Repository: owncloud/ocis
Pull request #8132 (2024-01-04 12:03:44)

[skip-ci][changelog] disallow to delete a file during the processing
<!--
Thanks for submitting a change to ownCloud!

This is the bug tracker for the oCIS component. Find other components at https://github.com/owncloud/core/blob/master/.github/CONTRIBUTING.md#guidelines

For fixing potential security issues please see https://owncloud.org/security/

To make it possible for us to get your change reviewed and merged please carefully fill out the requested information below.

Please note that any kind of change needs first be submitted to the master branch which holds the next version of oCIS.

Please set the following labels:

- Set label "Status:Needs-Review" for review or "Status:In-Progress" if the PR still has open tasks.
- Assignment: assign to self
- Reviewers: pick at least one
-->

## Description
<!--- Describe your changes in detail -->
Disallow to delete a file during the processing.

Related fix [https://github.com/cs3org/reva/pull/4446](https://github.com/cs3org/reva/pull/4446)

## Related Issue
<!--- This project only accepts pull requests related to open issues -->
<!--- If suggesting a new feature or change, please discuss it in an issue first -->
<!--- If fixing a bug, there should be an issue describing it with steps to reproduce -->
<!--- Please link to the issue here: -->
- Fixes [https://github.com/owncloud/ocis/issues/8127](https://github.com/owncloud/ocis/issues/8127)

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->
- test environment:
- test case 1:
- test case 2:
- ...

## Screenshots (if appropriate):

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Technical debt
- [ ] Tests only (no source changes)

## Checklist:
<!-- Tick the checkboxes when done. -->
<!-- Raise documentation ticket in owncloud.github.io/ -->
- [ ] Code changes
- [ ] Unit tests added
- [ ] Acceptance tests added
- [ ] Documentation ticket raised: <link> 


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132) **Quality Gate passed**  
Kudos, no new issues were introduced!

[0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
No data about Coverage  
No data about Duplication  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132)


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132) **Quality Gate passed**  
Kudos, no new issues were introduced!

[0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
No data about Coverage  
No data about Duplication  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132)


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132) **Quality Gate passed**  
Kudos, no new issues were introduced!

[0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
No data about Coverage  
No data about Duplication  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132)


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132) **Quality Gate passed**  
Kudos, no new issues were introduced!

[0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
No data about Coverage  
No data about Duplication  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132)


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132) **Quality Gate passed**  
The SonarCloud Quality Gate passed, but some issues were introduced.

[10 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=8132&resolved=false&inNewCodePeriod=true)  
[0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=8132&metric=new_coverage&view=list)  
[2.1% Duplication on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=8132&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=8132)



Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77349dfafe9..31b5f18cf7f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,15 +53,12 @@ The following sections list the changes for unreleased.
 * Bugfix - Cleanup `search/pkg/search/search.go`: [#8230](https://github.com/owncloud/ocis/pull/8230)
 * Bugfix - Graph/sharedWithMe works for shares from project spaces now: [#8233](https://github.com/owncloud/ocis/pull/8233)
 * Bugfix - Fix PATCH/DELETE status code for drives that don't support them: [#8235](https://github.com/owncloud/ocis/pull/8235)
-* Bugfix - Fix nats authentication: [#8236](https://github.com/owncloud/ocis/pull/8236)
-* Bugfix - Apply role constraints when creating shares via the graph API: [#8247](https://github.com/owncloud/ocis/pull/8247)
 * Bugfix - Fix concurrent access to a map: [#8269](https://github.com/owncloud/ocis/pull/8269)
-* Bugfix - Fix nats registry: [#8281](https://github.com/owncloud/ocis/pull/8281)
 * Enhancement - Disable the password policy: [#7985](https://github.com/owncloud/ocis/pull/7985)
 * Enhancement - Update antivirus service: [#8062](https://github.com/owncloud/ocis/pull/8062)
 * Enhancement - Remove deprecated environment variables: [#8149](https://github.com/owncloud/ocis/pull/8149)
 * Enhancement - Disable the password policy: [#8152](https://github.com/owncloud/ocis/pull/8152)
-* Enhancement - Update reva to latest edge version: [#8278](https://github.com/owncloud/ocis/pull/8278)
+* Enhancement - Update reva to latest edge version: [#8264](https://github.com/owncloud/ocis/pull/8264)
 
 ## Details
 
@@ -160,21 +157,6 @@ The following sections list the changes for unreleased.
    https://github.com/owncloud/ocis/issues/7881
    https://github.com/owncloud/ocis/pull/8235
 
-* Bugfix - Fix nats authentication: [#8236](https://github.com/owncloud/ocis/pull/8236)
-
-   Fixes nats authentication for registry/events/stores
-
-   https://github.com/owncloud/ocis/pull/8236
-
-* Bugfix - Apply role constraints when creating shares via the graph API: [#8247](https://github.com/owncloud/ocis/pull/8247)
-
-   We fixed a bug in the graph API for creating and updating shares so that
-   Spaceroot specific roles like 'Manager' and 'Co-owner' can no longer be assigned
-   for shares on files or directories.
-
-   https://github.com/owncloud/ocis/issues/8131
-   https://github.com/owncloud/ocis/pull/8247
-
 * Bugfix - Fix concurrent access to a map: [#8269](https://github.com/owncloud/ocis/pull/8269)
 
    We fixed the race condition that led to concurrent map access in a publicshare
@@ -184,15 +166,6 @@ The following sections list the changes for unreleased.
    https://github.com/owncloud/ocis/pull/8269
    https://github.com/cs3org/reva/pull/4472
 
-* Bugfix - Fix nats registry: [#8281](https://github.com/owncloud/ocis/pull/8281)
-
-   The nats registry would behave badly when configuring `nats-js-kv` via envvar.
-   Reason is the way go-micro initializes. It took 5 developers to find the issue
-   and the fix so the details cannot be shared here. Just accept that it is working
-   now
-
-   https://github.com/owncloud/ocis/pull/8281
-
 * Enhancement - Disable the password policy: [#7985](https://github.com/owncloud/ocis/pull/7985)
 
    We add the environment variable that allow to disable the password policy.
@@ -230,11 +203,10 @@ The following sections list the changes for unreleased.
    https://github.com/owncloud/ocis/pull/8152
    https://github.com/cs3org/reva/pull/4453
 
-* Enhancement - Update reva to latest edge version: [#8278](https://github.com/owncloud/ocis/pull/8278)
+* Enhancement - Update reva to latest edge version: [#8264](https://github.com/owncloud/ocis/pull/8264)
 
    We update reva to the latest edge version to get the latest fixes and features.
 
-   https://github.com/owncloud/ocis/pull/8278
    https://github.com/owncloud/ocis/pull/8264
    https://github.com/owncloud/ocis/pull/8100
 
diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md
index 1e32339c103..b08ffe6c430 100644
--- a/changelog/unreleased/bump-reva.md
+++ b/changelog/unreleased/bump-reva.md
@@ -2,6 +2,5 @@ Enhancement: Update reva to latest edge version
 
 We update reva to the latest edge version to get the latest fixes and features.
 
-https://github.com/owncloud/ocis/pull/8278
 https://github.com/owncloud/ocis/pull/8264
 https://github.com/owncloud/ocis/pull/8100
diff --git a/changelog/unreleased/fix-deleting-during-postprocessing.md b/changelog/unreleased/fix-deleting-during-postprocessing.md
new file mode 100644
index 00000000000..297b0357212
--- /dev/null
+++ b/changelog/unreleased/fix-deleting-during-postprocessing.md
@@ -0,0 +1,7 @@
+Bugfix: Disallow to delete a file during the processing
+
+We want to disallow deleting a file during the processing to prevent collecting the orphan uploads.
+
+https://github.com/owncloud/ocis/pull/8132
+https://github.com/cs3org/reva/pull/4446
+https://github.com/owncloud/ocis/issues/8127
diff --git a/changelog/unreleased/fix-nats-authentication.md b/changelog/unreleased/fix-nats-authentication.md
deleted file mode 100644
index 2ab13db9d8e..00000000000
--- a/changelog/unreleased/fix-nats-authentication.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Bugfix: Fix nats authentication
-
-Fixes nats authentication for registry/events/stores
-
-https://github.com/owncloud/ocis/pull/8236
diff --git a/changelog/unreleased/fix-nats-registry.md b/changelog/unreleased/fix-nats-registry.md
deleted file mode 100644
index ba5b29d0e38..00000000000
--- a/changelog/unreleased/fix-nats-registry.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Bugfix: Fix nats registry
-
-The nats registry would behave badly when configuring `nats-js-kv` via envvar. Reason is the way go-micro initializes.
-It took 5 developers to find the issue and the fix so the details cannot be shared here. Just accept that it is working now
-
-https://github.com/owncloud/ocis/pull/8281
diff --git a/changelog/unreleased/sharing-ng-roleconditions.md b/changelog/unreleased/sharing-ng-roleconditions.md
deleted file mode 100644
index efad06c1043..00000000000
--- a/changelog/unreleased/sharing-ng-roleconditions.md
+++ /dev/null
@@ -1,8 +0,0 @@
-Bugfix: apply role constraints when creating shares via the graph API
-
-We fixed a bug in the graph API for creating and updating shares so that
-Spaceroot specific roles like 'Manager' and 'Co-owner' can no longer be
-assigned for shares on files or directories.
-
-https://github.com/owncloud/ocis/pull/8247
-https://github.com/owncloud/ocis/issues/8131
diff --git a/go.mod b/go.mod
index b51fe0cff96..21f9ec0b55c 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.9.0
 	github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781
-	github.com/cs3org/reva/v2 v2.18.1-0.20240124094635-6eec406c0be7
+	github.com/cs3org/reva/v2 v2.18.1-0.20240123151850-049234cc31e0
 	github.com/dhowden/tag v0.0.0-20230630033851-978a0926ee25
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
diff --git a/go.sum b/go.sum
index d36cd3ab029..524e8b8e9b0 100644
--- a/go.sum
+++ b/go.sum
@@ -1018,8 +1018,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
 github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781 h1:BUdwkIlf8IS2FasrrPg8gGPHQPOrQ18MS1Oew2tmGtY=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.18.1-0.20240124094635-6eec406c0be7 h1:g7vQAbo64ziFqqhKcim3JCjDW1zqHy9imAm2HZmmK8w=
-github.com/cs3org/reva/v2 v2.18.1-0.20240124094635-6eec406c0be7/go.mod h1:GCN3g6uYE0Nvd31dGlhaGGyUviUfbG2NkecPRv5oSc4=
+github.com/cs3org/reva/v2 v2.18.1-0.20240123151850-049234cc31e0 h1:btY1QRE5X4bvp7V+PUkQptFFBkB9QoJTObDNrX9G3EU=
+github.com/cs3org/reva/v2 v2.18.1-0.20240123151850-049234cc31e0/go.mod h1:GCN3g6uYE0Nvd31dGlhaGGyUviUfbG2NkecPRv5oSc4=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
 github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
 github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
diff --git a/ocis-pkg/natsjsregistry/options.go b/ocis-pkg/natsjsregistry/options.go
index dfcda616a59..a6e862a62a2 100644
--- a/ocis-pkg/natsjsregistry/options.go
+++ b/ocis-pkg/natsjsregistry/options.go
@@ -10,6 +10,7 @@ import (
 
 type storeOptionsKey struct{}
 type expiryKey struct{}
+type authKey struct{}
 
 // StoreOptions sets the options for the underlying store
 func StoreOptions(opts []store.Option) registry.Option {
@@ -30,3 +31,13 @@ func ServiceExpiry(t time.Duration) registry.Option {
 		o.Context = context.WithValue(o.Context, expiryKey{}, t)
 	}
 }
+
+// Authenticate sets the username/password for the nats connection
+func Authenticate(username, password string) registry.Option {
+	return func(o *registry.Options) {
+		if o.Context == nil {
+			o.Context = context.Background()
+		}
+		o.Context = context.WithValue(o.Context, authKey{}, []string{username, password})
+	}
+}
diff --git a/ocis-pkg/natsjsregistry/registry.go b/ocis-pkg/natsjsregistry/registry.go
index feeac744b9f..8be5d02d823 100644
--- a/ocis-pkg/natsjsregistry/registry.go
+++ b/ocis-pkg/natsjsregistry/registry.go
@@ -5,8 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"os"
-	"strings"
 	"time"
 
 	natsjskv "github.com/go-micro/plugins/v4/store/nats-js-kv"
@@ -16,12 +14,7 @@ import (
 	"go-micro.dev/v4/util/cmd"
 )
 
-var (
-	_registryName        = "nats-js-kv"
-	_registryAddressEnv  = "MICRO_REGISTRY_ADDRESS"
-	_registryUsernameEnv = "MICRO_REGISTRY_AUTH_USERNAME"
-	_registryPasswordEnv = "MICRO_REGISTRY_AUTH_PASSWORD"
-)
+var _registryName = "nats-js-kv"
 
 func init() {
 	cmd.DefaultRegistries[_registryName] = NewRegistry
@@ -134,31 +127,18 @@ func (n *storeregistry) String() string {
 
 func storeOptions(opts registry.Options) []store.Option {
 	storeoptions := []store.Option{
+		store.Nodes(opts.Addrs...),
 		store.Database("service-registry"),
 		store.Table("service-registry"),
-		natsjskv.DefaultMemory(),
 	}
-
-	addr := []string{"127.0.0.1:9233"}
-	if len(opts.Addrs) > 0 {
-		addr = opts.Addrs
-	} else if a := strings.Split(os.Getenv(_registryAddressEnv), ","); len(a) > 0 && a[0] != "" {
-		addr = a
+	if so, ok := opts.Context.Value(storeOptionsKey{}).([]store.Option); ok {
+		storeoptions = append(storeoptions, so...)
 	}
-	storeoptions = append(storeoptions, store.Nodes(addr...))
-
 	natsOptions := nats.GetDefaultOptions()
 	natsOptions.Name = "nats-js-kv-registry"
-	natsOptions.User, natsOptions.Password = getAuth()
-	storeoptions = append(storeoptions, natsjskv.NatsOptions(natsOptions))
-
-	if so, ok := opts.Context.Value(storeOptionsKey{}).([]store.Option); ok {
-		storeoptions = append(storeoptions, so...)
+	if auth, ok := opts.Context.Value(authKey{}).([]string); ok {
+		natsOptions.User = auth[0]
+		natsOptions.Password = auth[1]
 	}
-
-	return storeoptions
-}
-
-func getAuth() (string, string) {
-	return os.Getenv(_registryUsernameEnv), os.Getenv(_registryPasswordEnv)
+	return append(storeoptions, natsjskv.NatsOptions(natsOptions))
 }
diff --git a/ocis-pkg/registry/registry.go b/ocis-pkg/registry/registry.go
index 1672a1a8e17..0b6b3e71f03 100644
--- a/ocis-pkg/registry/registry.go
+++ b/ocis-pkg/registry/registry.go
@@ -20,8 +20,10 @@ import (
 )
 
 const (
-	_registryEnv        = "MICRO_REGISTRY"
-	_registryAddressEnv = "MICRO_REGISTRY_ADDRESS"
+	registryEnv         = "MICRO_REGISTRY"
+	registryAddressEnv  = "MICRO_REGISTRY_ADDRESS"
+	registryUsernameEnv = "MICRO_REGISTRY_AUTH_USERNAME"
+	registryPasswordEnv = "MICRO_REGISTRY_AUTH_PASSWORD"
 )
 
 var (
@@ -62,6 +64,7 @@ func GetRegistry(opts ...Option) mRegistry.Registry {
 		case "natsjs", "nats-js", "nats-js-kv": // for backwards compatibility - we will stick with one of those
 			_reg = natsjsregistry.NewRegistry(
 				mRegistry.Addrs(cfg.Addresses...),
+				natsjsregistry.Authenticate(cfg.Username, cfg.Password),
 			)
 		case "memory":
 			_reg = memr.NewRegistry()
@@ -109,13 +112,15 @@ func getEnvs(opts ...Option) *Config {
 	cfg := &Config{
 		Type:      "nats-js-kv",
 		Addresses: []string{"127.0.0.1:9233"},
+		Username:  os.Getenv(registryUsernameEnv),
+		Password:  os.Getenv(registryPasswordEnv),
 	}
 
