[backend] Support one-time passwords (e.g. for public file shares)

apps/dav/lib/Connector/LegacyPublicAuth.php

@@ -67,7 +67,7 @@ protected function validateUserPass($username, $password) {
 		\OC_User::setIncognitoMode(true);
 
 		// check if the share is password protected
-		if ($share->getPassword() !== null) {
+		if ($share->isPasswordProtected()) {
 			if ($share->getShareType() === IShare::TYPE_LINK
 				|| $share->getShareType() === IShare::TYPE_EMAIL
 				|| $share->getShareType() === IShare::TYPE_CIRCLE) {

apps/dav/lib/Connector/Sabre/PublicAuth.php

@@ -63,7 +63,7 @@ public function check(RequestInterface $request, ResponseInterface $response): a
 		try {
 			$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
 
-			if (count($_COOKIE) > 0 && !$this->request->passesStrictCookieCheck() && $this->getShare()->getPassword() !== null) {
+			if (count($_COOKIE) > 0 && !$this->request->passesStrictCookieCheck() && $this->getShare()->isPasswordProtected()) {
 				throw new PreconditionFailed('Strict cookie check failed');
 			}
 
@@ -142,7 +142,7 @@ private function checkToken(): array {
 		}
 
 		// If the share is protected but user is not authenticated
-		if ($share->getPassword() !== null) {
+		if ($share->isPasswordProtected()) {
 			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
 			throw new NotAuthenticated();
 		}
@@ -176,7 +176,7 @@ protected function validateUserPass($username, $password) {
 		\OC_User::setIncognitoMode(true);
 
 		// check if the share is password protected
-		if ($share->getPassword() !== null) {
+		if ($share->isPasswordProtected()) {
 			if ($share->getShareType() === IShare::TYPE_LINK
 				|| $share->getShareType() === IShare::TYPE_EMAIL
 				|| $share->getShareType() === IShare::TYPE_CIRCLE) {

apps/federatedfilesharing/lib/Controller/MountPublicLinkController.php

@@ -98,8 +98,7 @@ public function createFederatedShare($shareWith, $token, $password = '') {
 		$authenticated = in_array($share->getId(), $allowedShareIds)
 			|| $this->shareManager->checkPassword($share, $password);
 
-		$storedPassword = $share->getPassword();
-		if (!empty($storedPassword) && !$authenticated) {
+		if ($share->isPasswordProtected() && !$authenticated) {
 			$response = new JSONResponse(
 				['message' => 'No permission to access the share'],
 				Http::STATUS_BAD_REQUEST

apps/files_sharing/appinfo/routes.php

@@ -53,6 +53,12 @@
 			'url' => '/shareinfo',
 			'verb' => 'POST',
 		],
+		[
+			'name' => 'ShareOTP#request',
+			'url' => '/s/{token}/requestotp',
+			'verb' => 'GET',
+			'root' => '',
+		],
 		[
 			'name' => 'Settings#setDefaultAccept',
 			'url' => '/settings/defaultAccept',

apps/files_sharing/composer/composer/autoload_classmap.php

@@ -41,6 +41,7 @@
     'OCA\\Files_Sharing\\Controller\\ShareController' => $baseDir . '/../lib/Controller/ShareController.php',
     'OCA\\Files_Sharing\\Controller\\ShareInfoController' => $baseDir . '/../lib/Controller/ShareInfoController.php',
     'OCA\\Files_Sharing\\Controller\\ShareesAPIController' => $baseDir . '/../lib/Controller/ShareesAPIController.php',
+    'OCA\\Files_Sharing\\Controller\\ShareOTPController' => $baseDir . '/../lib/Controller/ShareOTPController.php',
     'OCA\\Files_Sharing\\DefaultPublicShareTemplateProvider' => $baseDir . '/../lib/DefaultPublicShareTemplateProvider.php',
     'OCA\\Files_Sharing\\DeleteOrphanedSharesJob' => $baseDir . '/../lib/DeleteOrphanedSharesJob.php',
     'OCA\\Files_Sharing\\Event\\BeforeTemplateRenderedEvent' => $baseDir . '/../lib/Event/BeforeTemplateRenderedEvent.php',
@@ -91,6 +92,7 @@
     'OCA\\Files_Sharing\\Migration\\Version33000Date20251030081948' => $baseDir . '/../lib/Migration/Version33000Date20251030081948.php',
     'OCA\\Files_Sharing\\Migration\\Version33000Date20260306120000' => $baseDir . '/../lib/Migration/Version33000Date20260306120000.php',
     'OCA\\Files_Sharing\\Migration\\Version33000Date20260306150000' => $baseDir . '/../lib/Migration/Version33000Date20260306150000.php',
+    'OCA\\Files_Sharing\\Migration\\Version35000Date20260624183500' => $baseDir . '/../lib/Migration/Version35000Date20260624183500.php',
     'OCA\\Files_Sharing\\MountProvider' => $baseDir . '/../lib/MountProvider.php',
     'OCA\\Files_Sharing\\Notification\\Listener' => $baseDir . '/../lib/Notification/Listener.php',
     'OCA\\Files_Sharing\\Notification\\Notifier' => $baseDir . '/../lib/Notification/Notifier.php',

