feat(Interaction): Implement all existing restrictions

Signed-off-by: provokateurin <kate@provokateurin.de>

Author: provokateurin

apps/files/composer/composer/autoload_classmap.php

@@ -78,6 +78,7 @@
     'OCA\\Files\\Listener\\NodeAddedToFavoriteListener' => $baseDir . '/../lib/Listener/NodeAddedToFavoriteListener.php',
     'OCA\\Files\\Listener\\NodeRemovedFromFavoriteListener' => $baseDir . '/../lib/Listener/NodeRemovedFromFavoriteListener.php',
     'OCA\\Files\\Listener\\RenderReferenceEventListener' => $baseDir . '/../lib/Listener/RenderReferenceEventListener.php',
+    'OCA\\Files\\Listener\\RestrictInteractionListener' => $baseDir . '/../lib/Listener/RestrictInteractionListener.php',
     'OCA\\Files\\Listener\\SyncLivePhotosListener' => $baseDir . '/../lib/Listener/SyncLivePhotosListener.php',
     'OCA\\Files\\Listener\\UserFirstTimeLoggedInListener' => $baseDir . '/../lib/Listener/UserFirstTimeLoggedInListener.php',
     'OCA\\Files\\Migration\\Version11301Date20191205150729' => $baseDir . '/../lib/Migration/Version11301Date20191205150729.php',

apps/files/composer/composer/autoload_static.php

@@ -93,6 +93,7 @@ class ComposerStaticInitFiles
         'OCA\\Files\\Listener\\NodeAddedToFavoriteListener' => __DIR__ . '/..' . '/../lib/Listener/NodeAddedToFavoriteListener.php',
         'OCA\\Files\\Listener\\NodeRemovedFromFavoriteListener' => __DIR__ . '/..' . '/../lib/Listener/NodeRemovedFromFavoriteListener.php',
         'OCA\\Files\\Listener\\RenderReferenceEventListener' => __DIR__ . '/..' . '/../lib/Listener/RenderReferenceEventListener.php',
+        'OCA\\Files\\Listener\\RestrictInteractionListener' => __DIR__ . '/..' . '/../lib/Listener/RestrictInteractionListener.php',
         'OCA\\Files\\Listener\\SyncLivePhotosListener' => __DIR__ . '/..' . '/../lib/Listener/SyncLivePhotosListener.php',
         'OCA\\Files\\Listener\\UserFirstTimeLoggedInListener' => __DIR__ . '/..' . '/../lib/Listener/UserFirstTimeLoggedInListener.php',
         'OCA\\Files\\Migration\\Version11301Date20191205150729' => __DIR__ . '/..' . '/../lib/Migration/Version11301Date20191205150729.php',

apps/files/lib/AppInfo/Application.php

@@ -24,6 +24,7 @@
 use OCA\Files\Listener\NodeAddedToFavoriteListener;
 use OCA\Files\Listener\NodeRemovedFromFavoriteListener;
 use OCA\Files\Listener\RenderReferenceEventListener;
+use OCA\Files\Listener\RestrictInteractionListener;
 use OCA\Files\Listener\SyncLivePhotosListener;
 use OCA\Files\Listener\UserFirstTimeLoggedInListener;
 use OCA\Files\Notification\Notifier;
@@ -41,6 +42,7 @@
 use OCP\Files\Events\Node\NodeCopiedEvent;
 use OCP\Files\Events\NodeAddedToFavorite;
 use OCP\Files\Events\NodeRemovedFromFavorite;
+use OCP\Interaction\RestrictInteractionEvent;
 use OCP\User\Events\UserFirstTimeLoggedInEvent;
 use OCP\Util;
 
@@ -79,6 +81,7 @@ public function register(IRegistrationContext $context): void {
 
 		$context->registerConfigLexicon(ConfigLexicon::class);
 
+		$context->registerEventListener(RestrictInteractionEvent::class, RestrictInteractionListener::class);
 	}
 
 	#[\Override]

apps/files/lib/Listener/RestrictInteractionListener.php

@@ -0,0 +1,32 @@
+<?php
+
+/*
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Files\Listener;
+
+use OCP\Constants;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Interaction\InteractionRestrictedException;
+use OCP\Interaction\Resources\NodeResource;
+use OCP\Interaction\RestrictInteractionEvent;
+
+/**
+ * @template-implements IEventListener<RestrictInteractionEvent>
+ */
+final class RestrictInteractionListener implements IEventListener {
+	/**
+	 * @param RestrictInteractionEvent $event
+	 */
+	#[\Override]
+	public function handle(Event $event): void {
+		if ($event->resource instanceof NodeResource && ($event->resource->getNodePermissions($event->user->getUID()) & Constants::PERMISSION_READ) !== Constants::PERMISSION_READ) {
+			throw new InteractionRestrictedException('No read permission on the node.');
+		}
+	}
+}

