feat: immutable attribute + container-specific permissions

Add two features to the decomposedfs storage driver:

1. Container-specific permissions (cs3org/cs3apis#272):
   - DeleteContainer/MoveContainer checks in Delete/Move handlers
   - ACL encoding: +dc/!dc, +mc/!mc (with substring collision fix)
   - Roles updated: Editor/Manager/Coowner get DeleteContainer/MoveContainer
   - SetImmutableFile/SetImmutableContainer permissions on Manager/Coowner

2. Immutable attribute (freeze/protect):
   - xattr: user.oc.immutable
   - File (freeze): content fixed, irreversible
   - Container (protect): structure fixed, reversible by managers
   - Self vs parent rule: ImmutableState = Frozen/Protected/None
   - Node methods: FreezeFile, ProtectContainer, UnprotectContainer
   - Storage interface: SetImmutable/UnsetImmutable with permission checks
   - GRPC handlers: storageprovider + gateway pass-through
   - Handler checks: Delete, Move, CreateDir, Upload
   - Stat: ResourceInfo.Immutable + Opaque immutable-state
   - WebDAV: oc:immutable property + D/NV strip from oc:permissions
   - OwnerPermissions/AddPermissions updated

Tests: 21 new (node, handler, grants ACL), all pass.
2 pre-existing failures (UpdateGrant/DenyGrant ACL round-trip).

