Activities. Sharee can get the shared file activities using the file-id

[prashant-gurung899]

Steps to reproduce

1. share a folder to demo user

2. as demo, create some files in the received share

3. as demo, check the shared file activities using share mountpoint id (same as webUI)

   curl 'https://localhost:9200/graph/v1beta1/extensions/org.libregraph/activities?kql=itemid%3A{folder-share-mountpoint}' \
   -udemo:demo -vk | jq 
   

   {"value": []}

4. as demo, check the shared file activities using shared file id ❓

   curl 'https://localhost:9200/graph/v1beta1/extensions/org.libregraph/activities?kql=itemid%3A{folder-fileid}' \
   -udemo:demo -vk | jq
   

   {"value": [
     {
      ... # activities
     }
   ]}

[prashant-gurung899]

@ScharfViktor

This case : #9860 (comment) has been fixed by PR: #10092 but
the following scenario where sharee tries to get the activities of a shared folder with it's folder-id is not fixed.
Steps:

• admin shares folder f1 to einstein
• einstein gets the folderId of folder f1 in the Shares -> copy folderId from Propfind response body
• put folderId to

curl 'https://localhost:9200/graph/v1beta1/extensions/org.libregraph/activities?kql=itemid%3A{folderId}' \
-ueinstein:relativity -vk | jq

expected: 403 error

Actual: einstein can see all action of folder f1

Same applies with files inside the folder f1. Einstein can get the activities of files with their fileId.

[ScharfViktor]

Actual: einstein can see all action of folder f1

user can see not only activity of the shared folder f1. he can see all activity of the admin personal space if he uses kql=itemid%3A{spaceUUID} - couldn't reproduce it CC @kobergj

2 question: @tbsbdr should be einstein see activity of the shared folder?
or the recipient should not see activity of the shared resources anyway?

[ScharfViktor]

related #9860

[tbsbdr]

@ScharfViktor lets do it this way: recipients should not see activity of the shared resources. Lets keep it simple and gdpr compliant

[kobergj]

Currently view access is enough to query activities. (That was agreed on for initial implementation). We will need to check for another permission instead.

@micbar should we use ListGrants? This should probably be enough as you cannot share with Share permission any more.

[micbar]

@kobergj @tbsbdr

I like the idea to use ListGrants. Then we would see activitites only in "Transparent" Shares.

[tbsbdr]

I'm not a fan of having too many variations of the product behaviour, but I do not veto your propsal @micbar . I just want to document my concerns: I expect "transparent shares" to be a project specific feature, so same would then apply to the visibility of activities.

[micbar]

@kobergj Please add that to the dev docs on the unified Roles Page.