Repository navigation
fix(contexts): include circle (team) shares when resolving application access - #3231
Open
AndyScherzinger wants to merge 1 commit into
Open
AndyScherzinger wants to merge 1 commit into
AndyScherzinger wants to merge 1 commit into
Conversation
…n access ContextMapper::applyOwnedOrSharedQuery resolved only owner, direct-user and group shares, so an application shared with a circle (team) was invisible to every member of that circle even though the share row and its cleanup wiring already exist. The write path accepts circle receivers on context shares without restriction, so such shares can be created via the API but are never surfaced to their recipients. Resolve the requesting user's circle ids and add a circle clause that mirrors the existing group clause, so circle members see circle-shared applications the same way group members already do. findForNavBar needs no change: its non-owner display clause is receiver-type agnostic and surfaces the context once this access query includes it. Assisted-by: ClaudeCode:claude-opus-4-8 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
Member
|
This is very similar to #3199 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applications (contexts) shared with a circle (team) were invisible to every member of that circle. The share row is created and its cleanup is already wired, but the access query never resolved circle membership, so recipients never saw the shared application.
🔎 Root cause
ContextMapper::applyOwnedOrSharedQuery()— the access/listing query behindfindAll,findById,findForNavBarandfindAllContainingNode— resolved only owner, direct-user and group shares. It had no circle clause, and unlike tables (which resolve circle shares separately viaShareService::findTablesSharedWithMe()), contexts have no secondary circle-resolution path. Meanwhile the write path (ShareService::createContextShare()) accepts a circle receiver without restriction, so circle shares on contexts can be created through the API but are never surfaced to their recipients. It fails closed (under-sharing, not over-sharing), so there is no data exposure.This is pre-existing on
masterand not tied to any particular feature PR.🛠️ What changed
Inject
CircleHelperintoContextMapperand add a circle clause toapplyOwnedOrSharedQuery()that resolves the requesting user's circle ids (getCircleIdsForUser()) and matchesreceiver_type = 'circle', mirroring the existing group clause exactly. When the Circles app is disabled or the user belongs to no circle, the clause is skipped.findForNavBar()needs no change: its non-owner display branch (c.owner_id != userId AND n.display_mode > HIDDEN) is receiver-type agnostic, so a circle-shared context appears in the navigation as soon as this access query includes it.🧪 Testing
Added
ContextMapperTest(aDatabaseTestCase) asserting a circle member resolves a circle-shared application viafindAll()while a non-member does not. PHPUnit could not be run locally (it requires a booted Nextcloud server tree); validated with Psalm (clean on the changed file) and php-cs-fixer (clean). CI runs the suite.🖼️ Screenshots
n/a — no visual change (data-access query only).
🏁 Checklist
/backport to stableX.X🤖 AI (if applicable)