feat: Add missing NoSubAdminRequired attribute

apps/provisioning_api/lib/Controller/AppConfigController.php

@@ -15,6 +15,7 @@
 use OCP\App\IAppManager;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
@@ -102,8 +103,6 @@ public function getValue(string $app, string $key, string $defaultValue = ''): D
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Update the config value of an app
 	 *
 	 * @param string $app ID of the app
@@ -116,6 +115,7 @@ public function getValue(string $app, string $key, string $defaultValue = ''): D
 	 */
 	#[PasswordConfirmationRequired]
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function setValue(string $app, string $key, string $value): DataResponse {
 		$user = $this->userSession->getUser();
 		if ($user === null) {

apps/provisioning_api/lib/Controller/GroupsController.php

@@ -17,6 +17,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSException;
@@ -138,8 +139,6 @@ public function getGroup(string $groupId): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of users in the specified group
 	 *
 	 * @param string $groupId ID of the group
@@ -151,6 +150,7 @@ public function getGroup(string $groupId): DataResponse {
 	 * 200: User IDs returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getGroupUsers(string $groupId): DataResponse {
 		$groupId = urldecode($groupId);
 

apps/provisioning_api/lib/Controller/PreferencesController.php

@@ -11,6 +11,7 @@
 
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\Config\BeforePreferenceDeletedEvent;
@@ -33,8 +34,6 @@ public function __construct(
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Update multiple preference values of an app
 	 *
 	 * @param string $appId ID of the app
@@ -46,6 +45,7 @@ public function __construct(
 	 * 400: Preference invalid
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function setMultiplePreferences(string $appId, array $configs): DataResponse {
 		$userId = $this->userSession->getUser()->getUID();
 
@@ -78,8 +78,6 @@ public function setMultiplePreferences(string $appId, array $configs): DataRespo
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Update a preference value of an app
 	 *
 	 * @param string $appId ID of the app
@@ -91,6 +89,7 @@ public function setMultiplePreferences(string $appId, array $configs): DataRespo
 	 * 400: Preference invalid
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function setPreference(string $appId, string $configKey, string $configValue): DataResponse {
 		$userId = $this->userSession->getUser()->getUID();
 
@@ -119,8 +118,6 @@ public function setPreference(string $appId, string $configKey, string $configVa
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Delete multiple preferences for an app
 	 *
 	 * @param string $appId ID of the app
@@ -132,6 +129,7 @@ public function setPreference(string $appId, string $configKey, string $configVa
 	 * 400: Preference invalid
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function deleteMultiplePreference(string $appId, array $configKeys): DataResponse {
 		$userId = $this->userSession->getUser()->getUID();
 
@@ -162,8 +160,6 @@ public function deleteMultiplePreference(string $appId, array $configKeys): Data
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Delete a preference for an app
 	 *
 	 * @param string $appId ID of the app
@@ -174,6 +170,7 @@ public function deleteMultiplePreference(string $appId, array $configKeys): Data
 	 * 400: Preference invalid
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function deletePreference(string $appId, string $configKey): DataResponse {
 		$userId = $this->userSession->getUser()->getUID();
 

apps/provisioning_api/lib/Controller/UsersController.php

@@ -26,6 +26,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
@@ -349,8 +350,6 @@ public function getLastLoggedInUsers(
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Search users by their phone numbers
 	 *
 	 * @param string $location Location of the phone number (for country code)
@@ -360,6 +359,7 @@ public function getLastLoggedInUsers(
 	 * 200: Users returned
 	 * 400: Invalid location
 	 */
+	#[NoSubAdminRequired]
 	#[NoAdminRequired]
 	public function searchByPhoneNumbers(string $location, array $search): DataResponse {
 		if ($this->phoneNumberUtil->getCountryCodeForRegion($location) === null) {
@@ -656,8 +656,6 @@ public function addUser(
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get the details of a user
 	 *
 	 * @param string $userId ID of the user
@@ -667,6 +665,7 @@ public function addUser(
 	 * 200: User returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getUser(string $userId): DataResponse {
 		$includeScopes = false;
 		$currentUser = $this->userSession->getUser();
@@ -683,8 +682,6 @@ public function getUser(string $userId): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get the details of the current user
 	 *
 	 * @return DataResponse<Http::STATUS_OK, Provisioning_APIUserDetails, array{}>
@@ -693,6 +690,7 @@ public function getUser(string $userId): DataResponse {
 	 * 200: Current user returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getCurrentUser(): DataResponse {
 		$user = $this->userSession->getUser();
 		if ($user) {
@@ -705,8 +703,6 @@ public function getCurrentUser(): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of fields that are editable for the current user
 	 *
 	 * @return DataResponse<Http::STATUS_OK, list<string>, array{}>
@@ -715,6 +711,7 @@ public function getCurrentUser(): DataResponse {
 	 * 200: Editable fields returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getEditableFields(): DataResponse {
 		$currentLoggedInUser = $this->userSession->getUser();
 		if (!$currentLoggedInUser instanceof IUser) {
@@ -738,8 +735,6 @@ public function getEnabledApps(): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of fields that are editable for a user
 	 *
 	 * @param string $userId ID of the user
@@ -749,6 +744,7 @@ public function getEnabledApps(): DataResponse {
 	 * 200: Editable fields for user returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getEditableFieldsForUser(string $userId): DataResponse {
 		$currentLoggedInUser = $this->userSession->getUser();
 		if (!$currentLoggedInUser instanceof IUser) {
@@ -794,8 +790,6 @@ public function getEditableFieldsForUser(string $userId): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Update multiple values of the user's details
 	 *
 	 * @param string $userId ID of the user
@@ -809,6 +803,7 @@ public function getEditableFieldsForUser(string $userId): DataResponse {
 	 */
 	#[PasswordConfirmationRequired]
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	#[UserRateLimit(limit: 5, period: 60)]
 	public function editUserMultiValue(
 		string $userId,
@@ -1173,8 +1168,6 @@ private function validatePasswordChange(IUser $targetUser, string $password): ?a
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Update a value of the user's details
 	 *
 	 * @param string $userId ID of the user
@@ -1187,6 +1180,7 @@ private function validatePasswordChange(IUser $targetUser, string $password): ?a
 	 */
 	#[PasswordConfirmationRequired]
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	#[UserRateLimit(limit: 50, period: 600)]
 	public function editUser(string $userId, string $key, string $value): DataResponse {
 		$currentLoggedInUser = $this->userSession->getUser();
@@ -1611,8 +1605,6 @@ private function setEnabled(string $userId, bool $value): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of groups the user belongs to
 	 *
 	 * @param string $userId ID of the user
@@ -1622,6 +1614,7 @@ private function setEnabled(string $userId, bool $value): DataResponse {
 	 * 200: Users groups returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getUsersGroups(string $userId): DataResponse {
 		$loggedInUser = $this->userSession->getUser();
 
