Fix current user edit/delete permissions

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

apps/files_sharing/lib/Controller/ShareAPIController.php

@@ -154,7 +154,11 @@ class ShareAPIController extends OCSController {
 			'share_type' => $share->getShareType(),
 			'uid_owner' => $share->getSharedBy(),
 			'displayname_owner' => $sharedBy !== null ? $sharedBy->getDisplayName() : $share->getSharedBy(),
+			// recipient permissions
 			'permissions' => $share->getPermissions(),
+			// current user permissions on this share
+			'can_edit' => $this->canEditShare($share),
+			'can_delete' => $this->canDeleteShare($share),
 			'stime' => $share->getShareTime()->getTimestamp(),
 			'parent' => null,
 			'expiration' => null,

apps/files_sharing/src/components/SharingEntry.vue

@@ -30,75 +30,80 @@
 			<h5>{{ title }}</h5>
 		</div>
 		<Actions menu-align="right" class="sharing-entry__actions">
-			<!-- edit permission -->
-			<ActionCheckbox
-				ref="canEdit"
-				:checked.sync="canEdit"
-				:value="permissionsEdit"
-				:disabled="saving">
-				{{ t('files_sharing', 'Allow editing') }}
-			</ActionCheckbox>
-
-			<!-- reshare permission -->
-			<ActionCheckbox
-				ref="canReshare"
-				:checked.sync="canReshare"
-				:value="permissionsShare"
-				:disabled="saving">
-				{{ t('files_sharing', 'Can reshare') }}
-			</ActionCheckbox>
-
-			<!-- expiration date -->
-			<ActionCheckbox :checked.sync="hasExpirationDate"
-				:disabled="config.isDefaultExpireDateEnforced || saving"
-				@uncheck="onExpirationDisable">
-				{{ config.isDefaultExpireDateEnforced
-					? t('files_sharing', 'Expiration date enforced')
-					: t('files_sharing', 'Set expiration date') }}
-			</ActionCheckbox>
-			<ActionInput v-if="hasExpirationDate"
-				ref="expireDate"
-				v-tooltip.auto="{
-					content: errors.expireDate,
-					show: errors.expireDate,
-					trigger: 'manual'
-				}"
-				:class="{ error: errors.expireDate}"
-				:disabled="saving"
-				:first-day-of-week="firstDay"
-				:lang="lang"
-				:value="share.expireDate"
-				icon="icon-calendar-dark"
-				type="date"
-				:not-before="dateTomorrow"
-				:not-after="dateMaxEnforced"
-				@update:value="onExpirationChange">
-				{{ t('files_sharing', 'Enter a date') }}
-			</ActionInput>
-
-			<!-- note -->
-			<template v-if="canHaveNote">
+			<template v-if="share.canEdit">
+				<!-- edit permission -->
 				<ActionCheckbox
-					:checked.sync="hasNote"
-					:disabled="saving"
-					@uncheck="queueUpdate('note')">
-					{{ t('files_sharing', 'Note to recipient') }}
+					ref="canEdit"
+					:checked.sync="canEdit"
+					:value="permissionsEdit"
+					:disabled="saving">
+					{{ t('files_sharing', 'Allow editing') }}
 				</ActionCheckbox>
-				<ActionTextEditable v-if="hasNote"
-					ref="note"
+
+				<!-- reshare permission -->
+				<ActionCheckbox
+					ref="canReshare"
+					:checked.sync="canReshare"
+					:value="permissionsShare"
+					:disabled="saving">
+					{{ t('files_sharing', 'Can reshare') }}
+				</ActionCheckbox>
+
+				<!-- expiration date -->
+				<ActionCheckbox :checked.sync="hasExpirationDate"
+					:disabled="config.isDefaultExpireDateEnforced || saving"
+					@uncheck="onExpirationDisable">
+					{{ config.isDefaultExpireDateEnforced
+						? t('files_sharing', 'Expiration date enforced')
+						: t('files_sharing', 'Set expiration date') }}
+				</ActionCheckbox>
+				<ActionInput v-if="hasExpirationDate"
+					ref="expireDate"
 					v-tooltip.auto="{
-						content: errors.note,
-						show: errors.note,
+						content: errors.expireDate,
+						show: errors.expireDate,
 						trigger: 'manual'
 					}"
-					:class="{ error: errors.note}"
+					:class="{ error: errors.expireDate}"
 					:disabled="saving"
-					:value.sync="share.note"
-					icon="icon-edit"
-					@update:value="debounceQueueUpdate('note')" />
+					:first-day-of-week="firstDay"
+					:lang="lang"
+					:value="share.expireDate"
+					icon="icon-calendar-dark"
+					type="date"
+					:not-before="dateTomorrow"
+					:not-after="dateMaxEnforced"
+					@update:value="onExpirationChange">
+					{{ t('files_sharing', 'Enter a date') }}
+				</ActionInput>
+
+				<!-- note -->
+				<template v-if="canHaveNote">
+					<ActionCheckbox
+						:checked.sync="hasNote"
+						:disabled="saving"
+						@uncheck="queueUpdate('note')">
+						{{ t('files_sharing', 'Note to recipient') }}
+					</ActionCheckbox>
+					<ActionTextEditable v-if="hasNote"
+						ref="note"
+						v-tooltip.auto="{
+							content: errors.note,
+							show: errors.note,
+							trigger: 'manual'
+						}"
+						:class="{ error: errors.note}"
+						:disabled="saving"
+						:value.sync="share.note"
+						icon="icon-edit"
+						@update:value="debounceQueueUpdate('note')" />
+				</template>
 			</template>
 
