Public link enforce permissions

[PVince81]

Make sure permissions are enforced and return 403 instead of 500.
In the case of upload-only links, any Webdav operation would usually return 404 (need to be verified with the API tests)

Supersedes owncloud/ocis-reva#285 and owncloud/ocis-reva#291

• prevent upload, move, etc on read-only share
• prevent anything but upload on upload-only endpoint (return 404 for any other operation)
• upload-only doesn't behave correctly when overwriting: https://github.com/owncloud/ocis-reva/issues/286

[PVince81]

• creating a public link for a file with all permissions should automatically reduce them to 1 (not sure if a good idea but the tests expect it and it mimicks the old API)

[PVince81]

• tech debt related to permissions:
  • user share perm mappings are not 100% the same as with public link shares in OC 10, need a good way
  • somehow consolidate the roles and mapping functions, or at least the code styles

[PVince81]

Possible approaches:

1. Implement simple if statements in ocdav to check permissions
   or
2. Implement simple if statements in storage layer
   or
3. Map somehow to ACLs

also to consider: integration with roles concept.

Need to discuss what approach to take: @butonic @refs

[butonic]

the publicshareprovider fetches the issuer of the public share via the token. It uses that user to mint a token that is then used to authenticate requests to the actual storage. That logic needs to be double checked that

• permissions cannot be elevated and that
• error mcodes and messages bubblu up correctly and make sense to end users

[PVince81]

but: the user who issued the public share usually has maximum permissions, so there needs to be a mechanism to reduce the permissions to whatever the public link has been set to.

[refs]

Outcome of the roles and permissions meeting (broader topic) where we briefly discussed public links roles:

public shares permission and roles and permission will be 2 different development; PS roles don't depend on the settings service just yet, so we can work on enforcing them on the publicsharesprovider; when the roles and permissions is done, we can adjust the code to use the roles and permission from the actual service

[PVince81]

https://jira.owncloud.com/browse/OCIS-163

[refs]

this is a big technical debt currently present in the codebase.

[butonic]

this is covered by sharing NG