Skip password confirmation for ocs-apirequest

[kinolaev]

Problem: OAuth client cannot use some part of nextcloud API 30 minutes after authentication because nextcloud requires password confirmation even for requests withocs-apirequest: true and authorization: Bearer ... headers.
Solution: Skip password confirmation for requests with mentioned headers (as already implemented in SecurityMiddleware)

I will add tests later If you find that this is right thing)

Also it will be good to make method isOcsApiRequest to not duplicate this checks in 2 middlewares. Is Request class right place for this?

Related: #6476

[rullzer]

@kinolaev what requests are this actually?

[kinolaev]

Controllers with PasswordConfirmationRequired annotation are affected. Change quota (doc, code) for example.

[kinolaev]

@rullzer, affected methods are:

• apps/provisioning_api/lib/Controller/AppConfigController.php: setValue, deleteKey
• apps/provisioning_api/lib/Controller/AppsController.php: enable, disable
• apps/provisioning_api/lib/Controller/GroupsController.php: addGroup, updateGroup, deleteGroup
• apps/provisioning_api/lib/Controller/UsersController.php: addUser, editUser, wipeUserDevices, deleteUser, disableUser, enableUser, addToGroup, removeFromGroup, addSubAdmin, removeSubAdmin, resendWelcomeMessage

There are methods with PasswordConfirmationRequired annotation in other classes, but they don't inherit OCP\AppFramework\OCSController, so password confirmation still required for that methods.

[kinolaev]

Hello @rullzer, do you agree that password confirmation must be removed for ocs-apirequests and oauth client requests?
I mean need I add tests or this PR will not be merged for some reason?

[rullzer]

@kinolaev I was just busy with other stuff ;)

So the reason we want password confirmation is that they are sensitive operations (possibly destructive). And there is no real reason that if you have an apppassword this check should be no longer valid.

I would like it better if we could signal back that a password needs to be send as well and then the user just needs to enter their password also when doing this when sending an OCS-APIRequest.

I'll think a bit how that can be done.

[danielsss]

any updates ?

[LukasReschke]

Closing as there has been no traction on this.