Merge pull request #6391 from kobergj/RenamePermissions

[full-ci] Rename Permissions

.drone.star

@@ -148,7 +148,7 @@ config = {
         "earlyFail": True,
     },
     "e2eTests": {
-        "skip": False,
+        "skip": True,
         "earlyFail": True,
     },
     "rocketchat": {

changelog/unreleased/rename-permissions.md

@@ -0,0 +1,5 @@
+Enhancement: Rename permissions
+
+Rename permissions to be consistent and future proof
+
+https://github.com/cs3org/reva/pull/3922

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.6.0
 	github.com/cs3org/go-cs3apis v0.0.0-20230516150832-730ac860c71d
-	github.com/cs3org/reva/v2 v2.13.4-0.20230526111208-d62d1497abb9
+	github.com/cs3org/reva/v2 v2.13.4-0.20230531095732-bc9a3b635ec3
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1

go.sum

@@ -629,8 +629,8 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc=
 github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA=
-github.com/cs3org/reva/v2 v2.13.4-0.20230526111208-d62d1497abb9 h1:JuZPMzFl6Yr2PIlT7mIYJ+S++AS3PQoRcYyA1tsH2DI=
+github.com/cs3org/reva/v2 v2.13.4-0.20230531095732-bc9a3b635ec3 h1:T+W3zPmlPAaHlKhzBcW809PvcGUJJ+v1QF+JzdPRegU=
-github.com/cs3org/reva/v2 v2.13.4-0.20230526111208-d62d1497abb9/go.mod h1:vMQqSn30fEPHO/GKC2WmGimlOPqvfSy4gdhRSpbvrWc=
+github.com/cs3org/reva/v2 v2.13.4-0.20230531095732-bc9a3b635ec3/go.mod h1:vMQqSn30fEPHO/GKC2WmGimlOPqvfSy4gdhRSpbvrWc=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=

services/settings/pkg/store/defaults/defaults.go

@@ -21,17 +21,17 @@ const (
 	// RoleManagementPermissionID is the hardcoded setting UUID for the role management permission
 	RoleManagementPermissionID string = "a53e601e-571f-4f86-8fec-d4576ef49c62"
 	// RoleManagementPermissionName is the hardcoded setting name for the role management permission
-	RoleManagementPermissionName string = "role-management"
+	RoleManagementPermissionName string = "Roles.ReadWrite"
 
 	// SettingsManagementPermissionID is the hardcoded setting UUID for the settings management permission
 	SettingsManagementPermissionID string = "3d58f441-4a05-42f8-9411-ef5874528ae1"
 	// SettingsManagementPermissionName is the hardcoded setting name for the settings management permission
-	SettingsManagementPermissionName string = "settings-management"
+	SettingsManagementPermissionName string = "Settings.ReadWrite"
 
-	// LanguageReadWriteID is the hardcoded setting UUID for the language read write permission
+	// LanguageReadWriteID is the hardcoded setting UUID for the language read write all permission
 	LanguageReadWriteID string = "7d81f103-0488-4853-bce5-98dcce36d649"
-	// LanguageReadWriteName is the hardcoded setting name for the language read write permission
+	// LanguageReadWriteName is the hardcoded setting name for the language read write all permission
-	LanguageReadWriteName string = "language-readwrite"
+	LanguageReadWriteName string = "Language.ReadWrite"
 
 	// DisableEmailNotificationsPermissionID is the hardcoded setting UUID for the disable email notifications permission
 	DisableEmailNotificationsPermissionID string = "ad5bb5e5-dc13-4cd3-9304-09a424564ea8"
@@ -43,42 +43,42 @@ const (
 	// SetPersonalSpaceQuotaPermissionID is the hardcoded setting UUID for the set personal space quota permission
 	SetPersonalSpaceQuotaPermissionID string = "4e6f9709-f9e7-44f1-95d4-b762d27b7896"
 	// SetPersonalSpaceQuotaPermissionName is the hardcoded setting name for the set personal space quota permission
-	SetPersonalSpaceQuotaPermissionName string = "set-space-quota"
+	SetPersonalSpaceQuotaPermissionName string = "Drives.ReadWritePersonalQuota"
 
