[Feature Request] Sharing passwords grouped by tags/folders with multiple users/groups.

Feature request

User type: Logged-in
User level: Beginners

Description

Being able to share a list of passwords with a group of users would be very convenient for teams.

Several feature requests have been opened in the past to enhance sharing a group of passwords: #272, #340 and #243, to name a few. The use case is clear: having shared passwords with group of users. Some people like the way LastPass does it (you create "directories" of passwords and then share the directory).

I understand that sharing passwords with a nextcloud group of users seems non doable, because the way Passman is storing vaults and passwords. My proposal is to create a separated vault for each group of passwords that have to be shared, and to share the master key with users and groups. As groups don't have a public/private key pair for sharing, sharing with a group involves tracking which users are in a group and launch actions in the group membership changes.

New behaviour:

• after installing/activating Passman, all users must be forced to create a personal vault. This has to be done as a post-login hook. Without this, sharing to groups can be a real nightmare.

They way I see this group sharing is:

• a user creates a shared group of passwords and gives it a name. This makes Passman create a new vault ("shared vault", or SV), encrypted with a random password (SVP).
• the random password (SVP) is stored in the owner's vault, with a referece to the SV it opens.
• Passman must hide the fact that the SV is a different vault, showing it as a folder or an special tag to the user. This has to be replicated in all the interfaces.
• When the owner shares the vault, either to a user or a group, the vault master password is shared, and access to the vault itself is allowed too.
• Sharing to a group makes Passman generate a share notification for each member of the group.
• In the case a user gets a share notification but has no vault, he gets a request to create his personal vault. Once this is done, the SV owner gets a request to re-share the SV
• When a new user is added to a group that shares an SV, the SV owner gets a notification and must re-share the SV to get all users updated.
• When a user is deleted from a group, the master key for the SV must be regenerated and sent to all the members of the group, to make sure the excluded user is not able to open the SV again. A notification is sent to the SV owner to do so. This must be as automatic as possible.
• Passman must keep track of which users/group should access what SVs, and hide SVs from users when needed and launch the appropriated notifications/requests to the users.

Benefit / value

Being able to use vaults shared with a group of users will greatly enhance team's workflow

Risk / caveats

It requires significant work, not only in the server side but also in plugins and mobile interfaces.

Sponsorship

I will set a bounty if this feature request is accepted.

Are you a developer willing to implement this feature?: no

Can you sponsor the development of this feature or do you know someone who can?: yes

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Begin with the feature description and related requests #272, #340, and #243; no implementation files or tests are identified in the issue. Define the server, plugin, and mobile-interface work needed for grouped vault sharing, membership changes, notifications, and key updates before implementation can be considered complete.