[Bug]: NoUserException: files_versions and UpdateSingleMetadata call getUserFolder() on federated share owners

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Summary

Writing a file inside a received federated share logs an uncaught OC\User\NoUserException: Backends provided no user object on every write. The same exception is logged again later from a background job.

The write itself succeeds (201/204), so this is log noise rather than data loss — but it produces 15–25 error-level entries per active day and keeps the admin overview's error counter permanently dirty.

Root cause: both code paths call getUserFolder() with the file's owner, which for a federated share is a remote user that has no local user object.

This is the same class of bug that #19647 reported and PR #25274 fixed for the trashbin path in NC 21 ("Federated shares are somewhat special... we can't move the files from the main user"). That guard was never applied to the two paths below.

Steps to reproduce

Environment

• Nextcloud 34.0.1, PHP 8.5.7, official nextcloud:34-apache image, MariaDB 10.11, Redis
• files_versions 1.27.0
• A federated share received from another Nextcloud instance, mounted at /FEDSHARE
  (oc_share_external → remote: https://remote.example.com/, owner: remote-user;
  oc_mounts → OCA\Files_Sharing\External\MountProvider)
• Desktop client writing into it: mirall/33.0.7 (macOS)

Steps to reproduce

1. Receive and accept a federated share from another Nextcloud instance.
2. Write/modify any file inside it (desktop client or WebDAV PUT).
3. Check nextcloud.log.

Actual result

Path 1 — on every write, via the files_versions listener:

OC\User\NoUserException: Backends provided no user object
  OC\Files\Node\Root->getUserFolder()
  lib/private/Files/Node/LazyFolder.php:66      call_user_func_array
  lib/private/Files/Node/LazyRoot.php:39        __call
  apps/files_versions/lib/Versions/LegacyVersionsBackend.php:78   getUserFolder
  apps/files_versions/lib/Versions/VersionManager.php:148         getVersionsForFile
  apps/files_versions/lib/Listener/FileEventsListener.php:250     createVersionEntity
  apps/files_versions/lib/Listener/FileEventsListener.php:81      created

Path 2 — later, from cron, via the metadata job:

OC\User\NoUserException: Backends provided no user object
  OC\Files\Node\Root->getUserFolder()
  lib/private/Files/Node/LazyRoot.php:39                     __call
  lib/private/FilesMetadata/Job/UpdateSingleMetadata.php:42  getUserFolder
  lib/public/BackgroundJob/Job.php:50                        run
  core/Service/CronService.php:204                           start
  cron.php:52                                                run

Follow-on error. Because the version entity is never created, a subsequent lookup fails:

OCP\AppFramework\Db\DoesNotExistException: Did expect one result but found none when executing:
query "SELECT * FROM `oc_files_versions` WHERE (`file_id` = :dcValue1) AND (`timestamp` = :dcValue2)"
  apps/files_versions/lib/Db/VersionsMapper.php               findEntity
  apps/files_versions/lib/Versions/LegacyVersionsBackend.php  findVersionForFileId
  apps/files_versions/lib/Versions/VersionManager.php         setMetadataValue
  apps/files_versions/lib/Listener/VersionAuthorListener.php  post_write_hook

The corresponding access-log line shows the write succeeded:

"PUT /remote.php/dav/files/<user>/FEDSHARE/<file> HTTP/1.1" 201 710 "-" "mirall/33.0.7"

Expected behavior

Expected result

files_versions and UpdateSingleMetadata should skip files whose storage is a federated external share — versioning and metadata for those files are the remote instance's responsibility — instead of throwing on getUserFolder().

Suggested fix

Apply the same guard PR #25274 introduced for trashbin: detect the federated/external storage (or catch NoUserException) before calling getUserFolder(), in

• apps/files_versions/lib/Versions/LegacyVersionsBackend.php (~line 78)
• lib/private/FilesMetadata/Job/UpdateSingleMetadata.php (~line 42)

Related: #19647, PR #25274 (and its backports #25277, #25278).

