cs3org · glpatcern · Apr 20, 2026 · Apr 20, 2026
diff --git a/work/notifications/research/README.md b/work/notifications/research/README.md
@@ -4,14 +4,15 @@ Research notes for `/notifications`.
 
 - `matrix-notification-types.md` - types and where they live in code (pinned links)
 - `examples/README.md` - layout of the example files
-- `examples/metadata.md` - pinned commits (reva, Nextcloud, OCM-API spec cross-check)
+- `examples/metadata.md` - pinned commits (ownCloud reva, cs3org/reva, Nextcloud, OCM-API spec cross-check)
 - `examples/nextcloud-files.md`, `examples/nextcloud-talk.md`, `examples/nextcloud-calendar.md` - wire JSON + context
-- `examples/reva-ocm-notifications.md` - reva `notify` bodies
+- `examples/reva-ocm-notifications.md` - ownCloud reva `notify` bodies
 - `examples/discrepancies.md` - spec vs code, and where stacks disagree
 - `nextcloud-server.md`, `nextcloud-talk.md`, `ocis-reva.md`, `cernbox-reva.md`, `opencloud-reva.md` - per-platform notes
 
-Notes for ocis and owncloud/reva are in `ocis-reva.md`. Example JSON under
-`examples/` uses cs3org/reva permalinks; `examples/metadata.md` explains how
-that relates to owncloud/reva.
+Notes for ocis and owncloud/reva are in `ocis-reva.md`. The example JSON under
+`examples/` uses owncloud/reva permalinks, because that repo implements the
+notification sender and typed payloads. Upstream cs3org/reva is tracked
+separately in `cernbox-reva.md`.
 
 Platform files list notification types and send/receive paths from code review.
diff --git a/work/notifications/research/cernbox-reva.md b/work/notifications/research/cernbox-reva.md
@@ -2,7 +2,7 @@
 
 Inspected repo: `https://github.com/cs3org/reva`
 Inspected source commit:
-[`62d31b988cf0f864fafd033e1b939ea7f05ba398`](https://github.com/cs3org/reva/tree/62d31b988cf0f864fafd033e1b939ea7f05ba398)
+[`38515cdf789457bf0696a4c022c6652133bd0ad0`](https://github.com/cs3org/reva/tree/38515cdf789457bf0696a4c022c6652133bd0ad0)
 
 In this inspection, this repo is mainly relevant for the gap between route
 presence and notification behavior.
@@ -24,19 +24,21 @@ depend on."
 ## Notification Types And Code Paths
 
 - The inbound `/ocm/notifications` handler lives in
-  [`notifications.go`](https://github.com/cs3org/reva/blob/62d31b988cf0f864fafd033e1b939ea7f05ba398/internal/http/services/opencloudmesh/ocmd/notifications.go).
+  [`notifications.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/notifications.go).
 - In this checkout, that file does not decode typed notification requests. It
-  reads the raw JSON body, logs it, and returns `201 Created`.
+  reads the raw JSON body only for `application/json`, logs what it got, and
+  returns `201 Created`.
 - The code comments in
-  [`notifications.go`](https://github.com/cs3org/reva/blob/62d31b988cf0f864fafd033e1b939ea7f05ba398/internal/http/services/opencloudmesh/ocmd/notifications.go)
+  [`notifications.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/notifications.go)
   mention `SHARE_ACCEPTED`, `SHARE_DECLINED`, `REQUEST_RESHARE`,
   `SHARE_UNSHARED`, `RESHARE_UNDO`, and `RESHARE_CHANGE_PERMISSION`, but in
   this pass those values were examples only. They were not decoded or acted on.
 - Outgoing notification sending is still not wired because
-  [`client.go`](https://github.com/cs3org/reva/blob/62d31b988cf0f864fafd033e1b939ea7f05ba398/internal/http/services/opencloudmesh/ocmd/client.go)
+  [`client.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/client.go)
   still has `NewNotification()` unimplemented.
-- The route is marked as unprotected ingress in
-  [`routes.go`](https://github.com/cs3org/reva/blob/62d31b988cf0f864fafd033e1b939ea7f05ba398/internal/http/services/opencloudmesh/ocmd/routes.go).
+- The route is registered in
+  [`ocm.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/ocm.go)
+  and `/notifications` is still listed in `Unprotected()`.
 
