From 5fbcd78ab3b069dac57ab2eeb294c06b92218bb2 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Fri, 10 Jan 2025 17:23:06 +0100
Subject: [PATCH] Fallback to owners proofs during migration

---
 lib/env.js               |  1 +
 lib/storage/blob.js      |  5 +++++
 lib/workers/db-worker.js | 20 ++++++++++++++++++++
 lib/workers/index.js     |  5 ++++-
 server.js                | 10 +++++++++-
 5 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/lib/env.js b/lib/env.js
index d3748750f..a3593c7a1 100644
--- a/lib/env.js
+++ b/lib/env.js
@@ -415,6 +415,7 @@ const BAD = [
     'limits',
     'customLimits',
     'scheduleDecree',
+    'plugins',
 
     'httpServer',
 
diff --git a/lib/storage/blob.js b/lib/storage/blob.js
index f3d44c5d7..62719cefe 100644
--- a/lib/storage/blob.js
+++ b/lib/storage/blob.js
@@ -737,6 +737,11 @@ BlobStore.create = function (config, _cb) {
                 upload_cancel(Env, safeKey, fileSize, cb);
             },
 
+            isOwnedBy: function (safeKey, blobId, _cb) {
+                var cb = Util.once(Util.mkAsync(_cb));
+                if (!isValidSafeKey(safeKey)) { return void cb('INVALID_SAFEKEY'); }
+                isOwnedBy(Env, safeKey, blobId, cb);
+            },
             readMetadata: (blobId, handler, cb) => {
                 if (!isValidId(blobId)) { return void cb("INVALID_ID"); }
                 readBlobMetadata(Env, blobId, handler, cb);
diff --git a/lib/workers/db-worker.js b/lib/workers/db-worker.js
index d1a0fe962..9a4a39903 100644
--- a/lib/workers/db-worker.js
+++ b/lib/workers/db-worker.js
@@ -158,6 +158,12 @@ const isValidOffsetNumber = function (n) {
     return typeof(n) === 'number' && n >= 0;
 };
 
+const updateEnv = data => {
+    const {value} = data;
+    let env = Util.tryParse(value) || {};
+    Env.proofsMigrated = env?.proofsMigrated;
+};
+
 const computeIndexFromOffset = function (channelName, offset, cb) {
     let cpIndex = [];
     let messageBuf = [];
@@ -576,6 +582,16 @@ const removeOwnedBlob = function (data, cb) {
                 return void cb("INSUFFICIENT_PERMISSIONS");
             }
             let owners = meta.owners;
+            if (!owners && !Env.proofsMigrated) {
+                // Check old proofs during migration
+                blobStore.isOwnedBy(safeKey, blobId, w((e, owned) => {
+                    if (e || !owned) {
+                        w.abort();
+                        return void cb("INSUFFICIENT_PERMISSIONS");
+                    }
+                }))
+                return;
+            }
             if (!owners || !owners.includes(unsafeKey)) {
                 w.abort();
                 return void cb("INSUFFICIENT_PERMISSIONS");
@@ -693,6 +709,7 @@ const getLastChannelTime = function (data, cb) {
 };
 
 const COMMANDS = {
+    ENV_UPDATE: updateEnv,
     COMPUTE_INDEX: computeIndex,
     COMPUTE_METADATA: computeMetadata,
     GET_OLDER_HISTORY: getOlderHistory,
@@ -848,6 +865,9 @@ process.on('message', function (data) {
     };
 
     if (!ready) {
+        if (data.env) {
+            updateEnv({value:data.env});
+        }
         return void init(data.config, function (err) {
             if (err) { return void cb(Util.serializeError(err)); }
             ready = true;
diff --git a/lib/workers/index.js b/lib/workers/index.js
index 5bdbd5d7a..bc1780cc5 100644
--- a/lib/workers/index.js
+++ b/lib/workers/index.js
@@ -9,6 +9,7 @@ const { fork } = require('child_process');
 const Workers = module.exports;
 const PID = process.pid;
 const Block = require("../storage/block");
+const Environment = require('../env');
 
 const DB_PATH = 'lib/workers/db-worker';
 const MAX_JOBS = 16;
@@ -256,6 +257,7 @@ Workers.initialize = function (Env, config, _cb) {
             pid: PID,
             txid: txid,
             config: config,
+            env: Environment.serialize(Env)
         });
 
         worker.on('message', function (res) {
@@ -342,7 +344,8 @@ Workers.initialize = function (Env, config, _cb) {
                     type: 'broadcast',
                     pid: PID,
                     command: data.command,
-                    txid: data.txid
+                    txid: data.txid,
+                    value: data.value
                 });
             });
             return workers;
diff --git a/server.js b/server.js
index 407f10f43..ca2b2ae77 100644
--- a/server.js
+++ b/server.js
@@ -190,7 +190,15 @@ nThen(function (w) {
 
     var throttledEnvChange = Util.throttle(function () {
         Env.Log.info('WORKER_ENV_UPDATE', 'Updating HTTP workers with latest state');
-        broadcast('ENV_UPDATE', Environment.serialize(Env));
+        let serialized = Environment.serialize(Env);
+        broadcast('ENV_UPDATE', serialized);
+        if (Env.broadcastWorkerCommand) {
+            Env.broadcastWorkerCommand({
+                command: 'ENV_UPDATE',
+                value: serialized,
+                txid: Util.uid()
+            });
+        }
     }, 250); // NOTE: changing this value will impact lib/commands/admin-rpc.js#adminDecree callback
 
     var throttledCacheFlush = Util.throttle(function () {