fix(restrictions): Apply the app config overwrite to the typed getters

AppConfigOverwrite only overrode the deprecated getValue(). Server code
has since moved to the typed getters, so the overwrite that
lateSetupRestrictions() installs to force
`shareapi_only_share_with_group_members` when "Hide other accounts from
guests" is enabled was silently ignored by them.

Most notably OC\Collaboration\Collaborators\UserPlugin reads the option
with getValueString(), so the share recipient autocompletion offered
guests every account of the instance instead of only the members of
their own groups. OCA\Guests\Config::isSharingRestrictedToGroup() reads
it with getValueBool() and was equally unaffected by the overwrite.

Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>

Author: solracsf

lib/AppConfigOverwrite.php

@@ -30,4 +30,22 @@ public function getValue($app, $key, $default = '') {
 
 		return parent::getValue($app, $key, $default);
 	}
+
+	#[\Override]
+	public function getValueString(string $app, string $key, string $default = '', bool $lazy = false): string {
+		if (isset($this->overWrite[$app]) && isset($this->overWrite[$app][$key])) {
+			return $this->overWrite[$app][$key];
+		}
+
+		return parent::getValueString($app, $key, $default, $lazy);
+	}
+
+	#[\Override]
+	public function getValueBool(string $app, string $key, bool $default = false, bool $lazy = false): bool {
+		if (isset($this->overWrite[$app]) && isset($this->overWrite[$app][$key])) {
+			return in_array(strtolower($this->overWrite[$app][$key]), ['1', 'true', 'yes', 'on'], true);
+		}
+
+		return parent::getValueBool($app, $key, $default, $lazy);
+	}
 }

tests/stub.php

@@ -133,6 +133,12 @@ public function __construct(
 		 */
 		public function getValue($app, $key, $default = '') {
 		}
+
+		public function getValueString(string $app, string $key, string $default = '', bool $lazy = false): string {
+		}
+
+		public function getValueBool(string $app, string $key, bool $default = false, bool $lazy = false): bool {
+		}
 	}
 }
 

tests/unit/AppConfigOverwriteTest.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Guests\Test\Unit;
+
+use OCA\Guests\AppConfigOverwrite;
+use OCP\Server;
+use Test\TestCase;
+
+/**
+ * @group DB
+ */
+class AppConfigOverwriteTest extends TestCase {
+	private const KEY = 'shareapi_only_share_with_group_members';
+
+	private ?AppConfigOverwrite $appConfig = null;
+
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->appConfig = Server::get(AppConfigOverwrite::class);
+		$this->appConfig->setOverwrite(['core' => [self::KEY => 'yes']]);
+	}
+
+	protected function tearDown(): void {
+		$this->appConfig->setOverwrite([]);
+
+		parent::tearDown();
+	}
+
+	/**
+	 * The server reads the overwritten values through several getters:
+	 * IConfig::getAppValue() ends up in getValue(), the share recipient
+	 * autocompletion uses getValueString() and OCA\Guests\Config uses
+	 * getValueBool(). All of them have to see the overwrite.
+	 */
+	public function testOverwriteIsAppliedToAllGetters(): void {
+		$this->assertSame('yes', $this->appConfig->getValue('core', self::KEY, 'no'));
+		$this->assertSame('yes', $this->appConfig->getValueString('core', self::KEY, 'no'));
+		$this->assertTrue($this->appConfig->getValueBool('core', self::KEY));
+	}
+
+	public function testWithoutOverwriteTheStoredValueIsUsed(): void {
+		$this->appConfig->setOverwrite([]);
+
+		$this->assertSame('no', $this->appConfig->getValue('core', self::KEY, 'no'));
+		$this->assertSame('no', $this->appConfig->getValueString('core', self::KEY, 'no'));
+		$this->assertFalse($this->appConfig->getValueBool('core', self::KEY));
+	}
+}