Enforce that only the requested user can see the request

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Feature request

Which Nextcloud Version are you currently using: 31

Is your feature request related to a problem? Please describe.
When automating processes with Flow, it's sometimes necessary to get an approval by certain people. Right now, it's not possible to enforce that only a certain user can approve or disapprove.

Describe the solution you'd like
Introduce a new optional parameter to the create link endpoint, which takes a username. If a different person then the entered user opens the link, an error is shown like "You are not permitted to approve or disapprove this request". No more details should be shown (data protection -> e.g. it could be possible to automate HR processes)

Describe alternatives you've considered
Hiding the link is possible in theory, but since there's no feedback who accepted the request to the callback URIs, theoretically everyone could have approved the request.

Another alternative is getting the approval through a document, which is safer at the moment. But this creates basically useless documents, if you're only working with Tables e.g.

Additional context
Right now I'm trying to build a workflow for requesting new hardware like laptops and smartphones. This typically needs to be approved either by HR or by the head of IT. By storing the approval link in a Table, which I use to track the requests, theoretically everyone with access to that table can approve the request and there's no protocol who did it.

Start at the create link endpoint and trace how its username parameter and approval link are handled, including the callback URIs. Done means an optional username can restrict approval or rejection to that user, while other visitors receive only the specified permission error without request details.