[pringelmann]

Part of nextcloud/server#65523

Note

Needs nextcloud/server#65340, which refuses app passwords limited to scopes on every route without a #[TokenScope]. Until that is merged, nextcloud/ocp doesn't have the attribute class, so psalm will complain.
This stays in Draft until then.

Summary

Adds the notifications:notifications:read scope to the notifications list, push registration (mobile and web push) and your own notification settings.

Dismissing a notification and changing your own settings are also open under this scope. Both only touch your own account, so a separate write scope didn't seem worth an extra checkbox. Happy to be convinced otherwise.

Admin settings stay closed.

Manually tested:

• A Files key gets 403 on the list, dismiss and push registration, and passes with the scope added.
• Settings and web push stay 403.

The checkbox in Settings follows in server once this is merged.

AI

• Partly generated with AI

[nickvergessen]

Stays closed:

• web push (browser only)

Web push is used by mobile apps that don't use google play services. So should also be allowed
I would also add the personal settings route if that is possible without the admin one, as we could allow clients to change that setting going forward.

[pringelmann]

Stays closed:

• web push (browser only)

Web push is used by mobile apps that don't use google play services. So should also be allowed I would also add the personal settings route if that is possible without the admin one, as we could allow clients to change that setting going forward.

Makes sense thanks, I didn’t know web push was used by apps 👍 Opened both web push and the personal settings route.