feat: [OCISDEV-949] add option to disable direct (user/group) sharing (#651)

* feat: [OCISDEV-949] add option to disable direct (user/group) sharing

Adds an `enable_user_sharing` config option to the ocs, usershareprovider
and ocmshareprovider services. Defaults to true. When set to false, the
usershareprovider and ocmshareprovider gRPC services reject requests to
share a resource with a user, group, or federated (remote) user. The
sharees search endpoint returns no results, and the
files_sharing.user.enabled capability is set to false. Public link
sharing is not affected.

* feat: [OCISDEV-949] add option to disable public link sharing

Adds an enable_public_sharing config option to the publicshareprovider
service, defaulting to true. When set to false, creating new public
links is rejected (internal links, which carry no permissions, are
unaffected). Also removes a hardcoded override in the capabilities
handler that always forced files_sharing.public.enabled to true,
letting it reflect whatever value is actually configured.

Author: mzner

changelog/unreleased/add-enable-public-sharing-toggle.md

@@ -0,0 +1,10 @@
+Enhancement: Add config option to disable public link sharing
+
+Added an `enable_public_sharing` config option to the publicshareprovider
+service. When set to `false`, creating new public links is rejected
+(internal links, which carry no permissions, are unaffected), and the
+`files_sharing.public.enabled` capability reports `false`. A hardcoded
+override that always forced `files_sharing.public.enabled` to `true` was
+also removed so the capability reflects the actual configured value.
+
+https://github.com/owncloud/reva/pull/651

changelog/unreleased/add-enable-user-sharing-toggle.md

@@ -0,0 +1,9 @@
+Enhancement: Add config option to disable direct (user/group) sharing
+
+Added an `enable_user_sharing` config option to the ocs, usershareprovider
+and ocmshareprovider services. When set to `false`, creating user, group
+or federated shares is rejected, the `sharees` search endpoint returns
+empty results, and the `files_sharing.user.enabled` capability reports
+`false`. Public link sharing is unaffected.
+
+https://github.com/owncloud/reva/pull/651

internal/grpc/services/ocmshareprovider/ocmshareprovider.go

@@ -59,14 +59,15 @@ func init() {
 }
 
 type config struct {
-	Driver         string                            `mapstructure:"driver"`
-	Drivers        map[string]map[string]interface{} `mapstructure:"drivers"`
-	ClientTimeout  int                               `mapstructure:"client_timeout"`
-	ClientInsecure bool                              `mapstructure:"client_insecure"`
-	GatewaySVC     string                            `mapstructure:"gatewaysvc"      validate:"required"`
-	ProviderDomain string                            `mapstructure:"provider_domain" validate:"required" docs:"The same domain registered in the provider authorizer"`
-	WebDAVEndpoint string                            `mapstructure:"webdav_endpoint" validate:"required"`
-	WebappTemplate string                            `mapstructure:"webapp_template"`
+	Driver            string                            `mapstructure:"driver"`
+	Drivers           map[string]map[string]interface{} `mapstructure:"drivers"`
+	ClientTimeout     int                               `mapstructure:"client_timeout"`
+	ClientInsecure    bool                              `mapstructure:"client_insecure"`
+	GatewaySVC        string                            `mapstructure:"gatewaysvc"      validate:"required"`
+	ProviderDomain    string                            `mapstructure:"provider_domain" validate:"required" docs:"The same domain registered in the provider authorizer"`
+	WebDAVEndpoint    string                            `mapstructure:"webdav_endpoint" validate:"required"`
+	WebappTemplate    string                            `mapstructure:"webapp_template"`
+	EnableUserSharing bool                              `mapstructure:"enable_user_sharing"`
 }
 
 type service struct {
@@ -254,6 +255,12 @@ func (s *service) getProtocols(ctx context.Context, share *ocm.Share) ocmd.Proto
 }
 
 func (s *service) CreateOCMShare(ctx context.Context, req *ocm.CreateOCMShareRequest) (*ocm.CreateOCMShareResponse, error) {
+	if !s.conf.EnableUserSharing {
+		return &ocm.CreateOCMShareResponse{
+			Status: status.NewPermissionDenied(ctx, nil, "direct sharing is disabled"),
+		}, nil
+	}
+
 	gatewayClient, err := s.gatewaySelector.Next()
 	if err != nil {
 		return nil, err

