Skip to content

feat: add API to restrict permissions on resources of other apps #66546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
susnux wants to merge 4 commits into from
Open

feat: add API to restrict permissions on resources of other apps #66546

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3f0b852
feat: add API to restrict permissions on resources of other apps
susnux Nov 12, 2026
20fb77b
fix: harden the resource permission check
susnux Nov 12, 2026
851f593
refactor: share the common parts of the core resource permissions
susnux Nov 12, 2026
015850c
refactor: allow checking core permissions on effective permissions di…
susnux Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions core/AppInfo/Application.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,12 @@
use OC\Core\Listener\PasswordUpdatedListener;
use OC\Core\Listener\RestrictInteractionListener;
use OC\Core\Notification\CoreNotifier;
use OC\Core\Resource\Permission\CreatePermission;
use OC\Core\Resource\Permission\DeletePermission;
use OC\Core\Resource\Permission\DownloadPermission;
use OC\Core\Resource\Permission\ReadPermission;
use OC\Core\Resource\Permission\SharePermission;
use OC\Core\Resource\Permission\UpdatePermission;
use OC\Core\Sharing\Permission\EditSharePermissionPreset;
use OC\Core\Sharing\Permission\ReshareSharePermissionType;
use OC\Core\Sharing\Permission\ViewSharePermissionPreset;
Expand Down Expand Up @@ -89,6 +95,13 @@ public function register(IRegistrationContext $context): void {
return Util::getDefaultEmailAddress('lostpassword-noreply');
});

$context->registerResourcePermission(ReadPermission::class);
$context->registerResourcePermission(DownloadPermission::class);
$context->registerResourcePermission(UpdatePermission::class);
$context->registerResourcePermission(CreatePermission::class);
$context->registerResourcePermission(DeletePermission::class);
$context->registerResourcePermission(SharePermission::class);

// register notifier
$context->registerNotifierService(CoreNotifier::class);
$context->registerNotifierService(AuthenticationNotifier::class);
Expand Down
37 changes: 37 additions & 0 deletions core/Resource/Permission/ACorePermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;
use NCU\Resource\Permission\IPermission;
use OC\Core\AppInfo\Application;
use OCP\IL10N;
use OCP\L10N\IFactory;

abstract class ACorePermission implements IPermission {
public function __construct(
private readonly IFactory $l10nFactory,
) {
}

protected function getL10N(): IL10N {
return $this->l10nFactory->get(Application::APP_ID);
}

#[\Override]
public function getHint(): ?string {
return null;
}

#[\Override]
public function getKindOf(): ?CorePermission {
return null;
}
}
24 changes: 24 additions & 0 deletions core/Resource/Permission/CreatePermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class CreatePermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::Create->value;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('Create');
}
}
24 changes: 24 additions & 0 deletions core/Resource/Permission/DeletePermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class DeletePermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::Delete->value;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('Delete');
}
}
29 changes: 29 additions & 0 deletions core/Resource/Permission/DownloadPermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class DownloadPermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::DOWNLOAD;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('Download');
}

#[\Override]
public function getKindOf(): ?CorePermission {
return CorePermission::Read;
}
}
24 changes: 24 additions & 0 deletions core/Resource/Permission/ReadPermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class ReadPermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::Read->value;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('View');
}
}
24 changes: 24 additions & 0 deletions core/Resource/Permission/SharePermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class SharePermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::Share->value;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('Share');
}
}
24 changes: 24 additions & 0 deletions core/Resource/Permission/UpdatePermission.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

declare(strict_types=1);

namespace OC\Core\Resource\Permission;

use NCU\Resource\Permission\CorePermission;

final class UpdatePermission extends ACorePermission {
#[\Override]
public function getId(): string {
return CorePermission::Update->value;
}