 	// SetProjectSpaceQuotaPermissionID is the hardcoded setting UUID for the set project space quota permission
 	SetProjectSpaceQuotaPermissionID string = "977f0ae6-0da2-4856-93f3-22e0a8482489"
 	// SetProjectSpaceQuotaPermissionName is the hardcoded setting name for the set project space quota permission
-	SetProjectSpaceQuotaPermissionName string = "Drive.ReadWriteQuota.Project"
+	SetProjectSpaceQuotaPermissionName string = "Drives.ReadWriteProjectQuota"
 
 	// ListAllSpacesPermissionID is the hardcoded setting UUID for the list all spaces permission
 	ListAllSpacesPermissionID string = "016f6ddd-9501-4a0a-8ebe-64a20ee8ec82"
 	// ListAllSpacesPermissionName is the hardcoded setting name for the list all spaces permission
-	ListAllSpacesPermissionName string = "list-all-spaces"
+	ListAllSpacesPermissionName string = "Drives.List"
 
 	// CreateSpacePermissionID is the hardcoded setting UUID for the create space permission
 	CreateSpacePermissionID string = "79e13b30-3e22-11eb-bc51-0b9f0bad9a58"
 	// CreateSpacePermissionName is the hardcoded setting name for the create space permission
-	CreateSpacePermissionName string = "create-space"
+	CreateSpacePermissionName string = "Drives.Create"
 
 	// DeleteHomeSpacesPermissionID is the hardcoded setting UUID for the delete home space permission
 	DeleteHomeSpacesPermissionID string = "5de9fe0a-4bc5-4a47-b758-28f370caf169"
 	// DeleteHomeSpacesPermissionName is the hardcoded setting name for the delete home space permission
-	DeleteHomeSpacesPermissionName string = "delete-all-home-spaces"
+	DeleteHomeSpacesPermissionName string = "Drives.DeletePersonal"
 
 	// DeleteAllSpacesPermissionID is the hardcoded setting UUID for the delete all spaces permission
 	DeleteAllSpacesPermissionID string = "fb60b004-c1fa-4f09-bf87-55ce7d46ac61"
 	// DeleteAllSpacesPermissionName is the hardcoded setting name for the delete all space permission
-	DeleteAllSpacesPermissionName string = "delete-all-spaces"
+	DeleteAllSpacesPermissionName string = "Drives.DeleteProject"
 
 	// ManageSpacePropertiesPermissionID is the hardcoded setting UUID for the manage space properties permission
 	ManageSpacePropertiesPermissionID string = "b44b4054-31a2-42b8-bb71-968b15cfbd4f"
 	// ManageSpacePropertiesPermissionName is the hardcoded setting name for the manage space properties permission
-	ManageSpacePropertiesPermissionName string = "Drive.ReadWrite"
+	ManageSpacePropertiesPermissionName string = "Drives.ReadWrite"
 
 	// SpaceAbilityPermissionID is the hardcoded setting UUID for the space ability permission
 	SpaceAbilityPermissionID string = "cf3faa8c-50d9-4f84-9650-ff9faf21aa9d"
 	// SpaceAbilityPermissionName is the hardcoded setting name for the space ability permission
-	SpaceAbilityPermissionName string = "Drive.ReadWriteEnabled"
+	SpaceAbilityPermissionName string = "Drives.ReadWriteEnabled"
 
 	// SettingUUIDProfileLanguage is the hardcoded setting UUID for the user profile language
 	SettingUUIDProfileLanguage = "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f"
@@ -88,20 +88,20 @@ const (
 	// AccountManagementPermissionID is the hardcoded setting UUID for the account management permission
 	AccountManagementPermissionID string = "8e587774-d929-4215-910b-a317b1e80f73"
 	// AccountManagementPermissionName is the hardcoded setting name for the account management permission
-	AccountManagementPermissionName string = "account-management"
+	AccountManagementPermissionName string = "Accounts.ReadWrite"
 	// GroupManagementPermissionID is the hardcoded setting UUID for the group management permission
 	GroupManagementPermissionID string = "522adfbe-5908-45b4-b135-41979de73245"
 	// GroupManagementPermissionName is the hardcoded setting name for the group management permission
-	GroupManagementPermissionName string = "group-management"
+	GroupManagementPermissionName string = "Groups.ReadWrite"
 	// SelfManagementPermissionID is the hardcoded setting UUID for the self management permission
 	SelfManagementPermissionID string = "e03070e9-4362-4cc6-a872-1c7cb2eb2b8e"
 	// SelfManagementPermissionName is the hardcoded setting name for the self management permission
-	SelfManagementPermissionName string = "self-management"
+	SelfManagementPermissionName string = "Self.ReadWrite"
 
