Merge pull request #34730 from nextcloud/backport/33945/stable24

[stable24] LDAP to not register new users when outside of fair use or over limits

7 files changed, 138 insertions, 20 deletions

diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php
index 760ed236d67..ef4631c4e34 100644
--- a/lib/composer/composer/autoload_classmap.php
+++ b/lib/composer/composer/autoload_classmap.php
@@ -544,6 +544,7 @@ return array(
     'OCP\\Support\\CrashReport\\IRegistry' => $baseDir . '/lib/public/Support/CrashReport/IRegistry.php',
     'OCP\\Support\\CrashReport\\IReporter' => $baseDir . '/lib/public/Support/CrashReport/IReporter.php',
     'OCP\\Support\\Subscription\\Exception\\AlreadyRegisteredException' => $baseDir . '/lib/public/Support/Subscription/Exception/AlreadyRegisteredException.php',
+    'OCP\\Support\\Subscription\\IAssertion' => $baseDir . '/lib/public/Support/Subscription/IAssertion.php',
     'OCP\\Support\\Subscription\\IRegistry' => $baseDir . '/lib/public/Support/Subscription/IRegistry.php',
     'OCP\\Support\\Subscription\\ISubscription' => $baseDir . '/lib/public/Support/Subscription/ISubscription.php',
     'OCP\\Support\\Subscription\\ISupportedApps' => $baseDir . '/lib/public/Support/Subscription/ISupportedApps.php',
@@ -1516,6 +1517,7 @@ return array(
     'OC\\Streamer' => $baseDir . '/lib/private/Streamer.php',
     'OC\\SubAdmin' => $baseDir . '/lib/private/SubAdmin.php',
     'OC\\Support\\CrashReport\\Registry' => $baseDir . '/lib/private/Support/CrashReport/Registry.php',
+    'OC\\Support\\Subscription\\Assertion' => $baseDir . '/lib/private/Support/Subscription/Assertion.php',
     'OC\\Support\\Subscription\\Registry' => $baseDir . '/lib/private/Support/Subscription/Registry.php',
     'OC\\SystemConfig' => $baseDir . '/lib/private/SystemConfig.php',
     'OC\\SystemTag\\ManagerFactory' => $baseDir . '/lib/private/SystemTag/ManagerFactory.php',
diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php
index 95f758b7b92..6b49cb352fd 100644
--- a/lib/composer/composer/autoload_static.php
+++ b/lib/composer/composer/autoload_static.php
@@ -573,6 +573,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
         'OCP\\Support\\CrashReport\\IRegistry' => __DIR__ . '/../../..' . '/lib/public/Support/CrashReport/IRegistry.php',
         'OCP\\Support\\CrashReport\\IReporter' => __DIR__ . '/../../..' . '/lib/public/Support/CrashReport/IReporter.php',
         'OCP\\Support\\Subscription\\Exception\\AlreadyRegisteredException' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/Exception/AlreadyRegisteredException.php',
+        'OCP\\Support\\Subscription\\IAssertion' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/IAssertion.php',
         'OCP\\Support\\Subscription\\IRegistry' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/IRegistry.php',
         'OCP\\Support\\Subscription\\ISubscription' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/ISubscription.php',
         'OCP\\Support\\Subscription\\ISupportedApps' => __DIR__ . '/../../..' . '/lib/public/Support/Subscription/ISupportedApps.php',
@@ -1545,6 +1546,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
         'OC\\Streamer' => __DIR__ . '/../../..' . '/lib/private/Streamer.php',
         'OC\\SubAdmin' => __DIR__ . '/../../..' . '/lib/private/SubAdmin.php',
         'OC\\Support\\CrashReport\\Registry' => __DIR__ . '/../../..' . '/lib/private/Support/CrashReport/Registry.php',
+        'OC\\Support\\Subscription\\Assertion' => __DIR__ . '/../../..' . '/lib/private/Support/Subscription/Assertion.php',
         'OC\\Support\\Subscription\\Registry' => __DIR__ . '/../../..' . '/lib/private/Support/Subscription/Registry.php',
         'OC\\SystemConfig' => __DIR__ . '/../../..' . '/lib/private/SystemConfig.php',
         'OC\\SystemTag\\ManagerFactory' => __DIR__ . '/../../..' . '/lib/private/SystemTag/ManagerFactory.php',
diff --git a/lib/private/Server.php b/lib/private/Server.php
index e9d673d3746..e70d9d2a7b2 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -783,6 +783,7 @@ class Server extends ServerContainer implements IServerContainer {
 
 		$this->registerAlias(\OCP\Support\CrashReport\IRegistry::class, \OC\Support\CrashReport\Registry::class);
 		$this->registerAlias(\OCP\Support\Subscription\IRegistry::class, \OC\Support\Subscription\Registry::class);
+		$this->registerAlias(\OCP\Support\Subscription\IAssertion::class, \OC\Support\Subscription\Assertion::class);
 