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwriteprotocol": "https",
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.example.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.1.2",
        "overwrite.cli.url": "https:\/\/cloud.example.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "default_phone_region": "IT",
        "maintenance_window_start": 3,
        "overwritehost": "cloud.example.com",
        "loglevel": 2,
        "maintenance": false,
        "forbidden_filename_basenames": [
            "con", "prn", "aux", "nul",
            "com0", "com1", "com2", "com3", "com4", "com5", "com6", "com7", "com8", "com9",
            "com¹", "com²", "com³",
            "lpt0", "lpt1", "lpt2", "lpt3", "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
            "lpt¹", "lpt²", "lpt³"
        ],
        "forbidden_filename_characters": [
            "<", ">", ":", "\"", "|", "?", "*", "\\", "\/"
        ],
        "forbidden_filename_extensions": [
            " ", ".", ".filepart", ".part"
        ],
        "config_preset": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "serverid": 0,
        "app_install_overwrite": [],
        "trashbin_retention_obligation": "auto, 90",
        "updater.release.channel": "stable",
        "defaultapp": "files,tasks,calendar,budget"
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - app_api: 34.0.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - budget: 2.39.1
  - calendar: 6.5.1
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.7.4
  - contactsinteraction: 1.15.0
  - dav: 1.39.0
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0-dev.0
  - files_lock: 34.0.0
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - groupfolders: 22.0.3
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - tasks: 0.18.1
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - viewer: 7.0.0-dev.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - admin_audit: 1.24.0
  - dashboard: 7.14.0 (installed 7.12.0)
  - encryption: 2.22.0
  - files_external: 1.26.0
  - photos: 7.0.0 (installed 5.0.0)
  - recommendations: 7.0.0 (installed 5.0.0)
  - related_resources: 5.0.0-dev.0 (installed 3.0.0)
  - survey_client: 6.0.0-dev.0 (installed 4.0.0)
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0 (installed 1.22.0)
  - twofactor_nextcloud_notification: 8.0.0
  - user_ldap: 1.25.0
  - user_status: 1.14.0 (installed 1.12.0)
  - weather_status: 1.14.0 (installed 1.12.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "QH6D6VWSOe2phcAGq0Bs",
  "level": 3,
  "time": "2026-07-20T08:37:51+00:00",
  "remoteAddr": "203.0.113.10",
  "user": "localuser",
  "app": "files",
  "method": "PUT",
  "url": "/remote.php/dav/files/localuser/FEDSHARE/SUBFOLDER/example-file.ext",
  "scriptName": "/remote.php",
  "message": "Backends provided no user object for remote-user@remote.example.com",
  "userAgent": "Mozilla/5.0 (Macintosh) mirall/33.0.7 (Nextcloud, macos-25.5.0 ClientArchitecture: arm64 OsArchitecture: arm64)",
  "version": "34.0.1.2",
  "exception": {
    "Exception": "OC\\User\\NoUserException",
    "Message": "Backends provided no user object",
    "Code": 0,
    "Trace": [
      {
        "function": "getUserFolder",
        "class": "OC\\Files\\Node\\Root",
        "type": "->",
        "args": ["remote-user@remote.example.com"]
      },
      {
        "file": "/var/www/html/lib/private/Files/Node/LazyFolder.php",
        "line": 66,
        "function": "call_user_func_array"
      },
      {
        "file": "/var/www/html/lib/private/Files/Node/LazyRoot.php",
        "line": 39,
        "function": "__call",
        "class": "OC\\Files\\Node\\LazyFolder",
        "args": ["getUserFolder", ["remote-user@remote.example.com"]]
      },
      {
        "file": "/var/www/html/apps/files_versions/lib/Versions/LegacyVersionsBackend.php",
        "line": 78,
        "function": "getUserFolder",
        "class": "OC\\Files\\Node\\LazyRoot",
        "args": ["remote-user@remote.example.com"]
      },
      {
        "file": "/var/www/html/apps/files_versions/lib/Versions/VersionManager.php",
        "line": 148,
        "function": "getVersionsForFile",
        "class": "OCA\\Files_Versions\\Versions\\LegacyVersionsBackend"
      },
      {
        "file": "/var/www/html/apps/files_versions/lib/Listener/FileEventsListener.php",
        "line": 250,
        "function": "createVersionEntity",
        "class": "OCA\\Files_Versions\\Versions\\VersionManager"
      },
      {
        "file": "/var/www/html/apps/files_versions/lib/Listener/FileEventsListener.php",
        "line": 81,
        "function": "created",
        "class": "OCA\\Files_Versions\\Listener\\FileEventsListener"
      },
      {
        "file": "/var/www/html/lib/private/EventDispatcher/ServiceEventListener.php",
        "line": 57,
        "function": "handle",
        "class": "OCA\\Files_Versions\\Listener\\FileEventsListener",
        "args": [{"__class__": "OCP\\Files\\Events\\Node\\NodeCreatedEvent"}]
      }
    ]
  }
}



