Skip to content

feat(settings): UI picker for what an app password can access - #65692

Open
pringelmann wants to merge 12 commits into
feat/noid/app-password-dav-gatefrom
feat/noid/app-password-access-picker
Open

feat(settings): UI picker for what an app password can access#65692
pringelmann wants to merge 12 commits into
feat/noid/app-password-dav-gatefrom
feat/noid/app-password-access-picker

Conversation

@pringelmann

@pringelmann pringelmann commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Lets users pick what an app password can reach when they create it, and change it later from the row menu ("Edit access").

  • Presets: All access, Files only, Calendar and contacts, Custom
  • Custom: Files, Calendar and Contacts with sub-options. Files: sharing, restoring deleted files, restoring older versions. Calendar and Contacts: editing
  • The Files preset is files and sharing, without trash and versions
  • Scopes the picker doesn't know are kept on save (e.g. set through the API)

"Can edit files" and the read-only files preset come with read-only tokens (#65532), since they need the mount permission mask first.

Screenshots

Note

The picker layout is provisional. It works and is tested, but how Custom... looks may change once the app entry and shared service scopes are merged and we know what the full picker needs to show.

Before After
Create before-create after-create
Custom access custom-access
List before-rows after-rows
Row menu before-menu after-menu

Checklist

  • Code is properly formatted
  • Sign-off message is added to all commits
  • Tests (unit, integration, api and/or acceptance) are included
  • Screenshots before/after for front-end changes
  • Documentation (manuals or wiki) has been updated or is not required
  • Backports requested where applicable (ex: critical bugfixes)
  • Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
  • Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

  • The content of this PR was partly or fully generated using AI (tests, reviewed by me)

@pringelmann pringelmann self-assigned this Oct 19, 2026
@pringelmann
pringelmann added this pull request to stack #65341 October 19, 2026 13:17
@pringelmann pringelmann added this to the Nextcloud 36 milestone Oct 20, 2026
@pringelmann
pringelmann marked this pull request as ready for review October 20, 2026 09:24
@pringelmann
pringelmann requested review from a team as code owners October 20, 2026 09:24
@pringelmann
pringelmann requested review from Altahrim, CarlSchwan, artonge, come-nc, icewind1991, kristian-zendato, skjnldsv, sorbaugh and susnux and removed request for a team October 20, 2026 09:24
skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthToken.vue Outdated
skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthToken.vue Outdated
skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthTokenAccessDialog.vue Outdated
skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthTokenAccessDialog.vue Outdated
skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthTokenAccessDialog.vue Outdated
skjnldsv
skjnldsv requested changes Oct 20, 2026
View reviewed changes

@skjnldsv skjnldsv left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking real good!! A few comments of various importance (or not) :)

skjnldsv
skjnldsv reviewed Oct 20, 2026
View reviewed changes
Comment thread apps/settings/src/authtokens/components/AuthTokenAccessDialog.vue Outdated
@pringelmann
pringelmann force-pushed the feat/noid/app-password-access-picker branch from a7305b3 to ce1384c Compare October 20, 2026 13:34
@pringelmann
pringelmann requested a review from skjnldsv October 20, 2026 14:24
@artonge
artonge removed the request for review from sorbaugh October 20, 2026 14:51
@pringelmann
pringelmann force-pushed the feat/noid/app-password-access-picker branch 2 times, most recently from 029d53a to d67513e Compare October 20, 2026 15:22
@pringelmann pringelmann mentioned this pull request Oct 21, 2026
Open
3 of 7 tasks
@pringelmann
pringelmann force-pushed the feat/noid/app-password-access-picker branch from d67513e to bf65425 Compare October 22, 2026 08:16
@pringelmann
pringelmann force-pushed the feat/noid/app-password-access-picker branch 2 times, most recently from 2067f73 to c024cb8 Compare October 22, 2026 12:48
@pringelmann
feat(settings): accept scopes when creating an app password
55f486e 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): map app password scopes to access levels
69683bc 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): set app password scopes from the store
0d6e8f9 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): add the app password access picker
2e5a87c 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
refactor(settings): use the app-owned scope names
cc4204a 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): choose app password access when creating and editing
4bbde63 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): add sub-options to the app password access picker
f3d0abf 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
fix(settings): polish the app password access picker
a164add 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
refactor(settings): simplify the app password access picker
d0d5973 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
fix(settings): align the app password access dialog with the other di…
1bf9593 
…alogs

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
fix(settings): use native form validation in the app password access …
d1ecbb7 
…dialog

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
feat(settings): add DAV access and restore options to the Files access
9a76fbb 
Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
@pringelmann
pringelmann force-pushed the feat/noid/app-password-access-picker branch from c024cb8 to 9a76fbb Compare October 23, 2026 09:31

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@artonge artonge artonge approved these changes
@susnux susnux Awaiting requested review from susnux susnux is a code owner automatically assigned from nextcloud/server-frontend
@kristian-zendato kristian-zendato Awaiting requested review from kristian-zendato kristian-zendato is a code owner automatically assigned from nextcloud/server-frontend
@icewind1991 icewind1991 Awaiting requested review from icewind1991 icewind1991 is a code owner automatically assigned from nextcloud/server-backend
@Altahrim Altahrim Awaiting requested review from Altahrim Altahrim is a code owner automatically assigned from nextcloud/server-backend
@come-nc come-nc Awaiting requested review from come-nc come-nc is a code owner automatically assigned from nextcloud/server-backend
@CarlSchwan CarlSchwan Awaiting requested review from CarlSchwan
@skjnldsv skjnldsv Awaiting requested review from skjnldsv

Requested changes must be addressed to merge this pull request.

Assignees

@pringelmann pringelmann

Labels

3. to review Waiting for reviews AI assisted enhancement feature: authentication security team: IDP Code maintained by 🪪 IDP team

Projects

None yet

Milestone

Nextcloud 36

Development

Successfully merging this pull request may close these issues.

Scoped app passwords: access picker

3 participants

@pringelmann @artonge @skjnldsv