Author: flash

docs/patch-immutable-and-container-permissions.md

@@ -0,0 +1,206 @@
+# Patch Documentation: Immutable & Container-Specific Permissions
+
+## Status
+
+- **cs3org/cs3apis#272**: MERGED (4 Jun 2026)
+- **cs3org/go-cs3apis**: Regenerated (c3fdb0aa5e9e)
+- **opencloud-eu/reva#674**: go-cs3apis update PR (Housekeeping, waiting for review)
+- **cs3org/reva#5628**: Open, ACL encoding
+- **opencloud-eu/opencloud#2841**: EditorLitePlus role (independent, ready)
+- Feature branch ready, compiles with new go-cs3apis.
+
+## Overview
+
+Two features spanning 4 repositories:
+
+1. **Container-specific permissions** (`DeleteContainer`, `MoveContainer`) — separate file and directory delete/move operations
+2. **Immutable attribute** (freeze/protect) — persistent xattr to protect resources from modification
+
+Reference: [cs3org/cs3apis#272](https://github.com/cs3org/cs3apis/pull/272)
+
+## Repositories and Branches
+
+| Repo | Branch | PR | Purpose |
+|------|--------|-----|---------|
+| `flash7777/reva` | `chore/update-go-cs3apis` | [opencloud-eu/reva#674](https://github.com/opencloud-eu/reva/pull/674) | go-cs3apis update + stubs (Housekeeping) |
+| `flash7777/reva` | `feature/immutable-decomposedfs` | Pending (after #674) | decomposedfs, roles, ACL, WebDAV, tests |
+| `flash7777/opencloud` | `feature/immutable-and-container-permissions` | Pending | Graph API actions |
+| `flash7777/opencloud` | `feature/editor-light-role` | [opencloud-eu/opencloud#2841](https://github.com/opencloud-eu/opencloud/pull/2841) | EditorLitePlus role |
+| `flash7777/web` | `feature/immutable-ui` | Pending | Frontend: Resource model, icons, sidebar |
+
+## Release Strategy
+
+```
+cs3org/cs3apis#272 MERGED ✓
+    ↓
+cs3org/go-cs3apis regenerated ✓ (c3fdb0aa5e9e)
+    ↓
+PR 1: opencloud-eu/reva#674 — go-cs3apis update + stubs (waiting for review)
+    ↓
+PR 2: opencloud-eu/reva — feature/immutable-decomposedfs (rebase on #674, then submit)
+    ↓
+PR 3: opencloud-eu/opencloud — Graph API actions (after reva release with PR 2)
+    ↓
+PR 4: opencloud-eu/web — Frontend (independent, can merge anytime)
+```
+
+Note: `flash7777/reva` is a fork of cs3org/reva (same GitHub fork network as
+opencloud-eu/reva), which allows cross-repo PRs against opencloud-eu/reva.
+`flash7777/reva-eu` is a standalone repo (cannot create PRs).
+
+## What was changed — by layer
+
+### Layer 1: CS3 Proto Spec
+
+**cs3org/cs3apis#272** — APPROVED
+
+`ResourcePermissions` new fields:
+- `delete_container` (21) — can delete containers
+- `move_container` (22) — can move/rename containers
+- `set_immutable_file` (23) — can freeze files (irreversible)
+- `set_immutable_container` (24) — can protect/unprotect containers
+
+`ResourceInfo` new field:
+- `immutable` (20) — resource is frozen/protected
+
+`ProviderAPI` new RPCs:
+- `SetImmutable` / `UnsetImmutable`
+
+Immutable semantics documented in `docs/proposals/immutable-overview.md`:
+- File (freeze): content fixed, irreversible
+- Container (protect): structure fixed, reversible by manager/admin
+- Self vs. parent rule: object is immutable if own OR parent attribute is set
+
+### Layer 2: Go Bindings
+
+**cs3org/go-cs3apis** — will be regenerated by CERN after cs3apis#272 merge.
+
+`flash7777/go-cs3apis` was used for local testing only. The reva branch
+has **no** `replace` directive — it references the upstream go-cs3apis and
+will compile once the fields are available.
+
+### Layer 3: Reva Storage (opencloud-eu/reva)
+
+#### Roles (`pkg/conversions/role.go`)
+
+| Role | DeleteContainer | MoveContainer | SetImmutableFile | SetImmutableContainer |
+|------|:-:|:-:|:-:|:-:|
+| Viewer | - | - | - | - |
+| EditorLite | - | - | - | - |
+| Editor | **true** | **true** | - | - |
+| SpaceEditor | **true** | **true** | - | - |
+| SpaceEditorWithoutVersions | **true** | **true** | - | - |
+| Coowner | **true** | **true** | **true** | **true** |
+| Manager | **true** | **true** | **true** | **true** |
+
+**Breaking change:** Directory delete/move requires explicit `DeleteContainer`/`MoveContainer`.
+
+#### Storage Interface (`pkg/storage/storage.go`)
+
+New methods: `SetImmutable(ctx, ref)`, `UnsetImmutable(ctx, ref)`
+
+#### decomposedfs Implementation
+
+**xattr:** `user.oc.immutable` (`prefixes.go`)
+
+**Node methods** (`node/node.go`):
+- `ImmutableState` enum: `ImmutableNone` (0), `ImmutableProtected` (1), `ImmutableFrozen` (2)
+- `IsImmutable()` — check self
+- `GetImmutableState()` — effective state (self + parent)
+- `FreezeFile()` — irreversible, rejects dirs
+- `ProtectContainer()` — rejects files
+- `UnprotectContainer()` — rejects files
+
+**Handler checks** (`decomposedfs.go`):
+- `Delete`: `DeleteContainer` check + immutable self/parent
+- `Move`: `MoveContainer` check + immutable source/target
+- `CreateDir`: parent immutable check
+- `SetImmutable()`: permission check (`SetImmutableFile`/`SetImmutableContainer`)
+- `UnsetImmutable()`: rejects files, checks permission
+
+**Upload** (`upload.go`):
+- Frozen file → no overwrite
+- Protected parent → no new file, no modification
+
+**Stat** (`node.go` `AsResourceInfo()`):
+- `ResourceInfo.Immutable` set from xattr
+- `immutable-state` in Opaque: `frozen` or `protected`
+
+#### ACL Encoding (`pkg/storage/utils/grants/grants.go`)
+
+New flags: `+dc`/`!dc`, `+mc`/`!mc`
+Fix: strip container flags before parsing `!d` to avoid substring collision.
+
+#### WebDAV PROPFIND (`internal/http/services/owncloud/ocdav/propfind/`)
+
+- `oc:permissions`: strip `D` (delete) and `NV` (rename/move) when effectively immutable
+- `oc:immutable`: new property — `frozen`, `protected`, or NotFound
+- Both allprops and named property requests supported
+
+#### Legacy drivers
+
+All non-decomposedfs drivers get `NotSupported` stubs.
+
+### Layer 4: Graph API (opencloud-eu/opencloud)
+
+New LibreGraph actions:
+- `libre.graph/driveItem/container/delete`
+- `libre.graph/driveItem/container/move`
+- `libre.graph/driveItem/immutable/file/set`
+- `libre.graph/driveItem/immutable/container/set`
+
+Bidirectional mapping in `conversion.go`.
+Vendor patches for go-cs3apis and reva role.go (temporary until dependency update).
+
+### Layer 5: Web Frontend (opencloud-eu/web)
+
+- `DavProperty.Immutable`: new WebDAV property, added to Default request list
+- `Resource.immutableState`: `'frozen' | 'protected' | undefined`
+- `canBeDeleted()` / `canRename()`: return `false` when immutableState is set
+- `FileDetails.vue` sidebar: shield icon (filled = frozen, outline = protected) with label
+
+### Layer 6: EditorLitePlus Role (independent)
+
+**opencloud-eu/opencloud#2841** — new sharing role: edit without delete.
+Uses only existing CS3 permissions, no dependency on cs3apis#272.
+
+## Tests
+
+| Suite | Tests | Status |
+|-------|:-----:|:------:|
+| Node (IsImmutable, GetImmutableState, Freeze, Protect, Unprotect, Parent rule) | 6 | PASS |
+| Handler (Delete/Move/CreateDir frozen/protected, Upload protected, SetImmutable permissions) | 7 | PASS |
+| Grants ACL (+dc/!dc/+mc/!mc encoding, substring collision) | 8 | PASS |
+| Existing tests (recycle, delete) updated with DeleteContainer | 7 fixes | PASS |
+| Total new/modified tests | **28** | **All PASS** |
+
+`posix/tree` failure is pre-existing on main.
+
+## Concepts: Lock vs. Protected vs. Frozen
+
+| | Lock | Protected | Frozen |
+|---|---|---|---|
+| Purpose | Collaborative editing | Structure protection (parent) | Content protection (self) |
+| Duration | Temporary (expires) | Until manager removes | **Permanent** (files) |
+| Set by | Any user with write access | Manager/Admin | Manager/Admin |
+| Affects | Parallel writes | Delete/move/rename of object | All modifications |
+| Reversible | Yes (expires or unlock) | Yes (UnprotectContainer) | **No** (files) / Yes (containers) |
+| Icon | 🔒 Lock | 🛡️ Shield outline | 🛡️ Shield filled |
+| WebDAV | `d:lockdiscovery` | `oc:immutable="protected"` | `oc:immutable="frozen"` |
+
+## Migration
+
+No data migration needed. The `user.oc.immutable` xattr is only set explicitly via `SetImmutable()`. Existing deployments are unaffected.
+
+`DeleteContainer`/`MoveContainer` are added to all existing roles that have `Delete`/`Move`. No grants break — OpenCloud uses Unified Roles exclusively, not manual permission grants.
+
+## Dependency chain
+
+```
+cs3org/cs3apis#272  →  cs3org/go-cs3apis  →  opencloud-eu/reva  →  opencloud-eu/opencloud
+                                                                  →  opencloud-eu/web
+```
+
+No personal forks in any dependency. The flash7777/* forks were used for
+development and local testing only. PRs will be created against the
+upstream repos once go-cs3apis has the new fields.

