cozy-sharing 38.1.9 → 38.1.10

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [38.1.10](https://github.com/cozy/cozy-libs/compare/cozy-sharing@38.1.9...cozy-sharing@38.1.10) (2026-10-05)
+
+### Bug Fixes
+
+- **cozy-sharing:** Respect nested permissions in hasWriteAccess ([b04a8aa](https://github.com/cozy/cozy-libs/commit/b04a8aa6bda15e5ef5dfa357c3c75a5fdc040e1a))
+
 ## [38.1.9](https://github.com/cozy/cozy-libs/compare/cozy-sharing@38.1.8...cozy-sharing@38.1.9) (2026-10-04)
 
 **Note:** Version bump only for package cozy-sharing

package/dist/SharingProvider.js

@@ -1225,21 +1225,21 @@ export var SharingProvider = /*#__PURE__*/function (_Component) {
     }());
 
     _defineProperty(_this2, "hasWriteAccess", function (docId) {
+      var _this2$state$byDocId;
+
       var driveId = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : undefined;
 
       var instanceUri = _this2.props.client.getStackClient().uri;
-      /** Split another case for checking sharing type for shared drive
-       * In case of shared drive, we just check if shared drive has write access or not.
-       * All the files / folders inside must follow the sharing rule of shared drive.
-       * `driveId` only exist in files / folders from recipient, so we don't need to check it belong to owner or not.
-       */
 
+      if ((_this2$state$byDocId = _this2.state.byDocId) !== null && _this2$state$byDocId !== void 0 && _this2$state$byDocId[docId]) {
+        return _isOwner(_this2.state, docId) || _getSharingType(_this2.state, docId, instanceUri) === SHARING_TYPE.TWO_WAY;
+      }
 
       if (driveId) {
         return getSharedDriveSharingType(_this2.state, driveId, instanceUri) === SHARING_TYPE.TWO_WAY;
       }
 
-      return !_this2.state.byDocId || !_this2.state.byDocId[docId] || _isOwner(_this2.state, docId) || _getSharingType(_this2.state, docId, instanceUri) === SHARING_TYPE.TWO_WAY;
+      return true;
     });
 
     var _instanceUri = props.client.getStackClient().uri;

