refactor(files_sharing,Share20): Use Interaction API to apply restrictions

Signed-off-by: provokateurin <kate@provokateurin.de>

Author: provokateurin

apps/files_sharing/lib/Controller/ShareAPIController.php

@@ -718,10 +718,6 @@ public function createShare(
 			$share->setSharedWith($shareWith);
 			$share->setPermissions($permissions);
 		} elseif ($shareType === IShare::TYPE_GROUP) {
-			if (!$this->shareManager->allowGroupSharing()) {
-				throw new OCSNotFoundException($this->l->t('Group sharing is disabled by the administrator'));
-			}
-
 			// Valid group is required to share
 			if ($shareWith === null || !$this->groupManager->groupExists($shareWith)) {
 				throw new OCSNotFoundException($this->l->t('Please specify a valid group'));
@@ -731,11 +727,6 @@ public function createShare(
 		} elseif ($shareType === IShare::TYPE_LINK
 			|| $shareType === IShare::TYPE_EMAIL) {
 
-			// Can we even share links?
-			if (!$this->shareManager->shareApiAllowLinks()) {
-				throw new OCSNotFoundException($this->l->t('Public link sharing is disabled by the administrator'));
-			}
-
 			$this->validateLinkSharePermissions($node, $permissions, $hasPublicUpload);
 			$share->setPermissions($permissions);
 
@@ -769,10 +760,6 @@ public function createShare(
 				$share->setSendPasswordByTalk(true);
 			}
 		} elseif ($shareType === IShare::TYPE_REMOTE) {
-			if (!$this->shareManager->outgoingServer2ServerSharesAllowed()) {
-				throw new OCSForbiddenException($this->l->t('Sharing %1$s failed because the back end does not allow shares from type %2$s', [$node->getPath(), $shareType]));
-			}
-
 			if ($shareWith === null) {
 				throw new OCSNotFoundException($this->l->t('Please specify a valid federated account ID'));
 			}
@@ -781,10 +768,6 @@ public function createShare(
 			$share->setPermissions($permissions);
 			$share->setSharedWithDisplayName($this->getCachedFederatedDisplayName($shareWith, false));
 		} elseif ($shareType === IShare::TYPE_REMOTE_GROUP) {
-			if (!$this->shareManager->outgoingServer2ServerGroupSharesAllowed()) {
-				throw new OCSForbiddenException($this->l->t('Sharing %1$s failed because the back end does not allow shares from type %2$s', [$node->getPath(), $shareType]));
-			}
-
 			if ($shareWith === null) {
 				throw new OCSNotFoundException($this->l->t('Please specify a valid federated group ID'));
 			}
@@ -1043,12 +1026,6 @@ private function validateLinkSharePermissions(Node $node, int $permissions, ?boo
 			&& ($this->hasPermission($permissions, Constants::PERMISSION_UPDATE) || $this->hasPermission($permissions, Constants::PERMISSION_DELETE))) {
 			throw new OCSBadRequestException($this->l->t('Share must have READ permission if UPDATE or DELETE permission is set'));
 		}
-
-		// Check if public uploading was disabled
-		if ($this->hasPermission($permissions, Constants::PERMISSION_CREATE)
-			&& !$this->shareManager->shareApiLinkAllowPublicUpload()) {
-			throw new OCSForbiddenException($this->l->t('Public upload disabled by the administrator'));
-		}
 	}
 
