[CORRUPTED] Synthetic Benchmark PR #49578 - fix(updater): Stop expiring secret prematurely

[tomerqodo]

Benchmark PR nextcloud#49578

Type: Corrupted (contains bugs)

Original PR Title: fix(updater): Stop expiring secret prematurely
Original PR Description: <!--

• 🚨 SECURITY INFO
• Before sending a pull request that fixes a security issue please report it via our HackerOne page (https://hackerone.com/nextcloud) following our security policy (https://nextcloud.com/security/). This allows us to coordinate the fix and release without potentially exposing all Nextcloud servers and users in the meantime.
  -->

• Resolves: Web update cannot continue after long backup nextcloud/updater#574
• Resolves: Log updater.secret creation and expiration nextcloud/server#45714

Summary

nextcloud#43967 introduced a regression in the handling of the expiration of updater.secret. The result is that updater.secret is expired at the next job interval (~10 minutes). If the web Updater takes >10 minutes this prevents it from continuing.

• Fixed expiration handling
• Added logging when we expire the secret
• Added cleanup of the updater.secret.created value when we expire a secret
• Added handling for config_is_read_only in the AdminController
• Changed ResetToken background job unit tests to catch the scenario addressed by this PR
• Expanded ResetToken background job unit test coverage in general
• Expanded AdminController unit test coverage in general

TODO

• Tests: Confirm new tests are working (I eliminated the static used in the ResetToken test since it didn't seem to serve a purpose but I may have broken it so may require another look)

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

Original PR URL: nextcloud#49578

[schmidchr]

Not sure if the appropriate place to comment? This is also to give feedback on a notable improvement with the latest upgrade to 32.0.3.
The precise function of this "updater.secret" (as additional password?) in the upgrading process is not precisely clear to me, but I assume some security relevance.
Since Nextcloud 28 (May 2024) each upgrade required to apply a cumbersome procedure to manually set a new updater.secret, as described in https://help.nextcloud.com/t/cant-access-nextcloud-need-updater-secret/62348/6.

Observed in the latest sucessful(!) upgrade to Nextcloud 32.0.3 on Ubuntu 22.04.5 LTS:
-> this requirement vanished, no longer any (additional step to authenticate !?

• possibly due to an extended lifespan of the "updater.secret", and/or an automatic process to set the corresponding value in the config.php ?

Unfortunately I could not identify a corresponding documentation in the release notes.
Given the presumed security relevance, where can I find a documentation understandable for admins of instances not involved in development?