apps/files/tests/Listener/RestrictInteractionListenerTest.php

@@ -0,0 +1,68 @@
+<?php
+
+/*
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Files\Tests\Listener;
+
+use Exception;
+use OCP\Constants;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Files\IRootFolder;
+use OCP\Files\ISetupManager;
+use OCP\Interaction\Resources\NodeResource;
+use OCP\Interaction\RestrictInteractionEvent;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\Server;
+use PHPUnit\Framework\Attributes\Group;
+use Test\TestCase;
+
+#[Group('DB')]
+final class RestrictInteractionListenerTest extends TestCase {
+	private IUser $user;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+		$user = Server::get(IUserManager::class)->createUser('user', 'password');
+		$this->assertNotFalse($user);
+		$this->user = $user;
+
+		Server::get(ISetupManager::class)->setupForUser($user);
+	}
+
+	#[\Override]
+	protected function tearDown(): void {
+		Server::get(ISetupManager::class)->tearDown();
+
+		$this->assertTrue($this->user->delete());
+
+		parent::tearDown();
+	}
+
+	public function testNodeResourceShareActionMissingReadPermission(): void {
+		$userFolder = Server::get(IRootFolder::class)->getUserFolder($this->user->getUID());
+
+		$fileNode = $userFolder->newFile('foo.txt', 'bar');
+		$fileNode->getStorage()->getCache()->update($fileNode->getId(), ['permissions' => Constants::PERMISSION_ALL & ~Constants::PERMISSION_READ]);
+
+		$folderNode = $userFolder->newFolder('foo');
+		$folderNode->getStorage()->getCache()->update($folderNode->getId(), ['permissions' => Constants::PERMISSION_ALL & ~Constants::PERMISSION_READ]);
+
+		foreach ([$fileNode, $folderNode] as $node) {
+			$event = new RestrictInteractionEvent($this->user, new NodeResource($node->getId(), $node), null, null);
+
+			try {
+				Server::get(IEventDispatcher::class)->dispatchTyped($event);
+				$this->fail('Interaction not restricted.');
+			} catch (Exception $e) {
+				$this->assertEquals('No read permission on the node.', $e->getMessage());
+			}
+		}
+	}
+}

apps/files_sharing/composer/composer/autoload_classmap.php

@@ -70,6 +70,7 @@
     'OCA\\Files_Sharing\\Listener\\LoadAdditionalListener' => $baseDir . '/../lib/Listener/LoadAdditionalListener.php',
     'OCA\\Files_Sharing\\Listener\\LoadPublicFileRequestAuthListener' => $baseDir . '/../lib/Listener/LoadPublicFileRequestAuthListener.php',
     'OCA\\Files_Sharing\\Listener\\LoadSidebarListener' => $baseDir . '/../lib/Listener/LoadSidebarListener.php',
+    'OCA\\Files_Sharing\\Listener\\RestrictInteractionListener' => $baseDir . '/../lib/Listener/RestrictInteractionListener.php',
     'OCA\\Files_Sharing\\Listener\\ShareInteractionListener' => $baseDir . '/../lib/Listener/ShareInteractionListener.php',
     'OCA\\Files_Sharing\\Listener\\SharesUpdatedListener' => $baseDir . '/../lib/Listener/SharesUpdatedListener.php',
     'OCA\\Files_Sharing\\Listener\\UserAddedToGroupListener' => $baseDir . '/../lib/Listener/UserAddedToGroupListener.php',

apps/files_sharing/composer/composer/autoload_static.php

@@ -85,6 +85,7 @@ class ComposerStaticInitFiles_Sharing
         'OCA\\Files_Sharing\\Listener\\LoadAdditionalListener' => __DIR__ . '/..' . '/../lib/Listener/LoadAdditionalListener.php',
         'OCA\\Files_Sharing\\Listener\\LoadPublicFileRequestAuthListener' => __DIR__ . '/..' . '/../lib/Listener/LoadPublicFileRequestAuthListener.php',
         'OCA\\Files_Sharing\\Listener\\LoadSidebarListener' => __DIR__ . '/..' . '/../lib/Listener/LoadSidebarListener.php',
+        'OCA\\Files_Sharing\\Listener\\RestrictInteractionListener' => __DIR__ . '/..' . '/../lib/Listener/RestrictInteractionListener.php',
         'OCA\\Files_Sharing\\Listener\\ShareInteractionListener' => __DIR__ . '/..' . '/../lib/Listener/ShareInteractionListener.php',
         'OCA\\Files_Sharing\\Listener\\SharesUpdatedListener' => __DIR__ . '/..' . '/../lib/Listener/SharesUpdatedListener.php',
         'OCA\\Files_Sharing\\Listener\\UserAddedToGroupListener' => __DIR__ . '/..' . '/../lib/Listener/UserAddedToGroupListener.php',