-			<ActionButton icon="icon-delete" :disabled="saving" @click.prevent="onDelete">
+			<ActionButton v-if="share.canDelete"
+				icon="icon-delete"
+				:disabled="saving"
+				@click.prevent="onDelete">
 				{{ t('files_sharing', 'Unshare') }}
 			</ActionButton>
 		</Actions>

apps/files_sharing/src/components/SharingEntryLink.vue

@@ -123,7 +123,7 @@
 			:open.sync="open"
 			@close="onPasswordSubmit">
 			<template v-if="share">
-				<template v-if="isShareOwner">
+				<template v-if="share.canEdit">
 					<!-- folder -->
 					<template v-if="isFolder && fileHasCreatePermission && config.isPublicUploadEnabled">
 						<ActionRadio :checked="share.permissions === publicUploadRValue"
@@ -256,7 +256,10 @@
 					{{ name }}
 				</ActionLink>
 
-				<ActionButton icon="icon-delete" :disabled="saving" @click.prevent="onDelete">
+				<ActionButton v-if="share.canDelete"
+					icon="icon-delete"
+					:disabled="saving"
+					@click.prevent="onDelete">
 					{{ t('files_sharing', 'Delete share') }}
 				</ActionButton>
 				<ActionButton v-if="!isEmailShareType && canReshare"

apps/files_sharing/src/models/Share.js

@@ -420,6 +420,31 @@ export default class Share {
 		return !!((this.permissions & OC.PERMISSION_SHARE))
 	}
 
+	// PERMISSIONS Shortcuts for the CURRENT USER
+	// ! the permissions above are the share settings,
+	// ! meaning the permissions for the recipient
+	/**
+	 * Can the current user EDIT this share ?
+	 *
+	 * @returns {boolean}
+	 * @readonly
+	 * @memberof Share
+	 */
+	get canEdit() {
+		return this.#share.can_edit === true
+	}
+
+	/**
+	 * Can the current user DELETE this share ?
+	 *
+	 * @returns {boolean}
+	 * @readonly
+	 * @memberof Share
+	 */
+	get canDelete() {
+		return this.#share.can_delete === true
+	}
+
 	// TODO: SORT THOSE PROPERTIES
 	get label() {
 		return this.#share.label

apps/files_sharing/tests/Controller/ShareAPIControllerTest.php

@@ -577,6 +577,8 @@ class ShareAPIControllerTest extends TestCase {
 			'displayname_file_owner' => 'ownerDisplay',
 			'mimetype' => 'myMimeType',
 			'hide_download' => 0,
+			'can_edit' => false,
+			'can_delete' => false,
 		];
 		$data[] = [$share, $expected];
 