#[\Override]
public function getDisplayName(): string {
return $this->getL10N()->t('Edit');
}
}
19 changes: 19 additions & 0 deletions lib/composer/composer/autoload_classmap.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,17 @@
'NCU\\Config\\Lexicon\\Preset' => $baseDir . '/lib/unstable/Config/Lexicon/Preset.php',
'NCU\\Config\\ValueType' => $baseDir . '/lib/unstable/Config/ValueType.php',
'NCU\\Federation\\ISignedCloudFederationProvider' => $baseDir . '/lib/unstable/Federation/ISignedCloudFederationProvider.php',
'NCU\\Resource\\IResourceType' => $baseDir . '/lib/unstable/Resource/IResourceType.php',
'NCU\\Resource\\Permission\\APermission' => $baseDir . '/lib/unstable/Resource/Permission/APermission.php',
'NCU\\Resource\\Permission\\AccessEntry' => $baseDir . '/lib/unstable/Resource/Permission/AccessEntry.php',
'NCU\\Resource\\Permission\\CorePermission' => $baseDir . '/lib/unstable/Resource/Permission/CorePermission.php',
'NCU\\Resource\\Permission\\EffectivePermissions' => $baseDir . '/lib/unstable/Resource/Permission/EffectivePermissions.php',
'NCU\\Resource\\Permission\\IPermission' => $baseDir . '/lib/unstable/Resource/Permission/IPermission.php',
'NCU\\Resource\\Permission\\IPermissionManager' => $baseDir . '/lib/unstable/Resource/Permission/IPermissionManager.php',
'NCU\\Resource\\Permission\\IRestrictionProvider' => $baseDir . '/lib/unstable/Resource/Permission/IRestrictionProvider.php',
'NCU\\Resource\\Permission\\ResourceAccess' => $baseDir . '/lib/unstable/Resource/Permission/ResourceAccess.php',
'NCU\\Resource\\Permission\\Restriction' => $baseDir . '/lib/unstable/Resource/Permission/Restriction.php',
'NCU\\Resource\\ResourceReference' => $baseDir . '/lib/unstable/Resource/ResourceReference.php',
'NCU\\Search\\AccountScopedSearchResult' => $baseDir . '/lib/unstable/Search/AccountScopedSearchResult.php',
'NCU\\Search\\Exceptions\\AccountUnavailableException' => $baseDir . '/lib/unstable/Search/Exceptions/AccountUnavailableException.php',
'NCU\\Search\\Exceptions\\SearchTruncatedException' => $baseDir . '/lib/unstable/Search/Exceptions/SearchTruncatedException.php',
Expand Down Expand Up @@ -1772,6 +1783,13 @@
'OC\\Core\\Migrations\\Version35000Date20260527162338' => $baseDir . '/core/Migrations/Version35000Date20260527162338.php',
'OC\\Core\\Migrations\\Version36000Date20261028100000' => $baseDir . '/core/Migrations/Version36000Date20261028100000.php',
'OC\\Core\\Notification\\CoreNotifier' => $baseDir . '/core/Notification/CoreNotifier.php',
'OC\\Core\\Resource\\Permission\\ACorePermission' => $baseDir . '/core/Resource/Permission/ACorePermission.php',
'OC\\Core\\Resource\\Permission\\CreatePermission' => $baseDir . '/core/Resource/Permission/CreatePermission.php',
'OC\\Core\\Resource\\Permission\\DeletePermission' => $baseDir . '/core/Resource/Permission/DeletePermission.php',
'OC\\Core\\Resource\\Permission\\DownloadPermission' => $baseDir . '/core/Resource/Permission/DownloadPermission.php',
'OC\\Core\\Resource\\Permission\\ReadPermission' => $baseDir . '/core/Resource/Permission/ReadPermission.php',
'OC\\Core\\Resource\\Permission\\SharePermission' => $baseDir . '/core/Resource/Permission/SharePermission.php',
'OC\\Core\\Resource\\Permission\\UpdatePermission' => $baseDir . '/core/Resource/Permission/UpdatePermission.php',
'OC\\Core\\ResponseDefinitions' => $baseDir . '/core/ResponseDefinitions.php',
'OC\\Core\\Service\\CronService' => $baseDir . '/core/Service/CronService.php',
'OC\\Core\\Service\\LoginFlowV2Service' => $baseDir . '/core/Service/LoginFlowV2Service.php',
Expand Down Expand Up @@ -2299,6 +2317,7 @@
'OC\\Repair\\RepairLogoDimension' => $baseDir . '/lib/private/Repair/RepairLogoDimension.php',
'OC\\Repair\\RepairMimeTypes' => $baseDir . '/lib/private/Repair/RepairMimeTypes.php',
'OC\\Repair\\RepairSanitizeSystemTags' => $baseDir . '/lib/private/Repair/RepairSanitizeSystemTags.php',
'OC\\Resource\\Permission\\PermissionManager' => $baseDir . '/lib/private/Resource/Permission/PermissionManager.php',
'OC\\RichObjectStrings\\RichTextFormatter' => $baseDir . '/lib/private/RichObjectStrings/RichTextFormatter.php',
'OC\\RichObjectStrings\\Validator' => $baseDir . '/lib/private/RichObjectStrings/Validator.php',
'OC\\Route\\CachingRouter' => $baseDir . '/lib/private/Route/CachingRouter.php',
Expand Down
19 changes: 19 additions & 0 deletions lib/composer/composer/autoload_static.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,17 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