-	if s := os.Getenv(_registryEnv); s != "" {
+	if s := os.Getenv(registryEnv); s != "" {
 		cfg.Type = s
 	}
 
-	if s := strings.Split(os.Getenv(_registryAddressEnv), ","); len(s) > 0 && s[0] != "" {
+	if s := strings.Split(os.Getenv(registryAddressEnv), ","); len(s) > 0 && s[0] != "" {
 		cfg.Addresses = s
 	}
 
diff --git a/ocis-pkg/shared/shared_types.go b/ocis-pkg/shared/shared_types.go
index a5c5aa336a3..9775daec31b 100644
--- a/ocis-pkg/shared/shared_types.go
+++ b/ocis-pkg/shared/shared_types.go
@@ -63,8 +63,6 @@ type Cache struct {
 	TTL                time.Duration `yaml:"ttl" env:"OCIS_CACHE_TTL" desc:"Time to live for events in the store. The duration can be set as number followed by a unit identifier like s, m or h."`
 	Size               int           `yaml:"size" env:"OCIS_CACHE_SIZE" desc:"The maximum quantity of items in the store. Only applies when store type 'ocmem' is configured."`
 	DisablePersistence bool          `yaml:"disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	AuthUsername       string        `yaml:"auth_username" env:"OCIS_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
-	AuthPassword       string        `yaml:"auth_password" env:"OCIS_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
 }
 
 // Commons holds configuration that are common to all extensions. Each extension can then decide whether
diff --git a/services/app-provider/pkg/command/server.go b/services/app-provider/pkg/command/server.go
index 6259e7b8498..8234b4391d6 100644
--- a/services/app-provider/pkg/command/server.go
+++ b/services/app-provider/pkg/command/server.go
@@ -33,7 +33,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -50,7 +50,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/app-registry/pkg/command/server.go b/services/app-registry/pkg/command/server.go
index 54bf5241035..543eb3f833d 100644
--- a/services/app-registry/pkg/command/server.go
+++ b/services/app-registry/pkg/command/server.go
@@ -32,7 +32,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -49,7 +49,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/auth-service/pkg/command/server.go b/services/auth-service/pkg/command/server.go
index 565f6757476..d656ef42a9d 100644
--- a/services/auth-service/pkg/command/server.go
+++ b/services/auth-service/pkg/command/server.go
@@ -12,13 +12,13 @@ import (
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
 	"github.com/owncloud/ocis/v2/ocis-pkg/registry"
 	"github.com/owncloud/ocis/v2/ocis-pkg/sync"
-	"github.com/owncloud/ocis/v2/ocis-pkg/tracing"
 	"github.com/owncloud/ocis/v2/ocis-pkg/version"
 	"github.com/owncloud/ocis/v2/services/auth-service/pkg/config"
 	"github.com/owncloud/ocis/v2/services/auth-service/pkg/config/parser"
 	"github.com/owncloud/ocis/v2/services/auth-service/pkg/logging"
 	"github.com/owncloud/ocis/v2/services/auth-service/pkg/revaconfig"
 	"github.com/owncloud/ocis/v2/services/auth-service/pkg/server/debug"
+	"github.com/owncloud/ocis/v2/services/auth-service/pkg/tracing"
 	"github.com/urfave/cli/v2"
 )
 
@@ -33,7 +33,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			err := tracing.Configure(cfg, logger)
 			if err != nil {
 				return err
 			}
@@ -43,16 +43,11 @@ func Server(cfg *config.Config) *cli.Command {
 			defer cancel()
 
 			pidFile := path.Join(os.TempDir(), "revad-"+cfg.Service.Name+"-"+uuid.Must(uuid.NewV4()).String()+".pid")
-			reg := registry.GetRegistry()
 
 			rcfg := revaconfig.AuthMachineConfigFromStruct(cfg)
 
 			gr.Add(func() error {
-				runtime.RunWithOptions(rcfg, pidFile,
-					runtime.WithLogger(&logger.Logger),
-					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
-				)
+				runtime.RunWithOptions(rcfg, pidFile, runtime.WithLogger(&logger.Logger))
 				return nil
 			}, func(err error) {
 				logger.Error().
diff --git a/services/auth-service/pkg/config/config.go b/services/auth-service/pkg/config/config.go
index 36ad90df57a..0314497006c 100644
--- a/services/auth-service/pkg/config/config.go
+++ b/services/auth-service/pkg/config/config.go
@@ -24,6 +24,12 @@ type Config struct {
 	Supervised bool            `yaml:"-"`
 	Context    context.Context `yaml:"-"`
 }
+type Tracing struct {
+	Enabled   bool   `yaml:"enabled" env:"OCIS_TRACING_ENABLED;AUTH_SERVICE_TRACING_ENABLED" desc:"Activates tracing."`
+	Type      string `yaml:"type" env:"OCIS_TRACING_TYPE;AUTH_SERVICE_TRACING_TYPE" desc:"The type of tracing. Defaults to '', which is the same as 'jaeger'. Allowed tracing types are 'jaeger' and '' as of now."`
+	Endpoint  string `yaml:"endpoint" env:"OCIS_TRACING_ENDPOINT;AUTH_SERVICE_TRACING_ENDPOINT" desc:"The endpoint of the tracing agent."`
+	Collector string `yaml:"collector" env:"OCIS_TRACING_COLLECTOR;AUTH_SERVICE_TRACING_COLLECTOR" desc:"The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset."`
+}
 
 type Log struct {
 	Level  string `yaml:"level" env:"OCIS_LOG_LEVEL;AUTH_SERVICE_LOG_LEVEL" desc:"The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'."`
diff --git a/services/auth-service/pkg/config/tracing.go b/services/auth-service/pkg/config/tracing.go
deleted file mode 100644
index 135de64c328..00000000000
--- a/services/auth-service/pkg/config/tracing.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package config
-
-import "github.com/owncloud/ocis/v2/ocis-pkg/tracing"
-
-// Tracing is the config for tracing parameters
-type Tracing struct {
-	Enabled   bool   `yaml:"enabled" env:"OCIS_TRACING_ENABLED;AUTH_SERVICE_TRACING_ENABLED" desc:"Activates tracing."`
-	Type      string `yaml:"type" env:"OCIS_TRACING_TYPE;AUTH_SERVICE_TRACING_TYPE" desc:"The type of tracing. Defaults to '', which is the same as 'jaeger'. Allowed tracing types are 'jaeger' and '' as of now."`
-	Endpoint  string `yaml:"endpoint" env:"OCIS_TRACING_ENDPOINT;AUTH_SERVICE_TRACING_ENDPOINT" desc:"The endpoint of the tracing agent."`
-	Collector string `yaml:"collector" env:"OCIS_TRACING_COLLECTOR;AUTH_SERVICE_TRACING_COLLECTOR" desc:"The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset."`
-}
-
-// Convert Tracing to the tracing package's Config struct.
-func (t Tracing) Convert() tracing.Config {
-	return tracing.Config{
-		Enabled:   t.Enabled,
-		Type:      t.Type,
-		Endpoint:  t.Endpoint,
-		Collector: t.Collector,
-	}
-}
diff --git a/services/auth-service/pkg/tracing/tracing.go b/services/auth-service/pkg/tracing/tracing.go
new file mode 100644
index 00000000000..357ca4ebb6d
--- /dev/null
+++ b/services/auth-service/pkg/tracing/tracing.go
@@ -0,0 +1,25 @@
+package tracing
+
+import (
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/services/auth-service/pkg/config"
+	"go.opentelemetry.io/otel/trace"
+
+	pkgtrace "github.com/owncloud/ocis/v2/ocis-pkg/tracing"
+)
+
+var (
+	// TraceProvider is the global trace provider for the service.
+	TraceProvider = trace.NewNoopTracerProvider()
+)
+
+func Configure(cfg *config.Config, logger log.Logger) error {
+	var err error
+	if cfg.Tracing.Enabled {
+		if TraceProvider, err = pkgtrace.GetTraceProvider(cfg.Tracing.Endpoint, cfg.Tracing.Collector, cfg.Service.Name, cfg.Tracing.Type); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/services/frontend/pkg/command/server.go b/services/frontend/pkg/command/server.go
index a60e81153dc..6fdc3a8ecd6 100644
--- a/services/frontend/pkg/command/server.go
+++ b/services/frontend/pkg/command/server.go
@@ -33,7 +33,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -54,7 +54,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/frontend/pkg/config/config.go b/services/frontend/pkg/config/config.go
index fa8c7b2fc1f..897627ad84a 100644
--- a/services/frontend/pkg/config/config.go
+++ b/services/frontend/pkg/config/config.go
@@ -137,8 +137,6 @@ type OCS struct {
 	StatCacheTTL                time.Duration `yaml:"stat_cache_ttl" env:"OCIS_CACHE_TTL;FRONTEND_OCS_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
 	StatCacheSize               int           `yaml:"stat_cache_size" env:"OCIS_CACHE_SIZE;FRONTEND_OCS_STAT_CACHE_SIZE" desc:"Max number of entries to hold in the cache."`
 	StatCacheDisablePersistence bool          `yaml:"stat_cache_disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false."`
-	StatCacheAuthUsername       string        `yaml:"stat_cache_auth_username" env:"OCIS_CACHE_AUTH_USERNAME;FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when using the 'nats-js-kv' store type."`
-	StatCacheAuthPassword       string        `yaml:"stat_cache_auth_password" env:"OCIS_CACHE_AUTH_PASSWORD;FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when using the 'nats-js-kv' store type."`
 
 	CacheWarmupDriver                    string             `yaml:"cache_warmup_driver,omitempty"`  // not supported by the oCIS product, therefore not part of docs
 	CacheWarmupDrivers                   CacheWarmupDrivers `yaml:"cache_warmup_drivers,omitempty"` // not supported by the oCIS product, therefore not part of docs
diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go
index 93ab7833aed..51c41385600 100644
--- a/services/frontend/pkg/revaconfig/config.go
+++ b/services/frontend/pkg/revaconfig/config.go
@@ -8,6 +8,7 @@ import (
 	"path"
 	"path/filepath"
 	"strconv"
+	"time"
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
@@ -159,11 +160,9 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 						"cache_nodes":               cfg.OCS.StatCacheNodes,
 						"cache_database":            cfg.OCS.StatCacheDatabase,
 						"cache_table":               cfg.OCS.StatCacheTable,
-						"cache_ttl":                 cfg.OCS.StatCacheTTL,
+						"cache_ttl":                 cfg.OCS.StatCacheTTL / time.Second,
 						"cache_size":                cfg.OCS.StatCacheSize,
 						"cache_disable_persistence": cfg.OCS.StatCacheDisablePersistence,
-						"cache_auth_username":       cfg.OCS.StatCacheAuthUsername,
-						"cache_auth_password":       cfg.OCS.StatCacheAuthPassword,
 					},
 					"prefix":                    cfg.OCS.Prefix,
 					"additional_info_attribute": cfg.OCS.AdditionalInfoAttribute,
diff --git a/services/gateway/pkg/config/config.go b/services/gateway/pkg/config/config.go
index a3242706b8e..e676f59ec4b 100644
--- a/services/gateway/pkg/config/config.go
+++ b/services/gateway/pkg/config/config.go
@@ -85,20 +85,22 @@ type StorageRegistry struct {
 