 	// ChangeLogoPermissionID is the hardcoded setting UUID for the change-logo permission
 	ChangeLogoPermissionID string = "ed83fc10-1f54-4a9e-b5a7-fb517f5f3e01"
 	// ChangeLogoPermissionName is the hardcoded setting name for the change-logo permission
-	ChangeLogoPermissionName string = "change-logo"
+	ChangeLogoPermissionName string = "Logo.Write"
 
 	// WritePublicLinkPermissionID is the hardcoded setting UUID for the PublicLink.Write permission
 	WritePublicLinkPermissionID string = "11516bbd-7157-49e1-b6ac-d00c820f980b"
@@ -481,8 +481,8 @@ func generateBundleSpaceAdminRole() *settingsmsg.Bundle {
 				},
 			},
 			{
-				Id:          "640e00d2-4df8-41bd-b1c2-9f30a01e0e99",
+				Id:          LanguageReadWriteID,
-				Name:        "language-readwrite",
+				Name:        LanguageReadWriteName,
 				DisplayName: "Permission to read and set the language (self)",
 				Resource: &settingsmsg.Resource{
 					Type: settingsmsg.Resource_TYPE_SETTING,
@@ -572,8 +572,8 @@ func generateBundleUserRole() *settingsmsg.Bundle {
 		},
 		Settings: []*settingsmsg.Setting{
 			{
-				Id:          "640e00d2-4df8-41bd-b1c2-9f30a01e0e99",
+				Id:          LanguageReadWriteID,
-				Name:        "language-readwrite",
+				Name:        LanguageReadWriteName,
 				DisplayName: "Permission to read and set the language (self)",
 				Resource: &settingsmsg.Resource{
 					Type: settingsmsg.Resource_TYPE_SETTING,
@@ -663,8 +663,8 @@ func generateBundleGuestRole() *settingsmsg.Bundle {
 		},
 		Settings: []*settingsmsg.Setting{
 			{
-				Id:          "ca878636-8b1a-4fae-8282-8617a4c13597",
+				Id:          LanguageReadWriteID,
-				Name:        "language-readwrite",
+				Name:        LanguageReadWriteName,
 				DisplayName: "Permission to read and set the language (self)",
 				Resource: &settingsmsg.Resource{
 					Type: settingsmsg.Resource_TYPE_SETTING,

vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/spaces.go

@@ -125,6 +125,33 @@ func (h *Handler) addSpaceMember(w http.ResponseWriter, r *http.Request, info *p
 			Nanos:   uint32(expiration.UnixNano() % int64(time.Second)),
 		}
 	}
+
+	if role.Name != conversions.RoleManager {
+		ref := provider.Reference{ResourceId: info.GetId()}
+		p, err := h.findProvider(ctx, &ref)
+		if err != nil {
+			response.WriteOCSError(w, r, response.MetaNotFound.StatusCode, "error getting storage provider", err)
+			return
+		}
+
+		providerClient, err := h.getStorageProviderClient(p)
+		if err != nil {
+			response.WriteOCSError(w, r, response.MetaNotFound.StatusCode, "error getting storage provider client", err)
+			return
+		}
+
+		lgRes, err := providerClient.ListGrants(ctx, &provider.ListGrantsRequest{Ref: &ref})
+		if err != nil || lgRes.Status.Code != rpc.Code_CODE_OK {
+			response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "error listing space grants", err)
+			return
+		}
+
+		if !isSpaceManagerRemaining(lgRes.Grants, grantee) {
+			response.WriteOCSError(w, r, http.StatusForbidden, "the space must have at least one manager", nil)
+			return
+		}
+	}
+
 	createShareRes, err := client.CreateShare(ctx, &collaborationv1beta1.CreateShareRequest{
 		ResourceInfo: info,
 		Grant: &collaborationv1beta1.ShareGrant{