internal/grpc/services/publicshareprovider/publicshareprovider.go

@@ -67,6 +67,7 @@ type config struct {
 	WriteableShareMustHavePassword bool                              `mapstructure:"writeable_share_must_have_password"`
 	PublicShareMustHavePassword    bool                              `mapstructure:"public_share_must_have_password"`
 	PasswordPolicy                 map[string]interface{}            `mapstructure:"password_policy"`
+	EnablePublicSharing            bool                              `mapstructure:"enable_public_sharing"`
 }
 
 type passwordPolicy struct {
@@ -213,6 +214,12 @@ func (s *service) CreatePublicShare(ctx context.Context, req *link.CreatePublicS
 
 	isInternalLink := grants.PermissionsEqual(req.GetGrant().GetPermissions().GetPermissions(), &provider.ResourcePermissions{})
 
+	if !isInternalLink && !s.conf.EnablePublicSharing {
+		return &link.CreatePublicShareResponse{
+			Status: status.NewPermissionDenied(ctx, nil, "public sharing is disabled"),
+		}, nil
+	}
+
 	sRes, err := gatewayClient.Stat(ctx, &provider.StatRequest{Ref: &provider.Reference{ResourceId: req.GetResourceInfo().GetId()}})
 	if err != nil {
 		log.Err(err).Interface("resource_id", req.GetResourceInfo().GetId()).Msg("failed to stat resource to share")

internal/grpc/services/publicshareprovider/publicshareprovider_test.go

@@ -146,6 +146,7 @@ var _ = Describe("PublicShareProvider", func() {
 			"allowed_paths_for_shares":           []string{"/NewFolder"},
 			"writeable_share_must_have_password": false,
 			"public_share_must_have_password":    true,
+			"enable_public_sharing":              true,
 			"password_policy": map[string]interface{}{
 				"min_digits":               1,
 				"min_characters":           8,

internal/grpc/services/usershareprovider/usershareprovider.go

@@ -65,6 +65,7 @@ type config struct {
 	Drivers               map[string]map[string]interface{} `mapstructure:"drivers"`
 	GatewayAddr           string                            `mapstructure:"gateway_addr"`
 	AllowedPathsForShares []string                          `mapstructure:"allowed_paths_for_shares"`
+	EnableUserSharing     bool                              `mapstructure:"enable_user_sharing"`
 }
 
 func (c *config) init() {
@@ -77,6 +78,7 @@ type service struct {
 	sm                    share.Manager
 	gatewaySelector       pool.Selectable[gateway.GatewayAPIClient]
 	allowedPathsForShares []*regexp.Regexp
+	enableUserSharing     bool
 }
 
 func getShareManager(c *config) (share.Manager, error) {
@@ -137,15 +139,16 @@ func NewDefault(m map[string]interface{}, ss *grpc.Server, _ *zerolog.Logger) (r
 		return nil, err
 	}
 
-	return New(gatewaySelector, sm, allowedPathsForShares), nil
+	return New(gatewaySelector, sm, allowedPathsForShares, c.EnableUserSharing), nil
 }
 
 // New creates a new user share provider svc
-func New(gatewaySelector pool.Selectable[gateway.GatewayAPIClient], sm share.Manager, allowedPathsForShares []*regexp.Regexp) rgrpc.Service {
+func New(gatewaySelector pool.Selectable[gateway.GatewayAPIClient], sm share.Manager, allowedPathsForShares []*regexp.Regexp, enableUserSharing bool) rgrpc.Service {
 	service := &service{
 		sm:                    sm,
 		gatewaySelector:       gatewaySelector,
 		allowedPathsForShares: allowedPathsForShares,
+		enableUserSharing:     enableUserSharing,
 	}
 
 	return service
@@ -174,6 +177,12 @@ func (s *service) CreateShare(ctx context.Context, req *collaboration.CreateShar
 		}, nil
 	}
 