 // Cache holds cache config
 type Cache struct {
+	StatCacheStore                    string        // NOTE: The stat cache is not working atm. Hence we block configuring it
+	StatCacheNodes                    []string      `yaml:"stat_cache_nodes" env:"OCIS_CACHE_STORE_NODES;GATEWAY_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' or 'ocmem' stores are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details."`
+	StatCacheDatabase                 string        `yaml:"stat_cache_database" env:"OCIS_CACHE_DATABASE" desc:"The database name the configured store should use."`
+	StatCacheTTL                      time.Duration `yaml:"stat_cache_ttl" env:"OCIS_CACHE_TTL;GATEWAY_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
+	StatCacheSize                     int           `yaml:"stat_cache_size" env:"OCIS_CACHE_SIZE;GATEWAY_STAT_CACHE_SIZE" desc:"The maximum quantity of items in the cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
+	StatCacheDisablePersistence       bool          `yaml:"stat_cache_disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;GATEWAY_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the stat cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
 	ProviderCacheStore                string        `yaml:"provider_cache_store" env:"OCIS_CACHE_STORE;GATEWAY_PROVIDER_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details."`
 	ProviderCacheNodes                []string      `yaml:"provider_cache_nodes" env:"OCIS_CACHE_STORE_NODES;GATEWAY_PROVIDER_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' or 'ocmem' stores are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details."`
 	ProviderCacheDatabase             string        `yaml:"provider_cache_database" env:"OCIS_CACHE_DATABASE" desc:"The database name the configured store should use."`
 	ProviderCacheTTL                  time.Duration `yaml:"provider_cache_ttl" env:"OCIS_CACHE_TTL;GATEWAY_PROVIDER_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
 	ProviderCacheSize                 int           `yaml:"provider_cache_size" env:"OCIS_CACHE_SIZE;GATEWAY_PROVIDER_CACHE_SIZE" desc:"The maximum quantity of items in the cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
 	ProviderCacheDisablePersistence   bool          `yaml:"provider_cache_disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;GATEWAY_PROVIDER_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the provider cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	ProviderCacheAuthUsername         string        `yaml:"provider_cache_auth_username" env:"OCIS_CACHE_AUTH_USERNAME;GATEWAY_PROVIDER_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
-	ProviderCacheAuthPassword         string        `yaml:"provider_cache_auth_password" env:"OCIS_CACHE_AUTH_PASSWORD;GATEWAY_PROVIDER_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
 	CreateHomeCacheStore              string        `yaml:"create_home_cache_store" env:"OCIS_CACHE_STORE;GATEWAY_CREATE_HOME_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details."`
 	CreateHomeCacheNodes              []string      `yaml:"create_home_cache_nodes" env:"OCIS_CACHE_STORE_NODES;GATEWAY_CREATE_HOME_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' or 'ocmem' stores are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details."`
 	CreateHomeCacheDatabase           string        `yaml:"create_home_cache_database" env:"OCIS_CACHE_DATABASE" desc:"The database name the configured store should use."`
 	CreateHomeCacheTTL                time.Duration `yaml:"create_home_cache_ttl" env:"OCIS_CACHE_TTL;GATEWAY_CREATE_HOME_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
 	CreateHomeCacheSize               int           `yaml:"create_home_cache_size" env:"OCIS_CACHE_SIZE;GATEWAY_CREATE_HOME_CACHE_SIZE" desc:"The maximum quantity of items in the cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
 	CreateHomeCacheDisablePersistence bool          `yaml:"create_home_cache_disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;GATEWAY_CREATE_HOME_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the create home cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	CreateHomeCacheAuthUsername       string        `yaml:"create_home_cache_auth_username" env:"OCIS_CACHE_AUTH_USERNAME;GATEWAY_CREATE_HOME_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
-	CreateHomeCacheAuthPassword       string        `yaml:"create_home_cache_auth_password" env:"OCIS_CACHE_AUTH_PASSWORD;GATEWAY_CREATE_HOME_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured."`
 }
diff --git a/services/gateway/pkg/config/defaults/defaultconfig.go b/services/gateway/pkg/config/defaults/defaultconfig.go
index b8bea1a4bcc..f1ae8500422 100644
--- a/services/gateway/pkg/config/defaults/defaultconfig.go
+++ b/services/gateway/pkg/config/defaults/defaultconfig.go
@@ -39,6 +39,10 @@ func DefaultConfig() *config.Config {
 		DisableHomeCreationOnLogin: true,
 		TransferExpires:            24 * 60 * 60,
 		Cache: config.Cache{
+			StatCacheStore:          "noop", // NOTE: stat cache not working
+			StatCacheDatabase:       "ocis",
+			StatCacheNodes:          []string{"127.0.0.1:9233"},
+			StatCacheTTL:            300 * time.Second,
 			ProviderCacheStore:      "noop",
 			ProviderCacheNodes:      []string{"127.0.0.1:9233"},
 			ProviderCacheDatabase:   "cache-providers",
diff --git a/services/gateway/pkg/revaconfig/config.go b/services/gateway/pkg/revaconfig/config.go
index c13688aee9c..d1affa7a92a 100644
--- a/services/gateway/pkg/revaconfig/config.go
+++ b/services/gateway/pkg/revaconfig/config.go
@@ -61,6 +61,15 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]i
 					"transfer_shared_secret":         cfg.TransferSecret,
 					"transfer_expires":               cfg.TransferExpires,
 					// cache and TTLs
+					"stat_cache_config": map[string]interface{}{
+						"cache_store":              cfg.Cache.StatCacheStore,
+						"cache_nodes":              cfg.Cache.StatCacheNodes,
+						"cache_database":           cfg.Cache.StatCacheDatabase,
+						"cache_table":              "stat",
+						"cache_ttl":                cfg.Cache.StatCacheTTL,
+						"cache_size":               cfg.Cache.StatCacheSize,
+						"cache_disable_persistenc": cfg.Cache.StatCacheDisablePersistence,
+					},
 					"provider_cache_config": map[string]interface{}{
 						"cache_store":         cfg.Cache.ProviderCacheStore,
 						"cache_nodes":         cfg.Cache.ProviderCacheNodes,
@@ -69,8 +78,6 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]i
 						"cache_ttl":           cfg.Cache.ProviderCacheTTL,
 						"cache_size":          cfg.Cache.ProviderCacheSize,
 						"disable_persistence": cfg.Cache.ProviderCacheDisablePersistence,
-						"cache_auth_username": cfg.Cache.ProviderCacheAuthUsername,
-						"cache_auth_password": cfg.Cache.ProviderCacheAuthPassword,
 					},
 					"create_home_cache_config": map[string]interface{}{
 						"cache_store":               cfg.Cache.CreateHomeCacheStore,
@@ -80,8 +87,6 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]i
 						"cache_ttl":                 cfg.Cache.CreateHomeCacheTTL,
 						"cache_size":                cfg.Cache.CreateHomeCacheSize,
 						"cache_disable_persistence": cfg.Cache.CreateHomeCacheDisablePersistence,
-						"cache_auth_username":       cfg.Cache.CreateHomeCacheAuthUsername,
-						"cache_auth_password":       cfg.Cache.CreateHomeCacheAuthPassword,
 					},
 				},
 				"authregistry": map[string]interface{}{
diff --git a/services/graph/pkg/service/v0/driveitems.go b/services/graph/pkg/service/v0/driveitems.go
index ea6fc0ad757..da010478b4f 100644
--- a/services/graph/pkg/service/v0/driveitems.go
+++ b/services/graph/pkg/service/v0/driveitems.go
@@ -378,11 +378,6 @@ func (g Graph) ListPermissions(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	condition := unifiedrole.UnifiedRoleConditionGrantee
-	if IsSpaceRoot(statResponse.GetInfo().GetId()) {
-		condition = unifiedrole.UnifiedRoleConditionOwner
-	}
-
 	permissionSet := *statResponse.GetInfo().GetPermissionSet()
 	allowedActions := unifiedrole.CS3ResourcePermissionsToLibregraphActions(permissionSet)
 
@@ -391,7 +386,7 @@ func (g Graph) ListPermissions(w http.ResponseWriter, r *http.Request) {
 		LibreGraphPermissionsRolesAllowedValues: conversions.ToValueSlice(
 			unifiedrole.GetApplicableRoleDefinitionsForActions(
 				allowedActions,
-				condition,
+				unifiedrole.UnifiedRoleConditionGrantee,
 				g.config.FilesSharing.EnableResharing,
 				false,
 			),
@@ -457,18 +452,6 @@ func (g Graph) Invite(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	statResponse, err := gatewayClient.Stat(ctx, &storageprovider.StatRequest{Ref: &storageprovider.Reference{ResourceId: &itemID}})
-	if errCode := errorcode.FromStat(statResponse, err); errCode != nil {
-		g.logger.Warn().Err(errCode).Interface("stat.res", statResponse).Msg("stat failed")
-		errCode.Render(w, r)
-		return
-	}
-
-	condition := unifiedrole.UnifiedRoleConditionGrantee
-	if IsSpaceRoot(statResponse.GetInfo().GetId()) {
-		condition = unifiedrole.UnifiedRoleConditionOwner
-	}
-
 	unifiedRolePermissions := []*libregraph.UnifiedRolePermission{{AllowedResourceActions: driveItemInvite.LibreGraphPermissionsActions}}
 	for _, roleID := range driveItemInvite.GetRoles() {
 		role, err := unifiedrole.NewUnifiedRoleFromID(roleID, g.config.FilesSharing.EnableResharing)
@@ -478,15 +461,16 @@ func (g Graph) Invite(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		allowedResourceActions := unifiedrole.GetAllowedResourceActions(role, condition)
-		if len(allowedResourceActions) == 0 {
-			errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "role not applicable to this resource")
-			return
-		}
-
 		unifiedRolePermissions = append(unifiedRolePermissions, conversions.ToPointerSlice(role.GetRolePermissions())...)
 	}
 
+	statResponse, err := gatewayClient.Stat(ctx, &storageprovider.StatRequest{Ref: &storageprovider.Reference{ResourceId: &itemID}})
+	if errCode := errorcode.FromStat(statResponse, err); errCode != nil {
+		g.logger.Warn().Err(errCode).Interface("stat.res", statResponse).Msg("stat failed")
+		errCode.Render(w, r)
+		return
+	}
+
 	driveRecipient := driveItemInvite.GetRecipients()[0]
 
 	objectID := driveRecipient.GetObjectId()
@@ -502,7 +486,7 @@ func (g Graph) Invite(w http.ResponseWriter, r *http.Request) {
 	}
 
 	permission := &libregraph.Permission{}
-	if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(*cs3ResourcePermissions, condition, g.config.FilesSharing.EnableResharing); role != nil {
+	if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(*cs3ResourcePermissions, unifiedrole.UnifiedRoleConditionGrantee, g.config.FilesSharing.EnableResharing); role != nil {
 		permission.Roles = []string{role.GetId()}
 	}
 
diff --git a/services/graph/pkg/unifiedrole/unifiedrole.go b/services/graph/pkg/unifiedrole/unifiedrole.go
index fce338767c1..58890f8e81c 100644
--- a/services/graph/pkg/unifiedrole/unifiedrole.go
+++ b/services/graph/pkg/unifiedrole/unifiedrole.go
@@ -153,7 +153,7 @@ func NewCoownerUnifiedRole() *libregraph.UnifiedRoleDefinition {
 		RolePermissions: []libregraph.UnifiedRolePermission{
 			{
 				AllowedResourceActions: convert(r),
-				Condition:              proto.String(UnifiedRoleConditionOwner),
+				Condition:              proto.String(UnifiedRoleConditionGrantee),
 			},
 		},
 		LibreGraphWeight: proto.Int32(0),
@@ -185,6 +185,10 @@ func NewManagerUnifiedRole() *libregraph.UnifiedRoleDefinition {
 		Description: proto.String("Grants manager permissions on a resource. Semantically equivalent to co-owner"),
 		DisplayName: displayName(r),
 		RolePermissions: []libregraph.UnifiedRolePermission{
+			{
+				AllowedResourceActions: convert(r),
+				Condition:              proto.String(UnifiedRoleConditionGrantee),
+			},
 			{
 				AllowedResourceActions: convert(r),
 				Condition:              proto.String(UnifiedRoleConditionOwner),
diff --git a/services/groups/pkg/command/server.go b/services/groups/pkg/command/server.go
index 6690ebbb118..c1b43bc9459 100644
--- a/services/groups/pkg/command/server.go
+++ b/services/groups/pkg/command/server.go
@@ -34,7 +34,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -63,7 +63,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/ocdav/pkg/command/server.go b/services/ocdav/pkg/command/server.go
index 447e72d8c78..10f70334582 100644
--- a/services/ocdav/pkg/command/server.go
+++ b/services/ocdav/pkg/command/server.go
@@ -30,7 +30,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -86,7 +86,7 @@ func Server(cfg *config.Config) *cli.Command {
 					ocdav.MetricsEnabled(true),
 					ocdav.MetricsNamespace("ocis"),
 					ocdav.Tracing("Adding these strings is a workaround for ->", "https://github.com/cs3org/reva/issues/4131"),
-					ocdav.WithTraceProvider(traceProvider),
+					ocdav.WithTraceProvider(tracingProvider),
 				}
 
 				s, err := ocdav.Service(opts...)
diff --git a/services/settings/pkg/command/server.go b/services/settings/pkg/command/server.go
index b06302188d4..ca87133fb08 100644
--- a/services/settings/pkg/command/server.go
+++ b/services/settings/pkg/command/server.go
@@ -32,12 +32,12 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
 			cfg.GrpcClient, err = ogrpc.NewClient(
-				append(ogrpc.GetClientOptions(cfg.GRPCClientTLS), ogrpc.WithTraceProvider(traceProvider))...,
+				append(ogrpc.GetClientOptions(cfg.GRPCClientTLS), ogrpc.WithTraceProvider(tracingProvider))...,
 			)
 			if err != nil {
 				return err
@@ -65,7 +65,7 @@ func Server(cfg *config.Config) *cli.Command {
 				http.Config(cfg),
 				http.Metrics(mtrcs),
 				http.ServiceHandler(handle),
-				http.TraceProvider(traceProvider),
+				http.TraceProvider(tracingProvider),
 			)
 			if err != nil {
 				logger.Error().
@@ -87,7 +87,7 @@ func Server(cfg *config.Config) *cli.Command {
 				grpc.Config(cfg),
 				grpc.Metrics(mtrcs),
 				grpc.ServiceHandler(handle),
-				grpc.TraceProvider(traceProvider),
+				grpc.TraceProvider(tracingProvider),
 			)
 			servers.Add(grpcServer.Run, func(_ error) {
 				logger.Info().Str("server", "grpc").Msg("Shutting down server")
diff --git a/services/sharing/pkg/command/server.go b/services/sharing/pkg/command/server.go
index 61f72d65c53..8d18a3adcbd 100644
--- a/services/sharing/pkg/command/server.go
+++ b/services/sharing/pkg/command/server.go
@@ -34,7 +34,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -66,7 +66,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/sharing/pkg/config/config.go b/services/sharing/pkg/config/config.go
index 7d51d0b830c..24c8834d2ee 100644
--- a/services/sharing/pkg/config/config.go
+++ b/services/sharing/pkg/config/config.go
@@ -153,8 +153,6 @@ type Events struct {
 	TLSInsecure       bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;SHARING_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
 	TLSRootCaCertPath string `yaml:"tls_root_ca_cert_path" env:"OCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE;SHARING_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SHARING_EVENTS_TLS_INSECURE will be seen as false."`
 	EnableTLS         bool   `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;SHARING_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."`
-	AuthUsername      string `yaml:"auth_username" env:"OCIS_EVENTS_AUTH_USERNAME;SHARING_EVENTS_AUTH_USERNAME" desc:"Username for the events broker."`
-	AuthPassword      string `yaml:"auth_password" env:"OCIS_EVENTS_AUTH_PASSWORD;SHARING_EVENTS_AUTH_PASSWORD" desc:"Password for the events broker."`
 }
 
