nextcloud/build/integration/sharing_features/sharing-v1-part4.feature

# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
Feature: sharing
  Background:
    Given using api version "1"
    Given using new dav path

# See sharing-v1-part3.feature

Scenario: Creating a new share of a file shows size and mtime
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And parameter "shareapi_default_permissions" of app "core" is set to "7"
    When creating a share with
      | path | welcome.txt |
      | shareWith | user1 |
      | shareType | 0 |
    And the OCS status code should be "100"
    And the HTTP status code should be "200"
    And Getting info of last share
    Then the OCS status code should be "100"
    And the HTTP status code should be "200"
    And Share fields of last share match with
      | item_size | A_NUMBER |
      | item_mtime | A_NUMBER |

Scenario: Creating a new share of a file you own shows the file permissions
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And parameter "shareapi_default_permissions" of app "core" is set to "7"
    When creating a share with
      | path | welcome.txt |
      | shareWith | user1 |
      | shareType | 0 |
    And the OCS status code should be "100"
    And the HTTP status code should be "200"
    And Getting info of last share
    Then the OCS status code should be "100"
    And the HTTP status code should be "200"
    And Share fields of last share match with
      | item_permissions | 27 |

Scenario: Receiving a share of a file gives no create permission
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And parameter "shareapi_default_permissions" of app "core" is set to "31"
    And file "welcome.txt" of user "user0" is shared with user "user1"
    And sending "GET" to "/apps/files_sharing/api/v1/shares"
    And share 0 is returned with
      | path | /welcome.txt |
      | permissions | 19 |
      | item_permissions | 27 |
    When As an "user1"
    And user "user1" accepts last share
    And sending "GET" to "/apps/files_sharing/api/v1/shares?shared_with_me=true"
    Then the list of returned shares has 1 shares
    And share 0 is returned with
      | path | /welcome (2).txt |
      | permissions | 19 |
      | item_permissions | 27 |

Scenario: Receiving a share of a folder gives create permission
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And parameter "shareapi_default_permissions" of app "core" is set to "31"
    And file "PARENT/CHILD" of user "user0" is shared with user "user1"
    And sending "GET" to "/apps/files_sharing/api/v1/shares"
    And share 0 is returned with
      | path | /PARENT/CHILD |
      | permissions | 31 |
      | item_permissions | 31 |
    When As an "user1"
    And user "user1" accepts last share
    And sending "GET" to "/apps/files_sharing/api/v1/shares?shared_with_me=true"
    Then the list of returned shares has 1 shares
    And share 0 is returned with
      | path | /CHILD |
      | permissions | 31 |
      | item_permissions | 31 |

# User can remove itself from a share
Scenario: Receiving a share of a file without delete permission gives delete permission anyway
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And parameter "shareapi_default_permissions" of app "core" is set to "23"
    And file "welcome.txt" of user "user0" is shared with user "user1"
    And sending "GET" to "/apps/files_sharing/api/v1/shares"
    And share 0 is returned with
      | path | /welcome.txt |
      | permissions | 19 |
      | item_permissions | 27 |
    When As an "user1"
    And user "user1" accepts last share
    And sending "GET" to "/apps/files_sharing/api/v1/shares?shared_with_me=true"
    Then the list of returned shares has 1 shares
    And share 0 is returned with
      | path | /welcome (2).txt |
      | permissions | 19 |
      | item_permissions | 27 |

Scenario: Receiving a share of a file without delete permission gives delete permission anyway
    Given user "user0" exists
    And user "user1" exists
    And As an "user0"
    And group "group1" exists
    And user "user1" belongs to group "group1"
    And parameter "shareapi_default_permissions" of app "core" is set to "23"
    And file "welcome.txt" of user "user0" is shared with group "group1"
    And sending "GET" to "/apps/files_sharing/api/v1/shares"
    And share 0 is returned with
      | path | /welcome.txt |
      | permissions | 19 |
      | item_permissions | 27 |
    When As an "user1"
    And user "user1" accepts last share
    And sending "GET" to "/apps/files_sharing/api/v1/shares?shared_with_me=true"
    Then the list of returned shares has 1 shares
    And share 0 is returned with
      | path | /welcome (2).txt |
      | permissions | 19 |
      | item_permissions | 27 |

