Release: merge development into beta

.gitattributes

@@ -15,6 +15,14 @@ bin/console text eol=lf
 *.ico binary
 *.png binary
 
+# 🔴 THE VENDORED OMG BPMN SCHEMA SET IS BYTE-PINNED, SO GIT MUST NOT TOUCH IT.
+# The five files ship with CRLF endings exactly as omg.org serves them, and
+# `* text=auto eol=lf` above would rewrite every line on checkout: the files on
+# disk would then no longer hash to the SHA-256 sums recorded in
+# schema/PROVENANCE.md, which is both a failing provenance test and, more to
+# the point, a modified copy of a specification we said we had not modified.
+lib/Service/Flow/Bpmn/schema/*.xsd -text
+
 .github export-ignore
 .travis.yml export-ignore
 LICENSE export-ignore

.github/workflows/code-quality.yml

@@ -260,6 +260,61 @@ jobs:
       # mis-parse it. Path is relative to `server/`, which the step cd's into.
       playwright-seed-command: bash apps/openregister/tests/e2e/ci/seed.sh
       enable-coverage-guard: true
+      # ── Licensing ────────────────────────────────────────────────────────
+      # REUSE findings fail the build. The shared workflow defaults this OFF
+      # because most fleet apps ship no REUSE.toml or LICENSES/ directory. This
+      # repo ships both since WOO-579 (2026-09-17): a repo-wide `path = "**"` /
+      # `precedence = "closest"` floor in REUSE.toml makes every new file
+      # compliant on arrival whatever its type, and every piece of third-party
+      # material the repo bundles is annotated to what its publisher says, in
+      # `override` blocks that name the source. No enumeration of them here on
+      # purpose: the list written here first went stale inside the very pull
+      # request that wrote it, when review found five more clusters. REUSE.toml
+      # is the list, one commented block each. Measured before flipping:
+      # `reuse lint` compliant, 0 missing licences, 0 unused.
+      #
+      # Before this the REUSE row in the Quality Report was ❌ on every PR while
+      # the job itself reported success (`continue-on-error`), so nobody was
+      # blocked and nobody looked. Remko Huisman asked on portaliq (WOO-575) for
+      # the fleet to stop shipping that shape; this is the same change here.
+      #
+      # REUSE-IgnoreStart
+      # TWO regression modes remain. Measured on this branch, against the exact
+      # image the action runs (fsfe/reuse-action@v5 is FROM fsfe/reuse:5), and
+      # against fsfe/reuse:6 to see what the next bump brings.
+      #
+      # 1. Vendoring a file whose own SPDX header names a licence with no text
+      #    under LICENSES/. Red build on reuse 5 and 6 alike. The fix is
+      #    `reuse download <id>`, never removing the header.
+      #
+      # 2. A tracked TEXT file that MENTIONS an SPDX licence tag in prose —
+      #    reuse parses the rest of the line as the licence expression. This PR
+      #    tripped over it on an archived tasks.md that quoted a tag while
+      #    describing the work. What it costs depends on the reuse major:
+      #      reuse 5 (what CI runs today): a stderr ERROR, the file is skipped,
+      #        the blanket then supplies its licensing info, lint still exits 0.
+      #        Latent, not blocking. Verified by reproducing it on this branch.
+      #      reuse 6 (fsfe/reuse-action@v6 exists; the day the shared workflow
+      #        bumps): first-class non-compliance, "Invalid SPDX License
+      #        Expressions: N", red build. Verified the same way.
+      #    Both majors NAME the offending file in the error, so this is
+      #    diagnosable; run `docker run --rm -v "$PWD":/data fsfe/reuse:6 lint`
+      #    locally to see it before CI does.
+      #    Fix: reuse's own ignore markers around the quoted tag — which is
+      #    why this comment block sits between a pair of them. Their two names
+      #    are deliberately not written out again anywhere inside the block:
+      #    reuse matches the literal strings non-greedily, so a prose mention
+      #    of the closing one ENDS the region at that line and leaves the rest
+      #    of the block unprotected. That is a real trap — the first draft of
+      #    this comment had exactly that shape.
+      #    For openspec/changes/archive/**, which the repo treats as immutable
+      #    history, REUSE.toml carries a `precedence = "override"` block
+      #    instead, so nothing there is read for tags at all.
+      #
+      # This branch is compliant under BOTH majors, so the v6 bump will not
+      # land as a surprise red build here.
+      # REUSE-IgnoreEnd
+      reuse-blocking: true
       # Run the Hydra mechanical quality gates against this PR's diff.
       #
       # This tier has never executed in this repository. `enable-hydra-gates`
@@ -407,10 +462,9 @@ jobs:
       # call in src/, while `test:l10n:parity` asks whether every locale matches
       # en.js key-for-key. One passing tells you nothing about the other.
       #
-      # `check:l10n-js` is a THIRD question again: whether the generated browser
-      # catalogues (l10n/*.js) are in step with their .json sources. Both sides
-      # of this merge added one of these; neither replaces the other.
-      frontend-checks: '["check:specs", "test:l10n", "test:l10n:parity", "format", "check:schema-l10n", "check:l10n-js"]'
+      # There is no .js/.json parity leg: l10n/*.js is the browser catalogue and
+      # l10n/*.json the PHP one, separate sets with separate consumers.
+      frontend-checks: '["check:specs", "test:l10n", "test:l10n:parity", "format", "check:schema-l10n"]'
       # ── Cost controls (see ConductionNL/.github#596, #599) ───────────────
       #
       # The fleet's CI was not slow, it was QUEUED. A Code Quality run does

