Prevent last Space manager from leaving

changelog/unreleased/keep-last-space-manager.md

@@ -0,0 +1,5 @@
+Bugfix: Prevent last space manager from leaving
+
+It should not be possible for the last remaining space manager to change his role or get changed by others.
+
+https://github.com/cs3org/reva/pull/3917

internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/spaces.go

@@ -125,6 +125,33 @@ func (h *Handler) addSpaceMember(w http.ResponseWriter, r *http.Request, info *p
  Nanos: uint32(expiration.UnixNano() % int64(time.Second)),
  }
  }
+
+ if role.Name != conversions.RoleManager {
+ ref := provider.Reference{ResourceId: info.GetId()}
+ p, err := h.findProvider(ctx, &ref)
+ if err != nil {
+ response.WriteOCSError(w, r, response.MetaNotFound.StatusCode, "error getting storage provider", err)
+ return
+ }
+
+ providerClient, err := h.getStorageProviderClient(p)
+ if err != nil {
+ response.WriteOCSError(w, r, response.MetaNotFound.StatusCode, "error getting storage provider client", err)
+ return
+ }
+
+ lgRes, err := providerClient.ListGrants(ctx, &provider.ListGrantsRequest{Ref: &ref})
+ if err != nil || lgRes.Status.Code != rpc.Code_CODE_OK {
+ response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "error listing space grants", err)
+ return
+ }
+
+ if !isSpaceManagerRemaining(lgRes.Grants, grantee) {
+ response.WriteOCSError(w, r, http.StatusForbidden, "the space must have at least one manager", nil)
+ return
+ }
+ }
+
  createShareRes, err := client.CreateShare(ctx, &collaborationv1beta1.CreateShareRequest{
  ResourceInfo: info,
  Grant: &collaborationv1beta1.ShareGrant{