when requesting with a rule having a group as approver, do not share the file with the group if it already has access

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

lib/Service/ApprovalService.php

@@ -582,7 +582,7 @@ private function shareWithApprovers(int $fileId, array $rule, string $userId): a
 		}
 		if ($this->shareManager->allowGroupSharing()) {
 			foreach ($rule['approvers'] as $approver) {
-				if ($approver['type'] === 'group') {
+				if ($approver['type'] === 'group' && !$this->utilsService->groupHasAccessTo($fileId, $approver['entityId'])) {
 					if ($this->utilsService->createShare($node, IShare::TYPE_GROUP, $approver['entityId'], $fileOwner, $label)) {
 						$createdShares[] = $approver;
 					}

lib/Service/UtilsService.php

@@ -12,6 +12,8 @@
 namespace OCA\Approval\Service;
 
 use Exception;
+use OCP\IGroup;
+use OCP\IGroupManager;
 use OCP\IUserManager;
 use OCP\IUser;
 use OCP\Files\IRootFolder;
@@ -41,19 +43,25 @@ class UtilsService {
 	 * @var ISystemTagManager
 	 */
 	private $tagManager;
+	/**
+	 * @var IGroupManager
+	 */
+	private $groupManager;
 
 	/**
 	 * Service providing storage, circles and tags tools
 	 */
 	public function __construct(string $appName,
 								IUserManager $userManager,
+								IGroupManager $groupManager,
 								IShareManager $shareManager,
 								IRootFolder $root,
 								ISystemTagManager $tagManager) {
 		$this->userManager = $userManager;
 		$this->shareManager = $shareManager;
 		$this->root = $root;
 		$this->tagManager = $tagManager;
+		$this->groupManager = $groupManager;
 	}
 
 	/**
@@ -154,6 +162,26 @@ public function userHasAccessTo(int $fileId, ?string $userId): bool {
 		return false;
 	}
 
+	/**
+	 * Return false if at least one member of the group does not have access to the file
+	 *
+	 * @param int $fileId
+	 * @param string|null $groupId
+	 * @return bool
+	 */
+	public function groupHasAccessTo(int $fileId, ?string $groupId): bool {
+		$group = $this->groupManager->get($groupId);
+		if ($group instanceof IGroup) {
+			foreach ($group->getUsers() as $groupUser) {
+				if (!$this->userHasAccessTo($fileId, $groupUser->getUID())) {
+					return false;
+				}
+			}
+			return true;
+		}
+		return false;
+	}
+
 	/**
 	 * @param string $name of the new tag
 	 * @return array