apps/files_sharing/lib/AppInfo/Application.php

@@ -24,6 +24,7 @@
 use OCA\Files_Sharing\Listener\LoadAdditionalListener;
 use OCA\Files_Sharing\Listener\LoadPublicFileRequestAuthListener;
 use OCA\Files_Sharing\Listener\LoadSidebarListener;
+use OCA\Files_Sharing\Listener\RestrictInteractionListener;
 use OCA\Files_Sharing\Listener\ShareInteractionListener;
 use OCA\Files_Sharing\Listener\SharesUpdatedListener;
 use OCA\Files_Sharing\Listener\UserAddedToGroupListener;
@@ -56,6 +57,7 @@
 use OCP\IConfig;
 use OCP\IDBConnection;
 use OCP\IGroup;
+use OCP\Interaction\RestrictInteractionEvent;
 use OCP\Share\Events\BeforeShareDeletedEvent;
 use OCP\Share\Events\ShareCreatedEvent;
 use OCP\Share\Events\ShareMovedEvent;
@@ -132,6 +134,8 @@ function () use ($c) {
 		$context->registerEventListener(UserHomeSetupEvent::class, UserHomeSetupListener::class);
 
 		$context->registerConfigLexicon(ConfigLexicon::class);
+
+		$context->registerEventListener(RestrictInteractionEvent::class, RestrictInteractionListener::class);
 	}
 
 	#[\Override]

apps/files_sharing/lib/Listener/RestrictInteractionListener.php

@@ -0,0 +1,77 @@
+<?php
+
+/*
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Files_Sharing\Listener;
+
+use OCP\Constants;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Interaction\Actions\ShareAction;
+use OCP\Interaction\InteractionRestrictedException;
+use OCP\Interaction\Receivers\EmailReceiver;
+use OCP\Interaction\Receivers\LinkReceiver;
+use OCP\Interaction\Resources\NodeResource;
+use OCP\Interaction\RestrictInteractionEvent;
+use OCP\Share\IManager;
+
+/**
+ * @template-implements IEventListener<RestrictInteractionEvent>
+ */
+final readonly class RestrictInteractionListener implements IEventListener {
+
+	public function __construct(
+		private IManager $manager,
+	) {
+	}
+
+	/**
+	 * @param RestrictInteractionEvent $event
+	 */
+	#[\Override]
+	public function handle(Event $event): void {
+		if ($event->resource instanceof NodeResource && $event->action instanceof ShareAction) {
+			$nodePermissions = $event->resource->getNodePermissions($event->user->getUID());
+
+			if (($nodePermissions & Constants::PERMISSION_SHARE) !== Constants::PERMISSION_SHARE) {
+				throw new InteractionRestrictedException('No share permission on the node.');
+			}
+
+			if ($event->action->filesSharingPermissions !== null) {
+				if (($event->action->filesSharingPermissions & ~$nodePermissions) !== 0) {
+					throw new InteractionRestrictedException('Cannot share node with more permissions than the node already has.');
+				}
+
+				if ($event->resource->getNode($event->user->getUID()) instanceof File) {
+					if (($event->action->filesSharingPermissions & Constants::PERMISSION_DELETE) === Constants::PERMISSION_DELETE) {
+						throw new InteractionRestrictedException('Cannot share file node with delete permission.');
+					}
+
+					if (($event->action->filesSharingPermissions & Constants::PERMISSION_CREATE) === Constants::PERMISSION_CREATE) {
+						throw new InteractionRestrictedException('Cannot share file node with create permission.');
+					}
+				}
+
+				if (!$event->receiver instanceof LinkReceiver
+					&& !$event->receiver instanceof EmailReceiver
+					&& ($event->action->filesSharingPermissions & Constants::PERMISSION_READ) !== Constants::PERMISSION_READ) {
+					throw new InteractionRestrictedException('No read permission on the share.');
+				}
+
+				if (($event->receiver instanceof LinkReceiver || $event->receiver instanceof EmailReceiver)
+					&& $event->resource->getNode($event->user->getUID()) instanceof Folder
+					&& ($event->action->filesSharingPermissions & (Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE)) !== 0
+					&& !$this->manager->shareApiLinkAllowPublicUpload()) {
+					throw new InteractionRestrictedException('Public upload is not allowed.');
+				}
+			}
+		}
+	}
+}