[Question/Discussion] Add ”auth hooks” for extended permission controls in the virtual file system? #24877
Description
-
Background and use case:
I’m looking for a way to add ”auth hooks” for extended permission controls to the virtual file system that could for example be utilized by client certificates to control access on multiple levels. -
Questions that maybe a core developer may know the answer to:
Is there a conceptual description of the virtual file system (as "core/lib/private/Files/Filesystem.php" and friends) or is it reverse engineering à la "study the source code" that applies?Ref: https://github.com/owncloud/core/tree/v9.1.0beta1/lib/private/Files
-
Regarding https://github.com/owncloud/core/wiki/ownCloud-9.1-Features that really caught my mind was:
- Pluggable Auth - Updating the ownCloud server to enable easier implementation / activation of different authentication mechanisms, such as the L2 request for 2 Factor Auth 9.1: Pluggable Auth #23458
- Internal 2 Factor - After creating a more modular authentication mechanism, this will allow an admin to use email to provide a second factor for ownCloud logins. Note: this has mobile and desktop implications for it to be completed. HTTP 404 error by accesing to ownCloud using mobile apps #1211
a). Does that mean you can start working on client certificate authentication i.e use certificate attributes in the login process using "Pluggable Auth"?
b). Btw, does anyone know if the internal virtual filesystem utilizes some kind of general authentication and permission control on the file level (besides add, change and delete). If not, would it be possible to implement a similar "Pluggable Auth" on the virtual file system with a decent amount of work?
Would be very grateful for any kind of pointers regarding this or info about test cases (or apps) that utilize permission control on the file system level...
Regarding: https://github.com/owncloud/core/blob/v9.1.0beta1/lib/private/Files/Node/File.php
public function fopen($mode) {
. . .
. . .
if ($this->checkPermissions($requiredPermissions)) {
$this->sendHooks($preHooks);
$result = $this->view->fopen($this->path, $mode);
$this->sendHooks($postHooks);
return $result;
} else {
throw new NotPermittedException();
}
I noticed some "hooks" (preHooks, postHooks) in the code above. Are they available to use as extended permission controls?