@@ -623,6 +625,8 @@ class ShareAPIControllerTest extends TestCase {
 			'displayname_file_owner' => 'ownerDisplay',
 			'mimetype' => 'myFolderMimeType',
 			'hide_download' => 0,
+			'can_edit' => false,
+			'can_delete' => false,
 		];
 		$data[] = [$share, $expected];
 
@@ -676,6 +680,8 @@ class ShareAPIControllerTest extends TestCase {
 			'displayname_file_owner' => 'ownerDisplay',
 			'mimetype' => 'myFolderMimeType',
 			'hide_download' => 0,
+			'can_edit' => false,
+			'can_delete' => false,
 		];
 		$data[] = [$share, $expected];
 
@@ -3431,6 +3437,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 		// User backend up
@@ -3462,6 +3470,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [
 				['owner', $owner],
 				['initiator', $initiator],
@@ -3509,6 +3519,53 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
+			], $share, [], false
+		];
+
+		$share = \OC::$server->getShareManager()->newShare();
+		$share->setShareType(\OCP\Share::SHARE_TYPE_USER)
+			->setSharedWith('recipient')
+			->setSharedBy('initiator')
+			->setShareOwner('currentUser')
+			->setPermissions(\OCP\Constants::PERMISSION_READ)
+			->setNode($file)
+			->setShareTime(new \DateTime('2000-01-01T00:01:02'))
+			->setTarget('myTarget')
+			->setNote('personal note')
+			->setId(42);
+		// User backend down
+		$result[] = [
+			[
+				'id' => 42,
+				'share_type' => \OCP\Share::SHARE_TYPE_USER,
+				'uid_owner' => 'initiator',
+				'displayname_owner' => 'initiator',
+				'permissions' => 1,
+				'stime' => 946684862,
+				'parent' => null,
+				'expiration' => null,
+				'token' => null,
+				'uid_file_owner' => 'currentUser',
+				'displayname_file_owner' => 'currentUser',
+				'note' => 'personal note',
+				'label' => null,
+				'path' => 'file',
+				'item_type' => 'file',
+				'storage_id' => 'storageId',
+				'storage' => 100,
+				'item_source' => 3,
+				'file_source' => 3,
+				'file_parent' => 1,
+				'file_target' => 'myTarget',
+				'share_with' => 'recipient',
+				'share_with_displayname' => 'recipient',
+				'mail_send' => 0,
+				'mimetype' => 'myMimeType',
+				'hide_download' => 0,
+				'can_edit' => true,
+				'can_delete' => true,
 			], $share, [], false
 		];
 
@@ -3554,6 +3611,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3597,6 +3656,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3646,6 +3707,8 @@ class ShareAPIControllerTest extends TestCase {
 				'url' => 'myLink',
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3696,6 +3759,8 @@ class ShareAPIControllerTest extends TestCase {
 				'url' => 'myLink',
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3739,6 +3804,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myFolderMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3785,6 +3852,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myFolderMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3829,6 +3898,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myFolderMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3873,6 +3944,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mail_send' => 0,
 				'mimetype' => 'myFolderMimeType',
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3933,6 +4006,8 @@ class ShareAPIControllerTest extends TestCase {
 				'password' => 'password',
 				'send_password_by_talk' => false,
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -3979,6 +4054,8 @@ class ShareAPIControllerTest extends TestCase {
 				'password' => 'password',
 				'send_password_by_talk' => true,
 				'hide_download' => 0,
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, [], false
 		];
 
@@ -4120,6 +4197,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
 				'label' => '',
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, false, []
 		];
 
@@ -4163,6 +4242,8 @@ class ShareAPIControllerTest extends TestCase {
 				'mimetype' => 'myMimeType',
 				'hide_download' => 0,
 				'label' => '',
+				'can_edit' => false,
+				'can_delete' => false,
 			], $share, true, [
 				'share_with_displayname' => 'recipientRoomName'
 			]