allow querying federated sharing roles

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

services/graph/pkg/service/v0/api_driveitem_permissions.go

@@ -46,7 +46,7 @@ const (
 type DriveItemPermissionsProvider interface {
 	Invite(ctx context.Context, resourceId *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error)
 	SpaceRootInvite(ctx context.Context, driveID *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error)
-	ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
+	ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
 	ListSpaceRootPermissions(ctx context.Context, driveID *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error)
 	DeletePermission(ctx context.Context, itemID *storageprovider.ResourceId, permissionID string) error
 	DeleteSpaceRootPermission(ctx context.Context, driveID *storageprovider.ResourceId, permissionID string) error
@@ -283,7 +283,7 @@ func createShareRequestToFederatedUser(user libregraph.User, resourceId *storage
 			Id: &storageprovider.Grantee_UserId{UserId: &userpb.UserId{
 				Type:     userpb.UserType_USER_TYPE_FEDERATED,
 				OpaqueId: user.GetId(),
-				Idp:      providerInfo.Domain, // the domain is persisted in the grant as u:{opaqueid}:{domain}
+				Idp:      *user.GetIdentities()[0].Issuer, // the domain is persisted in the grant as u:{opaqueid}:{domain}
 			}},
 		},
 		RecipientMeshProvider: providerInfo,
@@ -320,7 +320,7 @@ func (s DriveItemPermissionsService) SpaceRootInvite(ctx context.Context, driveI
 }
 
 // ListPermissions lists the permissions of a driveItem
-func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID *storageprovider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
 	collectionOfPermissions := libregraph.CollectionOfPermissionsWithAllowedValues{}
 	gatewayClient, err := s.gatewaySelector.Next()
 	if err != nil {
@@ -347,6 +347,7 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 			unifiedrole.GetApplicableRoleDefinitionsForActions(
 				allowedActions,
 				condition,
+				listFederatedRoles,
 				false,
 			),
 		),
@@ -358,6 +359,13 @@ func (s DriveItemPermissionsService) ListPermissions(ctx context.Context, itemID
 		collectionOfPermissions.LibreGraphPermissionsRolesAllowedValues[i] = definition
 	}
 
+	if selectRoles {
+		// drop the actions
+		collectionOfPermissions.LibreGraphPermissionsActionsAllowedValues = nil
+		// no need to fetch shares, we are only interested in the roles
+		return collectionOfPermissions, nil
+	}
+
 	driveItems := make(driveItemsByResourceID)
 	if IsSpaceRoot(statResponse.GetInfo().GetId()) {
 		permissions, err := s.getSpaceRootPermissions(ctx, statResponse.GetInfo().GetSpace().GetId())
@@ -408,7 +416,7 @@ func (s DriveItemPermissionsService) ListSpaceRootPermissions(ctx context.Contex
 	}
 
 	rootResourceID := space.GetRoot()
-	return s.ListPermissions(ctx, rootResourceID)
+	return s.ListPermissions(ctx, rootResourceID, false, false) // federated roles are not supported for spaces
 }
 
 // DeletePermission deletes a permission from a drive item
@@ -626,9 +634,19 @@ func (api DriveItemPermissionsApi) ListPermissions(w http.ResponseWriter, r *htt
 		return
 	}
 
+	var listFederatedRoles bool
+	if GetFilterParam(r) == "@libre.graph.permissions.roles.allowedValues/rolePermissions/any(p:contains(p/condition, '@Subject.UserType==\"Federated\"'))" {
+		listFederatedRoles = true
+	}
+
+	var selectRoles bool
+	if GetSelectParam(r) == "@libre.graph.permissions.roles.allowedValues" {
+		selectRoles = true
+	}
+
 	ctx := r.Context()
 
-	permissions, err := api.driveItemPermissionsService.ListPermissions(ctx, &itemID)
+	permissions, err := api.driveItemPermissionsService.ListPermissions(ctx, &itemID, listFederatedRoles, selectRoles)
 	if err != nil {
 		errorcode.RenderError(w, r, err)
 		return

services/graph/pkg/service/v0/api_driveitem_permissions_test.go

@@ -15,7 +15,6 @@ import (
 	collaboration "github.com/cs3org/go-cs3apis/cs3/sharing/collaboration/v1beta1"
 	link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
@@ -367,7 +366,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(statResponse, nil)
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID)
+			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, false)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -414,7 +413,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("ListShares", mock.Anything, mock.Anything).Return(listSharesResponse, nil)
 			gatewayClient.On("GetUser", mock.Anything, mock.Anything).Return(getUserResponse, nil)
 			gatewayClient.On("ListPublicShares", mock.Anything, mock.Anything).Return(listPublicSharesResponse, nil)
-			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID)
+			permissions, err := driveItemPermissionsService.ListPermissions(context.Background(), itemID, false, false)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(permissions.LibreGraphPermissionsActionsAllowedValues)).ToNot(BeZero())
 			Expect(len(permissions.LibreGraphPermissionsRolesAllowedValues)).ToNot(BeZero())
@@ -806,10 +805,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			gatewayClient.On("UpdateShare",
 				mock.Anything,
 				mock.MatchedBy(func(req *collaboration.UpdateShareRequest) bool {
-					if req.GetShare().GetId().GetOpaqueId() == "permissionid" {
-						return true
-					}
-					return false
+					return req.GetShare().GetId().GetOpaqueId() == "permissionid"
 				}),
 			).Return(updateShareMockResponse, nil)
 