 // PasswordPolicy configures reva password policy
diff --git a/services/sharing/pkg/revaconfig/config.go b/services/sharing/pkg/revaconfig/config.go
index 8f02b796de4..b1f7e0d46a8 100644
--- a/services/sharing/pkg/revaconfig/config.go
+++ b/services/sharing/pkg/revaconfig/config.go
@@ -81,8 +81,6 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 								"natsclusterid":        cfg.Events.ClusterID,
 								"tlsinsecure":          cfg.Events.TLSInsecure,
 								"tlsrootcacertificate": cfg.Events.TLSRootCaCertPath,
-								"authusername":         cfg.Events.AuthUsername,
-								"authpassword":         cfg.Events.AuthPassword,
 							},
 						},
 					},
@@ -136,8 +134,6 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 					"tls-root-ca-cert": cfg.Events.TLSRootCaCertPath,
 					"enable-tls":       cfg.Events.EnableTLS,
 					"name":             "sharing-eventsmiddleware",
-					"username":         cfg.Events.AuthUsername,
-					"password":         cfg.Events.AuthPassword,
 				},
 				"prometheus": map[string]interface{}{
 					"namespace": "ocis",
diff --git a/services/storage-publiclink/pkg/command/server.go b/services/storage-publiclink/pkg/command/server.go
index 18da72cee52..6512252b758 100644
--- a/services/storage-publiclink/pkg/command/server.go
+++ b/services/storage-publiclink/pkg/command/server.go
@@ -33,7 +33,7 @@ func Server(cfg *config.Config) *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			traceProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
+			tracingProvider, err := tracing.GetServiceTraceProvider(cfg.Tracing, cfg.Service.Name)
 			if err != nil {
 				return err
 			}
@@ -50,7 +50,7 @@ func Server(cfg *config.Config) *cli.Command {
 				runtime.RunWithOptions(rCfg, pidFile,
 					runtime.WithLogger(&logger.Logger),
 					runtime.WithRegistry(reg),
-					runtime.WithTraceProvider(traceProvider),
+					runtime.WithTraceProvider(tracingProvider),
 				)
 
 				return nil
diff --git a/services/storage-system/pkg/config/config.go b/services/storage-system/pkg/config/config.go
index 6ebe5b7187b..e05a5245193 100644
--- a/services/storage-system/pkg/config/config.go
+++ b/services/storage-system/pkg/config/config.go
@@ -93,6 +93,4 @@ type Cache struct {
 	TTL                time.Duration `yaml:"ttl" env:"OCIS_CACHE_TTL;STORAGE_SYSTEM_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
 	Size               int           `yaml:"size" env:"OCIS_CACHE_SIZE;STORAGE_SYSTEM_CACHE_SIZE" desc:"The maximum quantity of items in the user info cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
 	DisablePersistence bool          `yaml:"disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;STORAGE_SYSTEM_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	AuthUsername       string        `yaml:"auth_username" env:"OCIS_CACHE_AUTH_USERNAME;STORAGE_SYSTEM_CACHE_AUTH_USERNAME" desc:"Username for the configured store. Only applies when store type 'nats-js-kv' is configured."`
-	AuthPassword       string        `yaml:"auth_password" env:"OCIS_CACHE_AUTH_PASSWORD;STORAGE_SYSTEM_CACHE_AUTH_PASSWORD" desc:"Password for the configured store. Only applies when store type 'nats-js-kv' is configured."`
 }
diff --git a/services/storage-system/pkg/revaconfig/config.go b/services/storage-system/pkg/revaconfig/config.go
index 5557552097e..16c1c3a09d9 100644
--- a/services/storage-system/pkg/revaconfig/config.go
+++ b/services/storage-system/pkg/revaconfig/config.go
@@ -1,6 +1,8 @@
 package revaconfig
 
 import (
+	"time"
+
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	"github.com/owncloud/ocis/v2/services/storage-system/pkg/config"
 )
@@ -163,11 +165,9 @@ func metadataDrivers(cfg *config.Config) map[string]interface{} {
 				"cache_store":               cfg.FileMetadataCache.Store,
 				"cache_nodes":               cfg.FileMetadataCache.Nodes,
 				"cache_database":            cfg.FileMetadataCache.Database,
-				"cache_ttl":                 cfg.FileMetadataCache.TTL,
+				"cache_ttl":                 cfg.FileMetadataCache.TTL / time.Second,
 				"cache_size":                cfg.FileMetadataCache.Size,
 				"cache_disable_persistence": cfg.FileMetadataCache.DisablePersistence,
-				"cache_auth_username":       cfg.FileMetadataCache.AuthUsername,
-				"cache_auth_password":       cfg.FileMetadataCache.AuthPassword,
 			},
 		},
 	}
diff --git a/services/storage-users/pkg/config/config.go b/services/storage-users/pkg/config/config.go
index 8fd16c74b87..77616b35d37 100644
--- a/services/storage-users/pkg/config/config.go
+++ b/services/storage-users/pkg/config/config.go
@@ -31,6 +31,7 @@ type Config struct {
 
 	TransferExpires   int64             `yaml:"transfer_expires" env:"STORAGE_USERS_TRANSFER_EXPIRES" desc:"the time after which the token for upload postprocessing expires"`
 	Events            Events            `yaml:"events"`
+	StatCache         StatCache         `yaml:"stat_cache"`
 	FilemetadataCache FilemetadataCache `yaml:"filemetadata_cache"`
 	IDCache           IDCache           `yaml:"id_cache"`
 	MountID           string            `yaml:"mount_id" env:"STORAGE_USERS_MOUNT_ID" desc:"Mount ID of this storage."`
@@ -181,6 +182,16 @@ type Events struct {
 	AuthPassword      string `yaml:"password" env:"OCIS_EVENTS_AUTH_PASSWORD;STORAGE_USERS_EVENTS_AUTH_PASSWORD" desc:"The password to authenticate with the events broker. The events broker is the ocis service which receives and delivers events between the services.."`
 }
 
+// StatCache holds cache config
+type StatCache struct {
+	Store              string        `yaml:"store" env:"OCIS_CACHE_STORE;STORAGE_USERS_STAT_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details."`
+	Nodes              []string      `yaml:"nodes" env:"OCIS_CACHE_STORE_NODES;STORAGE_USERS_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' or 'ocmem' stores are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details."`
+	Database           string        `yaml:"database" env:"OCIS_CACHE_DATABASE" desc:"The database name the configured store should use."`
+	TTL                time.Duration `yaml:"ttl" env:"OCIS_CACHE_TTL;STORAGE_USERS_STAT_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
+	Size               int           `yaml:"size" env:"OCIS_CACHE_SIZE;STORAGE_USERS_STAT_CACHE_SIZE" desc:"The maximum quantity of items in the user info cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
+	DisablePersistence bool          `yaml:"disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
+}
+
 // FilemetadataCache holds cache config
 type FilemetadataCache struct {
 	Store              string        `yaml:"store" env:"OCIS_CACHE_STORE;STORAGE_USERS_FILEMETADATA_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details."`
@@ -189,8 +200,6 @@ type FilemetadataCache struct {
 	TTL                time.Duration `yaml:"ttl" env:"OCIS_CACHE_TTL;STORAGE_USERS_FILEMETADATA_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details."`
 	Size               int           `yaml:"size" env:"OCIS_CACHE_SIZE;STORAGE_USERS_FILEMETADATA_CACHE_SIZE" desc:"The maximum quantity of items in the user info cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
 	DisablePersistence bool          `yaml:"disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_FILEMETADATA_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	AuthUsername       string        `yaml:"username" env:"OCIS_CACHE_AUTH_USERNAME;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured."`
-	AuthPassword       string        `yaml:"password" env:"OCIS_CACHE_AUTH_PASSWORD;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured."`
 }
 
 // IDCache holds cache config
@@ -201,8 +210,6 @@ type IDCache struct {
 	TTL                time.Duration `yaml:"ttl" env:"OCIS_CACHE_TTL;STORAGE_USERS_ID_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens have no expiration. Defaults to 300s which is derived from the underlaying package though not explicitly set as default. See the Environment Variable Types description for more details."`
 	Size               int           `yaml:"size" env:"OCIS_CACHE_SIZE;STORAGE_USERS_ID_CACHE_SIZE" desc:"The maximum quantity of items in the user info cache. Only applies when store type 'ocmem' is configured. Defaults to 512 which is derived from the ocmem package though not exclicitely set as default."`
 	DisablePersistence bool          `yaml:"disable_persistence" env:"OCIS_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_ID_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false."`
-	AuthUsername       string        `yaml:"username" env:"OCIS_CACHE_AUTH_USERNAME;STORAGE_USERS_ID_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured."`
-	AuthPassword       string        `yaml:"password" env:"OCIS_CACHE_AUTH_PASSWORD;STORAGE_USERS_ID_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured."`
 }
 
 // S3Driver is the storage driver configuration when using 's3' storage driver
diff --git a/services/storage-users/pkg/config/defaults/defaultconfig.go b/services/storage-users/pkg/config/defaults/defaultconfig.go
index 82a65ff7901..8bc070c6afc 100644
--- a/services/storage-users/pkg/config/defaults/defaultconfig.go
+++ b/services/storage-users/pkg/config/defaults/defaultconfig.go
@@ -94,6 +94,12 @@ func DefaultConfig() *config.Config {
 			ClusterID: "ocis-cluster",
 			EnableTLS: false,
 		},
+		StatCache: config.StatCache{
+			Store:    "memory",
+			Nodes:    []string{"127.0.0.1:9233"},
+			Database: "ocis",
+			TTL:      300 * time.Second,
+		},
 		FilemetadataCache: config.FilemetadataCache{
 			Store:    "memory",
 			Nodes:    []string{"127.0.0.1:9233"},
diff --git a/services/storage-users/pkg/revaconfig/config.go b/services/storage-users/pkg/revaconfig/config.go
index f8ecffd9b73..3966d86c56f 100644
--- a/services/storage-users/pkg/revaconfig/config.go
+++ b/services/storage-users/pkg/revaconfig/config.go
@@ -46,8 +46,6 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} {
 					"tls-root-ca-cert": cfg.Events.TLSRootCaCertPath,
 					"enable-tls":       cfg.Events.EnableTLS,
 					"name":             "storage-users-eventsmiddleware",
-					"username":         cfg.Events.AuthUsername,
-					"password":         cfg.Events.AuthPassword,
 				},
 				"prometheus": map[string]interface{}{
 					"namespace": "ocis",
@@ -72,8 +70,35 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} {
 					"nats_tls_insecure":      cfg.Events.TLSInsecure,
 					"nats_root_ca_cert_path": cfg.Events.TLSRootCaCertPath,
 					"nats_enable_tls":        cfg.Events.EnableTLS,
-					"nats_username":          cfg.Events.AuthUsername,
-					"nats_password":          cfg.Events.AuthPassword,
+					"data_txs": map[string]interface{}{
+						"simple": map[string]interface{}{
+							"cache_store":               cfg.StatCache.Store,
+							"cache_nodes":               cfg.StatCache.Nodes,
+							"cache_database":            cfg.StatCache.Database,
+							"cache_ttl":                 cfg.StatCache.TTL,
+							"cache_size":                cfg.StatCache.Size,
+							"cache_table":               "stat",
+							"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+						},
+						"spaces": map[string]interface{}{
+							"cache_store":               cfg.StatCache.Store,
+							"cache_nodes":               cfg.StatCache.Nodes,
+							"cache_database":            cfg.StatCache.Database,
+							"cache_ttl":                 cfg.StatCache.TTL,
+							"cache_size":                cfg.StatCache.Size,
+							"cache_table":               "stat",
+							"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+						},
+						"tus": map[string]interface{}{
+							"cache_store":               cfg.StatCache.Store,
+							"cache_nodes":               cfg.StatCache.Nodes,
+							"cache_database":            cfg.StatCache.Database,
+							"cache_ttl":                 cfg.StatCache.TTL,
+							"cache_size":                cfg.StatCache.Size,
+							"cache_table":               "stat",
+							"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+						},
+					},
 				},
 			},
 		},
diff --git a/services/storage-users/pkg/revaconfig/drivers.go b/services/storage-users/pkg/revaconfig/drivers.go
index 0a44caf74c8..a26bf8de476 100644
--- a/services/storage-users/pkg/revaconfig/drivers.go
+++ b/services/storage-users/pkg/revaconfig/drivers.go
@@ -132,6 +132,14 @@ func Ocis(cfg *config.Config) map[string]interface{} {
 		"max_concurrency":             cfg.Drivers.OCIS.MaxConcurrency,
 		"asyncfileuploads":            cfg.Drivers.OCIS.AsyncUploads,
 		"max_quota":                   cfg.Drivers.OCIS.MaxQuota,
+		"statcache": map[string]interface{}{
+			"cache_store":               cfg.StatCache.Store,
+			"cache_nodes":               cfg.StatCache.Nodes,
+			"cache_database":            cfg.StatCache.Database,
+			"cache_ttl":                 cfg.StatCache.TTL,
+			"cache_size":                cfg.StatCache.Size,
+			"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+		},
 		"filemetadatacache": map[string]interface{}{
 			"cache_store":               cfg.FilemetadataCache.Store,
 			"cache_nodes":               cfg.FilemetadataCache.Nodes,
@@ -139,8 +147,6 @@ func Ocis(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.FilemetadataCache.TTL,
 			"cache_size":                cfg.FilemetadataCache.Size,
 			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]interface{}{
 			"cache_store":               cfg.IDCache.Store,
@@ -149,11 +155,13 @@ func Ocis(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.IDCache.TTL,
 			"cache_size":                cfg.IDCache.Size,
 			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 		"events": map[string]interface{}{
-			"numconsumers": cfg.Events.NumConsumers,
+			"natsaddress":          cfg.Events.Addr,
+			"natsclusterid":        cfg.Events.ClusterID,
+			"tlsinsecure":          cfg.Events.TLSInsecure,
+			"tlsrootcacertificate": cfg.Events.TLSRootCaCertPath,
+			"numconsumers":         cfg.Events.NumConsumers,
 		},
 		"tokens": map[string]interface{}{
 			"transfer_shared_secret": cfg.Commons.TransferSecret,
@@ -185,6 +193,14 @@ func OcisNoEvents(cfg *config.Config) map[string]interface{} {
 		"lock_cycle_duration_factor":  cfg.Drivers.OCIS.LockCycleDurationFactor,
 		"max_concurrency":             cfg.Drivers.OCIS.MaxConcurrency,
 		"max_quota":                   cfg.Drivers.OCIS.MaxQuota,
+		"statcache": map[string]interface{}{
+			"cache_store":               cfg.StatCache.Store,
+			"cache_nodes":               cfg.StatCache.Nodes,
+			"cache_database":            cfg.StatCache.Database,
+			"cache_ttl":                 cfg.StatCache.TTL,
+			"cache_size":                cfg.StatCache.Size,
+			"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+		},
 		"filemetadatacache": map[string]interface{}{
 			"cache_store":               cfg.FilemetadataCache.Store,
 			"cache_nodes":               cfg.FilemetadataCache.Nodes,
@@ -192,8 +208,6 @@ func OcisNoEvents(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.FilemetadataCache.TTL,
 			"cache_size":                cfg.FilemetadataCache.Size,
 			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]interface{}{
 			"cache_store":               cfg.IDCache.Store,
@@ -202,8 +216,6 @@ func OcisNoEvents(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.IDCache.TTL,
 			"cache_size":                cfg.IDCache.Size,
 			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 	}
 }
@@ -247,6 +259,14 @@ func S3NG(cfg *config.Config) map[string]interface{} {
 		"lock_cycle_duration_factor":  cfg.Drivers.S3NG.LockCycleDurationFactor,
 		"max_concurrency":             cfg.Drivers.S3NG.MaxConcurrency,
 		"asyncfileuploads":            cfg.Drivers.OCIS.AsyncUploads,
+		"statcache": map[string]interface{}{
+			"cache_store":               cfg.StatCache.Store,
+			"cache_nodes":               cfg.StatCache.Nodes,
+			"cache_database":            cfg.StatCache.Database,
+			"cache_ttl":                 cfg.StatCache.TTL,
+			"cache_size":                cfg.StatCache.Size,
+			"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+		},
 		"filemetadatacache": map[string]interface{}{
 			"cache_store":               cfg.FilemetadataCache.Store,
 			"cache_nodes":               cfg.FilemetadataCache.Nodes,
@@ -254,8 +274,6 @@ func S3NG(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.FilemetadataCache.TTL,
 			"cache_size":                cfg.FilemetadataCache.Size,
 			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]interface{}{
 			"cache_store":               cfg.IDCache.Store,
@@ -264,11 +282,13 @@ func S3NG(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.IDCache.TTL,
 			"cache_size":                cfg.IDCache.Size,
 			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 		"events": map[string]interface{}{
-			"numconsumers": cfg.Events.NumConsumers,
+			"natsaddress":          cfg.Events.Addr,
+			"natsclusterid":        cfg.Events.ClusterID,
+			"tlsinsecure":          cfg.Events.TLSInsecure,
+			"tlsrootcacertificate": cfg.Events.TLSRootCaCertPath,
+			"numconsumers":         cfg.Events.NumConsumers,
 		},
 		"tokens": map[string]interface{}{
 			"transfer_shared_secret": cfg.Commons.TransferSecret,
@@ -304,6 +324,14 @@ func S3NGNoEvents(cfg *config.Config) map[string]interface{} {
 		"max_acquire_lock_cycles":     cfg.Drivers.S3NG.MaxAcquireLockCycles,
 		"max_concurrency":             cfg.Drivers.S3NG.MaxConcurrency,
 		"lock_cycle_duration_factor":  cfg.Drivers.S3NG.LockCycleDurationFactor,
+		"statcache": map[string]interface{}{
+			"cache_store":               cfg.StatCache.Store,
+			"cache_nodes":               cfg.StatCache.Nodes,
+			"cache_database":            cfg.StatCache.Database,
+			"cache_ttl":                 cfg.StatCache.TTL,
+			"cache_size":                cfg.StatCache.Size,
+			"cache_disable_persistence": cfg.StatCache.DisablePersistence,
+		},
 		"filemetadatacache": map[string]interface{}{
 			"cache_store":               cfg.FilemetadataCache.Store,
 			"cache_nodes":               cfg.FilemetadataCache.Nodes,
@@ -311,8 +339,6 @@ func S3NGNoEvents(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.FilemetadataCache.TTL,
 			"cache_size":                cfg.FilemetadataCache.Size,
 			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
 		},
 		"idcache": map[string]interface{}{
 			"cache_store":               cfg.IDCache.Store,
@@ -321,8 +347,6 @@ func S3NGNoEvents(cfg *config.Config) map[string]interface{} {
 			"cache_ttl":                 cfg.IDCache.TTL,
 			"cache_size":                cfg.IDCache.Size,
 			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
 		},
 	}
 }
diff --git a/vendor/github.com/cs3org/reva/v2/internal/grpc/services/sharesstorageprovider/sharesstorageprovider.go b/vendor/github.com/cs3org/reva/v2/internal/grpc/services/sharesstorageprovider/sharesstorageprovider.go
index 1d678d06bcf..432bcb15cec 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/grpc/services/sharesstorageprovider/sharesstorageprovider.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/grpc/services/sharesstorageprovider/sharesstorageprovider.go
@@ -321,7 +321,7 @@ func (s *service) GetPath(ctx context.Context, req *provider.GetPathRequest) (*p
 
