feat(OCM-Invites): Implement exchanging cloud IDs through OCM invitation workflow

see https://github.com/cs3org/OCM-API/blob/v1.2.1/IETF-RFC.md

Features:
 - Button to invite remote users to exchange cloudIDs.
 - Button to manually accept invite to exchange cloudIDs.
 - WAYF page allowing the receiver of the invite to select provider and accept the invitation.
 - Listing of open invitations.
 - Option to resend, revoke open invitations.
 - Administer invitation settings

Signed-off-by: Antoon P. <antoon.prins@surf.nl>
Co-authored-by: Micke Nordin <kano@sunet.se>
Co-authored-by: Mahdi Baghbani <mahdi-baghbani@azadehafzar.io>

Author: 3 people

appinfo/info.xml

@@ -49,6 +49,8 @@
 
 	<background-jobs>
 		<job>OCA\Contacts\Cron\SocialUpdateRegistration</job>
+		<job>OCA\Contacts\Cron\UpdateOcmProviders</job>
+		<job>OCA\Contacts\Cron\UpdateDeltaOcmProviders</job>
 	</background-jobs>
 
 	<settings>

lib/AppInfo/Application.php

@@ -7,17 +7,23 @@
 namespace OCA\Contacts\AppInfo;
 
 use OCA\Contacts\Capabilities;
+use OCA\Contacts\ConfigLexicon;
 use OCA\Contacts\Dav\PatchPlugin;
 use OCA\Contacts\Event\LoadContactsOcaApiEvent;
+use OCA\Contacts\Listener\FederatedInviteAcceptedListener;
 use OCA\Contacts\Listener\LoadContactsFilesActions;
 use OCA\Contacts\Listener\LoadContactsOcaApi;
+use OCA\Contacts\Listener\OcmDiscoveryListener;
 use OCA\DAV\Events\SabrePluginAddEvent;
 use OCA\Files\Event\LoadAdditionalScriptsEvent;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
 use OCP\EventDispatcher\IEventDispatcher;
+use OCP\OCM\Events\LocalOCMDiscoveryEvent;
+use OCP\OCM\Events\OCMEndpointRequestEvent;
+use OCP\OCM\Events\ResourceTypeRegisterEvent;
 
 class Application extends App implements IBootstrap {
 	public const APP_ID = 'contacts';
@@ -37,8 +43,15 @@ public function __construct() {
 	#[\Override]
 	public function register(IRegistrationContext $context): void {
 		$context->registerCapability(Capabilities::class);
+		$context->registerConfigLexicon(ConfigLexicon::class);
+
 		$context->registerEventListener(LoadAdditionalScriptsEvent::class, LoadContactsFilesActions::class);
 		$context->registerEventListener(LoadContactsOcaApiEvent::class, LoadContactsOcaApi::class);
+		$context->registerEventListener(OCMEndpointRequestEvent::class, FederatedInviteAcceptedListener::class);
+		$ocmDiscoveryEvent = class_exists(LocalOCMDiscoveryEvent::class)
+			? LocalOCMDiscoveryEvent::class
+			: ResourceTypeRegisterEvent::class;
+		$context->registerEventListener($ocmDiscoveryEvent, OcmDiscoveryListener::class);
 	}
 
 	#[\Override]

lib/ConfigLexicon.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Contacts;
+
+use OCP\Config\Lexicon\Entry;
+use OCP\Config\Lexicon\ILexicon;
+use OCP\Config\Lexicon\Strictness;
+use OCP\Config\ValueType;
+use OCP\IAppConfig;
+
+/**
+ * Config Lexicon for contacts.
+ *
+ * Please add and manage your config keys in this file and keep the
+ * Lexicon up to date.
+ *
+ * {@see ILexicon}
+ */
+class ConfigLexicon implements ILexicon {
+	public const OCM_INVITES_ENABLED = 'ocm_invites_enabled';
+	public const OCM_INVITES_OPTIONAL_MAIL = 'ocm_invites_optional_mail';
+	public const OCM_INVITES_ENCODED_COPY_BUTTON = 'ocm_invites_encoded_copy_button';
+	public const OCM_INVITES_DISABLE_SSRF_GUARD = 'ocm_invites_disable_ssrf_guard';
+	public const MESH_PROVIDERS_SERVICE = 'mesh_providers_service';
+	public const WAYF_ENDPOINT = 'wayf_endpoint';
+	public const FEDERATIONS_CACHE = 'federations_cache';
+	public const FEDERATIONS_CACHE_EXPIRES = 'expires';
+	public const FEDERATIONS_CACHE_DELTA_EXPIRES = 'delta_expires';
+
+	#[\Override]
+	public function getStrictness(): Strictness {
+		return Strictness::NOTICE;
+	}
+
+	#[\Override]
+	public function getAppConfigs(): array {
+		return [
+			new Entry(
+				self::OCM_INVITES_ENABLED,
+				ValueType::BOOL,
+				defaultRaw: false,
+				definition: 'Whether OCM invites for contacts are enabled.',
+				lazy: true,
+			),
+			new Entry(
+				self::OCM_INVITES_OPTIONAL_MAIL,
+				ValueType::BOOL,
+				defaultRaw: false,
+				definition: 'Whether the recipient email field is optional when creating an OCM invite.',
+				lazy: true,
+			),
+			new Entry(
+				self::OCM_INVITES_ENCODED_COPY_BUTTON,
+				ValueType::BOOL,
+				defaultRaw: false,
+				definition: 'Whether the invite email "Open invite" button uses the encoded WAYF URL instead of the raw token.',
+				lazy: true,
+			),
+			new Entry(
+				self::OCM_INVITES_DISABLE_SSRF_GUARD,
+				ValueType::BOOL,
+				defaultRaw: false,
+				definition: 'Unsafe development override that disables private-host and localhost checks for OCM invite discovery.',
+				lazy: true,
+			),
+			new Entry(
+				self::MESH_PROVIDERS_SERVICE,
+				ValueType::STRING,
+				defaultRaw: '',
+				definition: 'Space-separated list of mesh provider service URLs used for WAYF discovery.',
+				lazy: true,
+			),
+			new Entry(
+				self::WAYF_ENDPOINT,
+				ValueType::STRING,
+				defaultRaw: '',
+				definition: 'Optional override for the base WAYF endpoint used in invite links.',
+				note: 'If empty, the app route is used at runtime.',
+				lazy: true,
+			),
+			new Entry(
+				self::FEDERATIONS_CACHE,
+				ValueType::ARRAY,
+				defaultRaw: [],
+				definition: 'Internal cron-maintained cache for discovered federations and expiry metadata.',
+				flags: IAppConfig::FLAG_SENSITIVE,
+				lazy: true,
+			),
+			new Entry(
+				self::FEDERATIONS_CACHE_EXPIRES,
+				ValueType::INT,
+				defaultRaw: 0,
+				definition: 'Federations cache refresh expiration time.',
+				lazy: true,
+			),
+			new Entry(
+				self::FEDERATIONS_CACHE_DELTA_EXPIRES,
+				ValueType::INT,
+				defaultRaw: 0,
+				definition: 'Federations cache update (delta) expiration time.',
+				lazy: true,
+			),
+		];
+	}
+
+	#[\Override]
+	public function getUserConfigs(): array {
+		return [];
+	}
+}