owncloud / owncloud/ocis

Graph permissions for drives are not appropriate

Open
#9,862 0 comments 1 reaction 0 assignees View on GitHub
Priority:p2-high Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

The [graph permissions](https://github.com/owncloud/libre-graph-api/blob/main/api/openapi-spec/v1.0.yaml#L1578) are not appropriate (or simply missing some) when dealing with drive resources. Apparently Reva is checking for the `RemoveGrant` permission to indicate whether the user is a space admin, which is bad implicit behavior (see https://github.com/cs3org/reva/blob/edge/pkg/storage/utils/decomposedfs/permissions/spacepermissions.go#L146). And since we're transitioning to permission checks in clients, we would need to do the same there as well.

I don't know how a proper solution would look like, I'll leave that open to others. But from a client perspective I would ~~imagine~~ expect that there are dedicated graph permissions for e.g. updating drives, deleting drives etc.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.