feat(e2ee): add a way to trigger a reupload of encryption metadata

src/common/remoteinfo.h

@@ -34,6 +34,9 @@ struct RemoteInfo
     bool _isE2eEncrypted = false;
     bool isFileDropDetected = false;
     QString e2eMangledName;
+    QByteArray _e2eFileEncryptionKey;
+    QByteArray _initializationVector;
+    QByteArray _authenticationTag;
     bool sharedByMe = false;
 
     [[nodiscard]] bool isValid() const { return !name.isNull(); }

src/common/syncjournaldb.cpp

@@ -1,10 +1,10 @@
 /*
  * SPDX-FileCopyrightText: 2020 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2014 ownCloud GmbH
  * SPDX-License-Identifier: LGPL-2.1-or-later
  */
 
 #include <QCryptographicHash>
 #include <QFile>
 #include <QJsonArray>
 #include <QJsonDocument>
@@ -45,7 +45,7 @@
         "SELECT path, inode, modtime, type, md5, fileid, remotePerm, filesize," \
         "  ignoredChildrenRemote, contentchecksumtype.name || ':' || contentChecksum, e2eMangledName, isE2eEncrypted, e2eCertificateFingerprint, " \
         "  lock, lockOwnerDisplayName, lockOwnerId, lockType, lockOwnerEditor, lockTime, lockTimeout, lockToken, isShared, lastShareStateFetchedTimestmap, " \
-        "  sharedByMe, isLivePhoto, livePhotoFile, quotaBytesUsed, quotaBytesAvailable" \
+        "  sharedByMe, isLivePhoto, livePhotoFile, quotaBytesUsed, quotaBytesAvailable, e2eFileEncryptionKey, authenticationTag, initializationVector" \
         " FROM metadata" \
         "  LEFT JOIN checksumtype as contentchecksumtype ON metadata.contentChecksumTypeId == contentchecksumtype.id"
 
@@ -63,6 +63,9 @@
     rec._checksumHeader = query.baValue(9);
     rec._e2eMangledName = query.baValue(10);
     rec._e2eEncryptionStatus = static_cast<SyncJournalFileRecord::EncryptionStatus>(query.intValue(11));
+    rec._e2eFileEncryptionKey = query.baValue(28);
+    rec._authenticationTag = query.baValue(29);
+    rec._initializationVector = query.baValue(30);
     rec._lockstate._locked = query.intValue(13) > 0;
     rec._lockstate._lockOwnerDisplayName = query.stringValue(14);
     rec._lockstate._lockOwnerId = query.stringValue(15);
@@ -894,7 +897,7 @@
     addColumn(QStringLiteral("isLivePhoto"), QStringLiteral("INTEGER"));
     addColumn(QStringLiteral("livePhotoFile"), QStringLiteral("TEXT"));
 
     {
         const auto quotaBytesUsed =  QStringLiteral("quotaBytesUsed");
         const auto quotaBytesAvailable =  QStringLiteral("quotaBytesAvailable");
         const auto defaultCommand = QStringLiteral("DEFAULT -1 NOT NULL");
@@ -917,6 +920,10 @@
         addColumn(quotaBytesAvailable, bigInt, false, defaultCommand);
     }
 
+    addColumn(u"e2eFileEncryptionKey"_s, u"TEXT"_s);
+    addColumn(u"authenticationTag"_s, u"TEXT"_s);
+    addColumn(u"initializationVector"_s, u"TEXT"_s);
+
     return re;
 }
 
