feat(user-management): add “Add existing account” dialog and provisio… #53114

cushdog · 2025-05-26T06:52:43Z

Resolves: Groups: Allow group admins to assign existing users #11334

Summary

This PR adds two related features:

Frontend
- A new “Add existing account” button in the User Management navigation.
- A modal dialog (AddExistingUserDialog.vue) that lets group-admins search for existing users and assign them to the currently selected group.
- Vuex state (showAddExistingUserForm) persisted alongside the “New account” form flag to open/close the dialog.
Backend
- A new Provisioning API endpoint:
```
GET /ocs/v2.php/cloud/users/search?search=<query>
```
  Returns a JSON map of userId => displayName for all Nextcloud users matching the search string.
- Access restricted to admins, delegated admins, and subadmins (throws 403 otherwise).

Screenshots

Before	After

TODO

Unit tests
- Frontend: tests for AddExistingUserDialog.vue (rendering, search behavior, submit).
- Backend: tests for UsersController::searchAllUsers() (success and 403 cases).
Integration/API tests for the new /users/search endpoint.
Screenshots (before/after) of the new “Add existing account” button and dialog.
Documentation
- Update the Admin Manual / Provisioning API docs to include /users/search.
- Add a note in the “Groups” section of the User docs about this UI change.
Backport request to the 32 and 31 branches if this lands post-release.

Checklist

Code is properly formatted
All commits carry a valid DCO sign-off
Tests (unit, integration, API) are included
Screenshots before/after for front-end changes
Documentation (manuals or wiki) updated or noted “not required”
Backports requested for stable branches where applicable

Note

I just wanted to quickly note that I didn't update the documentation yet, since I wasn't sure if that should only be updated after this pull-request is potentially accepted!

nickvergessen · 2025-05-26T07:16:13Z

apps/provisioning_api/appinfo/routes.php

@@ -25,31 +25,32 @@
 		['root' => '/cloud', 'name' => 'Groups#deleteGroup', 'url' => '/groups/{groupId}', 'verb' => 'DELETE', 'requirements' => ['groupId' => '.+']],

 		// Users
-		['root' => '/cloud', 'name' => 'Users#getUsers', 'url' => '/users', 'verb' => 'GET'],


Can you run composer run cs:fix locally?

Done! Thanks for the catch!

Hmpf the reformating is still there

apps/provisioning_api/lib/Controller/UsersController.php

susnux · 2025-05-26T11:41:48Z

apps/provisioning_api/lib/Controller/UsersController.php

+	 * 200: Users returned
+	 */
+	#[NoAdminRequired]
+	public function searchAllUsers(string $search = '', ?int $limit = null, int $offset = 0): DataResponse {


Is this not exactly what getUsers does? It also has a search param

Yeah there is no need for a new endpoint, the frontend should use the existing ones unless there’s a really good reason.
I think getUsersDetails is the one to use as displaynames are needed, I suppose this is what the rest of the frontend uses (I did not check).

Sorry about this! Changed this and did a much simpler version of what I had before, let me know what you think now!

susnux · 2025-05-26T11:42:40Z

apps/settings/src/components/Users/AddExistingUserDialog.vue

+</template>
+
+<script>
+import { translate as t } from '@nextcloud/l10n'


Suggested change

import { translate as t } from '@nextcloud/l10n'

import { t } from '@nextcloud/l10n'

susnux · 2025-05-26T11:43:29Z

apps/settings/src/components/Users/AddExistingUserDialog.vue

+  </NcDialog>
+</template>
+
+<script>


I would prefer new files to be Typescript.

Suggested change

<script>

<script lang="ts">

(and then use defineComponent below)

Also fixed!

susnux · 2025-05-26T11:43:50Z

apps/settings/src/views/UserManagementNavigation.vue

 				<template #icon>
 					<NcIconSvgWrapper :path="mdiCog" />
 				</template>
-				{{ t('settings', 'Account management settings') }}
+				{{ t("settings", "Account management settings") }}


we use single quotes

Noted and fixed!

susnux · 2025-05-26T11:44:37Z

apps/settings/src/views/UserManagementNavigation.vue

please use npm run lint:fix locally. This contains a lot of fixable issues like usage of semicolon or double quotes.

sorbaugh · 2025-05-26T14:43:49Z

@cushdog for ease of reviewing, can you re-upload the screenshots directly to Github?

Here is a nice example of how you can add the Before/After screenshots: #52423

Thanks again for the PR!

cushdog · 2025-05-27T08:02:23Z

Note: just wanted to quickly apologize for the change in commit history, ran into a bit of git trouble that I was able to work out with a force commit!

come-nc · 2025-05-27T08:34:12Z

apps/provisioning_api/lib/Controller/UsersController.php

@@ -116,7 +116,7 @@ public function getUsers(string $search = '', ?int $limit = null, int $offset =
 		$subAdminManager = $this->groupManager->getSubAdmin();
 		$isAdmin = $this->groupManager->isAdmin($uid);
 		$isDelegatedAdmin = $this->groupManager->isDelegatedAdmin($uid);
-		if ($isAdmin || $isDelegatedAdmin) {
+		if ($isAdmin || $isDelegatedAdmin || $subAdminManager->isSubAdmin($user)) {


This allows group admins to see all users.
@sorbaugh What is the design decision on this? It will be enabled by default? It is a big change.

