perf(group): Cache group membership in distributed cache

apps/files_sharing/lib/AppInfo/Application.php

@@ -8,8 +8,6 @@
 
 namespace OCA\Files_Sharing\AppInfo;
 
-use OC\Group\DisplayNameCache as GroupDisplayNameCache;
-use OC\User\DisplayNameCache;
 use OCA\Files\Event\LoadAdditionalScriptsEvent;
 use OCA\Files\Event\LoadSidebar;
 use OCA\Files_Sharing\Capabilities;
@@ -50,7 +48,6 @@
 use OCP\Files\Events\Node\BeforeNodeReadEvent;
 use OCP\Files\Events\UserHomeSetupEvent;
 use OCP\Group\Events\BeforeGroupDeletedEvent;
-use OCP\Group\Events\GroupChangedEvent;
 use OCP\Group\Events\GroupDeletedEvent;
 use OCP\Group\Events\UserAddedEvent;
 use OCP\Group\Events\UserRemovedEvent;
@@ -61,8 +58,6 @@
 use OCP\Share\Events\ShareCreatedEvent;
 use OCP\Share\Events\ShareMovedEvent;
 use OCP\Share\Events\ShareTransferredEvent;
-use OCP\User\Events\UserChangedEvent;
-use OCP\User\Events\UserDeletedEvent;
 use OCP\Util;
 use Psr\Container\ContainerInterface;
 
@@ -96,10 +91,6 @@
 		$context->registerCapability(Capabilities::class);
 
 		$context->registerNotifierService(Notifier::class);
-		$context->registerEventListener(UserChangedEvent::class, DisplayNameCache::class);
-		$context->registerEventListener(UserDeletedEvent::class, DisplayNameCache::class);
-		$context->registerEventListener(GroupChangedEvent::class, GroupDisplayNameCache::class);
-		$context->registerEventListener(GroupDeletedEvent::class, GroupDisplayNameCache::class);
 
 		// Sidebar and files scripts
 		$context->registerEventListener(LoadAdditionalScriptsEvent::class, LoadAdditionalListener::class);
@@ -131,7 +122,7 @@
 		$context->registerEventListener(ShareMovedEvent::class, SharesUpdatedListener::class);
 		$context->registerEventListener(UserHomeSetupEvent::class, UserHomeSetupListener::class);
 
 		$context->registerEventListener(UserDeletedEvent::class, SharesUpdatedListener::class);
 
 		$context->registerConfigLexicon(ConfigLexicon::class);
 

apps/settings/lib/Controller/UsersController.php

@@ -130,7 +130,7 @@ public function usersList(INavigationManager $navigationManager, ISubAdmin $subA
 		} else {
 			if ($this->appManager->isEnabledForUser('user_ldap')) {
 				$isLDAPUsed
-					= $this->groupManager->isBackendUsed('\OCA\User_LDAP\Group_Proxy');
+					= $this->groupManager->isBackendUsed(\OCA\User_LDAP\Group_Proxy::class);
 				if ($isLDAPUsed) {
 					// LDAP user count can be slow, so we sort by group name here
 					$sortGroupsBy = MetaData::SORT_GROUPNAME;

build/psalm-baseline.xml

@@ -2673,6 +2673,11 @@
       <code><![CDATA[getSubject]]></code>
     </DeprecatedMethod>
   </file>
+  <file src="core/AppInfo/Application.php">
+    <DeprecatedClass>
+      <code><![CDATA[BeforeUserRemovedEvent::class]]></code>
+    </DeprecatedClass>
+  </file>
   <file src="core/BackgroundJobs/BackgroundCleanupUpdaterBackupsJob.php">
     <DeprecatedClass>
       <code><![CDATA[Files::rmdirr($dir)]]></code>

core/AppInfo/Application.php

@@ -9,6 +9,7 @@
 namespace OC\Core\AppInfo;
 