 		$this->registerService(\OC\Log::class, function (Server $c) {
 			$logType = $c->get(AllConfig::class)->getSystemValue('log_type', 'file');
diff --git a/lib/private/Support/Subscription/Assertion.php b/lib/private/Support/Subscription/Assertion.php
new file mode 100644
index 00000000000..9b77e875944
--- /dev/null
+++ b/lib/private/Support/Subscription/Assertion.php
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2022 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OC\Support\Subscription;
+
+use OCP\HintException;
+use OCP\L10N\IFactory;
+use OCP\Notification\IManager;
+use OCP\Support\Subscription\IAssertion;
+use OCP\Support\Subscription\IRegistry;
+
+class Assertion implements IAssertion {
+	private IRegistry $registry;
+	private IFactory $l10nFactory;
+	private IManager $notificationManager;
+
+	public function __construct(IRegistry $registry, IFactory $l10nFactory, IManager $notificationManager) {
+		$this->registry = $registry;
+		$this->l10nFactory = $l10nFactory;
+		$this->notificationManager = $notificationManager;
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function createUserIsLegit(): void {
+		if ($this->registry->delegateIsHardUserLimitReached($this->notificationManager)) {
+			$l = $this->l10nFactory->get('lib');
+			throw new HintException($l->t('The user limit has been reached and the user was not created. Check your notifications to learn more.'));
+		}
+	}
+}
diff --git a/lib/private/Support/Subscription/Registry.php b/lib/private/Support/Subscription/Registry.php
index ba3642d021c..87070e7a0dc 100644
--- a/lib/private/Support/Subscription/Registry.php
+++ b/lib/private/Support/Subscription/Registry.php
@@ -215,19 +215,38 @@ class Registry implements IRegistry {
 		return $userCount;
 	}
 
-	private function notifyAboutReachedUserLimit(IManager $notificationManager) {
+	private function notifyAboutReachedUserLimit(IManager $notificationManager): void {
 		$admins = $this->groupManager->get('admin')->getUsers();
-		foreach ($admins as $admin) {
-			$notification = $notificationManager->createNotification();
 
-			$notification->setApp('core')
-				->setUser($admin->getUID())
-				->setDateTime(new \DateTime())
-				->setObject('user_limit_reached', '1')
-				->setSubject('user_limit_reached');
+		$notification = $notificationManager->createNotification();
+		$notification->setApp('core')
+			->setObject('user_limit_reached', '1')
+			->setSubject('user_limit_reached');
+
+		if ($notificationManager->getCount($notification) > 0
+			&& !$this->reIssue()
+		) {
+			return;
+		}
+
+		$notificationManager->markProcessed($notification);
+		$notification->setDateTime(new \DateTime());
+
+		foreach ($admins as $admin) {
+			$notification->setUser($admin->getUID());
 			$notificationManager->notify($notification);
 		}
 
 		$this->logger->warning('The user limit was reached and the new user was not created', ['app' => 'lib']);
 	}
+
+	protected function reIssue(): bool {
+		$lastNotification = (int)$this->config->getAppValue('lib', 'last_subscription_reminder', '0');
+
+		if ((time() - $lastNotification) >= 86400) {
+			$this->config->setAppValue('lib', 'last_subscription_reminder', (string)time());
+			return true;
+		}
+		return false;
+	}
 }
diff --git a/lib/private/User/Manager.php b/lib/private/User/Manager.php
index c59cbaa7b20..33744ad7ffe 100644
--- a/lib/private/User/Manager.php
+++ b/lib/private/User/Manager.php
@@ -44,8 +44,7 @@ use OCP\IGroup;
 use OCP\IUser;
 use OCP\IUserBackend;
 use OCP\IUserManager;
-use OCP\Notification\IManager;
-use OCP\Support\Subscription\IRegistry;
+use OCP\Support\Subscription\IAssertion;
 use OCP\User\Backend\IGetRealUIDBackend;
 use OCP\User\Backend\ISearchKnownUsersBackend;
 use OCP\User\Events\BeforeUserCreatedEvent;
@@ -375,19 +374,15 @@ class Manager extends PublicEmitter implements IUserManager {
 	/**
 	 * @param string $uid
 	 * @param string $password
+	 * @return false|IUser the created user or false
 	 * @throws \InvalidArgumentException
-	 * @return bool|IUser the created user or false
+	 * @throws HintException
 	 */
 	public function createUser($uid, $password) {
 		// DI injection is not used here as IRegistry needs the user manager itself for user count and thus it would create a cyclic dependency
-		/** @var IRegistry $registry */
-		$registry = \OC::$server->get(IRegistry::class);
-		/** @var IManager $notificationManager */
-		$notificationManager = \OC::$server->get(IManager::class);
-		if ($registry->delegateIsHardUserLimitReached($notificationManager)) {
-			$l = \OC::$server->getL10N('lib');
-			throw new HintException($l->t('The user limit has been reached and the user was not created.'));
-		}
+		/** @var IAssertion $assertion */
+		$assertion = \OC::$server->get(IAssertion::class);
+		$assertion->createUserIsLegit();
 
 		$localBackends = [];
 		foreach ($this->backends as $backend) {
@@ -415,7 +410,7 @@ class Manager extends PublicEmitter implements IUserManager {
 	 * @param string $uid
 	 * @param string $password
 	 * @param UserInterface $backend
-	 * @return IUser|null
+	 * @return IUser
 	 * @throws \InvalidArgumentException
 	 */
 	public function createUserFromBackend($uid, $password, UserInterface $backend) {
diff --git a/lib/public/Support/Subscription/IAssertion.php b/lib/public/Support/Subscription/IAssertion.php
new file mode 100644
index 00000000000..1ef6a7b7187
--- /dev/null
+++ b/lib/public/Support/Subscription/IAssertion.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2022 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCP\Support\Subscription;
+
+use OCP\HintException;
+
+/**
+ * @since 26.0.0
+ */
+interface IAssertion {
+	/**
+	 * This method throws a localized exception when user limits are exceeded,
+	 * if applicable. Notifications are also created in that case. It is a
+	 * shorthand for a check against IRegistry::delegateIsHardUserLimitReached().
+	 *
+	 * @throws HintException
+	 * @since 26.0.0
+	 */
+	public function createUserIsLegit(): void;
+}