fix(encryption): Refactor EncryptionWrapper, fix zero-byte size, add S3 tests

[cuppett]

Summary

This PR makes several improvements to Nextcloud's encryption infrastructure:

1. Refactored EncryptionWrapper logic - Cleaner, more explicit conditional flow
2. Added HomeMountPoint support - Respects encryptHomeStorage setting for home storage mounts
3. Fixed zero-byte encrypted file size - Files with 0 bytes no longer incorrectly report as 8192 bytes
4. Added S3 encryption test suite - Comprehensive tests for encryption with S3 primary storage
5. Fixed test isolation - Prevents encryption state pollution between test runs

Changes

Code Fixes

lib/private/Encryption/EncryptionWrapper.php

Refactored storage wrapper logic:

• Restructured conditionals for clarity (inverted logic for early returns)
• Added support for encryptHomeStorage setting on HomeMountPoint mounts
• Encryption wrapper is now always applied (when not explicitly disabled), allowing encryption to be dynamically enabled/disabled

lib/private/Files/Cache/CacheEntry.php & lib/private/Files/FileInfo.php

Fixed zero-byte file size reporting:

• Removed > 0 check that caused 0-byte encrypted files to report as 8192 bytes (encryption header size)

Test Infrastructure

New: tests/lib/Files/ObjectStore/S3EncryptionTest.php (493 lines)

Comprehensive S3 encryption test suite covering:

• Size consistency across database, S3, and actual content
• Round-trip encryption/decryption for various file sizes (0 bytes to 110MB)
• Streaming integrity, partial reads, seeking operations
• Multipart upload support

New: tests/lib/Files/ObjectStore/S3EncryptionMigrationTest.php (270 lines)

Migration scenario tests:

• Mixed encrypted/unencrypted content handling
• Safe migration with encryption:encrypt-all

tests/lib/TestCase.php + 5 encryption test files

Fixed test pollution:

• Added global encryption cleanup in tearDown()
• Prevents MultiKeyEncryptException failures from state leakage between tests

Files Changed

File	Change
lib/private/Encryption/EncryptionWrapper.php	Refactored wrapper logic, added HomeMountPoint check
lib/private/Files/Cache/CacheEntry.php	Fixed zero-byte size check
lib/private/Files/FileInfo.php	Fixed zero-byte size check
tests/lib/TestCase.php	Added encryption cleanup in tearDown()
tests/lib/Encryption/EncryptionWrapperTest.php	Updated mock for new logic
tests/lib/Files/ObjectStore/S3EncryptionTest.php	New - S3 encryption tests
tests/lib/Files/ObjectStore/S3EncryptionMigrationTest.php	New - Migration tests
5 encryption test files in apps/	Added tearDown cleanup

Backward Compatibility

✅ Fully backward compatible

• No breaking changes to APIs or behavior
• Existing encrypted files continue to work
• encryptHomeStorage setting defaults to enabled ('1')

Testing

Run the S3 encryption tests:

OBJECT_STORE=s3 phpunit tests/lib/Files/ObjectStore/S3EncryptionTest.php

[CarlSchwan]

Failing test seems related. e.g.

2025-12-29T07:08:54.4550616Z 1) Test\Files\ViewTest::testCopyBetweenStorageNoCross
2025-12-29T07:08:54.4551112Z BadMethodCallException: path needs to be relative to the system wide data folder and point to a user specific file
2025-12-29T07:08:54.4552424Z 
2025-12-29T07:08:54.4552642Z /home/runner/actions-runner/_work/server/server/lib/private/Encryption/Util.php:208
2025-12-29T07:08:54.4553192Z /home/runner/actions-runner/_work/server/server/lib/private/Encryption/Keys/Storage.php:418
2025-12-29T07:08:54.4553758Z /home/runner/actions-runner/_work/server/server/lib/private/Encryption/Keys/Storage.php:368
2025-12-29T07:08:54.4554377Z /home/runner/actions-runner/_work/server/server/lib/private/Files/Storage/Wrapper/Encryption.php:877
2025-12-29T07:08:54.4555029Z /home/runner/actions-runner/_work/server/server/lib/private/Files/Storage/Wrapper/Encryption.php:673
2025-12-29T07:08:54.4555559Z /home/runner/actions-runner/_work/server/server/lib/private/Files/Storage/Wrapper/Encryption.php:582
2025-12-29T07:08:54.4556062Z /home/runner/actions-runner/_work/server/server/lib/private/Files/Storage/Wrapper/Wrapper.php:289
2025-12-29T07:08:54.4556501Z /home/runner/actions-runner/_work/server/server/lib/private/Files/View.php:968
2025-12-29T07:08:54.4556878Z /home/runner/actions-runner/_work/server/server/tests/lib/Files/ViewTest.php:475
2025-12-29T07:08:54.4557827Z /home/runner/actions-runner/_work/server/server/tests/lib/Files/ViewTest.php:454

[icewind1991]

Impact: When S3 is configured as primary object storage (via objectstore in config.php), it mounts at /, so encryption was NEVER applied, regardless of settings.

