feat(auth): store scopes on app passwords by pringelmann · Pull Request #65268 · nextcloud/server

pringelmann · 2026-10-07T09:47:18Z

Summary

First step towards limited app passwords: a token can now carry a list of scopes. This PR only stores them. Apart from files access nothing enforces them yet, and there's no UI.

How scopes work

Stored as a scopes key in the existing scope JSON column, so no migration
OAuth-style names, defined by the app that owns the data: files:read, files:share in files, calendar:read, contacts:write etc. in dav
Each scope stands on its own. Files are the exception: every files scope needs files:read, and files:read needs files:write until read-only files exist
No scopes key means full access. That's every existing token, unchanged
Empty list or anything malformed means no access
Existing filesystem flag stays and is derived from files:read, so code reading it keeps working
Per-app scopes come later (app:<appid>)

Change description

A new internal helper reads and validates the scope list
The files access check uses it for tokens that have scopes
Saving a token no longer wipes its scopes. Before, every save replaced the stored permissions with the single filesystem flag sent by the browser. Now the server merges the change, ignores that flag on scoped tokens and only checks the shape of the list. Setting scopes to null resets the token to full access
The occ token list shows the scopes

Next step

Enforcement on routes and DAV, then the access picker in Settings.

Checklist

Code is properly formatted
Sign-off message is added to all commits
Tests (unit, integration, api and/or acceptance) are included
Screenshots before/after for front-end changes
Documentation (manuals or wiki) has been updated or is not required
Backports requested where applicable (ex: critical bugfixes)
Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

The content of this PR was partly or fully generated using AI (tests, reviewed)

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

artonge · 2026-10-15T14:41:30Z

+	private const VOCABULARY = [
+		// Read-only files need a permissions mask on the mounts, which does not exist yet
+		self::FILES_READ => self::FILES_WRITE,
+		self::FILES_WRITE => self::FILES_READ,
+		self::FILES_SHARE => self::FILES_READ,
+		self::CALENDAR_READ => null,
+		self::CALENDAR_WRITE => self::CALENDAR_READ,
+		self::CONTACTS_READ => null,
+		self::CONTACTS_WRITE => self::CONTACTS_READ,
+	];
+


If we do not have a valid use case behind scope's dependency, then we can probably drop that.

artonge · 2026-10-15T14:41:40Z

+
+	public const FILES_READ = 'files:read';
+	public const FILES_WRITE = 'files:write';
+	public const FILES_SHARE = 'files:share';


Suggested change

public const FILES_SHARE = 'files:share';

public const FILES_SHARE = 'files_sharing:write';

artonge · 2026-10-15T14:44:09Z

+	public const FILES_READ = 'files:read';
+	public const FILES_WRITE = 'files:write';
+	public const FILES_SHARE = 'files:share';
+	public const CALENDAR_READ = 'calendar:read';
+	public const CALENDAR_WRITE = 'calendar:write';
+	public const CONTACTS_READ = 'contacts:read';
+	public const CONTACTS_WRITE = 'contacts:write';


I think those should be move within their respective app to keep this service ressource agnostic.
Unless we have a good reason to have those here.

artonge · 2026-10-15T14:45:03Z

+	 *
+	 * @throws \InvalidArgumentException
+	 */
+	public function mergeUpdate(array $stored, array $requested): array {


It might make it more explicit regarding what the method actually does:

Suggested change

public function mergeUpdate(array $stored, array $requested): array {

public function mergeScopes(array $scope1, array $scope2): array {

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

pringelmann added this to the Nextcloud 36 milestone Oct 7, 2026

pringelmann self-assigned this Oct 7, 2026

pringelmann requested a review from a team as a code owner October 7, 2026 09:47

pringelmann requested review from Altahrim, CarlSchwan and leftybournes and removed request for a team October 7, 2026 09:47

pringelmann added the enhancement label Oct 7, 2026

pringelmann requested a review from provokateurin October 7, 2026 09:47

pringelmann added 3. to review Waiting for reviews security feature: authentication feature: settings team: IDP Code maintained by 🪪 IDP team labels Oct 7, 2026

pringelmann requested a review from come-nc October 7, 2026 09:47

pringelmann mentioned this pull request Oct 7, 2026

Allow to restrict app password data access #2866

Open

pringelmann requested a review from artonge October 7, 2026 09:52

come-nc reviewed Oct 7, 2026

View reviewed changes

Comment thread lib/private/Authentication/Token/Scopes.php Outdated

come-nc requested changes Oct 7, 2026

View reviewed changes

pringelmann force-pushed the feat/noid/app-password-scope-storage branch from f50f496 to dd472f6 Compare October 7, 2026 10:53

pringelmann requested a review from come-nc October 7, 2026 11:01

come-nc reviewed Oct 7, 2026

View reviewed changes

Comment thread apps/settings/lib/Controller/AuthSettingsController.php

pringelmann force-pushed the feat/noid/app-password-scope-storage branch from dd472f6 to e3ec082 Compare October 7, 2026 12:27

sunjam mentioned this pull request Oct 7, 2026

Scoped Access for Oauth Tokens #26233

Open

pringelmann requested a review from come-nc October 8, 2026 07:44

come-nc approved these changes Oct 8, 2026

View reviewed changes

pringelmann mentioned this pull request Oct 9, 2026

feat(auth): limit scoped app passwords to the routes they open #65340

Draft

5 of 7 tasks

pringelmann added this pull request to stack #65341 October 9, 2026 11:15

pringelmann added 2 commits October 9, 2026 13:25

feat(auth): add app password scope storage

c8c5dfe

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

fix(settings): stop app password updates from widening scopes

de651b3

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

feat(core): show app password scopes in occ list

3f0d7ab

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

pringelmann force-pushed the feat/noid/app-password-scope-storage branch from e3ec082 to 3f0d7ab Compare October 9, 2026 11:25

pringelmann requested a review from nickvergessen October 9, 2026 11:35

artonge reviewed Oct 15, 2026

View reviewed changes

refactor(auth): drop the app password scope dependency map

cc3d87e

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>

Navigation Menu

Repository navigation

feat(auth): store scopes on app passwords - #65268

feat(auth): store scopes on app passwords#65268
pringelmann wants to merge 4 commits into
masterfrom
feat/noid/app-password-scope-storage

pringelmann commented Oct 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

artonge Oct 15, 2026

Uh oh!

artonge Oct 15, 2026

Uh oh!

artonge Oct 15, 2026

Uh oh!

artonge Oct 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	public const FILES_SHARE = 'files:share';
	public const FILES_SHARE = 'files_sharing:write';

	public function mergeUpdate(array $stored, array $requested): array {
	public function mergeScopes(array $scope1, array $scope2): array {

Conversation

pringelmann commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How scopes work

Change description

Next step

Checklist

AI (if applicable)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

artonge Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

artonge Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

artonge Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

artonge Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pringelmann commented Oct 7, 2026 •

edited

Loading