@@ -1078,9 +1085,13 @@
 
     const auto query = _queryManager.get(PreparedSqlQueryManager::SetFileRecordQuery, QByteArrayLiteral("INSERT OR REPLACE INTO metadata "
                                                                                                         "(phash, pathlen, path, inode, uid, gid, mode, modtime, type, md5, fileid, remotePerm, filesize, ignoredChildrenRemote, "
-                                                                                                        "contentChecksum, contentChecksumTypeId, e2eMangledName, isE2eEncrypted, e2eCertificateFingerprint, lock, lockType, lockOwnerDisplayName, lockOwnerId, "
-                                                                                                        "lockOwnerEditor, lockTime, lockTimeout, lockToken, isShared, lastShareStateFetchedTimestmap, sharedByMe, isLivePhoto, livePhotoFile, quotaBytesUsed, quotaBytesAvailable) "
-                                                                                                        "VALUES (?1 , ?2, ?3 , ?4 , ?5 , ?6 , ?7,  ?8 , ?9 , ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34);"),
+                                                                                                        "contentChecksum, contentChecksumTypeId, e2eMangledName, isE2eEncrypted, e2eCertificateFingerprint, "
+                                                                                                        "lock, lockType, lockOwnerDisplayName, lockOwnerId, "
+                                                                                                        "lockOwnerEditor, lockTime, lockTimeout, lockToken, isShared, lastShareStateFetchedTimestmap, "
+                                                                                                        "sharedByMe, isLivePhoto, livePhotoFile, quotaBytesUsed, quotaBytesAvailable, "
+                                                                                                        "e2eFileEncryptionKey, authenticationTag, initializationVector) "
+                                                                                                        "VALUES (?1 , ?2, ?3 , ?4 , ?5 , ?6 , ?7,  ?8 , ?9 , ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, "
+                                                                                                        "?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34, ?35, ?36, ?37);"),
         _db);
     if (!query) {
         qCWarning(lcDb) << "database error:" << query->error();
@@ -1106,6 +1117,9 @@
     query->bindValue(17, record._e2eMangledName);
     query->bindValue(18, static_cast<int>(record._e2eEncryptionStatus));
     query->bindValue(19, {});
+    query->bindValue(35, record._e2eFileEncryptionKey);
+    query->bindValue(36, record._authenticationTag);
+    query->bindValue(37, record._initializationVector);
     query->bindValue(20, record._lockstate._locked ? 1 : 0);
     query->bindValue(21, record._lockstate._lockOwnerType);
     query->bindValue(22, record._lockstate._lockOwnerDisplayName);
@@ -1229,7 +1243,7 @@
     auto pathComponents = parentPath.split(QLatin1Char('/'));
     while (!pathComponents.isEmpty()) {
         const auto pathCompontentsJointed = pathComponents.join(QLatin1Char('/'));
         if (!getFileRecord(pathCompontentsJointed, rec)) {
             qCWarning(lcDb) << "could not get file from local DB" << pathCompontentsJointed;
             return false;
         }
@@ -2440,7 +2454,7 @@
     commitInternal(QStringLiteral("setSelectiveSyncList"));
 }
 
 QStringList SyncJournalDb::addSelectiveSyncLists(SelectiveSyncListType type, const QString &path)
 {
     bool ok = false;
 

src/common/syncjournalfilerecord.h

@@ -7,7 +7,7 @@
 #ifndef SYNCJOURNALFILERECORD_H
 #define SYNCJOURNALFILERECORD_H
 
 #include <QString>
 #include <QDateTime>
 
 #include "csync.h"
@@ -72,6 +72,9 @@
     QByteArray _checksumHeader;
     QByteArray _e2eMangledName;
     EncryptionStatus _e2eEncryptionStatus = EncryptionStatus::NotEncrypted;
+    QByteArray _e2eFileEncryptionKey;
+    QByteArray _initializationVector;
+    QByteArray _authenticationTag;
     SyncJournalFileLockInfo _lockstate;
     bool _isShared = false;
     qint64 _lastShareStateFetchedTimestamp = 0;

src/gui/accountsettings.cpp

@@ -1,3 +1,3 @@
 /*
  * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2014 ownCloud GmbH
@@ -31,6 +31,7 @@
 #include "tooltipupdater.h"
 #include "filesystem.h"
 #include "encryptfolderjob.h"
+#include "repairfolderencryptionmetadatajob.h"
 #include "syncresult.h"
 #include "ignorelisttablewidget.h"
 #include "networksettings.h"
@@ -190,7 +191,7 @@
     _ui->accountStatusLayout->removeWidget(_ui->encryptionMessage);
     encryptionPanelLayout->addWidget(_ui->encryptionMessage);
 
     auto *connectionSettingsButton = new QPushButton(tr("Connection settings"), _ui->accountStatus);
     connectionSettingsButton->setSizePolicy(QSizePolicy::Maximum, QSizePolicy::Fixed);
     _ui->gridLayout_2->addWidget(connectionSettingsButton, 0, 2, Qt::AlignRight | Qt::AlignVCenter);
     connect(connectionSettingsButton, &QPushButton::clicked, this, &AccountSettings::showConnectionSettingsDialog);
@@ -417,6 +418,25 @@
     job->deleteLater();
 }
 