 	return &provider.GetPathResponse{
 		Status: status.NewOK(ctx),
-		Path:   filepath.Clean("/" + receivedShare.MountPoint.Path),
+		Path:   receivedShare.MountPoint.Path,
 	}, nil
 
 }
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/copy.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/copy.go
index 166c110f3f0..7379cff0bf9 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/copy.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/copy.go
@@ -303,7 +303,6 @@ func (s *svc) executePathCopy(ctx context.Context, selector pool.Selectable[gate
 			return err
 		}
 		httpUploadReq.Header.Set(datagateway.TokenTransportHeader, uploadToken)
-		httpUploadReq.ContentLength = int64(cp.sourceInfo.GetSize())
 
 		httpUploadRes, err := s.client.Do(httpUploadReq)
 		if err != nil {
@@ -522,7 +521,6 @@ func (s *svc) executeSpacesCopy(ctx context.Context, w http.ResponseWriter, sele
 			return err
 		}
 		httpUploadReq.Header.Set(datagateway.TokenTransportHeader, uploadToken)
-		httpUploadReq.ContentLength = int64(cp.sourceInfo.GetSize())
 
 		httpUploadRes, err := s.client.Do(httpUploadReq)
 		if err != nil {
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/put.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/put.go
index 485629a3f4a..7a6324ce386 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/put.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/put.go
@@ -307,7 +307,6 @@ func (s *svc) handlePut(ctx context.Context, w http.ResponseWriter, r *http.Requ
 		}
 		Propagator.Inject(ctx, propagation.HeaderCarrier(httpReq.Header))
 		httpReq.Header.Set(datagateway.TokenTransportHeader, token)
-		httpReq.ContentLength = length
 
 		httpRes, err := s.client.Do(httpReq)
 		if err != nil {
diff --git a/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload.go b/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload.go
index 06d1583da6f..d3af49b90a2 100644
--- a/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload.go
+++ b/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload.go
@@ -72,21 +72,13 @@ func (fs *Decomposedfs) Upload(ctx context.Context, req storage.UploadRequest, u
 		defer fd.Close()
 		defer os.RemoveAll(assembledFile)
 		req.Body = fd
+	}
 
-		size, err := session.WriteChunk(ctx, 0, req.Body)
-		if err != nil {
-			return provider.ResourceInfo{}, errors.Wrap(err, "Decomposedfs: error writing to binary file")
-		}
-		session.SetSize(size)
-	} else {
-		size, err := session.WriteChunk(ctx, 0, req.Body)
-		if err != nil {
-			return provider.ResourceInfo{}, errors.Wrap(err, "Decomposedfs: error writing to binary file")
-		}
-		if size != req.Length {
-			return provider.ResourceInfo{}, errtypes.PartialContent("Decomposedfs: unexpected end of stream")
-		}
+	size, err := session.WriteChunk(ctx, 0, req.Body)
+	if err != nil {
+		return provider.ResourceInfo{}, errors.Wrap(err, "Decomposedfs: error writing to binary file")
 	}
+	session.SetSize(size)
 
 	if err := session.FinishUpload(ctx); err != nil {
 		return provider.ResourceInfo{}, err
diff --git a/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload/store.go b/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload/store.go
index def5e545f8e..ce479056423 100644
--- a/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload/store.go
+++ b/vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/upload/store.go
@@ -96,8 +96,7 @@ func (store OcisStore) List(ctx context.Context) ([]*OcisSession, error) {
 	}
 
 	for _, info := range infoFiles {
-		id := strings.TrimSuffix(filepath.Base(info), filepath.Ext(info))
-		progress, err := store.Get(ctx, id)
+		progress, err := store.Get(ctx, info)
 		if err != nil {
 			appctx.GetLogger(ctx).Error().Interface("path", info).Msg("Decomposedfs: could not getUploadSession")
 			continue
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2aa98156d2e..d59bf277088 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -362,7 +362,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.18.1-0.20240124094635-6eec406c0be7
+# github.com/cs3org/reva/v2 v2.18.1-0.20240123151850-049234cc31e0
 ## explicit; go 1.21
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime


Test patch:
diff --git a/services/graph/pkg/service/v0/driveitems_test.go b/services/graph/pkg/service/v0/driveitems_test.go
index 69cacd7e90a..7513ec290cd 100644
--- a/services/graph/pkg/service/v0/driveitems_test.go
+++ b/services/graph/pkg/service/v0/driveitems_test.go
@@ -685,25 +685,6 @@ var _ = Describe("Driveitems", func() {
 			_, ok := res.GetRolesOk()
 			Expect(ok).To(BeTrue())
 		})
-		It("fails to update the share permissions for a file share when setting a space specific role", func() {
-			updateShareMock := gatewayClient.On("UpdateShare",
-				mock.Anything,
-				mock.MatchedBy(func(req *collaboration.UpdateShareRequest) bool {
-					return req.GetShare().GetId().GetOpaqueId() == "permissionid"
-				}),
-			)
-			updateShareMock.Return(updateShareMockResponse, nil)
-
-			driveItemPermission.SetRoles([]string{unifiedrole.NewSpaceViewerUnifiedRole().GetId()})
-			body, err := driveItemPermission.MarshalJSON()
-			Expect(err).To(BeNil())
-			svc.UpdatePermission(
-				rr,
-				httptest.NewRequest(http.MethodPatch, "/", strings.NewReader(string(body))).
-					WithContext(ctx),
-			)
-			Expect(rr.Code).To(Equal(http.StatusBadRequest))
-		})
 		It("updates the share permissions when changing the resource permission actions", func() {
 			updateShareMock := gatewayClient.On("UpdateShare",
 				mock.Anything,
@@ -1026,17 +1007,6 @@ var _ = Describe("Driveitems", func() {
 			Expect(jsonData.Get("0.roles.0").String()).To(Equal(unifiedrole.NewViewerUnifiedRole(true).GetId()))
 		})
 
-		It("fails with wrong role", func() {
-			driveItemInvite.Roles = []string{unifiedrole.NewCoownerUnifiedRole().GetId()}
-			svc.Invite(
-				rr,
-				httptest.NewRequest(http.MethodPost, "/", toJSONReader(driveItemInvite)).
-					WithContext(ctx),
-			)
-
-			Expect(rr.Code).To(Equal(http.StatusBadRequest))
-		})
-
 		It("with actions (happy path)", func() {
 			driveItemInvite.Roles = nil
 			driveItemInvite.LibreGraphPermissionsActions = []string{unifiedrole.DriveItemContentRead}
diff --git a/services/graph/pkg/unifiedrole/unifiedrole_test.go b/services/graph/pkg/unifiedrole/unifiedrole_test.go
index 12248a375b2..f11225a5a5e 100644
--- a/services/graph/pkg/unifiedrole/unifiedrole_test.go
+++ b/services/graph/pkg/unifiedrole/unifiedrole_test.go
@@ -27,7 +27,8 @@ var _ = Describe("unifiedroles", func() {
 		Entry(rConversions.RoleViewer, rConversions.NewViewerRole(true), unifiedrole.NewViewerUnifiedRole(true), unifiedrole.UnifiedRoleConditionGrantee),
 		Entry(rConversions.RoleEditor, rConversions.NewEditorRole(true), unifiedrole.NewEditorUnifiedRole(true), unifiedrole.UnifiedRoleConditionGrantee),
 		Entry(rConversions.RoleFileEditor, rConversions.NewFileEditorRole(true), unifiedrole.NewFileEditorUnifiedRole(true), unifiedrole.UnifiedRoleConditionGrantee),
-		Entry(rConversions.RoleCoowner, rConversions.NewCoownerRole(), unifiedrole.NewCoownerUnifiedRole(), unifiedrole.UnifiedRoleConditionOwner),
+		Entry(rConversions.RoleCoowner, rConversions.NewCoownerRole(), unifiedrole.NewCoownerUnifiedRole(), unifiedrole.UnifiedRoleConditionGrantee),
+		Entry(rConversions.RoleManager, rConversions.NewManagerRole(), unifiedrole.NewManagerUnifiedRole(), unifiedrole.UnifiedRoleConditionGrantee),
 		Entry(rConversions.RoleManager, rConversions.NewManagerRole(), unifiedrole.NewManagerUnifiedRole(), unifiedrole.UnifiedRoleConditionOwner),
 		Entry(rConversions.RoleSpaceViewer, rConversions.NewSpaceViewerRole(), unifiedrole.NewSpaceViewerUnifiedRole(), unifiedrole.UnifiedRoleConditionOwner),
 		Entry(rConversions.RoleSpaceEditor, rConversions.NewSpaceEditorRole(), unifiedrole.NewSpaceEditorUnifiedRole(), unifiedrole.UnifiedRoleConditionOwner),
@@ -207,17 +208,6 @@ var _ = Describe("unifiedroles", func() {
 					unifiedrole.NewViewerUnifiedRole(false),
 					unifiedrole.NewFileEditorUnifiedRole(false),
 					unifiedrole.NewEditorUnifiedRole(false),
-				},
-			),
-
-			Entry(
-				"GetBuiltinRoleDefinitionList",
-				rolesToAction(unifiedrole.GetBuiltinRoleDefinitionList(false)...),
-				unifiedrole.UnifiedRoleConditionOwner,
-				false,
-				[]*libregraph.UnifiedRoleDefinition{
-					unifiedrole.NewSpaceViewerUnifiedRole(),
-					unifiedrole.NewSpaceEditorUnifiedRole(),
 					unifiedrole.NewCoownerUnifiedRole(),
 					unifiedrole.NewManagerUnifiedRole(),
 				},
@@ -233,6 +223,8 @@ var _ = Describe("unifiedroles", func() {
 					unifiedrole.NewViewerUnifiedRole(true),
 					unifiedrole.NewFileEditorUnifiedRole(true),
 					unifiedrole.NewEditorUnifiedRole(true),
+					unifiedrole.NewCoownerUnifiedRole(),
+					unifiedrole.NewManagerUnifiedRole(),
 				},
 			),
 
diff --git a/tests/TestHelpers/GraphHelper.php b/tests/TestHelpers/GraphHelper.php
index d6d83be73a9..a8cbd2e4190 100644
--- a/tests/TestHelpers/GraphHelper.php
+++ b/tests/TestHelpers/GraphHelper.php
@@ -67,27 +67,6 @@ class GraphHelper {
 		return self::getUUIDv4Regex() . ':' . self::getUUIDv4Regex() . ':' . self::getUUIDv4Regex();
 	}
 