+	if !s.enableUserSharing {
+		return &collaboration.CreateShareResponse{
+			Status: status.NewPermissionDenied(ctx, nil, "direct sharing is disabled"),
+		}, nil
+	}
+
 	gatewayClient, err := s.gatewaySelector.Next()
 	if err != nil {
 		return nil, err

internal/grpc/services/usershareprovider/usershareprovider_test.go

@@ -115,7 +115,7 @@ var _ = Describe("user share provider service", func() {
 		}
 		manager.On("GetShare", mock.Anything, mock.Anything).Return(getShareResponse, nil)
 
-		rgrpcService := usershareprovider.New(gatewaySelector, manager, []*regexp.Regexp{})
+		rgrpcService := usershareprovider.New(gatewaySelector, manager, []*regexp.Regexp{}, true)
 
 		provider = rgrpcService.(collaborationpb.CollaborationAPIServer)
 		Expect(provider).ToNot(BeNil())
@@ -367,7 +367,7 @@ var _ = Describe("user share provider service", func() {
 		)
 		Context("resharing is not allowed", func() {
 			JustBeforeEach(func() {
-				rgrpcService := usershareprovider.New(gatewaySelector, manager, []*regexp.Regexp{})
+				rgrpcService := usershareprovider.New(gatewaySelector, manager, []*regexp.Regexp{}, true)
 
 				provider = rgrpcService.(collaborationpb.CollaborationAPIServer)
 				Expect(provider).ToNot(BeNil())

internal/http/services/owncloud/ocs/config/config.go

@@ -49,6 +49,7 @@ type Config struct {
 	Notifications                         map[string]interface{}            `mapstructure:"notifications"`
 	IncludeOCMSharees                     bool                              `mapstructure:"include_ocm_sharees"`
 	ShowEmailInResults                    bool                              `mapstructure:"show_email_in_results"`
+	EnableUserSharing                     bool                              `mapstructure:"enable_user_sharing"`
 }
 
 // Init sets sane defaults

internal/http/services/owncloud/ocs/handlers/apps/sharing/sharees/sharees.go

@@ -41,6 +41,7 @@ type Handler struct {
 	additionalInfoAttribute string
 	includeOCMSharees       bool
 	showUserEmailInResults  bool
+	enableUserSharing       bool
 }
 
 // Init initializes this and any contained handlers
@@ -49,6 +50,7 @@ func (h *Handler) Init(c *config.Config) {
 	h.additionalInfoAttribute = c.AdditionalInfoAttribute
 	h.includeOCMSharees = c.IncludeOCMSharees
 	h.showUserEmailInResults = c.ShowEmailInResults
+	h.enableUserSharing = c.EnableUserSharing
 }
 
 // FindSharees implements the /apps/files_sharing/api/v1/sharees endpoint
@@ -61,6 +63,20 @@ func (h *Handler) FindSharees(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !h.enableUserSharing {
+		response.WriteOCSSuccess(w, r, &conversions.ShareeData{
+			Exact: &conversions.ExactMatchesData{
+				Users:   []*conversions.MatchData{},
+				Groups:  []*conversions.MatchData{},
+				Remotes: []*conversions.MatchData{},
+			},
+			Users:   []*conversions.MatchData{},
+			Groups:  []*conversions.MatchData{},
+			Remotes: []*conversions.MatchData{},
+		})
+		return
+	}
+
 	gwc, err := pool.GetGatewayServiceClient(h.gatewayAddr)
 	if err != nil {
 		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "error getting gateway grpc client", err)

internal/http/services/owncloud/ocs/handlers/cloud/capabilities/capabilities.go

@@ -141,7 +141,6 @@ func (h *Handler) Init(c *config.Config) {
 	}
 
 	// h.c.Capabilities.FilesSharing.IsPublic.Enabled is boolean
-	h.c.Capabilities.FilesSharing.Public.Enabled = true
 
 	if h.c.Capabilities.FilesSharing.Public.Password == nil {
 		h.c.Capabilities.FilesSharing.Public.Password = &ocs.CapabilitiesFilesSharingPublicPassword{}