+void AccountSettings::slotRepairEncryptedFolderFinished(int status)
+{
+    qCInfo(lcAccountSettings) << "Current folder encryption status code:" << status;
+    auto job = qobject_cast<RepairFolderEncryptionMetadataJob*>(sender());
+    Q_ASSERT(job);
+    if (!job->errorString().isEmpty()) {
+        QMessageBox::warning(nullptr, tr("Repair of encryption failed"), job->errorString());
+    }
+
+    const auto folder = job->property(propertyFolder).value<Folder *>();
+    Q_ASSERT(folder);
+    const auto path = job->property(propertyPath).toString();
+    const auto index = _model->indexForPath(folder, path);
+    Q_ASSERT(index.isValid());
+    _model->resetAndFetch(index.parent());
+
+    job->deleteLater();
+}
+
 QString AccountSettings::selectedFolderAlias() const
 {
     const auto selected = _ui->_folderList->selectionModel()->currentIndex();
@@ -523,7 +543,7 @@
 
     const auto folderAlias = folder->alias();
     const auto path = folderInfo->_path;
     const auto fileId = folderInfo->_fileId;
     const auto encryptFolder = [this, fileId, path, folderAlias] {
         const auto folder = FolderMan::instance()->folder(folderAlias);
         if (!folder) {
@@ -552,6 +572,33 @@
     showEnableE2eeWarningDialog(encryptFolder);
 }
 
+void AccountSettings::slotRepairEncryptedSubfolder(FolderStatusModel::SubFolderInfo *folderInfo)
+{
+    const auto folder = folderInfo->_folder;
+    Q_ASSERT(folder);
+
+    const auto folderAlias = folder->alias();
+    const auto path = folderInfo->_path;
+    const auto fileId = folderInfo->_fileId;
+
+    if (!folder) {
+        qCWarning(lcAccountSettings) << "Could not repair encrypted folder because folder" << folderAlias << "does not exist anymore";
+        QMessageBox::warning(nullptr, tr("Repair of encryption failed"), tr("Could not repair encryption because the folder does not exist anymore"));
+        return;
+    }
+
+    // Folder info have directory paths in Foo/Bar/ convention...
+    Q_ASSERT(!path.startsWith('/') && path.endsWith('/'));
+    // But EncryptFolderJob expects directory path Foo/Bar convention
+    const auto choppedPath = path.chopped(1);
+    auto job = new RepairFolderEncryptionMetadataJob(accountsState()->account(), folder->journalDb(), choppedPath, choppedPath, folder->remotePath(), fileId);
+    job->setParent(this);
+    job->setProperty(propertyFolder, QVariant::fromValue(folder));
+    job->setProperty(propertyPath, QVariant::fromValue(path));
+    connect(job, &RepairFolderEncryptionMetadataJob::finished, this, &AccountSettings::slotRepairEncryptedFolderFinished);
+    job->start();
+}
+
 void AccountSettings::slotEditCurrentIgnoredFiles()
 {
     const auto folder = FolderMan::instance()->folder(selectedFolderAlias());
@@ -675,6 +722,10 @@
             // Ignore decrypting for now since it only works with an empty folder
             // connect(ac, &QAction::triggered, [this, &info] { slotMarkSubfolderDecrypted(info); });
         }
+        if (isEncrypted && _accountState->account()->e2e()->isInitialized()) {
+            ac = menu.addAction(tr("Repair encryption"));
+            connect(ac, &QAction::triggered, [this, info] { slotRepairEncryptedSubfolder(info); });
+        }
     }
 
     ac = menu.addAction(tr("Edit Ignored Files"));
@@ -1262,14 +1313,14 @@
     ui.lineEdit->selectAll();
     ui.lineEdit->setAlignment(Qt::AlignCenter);
 