-	/**
-	 * @return string
-	 */
-	public static function getFileIdRegex(): string {
-		return self::getUUIDv4Regex() . '\\\$' . self::getUUIDv4Regex() . '!' . self::getUUIDv4Regex();
-	}
-
-	/**
-	 * @return string
-	 */
-	public static function getShareIdRegex(): string {
-		return self::getUUIDv4Regex() . '\\\$' . self::getUUIDv4Regex() . '!' . self::getUUIDv4Regex() . ':' . self::getUUIDv4Regex() . ':' . self::getUUIDv4Regex();
-	}
-
-	/**
-	 * @return string
-	 */
-	public static function getEtagRegex(): string {
-		return "^\\\"[a-f0-9:.]{1,32}\\\"$";
-	}
-
 	/**
 	 * Key name can consist of @@@
 	 * This function separate such key and return its actual value from actual drive response which can be used for assertion
diff --git a/tests/TestHelpers/WebDavHelper.php b/tests/TestHelpers/WebDavHelper.php
index 728416f8939..651ac675370 100644
--- a/tests/TestHelpers/WebDavHelper.php
+++ b/tests/TestHelpers/WebDavHelper.php
@@ -179,7 +179,6 @@ class WebDavHelper {
 	 * @param string|null $type
 	 * @param int|null $davPathVersionToUse
 	 * @param string|null $doDavRequestAsUser
-	 * @param array|null $headers
 	 *
 	 * @return ResponseInterface
 	 * @throws Exception
@@ -195,8 +194,7 @@ class WebDavHelper {
 		?string $folderDepth = '1',
 		?string $type = "files",
 		?int $davPathVersionToUse = self::DAV_VERSION_NEW,
-		?string $doDavRequestAsUser = null,
-		?array $headers = []
+		?string $doDavRequestAsUser = null
 	):ResponseInterface {
 		$body = self::getBodyForPropfind($properties);
 		$folderDepth = (string) $folderDepth;
diff --git a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
index e4ecfd70210..d9b6da351ea 100644
--- a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
@@ -45,6 +45,18 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 
 - [apiGraphUserGroup/deleteGroup.feature:67](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiGraphUserGroup/deleteGroup.feature#L67)
 
+#### [CORS headers are not identical with oC10 headers](https://github.com/owncloud/ocis/issues/5195)
+
+- [apiCors/cors.feature:28](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L28)
+- [apiCors/cors.feature:29](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L29)
+- [apiCors/cors.feature:30](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L30)
+- [apiCors/cors.feature:31](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L31)
+
+#### [Requests with invalid credentials do not return CORS headers](https://github.com/owncloud/ocis/issues/5194)
+
+- [apiCors/cors.feature:70](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L70)
+- [apiCors/cors.feature:71](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiCors/cors.feature#L71)
+
 #### [A User can get information of another user with Graph API](https://github.com/owncloud/ocis/issues/5125)
 
 - [apiGraphUserGroup/getUser.feature:89](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiGraphUserGroup/getUser.feature#L89)
@@ -258,10 +270,10 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiSharingNg/linkShare.feature:453](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/linkShare.feature#L453)
 - [apiSharingNg/linkShare.feature:455](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/linkShare.feature#L455)
 - [apiSharingNg/linkShare.feature:456](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/linkShare.feature#L456)
-- [apiSharingNg/deletePermissions.feature:130](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L130)
-- [apiSharingNg/deletePermissions.feature:147](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L147)
-- [apiSharingNg/deletePermissions.feature:168](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L168)
-- [apiSharingNg/deletePermissions.feature:187](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L187)
+- [apiSharingNg/deletePermissions.feature:138](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L138)
+- [apiSharingNg/deletePermissions.feature:155](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L155)
+- [apiSharingNg/deletePermissions.feature:176](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L176)
+- [apiSharingNg/deletePermissions.feature:195](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/deletePermissions.feature#L195)
 
 ### [sharee (editor role) MOVE a file by file-id into same shared folder returns 403](https://github.com/owncloud/ocis/issues/7617)
 
diff --git a/tests/acceptance/features/apiCors/cors.feature b/tests/acceptance/features/apiCors/cors.feature
index 6b59cd45f72..a0a8da4cde8 100644
--- a/tests/acceptance/features/apiCors/cors.feature
+++ b/tests/acceptance/features/apiCors/cors.feature
@@ -18,10 +18,11 @@ Feature: CORS headers
     Then the OCS status code should be "<ocs-code>"
     And the HTTP status code should be "<http-code>"
     And the following headers should be set
-      | header                           | value               |
-      | Access-Control-Expose-Headers    | Location            |
-      | Access-Control-Allow-Origin      | https://aphno.badal |
-      | Access-Control-Allow-Credentials | true                |
+      | header                        | value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | Access-Control-Allow-Headers  | OC-Checksum,OC-Total-Length,OCS-APIREQUEST,X-OC-Mtime,OC-RequestAppPassword,Accept,Authorization,Brief,Content-Length,Content-Range,Content-Type,Date,Depth,Destination,Host,If,If-Match,If-Modified-Since,If-None-Match,If-Range,If-Unmodified-Since,Location,Lock-Token,Overwrite,Prefer,Range,Schedule-Reply,Timeout,User-Agent,X-Expected-Entity-Length,Accept-Language,Access-Control-Request-Method,Access-Control-Allow-Origin,Cache-Control,ETag,OC-Autorename,OC-CalDav-Import,OC-Chunked,OC-Etag,OC-FileId,OC-LazyOps,OC-Total-File-Length,Origin,X-Request-ID,X-Requested-With |
+      | Access-Control-Expose-Headers | Content-Location,DAV,ETag,Link,Lock-Token,OC-ETag,OC-Checksum,OC-FileId,OC-JobStatus-Location,OC-RequestAppPassword,Vary,Webdav-Location,X-Sabre-Status                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+      | Access-Control-Allow-Origin   | https://aphno.badal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+      | Access-Control-Allow-Methods  | GET,OPTIONS,POST,PUT,DELETE,MKCOL,PROPFIND,PATCH,PROPPATCH,REPORT                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
     Examples:
       | ocs_api_version | endpoint                          | ocs-code | http-code |
       | 1               | /config                           | 100      | 200       |
@@ -33,8 +34,8 @@ Feature: CORS headers
   Scenario Outline: CORS headers should not be returned when CORS domain does not match origin header
     Given using OCS API version "<ocs_api_version>"
     When user "Alice" sends HTTP method "GET" to OCS API endpoint "<endpoint>" with headers
-      | header | value              |
-      | Origin | https://mero.badal |
+      | header | value               |
+      | Origin | https://mero.badal  |
     Then the OCS status code should be "<ocs-code>"
     And the HTTP status code should be "<http-code>"
     And the following headers should not be set
@@ -51,42 +52,20 @@ Feature: CORS headers
       | 2               | /apps/files_sharing/api/v1/shares | 200      | 200       |
 
   @issue-5194
-  Scenario Outline: CORS headers should be returned when an preflight request is sent
+  Scenario Outline: CORS headers should be returned when an invalid password is used
     Given using OCS API version "<ocs_api_version>"
-    When user "Alice" sends HTTP method "OPTIONS" to OCS API endpoint "<endpoint>" with headers
-      | header                         | value                                                                                                                                                                                                                                                                                                                                                 |
-      | Origin                         | https://aphno.badal                                                                                                                                                                                                                                                                                                                                   |
-      | Access-Control-Request-Headers | Origin, Accept, Content-Type, Depth, Authorization, Ocs-Apirequest, If-None-Match, If-Match, Destination, Overwrite, X-Request-Id, X-Requested-With, Tus-Resumable, Tus-Checksum-Algorithm, Upload-Concat, Upload-Length, Upload-Metadata, Upload-Defer-Length, Upload-Expires, Upload-Checksum, Upload-Offset, X-Http-Method-Override, Cache-Control |
-      | Access-Control-Request-Method  | <request_method>                                                                                                                                                                                                                                                                                                                                      |
-    And the HTTP status code should be "204"
-    And the following headers should be set
-      | header                       | value                                                                                                                                                                                                                                                                                                                                                 |
-      | Access-Control-Allow-Headers | Origin, Accept, Content-Type, Depth, Authorization, Ocs-Apirequest, If-None-Match, If-Match, Destination, Overwrite, X-Request-Id, X-Requested-With, Tus-Resumable, Tus-Checksum-Algorithm, Upload-Concat, Upload-Length, Upload-Metadata, Upload-Defer-Length, Upload-Expires, Upload-Checksum, Upload-Offset, X-Http-Method-Override, Cache-Control |
-      | Access-Control-Allow-Origin  | https://aphno.badal                                                                                                                                                                                                                                                                                                                                   |
-      | Access-Control-Allow-Methods | <request_method>                                                                                                                                                                                                                                                                                                                                      |
-    Examples:
-      | ocs_api_version |  | endpoint                          | request_method |
-      | 1               |  | /apps/files_sharing/api/v1/shares | GET            |
-      | 2               |  | /apps/files_sharing/api/v1/shares | PUT            |
-      | 1               |  | /apps/files_sharing/api/v1/shares | DELETE         |
-      | 2               |  | /apps/files_sharing/api/v1/shares | POST           |
-
-
-  Scenario: CORS headers should be returned when setting CORS domain sending origin header in the Graph api
-    When user "Alice" lists all available spaces with headers using the Graph API
+    When user "Alice" sends HTTP method "GET" to OCS API endpoint "<endpoint>" with headers using password "invalid"
       | header | value               |
       | Origin | https://aphno.badal |
-    Then the HTTP status code should be "200"
+    Then the OCS status code should be "997"
+    And the HTTP status code should be "401"
     And the following headers should be set
-      | header                      | value               |
-      | Access-Control-Allow-Origin | https://aphno.badal |
-
-  @issue-8231
-  Scenario: CORS headers should be returned when setting CORS domain sending origin header in the Webdav api
-    When user "Alice" sends PROPFIND request to space "Alice Hansen" with headers using the WebDAV API
-      | header | value               |
-      | Origin | https://aphno.badal |
-    Then the HTTP status code should be "207"
-    And the following headers should be set
-      | header                      | value               |
-      | Access-Control-Allow-Origin | https://aphno.badal |
+      | header                        | value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+      | Access-Control-Allow-Headers  | OC-Checksum,OC-Total-Length,OCS-APIREQUEST,X-OC-Mtime,OC-RequestAppPassword,Accept,Authorization,Brief,Content-Length,Content-Range,Content-Type,Date,Depth,Destination,Host,If,If-Match,If-Modified-Since,If-None-Match,If-Range,If-Unmodified-Since,Location,Lock-Token,Overwrite,Prefer,Range,Schedule-Reply,Timeout,User-Agent,X-Expected-Entity-Length,Accept-Language,Access-Control-Request-Method,Access-Control-Allow-Origin,Cache-Control,ETag,OC-Autorename,OC-CalDav-Import,OC-Chunked,OC-Etag,OC-FileId,OC-LazyOps,OC-Total-File-Length,Origin,X-Request-ID,X-Requested-With |
+      | Access-Control-Expose-Headers | Content-Location,DAV,ETag,Link,Lock-Token,OC-ETag,OC-Checksum,OC-FileId,OC-JobStatus-Location,OC-RequestAppPassword,Vary,Webdav-Location,X-Sabre-Status                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+      | Access-Control-Allow-Origin   | https://aphno.badal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+      | Access-Control-Allow-Methods  | GET,OPTIONS,POST,PUT,DELETE,MKCOL,PROPFIND,PATCH,PROPPATCH,REPORT                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+    Examples:
+      | ocs_api_version | endpoint                          |
+      | 1               | /apps/files_sharing/api/v1/shares |
+      | 2               | /apps/files_sharing/api/v1/shares |
diff --git a/tests/acceptance/features/apiSharingNg/deletePermissions.feature b/tests/acceptance/features/apiSharingNg/deletePermissions.feature
index 222514e4c43..83053a67184 100644
--- a/tests/acceptance/features/apiSharingNg/deletePermissions.feature
+++ b/tests/acceptance/features/apiSharingNg/deletePermissions.feature
@@ -29,7 +29,9 @@ Feature: Remove access to a drive item
       | File Editor     | file          | textfile.txt  |
       | Viewer          | folder        | FolderToShare |
       | Editor          | folder        | FolderToShare |
+      | Co Owner        | folder        | FolderToShare |
       | Uploader        | folder        | FolderToShare |
+      | Manager         | folder        | FolderToShare |
 
 
   Scenario Outline: user removes access to resource inside of a project space in the user share
@@ -54,7 +56,9 @@ Feature: Remove access to a drive item
       | File Editor     | file          | textfile.txt  |
       | Viewer          | folder        | FolderToShare |
       | Editor          | folder        | FolderToShare |
+      | Co Owner        | folder        | FolderToShare |
       | Uploader        | folder        | FolderToShare |
+      | Manager         | folder        | FolderToShare |
 
 
   Scenario Outline: user removes access to a resource in a group share
@@ -80,7 +84,9 @@ Feature: Remove access to a drive item
       | File Editor     | file          | textfile.txt  |
       | Viewer          | folder        | FolderToShare |
       | Editor          | folder        | FolderToShare |
+      | Co Owner        | folder        | FolderToShare |
       | Uploader        | folder        | FolderToShare |
+      | Manager         | folder        | FolderToShare |
 