This is not true, the home storage is mounted at /$user same as with local storage.

[Copilot]

Pull request overview

This PR refines Nextcloud’s encryption behavior (wrapper application + home-mount handling), fixes incorrect size reporting for encrypted zero-byte files, and expands/isolates encryption test coverage (including new S3 primary-storage encryption tests).

Changes:

• Refactor EncryptionWrapper flow and add HomeMountPoint + encryptHomeStorage handling.
• Fix encrypted size propagation by treating unencrypted_size = 0 as a valid value in cache/fileinfo paths.
• Add S3 encryption test suites and broaden test cleanup to avoid encryption state leaking between tests.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/lib/Traits/EncryptionTrait.php	Switch test encryption enable/restore to IAppConfig APIs.
tests/lib/TestCase.php	Add global teardown cleanup for encryption app-config state.
tests/lib/Files/ObjectStore/S3EncryptionTest.php	New integration test suite for encryption + S3 primary storage (sizes, reads, seeks, multipart).
tests/lib/Files/ObjectStore/S3EncryptionMigrationTest.php	New migration-oriented tests for mixed encrypted/unencrypted S3 content.
tests/lib/Encryption/EncryptionWrapperTest.php	Adjust wrapper test expectations/mocking for updated logic.
tests/Core/Command/Encryption/EnableTest.php	Update command test to use IAppConfig methods.
tests/Core/Command/Encryption/DisableTest.php	Update command test to use IAppConfig methods.
lib/private/Files/Stream/Encryption.php	Broaden $unencryptedSize property type to accept int/float/null.
lib/private/Files/Storage/Wrapper/Encryption.php	Tighten plausibility checks for unencryptedSize to trigger recalculation.
lib/private/Files/FileInfo.php	Return unencrypted_size even when it is 0 for encrypted entries.
lib/private/Files/Cache/Scanner.php	Adjust scanner update/unset logic for unencrypted_size.
lib/private/Files/Cache/CacheEntry.php	Return unencrypted_size even when it is 0 for encrypted entries.
lib/private/Encryption/EncryptionWrapper.php	Refactor early-return logic; add HomeMountPoint handling for encryptHomeStorage.
core/Command/Encryption/Enable.php	Use IAppConfig for encryption_enabled / default module reads/writes.
core/Command/Encryption/Disable.php	Use IAppConfig for encryption_enabled reads/writes.
build/psalm-baseline.xml	Update baseline entries (including new Imagick-related suppressions).
apps/files_sharing/tests/EncryptedSizePropagationTest.php	Add encryption trait teardown to prevent state leakage.
apps/encryption/tests/EncryptedStorageTest.php	Add encryption trait teardown to prevent state leakage.
apps/encryption/tests/Command/FixEncryptedVersionTest.php	Add encryption trait teardown to prevent state leakage.
apps/dav/tests/unit/Connector/Sabre/RequestTest/EncryptionUploadTest.php	Add encryption trait teardown to prevent state leakage.
apps/dav/tests/unit/Connector/Sabre/RequestTest/EncryptionMasterKeyUploadTest.php	Add encryption trait teardown to prevent state leakage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 12 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cuppett]

@copilot apply changes based on the comments in this thread

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

lib/private/Files/FileInfo.php:170

• getSize(false) returns $this->rawSize, but rawSize is initialized in the constructor only when unencrypted_size !== 0. With this change, encrypted empty files will now return unencrypted_size (0) for getSize(true), while getSize(false) will still return the encrypted size (e.g. header size). Consider initializing rawSize from unencrypted_size whenever it is set (even when it is 0) to keep both code paths consistent for 0-byte encrypted files.

	public function getSize($includeMounts = true) {
		if ($includeMounts) {
			$this->updateEntryFromSubMounts();

			if ($this->isEncrypted() && isset($this->data['unencrypted_size'])) {
				return $this->data['unencrypted_size'];
			} else {
				return isset($this->data['size']) ? 0 + $this->data['size'] : 0;
			}
		} else {
			return $this->rawSize;
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

If the primary object store is configured with arguments.multibucket = true, the effective bucket name is user-dependent (see PrimaryObjectStoreConfig::getBucketForUser() / homeobjectstore user config). Using the raw arguments['bucket'] here will point headObject at the wrong bucket. Consider either resolving the effective bucket for TEST_USER or skipping when multibucket is enabled.

Suggested change

	$this->s3Config = Server::get(IConfig::class)->getSystemValue('objectstore');
	$this->s3Config = Server::get(IConfig::class)->getSystemValue('objectstore');
	if (($this->s3Config['arguments']['multibucket'] ?? false) === true) {
	self::markTestSkipped('S3 encryption test does not support multibucket primary object storage because direct bucket inspection requires resolving the effective bucket for the test user.');
	}