package/dist/SharingProvider.spec.js

@@ -1714,83 +1714,111 @@ describe('updateSharingMemberType', function () {
       }
     }, _callee39);
   })));
-}); // TODO Convert with react-testing-library
-// describe('hasWriteAccess', () => {
-//   it('tells if a doc is writtable', () => {
-//     const client = createMockClient({})
-//     client.stackClient.uri = 'http://cozy.tools:8080'
-//     const component = mount(
-//       <AppWrapper client={client}>
-//         <SharingContext.Consumer>
-//           {({ hasWriteAccess }) => (
-//             <>
-//               <div data-id="no-sharing">
-//                 {hasWriteAccess('no-sharing') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="owner-doc">
-//                 {hasWriteAccess('owner-doc') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="synced-doc">
-//                 {hasWriteAccess('synced-doc') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="read-only-doc">
-//                 {hasWriteAccess('read-only-doc') ? 'yes' : 'no'}
-//               </div>
-//             </>
-//           )}
-//         </SharingContext.Consumer>
-//       </AppWrapper>
-//     )
-//     expect(component.find('div[data-id="no-sharing"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="owner-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="synced-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="read-only-doc"]').text()).toBe('yes')
-//     const provider = component.find(SharingProvider)
-//     provider.instance().dispatch(
-//       receiveSharings({
-//         sharings: [
-//           {
-//             id: '123',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: true,
-//               members: [
-//                 { read_only: false, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [{ values: ['owner-doc'] }]
-//             }
-//           },
-//           {
-//             id: '456',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: false,
-//               members: [
-//                 { read_only: false, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [
-//                 { values: ['synced-doc'], update: 'sync', remove: 'sync' }
-//               ]
-//             }
-//           },
-//           {
-//             id: '789',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: false,
-//               members: [
-//                 { read_only: true, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [{ values: ['read-only-doc'] }]
-//             }
-//           }
-//         ]
-//       })
-//     )
-//     component.update()
-//     expect(component.find('div[data-id="no-sharing"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="owner-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="synced-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="read-only-doc"]').text()).toBe('no')
-//   })
-// })
+});
+describe('hasWriteAccess', function () {
+  var createClient = function createClient() {
+    var client = createMockClient({});
+    client.getStackClient().uri = 'http://cozy.tools:8080';
+    return client;
+  };
+
+  var parentSharing = {
+    id: 'parent-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: false,
+      drive: true,
+      members: [{
+        read_only: true,
+        instance: 'http://cozy.tools:8080'
+      }],
+      rules: [{
+        values: ['parent-folder']
+      }]
+    }
+  };
+  var nestedSharing = {
+    id: 'nested-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: false,
+      drive: true,
+      members: [{
+        read_only: false,
+        instance: 'http://cozy.tools:8080'
+      }],
+      rules: [{
+        values: ['nested-folder']
+      }]
+    }
+  };
+  var ownerSharing = {
+    id: 'owner-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: true,
+      drive: true,
+      members: [{
+        read_only: false,
+        instance: 'http://cozy.tools:8080'
+      }],
+      rules: [{
+        values: ['owner-folder']
+      }]
+    }
+  };
+  it('returns true when document is not shared and no driveId is provided', function () {
+    var provider = setupProvider(createClient());
+    expect(provider.hasWriteAccess('unshared-doc')).toBe(true);
+  });
+  it('returns true when user is owner of the shared document', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [ownerSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('owner-folder')).toBe(true);
+    expect(provider.hasWriteAccess('owner-folder', 'owner-drive')).toBe(true);
+  });
+  it('returns false for viewer of a shared document', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [parentSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('parent-folder')).toBe(false);
+  });
+  it('returns true for editor of a shared document', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [nestedSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('nested-folder')).toBe(true);
+  });
+  it('returns drive write access when document has no explicit sharing', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [parentSharing, nestedSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('child-file', 'parent-drive')).toBe(false);
+    expect(provider.hasWriteAccess('child-file', 'nested-drive')).toBe(true);
+  });
+  it('takes nested document permissions into account when driveId is provided (issue linagora/twake-drive#4220)', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [parentSharing, nestedSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('nested-folder', 'parent-drive')).toBe(true);
+  });
+  it('takes nested restricted permissions into account when driveId is editor', function () {
+    var provider = setupProvider(createClient());
+    provider.dispatch(receiveSharings({
+      sharings: [parentSharing, nestedSharing],
+      permissions: []
+    }));
+    expect(provider.hasWriteAccess('parent-folder', 'nested-drive')).toBe(false);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cozy-sharing",
-  "version": "38.1.9",
+  "version": "38.1.10",
   "description": "Provides sharing login for React applications.",
   "main": "dist/index.js",
   "author": "Cozy",
@@ -58,7 +58,7 @@
     "cozy-intent": "^2.31.1",
     "cozy-minilog": "^3.10.1",
     "cozy-ui": "^140.5.0",
-    "cozy-ui-plus": "^13.0.13",
+    "cozy-ui-plus": "^13.0.14",
     "jest": "30.3.0",
     "jest-environment-jsdom": "30.3.0",
     "react": "16.12.0",
@@ -84,5 +84,5 @@
   "sideEffects": [
     "*.css"
   ],
-  "gitHead": "02232de9e42ac348ae884a19e7ebfc981dd9cc63"
+  "gitHead": "17bfcc354f9462050e38fa5c826b4e2cc91fedd3"
 }

package/src/SharingProvider.jsx

@@ -718,11 +718,13 @@ export class SharingProvider extends Component {
   hasWriteAccess = (docId, driveId = undefined) => {
     const instanceUri = this.props.client.getStackClient().uri
 
-    /** Split another case for checking sharing type for shared drive
-     * In case of shared drive, we just check if shared drive has write access or not.
-     * All the files / folders inside must follow the sharing rule of shared drive.
-     * `driveId` only exist in files / folders from recipient, so we don't need to check it belong to owner or not.
-     */
+    if (this.state.byDocId?.[docId]) {
+      return (
+        isOwner(this.state, docId) ||
+        getSharingType(this.state, docId, instanceUri) === SHARING_TYPE.TWO_WAY
+      )
+    }
+
     if (driveId) {
       return (
         getSharedDriveSharingType(this.state, driveId, instanceUri) ===
@@ -730,12 +732,7 @@ export class SharingProvider extends Component {
       )
     }
 
-    return (
-      !this.state.byDocId ||
-      !this.state.byDocId[docId] ||
-      isOwner(this.state, docId) ||
-      getSharingType(this.state, docId, instanceUri) === SHARING_TYPE.TWO_WAY
-    )
+    return true
   }
 
   render() {

package/src/SharingProvider.spec.jsx

@@ -1330,88 +1330,107 @@ describe('updateSharingMemberType', () => {
   })
 })
 