.gitignore

@@ -141,3 +141,7 @@ scripts/l10n/harvest-*.json
 .phpunit.result.cache
 test-results/
 playwright-report/
+
+# Python bytecode caches (a .pyc was once committed by accident, WOO-579)
+__pycache__/
+*.pyc

CHANGELOG.md

@@ -66,6 +66,8 @@
 - **`@self.files` on rendered objects is now opt-in for full file metadata.** By default, `@self.files` is a lightweight list of integer file IDs (`[123, 456, 789]`). Consumers that need full file metadata (`id`, `path`, `title`, `accessUrl`, `downloadUrl`, `type`, `extension`, `size`, `hash`, `published`, `modified`, `labels`) MUST add `_extend[]=@self.files` (or the equivalent shorthand `_extend[]=_files`) to their request. The change applies to **every** consumer of OpenRegister's render output, including `show` endpoints in dependent apps (e.g. opencatalogi `/publications/{catalogSlug}/{id}`). Migration is a one-line query parameter addition. The previous behavior — full metadata always served on show, no metadata on list — caused asymmetric responses across endpoints and paid the file-lookup cost on every show response regardless of need. The new contract is symmetric across show and list endpoints (both emit `@self.files` as IDs by default; both accept `_extend[]=@self.files` for full metadata) and is documented under the `files-render-extension` capability. **Note:** Using `_extend[]=@self.files` (or `_files`) on **list** endpoints is heavily discouraged because it triggers per-row file/tag lookups (N+1 queries scaling with page size) and will result in degraded performance. Use it only when full file metadata is genuinely required for every row. **SOLR limitation:** on SOLR/index-backed list endpoints, `_extend[]=@self.files` is not yet supported; the lightweight ID list is always returned and the response carries `@self.extend_unsupported: ["@self.files"]` so consumers can detect the mismatch programmatically. Use the database-backed path when full file metadata is required on lists.
 