{
  "reqId": "QH6D6VWSOe2phcAGq0Bs",
  "level": 3,
  "time": "2026-07-20T08:37:51+00:00",
  "remoteAddr": "203.0.113.10",
  "user": "localuser",
  "app": "no app in context",
  "method": "PUT",
  "url": "/remote.php/dav/files/localuser/FEDSHARE/SUBFOLDER/example-file.ext",
  "scriptName": "/remote.php",
  "message": "Did expect one result but found none when executing: query \"SELECT * FROM `*PREFIX*files_versions` WHERE (`file_id` = :dcValue1) AND (`timestamp` = :dcValue2)\"; ",
  "userAgent": "Mozilla/5.0 (Macintosh) mirall/33.0.7 (Nextcloud, macos-25.5.0 ClientArchitecture: arm64 OsArchitecture: arm64)",
  "version": "34.0.1.2",
  "exception": {
    "Exception": "OCP\\AppFramework\\Db\\DoesNotExistException",
    "Trace": [
      {"file": "/var/www/html/lib/public/AppFramework/Db/QBMapper.php", "line": 382, "function": "findOneQuery", "class": "OCP\\AppFramework\\Db\\QBMapper"},
      {"file": "/var/www/html/apps/files_versions/lib/Db/VersionsMapper.php", "line": 60, "function": "findEntity", "class": "OCP\\AppFramework\\Db\\QBMapper"},
      {"file": "/var/www/html/apps/files_versions/lib/Versions/LegacyVersionsBackend.php", "line": 328, "function": "findVersionForFileId", "class": "OCA\\Files_Versions\\Db\\VersionsMapper"},
      {"file": "/var/www/html/apps/files_versions/lib/Versions/VersionManager.php", "line": 178, "function": "setMetadataValue", "class": "OCA\\Files_Versions\\Versions\\LegacyVersionsBackend"},
      {"file": "/var/www/html/apps/files_versions/lib/Listener/VersionAuthorListener.php", "line": 54, "function": "setMetadataValue", "class": "OCA\\Files_Versions\\Versions\\VersionManager"},
      {"file": "/var/www/html/apps/files_versions/lib/Listener/VersionAuthorListener.php", "line": 36, "function": "post_write_hook", "class": "OCA\\Files_Versions\\Listener\\VersionAuthorListener"}
    ]
  }
}



{
  "reqId": "UUAJLS884V6LOFH1gL0M",
  "level": 3,
  "time": "2026-07-20T08:40:01+00:00",
  "remoteAddr": "",
  "user": "--",
  "app": "files",
  "method": "",
  "url": "--",
  "scriptName": "cron.php",
  "message": "Backends provided no user object for remote-user@remote.example.com",
  "userAgent": "--",
  "version": "34.0.1.2",
  "exception": {
    "Exception": "OC\\User\\NoUserException",
    "Message": "Backends provided no user object",
    "Code": 0,
    "Trace": [
      {"function": "getUserFolder", "class": "OC\\Files\\Node\\Root", "args": ["remote-user@remote.example.com"]},
      {"file": "/var/www/html/lib/private/Files/Node/LazyFolder.php", "line": 66, "function": "call_user_func_array"},
      {"file": "/var/www/html/lib/private/Files/Node/LazyRoot.php", "line": 39, "function": "__call", "class": "OC\\Files\\Node\\LazyFolder"},
      {"file": "/var/www/html/lib/private/FilesMetadata/Job/UpdateSingleMetadata.php", "line": 42, "function": "getUserFolder", "class": "OC\\Files\\Node\\LazyRoot"},
      {"file": "/var/www/html/lib/public/BackgroundJob/Job.php", "line": 50, "function": "run", "class": "OC\\FilesMetadata\\Job\\UpdateSingleMetadata"},
      {"file": "/var/www/html/lib/public/BackgroundJob/QueuedJob.php", "line": 31, "function": "start", "class": "OCP\\BackgroundJob\\Job"},
      {"file": "/var/www/html/core/Service/CronService.php", "line": 204, "function": "start", "class": "OCP\\BackgroundJob\\QueuedJob"},
      {"file": "/var/www/html/core/Service/CronService.php", "line": 107, "function": "runCli", "class": "OC\\Core\\Service\\CronService"}
    ]
  }
}

Additional info

No response

Start with apps/files_versions/lib/Versions/LegacyVersionsBackend.php around line 78 and lib/private/FilesMetadata/Job/UpdateSingleMetadata.php around line 42, then compare the federated-share guard from PR #25274 and the related trashbin path. Confirm the two paths no longer call getUserFolder() for federated external shares, and verify that writes and metadata jobs no longer produce NoUserException entries.