 
   Scenario Outline: user removes access to a resource inside of a project space in group share
@@ -108,7 +114,9 @@ Feature: Remove access to a drive item
       | File Editor     | file          | textfile.txt  |
       | Viewer          | folder        | FolderToShare |
       | Editor          | folder        | FolderToShare |
+      | Co Owner        | folder        | FolderToShare |
       | Uploader        | folder        | FolderToShare |
+      | Manager         | folder        | FolderToShare |
 
 
   Scenario Outline: user removes access to a folder in link share
diff --git a/tests/acceptance/features/apiSharingNg/reshare.feature b/tests/acceptance/features/apiSharingNg/reshare.feature
deleted file mode 100644
index 2f38c89b1db..00000000000
--- a/tests/acceptance/features/apiSharingNg/reshare.feature
+++ /dev/null
@@ -1,231 +0,0 @@
-Feature: Reshare a share invitation
-  As a user
-  I want to be able to reshare the share invitations to other users
-  So that they can have access to it
-
-  https://owncloud.dev/libre-graph-api/#/drives.permissions/Invite
-
-  Background:
-    Given these users have been created with default attributes and without skeleton files:
-      | username |
-      | Alice    |
-      | Brian    |
-      | Carol    |
-
-
-  Scenario Outline: reshare a file to a user with different roles
-    Given user "Alice" has uploaded file with content "to share" to "/textfile1.txt"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | file               |
-      | resource        | textfile1.txt      |
-      | space           | Personal           |
-      | sharee          | Brian              |
-      | shareType       | user               |
-      | permissionsRole | <permissions-role> |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | file                       |
-      | resource        | textfile1.txt              |
-      | space           | Shares                     |
-      | sharee          | Carol                      |
-      | shareType       | user                       |
-      | permissionsRole | <reshare-permissions-role> |
-    Then the HTTP status code should be "200"
-    And for user "Carol" the space Shares should contain these entries:
-      | textfile1.txt |
-    Examples:
-      | permissions-role | reshare-permissions-role |
-      | Viewer           | Viewer                   |
-      | File Editor      | Viewer                   |
-      | File Editor      | File Editor              |
-
-
-  Scenario Outline: reshare a folder to a user with different roles
-    Given user "Alice" has created folder "FolderToShare"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | folder             |
-      | resource        | FolderToShare      |
-      | space           | Personal           |
-      | sharee          | Brian              |
-      | shareType       | user               |
-      | permissionsRole | <permissions-role> |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | folder                     |
-      | resource        | FolderToShare              |
-      | space           | Shares                     |
-      | sharee          | Carol                      |
-      | shareType       | user                       |
-      | permissionsRole | <reshare-permissions-role> |
-    Then the HTTP status code should be "200"
-    And for user "Carol" the space Shares should contain these entries:
-      | FolderToShare |
-    Examples:
-      | permissions-role | reshare-permissions-role |
-      | Viewer           | Viewer                   |
-      | Editor           | Viewer                   |
-      | Editor           | Editor                   |
-      | Editor           | Uploader                 |
-
-
-  Scenario Outline: reshare a file inside project space to a user with different roles
-    Given using spaces DAV path
-    And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
-    And user "Alice" has created a space "NewSpace" with the default quota using the Graph API
-    And user "Alice" has uploaded a file inside space "NewSpace" with content "to share" to "textfile1.txt"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | file               |
-      | resource        | textfile1.txt      |
-      | space           | NewSpace           |
-      | sharee          | Brian              |
-      | shareType       | user               |
-      | permissionsRole | <permissions-role> |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | file                       |
-      | resource        | textfile1.txt              |
-      | space           | Shares                     |
-      | sharee          | Carol                      |
-      | shareType       | user                       |
-      | permissionsRole | <reshare-permissions-role> |
-    Then the HTTP status code should be "200"
-    And for user "Carol" the space Shares should contain these entries:
-      | textfile1.txt |
-    Examples:
-      | permissions-role | reshare-permissions-role |
-      | Viewer           | Viewer                   |
-      | File Editor      | Viewer                   |
-      | File Editor      | File Editor              |
-
-
-  Scenario Outline: reshare a folder inside project space to a user with different roles
-    Given using spaces DAV path
-    And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
-    And user "Alice" has created a space "NewSpace" with the default quota using the Graph API
-    And user "Alice" has created a folder "FolderToShare" in space "NewSpace"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | folder             |
-      | resource        | FolderToShare      |
-      | space           | NewSpace           |
-      | sharee          | Brian              |
-      | shareType       | user               |
-      | permissionsRole | <permissions-role> |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | folder                     |
-      | resource        | FolderToShare              |
-      | space           | Shares                     |
-      | sharee          | Carol                      |
-      | shareType       | user                       |
-      | permissionsRole | <reshare-permissions-role> |
-    Then the HTTP status code should be "200"
-    And for user "Carol" the space Shares should contain these entries:
-      | FolderToShare |
-    Examples:
-      | permissions-role | reshare-permissions-role |
-      | Viewer           | Viewer                   |
-      | Editor           | Viewer                   |
-      | Editor           | Editor                   |
-      | Editor           | Uploader                 |
-
-
-  Scenario: try to reshare a resource to higher roles
-    Given user "Alice" has uploaded file with content "to share" to "/textfile1.txt"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | file          |
-      | resource        | textfile1.txt |
-      | space           | Personal      |
-      | sharee          | Brian         |
-      | shareType       | user          |
-      | permissionsRole | Viewer        |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | file          |
-      | resource        | textfile1.txt |
-      | space           | Shares        |
-      | sharee          | Carol         |
-      | shareType       | user          |
-      | permissionsRole | File Editor   |
-    Then the HTTP status code should be "403"
-    And the JSON data of the response should match
-      """
-      {
-        "type": "object",
-        "required": [
-          "error"
-        ],
-        "properties": {
-          "error": {
-            "type": "object",
-            "required": [
-              "code",
-              "message"
-            ],
-            "properties": {
-              "code": {
-                "type": "string",
-                "enum": [
-                  "accessDenied"
-                ]
-              },
-              "message": {
-                "type": "string",
-                "enum": [
-                  "insufficient permissions to create that kind of share"
-                ]
-              }
-            }
-          }
-        }
-      }
-      """
-    And for user "Carol" the space Shares should not contain these entries:
-      | textfile1.txt |
-
-
-  Scenario: user with role Uploader tries to reshare a folder
-    Given user "Alice" has created folder "FolderToShare"
-    And user "Alice" has sent the following share invitation:
-      | resourceType    | folder        |
-      | resource        | FolderToShare |
-      | space           | Personal      |
-      | sharee          | Brian         |
-      | shareType       | user          |
-      | permissionsRole | Uploader      |
-    When user "Brian" sends the following share invitation using the Graph API:
-      | resourceType    | folder        |
-      | resource        | FolderToShare |
-      | space           | Shares        |
-      | sharee          | Carol         |
-      | shareType       | user          |
-      | permissionsRole | Viewer        |
-    Then the HTTP status code should be "403"
-    And the JSON data of the response should match
-      """
-      {
-        "type": "object",
-        "required": [
-          "error"
-        ],
-        "properties": {
-          "error": {
-            "type": "object",
-            "required": [
-              "code",
-              "message"
-            ],
-            "properties": {
-              "code": {
-                "type": "string",
-                "enum": [
-                  "accessDenied"
-                ]
-              },
-              "message": {
-                "type": "string",
-                "enum": [
-                  "no permission to add grants on shared resource"
-                ]
-              }
-            }
-          }
-        }
-      }
-      """
-    And for user "Carol" the space Shares should not contain these entries:
-      | textfile1.txt |
diff --git a/tests/acceptance/features/apiSharingNg/shareInvitations.feature b/tests/acceptance/features/apiSharingNg/shareInvitations.feature
index 368e34dd9f2..c670ced7eb1 100644
--- a/tests/acceptance/features/apiSharingNg/shareInvitations.feature
+++ b/tests/acceptance/features/apiSharingNg/shareInvitations.feature
@@ -93,7 +93,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send share invitation to group with different roles
@@ -185,7 +187,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send share invitation for a file to user with different permissions
@@ -661,7 +665,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send share invitation with expiration date to group with different roles
@@ -757,7 +763,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
   @issue-7962
   Scenario Outline: send share invitation to disabled user
@@ -840,7 +848,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send sharing invitation to a deleted group with different roles
@@ -899,7 +909,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send share invitation to deleted user
@@ -950,7 +962,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: try to send sharing invitation to multiple groups
@@ -1076,7 +1090,9 @@ Feature: Send a sharing invitations
       | File Editor      | file          | /textfile1.txt |
       | Viewer           | folder        | FolderToShare  |
       | Editor           | folder        | FolderToShare  |
+      | Co Owner         | folder        | FolderToShare  |
       | Uploader         | folder        | FolderToShare  |
+      | Manager          | folder        | FolderToShare  |
 
