Cordy/Cairn
2
1
Fork 0
Code Issues 20 Pull requests Projects Releases Packages Wiki Activity Actions

ocm: handshake callback follows OCS discovery, legacy GET flavor (#455) #482

Merged
Cordy merged 2 commits from fix-455e into main 2026-09-11 10:56:35 +00:00
Conversation 0 Commits 2 Files changed 3 +107 -14
Cordy commented 2026-09-11 10:54:35 +00:00
Owner
Copy link

Live dogfood trace: after the overwrite.cli.url fix, NC's request-shared-secret arrived and was accepted (200) — but our callback got 404, because Nextcloud 34 does not serve /ocs/v2.php/apps/federation/api/v1/get-shared-secret. Its /ocs-provider advertises the real endpoint: FEDERATED_SHARING.endpoints["shared-secret"] = /ocs/v2.php/cloud/shared-secret, a GET with query parameters and the OCS-APIRequest: true header (verified live against nextcloud.c0rdyceps.ch: GET → 403 on a dummy token, exactly the validation semantics).

fetchDirSecret now: fetches the peer's /ocs-provider/, uses the advertised shared-secret endpoint GET-style with the OCS header, and keeps the modern POST path as fallback when discovery is absent. Trailing-slash source retry unchanged; refusal logs now include the endpoint.

TDD: the corrected-protocol test (discovery + GET + header assertions) witnessed red on the runner against the old POST implementation; a second test pins the discovery-less POST fallback.

Live dogfood trace: after the `overwrite.cli.url` fix, NC's `request-shared-secret` arrived and was accepted (200) — but our callback got **404**, because Nextcloud 34 does not serve `/ocs/v2.php/apps/federation/api/v1/get-shared-secret`. Its `/ocs-provider` advertises the real endpoint: `FEDERATED_SHARING.endpoints["shared-secret"] = /ocs/v2.php/cloud/shared-secret`, a **GET** with query parameters and the `OCS-APIRequest: true` header (verified live against nextcloud.c0rdyceps.ch: GET → 403 on a dummy token, exactly the validation semantics). `fetchDirSecret` now: fetches the peer's `/ocs-provider/`, uses the advertised shared-secret endpoint GET-style with the OCS header, and keeps the modern POST path as fallback when discovery is absent. Trailing-slash source retry unchanged; refusal logs now include the endpoint. TDD: the corrected-protocol test (discovery + GET + header assertions) witnessed red on the runner against the old POST implementation; a second test pins the discovery-less POST fallback.
ocm: handshake callback follows OCS discovery, legacy GET flavor (#455)
All checks were successful
ci / test-and-build (pull_request) Successful in 55s
Details
08be60aa48
Cordy merged commit ddd65c6589 into main 2026-09-11 10:56:35 +00:00
Cordy deleted branch fix-455e 2026-09-11 10:56:37 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#482
No description provided.
Delete branch "fix-455e"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?