-    const QFont font(QStringLiteral(""), 0);
+    const QFont font(QLatin1String{}, 0);
     QFontMetrics fm(font);
     ui.lineEdit->setFixedWidth(fm.horizontalAdvance(mnemonic));
     widget.resize(widget.sizeHint());
     widget.exec();
 }
 
 void AccountSettings::forgetEncryptionOnDeviceForAccount(const AccountPtr &account) const
 {
     QMessageBox dialog;
     dialog.setWindowTitle(tr("Forget the end-to-end encryption on this device"));
@@ -1537,7 +1588,7 @@
                                 .arg(Utility::escape(Theme::instance()->appNameGUI())));
     }
 
     const auto isPublicShareLink = _accountState->account()->isPublicShareLink();
     _ui->_toggleSignInOutButton->setVisible(!isPublicShareLink);
     _ui->_toggleSignInOutButton->setText(_accountState->isSignedOut() ? tr("Log in") : tr("Log out"));
     _ui->_removeAccountButton->setText(isPublicShareLink ? tr("Leave share") : tr("Remove account"));
@@ -1599,7 +1650,7 @@
     const auto li = link.split(QLatin1String("?folder="));
     if (li.count() > 1) {
         auto myFolder = li[0];
         const auto alias = li[1];
         if (myFolder.endsWith(QLatin1Char('/'))) {
             myFolder.chop(1);
         }
@@ -2060,7 +2111,7 @@
         stretchIndex = layout->count() - 1;
     }
 
     for (QAction *action : actions) {
         auto *button = new QPushButton(_ui->encryptionMessage);
         button->setText(action->text());
         button->setIcon(action->icon());

src/gui/accountsettings.h

@@ -7,7 +7,7 @@
 #ifndef ACCOUNTSETTINGS_H
 #define ACCOUNTSETTINGS_H
 
 #include <QWidget>
 #include <QUrl>
 #include <QPointer>
 #include <QHash>
@@ -105,6 +105,7 @@
     void slotToggleSignInState();
     void refreshSelectiveSyncStatus();
     void slotMarkSubfolderEncrypted(OCC::FolderStatusModel::SubFolderInfo *folderInfo);
+    void slotRepairEncryptedSubfolder(OCC::FolderStatusModel::SubFolderInfo *folderInfo);
     void slotSubfolderContextMenuRequested(const QModelIndex& idx, const QPoint& point);
     void slotCustomContextMenuRequested(const QPoint &);
     void slotFolderListClicked(const QModelIndex &indx);
@@ -116,6 +117,7 @@
     void slotE2eEncryptionGenerateKeys();
     void slotE2eEncryptionInitializationFinished(bool isNewMnemonicGenerated);
     void slotEncryptFolderFinished(int status);
+    void slotRepairEncryptedFolderFinished(int status);
 
     void slotSelectiveSyncChanged(const QModelIndex &topLeft, const QModelIndex &bottomRight,
                                   const QVector<int> &roles);

src/gui/folder.h

@@ -1,3 +1,3 @@
 /*
  * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2014 ownCloud GmbH
@@ -7,7 +7,7 @@
 #ifndef MIRALL_FOLDER_H
 #define MIRALL_FOLDER_H
 
 #include "syncresult.h"
 #include "progressdispatcher.h"
 #include "common/syncjournaldb.h"
 #include "networkjobs.h"
@@ -392,7 +392,7 @@
     void slotTerminateSync();
 
     // connected to the corresponding signals in the SyncEngine
-    void slotAboutToRemoveAllFiles(OCC::SyncFileItem::Direction, std::function<void(bool)> callback);
+    void slotAboutToRemoveAllFiles(OCC::SyncFileItem::Direction, std::function<void(bool)> callback);// clazy:exclude=fully-qualified-moc-types
 