'NCU\\Config\\Lexicon\\Preset' => __DIR__ . '/../../..' . '/lib/unstable/Config/Lexicon/Preset.php',
'NCU\\Config\\ValueType' => __DIR__ . '/../../..' . '/lib/unstable/Config/ValueType.php',
'NCU\\Federation\\ISignedCloudFederationProvider' => __DIR__ . '/../../..' . '/lib/unstable/Federation/ISignedCloudFederationProvider.php',
'NCU\\Resource\\IResourceType' => __DIR__ . '/../../..' . '/lib/unstable/Resource/IResourceType.php',
'NCU\\Resource\\Permission\\APermission' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/APermission.php',
'NCU\\Resource\\Permission\\AccessEntry' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/AccessEntry.php',
'NCU\\Resource\\Permission\\CorePermission' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/CorePermission.php',
'NCU\\Resource\\Permission\\EffectivePermissions' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/EffectivePermissions.php',
'NCU\\Resource\\Permission\\IPermission' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/IPermission.php',
'NCU\\Resource\\Permission\\IPermissionManager' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/IPermissionManager.php',
'NCU\\Resource\\Permission\\IRestrictionProvider' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/IRestrictionProvider.php',
'NCU\\Resource\\Permission\\ResourceAccess' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/ResourceAccess.php',
'NCU\\Resource\\Permission\\Restriction' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/Restriction.php',
'NCU\\Resource\\ResourceReference' => __DIR__ . '/../../..' . '/lib/unstable/Resource/ResourceReference.php',
'NCU\\Search\\AccountScopedSearchResult' => __DIR__ . '/../../..' . '/lib/unstable/Search/AccountScopedSearchResult.php',
'NCU\\Search\\Exceptions\\AccountUnavailableException' => __DIR__ . '/../../..' . '/lib/unstable/Search/Exceptions/AccountUnavailableException.php',
'NCU\\Search\\Exceptions\\SearchTruncatedException' => __DIR__ . '/../../..' . '/lib/unstable/Search/Exceptions/SearchTruncatedException.php',
Expand Down Expand Up @@ -1813,6 +1824,13 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
'OC\\Core\\Migrations\\Version35000Date20260527162338' => __DIR__ . '/../../..' . '/core/Migrations/Version35000Date20260527162338.php',
'OC\\Core\\Migrations\\Version36000Date20261028100000' => __DIR__ . '/../../..' . '/core/Migrations/Version36000Date20261028100000.php',
'OC\\Core\\Notification\\CoreNotifier' => __DIR__ . '/../../..' . '/core/Notification/CoreNotifier.php',
'OC\\Core\\Resource\\Permission\\ACorePermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/ACorePermission.php',
'OC\\Core\\Resource\\Permission\\CreatePermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/CreatePermission.php',
'OC\\Core\\Resource\\Permission\\DeletePermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/DeletePermission.php',
'OC\\Core\\Resource\\Permission\\DownloadPermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/DownloadPermission.php',
'OC\\Core\\Resource\\Permission\\ReadPermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/ReadPermission.php',
'OC\\Core\\Resource\\Permission\\SharePermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/SharePermission.php',
'OC\\Core\\Resource\\Permission\\UpdatePermission' => __DIR__ . '/../../..' . '/core/Resource/Permission/UpdatePermission.php',
'OC\\Core\\ResponseDefinitions' => __DIR__ . '/../../..' . '/core/ResponseDefinitions.php',
'OC\\Core\\Service\\CronService' => __DIR__ . '/../../..' . '/core/Service/CronService.php',
'OC\\Core\\Service\\LoginFlowV2Service' => __DIR__ . '/../../..' . '/core/Service/LoginFlowV2Service.php',
Expand Down Expand Up @@ -2340,6 +2358,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
'OC\\Repair\\RepairLogoDimension' => __DIR__ . '/../../..' . '/lib/private/Repair/RepairLogoDimension.php',
'OC\\Repair\\RepairMimeTypes' => __DIR__ . '/../../..' . '/lib/private/Repair/RepairMimeTypes.php',
'OC\\Repair\\RepairSanitizeSystemTags' => __DIR__ . '/../../..' . '/lib/private/Repair/RepairSanitizeSystemTags.php',
'OC\\Resource\\Permission\\PermissionManager' => __DIR__ . '/../../..' . '/lib/private/Resource/Permission/PermissionManager.php',
'OC\\RichObjectStrings\\RichTextFormatter' => __DIR__ . '/../../..' . '/lib/private/RichObjectStrings/RichTextFormatter.php',
'OC\\RichObjectStrings\\Validator' => __DIR__ . '/../../..' . '/lib/private/RichObjectStrings/Validator.php',
'OC\\Route\\CachingRouter' => __DIR__ . '/../../..' . '/lib/private/Route/CachingRouter.php',
Expand Down
Loading
Loading