 use NCU\Sharing\ISharingRegistry;
+use OC\App\Listeners\RemoveGroupRestrictionsListener;
 use OC\Authentication\Events\RemoteWipeFinished;
 use OC\Authentication\Events\RemoteWipeStarted;
 use OC\Authentication\Listeners\RemoteWipeActivityListener;
@@ -41,8 +42,11 @@
 use OC\Core\Sharing\Recipient\UserShareRecipientType;
 use OC\DirectEditing\Listeners\UserDeletedTokenCleanupListener as UserDeletedDirectEditingTokenCleanupListener;
 use OC\DirectEditing\Listeners\UserDisabledTokenCleanupListener as UserDisabledDirectEditingTokenCleanupListener;
+use OC\Group\DisplayNameCache as GroupDisplayNameCache;
+use OC\Group\Listeners\MembershipCacheListener;
 use OC\OCM\OCMDiscoveryHandler;
 use OC\TagManager;
+use OC\User\DisplayNameCache;
 use OCP\Accounts\UserUpdatedEvent;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
@@ -52,6 +56,13 @@
 use OCP\AppFramework\Http\Events\BeforeTemplateRenderedEvent;
 use OCP\DB\Events\AddMissingIndicesEvent;
 use OCP\DB\Events\AddMissingPrimaryKeyEvent;
+use OCP\Group\Events\BeforeGroupDeletedEvent;
+use OCP\Group\Events\BeforeUserAddedEvent;
+use OCP\Group\Events\BeforeUserRemovedEvent;
+use OCP\Group\Events\GroupChangedEvent;
+use OCP\Group\Events\GroupDeletedEvent;
+use OCP\Group\Events\UserAddedEvent;
+use OCP\Group\Events\UserRemovedEvent;
 use OCP\IAppConfig;
 use OCP\Interaction\RestrictInteractionEvent;
 use OCP\Navigation\Events\LoadAdditionalEntriesEvent;
@@ -109,6 +120,18 @@ public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(UserUpdatedEvent::class, AvatarVersionListener::class);
 		$context->registerEventListener(UserChangedEvent::class, AvatarVersionListener::class);
 
+		$context->registerEventListener(UserChangedEvent::class, DisplayNameCache::class);
+		$context->registerEventListener(UserDeletedEvent::class, DisplayNameCache::class);
+		$context->registerEventListener(GroupChangedEvent::class, GroupDisplayNameCache::class);
+		$context->registerEventListener(GroupDeletedEvent::class, GroupDisplayNameCache::class);
+		$context->registerEventListener(BeforeUserAddedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(UserAddedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(BeforeUserRemovedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(UserRemovedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(BeforeGroupDeletedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(GroupDeletedEvent::class, MembershipCacheListener::class);
+		$context->registerEventListener(GroupDeletedEvent::class, RemoveGroupRestrictionsListener::class);
+
 		// Tags
 		$context->registerEventListener(UserDeletedEvent::class, TagManager::class);
 

lib/OC.php

@@ -913,7 +913,6 @@ public static function initForRequest(): void {
 		self::registerResourceCollectionHooks();
 		self::registerFileReferenceEventListener();
 		self::registerRenderReferenceEventListener();
-		self::registerAppRestrictionsHooks();
 
 		// Make sure that the application class is not loaded before the database is setup
 		if ($systemConfig->getValue('installed', false)) {
@@ -1063,29 +1062,6 @@ private static function registerAccountHooks(): void {
 		$dispatcher->addServiceListener(UserChangedEvent::class, \OC\Accounts\Hooks::class);
 	}
 
-	private static function registerAppRestrictionsHooks(): void {
-		$eventDispatcher = Server::get(IEventDispatcher::class);
-		$eventDispatcher->addListener(GroupDeletedEvent::class, function (GroupDeletedEvent $event) {
-			$group = $event->getGroup();
-			$appManager = Server::get(\OCP\App\IAppManager::class);
-			$apps = $appManager->getEnabledAppsForGroup($group);
-			foreach ($apps as $appId) {
-				$restrictions = $appManager->getAppRestriction($appId);
-				if (empty($restrictions)) {
-					continue;
-				}
-				$key = array_search($group->getGID(), $restrictions, true);
-				unset($restrictions[$key]);
-				$restrictions = array_values($restrictions);
-				if (empty($restrictions)) {
-					$appManager->disableApp($appId);
-				} else {
-					$appManager->enableAppForGroups($appId, $restrictions);
-				}
-			}
-		});
-	}
-
 	private static function registerResourceCollectionHooks(): void {
 		\OC\Collaboration\Resources\Listener::register(Server::get(IEventDispatcher::class));
 	}

