spaces: enforce create-space permission

graph/pkg/service/v0/drives.go

@@ -8,16 +8,18 @@ import (
 	"path"
 	"time"
 
-	ctxpkg "github.com/cs3org/reva/pkg/ctx"
-
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	v1beta11 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	ctxpkg "github.com/cs3org/reva/pkg/ctx"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 	"github.com/owncloud/ocis/graph/pkg/service/v0/errorcode"
+	"github.com/owncloud/ocis/ocis-pkg/service/grpc"
+	sproto "github.com/owncloud/ocis/settings/pkg/proto/v0"
+	settingsSvc "github.com/owncloud/ocis/settings/pkg/service/v0"
 	msgraph "github.com/owncloud/open-graph-api-go"
 )
 
@@ -142,6 +144,17 @@ func (g Graph) CreateDrive(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	s := sproto.NewPermissionService("com.owncloud.api.settings", grpc.DefaultClient)
+
+	_, err := s.GetPermissionByID(r.Context(), &sproto.GetPermissionByIDRequest{
+		PermissionId: settingsSvc.CreateSpacePermissionID,
+	})
+	if err != nil {
+		// if the permission is not existing for the user in context we can assume we don't have it. Return 401.
+		errorcode.GeneralException.Render(w, r, http.StatusUnauthorized, "insufficient permissions to create a space.")
+		return
+	}
+
 	client, err := g.GetClient()
 	if err != nil {
 		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())

graph/pkg/service/v0/service.go

@@ -3,6 +3,9 @@ package svc
 import (
 	"net/http"
 
+	"github.com/owncloud/ocis/ocis-pkg/account"
+	opkgm "github.com/owncloud/ocis/ocis-pkg/middleware"
+
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 )
@@ -51,6 +54,10 @@ func NewService(opts ...Option) Service {
 				})
 			})
 			r.Route("/drives", func(r chi.Router) {
+				r.Use(opkgm.ExtractAccountUUID(
+					account.Logger(options.Logger),
+					account.JWTSecret(options.Config.TokenManager.JWTSecret)),
+				)
 				// This route is non-compliant with MS Graph implementation; creating a drive is not supported. There
 				// is no official MS SDK support for this method.
 				r.Post("/{drive-name}", svc.CreateDrive)