public sharing

[hweihwang]

No description provided.

[juliushaertl]

We should also limit this to single file shares (see https://github.com/nextcloud/text/blob/main/src/public.js#L143-L151 how text checks for if a files table is rendered)

[juliushaertl]

We should make sure to set the viewModeEnabled to enforce read only depending on permissions in the frontend: https://docs.excalidraw.com/docs/@excalidraw/excalidraw/api/props/#viewmodeenabled

In addition we should also block handling SCENE_INIT payloads from read only clients on the node backend

[hweihwang]

@juliushaertl Yes we already have that and working okay with sharing to specific person:

async serverBroadcastHandler(socket, roomID, encryptedData, iv) {
		const isReadOnly = await this.isSocketReadOnly(socket.id)
		if (!socket.rooms.has(roomID) || isReadOnly) return

		socket.broadcast.to(roomID).emit('client-broadcast', encryptedData, iv)

		const decryptedData = JSON.parse(Utils.convertArrayBufferToString(encryptedData))
		const socketData = await this.socketDataManager.getSocketData(socket.id)
		const userSocketsAndIds = await this.getUserSocketsAndIds(roomID)

		await this.roomDataManager.syncRoomData(
			roomID,
			decryptedData.payload.elements,
			userSocketsAndIds.map(u => u.userId),
			socketData.user.id,
		)
	}

this.socket.on('read-only', () => this.handleReadOnlySocket())

Find out that i have wrongly taken the permissions of the Share, it should be $share->getPermissions() instead of getting the File of that Share first and do $file->getPermissions(), correct me if I'm wrong :)

[juliushaertl]

Ok, strange, I would actually expect $share->getNode()->getPermissions() to return the correct ones as well