 
   Scenario Outline: send sharing invitation to non-existing group
diff --git a/tests/acceptance/features/apiSharingNg/sharedWithMe.feature b/tests/acceptance/features/apiSharingNg/sharedWithMe.feature
deleted file mode 100644
index a938483bb7f..00000000000
--- a/tests/acceptance/features/apiSharingNg/sharedWithMe.feature
+++ /dev/null
@@ -1,476 +0,0 @@
-Feature: an user gets the resources shared to them
-  As a user
-  I want to get resources shared with me
-  So that I can know about what resources I have access to
-
-  https://owncloud.dev/libre-graph-api/#/me.drive/ListSharedWithMe
-
-  Background:
-    Given these users have been created with default attributes and without skeleton files:
-      | username |
-      | Alice    |
-      | Brian    |
-
-
-  Scenario: user lists the file shared with them
-    Given user "Alice" has uploaded file with content "hello world" to "/textfile0.txt"
-    And user "Alice" has shared file "textfile0.txt" with user "Brian"
-    When user "Brian" lists the resources shared with him using the Graph API
-    Then the HTTP status code should be "200"
-    And the JSON data of the response should match
-    """
-    {
-      "type": "object",
-      "required": [
-        "value"
-      ],
-      "properties": {
-        "value": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "required": [
-              "createdBy",
-              "eTag",
-              "file",
-              "id",
-              "lastModifiedDateTime",
-              "name",
-              "parentReference",
-              "remoteItem"
-            ],
-            "properties": {
-              "createdBy": {
-                "type": "object",
-                "required": [
-                  "user"
-                ],
-                "properties": {
-                  "user": {
-                    "type": "object",
-                    "required": ["displayName", "id"],
-                    "properties": {
-                      "displayName": {
-                        "type": "string",
-                        "enum": ["Alice Hansen"]
-                      },
-                      "id": {
-                        "type": "string",
-                        "pattern": "^%user_id_pattern%$"
-                      }
-                    }
-                  }
-                }
-              },
-              "eTag": {
-                "type": "string",
-                "pattern": "%eTag%"
-              },
-              "file": {
-                "type": "object",
-                "required": ["mimeType"],
-                "properties": {
-                  "mimeType": {
-                    "type": "string",
-                    "enum": ["text/plain"]
-                  }
-                }
-              },
-              "id": {
-                "type": "string",
-                "pattern": "^%share_id_pattern%$"
-              },
-              "name": {
-                "type": "string",
-                "enum": [
-                  "textfile0.txt"
-                ]
-              },
-              "parentReference": {
-                "type": "object",
-                "required": [
-                  "driveId",
-                  "driveType"
-                ],
-                "properties": {
-                  "driveId": {
-                    "type": "string",
-                    "pattern": "^%space_id_pattern%$"
-                  },
-                  "driveType" : {
-                    "type": "string",
-                    "enum": ["virtual"]
-                  }
-                }
-              },
-              "remoteItem": {
-                "type": "object",
-                "required": [
-                  "createdBy",
-                  "eTag",
-                  "file",
-                  "id",
-                  "lastModifiedDateTime",
-                  "name",
-                  "parentReference",
-                  "permissions",
-                  "shared",
-                  "size"
-                ],
-                "properties": {
-                  "createdBy": {
-                    "type": "object",
-                    "required": [
-                      "user"
-                    ],
-                    "properties": {
-                      "user": {
-                        "type": "object",
-                        "required": [
-                          "id",
-                          "displayName"
-                        ],
-                        "properties": {
-                          "id": {
-                            "type": "string",
-                            "pattern": "^%user_id_pattern%$"
-                          },
-                          "displayName": {
-                            "type": "string",
-                            "enum": [
-                              "Alice Hansen"
-                            ]
-                          }
-                        }
-                      }
-                    }
-                  },
-                  "eTag": {
-                    "type": "string",
-                    "pattern": "%eTag%"
-                  },
-                  "file": {
-                    "type": "object",
-                    "required": [
-                      "mimeType"
-                    ],
-                    "properties": {
-                      "mimeType": {
-                        "type": "string",
-                        "pattern": "text/plain"
-                      }
-                    }
-                  },
-                  "id": {
-                    "type": "string",
-                    "pattern": "^%file_id_pattern%$"
-                  },
-                  "name": {
-                    "type": "string",
-                    "enum": [
-                      "textfile0.txt"
-                    ]
-                  },
-                  "shared": {
-                    "type": "object",
-                    "required": [
-                      "sharedBy",
-                      "owner"
-                    ],
-                    "properties": {
-                      "owner": {
-                        "type": "object",
-                        "required": [
-                          "user"
-                        ],
-                        "properties": {
-                          "user": {
-                            "type": "object",
-                            "required": [
-                              "id",
-                              "displayName"
-                            ],
-                            "properties": {
-                              "id": {
-                                "type": "string",
-                                "pattern": "^%user_id_pattern%$"
-                              },
-                              "displayName": {
-                                "type": "string",
-                                "enum": [
-                                  "Alice Hansen"
-                                ]
-                              }
-                            }
-                          }
-                        }
-                      },
-                      "sharedBy": {
-                        "type": "object",
-                        "required": [
-                          "user"
-                        ],
-                        "properties": {
-                          "user": {
-                            "type": "object",
-                            "required": [
-                              "id",
-                              "displayName"
-                            ],
-                            "properties": {
-                              "id": {
-                                "type": "string",
-                                "pattern": "^%user_id_pattern%$"
-                              },
-                              "displayName": {
-                                "type": "string",
-                                "enum": [
-                                  "Alice Hansen"
-                                ]
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  },
-                  "size": {
-                    "type": "number",
-                    "enum": [
-                      11
-                    ]
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-    """
-
-
-  Scenario: user lists the folder shared with them
-    Given user "Alice" has created folder "folder"
-    And user "Alice" has shared folder "folder" with user "Brian"
-    When user "Brian" lists the resources shared with him using the Graph API
-    Then the HTTP status code should be "200"
-    And the JSON data of the response should match
-    """
-    {
-      "type": "object",
-      "required": [
-        "value"
-      ],
-      "properties": {
-        "value": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "required": [
-              "createdBy",
-              "eTag",
-              "folder",
-              "id",
-              "lastModifiedDateTime",
-              "name",
-              "parentReference",
-              "remoteItem"
-            ],
-            "properties": {
-              "createdBy": {
-                "type": "object",
-                "required": [
-                  "user"
-                ],
-                "properties": {
-                  "user": {
-                    "type": "object",
-                    "required": ["displayName", "id"],
-                    "properties": {
-                      "displayName": {
-                        "type": "string",
-                        "enum": ["Alice Hansen"]
-                      },
-                      "id": {
-                        "type": "string",
-                        "pattern": "^%user_id_pattern%$"
-                      }
-                    }
-                  }
-                }
-              },
-              "eTag": {
-                "type": "string",
-                "pattern": "%eTag%"
-              },
-              "folder": {
-                "type": "object",
-                "required": [],
-                "properties": {}
-              },
-              "id": {
-                "type": "string",
-                "pattern": "^%share_id_pattern%$"
-              },
-              "name": {
-                "type": "string",
-                "enum": [
-                  "folder"
-                ]
-              },
-              "parentReference": {
-                "type": "object",
-                "required": [
-                  "driveId",
-                  "driveType"
-                ],
-                "properties": {
-                  "driveId": {
-                    "type": "string",
-                    "pattern": "^%space_id_pattern%$"
-                  },
-                  "driveType" : {
-                    "type": "string",
-                    "enum": ["virtual"]
-                  }
-                }
-              },
-              "remoteItem": {
-                "type": "object",
-                "required": [
-                  "createdBy",
-                  "eTag",
-                  "folder",
-                  "id",
-                  "lastModifiedDateTime",
-                  "name",
-                  "parentReference",
-                  "permissions",
-                  "shared"
-                ],
-                "properties": {
-                  "createdBy": {
-                    "type": "object",
-                    "required": [
-                      "user"
-                    ],
-                    "properties": {
-                      "user": {
-                        "type": "object",
-                        "required": [
-                          "id",
-                          "displayName"
-                        ],
-                        "properties": {
-                          "id": {
-                            "type": "string",
-                            "pattern": "^%user_id_pattern%$"
-                          },
-                          "displayName": {
-                            "type": "string",
-                            "enum": [
-                              "Alice Hansen"
-                            ]
-                          }
-                        }
-                      }
-                    }
-                  },
-                  "eTag": {
-                    "type": "string",
-                    "pattern": "%eTag%"
-                  },
-                  "file": {
-                    "type": "object",
-                    "required": [
-                      "mimeType"
-                    ],
-                    "properties": {
-                      "mimeType": {
-                        "type": "string",
-                        "pattern": "text/plain"
-                      }
-                    }
-                  },
-                  "id": {
-                    "type": "string",
-                    "pattern": "^%file_id_pattern%$"
-                  },
-                  "name": {
-                    "type": "string",
-                    "enum": [
-                      "folder"
-                    ]
-                  },
-                  "shared": {
-                    "type": "object",
-                    "required": [
-                      "sharedBy",
-                      "owner"
-                    ],
-                    "properties": {
-                      "owner": {
-                        "type": "object",
-                        "required": [
-                          "user"
-                        ],
-                        "properties": {
-                          "user": {
-                            "type": "object",
-                            "required": [
-                              "id",
-                              "displayName"
-                            ],
-                            "properties": {
-                              "id": {
-                                "type": "string",
-                                "pattern": "^%user_id_pattern%$"
-                              },
-                              "displayName": {
-                                "type": "string",
-                                "enum": [
-                                  "Alice Hansen"
-                                ]
-                              }
-                            }
-                          }
-                        }
-                      },
-                      "sharedBy": {
-                        "type": "object",
-                        "required": [
-                          "user"
-                        ],
-                        "properties": {
-                          "user": {
-                            "type": "object",
-                            "required": [
-                              "id",
-                              "displayName"
-                            ],
-                            "properties": {
-                              "id": {
-                                "type": "string",
-                                "pattern": "^%user_id_pattern%$"
-                              },
-                              "displayName": {
-                                "type": "string",
-                                "enum": [
-                                  "Alice Hansen"
-                                ]
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-    """
diff --git a/tests/acceptance/features/bootstrap/FeatureContext.php b/tests/acceptance/features/bootstrap/FeatureContext.php
index d6b3661599e..89a33993f6e 100644
--- a/tests/acceptance/features/bootstrap/FeatureContext.php
+++ b/tests/acceptance/features/bootstrap/FeatureContext.php
@@ -2799,30 +2799,6 @@ class FeatureContext extends BehatVariablesContext {
 					"getPermissionsIdRegex"
 				],
 				"parameter" => []
-			],
-			[
-				"code" => "%file_id_pattern%",
-				"function" => [
-					__NAMESPACE__ . '\TestHelpers\GraphHelper',
-					"getFileIdRegex"
-				],
-				"parameter" => []
-			],
-			[
-				"code" => "%share_id_pattern%",
-				"function" => [
-					__NAMESPACE__ . '\TestHelpers\GraphHelper',
-					"getShareIdRegex"
-				],
-				"parameter" => []
-			],
-			[
-				"code" => "%eTag%",
-				"function" => [
-					__NAMESPACE__ . '\TestHelpers\GraphHelper',
-					"getEtagRegex"
-				],
-				"parameter" => []
 			]
 		];
 		if ($user !== null) {
diff --git a/tests/acceptance/features/bootstrap/GraphContext.php b/tests/acceptance/features/bootstrap/GraphContext.php
index ec322b49973..aee5618c250 100644
--- a/tests/acceptance/features/bootstrap/GraphContext.php
+++ b/tests/acceptance/features/bootstrap/GraphContext.php
@@ -2505,24 +2505,4 @@ class GraphContext implements Context {
 			)
 		);
 	}
-
-	/**
-	 * @When user :user lists the resources shared with him/her using the Graph API
-	 *
-	 * @param string $user
-	 *
-	 * @return void
-	 * @throws GuzzleException
-	 */
-	public function userListsTheResourcesSharedWithThemUsingGraphApi(string $user): void {
-		$credentials = $this->getAdminOrUserCredentials($user);
-		$this->featureContext->setResponse(
-			GraphHelper::getSharesSharedWithMe(
-				$this->featureContext->getBaseUrl(),
-				$this->featureContext->getStepLineRef(),
-				$credentials['username'],
-				$credentials['password']
-			)
-		);
-	}
 }
diff --git a/tests/acceptance/features/bootstrap/SharingNgContext.php b/tests/acceptance/features/bootstrap/SharingNgContext.php
index 7e16a7356f2..bb4492301f8 100644
--- a/tests/acceptance/features/bootstrap/SharingNgContext.php
+++ b/tests/acceptance/features/bootstrap/SharingNgContext.php
@@ -141,20 +141,9 @@ class SharingNgContext implements Context {
 		$rows = $table->getRowsHash();
 		$spaceId = ($this->spacesContext->getSpaceByName($user, $rows['space']))["id"];
 
-		// for resharing a resource, "item-id" in API endpoint takes shareMountId
-		if ($rows['space'] === 'Shares') {
-			$itemId = GraphHelper::getShareMountId(
-				$this->featureContext->getBaseUrl(),
-				$this->featureContext->getStepLineRef(),
-				$user,
-				$this->featureContext->getPasswordForUser($user),
-				$rows['resource']
-			);
-		} else {
-			$itemId = ($rows['resourceType'] === 'folder')
-				? $this->spacesContext->getResourceId($user, $rows['space'], $rows['resource'])
-				: $this->spacesContext->getFileId($user, $rows['space'], $rows['resource']);
-		}
+		$itemId = ($rows['resourceType'] === 'folder')
+			? $this->spacesContext->getResourceId($user, $rows['space'], $rows['resource'])
+			: $this->spacesContext->getFileId($user, $rows['space'], $rows['resource']);
 
 		$sharees = array_map('trim', explode(',', $rows['sharee']));
 		$shareTypes = array_map('trim', explode(',', $rows['shareType']));
diff --git a/tests/acceptance/features/bootstrap/SpacesContext.php b/tests/acceptance/features/bootstrap/SpacesContext.php
index 23107d7fe8f..1fd4615bab4 100644
--- a/tests/acceptance/features/bootstrap/SpacesContext.php
+++ b/tests/acceptance/features/bootstrap/SpacesContext.php
@@ -544,22 +544,19 @@ class SpacesContext implements Context {
 	/**
 	 * @param string $user
 	 * @param string $query
-	 * @param array $headers
 	 *
 	 * @return ResponseInterface
 	 *
 	 * @throws GuzzleException
 	 * @throws Exception
 	 */
-	public function listAllAvailableSpacesOfUser(string $user, string $query = '', array $headers = []): ResponseInterface {
+	public function listAllAvailableSpacesOfUser(string $user, string $query = ''): ResponseInterface {
 		$response = GraphHelper::getMySpaces(
 			$this->featureContext->getBaseUrl(),
 			$user,
 			$this->featureContext->getPasswordForUser($user),
 			"?" . $query,
-			$this->featureContext->getStepLineRef(),
-			[],
-			$headers
+			$this->featureContext->getStepLineRef()
 		);
 		$this->rememberTheAvailableSpaces($response);
 		return $response;
@@ -581,28 +578,6 @@ class SpacesContext implements Context {
 		$this->featureContext->setResponse($this->listAllAvailableSpacesOfUser($user, $query));
 	}
 
-	/**
-	 * @When /^user "([^"]*)" lists all available spaces with headers using the Graph API$/
-	 *
-	 * @param string $user
-	 * @param TableNode $headersTable
-	 *
-	 * @return void
-	 *
-	 * @throws GuzzleException
-	 * @throws Exception
-	 */
-	public function theUserListsAllHisAvailableSpacesWithHeadersUsingTheGraphApi(string $user, TableNode $headersTable): void {
-		$this->featureContext->verifyTableNodeColumns(
-			$headersTable,
-			['header', 'value']
-		);
-		foreach ($headersTable as $row) {
-			$headers[$row['header']] = $row ['value'];
-		}
-		$this->featureContext->setResponse($this->listAllAvailableSpacesOfUser($user, '', $headers));
-	}
-
 	/**
 	 * The method is used on the administration setting tab, which only the Admin user and the Space admin user have access to
 	 *
@@ -3553,44 +3528,17 @@ class SpacesContext implements Context {
 		);
 	}
 
-	/**
-	 * @When /^user "([^"]*)" sends PROPFIND request to space "([^"]*)" with headers using the WebDAV API$/
-	 *
-	 * @param string $user
-	 * @param string $spaceName
-	 * @param TableNode $headersTable
-	 *
-	 * @return void
-	 *
-	 * @throws JsonException
-	 *
-	 * @throws GuzzleException
-	 */
-	public function userSendsPropfindRequestToSpaceWithHeaders(string $user, string $spaceName, $headersTable): void {
-		$this->featureContext->verifyTableNodeColumns(
-			$headersTable,
-			['header', 'value']
-		);
-		foreach ($headersTable as $row) {
-			$headers[$row['header']] = $row ['value'];
-		}
-		$this->featureContext->setResponse(
-			$this->sendPropfindRequestToSpace($user, $spaceName, '', $headers)
-		);
-	}
-
 	/**
 	 * @param string $user
 	 * @param string $spaceName
 	 * @param string|null $resource
-	 * @param array|null $headers
 	 *
 	 * @return ResponseInterface
 	 * @throws GuzzleException
 	 *
 	 * @throws JsonException
 	 */
-	public function sendPropfindRequestToSpace(string $user, string $spaceName, ?string $resource = "", ?array $headers = []): ResponseInterface {
+	public function sendPropfindRequestToSpace(string $user, string $spaceName, ?string $resource = ""): ResponseInterface {
 		$this->setSpaceIDByName($user, $spaceName);
 		$properties = ['oc:permissions','oc:file-parent','oc:fileid','oc:share-types','oc:privatelink','d:resourcetype','oc:size','oc:name','d:getcontenttype','oc:tags','d:lockdiscovery','d:activelock'];
 		return  WebDavHelper::propfind(
@@ -3602,9 +3550,7 @@ class SpacesContext implements Context {
 			$this->featureContext->getStepLineRef(),
 			"0",
 			"files",
-			WebDavHelper::DAV_VERSION_SPACES,
-			"",
-			$headers
+			WebDavHelper::DAV_VERSION_SPACES
 		);
 	}
 
diff --git a/tests/acceptance/features/coreApiVersions/fileVersions.feature b/tests/acceptance/features/coreApiVersions/fileVersions.feature
index 9658d6f6117..3d89be133fd 100644
--- a/tests/acceptance/features/coreApiVersions/fileVersions.feature
+++ b/tests/acceptance/features/coreApiVersions/fileVersions.feature
@@ -418,31 +418,3 @@ Feature: dav-versions
     When user "Brian" tries to get versions of file "textfile0.txt" from "Alice"
     Then the HTTP status code should be "403"
     And the value of the item "//s:exception" in the response about user "Alice" should be "Sabre\DAV\Exception\Forbidden"
-
-  @issue-enterprise-6249
-  Scenario: upload empty content file and check versions after multiple restores
-    Given user "Alice" has uploaded file with content "" to "textfile.txt"
-    And user "Alice" has uploaded file with content "test content" to "textfile.txt"
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" element
-    When user "Alice" restores version index "1" of file "textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "204"
-    And the content of file "textfile.txt" for user "Alice" should be ""
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" elements
-    When user "Alice" restores version index "1" of file "textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "204"
-    And the content of file "textfile.txt" for user "Alice" should be "test content"
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" elements
-
-
-  Scenario: update with empty content and check versions after multiple restores
-    Given user "Alice" has uploaded file with content "test content" to "textfile.txt"
-    And user "Alice" has uploaded file with content "" to "textfile.txt"
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" element
-    When user "Alice" restores version index "1" of file "textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "204"
-    And the content of file "textfile.txt" for user "Alice" should be "test content"
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" elements
-    When user "Alice" restores version index "1" of file "textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "204"
-    And the content of file "textfile.txt" for user "Alice" should be ""
-    And the version folder of file "textfile.txt" for user "Alice" should contain "1" elements