     /**
       * Starts a sync operation

src/gui/owncloudgui.h

@@ -1,3 +1,3 @@
 /*
  * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2013 ownCloud GmbH
@@ -97,7 +97,7 @@
      * to the folder).
      */
     void slotShowShareDialog(const QString &localPath) const;
-    void slotShowGovernanceLabelsDialog(AccountPtr account,
+    void slotShowGovernanceLabelsDialog(OCC::AccountPtr account,
                                         const QString &localPath,
                                         const QString &fileId) const;
     void slotShowFileActivityDialog(const QString &localPath) const;

src/gui/systray.h

@@ -134,7 +134,7 @@ public slots:
     void createEditFileLocallyLoadingDialog(const QString &fileName);
     void destroyEditFileLocallyLoadingDialog();
     void createResolveConflictsDialog(const OCC::ActivityList &allConflicts);
-    void createGovernanceLabelsDialog(AccountPtr account, const QString &fileName, const QString &fileId);
+    void createGovernanceLabelsDialog(OCC::AccountPtr account, const QString &fileName, const QString &fileId);
     void createEncryptionTokenDiscoveryDialog();
     void destroyEncryptionTokenDiscoveryDialog();
 

src/gui/tray/usermodel.h

@@ -6,7 +6,7 @@
 #ifndef USERMODEL_H
 #define USERMODEL_H
 
 #include <QAbstractListModel>
 #include <QImage>
 #include <QDateTime>
 #include <QJsonDocument>
@@ -233,8 +233,8 @@
 private slots:
     void slotPushNotificationsReady();
     void slotDisconnectPushNotifications();
-    void slotReceivedPushFilesChanges(Account *account);
-    void slotReceivedPushFileIdsChanges(Account *account, const QList<qint64> &fileIds);
+    void slotReceivedPushFilesChanges(OCC::Account *account);
+    void slotReceivedPushFileIdsChanges(OCC::Account *account, const QList<qint64> &fileIds);
     void slotReceivedPushNotification(OCC::Account *account);
     void slotReceivedPushActivity(OCC::Account *account);
     void slotCheckExpiredActivities();
@@ -307,7 +307,7 @@
     // no query for notifications is started.
     int _notificationRequestsRunning = 0;
 
     int _lastTalkNotificationsReceivedCount = 0;
 
     bool _isNotificationFetchRunning = false;
 

src/libsync/CMakeLists.txt

@@ -138,6 +138,8 @@ set(libsync_SRCS
     clientsideencryptionprimitives.cpp
     clientsideencryptiontokenselector.h
     clientsideencryptiontokenselector.cpp
+    repairfolderencryptionmetadatajob.h
+    repairfolderencryptionmetadatajob.cpp
     datetimeprovider.h
     datetimeprovider.cpp
     rootencryptedfolderinfo.h

src/libsync/clientsideencryption.h

@@ -1,3 +1,3 @@
 /*
  * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: GPL-2.0-or-later
@@ -6,7 +6,7 @@
 #ifndef CLIENTSIDEENCRYPTION_H
 #define CLIENTSIDEENCRYPTION_H
 
 #include "owncloudlib.h"
 
 #include "clientsideencryptionprimitives.h"
 #include "accountfwd.h"
@@ -220,7 +220,7 @@
     NextcloudSslCertificate(QSslCertificate &&certificate);
 
     operator QSslCertificate();
     operator QSslCertificate() const;
 
     QSslCertificate& get();
     const QSslCertificate &get() const;
@@ -306,7 +306,7 @@
     void certificatesFetchedFromServer(const QHash<QString, OCC::NextcloudSslCertificate> &results);
     void certificateWriteComplete(const QSslCertificate &certificate);
 
     void startingDiscoveryEncryptionUsbToken();
     void finishedDiscoveryEncryptionUsbToken();
 
     void canEncryptChanged();
@@ -334,10 +334,10 @@
     void privateKeyFetched(QKeychain::Job *incoming);
     void mnemonicKeyFetched(QKeychain::Job *incoming);
 