apps/files_sharing/composer/composer/autoload_static.php

@@ -56,6 +56,7 @@ class ComposerStaticInitFiles_Sharing
         'OCA\\Files_Sharing\\Controller\\ShareController' => __DIR__ . '/..' . '/../lib/Controller/ShareController.php',
         'OCA\\Files_Sharing\\Controller\\ShareInfoController' => __DIR__ . '/..' . '/../lib/Controller/ShareInfoController.php',
         'OCA\\Files_Sharing\\Controller\\ShareesAPIController' => __DIR__ . '/..' . '/../lib/Controller/ShareesAPIController.php',
+        'OCA\\Files_Sharing\\Controller\\ShareOTPController' => __DIR__ . '/..' . '/../lib/Controller/ShareOTPController.php',
         'OCA\\Files_Sharing\\DefaultPublicShareTemplateProvider' => __DIR__ . '/..' . '/../lib/DefaultPublicShareTemplateProvider.php',
         'OCA\\Files_Sharing\\DeleteOrphanedSharesJob' => __DIR__ . '/..' . '/../lib/DeleteOrphanedSharesJob.php',
         'OCA\\Files_Sharing\\Event\\BeforeTemplateRenderedEvent' => __DIR__ . '/..' . '/../lib/Event/BeforeTemplateRenderedEvent.php',
@@ -106,6 +107,7 @@ class ComposerStaticInitFiles_Sharing
         'OCA\\Files_Sharing\\Migration\\Version33000Date20251030081948' => __DIR__ . '/..' . '/../lib/Migration/Version33000Date20251030081948.php',
         'OCA\\Files_Sharing\\Migration\\Version33000Date20260306120000' => __DIR__ . '/..' . '/../lib/Migration/Version33000Date20260306120000.php',
         'OCA\\Files_Sharing\\Migration\\Version33000Date20260306150000' => __DIR__ . '/..' . '/../lib/Migration/Version33000Date20260306150000.php',
+        'OCA\\Files_Sharing\\Migration\\Version35000Date20260624183500' => __DIR__ . '/..' . '/../lib/Migration/Version35000Date20260624183500.php',
         'OCA\\Files_Sharing\\MountProvider' => __DIR__ . '/..' . '/../lib/MountProvider.php',
         'OCA\\Files_Sharing\\Notification\\Listener' => __DIR__ . '/..' . '/../lib/Notification/Listener.php',
         'OCA\\Files_Sharing\\Notification\\Notifier' => __DIR__ . '/..' . '/../lib/Notification/Notifier.php',

apps/files_sharing/lib/Controller/PublicPreviewController.php

@@ -60,7 +60,7 @@ public function isValidToken(): bool {
 
 	#[\Override]
 	protected function isPasswordProtected(): bool {
-		return $this->share->getPassword() !== null;
+		return $this->share->isPasswordProtected();
 	}
 
 	/**
@@ -181,7 +181,7 @@ public function directLink(string $token) {
 		}
 
 		// Password protected shares have no direct link!
-		if ($share->getPassword() !== null) {
+		if ($share->isPasswordProtected()) {
 			return new DataResponse([], Http::STATUS_FORBIDDEN);
 		}
 

apps/files_sharing/lib/Controller/ShareAPIController.php

@@ -57,6 +57,8 @@
 use OCP\Lock\LockedException;
 use OCP\Mail\IEmailValidator;
 use OCP\Mail\IMailer;
+use OCP\OneTimePassword\IManager as IOTPManager;
+use OCP\Security\ISecureRandom;
 use OCP\Server;
 use OCP\Share\Exceptions\GenericShareException;
 use OCP\Share\Exceptions\ShareNotFound;
@@ -91,6 +93,7 @@ public function __construct(
 		string $appName,
 		IRequest $request,
 		private IManager $shareManager,
+		private IOTPManager $otpManager,
 		private IGroupManager $groupManager,
 		private IUserManager $userManager,
 		private IRootFolder $rootFolder,
@@ -109,6 +112,7 @@ public function __construct(
 		private ITagManager $tagManager,
 		private IEmailValidator $emailValidator,
 		private ?TrustedServers $trustedServers,
+		protected ISecureRandom $secureRandom,
 		private ?string $userId = null,
 	) {
 		parent::__construct($appName, $request);
@@ -342,6 +346,9 @@ protected function formatShare(IShare $share, ?Node $recipientNode = null): arra
 			}
 		}
 