 ## What This Shows
 

diff --git a/work/notifications/research/examples/README.md b/work/notifications/research/examples/README.md
@@ -4,19 +4,22 @@ Each example is the HTTP JSON body for `/notifications`-style traffic: one objec
 
 Provenance sits in the markdown (repo, file, method, which side sends). The fenced `json` blocks are the wire payload; metadata keys like `label` or `emission` never belong inside them.
 
-Commits and GitHub permalinks live in `metadata.md` (reva, Nextcloud, OCM-API spec cross-check). Links use `blob/<commit>/path` so they do not break when `main` moves.
+Commits and GitHub permalinks live in `metadata.md` (ownCloud reva,
+cs3org/reva, Nextcloud, OCM-API spec cross-check). Links use
+`blob/<commit>/path` so they do not break when `main` moves.
 
 Source first; tests where they exist (reva httptest) or the manual steps in `work/notifications/research/` otherwise. Placeholders are angle brackets or `REDACTED`.
 
-Files, Talk, Calendar, and reva `notify` at the pinned commit. More stacks can use the same layout.
+Files, Talk, Calendar, and the ownCloud reva `notify` path at the pinned
+commit. More stacks can use the same layout.
 
 | File | What |
 | ---- | ---- |
-| `metadata.md` | Commits (reva, Nextcloud, OCM-API for spec links) |
+| `metadata.md` | Commits (ownCloud reva, cs3org/reva, Nextcloud, OCM-API) |
 | `nextcloud-files.md` | `resourceType` `file` |
 | `nextcloud-talk.md` | `resourceType` `talk-room` |
 | `nextcloud-calendar.md` | `resourceType` `calendar` |
-| `reva-ocm-notifications.md` | reva `notify` output |
+| `reva-ocm-notifications.md` | ownCloud reva `notify` output |
 | `discrepancies.md` | Spec vs code; where stacks disagree |
 
 PR: rebase onto the target branch, run a secret scan on touched markdown, note any OpenAPI field-name mismatch beside the example.
diff --git a/work/notifications/research/examples/discrepancies.md b/work/notifications/research/examples/discrepancies.md
@@ -1,35 +1,45 @@
 # Where spec text, code, and stacks disagree
 
-Permalinks are listed in [`metadata.md`](metadata.md) (OCM-API, reva, Nextcloud).
-
-I keep two things separate on purpose. [`ocis-reva.md`](../ocis-reva.md) describes owncloud/ocis and owncloud/reva at the commits I inspected: how the OCM service is wired, what the `/ocm/notifications` handler expects, and what still looked rough. The JSON examples in this folder use [cs3org/reva](https://github.com/cs3org/reva) permalinks because that is the tree the links in this repo point at. The same commit hash often appears on owncloud/reva when both forks carry the same revision. The split between these files is by topic (product wiring versus example JSON), not a claim about which fork is authoritative.
+Permalinks are listed in [`metadata.md`](metadata.md) (OCM-API, ownCloud reva,
+cs3org/reva, Nextcloud).
+
+I keep two things separate on purpose. [`ocis-reva.md`](../ocis-reva.md)
+describes owncloud/ocis plus owncloud/reva at the commits I inspected: how the
+OCM service is wired, what the `/ocm/notifications` handler expects, and what
+still looked rough. The JSON examples in this folder use the same
+owncloud/reva tree, because that repo actually implements the `notify` sender,
+the typed payload structs, and the typed `/ocm/notifications` handler
+discussed here. Upstream cs3org/reva is a separate case and is covered in
+[`cernbox-reva.md`](../cernbox-reva.md).
 
 ## When servers do not match each other
 
 This section is informal notes from comparing implementations. It is not a complete interoperability matrix.
 