-    void handlePrivateKeyDeleted(const QKeychain::Job* const incoming);
-    void handleCertificateDeleted(const QKeychain::Job* const incoming);
-    void handleMnemonicDeleted(const QKeychain::Job* const incoming);
-    void handlePublicKeyDeleted(const QKeychain::Job* const incoming);
+    void handlePrivateKeyDeleted(const QKeychain::Job* incoming);
+    void handleCertificateDeleted(const QKeychain::Job* incoming);
+    void handleMnemonicDeleted(const QKeychain::Job* incoming);
+    void handlePublicKeyDeleted(const QKeychain::Job* incoming);
     void checkAllSensitiveDataDeleted();
 
     void getPrivateKeyFromServer();
@@ -350,7 +350,7 @@
     void writePrivateKey();
     void writeCertificate();
 
     void completeHardwareTokenInitialization(QWidget *settingsDialog);
 
     void setMnemonic(const QString &mnemonic);
 

src/libsync/clientsideencryptionjobs.cpp

@@ -161,7 +161,7 @@
     req.setHeader(QNetworkRequest::ContentTypeHeader, QByteArrayLiteral("application/x-www-form-urlencoded"));
 
     if (_account->capabilities().clientSideEncryptionVersion() >= 2.0) {
         if (!_signature.isEmpty()) {
             req.setRawHeader(e2eeSignatureHeaderName, _signature);
         }
     }
@@ -369,7 +369,9 @@
     const auto obj = json.object().toVariantMap();
     const auto token = obj["ocs"].toMap()["data"].toMap()["e2e-token"].toByteArray();
 
+#if defined NEXTCLOUD_DEV && NEXTCLOUD_DEV && defined QT_DEBUG
     qCDebug(lcCseJob()) << "lock folder finished with code" << retCode << " for:" << path() << " for fileId: " << _fileId << " token:" << token;
+#endif
 
     if (!_account->e2e()->getPublicKey().isNull()) {
         const auto folderTokenEncrypted = EncryptionHelper::encryptStringAsymmetric(_account->e2e()->getCertificateInformation(), _account->e2e()->paddingMode(), *_account->e2e(), token);
@@ -385,7 +387,7 @@
     return true;
 }
 
 void LockEncryptFolderApiJob::setCounter(quint64 counter)
 {
     _counter = counter;
 }

src/libsync/discovery.cpp

@@ -31,7 +31,7 @@
 constexpr const char *editorNamesForDelayedUpload[] = {"PowerPDF"};
 constexpr const char *fileExtensionsToCheckIfOpenForSigning[] = {".pdf"};
 constexpr auto delayIntervalForSyncRetryForOpenedForSigningFilesSeconds = 60;
 constexpr auto delayIntervalForSyncRetryForFilesExceedQuotaSeconds = 60;
 }
 
 namespace OCC {
@@ -771,6 +771,9 @@
         result = serverEntry.e2eMangledName.mid(rootPath.length());
         return result;
     }();
+    item->_e2eFileEncryptionKey = serverEntry._e2eFileEncryptionKey;
+    item->_initializationVector = serverEntry._initializationVector;
+    item->_authenticationTag = serverEntry._authenticationTag;
     item->_locked = serverEntry.locked;
     item->_lockOwnerDisplayName = serverEntry.lockOwnerDisplayName;
     item->_lockOwnerId = serverEntry.lockOwnerId;
@@ -1869,7 +1872,7 @@
     if (_discoveryData->_syncOptions._vfs && _discoveryData->_syncOptions._vfs->mode() != OCC::Vfs::Off &&
         (item->_type == CSyncEnums::ItemTypeFile || item->_type == CSyncEnums::ItemTypeDirectory) &&
         item->_instruction == CSyncEnums::CSYNC_INSTRUCTION_NONE &&
         FileSystem::isLnkFile((_discoveryData->_localDir + path._local)) &&
         !_discoveryData->_syncOptions._vfs->isPlaceHolderInSync(_discoveryData->_localDir + path._local)) {
         item->_instruction = CSyncEnums::CSYNC_INSTRUCTION_SYNC;
         item->_direction = SyncFileItem::Down;
@@ -2370,7 +2373,7 @@
 void ProcessDirectoryJob::startAsyncLocalQuery()
 {
     QString localPath = _discoveryData->_localDir + _currentFolder._local;
     auto localJob = new DiscoverySingleLocalDirectoryJob(_discoveryData->_account, localPath, _discoveryData->_syncOptions._vfs.data(), _discoveryData->_fileSystemReliablePermissions);
 