 ### Fixed
+- **Starting an OAuth2 connection works again, and each refusal answers with its own status.** `POST /api/credentials/oauth2/start` answered 500 on PostgreSQL and strict MySQL, because the pending state's vault key (71 characters) did not fit `oc_storages_credentials.identifier` (64); the nonce is now 32 characters, so the key is 60. A refusal now answers 400, 403, 409 (no OAuth2 client configured on this server) or 502 (a per-instance provider's server would not register a client), and only a genuine fault answers 500. A start that fails after minting a Mastodon client credential, or after storing its pending state, removes both again. **Upgrade note:** every Mastodon start made before this fix registered an application at the account's server and minted a local `generic-oauth2` credential ("OAuth2 client for https://…") before it failed, so affected users may find stray client credentials in their list, one per attempt. On PostgreSQL and strict MySQL none of those starts completed, so they are safe to delete. On a database that does not enforce the column length (SQLite), a start could complete, so delete such a client credential only when no Mastodon connection uses it as its `clientCredentialRef`. The matching applications at the Mastodon server were never authorised by the user, so they hold no access to the account.
+- **Rotating a secret with `PUT /api/credentials/{id}` no longer leaves a half-applied update.** A rotated secret is now written before the metadata, so a failed rotation changes nothing. A `name` longer than 255 characters or an `allowedApps` entry longer than 64 now answers 400 `Invalid credential request` before anything is written, where it used to answer 500 after the save refused it. When the metadata cannot be saved after a rotation, the 500 now says `The secret was rotated, but the other changes could not be saved` rather than `Unable to update credential`, so a client must not read every 500 from this endpoint as "nothing changed".
 - **Verified JSON object-typed property key order survives the PUT/create write path (#1720).** Traced the full write path (`ObjectsController::update` → `ObjectService::saveObject` → `SaveObject::prepareObjectForUpdate`/`prepareObjectForCreation` → `MagicMapper::prepareObjectDataForTable`/`rowToObjectEntity`): no PHP-layer reordering step exists (`setDefaultValues()` merges submitted keys first, defaults appended after; nothing applies `ksort` or rebuilds an object-typed value from schema-declared property order). The storage-layer cause of #1720 (PostgreSQL JSONB hashing object-typed columns) was already closed by the `json_ordered` column-type fix. Added `SaveObjectKeyOrderPreserveTest` (4 tests) locking in the drag-reorder round-trip and the PUT-semantic sibling-field guard through the real write path, alongside the pre-existing `MagicMapperKeyOrderColumnTypeTest`. (`put-preserve-key-order`)
 - **Strict PDF anonymisation no longer fails on case-variant text and now redacts line-wrapped entities.** Three related fixes diagnosed on a Dutch government letter fixture: (1) `DocumentProcessingHandler::anonymizeDocument` orders the substitution map longest-needle-first so overlapping entities cannot clobber each other (a bare `Amsterdam` LOCATION no longer rewrites `De gemeente Amsterdam` before the longer `gemeente Amsterdam` needle matches, which left the longer entity unmatched and mis-typed). (2) `PdfTextReplacer::validateOutput` is now case-SENSITIVE (`mb_strpos`, mirroring the replacement engine's exact-case guarantee — previously a lowercase URL fragment like `www.amsterdam.nl`, never a detected entity, tripped the case-insensitive probe and failed fully-anonymised documents closed with `REASON_VALIDATION_FAILED`) and whitespace-normalised (both the re-extracted text and each needle are collapsed to single spaces, so entity text the PDF splits across a line break — `14 mei` / `2026` — is detected as residual instead of silently leaking). (3) The `ddn/sapp` pin is bumped to the cross-line-matching commit (Phase 4, Conduction/sapp PR #1) so wrapped entities are actually replaced: vertically adjacent same-font blocks are paired and matched across the wrap, giving the wrapped date its own placeholder. The dev-branch pin is temporary — re-pinning to a tagged sapp release is tracked in #69. On invalid UTF-8 from the re-extraction (the encoding-edge SAPP runs tracked by `font_encoding_misses`/`cid_split_mismatch`), strict mode now fails CLOSED (`validate.normalise`) instead of silently passing unaudited output; lenient mode falls back to un-normalised probing. Verified end-to-end through the DocuDesk anonymise flow: all 34 entities replaced, `unmatchedEntities: []`, strict validation passes. (#65)
 - **Magic-table read path now coerces every property to its schema-declared PHP type.** Previously only `string` properties were coerced (and even then over-eagerly JSON-decoded scalar JSON like `"true"` / `"123"`); `boolean`, `integer`, `number`, `array`, and `object` properties were returned with whatever type the database driver produced — most visibly, booleans came back as `int 0`/`1` on MariaDB. A new shared `Service\Object\SchemaTypeConverter` is now the single source of truth for both `MagicStatisticsHandler::convertRowToObjectEntity` (single-object / list / POST / PUT response paths) and `MagicSearchHandler::convertRowToObjectEntity` (search path). Every endpoint that returns an `ObjectEntity` (`GET /api/objects/<uuid>`, `GET /api/objects`, `GET /api/search`, `POST /api/objects`, `PUT /api/objects/<uuid>`) now produces consistently schema-typed JSON. **Consumer-impact note:** consumers that depended on the broken behaviour (e.g. JS `value === 1` for "true") must switch to native truthy checks; OpenConnector register-backed sync flows and frontend widgets now receive correctly-typed values automatically. (`fix-magic-table-type-coercion`)