-- Reva `notify` emits `SHARE_CHANGE_PERMISSION`. Nextcloud Files uses `RESHARE_CHANGE_PERMISSION` on the file path ([`matrix-notification-types.md`](../matrix-notification-types.md) section 1). The OpenAPI [`notificationType` MAY list](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/spec.yaml#L768-L777) lists `RESHARE_CHANGE_PERMISSION`. Interoperation requires a mapping if peers compare `notificationType` as a plain string.
+- ownCloud reva `notify` emits `SHARE_CHANGE_PERMISSION`. Nextcloud Files uses `RESHARE_CHANGE_PERMISSION` on the file path ([`matrix-notification-types.md`](../matrix-notification-types.md) section 1). The OpenAPI [`notificationType` MAY list](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/spec.yaml#L768-L777) lists `RESHARE_CHANGE_PERMISSION`. Interoperation requires a mapping if peers compare `notificationType` as a plain string.
 - Nextcloud Files uses `sharedSecret` heavily in outbound file traffic (matrix section 1). The oCIS / reva receive path in [`ocis-reva.md`](../ocis-reva.md) expects `grantee` and, for permission changes, `notification.protocol`. The remote has to send what the receiver implements, which is not always the same as the draft text.
-- Nextcloud Files sends and receives many `notificationType` values. The reva `notify` switch I pinned only implements `SHARE_UNSHARED` and `SHARE_CHANGE_PERMISSION` ([`reva-ocm-notifications.md`](reva-ocm-notifications.md), matrix section 3). A type string that exists only on the Nextcloud side can fail on reva.
-- On the Nextcloud Files receive path, `RESHARE_CHANGE_PERMISSION` calls `updateResharePermissions`, which throws (`HintException`, updating reshares not allowed) in the tree I read. Other layers may still report success. See matrix section 1.1 and [`nextcloud-server.md`](../nextcloud-server.md).
-- [CERN / cs3org reva](../cernbox-reva.md) and [openCloud / reva](../opencloud-reva.md) were different in my pass: the route existed, but typed handling was minimal or absent. Check those files before assuming parity with Nextcloud or a full ocmd receiver.
+- Nextcloud Files sends and receives many `notificationType` values. The ownCloud reva `notify` switch I pinned only implements `SHARE_UNSHARED` and `SHARE_CHANGE_PERMISSION` ([`reva-ocm-notifications.md`](reva-ocm-notifications.md), matrix section 3). A type string that exists only on the Nextcloud side can fail on reva.
+- On the Nextcloud Files receive path, `RESHARE_CHANGE_PERMISSION` calls `updateResharePermissions`, which throws (`HintException`, updating reshares not allowed) in the tree I read. The canonical `/ocm/notifications` controller then returns a bad request rather than a successful update. See matrix section 1.1 and [`nextcloud-server.md`](../nextcloud-server.md).
+- [CERN / cs3org reva](../cernbox-reva.md) and [openCloud / reva](../opencloud-reva.md) were different in my pass: the route existed, but typed handling was minimal or absent. Check those files before assuming parity with ownCloud reva, Nextcloud, or a full ocmd receiver.
 
 The per-codebase map lives in [`matrix-notification-types.md`](../matrix-notification-types.md) and the platform files under `research/`.
 
-## Reva `protocol` on notifications
+## ownCloud reva `protocol` on notifications
 
 Share Creation defines `protocol` as one JSON **object**, not an array:
 
-- [`spec.yaml` `protocol`](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/spec.yaml#L555-L572)
-- [`IETF-RFC.md` Share Creation](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/IETF-RFC.md#L873-L897)
+- [`spec.yaml` `protocol`](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/spec.yaml#L555-L572)
+- [`IETF-RFC.md` Share Creation](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/IETF-RFC.md#L873-L897)
 
 For permission-change notifications:
 
