fix: fall back instead of stranding empty .pad files

initializeMissingFrontmatter hard-required protected pads, so a `.pad`
that arrived outside the UI -- over WebDAV, from another integration, or
from before the setting changed -- failed every open attempt with 403
when protected pads were off, even though public pads were available.
There was no way out for the user: recovery needs frontmatter the file
doesn't have.

Use the same fallback the template path already uses. It still closes the
`/initialize` bypass (nothing enabled means an exception), but produces an
openable pad whenever some type is allowed.

Rename resolveForTemplate() to resolveCreatableMode(), since it now serves
both callers, and note in its docblock that the fallback can widen access:
a protected template becomes a public pad when protected pads are off.
README, api-reference and templates docs say so too.

Author: Jaggob

README.md

@@ -108,9 +108,15 @@ Two settings control which pad types the app offers, both enabled by default:
   Nextcloud account.
 
 Switching a type off hides its `+ New` entries and refuses new pads of that
-type on the regular create paths — the API create endpoints, the template
-flows and the first-open initialisation of a `.pad` that has no pad yet. Pads
-that already exist keep working either way.
+type on the API create endpoints. Pads that already exist keep working either
+way.
+
+Two paths fall back rather than refuse, so nothing gets stranded: a template
+carrying the disabled mode, and the first-open initialisation of a `.pad`
+that arrived outside the app (over WebDAV, say). Both create the pad in the
+enabled mode; only with both types off is creation refused outright. Note
+that this can widen access — a protected template becomes a public pad when
+protected pads are off.
 
 The setting decides what the app offers; it is not a hard boundary against a
 user who crafts `.pad` files by hand. Recovering an orphaned `.pad` from its

docs/api-reference.md

@@ -71,11 +71,15 @@ Base: `/apps/etherpad_nextcloud`
     - read-only protected share: `is_readonly_snapshot=true`, empty `url`, `snapshot_text`, and sanitized `snapshot_html`; no Etherpad session cookie
     - public/external pad share: regular public Etherpad URL
 
-Admins can switch either pad type off (see the admin settings). Creating a pad
-of a disabled type is refused with `403` by `POST /pads`,
-`POST /pads/create-by-parent`, `POST /pads/from-template` and the
-`initialize` endpoints; pads that already exist are unaffected. Templates
-carrying a disabled mode are created in the enabled mode instead of failing.
+Admins can switch either pad type off (see the admin settings). `POST /pads`
+and `POST /pads/create-by-parent` refuse a disabled `accessMode` with `403`.
+Pads that already exist are unaffected.
+
+`POST /pads/from-template` and the `initialize` endpoints do not refuse a
+disabled mode — they create the pad in the enabled mode instead, so a
+template or a `.pad` that arrived outside the UI stays usable. They only
+return `403` when no pad type is enabled at all. Note this can widen access:
+a protected template becomes a public pad when protected pads are off.
 
 The refusal carries `code: pad_type_disabled`, plus `access_mode` naming the
 disabled type — that field is absent when no pad type is enabled at all.

docs/templates.md

@@ -91,4 +91,4 @@ Error responses:
 - **Failed template materialisation falls back to a blank pad.** If anything in the listener throws (binding race, Etherpad unreachable, malformed template), the byte-copy NC made is wiped and the new file behaves like a normal empty `.pad` — the regular missing-frontmatter init kicks in on first open.
 - **Placeholder substitution applies to both the plain-text and the HTML snapshot in the body**. If a placeholder ends up inside an HTML attribute (`<a href="{{date}}">`), it gets resolved too — keep placeholders in human-readable locations to avoid surprises.
 - **No template registry** — every `.pad` in the user's *Templates* folder is a candidate. There's no separate "is a template" flag.
-- **A template keeps its own access mode**, unless the admin switched that pad type off. In that case the pad is created in the enabled mode instead of failing, so the template's content still lands. With no pad type enabled at all, template creation is refused.
+- **A template keeps its own access mode**, unless the admin switched that pad type off. In that case the pad is created in the enabled mode instead of failing, so the template's content still lands. With no pad type enabled at all, template creation is refused. Be aware this can widen access: a protected template creates a public pad when protected pads are off — on such an instance that is the only option, but the resulting pad is open to anyone with the link.

lib/Service/PadBootstrapService.php

@@ -101,9 +101,13 @@ public function initializeMissingFrontmatter(string $uid, File $file, string $ex
 			// re-initialising an existing one — the policy applies. Files that
 			// already have a binding fall into the branch above and keep
 			// working whatever the admin configured.
-			$this->padTypePolicy->requireEnabled(BindingService::ACCESS_PROTECTED);
-			$padId = $this->provisionPadId(BindingService::ACCESS_PROTECTED);
-			$accessMode = BindingService::ACCESS_PROTECTED;
+			//
+			// Fall back rather than refuse: an empty `.pad` can arrive outside
+			// the UI (WebDAV, another integration, or from before the setting
+			// changed), and a hard requirement would leave it permanently
+			// unopenable even when the other pad type is available.
+			$accessMode = $this->padTypePolicy->resolveCreatableMode(BindingService::ACCESS_PROTECTED);
+			$padId = $this->provisionPadId($accessMode);
 			$this->bindingService->createBinding($fileId, $padId, $accessMode);
 			$createdNewBinding = true;
 			$createdNewPad = true;

lib/Service/PadCreationService.php

@@ -343,7 +343,7 @@ public function materializeTemplateInto(File $target, File $template, ?IUser $us
 		// A template keeps the access mode of the pad it was made from. If the
 		// admin switched that type off, create the pad in the other enabled
 		// mode rather than refusing — the template's content is the point.
-		$accessMode = $this->padTypePolicy->resolveForTemplate($accessMode);
+		$accessMode = $this->padTypePolicy->resolveCreatableMode($accessMode);
 