 	/**

lib/private/Share20/Manager.php

@@ -28,7 +28,6 @@
 use OCP\Files\Folder;
 use OCP\Files\IRootFolder;
 use OCP\Files\Mount\IMountManager;
-use OCP\Files\Mount\IMovableMount;
 use OCP\Files\Mount\IShareOwnerlessMount;
 use OCP\Files\Node;
 use OCP\Files\NotFoundException;
@@ -39,6 +38,18 @@
 use OCP\IDBConnection;
 use OCP\IGroupManager;
 use OCP\IL10N;
+use OCP\Interaction\Actions\ShareAction;
+use OCP\Interaction\Receivers\CircleReceiver;
+use OCP\Interaction\Receivers\DeckReceiver;
+use OCP\Interaction\Receivers\EmailReceiver;
+use OCP\Interaction\Receivers\GroupReceiver;
+use OCP\Interaction\Receivers\LinkReceiver;
+use OCP\Interaction\Receivers\RemoteGroupReceiver;
+use OCP\Interaction\Receivers\RemoteUserReceiver;
+use OCP\Interaction\Receivers\RoomReceiver;
+use OCP\Interaction\Receivers\UserReceiver;
+use OCP\Interaction\Resources\NodeResource;
+use OCP\Interaction\RestrictInteractionEvent;
 use OCP\IUser;
 use OCP\IUserManager;
 use OCP\IUserSession;
@@ -149,7 +160,7 @@ protected function verifyPassword(?string $password): void {
 	 *
 	 * @suppress PhanUndeclaredClassMethod
 	 */
-	protected function generalCreateChecks(IShare $share, bool $isUpdate = false): void {
+	protected function generalChecks(IShare $share): void {
 		if ($share->getShareType() === IShare::TYPE_USER) {
 			// We expect a valid user as sharedWith for user shares
 			if (!$this->userManager->userExists($share->getSharedWith())) {
@@ -212,21 +223,6 @@ protected function generalCreateChecks(IShare $share, bool $isUpdate = false): v
 			throw new \InvalidArgumentException($this->l->t('Shared path must be either a file or a folder'));
 		}
 
-		// And you cannot share your rootfolder
-		if ($this->userManager->userExists($share->getSharedBy())) {
-			$userFolder = $this->rootFolder->getUserFolder($share->getSharedBy());
-		} else {
-			$userFolder = $this->rootFolder->getUserFolder($share->getShareOwner());
-		}
-		if ($userFolder->getId() === $share->getNode()->getId()) {
-			throw new \InvalidArgumentException($this->l->t('You cannot share your root folder'));
-		}
-
-		// Check if we actually have share permissions
-		if (!$share->getNode()->isShareable()) {
-			throw new GenericShareException($this->l->t('You are not allowed to share %s', [$share->getNode()->getName()]), code: 404);
-		}
-
 		// Permissions should be set
 		if ($share->getPermissions() === null) {
 			throw new \InvalidArgumentException($this->l->t('Valid permissions are required for sharing'));
@@ -237,45 +233,32 @@ protected function generalCreateChecks(IShare $share, bool $isUpdate = false): v
 			throw new \InvalidArgumentException($this->l->t('Valid permissions are required for sharing'));
 		}
 
-		// Single file shares should never have delete or create permissions
-		if (($share->getNode() instanceof File)
-			&& (($share->getPermissions() & (Constants::PERMISSION_CREATE | Constants::PERMISSION_DELETE)) !== 0)) {
-			throw new \InvalidArgumentException($this->l->t('File shares cannot have create or delete permissions'));
-		}
+		$action = new ShareAction($share->getPermissions());
+		$receiver = match ($share->getShareType()) {
+			IShare::TYPE_USER => new UserReceiver($share->getSharedWith()),
+			IShare::TYPE_GROUP => new GroupReceiver($share->getSharedWith()),
+			IShare::TYPE_LINK => new LinkReceiver(),
+			IShare::TYPE_EMAIL => new EmailReceiver($share->getSharedWith()),
+			IShare::TYPE_REMOTE => new RemoteUserReceiver($share->getSharedWith()),
+			IShare::TYPE_CIRCLE => new CircleReceiver($share->getSharedWith()),
+			IShare::TYPE_REMOTE_GROUP => new RemoteGroupReceiver($share->getSharedWith()),
+			IShare::TYPE_ROOM => new RoomReceiver($share->getSharedWith()),
+			IShare::TYPE_DECK => new DeckReceiver((int)$share->getSharedWith()),
+			default => throw new \InvalidArgumentException('Unknown share type.'),
+		};
 