-- [`NewNotification`](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/spec.yaml#L761-L801) does not document `notification.protocol`.
-- [`IETF-RFC.md` Share Updating](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/IETF-RFC.md#L1293-L1301): `RESHARE_CHANGE_PERMISSION` payload and side effects are out of scope.
-- [`notificationType` MAY list](https://github.com/cs3org/OCM-API/blob/2de5068e0b4755794b54670655d625bbd78615fc/spec.yaml#L768-L777): `RESHARE_CHANGE_PERMISSION`; reva sends `SHARE_CHANGE_PERMISSION`.
+- [`NewNotification`](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/spec.yaml#L761-L801) does not document `notification.protocol`.
+- [`IETF-RFC.md` Share Acceptance fields](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/IETF-RFC.md#L1059-L1070) are scoped to Share Acceptance Notification, not a generic field list for every notification type. That same block also marks `resourceType` optional, while OpenAPI `NewNotification` requires it.
+- [`IETF-RFC.md` Share Updating](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/IETF-RFC.md#L1293-L1301): `RESHARE_CHANGE_PERMISSION` payload and side effects are out of scope.
+- [`notificationType` MAY list](https://github.com/cs3org/OCM-API/blob/6b2225e31fc4d50df16aac24a570e8263591130c/spec.yaml#L768-L777): `RESHARE_CHANGE_PERMISSION`; ownCloud reva sends `SHARE_CHANGE_PERMISSION`.
 
-Reva fills `notification.protocol` with the same object encoding as Share Creation via [`protocols.go`](https://github.com/cs3org/reva/blob/823c2f1c2593ad310f49da2f68e35b757fb49e15/internal/http/services/ocmd/protocols.go) (reva pin in `metadata.md`).
+ownCloud reva fills `notification.protocol` with the same object encoding as
+Share Creation via [`protocols.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/internal/http/services/ocmd/protocols.go) (reva pin in `metadata.md`).
 
 ## Nextcloud envelope
 

diff --git a/work/notifications/research/examples/metadata.md b/work/notifications/research/examples/metadata.md
@@ -27,22 +27,35 @@ Commits for the server, Spreed, and reva trees these notes came from. Use them w
 
 ---
 
-## Reva (notify samples)
+## ownCloud reva (oCIS notification path)
 
-The examples in this folder use [cs3org/reva](https://github.com/cs3org/reva)
-for `blob/` links. [`ocis-reva.md`](../ocis-reva.md) is written against
-[owncloud/reva](https://github.com/owncloud/reva) when the tree matched that
-commit. The hash is the same in both places; only the GitHub org in the URL
-changes. Line numbers can still drift between forks, so verify before you rely
-on a permalink.
+The JSON examples in this folder come from
+[owncloud/reva](https://github.com/owncloud/reva) at the commit below. This is
+the tree that implements `pkg/ocm/client`, the `notify` switch in
+`ocmshareprovider.go`, and the typed `/ocm/notifications` handler used by the
+oCIS-related notes.
 
-The hash below exists on cs3org/reva; other forks may not match line-for-line.
+| | |
+| --- | --- |
+| Repo | [owncloud/reva](https://github.com/owncloud/reva) |
+| Commit | `9ef2450fc1c9c711cc4e21034aa921bb2d47f34c` |
+| Open on GitHub | [owncloud/reva @ that commit](https://github.com/owncloud/reva/commit/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c) |
+
+---
+
+## cs3org/reva (upstream contrast)
+
+This section points to [cs3org/reva](https://github.com/cs3org/reva). I keep it
+separate because the latest upstream tree does not implement the same OCM
+notification sender path.
+It has the route and share protocol structs, but `/notifications` is still a
+stub there.
 
 | | |
 | --- | --- |
-| Commit | `823c2f1c2593ad310f49da2f68e35b757fb49e15` |
-| Branch | `main` |
-| Open on GitHub | [cs3org/reva @ that commit](https://github.com/cs3org/reva/commit/823c2f1c2593ad310f49da2f68e35b757fb49e15) |
+| Repo | [cs3org/reva](https://github.com/cs3org/reva) |
+| Commit | `38515cdf789457bf0696a4c022c6652133bd0ad0` |
+| Open on GitHub | [cs3org/reva @ that commit](https://github.com/cs3org/reva/commit/38515cdf789457bf0696a4c022c6652133bd0ad0) |
 