+		$result['otp_provider'] = $share->getOneTimePassword()?->getProviderId();
+		$result['otp_recipient'] = $share->getOneTimePassword()?->getRecipient();
+
 		$result['mail_send'] = $share->getMailSend() ? 1 : 0;
 		$result['hide_download'] = $share->getHideDownload() ? 1 : 0;
 
@@ -583,9 +590,11 @@ public function deleteShare(string $id): DataResponse {
 	 * @param string $label Label for the share (only used in link and email)
 	 * @param string|null $attributes Additional attributes for the share
 	 * @param 'false'|'true'|null $sendMail Send a mail to the recipient
+	 * @param ?string $otpProvider
+	 * @param ?string $otpRecipient
 	 *
 	 * @return DataResponse<Http::STATUS_OK, Files_SharingShare, array{}>
-	 * @throws OCSBadRequestException Unknown share type
+	 * @throws OCSBadRequestException Unknown share type or invalid combination of arguments
 	 * @throws OCSException
 	 * @throws OCSForbiddenException Creating the share is not allowed
 	 * @throws OCSNotFoundException Creating the share failed
@@ -608,6 +617,8 @@ public function createShare(
 		string $label = '',
 		?string $attributes = null,
 		?string $sendMail = null,
+		?string $otpProvider = null,
+		?string $otpRecipient = null,
 	): DataResponse {
 		assert($this->userId !== null);
 
@@ -736,11 +747,24 @@ public function createShare(
 				throw new OCSNotFoundException($this->l->t('Public link sharing is disabled by the administrator'));
 			}
 
-			$this->validateLinkSharePermissions($node, $permissions, $hasPublicUpload);
+			$this->validateLinkSharePermissions($node, $permissions, $hasPublicUpload, $otpRecipient !== null);
 			$share->setPermissions($permissions);
 
-			// Set password
-			if ($password !== '') {
+			if ($otpRecipient !== null) {
+				if ($otpProvider === null) {
+					throw new OCSBadRequestException($this->l->t('otpProvider must not be null if otpRecipient is given'));
+				}
+				if ($password !== '') {
+					throw new OCSBadRequestException($this->l->t('otpRecipient and password are mutually exclusive (but both were given)'));
+				}
+				$otp = $this->otpManager->createOTP($otpProvider, $otpRecipient);
+				$share->setOneTimePassword($otp);
+
+				// When using OTPs we still use the password internally to
+				// store it in the session after successful authentication
+				$password = $this->secureRandom->generate(32);
+				$share->setPassword($password);
+			} elseif ($password !== '') {
 				$share->setPassword($password);
 			}
 
@@ -1267,6 +1291,8 @@ public function updateShare(
 		?string $attributes = null,
 		?string $sendMail = null,
 		?string $token = null,
+		?string $otpProvider = null,
+		?string $otpRecipient = null,
 	): DataResponse {
 		try {
 			$share = $this->getShareById($id);
@@ -1335,9 +1361,29 @@ public function updateShare(
 				$share->setPermissions($permissions);
 			}
 
-			$passwordParamSent = $password !== null;
-			if ($passwordParamSent) {
-				if ($password === '') {
+			if ($otpRecipient !== null) {
+				if ($otpProvider === null) {
+					throw new OCSBadRequestException($this->l->t('otpProvider must not be null if otpRecipient is given'));
+				}
+				if ($password !== '' && $password !== null) {
+					throw new OCSBadRequestException($this->l->t('otpRecipient and password are mutually exclusive (but both were given)'));
+				}
+				$origOTP = $share->getOneTimePassword();
+				if ($origOTP->getProviderId() !== $otpProvider || $origOTP->getRecipient() !== $otpRecipient) {
+					$otp = $this->otpManager->createOTP($otpProvider, $otpRecipient);
+					$share->setOneTimePassword($otp);
+
+					// When using OTPs we still use the password internally to
+					// store it in the session after successful authentication
+					$password = $this->secureRandom->generate(32);
+					$share->setPassword($password);
+				}
+			} elseif ($password !== null) {
+				if ($share->getOneTimePassword() !== null) {
+					$deleteOtpId = $share->getOneTimePassword()->getId();
+					$share->setOneTimePassword(null);
+				}
+				if ($password === '' && $share->getOneTimePassword() !== null) {
 					$share->setPassword(null);
 				} else {
 					$share->setPassword($password);
@@ -2178,11 +2224,14 @@ public function sendShareEmail(string $id, $password = ''): DataResponse {
 				// the password clear, it is just a temporary
 				// object manipulation. The password will stay
 				// encrypted in the database.
-				if ($share->getPassword() !== null && $share->getPassword() !== $password) {
+				if (($share->getPassword() !== null && $share->getPassword() !== $password) || ($share->getOneTimePassword() !== null)) {
 					if (!$this->shareManager->checkPassword($share, $password)) {
 						throw new OCSBadRequestException($this->l->t('Wrong password'));
 					}
-					$share = $share->setPassword($password);
+					$share->setPassword($password);
+					if ($password !== null && $password !== '') {
+						$share->setOneTimePassword(null);
+					}
 				}
 