internal/grpc/services/gateway/storageprovider.go

@@ -919,6 +919,40 @@ func (s *svc) Unlock(ctx context.Context, req *provider.UnlockRequest) (*provide
 	return res, nil
 }
 
+func (s *svc) SetImmutable(ctx context.Context, req *provider.SetImmutableRequest) (*provider.SetImmutableResponse, error) {
+	c, _, err := s.find(ctx, req.Ref)
+	if err != nil {
+		return &provider.SetImmutableResponse{
+			Status: status.NewStatusFromErrType(ctx, "SetImmutable ref="+req.Ref.String(), err),
+		}, nil
+	}
+	res, err := c.SetImmutable(ctx, req)
+	if err != nil {
+		if gstatus.Code(err) == codes.PermissionDenied {
+			return &provider.SetImmutableResponse{Status: &rpc.Status{Code: rpc.Code_CODE_PERMISSION_DENIED}}, nil
+		}
+		return nil, errors.Wrap(err, "gateway: error calling SetImmutable")
+	}
+	return res, nil
+}
+
+func (s *svc) UnsetImmutable(ctx context.Context, req *provider.UnsetImmutableRequest) (*provider.UnsetImmutableResponse, error) {
+	c, _, err := s.find(ctx, req.Ref)
+	if err != nil {
+		return &provider.UnsetImmutableResponse{
+			Status: status.NewStatusFromErrType(ctx, "UnsetImmutable ref="+req.Ref.String(), err),
+		}, nil
+	}
+	res, err := c.UnsetImmutable(ctx, req)
+	if err != nil {
+		if gstatus.Code(err) == codes.PermissionDenied {
+			return &provider.UnsetImmutableResponse{Status: &rpc.Status{Code: rpc.Code_CODE_PERMISSION_DENIED}}, nil
+		}
+		return nil, errors.Wrap(err, "gateway: error calling UnsetImmutable")
+	}
+	return res, nil
+}
+
 // Stat returns the Resoure info for a given resource by forwarding the request to the responsible provider.
 func (s *svc) Stat(ctx context.Context, req *provider.StatRequest) (*provider.StatResponse, error) {
 	c, _, ref, err := s.findAndUnwrap(ctx, req.Ref)