# This is a regression test as in the past creating a file drop required creating with permissions=5
# and then afterwards update the share to permissions=4
Scenario: Directly create link share with CREATE only permissions (file drop)
    Given user "user0" exists
    And As an "user0"
    And user "user0" created a folder "/TMP"
    When creating a share with
      | path        | TMP |
      | shareType   |   3 |
      | permissions |   4 |
    And Getting info of last share
    Then Share fields of last share match with
      | uid_file_owner | user0 |
      | share_type     |     3 |
      | permissions    |     4 |

Scenario: Directly create email share with CREATE only permissions (file drop)
  Given user "user0" exists
  And As an "user0"
  And user "user0" created a folder "/TMP"
  When creating a share with
    | path        |               TMP |
    | shareType   |                 4 |
    | shareWith   | j.doe@example.com |
    | permissions |                 4 |
  And Getting info of last share
  Then Share fields of last share match with
    | uid_file_owner | user0 |
    | share_type     |     4 |
    | permissions    |     4 |

# This ensures the legacy behavior of sharing v1 is kept
Scenario: publicUpload overrides permissions
    Given user "user0" exists
    And As an "user0"
    And parameter "outgoing_server2server_share_enabled" of app "files_sharing" is set to "no"
    And user "user0" created a folder "/TMP"
    When creating a share with
      | path         |  TMP |
      | shareType    |    3 |
      | permissions  |    4 |
      | publicUpload | true |
    And Getting info of last share
    Then Share fields of last share match with
      | uid_file_owner | user0 |
      | share_type     |     3 |
      | permissions    |    15 |
    When creating a share with
      | path         |   TMP |
      | shareType    |     3 |
      | permissions  |     4 |
      | publicUpload | false |
    And Getting info of last share
    Then Share fields of last share match with
      | uid_file_owner | user0 |
      | share_type     |     3 |
      | permissions    |     1 |

Scenario: Cannot copy files from share without share permission into other share
    Given user "user0" exists
    Given user "user1" exists
    Given user "user2" exists
    And As an "user0"
    And user "user0" created a folder "/share"
    When creating a share with
      | path        | share |
      | shareType   |     0 |
      | shareWith   | user1 |
      | permissions |    7 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    And User "user0" uploads file with content "test" to "/share/test.txt"
    And As an "user1"
    And user "user1" created a folder "/re-share"
    When creating a share with
      | path        | re-share |
      | shareType   |        0 |
      | shareWith   |    user2 |
      | permissions |       31 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    When User "user1" copies file "/share/test.txt" to "/re-share/copytest.txt"
    Then the HTTP status code should be "403"

Scenario: Cannot move files from share without share permission into other share
    Given user "user0" exists
    Given user "user1" exists
    Given user "user2" exists
    And As an "user0"
    And user "user0" created a folder "/share"
    When creating a share with
      | path        | share |
      | shareType   |     0 |
      | shareWith   | user1 |
      | permissions |    7 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    And User "user0" uploads file with content "test" to "/share/test.txt"
    And As an "user1"
    And user "user1" created a folder "/re-share"
    When creating a share with
      | path        | re-share |
      | shareType   |        0 |
      | shareWith   |    user2 |
      | permissions |       31 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    When User "user1" moves file "/share/test.txt" to "/re-share/movetest.txt"
    Then the HTTP status code should be "403"

	Scenario: Can move files from share without share permission but with delete permissions into other share
		Given user "user0" exists
		Given user "user1" exists
		Given user "user2" exists
		And As an "user0"
		And user "user0" created a folder "/share"
		When creating a share with
			| path        | share |
			| shareType   |     0 |
			| shareWith   | user1 |
			| permissions |    15 |
		Then the HTTP status code should be "200"
		And the OCS status code should be "100"
		And User "user0" uploads file with content "test" to "/share/test.txt"
		And As an "user1"
		And user "user1" created a folder "/re-share"
		When creating a share with
			| path        | re-share |
			| shareType   |        0 |
			| shareWith   |    user2 |
			| permissions |       31 |
		Then the HTTP status code should be "200"
		And the OCS status code should be "100"
		When User "user1" moves file "/share/test.txt" to "/re-share/movetest.txt"
		Then the HTTP status code should be "201"

Scenario: Cannot move folder containing share without share permission into other share
    Given user "user0" exists
    Given user "user1" exists
    Given user "user2" exists
    And As an "user0"
    And user "user0" created a folder "/share"
    When creating a share with
      | path        | share |
      | shareType   |     0 |
      | shareWith   | user1 |
      | permissions |    7 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    And User "user0" uploads file with content "test" to "/share/test.txt"
    And As an "user1"
    And user "user1" created a folder "/contains-share"
    When User "user1" moves file "/share" to "/contains-share/share"
    Then the HTTP status code should be "201"
    And user "user1" created a folder "/re-share"
    When creating a share with
      | path        | re-share |
      | shareType   |        0 |
      | shareWith   |    user2 |
      | permissions |       31 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    When User "user1" moves file "/contains-share" to "/re-share/movetest"
    Then the HTTP status code should be "403"