@@ -1656,8 +1649,6 @@ public function getUsersGroups(string $userId): DataResponse {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of groups with details
 	 *
 	 * @param string $userId ID of the user
@@ -1667,6 +1658,7 @@ public function getUsersGroups(string $userId): DataResponse {
 	 * 200: Users groups returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getUsersGroupsDetails(string $userId): DataResponse {
 		$loggedInUser = $this->userSession->getUser();
 
@@ -1733,8 +1725,6 @@ function (string $gid) {
 	}
 
 	/**
-	 * @NoSubAdminRequired
-	 *
 	 * Get a list of the groups the user is a subadmin of, with details
 	 *
 	 * @param string $userId ID of the user
@@ -1744,6 +1734,7 @@ function (string $gid) {
 	 * 200: Users subadmin groups returned
 	 */
 	#[NoAdminRequired]
+	#[NoSubAdminRequired]
 	public function getUserSubAdminGroupsDetails(string $userId): DataResponse {
 		$loggedInUser = $this->userSession->getUser();
 

apps/provisioning_api/lib/Controller/VerificationController.php

@@ -15,6 +15,7 @@
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\HintException;
@@ -41,9 +42,7 @@ public function __construct(
 		parent::__construct($appName, $request);
 	}
 
-	/**
-	 * @NoSubAdminRequired
-	 */
+	#[NoSubAdminRequired]
 	#[NoAdminRequired]
 	#[NoCSRFRequired]
 	public function showVerifyMail(string $token, string $userId, string $key): TemplateResponse {
@@ -71,9 +70,7 @@ public function showVerifyMail(string $token, string $userId, string $key): Temp
 			], TemplateResponse::RENDER_AS_GUEST);
 	}
 
-	/**
-	 * @NoSubAdminRequired
-	 */
+	#[NoSubAdminRequired]
 	#[NoAdminRequired]
 	#[BruteForceProtection(action: 'emailVerification')]
 	public function verifyMail(string $token, string $userId, string $key): TemplateResponse {

apps/provisioning_api/lib/Middleware/ProvisioningApiMiddleware.php

@@ -13,6 +13,7 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Response;
 use OCP\AppFramework\Middleware;
 use OCP\AppFramework\OCS\OCSException;
@@ -43,7 +44,8 @@ public function __construct(
 	#[\Override]
 	public function beforeController(Controller $controller, string $methodName): void {
 		// If AuthorizedAdminSetting, the check will be done in the SecurityMiddleware
-		if (!$this->isAdmin && !$this->reflector->hasAnnotation('NoSubAdminRequired') && !$this->isSubAdmin && !$this->reflector->hasAnnotationOrAttribute('AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
+		if (!$this->isAdmin && !$this->reflector->hasAnnotationOrAttribute('NoSubAdminRequired', NoSubAdminRequired::class)
+			&& !$this->isSubAdmin && !$this->reflector->hasAnnotationOrAttribute('AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
 			throw new NotSubAdminException();
 		}
 	}

apps/provisioning_api/tests/Middleware/ProvisioningApiMiddlewareTest.php

@@ -53,15 +53,11 @@ public function testBeforeController(bool $subadminRequired, bool $isAdmin, bool
 			$isSubAdmin
 		);
 
-		$this->reflector->method('hasAnnotation')
-			->willReturnCallback(function ($annotation) use ($subadminRequired) {
+		$this->reflector->method('hasAnnotationOrAttribute')
+			->willReturnCallback(function ($annotation, $attribute) use ($subadminRequired, $hasSettingAuthorizationAnnotation) {
 				if ($annotation === 'NoSubAdminRequired') {
 					return !$subadminRequired;
 				}
-				return false;
-			});
-		$this->reflector->method('hasAnnotationOrAttribute')
-			->willReturnCallback(function ($annotation, $attribute) use ($hasSettingAuthorizationAnnotation) {
 				if ($annotation === 'AuthorizedAdminSetting') {
 					return $hasSettingAuthorizationAnnotation;
 				}

apps/settings/lib/Controller/AdminSettingsController.php

@@ -10,6 +10,7 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\AppFramework\Services\IInitialState;
@@ -47,10 +48,10 @@ public function __construct(
 	}
 
 	/**
-	 * @NoSubAdminRequired
 	 * We are checking the permissions in the getSettings method. If there is no allowed
 	 * settings for the given section. The user will be greeted by an error message.
 	 */
+	#[NoSubAdminRequired]
 	#[NoAdminRequired]
 	#[NoCSRFRequired]
 	public function index(string $section): TemplateResponse {