederationRequest()) {
+			throw new ParticipantNotFoundException();
+		}
+
+		$room = $controller->getRoom();
+		$sessionId = null;
+		if (!$room instanceof Room) {
+			$token = $this->request->getParam('token');
+			if (!$this->federationAuthenticator->isFederationRequest()) {
+				$sessionId = $this->talkSession->getSessionForRoom($token);
+				$room = $this->manager->getRoomForUserByToken($token, $this->userId, $sessionId);
+			} else {
+				$sessionId = $sessionIdParameter !== null ? $this->request->getParam($sessionIdParameter) : null;
+				$room = $this->manager->getRoomByRemoteAccess($token, Attendee::ACTOR_FEDERATED_USERS, $this->federationAuthenticator->getCloudId(), $this->federationAuthenticator->getAccessToken(), $sessionId);
+
+				// Get and set the participant already, so we don't retry public access
+				$participant = $this->participantService->getParticipantByActor($room, Attendee::ACTOR_FEDERATED_USERS, $this->federationAuthenticator->getCloudId());
+
+				if ($sessionIdParameter !== null && !$participant->getSession() instanceof Session) {
+					// If a session is required, fail if we didn't find it
+					throw new ParticipantNotFoundException();
+				}
+
+				$this->federationAuthenticator->authenticated($room, $participant);
+				$controller->setParticipant($participant);
+			}
+			$controller->setRoom($room);
+		}
+
+		$participant = $controller->getParticipant();
+		if (!$participant instanceof Participant) {
+			$participant = null;
+			if ($sessionId !== null) {
+				try {
+					$participant = $this->participantService->getParticipantBySession($room, $sessionId);
+					$controller->setParticipant($participant);
+				} catch (ParticipantNotFoundException $e) {
+					// ignore and fall back in case a concurrent request might have
+					// invalidated the session
+				}
+			}
+
+			if ($participant === null) {
+				if (!$requireListedWhenNoParticipant || !$this->manager->isRoomListableByUser($room, $this->userId)) {
+					$participant = $this->participantService->getParticipant($room, $this->userId);
+					$controller->setParticipant($participant);
+				}
+			}
+		}
+
+		$this->banService->throwIfActorIsBanned($room, $this->userId);
+
+		if ($moderatorRequired && !$participant->hasModeratorPermissions()) {
+			throw new NotAModeratorException();
+		}
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @throws RoomNotFoundException
+	 * @throws ParticipantNotFoundException
+	 */
+	protected function getRoomByInvite(AEnvironmentAwareOCSController $controller): void {
+		if ($this->userId === null) {
+			throw new ParticipantNotFoundException('No user available');
+		}
+
+		$room = $controller->getRoom();
+		if (!$room instanceof Room) {
+			$token = $this->request->getParam('token');
+			$room = $this->manager->getRoomByToken($token);
+		}
+
+		$participant = $controller->getParticipant();
+		if (!$participant instanceof Participant) {
+			try {
+				$invitation = $this->invitationMapper->getInvitationForUserByLocalRoom($room, $this->userId);
+				$controller->setRoom($room);
+				$controller->setInvitation($invitation);
+			} catch (DoesNotExistException $e) {
+				throw new ParticipantNotFoundException('No invite available', $e->getCode(), $e);
+			}
+		}
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @throws FederationUnsupportedFeatureException
+	 */
+	protected function checkFederationSupport(AEnvironmentAwareOCSController $controller): void {
+		$room = $controller->getRoom();
+		if ($room instanceof Room && $room->isFederatedConversation()) {
+			throw new FederationUnsupportedFeatureException();
+		}
+	}
+
+	/**
+	 * @param AEnvironmentAwareOCSController $controller
+	 * @throws ReadOnlyException
+	 */
+	protected function checkReadOnlyState(AEnvironmentAwareOCSController $controller): void {
+		$room = $controller->getRoom();
+		if (!$room instanceof Room || $room->getReadOnly() === Room::READ_ONLY) {
+			throw new ReadOnlyException();
+		}
+		if ($room->getType() === Room::TYPE_CHANGELOG) {
+			throw new ReadOnlyException();
+		}
+	}
+
+	/**
+	 * @throws PermissionsException
+	 */
+	protected function checkPermission(AEnvironmentAwareOCSController $controller, string $permission): void {
+		$participant = $controller->getParticipant();