The linked issue talks about limiting to displayname and a few things, which is not done here, but not sure it would be enough. We might want to safe guard behind an opt-in config flag, at least for upgrades.

User iteration is not in our threat model, thus not a problem.
What is a problem is that more information as uid and displayname might be available.

Then again this is not a problem, because if we accept this feature, then every group admin can assign users to their group gaining full admin access over them.
So this means a group admin then has the same permissions on user management as admins, as there are not restrictions anymore (they can just add a user to their group and then adjust the user as they like).

For this its good to have approval of @nickvergessen for security point of view.

So, the API already allows some extend of it.
Using http requests I as able, as a group admin, to add some users to my groups.

I am not sure why we need to change the API 🤔

We need to change the API so that group admins can list all users, to be able to chose which ones they want to add to their groups

Is the consensus that I would need to change the API then? I couldn't see any way to go about listing all users without adding in some new endpoint that only group-admins could access, which is why my original commit included a change to the API routes.

We need to change the API so that group admins can list all users, to be able to chose which ones they want to add to their group

Right, so only the listing API needs a change. Other than that it should be working already.

My thoughts exactly, I'll revert back to the API-change approach I committed originally!

come-nc · 2025-05-27T08:34:25Z

.htaccess

+#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####
+
+ErrorDocument 403 /index.php/error/403
+ErrorDocument 404 /index.php/error/404


Should not be commited

come-nc · 2025-05-27T08:34:56Z

apps/provisioning_api/appinfo/routes.php

+		['root' => '/cloud', 'name' => 'Users#getUsers',                     'url' => '/users',                       'verb' => 'GET'],
+		['root' => '/cloud', 'name' => 'Users#getUsersDetails',             'url' => '/users/details',               'verb' => 'GET'],
+		['root' => '/cloud', 'name' => 'Users#getDisabledUsersDetails',     'url' => '/users/disabled',              'verb' => 'GET'],


Please reset this file space changes and only commit it if there are real changes.

come-nc · 2025-05-27T08:35:26Z

apps/settings/l10n/cs.json

@@ -313,7 +313,6 @@
    "Architecture" : "Architektura",
    "64-bit" : "64bit",
    "It seems like you are running a 32-bit PHP version. Nextcloud needs 64-bit to run well. Please upgrade your OS and PHP to 64-bit!" : "Zdá se, že provozujete 32bitovou verzi PHP. Aby správně fungoval, potřebuje Nextcloud 64bit. Přejděte na 64bit instalaci operačního systému a PHP!",
-    "Task Processing pickup speed" : "Rychlost vyzvedávání zpracovávání úkolů",


All these l10n diff seems unrelated, or did I miss something?

I never actually added these to my changes but they were committed anyways for some reason, I'll see if I can't fix this.

come-nc · 2025-05-27T08:36:11Z

openapi.json

@@ -25242,6 +25242,104 @@
                }
            }
        },
+        "/ocs/v2.php/cloud/users/search": {


openapi.json should be regenerated now that the new route is gone.

cushdog · 2025-05-29T02:00:55Z

Apologies, working right now on unstaging the huge amount of extra files that got added in for some reason

…nges

cushdog · 2025-05-29T06:21:14Z

Apologies, working right now on unstaging the huge amount of extra files that got added in for some reason

Ok I think I figured this out, apologies I had to do quite a few git operations I wasn't familiar with!

cushdog requested review from provokateurin and a team as code owners May 26, 2025 06:52

cushdog requested review from ArtificialOwl, skjnldsv, susnux and artonge and removed request for a team May 26, 2025 06:52

nickvergessen reviewed May 26, 2025

View reviewed changes

apps/provisioning_api/lib/Controller/UsersController.php Outdated Show resolved Hide resolved

AndyScherzinger added 3. to review Waiting for reviews feature: users and groups labels May 26, 2025

susnux reviewed May 26, 2025

View reviewed changes

cushdog force-pushed the feat/11334-account-endpoint branch from 4e16a51 to 66091a4 Compare May 27, 2025 07:04

cushdog requested a review from a team as a code owner May 27, 2025 07:04

come-nc reviewed May 27, 2025

View reviewed changes

cushdog requested review from ChristophWurst, miaulalala, st3iny, hamza221, SebastianKrupinski and tcitworld as code owners May 29, 2025 01:54

cushdog force-pushed the feat/11334-account-endpoint branch 4 times, most recently from c26dd3b to 64731fe Compare May 29, 2025 05:59

feat(user-management): add AddExistingUserDialog and provisioning cha…

1f8e6c6

…nges

cushdog force-pushed the feat/11334-account-endpoint branch from 64731fe to 1f8e6c6 Compare May 29, 2025 06:20

fix(user-list): took out comments

3d7b41c

	import { translate as t } from '@nextcloud/l10n'
	import { t } from '@nextcloud/l10n'

Uh oh!

feat(user-management): add “Add existing account” dialog and provisio… #53114

Are you sure you want to change the base?

feat(user-management): add “Add existing account” dialog and provisio… #53114

Uh oh!

Conversation

cushdog commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

TODO

Checklist

Note

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sorbaugh commented May 26, 2025

Uh oh!

cushdog commented May 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cushdog commented May 29, 2025

Uh oh!

cushdog commented May 29, 2025

Uh oh!

Uh oh!

cushdog commented May 26, 2025 •

edited

Loading