 ---
 
@@ -53,21 +66,36 @@ Cross-checks in `discrepancies.md` and `reva-ocm-notifications.md` use this tree
 | | |
 | --- | --- |
 | Repo | [cs3org/OCM-API](https://github.com/cs3org/OCM-API) |
-| Commit | `2de5068e0b4755794b54670655d625bbd78615fc` |
-| Open on GitHub | [commit](https://github.com/cs3org/OCM-API/commit/2de5068e0b4755794b54670655d625bbd78615fc) |
+| Commit | `6b2225e31fc4d50df16aac24a570e8263591130c` |
+| Open on GitHub | [commit](https://github.com/cs3org/OCM-API/commit/6b2225e31fc4d50df16aac24a570e8263591130c) |
+
+---
+
+## ownCloud reva paths I keep pointing at
+
+Same commit as in the ownCloud reva section above. Permalinks all start from `https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/`.
+
+| What | Path |
+| ---- | ---- |
+| Notify client tests | [`pkg/ocm/client/notify_payload_test.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/pkg/ocm/client/notify_payload_test.go) |
+| Notification payload struct | [`pkg/ocm/client/payload.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/pkg/ocm/client/payload.go) |
+| `notify` in the gRPC service | [`internal/grpc/services/ocmshareprovider/ocmshareprovider.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/internal/grpc/services/ocmshareprovider/ocmshareprovider.go) (`notify`) |
+| Typed receive handler | [`internal/http/services/ocmd/notifications.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/internal/http/services/ocmd/notifications.go) |
+| Protocol JSON shape | [`internal/http/services/ocmd/protocols.go`](https://github.com/owncloud/reva/blob/9ef2450fc1c9c711cc4e21034aa921bb2d47f34c/internal/http/services/ocmd/protocols.go) |
 
 ---
 
-## Reva paths I keep pointing at
+## cs3org/reva paths I keep pointing at
 
-Same commit as in the previous section. Permalinks all start from `https://github.com/cs3org/reva/blob/823c2f1c2593ad310f49da2f68e35b757fb49e15/`.
+Same commit as in the cs3org/reva section above. Permalinks all start from `https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/`.
 
 | What | Path |
 | ---- | ---- |
-| Notify client tests | [`pkg/ocm/client/notify_payload_test.go`](https://github.com/cs3org/reva/blob/823c2f1c2593ad310f49da2f68e35b757fb49e15/pkg/ocm/client/notify_payload_test.go) |
-| `notify` in the gRPC service | [`internal/grpc/services/ocmshareprovider/ocmshareprovider.go`](https://github.com/cs3org/reva/blob/823c2f1c2593ad310f49da2f68e35b757fb49e15/internal/grpc/services/ocmshareprovider/ocmshareprovider.go) (`notify`) |
-| Protocol JSON shape | [`internal/http/services/ocmd/protocols.go`](https://github.com/cs3org/reva/blob/823c2f1c2593ad310f49da2f68e35b757fb49e15/internal/http/services/ocmd/protocols.go) |
+| Stub `/notifications` handler | [`internal/http/services/opencloudmesh/ocmd/notifications.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/notifications.go) |
+| Router and unprotected list | [`internal/http/services/opencloudmesh/ocmd/ocm.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/ocm.go) |
+| Unimplemented `NewNotification` | [`internal/http/services/opencloudmesh/ocmd/client.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/client.go) |
+| Share `Protocols` encoding | [`internal/http/services/opencloudmesh/ocmd/specs.go`](https://github.com/cs3org/reva/blob/38515cdf789457bf0696a4c022c6652133bd0ad0/internal/http/services/opencloudmesh/ocmd/specs.go) |
 
 ---
 
-When you change a pin, update the permalinks in the same change. If you move the OCM-API pin, refresh every `blob/2de5068...` link under `work/notifications/research/examples/`.
+When you change a pin, update the permalinks in the same change. If you move the OCM-API pin, refresh every `blob/6b2225...` link under `work/notifications/research/examples/`.