 		$snapshot = $this->padFileService->getSnapshotPartsFromBody($pad->body);
 		$resolvedText = $this->placeholderResolver->applyForContent($snapshot['text'], $user);

lib/Service/PadTypePolicy.php

@@ -53,14 +53,21 @@ public function requireEnabled(string $accessMode): void {
 	}
 
 	/**
-	 * A template carries the access mode of the pad it was made from. When
-	 * that mode is switched off, create the pad in the other enabled mode
-	 * rather than refusing: the template's content is what the user is after,
-	 * and the policy still holds for the resulting pad.
+	 * Pick a mode that may actually be created, preferring the requested one.
+	 *
+	 * Used where refusing would strand the user rather than protect anything:
+	 * a template carries the mode of the pad it was made from, and a `.pad`
+	 * file that arrived outside the UI (WebDAV, another integration) has to
+	 * become *some* pad on first open. Falling back keeps the content
+	 * reachable while the policy still holds for the resulting pad.
+	 *
+	 * Note this can widen access — a protected template becomes a public pad
+	 * when protected pads are off. That is the instance's only option at that
+	 * point, but it is a downgrade in the security-relevant direction.
 	 *
 	 * @throws PadTypeDisabledException when no pad type is enabled at all
 	 */
-	public function resolveForTemplate(string $requested): string {
+	public function resolveCreatableMode(string $requested): string {
 		if ($this->isEnabled($requested)) {
 			return $requested;
 		}

tests/phpunit/unit/PadBootstrapServiceTest.php

@@ -157,10 +157,10 @@ public function testInitializeMissingFrontmatterCleansUpWhenWriteFails(): void {
 		$service->initializeMissingFrontmatter('alice', $file, '');
 	}
 
-	public function testBlankInitialisationIsRefusedWhenProtectedPadsAreDisabled(): void {
-		// Without a binding this provisions a brand-new pad, so the admin's
-		// setting applies — otherwise an empty .pad plus /initialize would be
-		// a way around it.
+	public function testBlankInitialisationIsRefusedWhenNoPadTypeIsEnabled(): void {
+		// Without a binding this provisions a brand-new pad, so the policy
+		// applies — otherwise an empty .pad plus /initialize would be a way
+		// around it.
 		$bindingService = $this->createMock(BindingService::class);
 		$bindingService->method('findByFileId')->willReturn(null);
 		$bindingService->expects($this->never())->method('createBinding');
@@ -171,26 +171,75 @@ public function testBlankInitialisationIsRefusedWhenProtectedPadsAreDisabled():
 		$etherpadClient = $this->createMock(EtherpadClient::class);
 		$etherpadClient->expects($this->never())->method('createGroup');
 		$etherpadClient->expects($this->never())->method('createGroupPad');
+		$etherpadClient->expects($this->never())->method('createPad');
 
 		$file = $this->createMock(File::class);
 		$file->method('getId')->willReturn(4321);
 		$file->expects($this->never())->method('putContent');
 
+		$service = $this->buildService($bindingService, $padFileService, $etherpadClient, $this->buildPadTypePolicy(false, false));
+
+		$this->expectException(\OCA\EtherpadNextcloud\Exception\PadTypeDisabledException::class);
+
+		$service->initializeMissingFrontmatter('alice', $file, '');
+	}
+
+	public function testBlankInitialisationFallsBackToPublicWhenProtectedPadsAreDisabled(): void {
+		// A .pad can arrive outside the UI (WebDAV, another integration). If
+		// protected pads are off but public ones are allowed, the file must
+		// still become openable instead of 403-ing forever.
+		$bindingService = $this->createMock(BindingService::class);
+		$bindingService->method('findByFileId')->willReturn(null);
+		$bindingService->expects($this->once())
+			->method('createBinding')
+			->with(4321, 'nc-abcdefghijklmnopqrstuvwx', BindingService::ACCESS_PUBLIC);
+
+		$padFileService = $this->createMock(PadFileService::class);
+		$padFileService->method('parseLegacyOwnpadShortcut')->willReturn(null);
+		$padFileService->method('buildInitialDocument')->willReturn('doc-content');
+
+		$etherpadClient = $this->createMock(EtherpadClient::class);
+		$etherpadClient->expects($this->never())->method('createGroupPad');
+		$etherpadClient->expects($this->once())->method('createPad')->with('nc-abcdefghijklmnopqrstuvwx');
+		$etherpadClient->method('buildPadUrl')->willReturn('https://pad.example.test/p/nc-abcdefghijklmnopqrstuvwx');
+
+		$secureRandom = $this->createMock(ISecureRandom::class);
+		$secureRandom->method('generate')->willReturn('abcdefghijklmnopqrstuvwx');
+
+		$file = $this->createMock(File::class);
+		$file->method('getId')->willReturn(4321);
+		$file->expects($this->once())->method('putContent')->with('doc-content');
+
 		$service = new PadBootstrapService(
 			$bindingService,
 			$padFileService,
 			$etherpadClient,
-			$this->createMock(ISecureRandom::class),
+			$secureRandom,
 			$this->createMock(LoggerInterface::class),
 			$this->createMock(\OCA\EtherpadNextcloud\Service\PadLegacyMigrationService::class),
-			$this->buildPadTypePolicy(false),
+			$this->buildPadTypePolicy(false, true),
 		);
 