-// TODO Convert with react-testing-library
-// describe('hasWriteAccess', () => {
-//   it('tells if a doc is writtable', () => {
-//     const client = createMockClient({})
-//     client.stackClient.uri = 'http://cozy.tools:8080'
-
-//     const component = mount(
-//       <AppWrapper client={client}>
-//         <SharingContext.Consumer>
-//           {({ hasWriteAccess }) => (
-//             <>
-//               <div data-id="no-sharing">
-//                 {hasWriteAccess('no-sharing') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="owner-doc">
-//                 {hasWriteAccess('owner-doc') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="synced-doc">
-//                 {hasWriteAccess('synced-doc') ? 'yes' : 'no'}
-//               </div>
-//               <div data-id="read-only-doc">
-//                 {hasWriteAccess('read-only-doc') ? 'yes' : 'no'}
-//               </div>
-//             </>
-//           )}
-//         </SharingContext.Consumer>
-//       </AppWrapper>
-//     )
-
-//     expect(component.find('div[data-id="no-sharing"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="owner-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="synced-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="read-only-doc"]').text()).toBe('yes')
-
-//     const provider = component.find(SharingProvider)
-//     provider.instance().dispatch(
-//       receiveSharings({
-//         sharings: [
-//           {
-//             id: '123',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: true,
-//               members: [
-//                 { read_only: false, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [{ values: ['owner-doc'] }]
-//             }
-//           },
-//           {
-//             id: '456',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: false,
-//               members: [
-//                 { read_only: false, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [
-//                 { values: ['synced-doc'], update: 'sync', remove: 'sync' }
-//               ]
-//             }
-//           },
-//           {
-//             id: '789',
-//             type: 'io.cozy.sharings',
-//             attributes: {
-//               owner: false,
-//               members: [
-//                 { read_only: true, instance: 'http://cozy.tools:8080' }
-//               ],
-//               rules: [{ values: ['read-only-doc'] }]
-//             }
-//           }
-//         ]
-//       })
-//     )
-
-//     component.update()
-
-//     expect(component.find('div[data-id="no-sharing"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="owner-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="synced-doc"]').text()).toBe('yes')
-//     expect(component.find('div[data-id="read-only-doc"]').text()).toBe('no')
-//   })
-// })
+describe('hasWriteAccess', () => {
+  const createClient = () => {
+    const client = createMockClient({})
+    client.getStackClient().uri = 'http://cozy.tools:8080'
+    return client
+  }
+
+  const parentSharing = {
+    id: 'parent-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: false,
+      drive: true,
+      members: [{ read_only: true, instance: 'http://cozy.tools:8080' }],
+      rules: [{ values: ['parent-folder'] }]
+    }
+  }
+
+  const nestedSharing = {
+    id: 'nested-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: false,
+      drive: true,
+      members: [{ read_only: false, instance: 'http://cozy.tools:8080' }],
+      rules: [{ values: ['nested-folder'] }]
+    }
+  }
+
+  const ownerSharing = {
+    id: 'owner-drive',
+    type: 'io.cozy.sharings',
+    attributes: {
+      owner: true,
+      drive: true,
+      members: [{ read_only: false, instance: 'http://cozy.tools:8080' }],
+      rules: [{ values: ['owner-folder'] }]
+    }
+  }
+
+  it('returns true when document is not shared and no driveId is provided', () => {
+    const provider = setupProvider(createClient())
+    expect(provider.hasWriteAccess('unshared-doc')).toBe(true)
+  })
+
+  it('returns true when user is owner of the shared document', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({ sharings: [ownerSharing], permissions: [] })
+    )
+    expect(provider.hasWriteAccess('owner-folder')).toBe(true)
+    expect(provider.hasWriteAccess('owner-folder', 'owner-drive')).toBe(true)
+  })
+
+  it('returns false for viewer of a shared document', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({ sharings: [parentSharing], permissions: [] })
+    )
+    expect(provider.hasWriteAccess('parent-folder')).toBe(false)
+  })
+
+  it('returns true for editor of a shared document', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({ sharings: [nestedSharing], permissions: [] })
+    )
+    expect(provider.hasWriteAccess('nested-folder')).toBe(true)
+  })
+
+  it('returns drive write access when document has no explicit sharing', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({
+        sharings: [parentSharing, nestedSharing],
+        permissions: []
+      })
+    )
+    expect(provider.hasWriteAccess('child-file', 'parent-drive')).toBe(false)
+    expect(provider.hasWriteAccess('child-file', 'nested-drive')).toBe(true)
+  })
+
+  it('takes nested document permissions into account when driveId is provided (issue linagora/twake-drive#4220)', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({
+        sharings: [parentSharing, nestedSharing],
+        permissions: []
+      })
+    )
+    expect(provider.hasWriteAccess('nested-folder', 'parent-drive')).toBe(true)
+  })
+
+  it('takes nested restricted permissions into account when driveId is editor', () => {
+    const provider = setupProvider(createClient())
+    provider.dispatch(
+      receiveSharings({
+        sharings: [parentSharing, nestedSharing],
+        permissions: []
+      })
+    )
+    expect(provider.hasWriteAccess('parent-folder', 'nested-drive')).toBe(false)
+  })
+})