-		$permissions = 0;
-		$nodesForUser = $userFolder->getById($share->getNodeId());
-		foreach ($nodesForUser as $node) {
-			if ($node->getInternalPath() === '' && !$node->getMountPoint() instanceof IMovableMount) {
-				// for the root of non-movable mount, the permissions we see if limited by the mount itself,
-				// so we instead use the "raw" permissions from the storage
-				$permissions |= $node->getStorage()->getPermissions('');
-			} else {
-				$permissions |= $node->getPermissions();
-			}
-		}
-
-		// Check that we do not share with more permissions than we have
-		if ($share->getPermissions() & ~$permissions) {
-			$path = $userFolder->getRelativePath($share->getNode()->getPath());
-			throw new GenericShareException($this->l->t('Cannot increase permissions of %s', [$path]), code: 404);
+		$userIds = [];
+		if ($share->getShareOwner() !== null && $this->userManager->userExists($share->getShareOwner())) {
+			$userIds[] = $share->getShareOwner();
 		}
-
-		// Check that read permissions are always set
-		// Link shares are allowed to have no read permissions to allow upload to hidden folders
-		$noReadPermissionRequired = $share->getShareType() === IShare::TYPE_LINK
-			|| $share->getShareType() === IShare::TYPE_EMAIL;
-		if (!$noReadPermissionRequired
-			&& ($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
-			throw new \InvalidArgumentException($this->l->t('Shares need at least read permissions'));
+		if ($share->getSharedBy() !== $share->getShareOwner() && $this->userManager->userExists($share->getSharedBy())) {
+			$userIds[] = $share->getSharedBy();
 		}
 
-		if ($share->getNode() instanceof File) {
-			if ($share->getPermissions() & Constants::PERMISSION_DELETE) {
-				throw new GenericShareException($this->l->t('Files cannot be shared with delete permissions'));
-			}
-			if ($share->getPermissions() & Constants::PERMISSION_CREATE) {
-				throw new GenericShareException($this->l->t('Files cannot be shared with create permissions'));
+		foreach ($userIds as $userId) {
+			$resource = new NodeResource($share->getNodeId(), $userId);
+			if ((new RestrictInteractionEvent($userId, null, $resource, $action, $receiver))->isInteractionRestricted()) {
+				throw new GenericShareException($this->l->t('You are not allowed to share %s', [$share->getNode()->getName()]), code: 403);
 			}
 		}
 	}
@@ -432,25 +415,6 @@ protected function validateExpirationDateLink(IShare $share): IShare {
 	 * @throws \Exception
 	 */
 	protected function userCreateChecks(IShare $share): void {
-		// Check if we can share with group members only
-		if ($this->shareWithGroupMembersOnly()) {
-			$sharedBy = $this->userManager->get($share->getSharedBy());
-			$sharedWith = $this->userManager->get($share->getSharedWith());
-			// Verify we can share with this user
-			$groups = array_intersect(
-				$this->groupManager->getUserGroupIds($sharedBy),
-				$this->groupManager->getUserGroupIds($sharedWith)
-			);
-
-			// optional excluded groups
-			$excludedGroups = $this->shareWithGroupMembersOnlyExcludeGroupsList();
-			$groups = array_diff($groups, $excludedGroups);
-
-			if (empty($groups)) {
-				throw new \Exception($this->l->t('Sharing is only allowed with group members'));
-			}
-		}
-
 		/*
 		 * TODO: Could be costly, fix
 		 *
@@ -493,23 +457,6 @@ protected function userCreateChecks(IShare $share): void {
 	 * @throws \Exception
 	 */
 	protected function groupCreateChecks(IShare $share): void {
-		// Verify group shares are allowed
-		if (!$this->allowGroupSharing()) {
-			throw new \Exception($this->l->t('Group sharing is now allowed'));
-		}
-
-		// Verify if the user can share with this group
-		if ($this->shareWithGroupMembersOnly()) {
-			$sharedBy = $this->userManager->get($share->getSharedBy());
-			$sharedWith = $this->groupManager->get($share->getSharedWith());
-
-			// optional excluded groups
-			$excludedGroups = $this->shareWithGroupMembersOnlyExcludeGroupsList();
-			if (is_null($sharedWith) || in_array($share->getSharedWith(), $excludedGroups) || !$sharedWith->inGroup($sharedBy)) {
-				throw new \Exception($this->l->t('Sharing is only allowed within your own groups'));
-			}
-		}
-
 		/*
 		 * TODO: Could be costly, fix
 		 *
@@ -532,24 +479,6 @@ protected function groupCreateChecks(IShare $share): void {
 		}
 	}
 