-		$this->expectException(\OCA\EtherpadNextcloud\Exception\PadTypeDisabledException::class);
-
 		$service->initializeMissingFrontmatter('alice', $file, '');
 	}
 
+	private function buildService(
+		BindingService $bindingService,
+		PadFileService $padFileService,
+		EtherpadClient $etherpadClient,
+		\OCA\EtherpadNextcloud\Service\PadTypePolicy $policy,
+	): PadBootstrapService {
+		return new PadBootstrapService(
+			$bindingService,
+			$padFileService,
+			$etherpadClient,
+			$this->createMock(ISecureRandom::class),
+			$this->createMock(LoggerInterface::class),
+			$this->createMock(\OCA\EtherpadNextcloud\Service\PadLegacyMigrationService::class),
+			$policy,
+		);
+	}
+
 	public function testExistingBindingStillInitialisesWhenProtectedPadsAreDisabled(): void {
 		// The pad already exists; the setting governs creation only, so this
 		// file must keep opening.
@@ -259,14 +308,14 @@ public function testLegacyMigrationStillRunsWhenProtectedPadsAreDisabled(): void
 		));
 	}
 
-	private function buildPadTypePolicy(bool $protectedEnabled): \OCA\EtherpadNextcloud\Service\PadTypePolicy {
+	private function buildPadTypePolicy(bool $protectedEnabled, bool $publicEnabled = true): \OCA\EtherpadNextcloud\Service\PadTypePolicy {
 		$config = $this->createMock(\OCP\IConfig::class);
 		$config->method('getAppValue')->willReturnCallback(
-			static fn (string $app, string $key, string $default = ''): string => (
-				$key === \OCA\EtherpadNextcloud\Service\PadTypePolicy::SETTING_PROTECTED
-					? ($protectedEnabled ? 'yes' : 'no')
-					: $default
-			)
+			static fn (string $app, string $key, string $default = ''): string => match ($key) {
+				\OCA\EtherpadNextcloud\Service\PadTypePolicy::SETTING_PROTECTED => $protectedEnabled ? 'yes' : 'no',
+				\OCA\EtherpadNextcloud\Service\PadTypePolicy::SETTING_PUBLIC => $publicEnabled ? 'yes' : 'no',
+				default => $default,
+			}
 		);
 		return new \OCA\EtherpadNextcloud\Service\PadTypePolicy($config);
 	}

tests/phpunit/unit/PadTypePolicyTest.php

@@ -67,7 +67,7 @@ public function testTemplateKeepsItsOwnModeWhenThatTypeIsEnabled(): void {
 
 		self::assertSame(
 			BindingService::ACCESS_PUBLIC,
-			$policy->resolveForTemplate(BindingService::ACCESS_PUBLIC)
+			$policy->resolveCreatableMode(BindingService::ACCESS_PUBLIC)
 		);
 	}
 
@@ -78,7 +78,7 @@ public function testTemplateFallsBackToTheEnabledTypeInsteadOfFailing(): void {
 
 		self::assertSame(
 			BindingService::ACCESS_PROTECTED,
-			$policy->resolveForTemplate(BindingService::ACCESS_PUBLIC)
+			$policy->resolveCreatableMode(BindingService::ACCESS_PUBLIC)
 		);
 	}
 
@@ -87,7 +87,7 @@ public function testTemplateFallsBackToPublicWhenProtectedIsDisabled(): void {
 
 		self::assertSame(
 			BindingService::ACCESS_PUBLIC,
-			$policy->resolveForTemplate(BindingService::ACCESS_PROTECTED)
+			$policy->resolveCreatableMode(BindingService::ACCESS_PROTECTED)
 		);
 	}
 
@@ -98,7 +98,7 @@ public function testTemplateFailsWhenNoPadTypeIsEnabledAtAll(): void {
 		]);
 
 		try {
-			$policy->resolveForTemplate(BindingService::ACCESS_PROTECTED);
+			$policy->resolveCreatableMode(BindingService::ACCESS_PROTECTED);
 			self::fail('Expected PadTypeDisabledException');
 		} catch (PadTypeDisabledException $e) {
 			// No single mode to blame when nothing is enabled.