[nickvergessen]

Assisted-by: ClaudeCode:claude-opus-5-5

Summary

• Similar to the existing feature for user preferences together with the OCC part from feat(preference): Allow apps to prevent admins from corrupting preferences via command line #66034
• There are various appconfigs which admins should not be allowed to change/unset
• This change allows apps to ensure that a set value via provisioning api (and occ) can be validated against a set of legit values

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI

[ArtificialOwl]

not doable deeper in the AppConfig API ?

[nickvergessen]

not doable deeper in the AppConfig API ?

I actually don't want to do it inside there intentionally, so that apps can still temper with their own data and don't have to check when the event is triggered, if they are the one calling it.

E.g. follow up idea from me would be adding a listener in core that takes over this validation:

server/apps/provisioning_api/lib/Controller/AppConfigController.php

Lines 221 to 231 in 58a10e1

	if (in_array($key, ['installed_version', 'enabled', 'types'], true)) {
	throw new \InvalidArgumentException('The given key can not be set');
	}
	if ($app === 'core' && $key === 'encryption_enabled' && $value !== 'yes') {
	throw new \InvalidArgumentException('The given key can not be set');
	}
	if ($app === 'core' && (strpos($key, 'public_') === 0 || strpos($key, 'remote_') === 0)) {
	throw new \InvalidArgumentException('The given key can not be set');
	}

But e.g. the installed_version and others still need to be able to be set with core functionality