-	/**
-	 * Check for pre share requirements for link shares
-	 *
-	 * @throws \Exception
-	 */
-	protected function linkCreateChecks(IShare $share): void {
-		// Are link shares allowed?
-		if (!$this->shareApiAllowLinks()) {
-			throw new \Exception($this->l->t('Link sharing is not allowed'));
-		}
-
-		// Check if public upload is allowed
-		if ($share->getNodeType() === 'folder' && !$this->shareApiLinkAllowPublicUpload()
-			&& ($share->getPermissions() & (Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE))) {
-			throw new \InvalidArgumentException($this->l->t('Public upload is not allowed'));
-		}
-	}
-
 	/**
 	 * To make sure we don't get invisible link shares we set the parent
 	 * of a link if it is a reshare. This is a quick word around
@@ -600,10 +529,7 @@ protected function canShare(IShare $share): void {
 
 	#[Override]
 	public function createShare(IShare $share): IShare {
-		// TODO: handle link share permissions or check them
-		$this->canShare($share);
-
-		$this->generalCreateChecks($share);
+		$this->generalChecks($share);
 
 		// Verify if there are any issues with the path
 		$this->pathCreateChecks($share->getNode());
@@ -644,7 +570,6 @@ public function createShare(IShare $share): IShare {
 				$share = $this->validateExpirationDateInternal($share);
 			} elseif ($share->getShareType() === IShare::TYPE_LINK
 				|| $share->getShareType() === IShare::TYPE_EMAIL) {
-				$this->linkCreateChecks($share);
 				$this->setLinkParent($share);
 
 				$token = $this->generateToken();
@@ -737,8 +662,6 @@ public function createShare(IShare $share): IShare {
 	public function updateShare(IShare $share, bool $onlyValid = true): IShare {
 		$expirationDateUpdated = false;
 
-		$this->canShare($share);
-
 		try {
 			$originalShare = $this->getShareById($share->getFullId(), onlyValid: $onlyValid);
 		} catch (\UnexpectedValueException $e) {
@@ -762,7 +685,7 @@ public function updateShare(IShare $share, bool $onlyValid = true): IShare {
 			throw new \InvalidArgumentException($this->l->t('Cannot share with the share owner'));
 		}
 
-		$this->generalCreateChecks($share, true);
+		$this->generalChecks($share);
 
 		if ($share->getShareType() === IShare::TYPE_USER) {
 			$this->userCreateChecks($share);
@@ -782,7 +705,6 @@ public function updateShare(IShare $share, bool $onlyValid = true): IShare {
 			}
 		} elseif ($share->getShareType() === IShare::TYPE_LINK
 			|| $share->getShareType() === IShare::TYPE_EMAIL) {
-			$this->linkCreateChecks($share);
 
 			// The new password is not set again if it is the same as the old
 			// one, unless when switching from sending by Talk to sending by
@@ -1096,7 +1018,7 @@ protected function promoteReshares(IShare $share): void {
 		foreach ($reshareRecords as $child) {
 			try {
 				/* Check if the share is still valid (means the resharer still has access to the file through another mean) */
-				$this->generalCreateChecks($child);
+				$this->generalChecks($child);
 			} catch (GenericShareException $e) {
 				/* The check is invalid, promote it to a direct share from the sharer of parent share */
 				$this->logger->debug('Promote reshare because of exception ' . $e->getMessage(), ['exception' => $e, 'fullId' => $child->getFullId()]);
@@ -1486,7 +1408,7 @@ private function checkShare(IShare $share, int &$added = 1): void {
 			throw new ShareNotFound($this->l->t('The requested share does not exist anymore'));
 		}
 		if ($this->config->getAppValue('files_sharing', 'hide_disabled_user_shares', 'no') === 'yes') {
-			$uids = array_unique([$share->getShareOwner(),$share->getSharedBy()]);
+			$uids = array_unique([$share->getShareOwner(), $share->getSharedBy()]);
 			foreach ($uids as $uid) {
 				$user = $this->userManager->get($uid);
 				if ($user?->isEnabled() === false) {

tests/lib/Share20/ManagerTest.php

@@ -2625,7 +2625,7 @@ public function testCreateShareUser(): void {
 			->method('canShare')
 			->with($share);
 		$manager->expects($this->once())
-			->method('generalCreateChecks')
+			->method('generalChecks')
 			->with($share);
 		;
 		$manager->expects($this->once())