@@ -1072,7 +1068,7 @@ var _ = Describe("DriveItemPermissionsApi", func() {
 
 			onInvite := mockProvider.On("Invite", mock.Anything, mock.Anything, mock.Anything)
 
-			onInvite.Return(func(ctx context.Context, resourceID *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
+			onInvite.Return(func(ctx context.Context, resourceID *provider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
 				return libregraph.Permission{}, errors.New("any")
 			}).Once()
 
@@ -1088,7 +1084,7 @@ var _ = Describe("DriveItemPermissionsApi", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			onInvite := mockProvider.On("Invite", mock.Anything, mock.Anything, mock.Anything)
-			onInvite.Return(func(ctx context.Context, resourceID *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
+			onInvite.Return(func(ctx context.Context, resourceID *provider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
 				Expect(storagespace.FormatResourceID(resourceID)).To(Equal("1$2!3"))
 				return libregraph.Permission{}, nil
 			}).Once()
@@ -1109,7 +1105,7 @@ var _ = Describe("DriveItemPermissionsApi", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			onInvite := mockProvider.On("SpaceRootInvite", mock.Anything, mock.Anything, mock.Anything)
-			onInvite.Return(func(ctx context.Context, driveID *storageprovider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
+			onInvite.Return(func(ctx context.Context, driveID *provider.ResourceId, invite libregraph.DriveItemInvite) (libregraph.Permission, error) {
 				Expect(storagespace.FormatResourceID(driveID)).To(Equal("1$2"))
 				return libregraph.Permission{}, nil
 			}).Once()
@@ -1144,8 +1140,9 @@ var _ = Describe("DriveItemPermissionsApi", func() {
 			inviteJson, err := json.Marshal(invite)
 			Expect(err).ToNot(HaveOccurred())
 
-			mockProvider.On("ListPermissions", mock.Anything, mock.Anything, mock.Anything).
-				Return(func(ctx context.Context, itemid *storageprovider.ResourceId) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+			mockProvider.On("ListPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).
+				Return(func(ctx context.Context, itemid *provider.ResourceId, listFederatedRoles, selectRoles bool) (libregraph.CollectionOfPermissionsWithAllowedValues, error) {
+					Expect(listFederatedRoles).To(Equal(false))
 					Expect(storagespace.FormatResourceID(itemid)).To(Equal("1$2!3"))
 					return libregraph.CollectionOfPermissionsWithAllowedValues{}, nil
 				}).Once()

services/graph/pkg/service/v0/sharedwithme_test.go

@@ -24,6 +24,7 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/tidwall/gjson"
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
 
 	libregraph "github.com/owncloud/libre-graph-api-go"
 	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
@@ -182,16 +183,16 @@ var _ = Describe("SharedWithMe", func() {
 			}
 
 			gatewayClient.On("Stat", mock.Anything, mock.Anything).Return(func(_ context.Context, r *providerv1beta1.StatRequest, _ ...grpc.CallOption) (*providerv1beta1.StatResponse, error) {
+				// copy the response to	avoid side effects
+				res := proto.Clone(statResponse).(*providerv1beta1.StatResponse)
 				for _, share := range listReceivedSharesResponse.Shares {
 					if share.Share.ResourceId != r.Ref.ResourceId {
 						continue
 					}
 
-					if statResponse.Info.Id == nil {
-						statResponse.Info.Id = share.Share.ResourceId
-					}
+					res.Info.Id = share.Share.ResourceId
 
-					return statResponse, nil
+					return res, nil
 				}
 
 				return nil, nil

services/graph/pkg/service/v0/utils.go

@@ -72,6 +72,16 @@ func GetDriveAndItemIDParam(r *http.Request, logger *log.Logger) (storageprovide
 	return driveID, itemID, nil
 }
 
+// GetFilterParam returns the $filter query parameter from the request. If you need to parse the filter use godata.ParseRequest
+func GetFilterParam(r *http.Request) string {
+	return r.URL.Query().Get("$filter")
+}
+
+// GetSelectParam returns the $select query parameter from the request. If you need to parse the select filter use godata.ParseRequest
+func GetSelectParam(r *http.Request) string {
+	return r.URL.Query().Get("$select")
+}
+
 // GetGatewayClient returns a gateway client from the gatewaySelector.
 func (g Graph) GetGatewayClient(w http.ResponseWriter, r *http.Request) (gateway.GatewayAPIClient, bool) {
 	gatewayClient, err := g.gatewaySelector.Next()