one-time passwords (e.g. for public file shares)

.tx/config

@@ -205,3 +205,9 @@ file_filter = translationfiles/<lang>/workflowengine.po
 source_file = translationfiles/templates/workflowengine.pot
 source_lang = en
 type        = PO
+
+[o:nextcloud:p:nextcloud:r:otp_provider_email]
+file_filter = translationfiles/<lang>/otp_provider_email.po
+source_file = translationfiles/templates/otp_provider_email.pot
+source_lang = en
+type        = PO

AUTHORS

@@ -494,6 +494,7 @@
  - Tobia De Koninck <tobia@ledfan.be>
  - Tobias Assmann <tobias.assmann@ecsec.de>
  - Tobias Kaminsky <tobias@kaminsky.me>
+ - Tobias Knöppler <tobias@knoeppler.org>
  - Tobias Perschon <tobias@perschon.at>
  - Tom Grant <TomG736@users.noreply.github.com>
  - Tom Needham <tom@owncloud.com>

apps/files_sharing/appinfo/routes.php

@@ -3,7 +3,7 @@
 declare(strict_types=1);
 
 /**
- * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016-2026 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
  * SPDX-License-Identifier: AGPL-3.0-only
  */
@@ -53,6 +53,17 @@
 			'url' => '/shareinfo',
 			'verb' => 'POST',
 		],
+		[
+			'name' => 'ShareOTP#request',
+			'url' => '/s/{token}/requestotp',
+			'verb' => 'POST',
+			'root' => '',
+		],
+		[
+			'name' => 'ShareOTP#listProviders',
+			'url' => '/otp-providers',
+			'verb' => 'GET',
+		],
 		[
 			'name' => 'Settings#setDefaultAccept',
 			'url' => '/settings/defaultAccept',

apps/files_sharing/composer/composer/autoload_classmap.php

@@ -41,6 +41,7 @@
     'OCA\\Files_Sharing\\Controller\\ShareAPIController' => $baseDir . '/../lib/Controller/ShareAPIController.php',
     'OCA\\Files_Sharing\\Controller\\ShareController' => $baseDir . '/../lib/Controller/ShareController.php',
     'OCA\\Files_Sharing\\Controller\\ShareInfoController' => $baseDir . '/../lib/Controller/ShareInfoController.php',
+    'OCA\\Files_Sharing\\Controller\\ShareOTPController' => $baseDir . '/../lib/Controller/ShareOTPController.php',
     'OCA\\Files_Sharing\\Controller\\ShareesAPIController' => $baseDir . '/../lib/Controller/ShareesAPIController.php',
     'OCA\\Files_Sharing\\DefaultPublicShareTemplateProvider' => $baseDir . '/../lib/DefaultPublicShareTemplateProvider.php',
     'OCA\\Files_Sharing\\DeleteOrphanedSharesJob' => $baseDir . '/../lib/DeleteOrphanedSharesJob.php',

apps/files_sharing/composer/composer/autoload_static.php

@@ -56,6 +56,7 @@ class ComposerStaticInitFiles_Sharing
         'OCA\\Files_Sharing\\Controller\\ShareAPIController' => __DIR__ . '/..' . '/../lib/Controller/ShareAPIController.php',
         'OCA\\Files_Sharing\\Controller\\ShareController' => __DIR__ . '/..' . '/../lib/Controller/ShareController.php',
         'OCA\\Files_Sharing\\Controller\\ShareInfoController' => __DIR__ . '/..' . '/../lib/Controller/ShareInfoController.php',
+        'OCA\\Files_Sharing\\Controller\\ShareOTPController' => __DIR__ . '/..' . '/../lib/Controller/ShareOTPController.php',
         'OCA\\Files_Sharing\\Controller\\ShareesAPIController' => __DIR__ . '/..' . '/../lib/Controller/ShareesAPIController.php',
         'OCA\\Files_Sharing\\DefaultPublicShareTemplateProvider' => __DIR__ . '/..' . '/../lib/DefaultPublicShareTemplateProvider.php',
         'OCA\\Files_Sharing\\DeleteOrphanedSharesJob' => __DIR__ . '/..' . '/../lib/DeleteOrphanedSharesJob.php',

apps/files_sharing/lib/Controller/ShareAPIController.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 /**
- * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016-2026 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
  * SPDX-License-Identifier: AGPL-3.0-only
  */
@@ -56,6 +56,8 @@
 use OCP\Lock\LockedException;
 use OCP\Mail\IEmailValidator;
 use OCP\Mail\IMailer;
+use OCP\OneTimePassword\Exceptions\OTPProviderNotFoundException;
+use OCP\OneTimePassword\IManager as IOTPManager;
 use OCP\Server;
 use OCP\Share\Exceptions\GenericShareException;
 use OCP\Share\Exceptions\ShareNotFound;
@@ -68,6 +70,7 @@
 use Psr\Container\ContainerExceptionInterface;
 use Psr\Container\ContainerInterface;
 use Psr\Log\LoggerInterface;
+use Random\Randomizer;
 
 /**
  * @package OCA\Files_Sharing\API
@@ -90,6 +93,7 @@ public function __construct(
 		string $appName,
 		IRequest $request,
 		private IManager $shareManager,
+		private IOTPManager $otpManager,
 		private IGroupManager $groupManager,
 		private IUserManager $userManager,
 		private IRootFolder $rootFolder,
@@ -108,6 +112,7 @@ public function __construct(
 		private ITagManager $tagManager,
 		private IEmailValidator $emailValidator,
 		private ?TrustedServers $trustedServers,
+		protected Randomizer $randomizer,
 		private ?string $userId = null,
 	) {
 		parent::__construct($appName, $request);
@@ -341,6 +346,9 @@ protected function formatShare(IShare $share, ?Node $recipientNode = null): arra
 			}
 		}
 
+		$result['otp_provider'] = $share->getOneTimePassword()?->getProviderId();
+		$result['otp_recipient'] = $share->getOneTimePassword()?->getRecipient();
+
 		$result['mail_send'] = $share->getMailSend() ? 1 : 0;
 		$result['hide_download'] = $share->getHideDownload() ? 1 : 0;
 
@@ -582,9 +590,11 @@ public function deleteShare(string $id): DataResponse {
 	 * @param string $label Label for the share (only used in link and email)
 	 * @param string|null $attributes Additional attributes for the share
 	 * @param 'false'|'true'|null $sendMail Send a mail to the recipient
+	 * @param ?string $otpProvider The id of an otp provider (e.g. 'email')
+	 * @param ?string $otpRecipient The identifier of an OTP recipient (e.g. an email address)
 	 *
 	 * @return DataResponse<Http::STATUS_OK, Files_SharingShare, array{}>
-	 * @throws OCSBadRequestException Unknown share type
+	 * @throws OCSBadRequestException Unknown share type or invalid combination of arguments
 	 * @throws OCSException
 	 * @throws OCSForbiddenException Creating the share is not allowed
 	 * @throws OCSNotFoundException Creating the share failed
@@ -607,7 +617,10 @@ public function createShare(
 		string $label = '',
 		?string $attributes = null,
 		?string $sendMail = null,
+		?string $otpProvider = null,
+		?string $otpRecipient = null,
 	): DataResponse {
+
 		assert($this->userId !== null);
 
 		$share = $this->shareManager->newShare();
@@ -729,8 +742,26 @@ public function createShare(
 			$this->validateLinkSharePermissions($node, $permissions, $hasPublicUpload);
 			$share->setPermissions($permissions);
 
-			// Set password
-			if ($password !== '') {
+			if ($otpRecipient !== null && $otpRecipient !== '') {
+				if ($otpProvider === null || $otpProvider === '') {
+					throw new OCSBadRequestException($this->l->t('otpProvider must not be null if otpRecipient is given'));
+				}
+				if ($password !== '') {
+					throw new OCSBadRequestException($this->l->t('otpRecipient and password are mutually exclusive (but both were given)'));
+				}
+				try {
+					$otp = $this->otpManager->createOTP($otpProvider, $otpRecipient);
+				} catch (OTPProviderNotFoundException $e) {
+					$this->logger->debug('Could not update share', ['exception' => $e]);
+					throw new OCSBadRequestException($this->l->t('No OTP provider found for id %s', [$otpProvider]));
+				}
+				$share->setOneTimePassword($otp);
+
+				// When using OTPs we still use the password internally to
+				// store it in the session after successful authentication
+				$password = $this->randomizer->getBytes(32);
+				$share->setPassword($password);
+			} elseif ($password !== '') {
 				$share->setPassword($password);
 			}
 
@@ -1222,6 +1253,8 @@ private function hasPermission(int $permissionsSet, int $permissionsToCheck): bo
 	 *                              You will have to use the sendMail action to send the mail.
 	 * @param string|null $shareWith New recipient for email shares
 	 * @param string|null $token New token
+	 * @param ?string $otpProvider The id of an otp provider (e.g. 'email')
+	 * @param ?string $otpRecipient The identifier of an OTP recipient (e.g. an email address)
 	 * @return DataResponse<Http::STATUS_OK, Files_SharingShare, array{}>
 	 * @throws OCSBadRequestException Share could not be updated because the requested changes are invalid
 	 * @throws OCSForbiddenException Missing permissions to update the share
@@ -1243,6 +1276,8 @@ public function updateShare(
 		?string $attributes = null,
 		?string $sendMail = null,
 		?string $token = null,
+		?string $otpProvider = null,
+		?string $otpRecipient = null,
 	): DataResponse {
 		try {
 			$share = $this->getShareById($id);
@@ -1311,9 +1346,46 @@ public function updateShare(
 				$share->setPermissions($permissions);
 			}
 
-			$passwordParamSent = $password !== null;
-			if ($passwordParamSent) {
-				if ($password === '') {
+			// Reset otp and password if we used an otp previously and don't do anymore
+			if ($otpProvider === '' && $share->getOneTimePassword() !== null) {
+				$this->logger->debug('clearing OTP for share (received empty provider during share update)');
+				$share->setOneTimePassword(null);
+				$share->setPassword(null);
+				$otpProvider = null;
+				$otpRecipient = null;
+			}
+
+			if ($otpRecipient !== null) {
+				$clearOTP = $otpRecipient === '';
+				if (!$clearOTP) {
+					if ($otpProvider === null || $otpProvider === '') {
+						throw new OCSBadRequestException($this->l->t('otpProvider must not be empty if otpRecipient is given'));
+					}
+					if ($password !== '' && $password !== null) {
+						throw new OCSBadRequestException($this->l->t('otpRecipient and password are mutually exclusive (but both were given)'));
+					}
+				}
+				$origOTP = $share->getOneTimePassword();
+				if ($origOTP?->getProviderId() !== $otpProvider || $origOTP?->getRecipient() !== $otpRecipient) {
+					try {
+						$otp = $this->otpManager->createOTP($otpProvider, $otpRecipient);
+					} catch (OTPProviderNotFoundException $e) {
+						$this->logger->warning('Could not update share', ['exception' => $e]);
+						throw new OCSBadRequestException($this->l->t('No OTP provider found for id %s', [$otpProvider]));
+					}
+					$share->setOneTimePassword($otp);
+
+					// When using OTPs we still use the password internally to
+					// store it in the session after successful authentication
+					$password = $this->randomizer->getBytes(32);
+
+					$share->setPassword($password);
+				}
+			} elseif ($password !== null) {
+				if ($share->getOneTimePassword() !== null) {
+					$share->setOneTimePassword(null);
+				}
+				if ($password === '' && $share->getOneTimePassword() !== null) {
 					$share->setPassword(null);
 				} else {
 					$share->setPassword($password);
@@ -2154,11 +2226,14 @@ public function sendShareEmail(string $id, $password = ''): DataResponse {
 				// the password clear, it is just a temporary
 				// object manipulation. The password will stay
 				// encrypted in the database.
-				if ($share->getPassword() !== null && $share->getPassword() !== $password) {
+				if (($share->getPassword() !== null && $share->getPassword() !== $password) || ($share->getOneTimePassword() !== null)) {
 					if (!$this->shareManager->checkPassword($share, $password)) {
 						throw new OCSBadRequestException($this->l->t('Wrong password'));
 					}
-					$share = $share->setPassword($password);
+					$share->setPassword($password);
+					if ($password !== null && $password !== '') {
+						$share->setOneTimePassword(null);
+					}
 				}
 
 				$provider->sendMailNotification($share);

apps/files_sharing/lib/Controller/ShareController.php

@@ -40,6 +40,8 @@
 use OCP\ISession;
 use OCP\IURLGenerator;
 use OCP\IUserManager;
+use OCP\OneTimePassword\Exceptions\OTPProviderNotFoundException;
+use OCP\OneTimePassword\IManager as IOTPManager;
 use OCP\Security\Events\GenerateSecurePasswordEvent;
 use OCP\Security\ISecureRandom;
 use OCP\Security\PasswordContext;
@@ -78,10 +80,31 @@ public function __construct(
 		protected ISecureRandom $secureRandom,
 		protected Defaults $defaults,
 		private IPublicShareTemplateFactory $publicShareTemplateFactory,
+		private IOTPManager $otpManager,
 	) {
 		parent::__construct($appName, $request, $session, $urlGenerator);
 	}
 
+	/**
+	 * @return null|string[]
+	 * @throws OTPProviderNotFoundException
+	 *
+	 * @psalm-return array{name: string, description: string, recipientPattern: string, maskedRecipient: string}|null
+	 */
+	private function getOtpProviderInfo(): ?array {
+		if ($this->share->getOneTimePassword() === null) {
+			return null;
+		}
+
+		$otpProvider = $this->otpManager->getOTPProviderById($this->share->getOneTimePassword()->getProviderId());
+		return [
+			'name' => $otpProvider->getName(),
+			'description' => $otpProvider->getDescription(),
+			'recipientPattern' => $otpProvider->getRecipientPattern(),
+			'maskedRecipient' => $otpProvider->maskRecipient($this->share->getOneTimePassword()->getRecipient()),
+		];
+	}
+
 	/**
 	 * Show the authentication page
 	 * The form has to submit to the authenticate method route
@@ -90,7 +113,15 @@ public function __construct(
 	#[PublicPage]
 	#[NoCSRFRequired]
 	public function showAuthenticate(): TemplateResponse {
-		$templateParameters = ['share' => $this->share];
+		try {
+			$otpInfo = $this->getOtpProviderInfo();
+		} catch (OTPProviderNotFoundException $e) {
+			return new TemplateResponse('core', 'error', ['errors' => [[
+				'error' => $this->l10n->t('This share requires a one-time password, but the configured one-time password provider \'%s\' could not be found (it might be disabled).', [$this->share->getOneTimePassword()->getProviderId()]),
+				'hint' => $this->l10n->t('Please request a new share link or contact your administrator.')
+			]]], 'guest');
+		}
+		$templateParameters = ['share' => $this->share, 'otpInfo' => $otpInfo];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -102,7 +133,16 @@ public function showAuthenticate(): TemplateResponse {
 	 */
 	#[\Override]
 	protected function showAuthFailed(): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'wrongpw' => true];
+		try {
+			$otpInfo = $this->getOtpProviderInfo();
+		} catch (OTPProviderNotFoundException $e) {
+			return new TemplateResponse('core', 'error', ['errors' => [[
+				'error' => $this->l10n->t('This share requires a one-time password, but the configured one-time password provider \'%s\' could not be found (it might be disabled).', [$this->share->getOneTimePassword()->getProviderId()]),
+				'hint' => $this->l10n->t('Please request a new share link or contact your administrator.')
+			]]], 'guest');
+		}
+
+		$templateParameters = ['share' => $this->share, 'wrongpw' => true, 'otpInfo' => $otpInfo];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -114,7 +154,16 @@ protected function showAuthFailed(): TemplateResponse {
 	 */
 	#[\Override]
 	protected function showIdentificationResult(bool $success = false): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'identityOk' => $success];
+		try {
+			$otpInfo = $this->getOtpProviderInfo();
+		} catch (OTPProviderNotFoundException $e) {
+			return new TemplateResponse('core', 'error', ['errors' => [[
+				'error' => $this->l10n->t('This share requires a one-time password, but the configured one-time password provider \'%s\' could not be found (it might be disabled).', [$this->share->getOneTimePassword()->getProviderId()]),
+				'hint' => $this->l10n->t('Please request a new share link or contact your administrator.')
+			]]], 'guest');
+		}
+
+		$templateParameters = ['share' => $this->share, 'identityOk' => $success, 'otpInfo' => $otpInfo];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -191,6 +240,12 @@ protected function authSucceeded() {
 			$allowedShareIds = [];
 		}
 
+		$otp = $this->share->getOneTimePassword();
+		if ($otp !== null) {
+			$otp->setPassword(null);
+			$this->otpManager->updateOTP($otp);
+		}
+
 		$this->session->set(PublicAuth::DAV_AUTHENTICATED, array_merge($allowedShareIds, [$this->share->getId()]));
 	}