lib/composer/composer/autoload_classmap.php

@@ -1284,6 +1284,7 @@
     'OC\\App\\CompareVersion' => $baseDir . '/lib/private/App/CompareVersion.php',
     'OC\\App\\DependencyAnalyzer' => $baseDir . '/lib/private/App/DependencyAnalyzer.php',
     'OC\\App\\InfoParser' => $baseDir . '/lib/private/App/InfoParser.php',
+    'OC\\App\\Listeners\\RemoveGroupRestrictionsListener' => $baseDir . '/lib/private/App/Listeners/RemoveGroupRestrictionsListener.php',
     'OC\\App\\Platform' => $baseDir . '/lib/private/App/Platform.php',
     'OC\\App\\PlatformRepository' => $baseDir . '/lib/private/App/PlatformRepository.php',
     'OC\\Archive\\Archive' => $baseDir . '/lib/private/Archive/Archive.php',
@@ -2023,6 +2024,7 @@
     'OC\\Group\\Database' => $baseDir . '/lib/private/Group/Database.php',
     'OC\\Group\\DisplayNameCache' => $baseDir . '/lib/private/Group/DisplayNameCache.php',
     'OC\\Group\\Group' => $baseDir . '/lib/private/Group/Group.php',
+    'OC\\Group\\Listeners\\MembershipCacheListener' => $baseDir . '/lib/private/Group/Listeners/MembershipCacheListener.php',
     'OC\\Group\\Manager' => $baseDir . '/lib/private/Group/Manager.php',
     'OC\\Group\\MetaData' => $baseDir . '/lib/private/Group/MetaData.php',
     'OC\\HintException' => $baseDir . '/lib/private/HintException.php',

lib/composer/composer/autoload_static.php

@@ -1330,6 +1330,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\App\\CompareVersion' => __DIR__ . '/../../..' . '/lib/private/App/CompareVersion.php',
         'OC\\App\\DependencyAnalyzer' => __DIR__ . '/../../..' . '/lib/private/App/DependencyAnalyzer.php',
         'OC\\App\\InfoParser' => __DIR__ . '/../../..' . '/lib/private/App/InfoParser.php',
+        'OC\\App\\Listeners\\RemoveGroupRestrictionsListener' => __DIR__ . '/../../..' . '/lib/private/App/Listeners/RemoveGroupRestrictionsListener.php',
         'OC\\App\\Platform' => __DIR__ . '/../../..' . '/lib/private/App/Platform.php',
         'OC\\App\\PlatformRepository' => __DIR__ . '/../../..' . '/lib/private/App/PlatformRepository.php',
         'OC\\Archive\\Archive' => __DIR__ . '/../../..' . '/lib/private/Archive/Archive.php',
@@ -2069,6 +2070,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\Group\\Database' => __DIR__ . '/../../..' . '/lib/private/Group/Database.php',
         'OC\\Group\\DisplayNameCache' => __DIR__ . '/../../..' . '/lib/private/Group/DisplayNameCache.php',
         'OC\\Group\\Group' => __DIR__ . '/../../..' . '/lib/private/Group/Group.php',
+        'OC\\Group\\Listeners\\MembershipCacheListener' => __DIR__ . '/../../..' . '/lib/private/Group/Listeners/MembershipCacheListener.php',
         'OC\\Group\\Manager' => __DIR__ . '/../../..' . '/lib/private/Group/Manager.php',
         'OC\\Group\\MetaData' => __DIR__ . '/../../..' . '/lib/private/Group/MetaData.php',
         'OC\\HintException' => __DIR__ . '/../../..' . '/lib/private/HintException.php',

lib/private/App/Listeners/RemoveGroupRestrictionsListener.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\App\Listeners;
+
+use OCP\App\IAppManager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Group\Events\GroupDeletedEvent;
+
+/**
+ * @template-implements IEventListener<GroupDeletedEvent>
+ */
+class RemoveGroupRestrictionsListener implements IEventListener {
+	public function __construct(
+		private readonly IAppManager $appManager,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!$event instanceof GroupDeletedEvent) {
+			return;
+		}
+
+		$group = $event->getGroup();
+		$apps = $this->appManager->getEnabledAppsForGroup($group);
+		foreach ($apps as $appId) {
+			$restrictions = $this->appManager->getAppRestriction($appId);
+			if (empty($restrictions)) {
+				continue;
+			}
+			$key = array_search($group->getGID(), $restrictions, true);
+			unset($restrictions[$key]);
+			$restrictions = array_values($restrictions);
+			if (empty($restrictions)) {
+				$this->appManager->disableApp($appId);
+			} else {
+				$this->appManager->enableAppForGroups($appId, $restrictions);
+			}
+		}
+	}
+}

lib/private/Group/Group.php

@@ -8,7 +8,6 @@
 
 namespace OC\Group;
 