Scenario: Can copy file between shares if share permissions
    Given user "user0" exists
    Given user "user1" exists
    Given user "user2" exists
    And As an "user0"
    And user "user0" created a folder "/share"
    When creating a share with
      | path        | share |
      | shareType   |     0 |
      | shareWith   | user1 |
      | permissions |    31 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    And User "user0" uploads file with content "test" to "/share/test.txt"
    And As an "user1"
    And user "user1" created a folder "/re-share"
    When creating a share with
      | path        | re-share |
      | shareType   |        0 |
      | shareWith   |    user2 |
      | permissions |       31 |
    Then the HTTP status code should be "200"
    And the OCS status code should be "100"
    When User "user1" copies file "/share/test.txt" to "/re-share/movetest.txt"
    Then the HTTP status code should be "201"

Scenario: Group deletes removes mount without marking
	Given As an "admin"
	And user "user0" exists
	And user "user1" exists
	And group "group0" exists
	And user "user0" belongs to group "group0"
	And file "textfile0.txt" of user "user1" is shared with group "group0"
	And As an "user0"
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	And group "group0" does not exist
	Then Share mounts for "user0" are empty

Scenario: Group deletes removes mount with marking
	Given As an "admin"
	And parameter "update_cutoff_time" of app "files_sharing" is set to "0"
	And user "user0" exists
	And user "user1" exists
	And group "group0" exists
	And user "user0" belongs to group "group0"
	And file "textfile0.txt" of user "user1" is shared with group "group0"
	And As an "user0"
	Then Share mounts for "user0" are empty
	When Connecting to dav endpoint
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	And group "group0" does not exist
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When Connecting to dav endpoint
	Then Share mounts for "user0" are empty

Scenario: User share mount without marking
	Given As an "admin"
	And user "user0" exists
	And user "user1" exists
	And file "textfile0.txt" of user "user1" is shared with user "user0"
	And As an "user0"
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When Deleting last share
	Then Share mounts for "user0" are empty

Scenario: User share mount with marking
	Given As an "admin"
	And parameter "update_cutoff_time" of app "files_sharing" is set to "0"
	And user "user0" exists
	And user "user1" exists
	And file "textfile0.txt" of user "user1" is shared with user "user0"
	And As an "user0"
	Then Share mounts for "user0" are empty
	When Connecting to dav endpoint
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When Deleting last share
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When Connecting to dav endpoint
	Then Share mounts for "user0" are empty

Scenario: User added/removed to group share without marking
	Given As an "admin"
	And user "user0" exists
	And user "user1" exists
	And group "group0" exists
	And file "textfile0.txt" of user "user1" is shared with group "group0"
	And As an "user0"
	Then Share mounts for "user0" are empty
	When user "user0" belongs to group "group0"
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When As an "admin"
	Then sending "DELETE" to "/cloud/users/user0/groups" with
		| groupid | group0 |
	Then As an "user0"
	And Share mounts for "user0" are empty

Scenario: User added/removed to group share with marking
	Given As an "admin"
	And parameter "update_cutoff_time" of app "files_sharing" is set to "0"
	And user "user0" exists
	And user "user1" exists
	And group "group0" exists
	And file "textfile0.txt" of user "user1" is shared with group "group0"
	And As an "user0"
	When user "user0" belongs to group "group0"
	Then Share mounts for "user0" are empty
	When Connecting to dav endpoint
	Then Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When As an "admin"
	Then sending "DELETE" to "/cloud/users/user0/groups" with
		| groupid | group0 |
	Then As an "user0"
	And Share mounts for "user0" match
		| /user0/files/textfile0 (2).txt/ |
	When Connecting to dav endpoint
	Then Share mounts for "user0" are empty

  Scenario: Share moved without marking
    Given As an "admin"
    And user "user0" exists
    And user "user1" exists
    And file "textfile0.txt" of user "user1" is shared with user "user0"
    And As an "user0"
    Then Share mounts for "user0" match
      | /user0/files/textfile0 (2).txt/ |
    When User "user0" moves file "/textfile0 (2).txt" to "/target.txt"
    Then Share mounts for "user0" match
      | /user0/files/target.txt/ |