CONTRIBUTING.md

@@ -130,6 +130,7 @@ Every pull request triggers our automated quality pipeline. **All checks must pa
 | ----------------------------- | ---------------------------------------------------------- |
 | **License (npm + composer)**  | Ensures all dependencies use approved open-source licenses |
 | **Security (npm + composer)** | Checks for known vulnerabilities in dependencies           |
+| **REUSE compliance**          | Every file has copyright + licence info, and every licence it names has a text under `LICENSES/`. **Blocking** — a red REUSE check fails the build |
 
 ### Running Quality Checks Locally
 
@@ -144,8 +145,45 @@ composer phpmd             # PHPMD mess detection
 # Frontend
 npm run lint               # ESLint
 npx stylelint "src/**/*.{css,scss,vue}"  # Stylelint
+
+# Licensing (same tool CI runs)
+docker run --rm -v "$PWD":/data fsfe/reuse:5 lint
 ```
 
+### Licensing (REUSE)
+
+`REUSE.toml` in the repository root declares copyright and licence for every
+file. Most files are covered by a blanket entry; third-party material gets its
+own block naming the publisher. New files normally need nothing — PHP files keep
+carrying their own SPDX header, and everything else falls under the blanket.
+
+If the REUSE check goes red, it is almost always one of three things:
+
+1. **A file names a licence that has no text under `LICENSES/`.** Add it:
+
+   ```bash
+   docker run --rm -v "$PWD":/data fsfe/reuse:5 download MIT
+   ```
+
+2. **You added third-party material.** Add an `[[annotations]]` block to
+   `REUSE.toml` naming the real rights holder *before* relying on the blanket —
+   the blanket will otherwise silently declare it Conduction's. Blocks are
+   ordered: the last matching one wins, so third-party blocks come after the
+   blanket and use `precedence = "override"`.
+
+3. **You wrote an SPDX tag in prose** — explaining the convention in a comment,
+   a README or a workflow file — and REUSE parsed your explanation as a real
+   tag. Wrap the passage in REUSE's ignore markers; `.github/workflows/`
+   `code-quality.yml` has a worked example of both markers and the rule for
+   using them. Two traps, both of which this repository has already hit: naming
+   the closing marker inside the region terminates it early, and a licence
+   identifier mentioned in prose without a licence text under `LICENSES/` fails
+   the same way a real one does.
+
+Run the lint locally before pushing — it is the same image and version CI uses,
+and it takes under a minute. `fsfe/reuse:6` is stricter about invalid SPDX
+expressions and is worth a second run if the failure is confusing.
+
 ## App Store Release Process
 
 Releases to the Nextcloud App Store are fully automated via GitHub Actions. They are triggered by merging PRs into `beta` or `main`. Version numbers are calculated automatically from PR labels.