 				$provider->sendMailNotification($share);

apps/files_sharing/lib/Controller/ShareController.php

@@ -40,6 +40,7 @@
 use OCP\ISession;
 use OCP\IURLGenerator;
 use OCP\IUserManager;
+use OCP\OneTimePassword\IManager as IOTPManager;
 use OCP\Security\Events\GenerateSecurePasswordEvent;
 use OCP\Security\ISecureRandom;
 use OCP\Security\PasswordContext;
@@ -78,10 +79,33 @@ public function __construct(
 		protected ISecureRandom $secureRandom,
 		protected Defaults $defaults,
 		private IPublicShareTemplateFactory $publicShareTemplateFactory,
+		private IOTPManager $otpManager,
 	) {
 		parent::__construct($appName, $request, $session, $urlGenerator);
 	}
 
+	/**
+	 * @return null|string[]
+	 *
+	 * @psalm-return array{name: string, description: string, recipientPattern: string, maskedRecipient: string}|null
+	 */
+	private function getOtpProviderInfo(): ?array {
+		$otpProvider = null;
+		$otpProviderInfo = null;
+		if ($this->share->getOneTimePassword() !== null) {
+			$otpProvider = $this->otpManager->getOTPProviderById($this->share->getOneTimePassword()->getProviderId());
+		}
+		if ($otpProvider !== null) {
+			$otpProviderInfo = [
+				'name' => $otpProvider->getName(),
+				'description' => $otpProvider->getDescription(),
+				'recipientPattern' => $otpProvider->getRecipientPattern(),
+				'maskedRecipient' => $otpProvider->maskRecipient($this->share->getOneTimePassword()->getRecipient()),
+			];
+		}
+		return $otpProviderInfo;
+	}
+
 	/**
 	 * Show the authentication page
 	 * The form has to submit to the authenticate method route
@@ -90,7 +114,7 @@ public function __construct(
 	#[PublicPage]
 	#[NoCSRFRequired]
 	public function showAuthenticate(): TemplateResponse {
-		$templateParameters = ['share' => $this->share];
+		$templateParameters = ['share' => $this->share, 'otpInfo' => $this->getOtpProviderInfo()];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -102,7 +126,7 @@ public function showAuthenticate(): TemplateResponse {
 	 */
 	#[\Override]
 	protected function showAuthFailed(): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'wrongpw' => true];
+		$templateParameters = ['share' => $this->share, 'wrongpw' => true, 'otpInfo' => $this->getOtpProviderInfo()];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -114,7 +138,7 @@ protected function showAuthFailed(): TemplateResponse {
 	 */
 	#[\Override]
 	protected function showIdentificationResult(bool $success = false): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'identityOk' => $success];
+		$templateParameters = ['share' => $this->share, 'identityOk' => $success, 'otpInfo' => $this->getOtpProviderInfo()];
 
 		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
 
@@ -176,7 +200,7 @@ public function isValidToken(): bool {
 
 	#[\Override]
 	protected function isPasswordProtected(): bool {
-		return $this->share->getPassword() !== null;
+		return $this->share->isPasswordProtected();
 	}
 
 	#[\Override]
@@ -191,6 +215,12 @@ protected function authSucceeded() {
 			$allowedShareIds = [];
 		}
 
+		$otp = $this->share->getOneTimePassword();
+		if ($otp !== null) {
+			$otp->setPassword(null);
+			$this->otpManager->updateOTP($otp);
+		}
+
 		$this->session->set(PublicAuth::DAV_AUTHENTICATED, array_merge($allowedShareIds, [$this->share->getId()]));
 	}
 

apps/files_sharing/lib/Controller/ShareInfoController.php

@@ -70,7 +70,7 @@ public function info(string $t, ?string $password = null, ?string $dir = null, i
 			return $response;
 		}
 
-		if ($share->getPassword() && !$this->shareManager->checkPassword($share, $password)) {
+		if ($share->isPasswordProtected() && !$this->shareManager->checkPassword($share, $password)) {
 			$response = new JSONResponse([], Http::STATUS_FORBIDDEN);
 			$response->throttle(['token' => $t]);
 			return $response;