     _discoveryData->_currentlyActiveJobs++;
     _pendingAsyncJobs++;
@@ -2458,13 +2461,13 @@
     }
 }
 
 bool ProcessDirectoryJob::maybeRenameForWindowsCompatibility(const QString &absoluteFileName,
                                                              CSYNC_EXCLUDE_TYPE excludeReason)
 {
     auto result = true;
 
     const auto leadingAndTrailingSpacesFilesAllowed = !_discoveryData->_shouldEnforceWindowsFileNameCompatibility || _discoveryData->_leadingAndTrailingSpacesFilesAllowed.contains(absoluteFileName);
     if (leadingAndTrailingSpacesFilesAllowed) {
         return result;
     }
 

src/libsync/discoveryphase.cpp

@@ -120,7 +120,7 @@
 
         // it is not too big, put it in the white list (so we will not do more query for the children) and and do not block.
         const auto sanitisedPath = Utility::trailingSlashPath(path);
         _selectiveSyncWhiteList.insert(std::upper_bound(_selectiveSyncWhiteList.begin(), _selectiveSyncWhiteList.end(), sanitisedPath), sanitisedPath);
         return callback(false);
     });
 }
@@ -150,7 +150,7 @@
 QString adjustRenamedPath(const QMap<QString, QString> &renamedItems, const QString &original)
 {
     int slashPos = original.size();
     while ((slashPos = original.lastIndexOf('/', slashPos - 1)) > 0) {
         auto it = renamedItems.constFind(original.left(slashPos));
         if (it != renamedItems.constEnd()) {
             return *it + original.mid(slashPos);
@@ -329,7 +329,7 @@
 
 DiscoverySingleLocalDirectoryJob::DiscoverySingleLocalDirectoryJob(const AccountPtr &account,
                                                                    const QString &localPath,
                                                                    OCC::Vfs *vfs,
                                                                    bool fileSystemReliablePermissions,
                                                                    QObject *parent)
     : QObject{parent}
@@ -441,7 +441,7 @@
 void DiscoverySingleDirectoryJob::start()
 {
     // Start the actual HTTP job
     auto *lsColJob = new LsColJob(_account, _subPath);
 
     const auto props = LsColJob::defaultProperties(_isRootPath ? LsColJob::FolderType::RootFolder : LsColJob::FolderType::ChildFolder,
                                                    _account);
@@ -640,7 +640,7 @@
     // hence, we need to find its path and pass to any subfolder's metadata, so it will fetch the top level metadata when needed
     // see https://github.com/nextcloud/end_to_end_encryption_rfc/blob/v2.1/RFC.md
     QString topLevelFolderPath = u"/"_s;
     for (const QString &topLevelPath : std::as_const(_topLevelE2eeFolderPaths)) {
         if (_subPath == topLevelPath) {
             topLevelFolderPath = u"/"_s;
             break;
@@ -660,7 +660,7 @@
     case FolderMetadata::MetadataVersion::Version1_2:
         break;
     case FolderMetadata::MetadataVersion::Version2_0:
     case FolderMetadata::MetadataVersion::Version2_1:
         if (job->signature().isEmpty()) {
             qCDebug(lcDiscovery) << "Initial signature is empty.";
             _account->reportClientStatus(OCC::ClientStatusReportingStatus::E2EeError_GeneralError);
@@ -676,7 +676,7 @@
     const auto folderType = _topLevelE2eeFolderPaths.contains(_subPath) ? FolderMetadata::FolderType::Root : FolderMetadata::FolderType::Nested;
     Q_ASSERT((folderType == FolderMetadata::FolderType::Root) == (rootEncryptedFolderInfo.path == QStringLiteral("/")));
 