+		if (!$participant instanceof Participant) {
+			throw new PermissionsException();
+		}
+
+		if ($permission === RequirePermission::CHAT && !($participant->getPermissions() & Attendee::PERMISSIONS_CHAT)) {
+			throw new PermissionsException();
+		}
+		if ($permission === RequirePermission::START_CALL && !($participant->getPermissions() & Attendee::PERMISSIONS_CALL_START)) {
+			throw new PermissionsException();
+		}
+	}
+
+	/**
+	 * @throws LobbyException
+	 */
+	protected function checkLobbyState(AEnvironmentAwareOCSController $controller): void {
+		try {
+			$this->getLoggedInOrGuest($controller, true);
+			return;
+		} catch (NotAModeratorException|ParticipantNotFoundException) {
+		}
+
+		$participant = $controller->getParticipant();
+		if ($participant instanceof Participant
+			&& $participant->getPermissions() & Attendee::PERMISSIONS_LOBBY_IGNORE) {
+			return;
+		}
+
+		$room = $controller->getRoom();
+		if (!$room instanceof Room || $room->getLobbyState() !== Webinary::LOBBY_NONE) {
+			throw new LobbyException();
+		}
+	}
+
+	/**
+	 * @throws \Exception
+	 */
+	#[\Override]
+	public function afterException(Controller $controller, string $methodName, \Exception $exception): Response {
+		if ($exception instanceof RoomNotFoundException
+			|| $exception instanceof ParticipantNotFoundException) {
+			if ($controller instanceof OCSController) {
+				$reflectionMethod = new \ReflectionMethod($controller, $methodName);
+				$attributes = $reflectionMethod->getAttributes(BruteForceProtection::class);
+
+				if (!empty($attributes)) {
+					foreach ($attributes as $attribute) {
+						/** @var BruteForceProtection $protection */
+						$protection = $attribute->newInstance();
+						$action = $protection->getAction();
+
+						if ($action === 'talkRoomToken') {
+							$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" throttled for accessing "' . ($this->request->getParam('token') ?? 'UNKNOWN') . '"', ['app' => 'spreed-bfp']);
+							try {
+								$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $action);
+							} catch (MaxDelayReached $e) {
+								throw new OCSException($e->getMessage(), Http::STATUS_TOO_MANY_REQUESTS);
+							}
+							$this->throttler->registerAttempt($action, $this->request->getRemoteAddress(), [
+								'token' => $this->request->getParam('token') ?? '',
+							]);
+						}
+					}
+				}
+
+				throw new OCSException('', Http::STATUS_NOT_FOUND);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		if ($exception instanceof CannotReachRemoteException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException('', Http::STATUS_UNPROCESSABLE_ENTITY);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		if ($exception instanceof FederationUnsupportedFeatureException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException('', Http::STATUS_NOT_ACCEPTABLE);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		if ($exception instanceof LobbyException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException('', Http::STATUS_PRECONDITION_FAILED);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		if ($exception instanceof NotAModeratorException
+			|| $exception instanceof ReadOnlyException
+			|| $exception instanceof ForbiddenException
+			|| $exception instanceof PermissionsException) {
+			if ($controller instanceof OCSController) {
+				throw new OCSException('', Http::STATUS_FORBIDDEN);
+			}
+
+			return new RedirectResponse($this->url->linkToDefaultPageUrl());
+		}
+
+		throw $exception;
+	}
+}

lib/Middleware/ParameterOutOfRangeMiddleware.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Middleware;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Http\ParameterOutOfRangeException;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+use OCP\AppFramework\OCSController;
+
+class ParameterOutOfRangeMiddleware extends Middleware {
+	/**
+	 * @throws \Exception
+	 */
+	#[\Override]
+	public function afterException(Controller $controller, string $methodName, \Exception $exception): Response {
+		if ($exception instanceof ParameterOutOfRangeException
+			&& $controller instanceof OCSController) {
+			return new DataResponse([
+				'error' => $exception->getParameterName(),
+			], Http::STATUS_BAD_REQUEST);
+		}
+
+		throw $exception;
+	}
+}