feat(Sharing): Add per-recipient permissions

apps/sharing/appinfo/info.xml

@@ -9,7 +9,7 @@
 	<name>Sharing</name>
 	<summary>TODO</summary>
 	<description>TODO</description>
-	<version>2.0.0-dev.1</version>
+	<version>2.0.0-dev.3</version>
 	<licence>AGPL-3.0-or-later</licence>
 	<author>Kate Döen</author>
 	<namespace>Sharing</namespace>
@@ -30,6 +30,7 @@
 		<command>\OCA\Sharing\Command\SelectSharePermissionPreset</command>
 		<command>\OCA\Sharing\Command\UpdateSharePermission</command>
 		<command>\OCA\Sharing\Command\UpdateShareProperty</command>
+		<command>\OCA\Sharing\Command\UpdateShareRecipientPermission</command>
 		<command>\OCA\Sharing\Command\UpdateShareRecipientSecret</command>
 		<command>\OCA\Sharing\Command\UpdateShareState</command>
 		<command>\OCA\Sharing\Command\UpdateShareUserStatus</command>

apps/sharing/composer/composer/autoload_classmap.php

@@ -21,6 +21,7 @@
     'OCA\\Sharing\\Command\\SharingBase' => $baseDir . '/../lib/Command/SharingBase.php',
     'OCA\\Sharing\\Command\\UpdateSharePermission' => $baseDir . '/../lib/Command/UpdateSharePermission.php',
     'OCA\\Sharing\\Command\\UpdateShareProperty' => $baseDir . '/../lib/Command/UpdateShareProperty.php',
+    'OCA\\Sharing\\Command\\UpdateShareRecipientPermission' => $baseDir . '/../lib/Command/UpdateShareRecipientPermission.php',
     'OCA\\Sharing\\Command\\UpdateShareRecipientSecret' => $baseDir . '/../lib/Command/UpdateShareRecipientSecret.php',
     'OCA\\Sharing\\Command\\UpdateShareState' => $baseDir . '/../lib/Command/UpdateShareState.php',
     'OCA\\Sharing\\Command\\UpdateShareUserStatus' => $baseDir . '/../lib/Command/UpdateShareUserStatus.php',
@@ -29,5 +30,7 @@
     'OCA\\Sharing\\Migration\\Version1000Date20250929161325' => $baseDir . '/../lib/Migration/Version1000Date20250929161325.php',
     'OCA\\Sharing\\Migration\\Version1000Date20260731171922' => $baseDir . '/../lib/Migration/Version1000Date20260731171922.php',
     'OCA\\Sharing\\Migration\\Version1000Date20260826073021' => $baseDir . '/../lib/Migration/Version1000Date20260826073021.php',
+    'OCA\\Sharing\\Migration\\Version1000Date20260826115938' => $baseDir . '/../lib/Migration/Version1000Date20260826115938.php',
+    'OCA\\Sharing\\Migration\\Version1000Date20260826122228' => $baseDir . '/../lib/Migration/Version1000Date20260826122228.php',
     'OCA\\Sharing\\ResponseDefinitions' => $baseDir . '/../lib/ResponseDefinitions.php',
 );

apps/sharing/composer/composer/autoload_static.php

@@ -36,6 +36,7 @@ class ComposerStaticInitSharing
         'OCA\\Sharing\\Command\\SharingBase' => __DIR__ . '/..' . '/../lib/Command/SharingBase.php',
         'OCA\\Sharing\\Command\\UpdateSharePermission' => __DIR__ . '/..' . '/../lib/Command/UpdateSharePermission.php',
         'OCA\\Sharing\\Command\\UpdateShareProperty' => __DIR__ . '/..' . '/../lib/Command/UpdateShareProperty.php',
+        'OCA\\Sharing\\Command\\UpdateShareRecipientPermission' => __DIR__ . '/..' . '/../lib/Command/UpdateShareRecipientPermission.php',
         'OCA\\Sharing\\Command\\UpdateShareRecipientSecret' => __DIR__ . '/..' . '/../lib/Command/UpdateShareRecipientSecret.php',
         'OCA\\Sharing\\Command\\UpdateShareState' => __DIR__ . '/..' . '/../lib/Command/UpdateShareState.php',
         'OCA\\Sharing\\Command\\UpdateShareUserStatus' => __DIR__ . '/..' . '/../lib/Command/UpdateShareUserStatus.php',
@@ -44,6 +45,8 @@ class ComposerStaticInitSharing
         'OCA\\Sharing\\Migration\\Version1000Date20250929161325' => __DIR__ . '/..' . '/../lib/Migration/Version1000Date20250929161325.php',
         'OCA\\Sharing\\Migration\\Version1000Date20260731171922' => __DIR__ . '/..' . '/../lib/Migration/Version1000Date20260731171922.php',
         'OCA\\Sharing\\Migration\\Version1000Date20260826073021' => __DIR__ . '/..' . '/../lib/Migration/Version1000Date20260826073021.php',
+        'OCA\\Sharing\\Migration\\Version1000Date20260826115938' => __DIR__ . '/..' . '/../lib/Migration/Version1000Date20260826115938.php',
+        'OCA\\Sharing\\Migration\\Version1000Date20260826122228' => __DIR__ . '/..' . '/../lib/Migration/Version1000Date20260826122228.php',
         'OCA\\Sharing\\ResponseDefinitions' => __DIR__ . '/..' . '/../lib/ResponseDefinitions.php',
     );
 