-use OC\Hooks\PublicEmitter;
 use OC\User\LazyUser;
 use OC\User\User;
 use OCP\EventDispatcher\IEventDispatcher;
@@ -48,7 +47,6 @@ public function __construct(
 		private array $backends,
 		private IEventDispatcher $dispatcher,
 		private IUserManager $userManager,
-		private ?PublicEmitter $emitter = null,
 		/** @var ?non-empty-string $displayName */
 		protected ?string $displayName = null,
 	) {
@@ -153,20 +151,13 @@ public function addUser(IUser $user): void {
 
 		$this->dispatcher->dispatchTyped(new BeforeUserAddedEvent($this, $user));
 
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\Group', 'preAddUser', [$this, $user]);
-		}
 		foreach ($this->backends as $backend) {
 			if ($backend->implementsActions(\OC\Group\Backend::ADD_TO_GROUP)) {
 				/** @var IAddToGroupBackend $backend */
 				$backend->addToGroup($user->getUID(), $this->gid);
 				$this->users[$user->getUID()] = $user;
 
 				$this->dispatcher->dispatchTyped(new UserAddedEvent($this, $user));
-
-				if ($this->emitter) {
-					$this->emitter->emit('\OC\Group', 'postAddUser', [$this, $user]);
-				}
 				return;
 			}
 		}
@@ -179,9 +170,6 @@ public function addUser(IUser $user): void {
 	public function removeUser(IUser $user): void {
 		$result = false;
 		$this->dispatcher->dispatchTyped(new BeforeUserRemovedEvent($this, $user));
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\Group', 'preRemoveUser', [$this, $user]);
-		}
 		foreach ($this->backends as $backend) {
 			if ($backend->implementsActions(\OC\Group\Backend::REMOVE_FROM_GOUP) && $backend->inGroup($user->getUID(), $this->gid)) {
 				/** @var IRemoveFromGroupBackend $backend */
@@ -191,9 +179,6 @@ public function removeUser(IUser $user): void {
 		}
 		if ($result) {
 			$this->dispatcher->dispatchTyped(new UserRemovedEvent($this, $user));
-			if ($this->emitter) {
-				$this->emitter->emit('\OC\Group', 'postRemoveUser', [$this, $user]);
-			}
 			if ($this->users) {
 				foreach ($this->users as $index => $groupUser) {
 					if ($groupUser->getUID() === $user->getUID()) {
@@ -322,9 +307,6 @@ public function delete(): bool {
 
 		$result = false;
 		$this->dispatcher->dispatchTyped(new BeforeGroupDeletedEvent($this));
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\Group', 'preDelete', [$this]);
-		}
 		foreach ($this->backends as $backend) {
 			if ($backend->implementsActions(\OC\Group\Backend::DELETE_GROUP)) {
 				/** @var IDeleteGroupBackend $backend */
@@ -333,9 +315,6 @@ public function delete(): bool {
 		}
 		if ($result) {
 			$this->dispatcher->dispatchTyped(new GroupDeletedEvent($this));
-			if ($this->emitter) {
-				$this->emitter->emit('\OC\Group', 'postDelete', [$this]);
-			}
 		}
 		return $result;
 	}

lib/private/Group/Listeners/MembershipCacheListener.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\Group\Listeners;
+
+use OC\Group\Manager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Group\Events\BeforeGroupDeletedEvent;
+use OCP\Group\Events\BeforeUserAddedEvent;
+use OCP\Group\Events\BeforeUserRemovedEvent;
+use OCP\Group\Events\GroupDeletedEvent;
+use OCP\Group\Events\UserAddedEvent;
+use OCP\Group\Events\UserRemovedEvent;
+
+/**
+ * Invalidates before the change for listeners of the current request, and after
+ * it in case a concurrent request repopulated the distributed cache meanwhile.
+ *
+ * @template-implements IEventListener<BeforeUserAddedEvent|UserAddedEvent|BeforeUserRemovedEvent|UserRemovedEvent|BeforeGroupDeletedEvent|GroupDeletedEvent>
+ */
+class MembershipCacheListener implements IEventListener {
+	public function __construct(
+		private readonly Manager $groupManager,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if ($event instanceof BeforeUserAddedEvent
+			|| $event instanceof UserAddedEvent
+			|| $event instanceof BeforeUserRemovedEvent
+			|| $event instanceof UserRemovedEvent) {
+			$this->groupManager->invalidateUserGroups($event->getUser()->getUID());
+		} elseif ($event instanceof BeforeGroupDeletedEvent || $event instanceof GroupDeletedEvent) {
+			$this->groupManager->invalidateGroup($event->getGroup()->getGID());
+		}
+	}
+}