internal/grpc/services/storageprovider/storageprovider.go

@@ -325,14 +325,16 @@ func (s *Service) ListResourcesForLabel(ctx context.Context, req *labels.ListRes
 }
 
 func (s *Service) SetImmutable(ctx context.Context, req *provider.SetImmutableRequest) (*provider.SetImmutableResponse, error) {
+	err := s.Storage.SetImmutable(ctx, req.Ref)
 	return &provider.SetImmutableResponse{
-		Status: status.NewUnimplemented(ctx, nil, "SetImmutable not yet implemented"),
+		Status: status.NewStatusFromErrType(ctx, "set immutable", err),
 	}, nil
 }
 
 func (s *Service) UnsetImmutable(ctx context.Context, req *provider.UnsetImmutableRequest) (*provider.UnsetImmutableResponse, error) {
+	err := s.Storage.UnsetImmutable(ctx, req.Ref)
 	return &provider.UnsetImmutableResponse{
-		Status: status.NewUnimplemented(ctx, nil, "UnsetImmutable not yet implemented"),
+		Status: status.NewStatusFromErrType(ctx, "unset immutable", err),
 	}, nil
 }
 

internal/http/services/owncloud/ocdav/propfind/propfind.go

@@ -1136,6 +1136,17 @@ func mdToPropResponse(ctx context.Context, pf *XML, md *provider.ResourceInfo, p
 			false,
 			isPublic,
 		)
+		// Strip delete/move flags from permissions if resource is effectively immutable
+		isEffectivelyImmutable := md.Immutable
+		if !isEffectivelyImmutable && md.Opaque != nil {
+			if v, ok := md.Opaque.Map["immutable-state"]; ok && string(v.Value) == "protected" {
+				isEffectivelyImmutable = true
+			}
+		}
+		if isEffectivelyImmutable {
+			wdp = strings.ReplaceAll(wdp, "D", "")
+			wdp = strings.ReplaceAll(wdp, "NV", "")
+		}
 	}
 
 	// replace fileid of /public/{token} mountpoint with grant fileid
@@ -1229,6 +1240,15 @@ func mdToPropResponse(ctx context.Context, pf *XML, md *provider.ResourceInfo, p
 			appendToOK(prop.Escaped("oc:permissions", wdp))
 		}
 
+		// Immutable state — always return in allprops if set
+		if md.Immutable {
+			appendToOK(prop.Escaped("oc:immutable", "frozen"))
+		} else if md.Opaque != nil {
+			if v, ok := md.Opaque.Map["immutable-state"]; ok && string(v.Value) == "protected" {
+				appendToOK(prop.Escaped("oc:immutable", "protected"))
+			}
+		}
+
 		// always return size, well nearly always ... public link shares are a little weird
 		if md.Type == provider.ResourceType_RESOURCE_TYPE_CONTAINER {
 			appendToOK(prop.Raw("d:resourcetype", "<d:collection/>"))
@@ -1362,6 +1382,18 @@ func mdToPropResponse(ctx context.Context, pf *XML, md *provider.ResourceInfo, p
 					// M = Mounted
 					// in contrast, the ocs:share-permissions further down below indicate clients the maximum permissions that can be granted
 					appendToOK(prop.Escaped("oc:permissions", wdp))
+				case "immutable":
+					if md.Immutable {
+						appendToOK(prop.Escaped("oc:immutable", "frozen"))
+					} else if md.Opaque != nil {
+						if v, ok := md.Opaque.Map["immutable-state"]; ok && string(v.Value) == "protected" {
+							appendToOK(prop.Escaped("oc:immutable", "protected"))
+						} else {
+							appendToNotFound(prop.NotFound("oc:immutable"))
+						}
+					} else {
+						appendToNotFound(prop.NotFound("oc:immutable"))
+					}
 				case "public-link-permission": // only on a share root node
 					if ls != nil && md.PermissionSet != nil {
 						appendToOK(prop.Escaped("oc:public-link-permission", role.OCSPermissions().String()))