[full-ci] Do not share versions

.drone.env

@@ -1,3 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=c7781078121ee07cc19b866713b0047a0e1c0eed
-WEB_BRANCH=master
+
+WEB_COMMITID=a36aec7f6af0a0e5d2319f5ab18429e53e9f702a
+WEB_BRANCH=doNotShareVersionChangeE2eTest

changelog/unreleased/do-not-share-versions.md

@@ -0,0 +1,5 @@
+Change: Do not share versions
+
+We changed the default behavior of shares: Share receivers have no access to versions. People in spaces with the "Editor" or "Manager" role can still see versions and work with them.
+
+https://github.com/owncloud/ocis/pull/5531

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/blevesearch/bleve/v2 v2.3.7
 	github.com/coreos/go-oidc/v3 v3.4.0
 	github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965
-	github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656
+	github.com/cs3org/reva/v2 v2.12.1-0.20230404090709-bb973fae26ae
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1

go.sum

@@ -627,8 +627,8 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc=
 github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA=
-github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656 h1:FAlxhUtG0/57X4i05x3suRd/rtAecM/7ZWeJ9ZtqrIc=
-github.com/cs3org/reva/v2 v2.12.1-0.20230403080425-f93a726ab656/go.mod h1:FNAYs5H3xs8v0OFmNgZtiMAzIMXd/6TJmO0uZuNn8pQ=
+github.com/cs3org/reva/v2 v2.12.1-0.20230404090709-bb973fae26ae h1:APfYubzIYqCTXtmX6cAm4c8wBYS3R/cZwomX8IlXLaI=
+github.com/cs3org/reva/v2 v2.12.1-0.20230404090709-bb973fae26ae/go.mod h1:FNAYs5H3xs8v0OFmNgZtiMAzIMXd/6TJmO0uZuNn8pQ=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
@@ -1268,6 +1268,8 @@ github.com/maxymania/go-system v0.0.0-20170110133659-647cc364bf0b h1:Q53idHrTuQD
 github.com/maxymania/go-system v0.0.0-20170110133659-647cc364bf0b/go.mod h1:KirJrATYGbTyUwVR26xIkaipRqRcMRXBf8N5dacvGus=
 github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103 h1:Z/i1e+gTZrmcGeZyWckaLfucYG6KYOXLWo4co8pZYNY=
 github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103/go.mod h1:o9YPB5aGP8ob35Vy6+vyq3P3bWe7NQWzf+JLiXCiMaE=
+github.com/micbar/reva/v2 v2.0.0-20230403215034-66e24325ae82 h1:ivuBEObF9BlpArq363tS2qB9w4YO+b+uO59GueepZhk=
+github.com/micbar/reva/v2 v2.0.0-20230403215034-66e24325ae82/go.mod h1:FNAYs5H3xs8v0OFmNgZtiMAzIMXd/6TJmO0uZuNn8pQ=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.40/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=

tests/acceptance/expected-failures-API-on-OCIS-storage.md

@@ -359,10 +359,6 @@ cannot share a folder with create permission
 - [coreApiShareUpdateToShares/updateShare.feature:241](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareUpdateToShares/updateShare.feature#L241)
 - [coreApiShareUpdateToShares/updateShare.feature:242](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareUpdateToShares/updateShare.feature#L242)
 
-#### [user can access version metadata of a received share before accepting it](https://github.com/owncloud/ocis/issues/760)
-
-- [coreApiVersions/fileVersions.feature:487](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiVersions/fileVersions.feature#L487)
-
 #### [Share lists deleted user as 'user'](https://github.com/owncloud/ocis/issues/903)
 
 - [coreApiShareManagementBasicToShares/createShareToSharesFolder.feature:676](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareManagementBasicToShares/createShareToSharesFolder.feature#L676)

tests/acceptance/features/apiContract/sharesReport.feature

@@ -25,7 +25,7 @@ Feature: REPORT request to Shares space
       | oc:shareroot     | /folderMain          |
       | oc:name          | SubFolder1           |
       | d:getcontenttype | httpd/unix-directory |
-      | oc:permissions   | SR                   |
+      | oc:permissions   | S                    |
     Examples:
       | dav_version |
       | old         |
@@ -44,7 +44,7 @@ Feature: REPORT request to Shares space
       | oc:shareroot       | /folderMain                            |
       | oc:name            | frodo.txt                              |
       | d:getcontenttype   | text/plain                             |
-      | oc:permissions     | SR                                     |
+      | oc:permissions     | S                                      |
       | d:getcontentlength | 34                                     |
     Examples:
       | dav_version |

tests/acceptance/features/apiContract/spacesReport.feature

@@ -33,7 +33,7 @@ Feature: Report test
       | oc:shareroot     | /folderMain          |
       | oc:name          | SubFolder1           |
       | d:getcontenttype | httpd/unix-directory |
-      | oc:permissions   | SR                   |
+      | oc:permissions   | S                    |
       | oc:size          | 12                   |
 
