Skip to content

feat(dav): limit scoped app passwords to the collections they open - #65552

Open
pringelmann wants to merge 3 commits into
feat/noid/app-password-route-gatefrom
feat/noid/app-password-dav-gate
Open

feat(dav): limit scoped app passwords to the collections they open#65552
pringelmann wants to merge 3 commits into
feat/noid/app-password-route-gatefrom
feat/noid/app-password-dav-gate

Conversation

@pringelmann

@pringelmann pringelmann commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

I'm new to DAV and leaned heavily on Claude for this PR. I went through the code with it until I understood how the plugin hooks into Sabre and why each rule is there, but reviews from people who know DAV well would help the most here, especially on the calendar and contacts rules.

Summary

Stacked on #65340, which does the same for index.php and OCS.

A Sabre plugin that 403s DAV requests outside the token's scopes and drops refused items from multistatus, so multiget can't get around it. Runs on remote.php/dav and the legacy caldav, carddav and webdav endpoints. Anything not listed is denied.

  • Files, uploads, bulk: files:dav:read / files:dav:write
  • App collections like trash, versions or team folders: the app's own scope, e.g. files_trashbin:dav:read
  • Which app owns a collection comes from its info.xml
  • Calendars and contacts: read or write by HTTP method. No sharing, publishing or proxies
  • Tags: closed for now

Tokens without scopes are unaffected.

Known limits

A calendar token also sees app calendars (Deck) and the birthday calendar.

Testing

Manually tested:

  • Thunderbird 140.17.0 with a [dav:calendar:read, dav:calendar:write] scoped token: finds calendars but no files, events sync both ways, external invites go out. A files token finds no calendars.

  • Curl with a files token: reaches files and legacy webdav, but not trash, versions, tags or team folders until you add their scopes.

Checklist

  • Code is properly formatted
  • Sign-off message is added to all commits
  • Tests (unit, integration, api and/or acceptance) are included
  • Screenshots before/after for front-end changes
  • Documentation (manuals or wiki) has been updated or is not required
  • Backports requested where applicable (ex: critical bugfixes)
  • Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
  • Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

  • The content of this PR was partly or fully generated using AI (some dav-related code, tests, all reviewed by me)

@pringelmann pringelmann added this to the Nextcloud 36 milestone Oct 15, 2026
@pringelmann pringelmann self-assigned this Oct 15, 2026
@pringelmann pringelmann added the 3. to review Waiting for reviews label Oct 15, 2026
@pringelmann
pringelmann requested a review from a team as a code owner October 15, 2026 13:19
@pringelmann
pringelmann added this pull request to stack #65341 October 15, 2026 13:19
@pringelmann
pringelmann removed the request for review from a team October 15, 2026 13:19
@pringelmann pringelmann added the feature: carddav Related to CardDAV internals label Oct 15, 2026
@pringelmann pringelmann added the team: IDP Code maintained by 🪪 IDP team label Oct 15, 2026
@pringelmann
pringelmann requested review from CarlSchwan, artonge, come-nc and nickvergessen and removed request for sorbaugh October 15, 2026 13:19
@pringelmann
pringelmann marked this pull request as draft October 15, 2026 15:47
@pringelmann pringelmann removed the 3. to review Waiting for reviews label Oct 15, 2026
@pringelmann

pringelmann commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Drafting for now, got feedback that necessitates major changes

@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from 0e6e023 to 533a200 Compare October 15, 2026 20:17
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from 533a200 to b14c33a Compare October 15, 2026 20:30
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from b14c33a to 388b0a0 Compare October 16, 2026 07:38
@pringelmann pringelmann added the 3. to review Waiting for reviews label Oct 16, 2026
@pringelmann
pringelmann marked this pull request as ready for review October 16, 2026 08:29
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch 2 times, most recently from 929e6e2 to 1cc45f6 Compare October 16, 2026 11:11
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch 3 times, most recently from a117cd2 to df59eca Compare October 20, 2026 15:22
@pringelmann
pringelmann requested a review from susnux October 22, 2026 08:15
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from df59eca to 38450b4 Compare October 22, 2026 08:16
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch 2 times, most recently from 047839f to abe7192 Compare October 22, 2026 12:48
@pringelmann pringelmann removed the 3. to review Waiting for reviews label Oct 22, 2026
@pringelmann

pringelmann commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Got some major feedback, putting back into draft mode for now

@pringelmann
pringelmann marked this pull request as draft October 22, 2026 14:52
@pringelmann pringelmann added the 2. developing Work in progress label Oct 23, 2026
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from 4471705 to 523a613 Compare October 23, 2026 08:57
@pringelmann
feat(dav): limit scoped app passwords to the collections they open
a032b9d 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
test(dav): use the app-owned scope names in the integration tests
c27652d 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
refactor(dav): let apps own the scopes of their DAV collections
98aca83 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
pringelmann force-pushed the feat/noid/app-password-dav-gate branch from 523a613 to 98aca83 Compare October 23, 2026 08:58
@pringelmann pringelmann added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Oct 23, 2026
@pringelmann
pringelmann marked this pull request as ready for review October 23, 2026 09:07
@pringelmann pringelmann mentioned this pull request Oct 23, 2026
Open
5 of 7 tasks

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leftybournes leftybournes Awaiting requested review from leftybournes leftybournes is a code owner automatically assigned from nextcloud/server-backend
@provokateurin provokateurin Awaiting requested review from provokateurin provokateurin is a code owner automatically assigned from nextcloud/server-backend
@come-nc come-nc Awaiting requested review from come-nc come-nc is a code owner automatically assigned from nextcloud/server-backend
@nickvergessen nickvergessen Awaiting requested review from nickvergessen
@artonge artonge Awaiting requested review from artonge
@CarlSchwan CarlSchwan Awaiting requested review from CarlSchwan
@susnux susnux Awaiting requested review from susnux
@icewind1991 icewind1991 Awaiting requested review from icewind1991
@salmart-dev salmart-dev Awaiting requested review from salmart-dev
@ChristophWurst ChristophWurst Awaiting requested review from ChristophWurst

At least 2 approving reviews are required to merge this pull request.

Assignees

@pringelmann pringelmann

Labels

3. to review Waiting for reviews feature: authentication feature: caldav Related to CalDAV internals feature: carddav Related to CardDAV internals feature: dav security team: IDP Code maintained by 🪪 IDP team

Projects

None yet

Milestone

Nextcloud 36

Development

Successfully merging this pull request may close these issues.

Scoped app passwords: DAV

1 participant

@pringelmann