apps/sharing/lib/Command/GetShares.php

@@ -84,7 +84,7 @@ public function execute(InputInterface $input, OutputInterface $output): int {
 			$shares = $this->manager->getShares($this->accessContext, $filterSourceTypeClass, $filterSourceTypeValue, $filterState, $filterUserStatus, $lastShareID, $limit);
 			$this->dbConnection->commit();
 
-			$data = Share::formatMultiple($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $shares);
+			$data = Share::formatMultiple($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext, $shares);
 			$this->writeArrayInOutputFormat($input, $output, $data);
 			return Base::SUCCESS;
 		} catch (Exception $exception) {

apps/sharing/lib/Command/SharingBase.php

@@ -71,7 +71,7 @@ protected function wrapExecution(InputInterface $input, OutputInterface $output,
 				$share = $closure();
 				$this->dbConnection->commit();
 
-				$data = $share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager);
+				$data = $share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext);
 				$this->writeArrayInOutputFormat($input, $output, $data);
 
 				return Base::SUCCESS;

apps/sharing/lib/Command/UpdateShareRecipientPermission.php

@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Sharing\Command;
+
+use NCU\Sharing\Permission\ISharePermissionType;
+use NCU\Sharing\Permission\SharePermission;
+use NCU\Sharing\Recipient\IShareRecipientType;
+use NCU\Sharing\Recipient\ShareRecipient;
+use NCU\Sharing\Share;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class UpdateShareRecipientPermission extends SharingBase {
+	#[\Override]
+	public function configure(): void {
+		$this
+			->setName('sharing:update-share-recipient-permission')
+			->setDescription('Update a permission for a recipient of a share.')
+			->addArgument('id', InputArgument::REQUIRED, 'Share ID')
+			->addArgument('permission-class', InputArgument::REQUIRED, 'Permission class')
+			->addArgument('permission-enabled', InputArgument::REQUIRED, 'Permission enabled. Only takes "true" or "false".')
+			->addArgument('recipient-class', InputArgument::REQUIRED, 'Recipient class')
+			->addArgument('recipient-value', InputArgument::REQUIRED, 'Recipient value')
+			->addArgument('recipient-instance', InputArgument::OPTIONAL, 'Recipient instance');
+		parent::configure();
+	}
+
+	#[\Override]
+	public function execute(InputInterface $input, OutputInterface $output): int {
+		/** @var string $id */
+		$id = $input->getArgument('id');
+		/** @var class-string<ISharePermissionType> $permissionClass */
+		$permissionClass = $input->getArgument('permission-class');
+		/** @var string $permissionEnabled */
+		$permissionEnabled = $input->getArgument('permission-enabled');
+		$permissionEnabled = $permissionEnabled === 'true';
+		/** @var class-string<IShareRecipientType> $recipientClass */
+		$recipientClass = $input->getArgument('recipient-class');
+		/** @var non-empty-string $recipientValue */
+		$recipientValue = $input->getArgument('recipient-value');
+		/** @var ?non-empty-string $recipientInstance */
+		$recipientInstance = $input->getArgument('recipient-instance');
+
+		$recipient = new ShareRecipient($recipientClass, $recipientValue, $recipientInstance);
+		$permission = new SharePermission($permissionClass, $permissionEnabled);
+
+		return $this->wrapExecution($input, $output, function () use ($id, $recipient, $permission): Share {
+			$share = $this->manager->getShare($this->accessContext, $id);
+			return $this->manager->updateShareRecipientPermission($this->accessContext, $share, $recipient, $permission);
+		});
+	}
+}

apps/sharing/lib/Controller/ApiV1Controller.php

@@ -152,7 +152,7 @@ public function createShare(): DataResponse {
 				$share = $this->manager->createShare($this->accessContext);
 