     const auto e2EeFolderMetadata = new FolderMetadata(_account,
                                                        _remoteRootFolderPath,
                                                        jsonMetadata,
                                                        rootEncryptedFolderInfo,
@@ -717,6 +717,9 @@
                 result._isE2eEncrypted = true;
                 result.e2eMangledName = _subPath.mid(1) + u'/' + result.name;
                 result.name = encryptedFileInfo->originalFilename;
+                result._e2eFileEncryptionKey = encryptedFileInfo->encryptionKey;
+                result._initializationVector = encryptedFileInfo->initializationVector;
+                result._authenticationTag = encryptedFileInfo->authenticationTag;
             }
             return result;
         });

src/libsync/encryptedfoldermetadatahandler.cpp

@@ -1,3 +1,3 @@
 /*
  * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: GPL-2.0-or-later
@@ -133,11 +133,11 @@
     }
 
     // normally, we should allow locking any nested folder to update its metadata, yet, with the new V2 architecture, this is something we might want to disallow
     /*if (!folderMetadata()->isRootEncryptedFolder()) {
         qCWarning(lcFetchAndUploadE2eeFolderMetadataJob) << "Error locking folder" << _folderId << "as it is not a top level folder";
         emit uploadFinished(-1, tr("Error locking folder."));
         return false;
     }*/
     return true;
 }
 
@@ -162,9 +162,11 @@
     emit fetchFinished(errorCode, reply->errorString());
 }
 
 void EncryptedFolderMetadataHandler::slotMetadataReceived(const QJsonDocument &json, int statusCode)
 {
+#if defined NEXTCLOUD_DEV && NEXTCLOUD_DEV && defined QT_DEBUG
     qCDebug(lcFetchAndUploadE2eeFolderMetadataJob) << "Metadata Received, parsing it and decrypting" << json.toVariant();
+#endif
 
     const auto job = qobject_cast<GetMetadataApiJob *>(sender());
     Q_ASSERT(job);
@@ -277,6 +279,12 @@
     unlockJob->start();
 }
 
+void EncryptedFolderMetadataHandler::repairMetadata(const QList<FolderMetadata::DatabaseEncryptedFile> &childItems,
+                                                    OwncloudPropagator *propagator)
+{
+    _folderMetadata->repair(childItems, propagator);
+}
+
 void EncryptedFolderMetadataHandler::startUploadMetadata()
 {
     qCDebug(lcFetchAndUploadE2eeFolderMetadataJob) << "Metadata created, sending to the server.";

src/libsync/encryptedfoldermetadatahandler.h

@@ -1,15 +1,16 @@
 /*
  * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
 #pragma once
 
 #include "owncloudlib.h"
 
 #include "account.h"
 #include "rootencryptedfolderinfo.h"
 #include "common/syncjournaldb.h"
+#include "foldermetadata.h"
 
 #include <QHash>
 #include <QMutex>
@@ -19,8 +20,10 @@
 #include <QPointer>
 
 namespace OCC {
-class FolderMetadata;
+
 class SyncJournalDb;
+class OwncloudPropagator;
+
 // all metadata operations with server must be performed via this class
 class OWNCLOUDSYNC_EXPORT EncryptedFolderMetadataHandler
     : public QObject
@@ -30,19 +33,20 @@
 public:
     enum class FetchMode {
         NonEmptyMetadata = 0,
-        AllowEmptyMetadata
+        AllowEmptyMetadata,
+        AllowBrokenSignature,
     };
     Q_ENUM(FetchMode);
 
     enum class UploadMode {
         DoNotKeepLock = 0,
-        KeepLock
+        KeepLock,
     };
     Q_ENUM(UploadMode);
 
     enum class UnlockFolderWithResult {
         Success = 0,
-        Failure
+        Failure,
     };
     Q_ENUM(UnlockFolderWithResult);
 
@@ -66,6 +70,8 @@
     void fetchMetadata(const FetchMode fetchMode = FetchMode::NonEmptyMetadata);
     void uploadMetadata(const UploadMode uploadMode = UploadMode::DoNotKeepLock);
     void unlockFolder(const UnlockFolderWithResult result = UnlockFolderWithResult::Success);
+    void repairMetadata(const QList<OCC::FolderMetadata::DatabaseEncryptedFile> &childItems,
+                        OwncloudPropagator *propagator);
 
 private:
     void lockFolder();