Repository navigation
feat(auth): let app passwords read files without changing them - #66137
Open
pringelmann wants to merge 4 commits into
Open
pringelmann wants to merge 4 commits into
pringelmann wants to merge 4 commits into
Conversation
pringelmann
added
feature: authentication
feature: settings
team: IDP
pringelmann
requested review from
Altahrim,
CarlSchwan,
GhassenKefi,
cristianscheid,
kristian-zendato,
leftybournes,
pabzm,
skjnldsv,
sorbaugh and
susnux
and removed request for
a team
November 2, 2026 10:02
pringelmann
commented
Nov 2, 2026
| export const AREAS = Object.keys(AREA_OPTIONS) as Area[] | ||
|
|
||
| /** Restoring writes into the files, so it only works with editing */ | ||
| const NEEDS: Partial<Record<Grant, Grant>> = { |
Contributor
Author
There was a problem hiding this comment.
Temporary dependency map until we replace it with a ScopeProvider (comes after 36)
pringelmann
force-pushed
the
feat/noid/app-password-read-only
branch
from
November 2, 2026 10:37
2ddc997 to
181101d
Compare
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
…ad APIs Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
passwords Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
pringelmann
force-pushed
the
feat/noid/app-password-read-only
branch
from
November 3, 2026 10:02
181101d to
c47fa12
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
App passwords can now be limited to reading files using the
files:files:readscope.A permissions mask on the key's mounts removes write rights. (the root mount is not masked, so previews still get generated.
The read methods in the files and sharing controllers now need only
files:files:read. The classes stay on write, so new methods are closed by default.Changes to the picker: a "Read-only files" preset and a "Can edit files" option under Files:
Note
Read-only also means no
PROPPATCH, so favorites and tags can't be changed with such a key. We can add this later if needed when actual clients can request scopes during login flow.Checklist
3. to review, feature component)stable32)AI (if applicable)