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager), Http::STATUS_CREATED);
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext), Http::STATUS_CREATED);
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -190,7 +190,7 @@ public function updateShareState(string $id, string $state): DataResponse {
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->updateShareState($this->accessContext, $share, $shareState);
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -229,7 +229,7 @@ public function updateShareUserStatus(string $id, string $userStatus): DataRespo
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->updateShareUserStatus($this->accessContext, $share, $shareUserStatus);
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -262,7 +262,7 @@ public function addShareSource(string $id, string $class, string $value): DataRe
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->addShareSource($this->accessContext, $share, new ShareSource($class, $value));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -298,7 +298,7 @@ public function removeShareSource(string $id, string $class, string $value): Dat
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->removeShareSource($this->accessContext, $share, new ShareSource($class, $value));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -334,7 +334,7 @@ public function addShareRecipient(string $id, string $class, string $value, ?str
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->addShareRecipient($this->accessContext, $share, new ShareRecipient($class, $value, $instance));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -371,7 +371,7 @@ public function removeShareRecipient(string $id, string $class, string $value, ?
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->removeShareRecipient($this->accessContext, $share, new ShareRecipient($class, $value, $instance));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -408,7 +408,7 @@ public function updateShareRecipientSecret(string $id, string $class, string $va
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->updateShareRecipientSecret($this->accessContext, $share, new ShareRecipient($class, $value, $instance), $secret);
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -445,7 +445,7 @@ public function updateShareProperty(string $id, string $class, ?string $value):
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->updateShareProperty($this->accessContext, $share, new ShareProperty($class, $value));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -482,7 +482,7 @@ public function updateSharePermission(string $id, string $class, bool $enabled):
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->updateSharePermission($this->accessContext, $share, new SharePermission($class, $enabled));
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -496,6 +496,43 @@ public function updateSharePermission(string $id, string $class, bool $enabled):
 		}
 	}
 
+	/**
+	 * Update a permission for a recipient of a share.
+	 *
+	 * @param string $id ID of the share
+	 * @param class-string<IShareRecipientType> $recipientClass Type class of the recipient
+	 * @param non-empty-string $recipientValue Value of the recipient
+	 * @param ?non-empty-string $recipientInstance Instance of the recipient
+	 * @param class-string<ISharePermissionType> $permissionClass Type class of the permission
+	 * @param bool $enabled Enabled state of the permission
+	 * @return DataResponse<Http::STATUS_OK, SharingShare, array{}>|DataResponse<Http::STATUS_FORBIDDEN|Http::STATUS_NOT_FOUND, string, array{}>
+	 *
+	 * 200: Share recipient permission updated successfully
+	 * 403: Updating the share recipient permission is not allowed
+	 * 404: Share not found
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'PUT', url: '/api/v1/share/{id}/recipient/permission')]
+	public function updateShareRecipientPermission(string $id, string $recipientClass, string $recipientValue, ?string $recipientInstance, string $permissionClass, bool $enabled): DataResponse {
+		try {
+			try {
+				$this->dbConnection->beginTransaction();
+
+				$share = $this->manager->getShare($this->accessContext, $id);
+				$share = $this->manager->updateShareRecipientPermission($this->accessContext, $share, new ShareRecipient($recipientClass, $recipientValue, $recipientInstance), new SharePermission($permissionClass, $enabled));
+				$this->dbConnection->commit();
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
+			} catch (Exception $exception) {
+				$this->dbConnection->rollBack();
+				throw $exception;
+			}
+		} catch (ShareOperationForbiddenException $shareOperationForbiddenException) {
+			return new DataResponse($shareOperationForbiddenException->getHint(), Http::STATUS_FORBIDDEN);
+		} catch (ShareNotFoundException $shareNotFoundException) {
+			return new DataResponse($shareNotFoundException->getHint(), Http::STATUS_NOT_FOUND);
+		}
+	}
+
 	/**
 	 * Select a permission preset for a share.
 	 *
@@ -518,7 +555,7 @@ public function selectSharePermissionPreset(string $id, string $permissionPreset
 				$share = $this->manager->getShare($this->accessContext, $id);
 				$share = $this->manager->selectSharePermissionPreset($this->accessContext, $share, $permissionPresetClass);
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -583,7 +620,7 @@ public function getShare(string $id, ?string $secret = null, array $arguments =
 
 				$share = $this->manager->getShare(new ShareAccessContext($this->accessContext->currentUser, $secret, $arguments, $this->accessContext->overrideChecks), $id);
 				$this->dbConnection->commit();
-				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager));
+				return new DataResponse($share->format($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext));
 			} catch (Exception $exception) {
 				$this->dbConnection->rollBack();
 				throw $exception;
@@ -650,7 +687,7 @@ public function getShares(?string $filterSourceTypeClass, ?string $filterSourceT
 
 			$shares = $this->manager->getShares($this->accessContext, $filterSourceTypeClass, $filterSourceTypeValue, $filterState, $filterUserStatus, $lastShareID, $limit);
 			$this->dbConnection->commit();
-			return new DataResponse(Share::formatMultiple($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $shares));
+			return new DataResponse(Share::formatMultiple($this->registry, $this->l10nFactory, $this->urlGenerator, $this->userManager, $this->accessContext, $shares));
 		} catch (Exception $exception) {
 			$this->dbConnection->rollBack();
 			throw $exception;