Graph permissions for drives are not appropriate
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 103
Description
The [graph permissions](https://github.com/owncloud/libre-graph-api/blob/main/api/openapi-spec/v1.0.yaml#L1578) are not appropriate (or simply missing some) when dealing with drive resources. Apparently Reva is checking for the `RemoveGrant` permission to indicate whether the user is a space admin, which is bad implicit behavior (see https://github.com/cs3org/reva/blob/edge/pkg/storage/utils/decomposedfs/permissions/spacepermissions.go#L146). And since we're transitioning to permission checks in clients, we would need to do the same there as well.
I don't know how a proper solution would look like, I'll leave that open to others. But from a client perspective I would ~~imagine~~ expect that there are dedicated graph permissions for e.g. updating drives, deleting drives etc.
Contributor guide
Assessment
This issue has not been assessed yet.