 
@@ -52,5 +52,5 @@ Feature: Report test
       | oc:shareroot       | /folderMain                                      |
       | oc:name            | insideTheFolder.txt                              |
       | d:getcontenttype   | text/plain                                       |
-      | oc:permissions     | SRDNVW                                           |
+      | oc:permissions     | SD                                               |
       | d:getcontentlength | 12                                               |

tests/acceptance/features/apiSpaces/download.feature

@@ -23,7 +23,7 @@ Feature: Download file in project space
       | role      | viewer |
 
 
-  Scenario Outline: An user downloads a file in the project space
+  Scenario Outline: A user downloads a file in the project space
     When user "<user>" downloads the file "file.txt" of the space "download file" using the WebDAV API
     Then the HTTP status code should be "200"
     And the following headers should be set
@@ -36,7 +36,7 @@ Feature: Download file in project space
       | Bob   |
 
 
-  Scenario Outline: An user downloads an old version of the file in the project space
+  Scenario Outline: users with role manager and editor can download an old version of the file in the project space
     Given user "Alice" has uploaded a file inside space "download file" with content "new content" to "file.txt"
     And user "Alice" has uploaded a file inside space "download file" with content "newest content" to "file.txt"
     When user "<user>" downloads version of the file "file.txt" with the index "1" of the space "download file" using the WebDAV API
@@ -53,4 +53,10 @@ Feature: Download file in project space
       | user  |
       | Alice |
       | Brian |
-      | Bob   |
+
+
+  Scenario: A user viewer cannot get the old version of the file in the project space
+    Given user "Alice" has uploaded a file inside space "download file" with content "new content" to "file.txt"
+    When user "Bob" tries to get version of the file "file.txt" with the index "1" of the space "download file" using the WebDAV API
+    Then the HTTP status code should be "403"
+

tests/acceptance/features/apiSpaces/restoreSpaceObjects.feature

@@ -116,50 +116,3 @@ Feature: Restore files, folder
       }
     }
     """
-
-
-  Scenario: The recipient can restore a file even if there is not enough owner's quota to do so
-    Given user "Admin" has changed the quota of the "Brian Murphy" space to "30"
-    And user "Brian" has uploaded file with content "file is less than 30 bytes" to "/file.txt"
-    And user "Brian" has uploaded file with content "reduceContent" to "/file.txt"
-    And user "Brian" has uploaded file with content "some content" to "newFile.txt"
-    And user "Brian" has shared file "file.txt" with user "Alice"
-    And user "Alice" has accepted share "/file.txt" offered by user "Brian"
-    And using new DAV path
-    When user "Alice" restores version index "1" of file "/Shares/file.txt" using the WebDAV API
-    Then the HTTP status code should be "204"
-    And the content of file "/Shares/file.txt" for user "Alice" should be "file is less than 30 bytes"
-    And for user "Brian" the JSON response should contain space called "Brian Murphy" and match
-    """
-     {
-      "type": "object",
-      "required": [
-        "quota"
-      ],
-      "properties": {
-        "quota": {
-          "type": "object",
-          "required": [
-            "state",
-            "total",
-            "remaining",
-            "used"
-          ],
-          "properties": {
-            "state" : {
-              "type": "string",
-              "enum": ["exceeded"]
-            },
-            "total" : {
-              "type": "number",
-              "enum": [30]
-            },
-            "used": {
-              "type": "number",
-              "enum": [38]
-            }
-          }
-        }
-      }
-    }
-    """

tests/acceptance/features/apiSpacesShares/changingFilesShare.feature

@@ -41,6 +41,8 @@ Feature:
     When user "Alice" downloads version of the file "/textfile1.txt" with the index "2" of the space "Personal" using the WebDAV API
     Then the HTTP status code should be "200"
     And the downloaded content should be "old content version 1"
-    When user "Brian" downloads version of the file "/textfile1.txt" with the index "1" of the space "Shares" using the WebDAV API
+    When user "Alice" downloads version of the file "/textfile1.txt" with the index "1" of the space "Personal" using the WebDAV API
     Then the HTTP status code should be "200"
     And the downloaded content should be "old content version 2"
+    When user "Brian" tries to get version of the file "/textfile1.txt" with the index "1" of the space "Shares" using the WebDAV API
+    Then the HTTP status code should be "403"

tests/acceptance/features/bootstrap/SpacesContext.php

@@ -2739,6 +2739,22 @@ public function downloadVersionOfTheFile(
 		WebDavHelper::$SPACE_ID_FROM_OCIS = '';
 	}
 
+	/**
+	 * @When /^user "([^"]*)" tries to get version of the file "([^"]*)" with the index "([^"]*)" of the space "([^"]*)" using the WebDAV API$/
+	 *
+	 * @param string $user
+	 * @param string $file
+	 * @param string $index
+	 * @param string $spaceName
+	 *
+	 * @return void
+	 * @throws Exception
+	 */
+	public function userTriesToDownloadFileVersions(string $user, string $file, string $index, string $spaceName):void {
+		$this->setSpaceIDByName($user, $spaceName);
+		$this->filesVersionsContext->userGetsFileVersions($user, $file);
+	}
+
 	/**
 	 * return the etag for an element inside a space
 	 *