vendor/github.com/cs3org/reva/v2/pkg/permission/permission.go

@@ -24,9 +24,9 @@ import (
 
 const (
 	// ListAllSpaces is the hardcoded name for the list all spaces permission
-	ListAllSpaces string = "list-all-spaces"
+	ListAllSpaces string = "Drives.List"
 	// CreateSpace is the hardcoded name for the create space permission
-	CreateSpace string = "create-space"
+	CreateSpace string = "Drives.Create"
 	// WritePublicLink is the hardcoded name for the PublicLink.Write permission
 	WritePublicLink string = "PublicLink.Write"
 )

vendor/github.com/cs3org/reva/v2/pkg/storage/utils/decomposedfs/spacepermissions.go

@@ -41,7 +41,7 @@ func (p Permissions) AssemblePermissions(ctx context.Context, n *node.Node) (pro
 
 // CreateSpace returns true when the user is allowed to create the space
 func (p Permissions) CreateSpace(ctx context.Context, spaceid string) bool {
-	return p.checkPermission(ctx, "create-space", spaceRef(spaceid))
+	return p.checkPermission(ctx, "Drives.Create", spaceRef(spaceid))
 }
 
 // SetSpaceQuota returns true when the user is allowed to change the spaces quota
@@ -50,25 +50,25 @@ func (p Permissions) SetSpaceQuota(ctx context.Context, spaceid string, spaceTyp
 	default:
 		return false // only quotas of personal and project space may be changed
 	case _spaceTypePersonal:
-		return p.checkPermission(ctx, "set-space-quota", spaceRef(spaceid))
+		return p.checkPermission(ctx, "Drives.ReadWritePersonalQuota", spaceRef(spaceid))
 	case _spaceTypeProject:
-		return p.checkPermission(ctx, "Drive.ReadWriteQuota.Project", spaceRef(spaceid))
+		return p.checkPermission(ctx, "Drives.ReadWriteProjectQuota", spaceRef(spaceid))
 	}
 }
 
 // ManageSpaceProperties returns true when the user is allowed to change space properties (name/subtitle)
 func (p Permissions) ManageSpaceProperties(ctx context.Context, spaceid string) bool {
-	return p.checkPermission(ctx, "Drive.ReadWrite", spaceRef(spaceid))
+	return p.checkPermission(ctx, "Drives.ReadWrite", spaceRef(spaceid))
 }
 
 // SpaceAbility returns true when the user is allowed to enable/disable the space
 func (p Permissions) SpaceAbility(ctx context.Context, spaceid string) bool {
-	return p.checkPermission(ctx, "Drive.ReadWriteEnabled", spaceRef(spaceid))
+	return p.checkPermission(ctx, "Drives.ReadWriteEnabled", spaceRef(spaceid))
 }
 
 // ListAllSpaces returns true when the user is allowed to list all spaces
 func (p Permissions) ListAllSpaces(ctx context.Context) bool {
-	return p.checkPermission(ctx, "list-all-spaces", nil)
+	return p.checkPermission(ctx, "Drives.List", nil)
 }
 
 // ListSpacesOfUser returns true when the user is allowed to list the spaces of the given user
@@ -86,12 +86,12 @@ func (p Permissions) ListSpacesOfUser(ctx context.Context, userid *userv1beta1.U
 
 // DeleteAllSpaces returns true when the user is allowed to delete all spaces
 func (p Permissions) DeleteAllSpaces(ctx context.Context) bool {
-	return p.checkPermission(ctx, "delete-all-spaces", nil)
+	return p.checkPermission(ctx, "Drives.DeleteProject", nil)
 }
 
 // DeleteAllHomeSpaces returns true when the user is allowed to delete all home spaces
 func (p Permissions) DeleteAllHomeSpaces(ctx context.Context) bool {
-	return p.checkPermission(ctx, "delete-all-home-spaces", nil)
+	return p.checkPermission(ctx, "Drives.DeletePersonal", nil)
 }
 
 // checkPermission is used to check a users space permissions

vendor/modules.txt

@@ -352,7 +352,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.13.4-0.20230526111208-d62d1497abb9
+# github.com/cs3org/reva/v2 v2.13.4-0.20230531095732-bc9a3b635ec3
 ## explicit; go 1.19
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime