[full-ci] read-only storagehome and storageusers

[micbar]

Description

For migration scenarios it can be handy to use a storage provider in read-only mode. For example if we use the ownCloud SQL driver to connect to a ownCloud Classic, readonly mode is a vital step in the migration process.

How it works

• The read-only interceptor uses a list of known request types which are allowed.
• Known request types which change data on the storage are blocked and return a grpc error which will be forwarded to WebDAV.
• Unknown Request Types will be blocked and throw a GRPC error
• The interceptor changes the grants on the resources which will cause WebDAV to return read-only permissions.

WebUI

• The webUI reflects the webdav permissions and "greys out" or hides all actions that would change the files on the storage

Config

• To enable the interceptor, use STORAGE_HOME_READ_ONLY=true and STORAGE_USERS_READ_ONLY=true
• alternative: use OCIS_STORAGE_READ_ONLY=true

Known Issue

• Currently we need to add the interceptor to storagehome and storageusers which share the same physical storage (which is IMO weird and will be changed in the future)

Related Issue

• Needs Add read-only interceptor to use on storage providers cs3org/reva#1849

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[ownclouders]

💥 Acceptance tests Core-API-Tests-ocis-storage-10 failed. The build is cancelled...

[ownclouders]

💥 Acceptance tests Core-API-Tests-ocis-storage-10 failed. The build is cancelled...

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
7.4% Duplication

[butonic]

This would replace an existing map. You will have to check if it exists and create a new map or append to the existing one. Move that to a function with a name that explains what it does, eg. 'appendInterceptor()' then we can use it to add arbitrary interceptors... Or maybe even generic map[string]interface{} things 🤔

[micbar]

Yes. But the whole struct is created in L113. I don't see a case where there is already another interceptor.

I was digging into it but let us merge now. We will see what is needed when we have a real use case for more interceptors.

[butonic]

Same here

[micbar]

same answer.