Re-enable ACLs for team folders

lib/ACL/ACLStorageWrapper.php

@@ -22,19 +22,25 @@ class ACLStorageWrapper extends Wrapper implements IConstructableStorage {
 	private readonly bool $inShare;
 	private readonly int $folderId;
 	private readonly int $storageId;
+	private readonly bool $isTeamSpace;
 
 	/**
-	 * @param array{storage: Storage, acl_manager: ACLManager, in_share: bool, folder_id: int, storage_id: int} $arguments
+	 * @param array{storage: Storage, acl_manager: ACLManager, in_share: bool, folder_id: int, storage_id: int, is_team_space: bool} $arguments
 	 */
 	public function __construct(array $arguments) {
 		parent::__construct($arguments);
 		$this->aclManager = $arguments['acl_manager'];
 		$this->inShare = $arguments['in_share'];
 		$this->folderId = $arguments['folder_id'];
 		$this->storageId = $arguments['storage_id'];
+		$this->isTeamSpace = $arguments['is_team_space'];
 	}
 
 	private function getACLPermissionsForPath(string $path): int {
+		if ($this->isProtectedTeamSpacePath($path)) {
+			return Constants::PERMISSION_ALL;
+		}
+
 		$permissions = $this->aclManager->getACLPermissionsForPath($this->folderId, $this->storageId, $path);
 
 		// if there is no read permissions, than deny everything
@@ -47,6 +53,10 @@ private function getACLPermissionsForPath(string $path): int {
 		return $canRead ? $permissions : 0;
 	}
 
+	private function isProtectedTeamSpacePath(string $path): bool {
+		return $this->isTeamSpace && ($path === '.system' || str_starts_with($path, '.system/'));
+	}
+
 	private function checkPermissions(string $path, int $permissions): bool {
 		return ($this->getACLPermissionsForPath($path) & $permissions) === $permissions;
 	}
@@ -169,6 +179,10 @@ public function unlink(string $path): bool {
 	 * This check is fairly expensive so we only do it for the actual delete and not metadata operations
 	 */
 	private function canDeleteTree(string $path): int {
+		if ($this->isProtectedTeamSpacePath($path)) {
+			return Constants::PERMISSION_DELETE;
+		}
+
 		return $this->aclManager->getPermissionsForTree($this->folderId, $this->storageId, $path) & Constants::PERMISSION_DELETE;
 	}
 

lib/DAV/ACLPlugin.php

@@ -93,6 +93,16 @@ private function getParents(string $path): array {
 		return $paths;
 	}
 
+	private function isProtectedTeamSpacePath(GroupMountPoint $mount, string $path): bool {
+		$folder = $this->folderManager->getFolder($mount->getFolderId());
+		if ($folder === null || !$folder->isTeamSpace()) {
+			return false;
+		}
+
+		$path = ltrim($path, '/');
+		return $path === '.system' || str_starts_with($path, '.system/');
+	}
+
 	public function propFind(PropFind $propFind, INode $node): void {
 		if (!$node instanceof Node) {
 			return;
@@ -227,7 +237,7 @@ public function propPatch(string $path, PropPatch $propPatch): void {
 		}
 
 		// Mapping the old property to the new property.
-		$propPatch->handle(self::ACL_LIST, function (array $rawRules) use ($path): bool {
+		$propPatch->handle(self::ACL_LIST, function (array $rawRules) use ($path, $mount): bool {
 			if ($this->server === null) {
 				return false;
 			}
@@ -238,6 +248,9 @@ public function propPatch(string $path, PropPatch $propPatch): void {
 			}
 
 			$fileInfo = $node->getFileInfo();
+			if ($this->isProtectedTeamSpacePath($mount, $fileInfo->getInternalPath())) {
+				throw new BadRequest($this->l10n->t('Advanced permissions cannot be changed for the reserved .system directory.'));
+			}
 
 			$fileInfoId = $fileInfo->getId();
 			if ($fileInfoId === null) {

lib/Migration/Version2300000Date20260922000000.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\GroupFolders\Migration;
+
+use Closure;
+use OCP\DB\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version2300000Date20260922000000 extends SimpleMigrationStep {
+	public function __construct(
+		private readonly IDBConnection $connection,
+	) {
+	}
+
+	#[\Override]
+	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
+		$query = $this->connection->getQueryBuilder();
+		$query->update('group_folders')
+			->set('acl', $query->createNamedParameter(true, IQueryBuilder::PARAM_BOOL))
+			->where($query->expr()->isNotNull('team_circle_id'));
+		$query->executeStatement();
+	}
+}

lib/Mount/FolderStorageManager.php

@@ -116,6 +116,7 @@ private function getBaseStorageForFolderSeparate(
 				'acl_manager' => $aclManager,
 				'in_share' => $inShare,
 				'folder_id' => $folderId,
+				'is_team_space' => $folder->isTeamSpace(),
 				// already loaded with the folder; avoids a storages lookup per folder
 				'storage_id' => $folder->storageId,
 			]);
@@ -251,6 +252,7 @@ private function getBaseStorageForFolderRootJail(
 				'acl_manager' => $aclManager,
 				'in_share' => $inShare,
 				'folder_id' => $folderId,
+				'is_team_space' => $folder->isTeamSpace(),
 				// already loaded; the same id MountProvider uses for rule lookups (incl. legacy root-jail)
 				'storage_id' => $folder->storageId,
 			]);

lib/TeamSpace/TeamSpaceService.php

@@ -62,6 +62,7 @@ public function createTeamSpace(string $circleId, string $mountPoint, int $quota
 			}
 
 			$this->folderManager->addApplicableGroup($folderId, $circleId);
+			$this->folderManager->setFolderACL($folderId, true);
 			$this->folderManager->setManageACL($folderId, 'circle', $circleId, true);
 
 			$this->folderManager->setTeamCircleId($folderId, $circleId);

tests/ACL/ACLScannerTest.php

@@ -61,6 +61,7 @@ public function testScanAclStorage(): void {
 			'in_share' => false,
 			'folder_id' => 0,
 			'storage_id' => $cache->getNumericStorageId(),
+			'is_team_space' => false,
 		]);
 
 		$scanner = $aclStorage->getScanner();

tests/ACL/ACLStorageWrapperTest.php

@@ -37,9 +37,40 @@
 			'in_share' => false,
 			'folder_id' => 0,
 			'storage_id' => $this->source->getCache()->getNumericStorageId(),
+			'is_team_space' => true,
 		]);
 	}
 
+	public function testTeamSpaceSystemDirectoryBypassesACL(): void {
+		$this->source->mkdir('.system');
+		$this->source->touch('.system/app-data.json');
+		$this->source->mkdir('.system-copy');
+
+		$this->aclPermissions['.system'] = 0;
+		$this->aclPermissions['.system/app-data.json'] = 0;
+		$this->aclPermissions['.system-copy'] = 0;
+
+		$this->assertTrue($this->storage->isReadable('.system'));
+		$this->assertTrue($this->storage->isReadable('.system/app-data.json'));
+		$this->assertFalse($this->storage->isReadable('.system-copy'));
+	}
+
+	public function testRegularGroupFolderSystemDirectoryHonorsACL(): void {
+		$this->source->mkdir('.system');
+		$this->aclPermissions['.system'] = 0;
+
+		$storage = new ACLStorageWrapper([
+			'storage' => $this->source,
+			'acl_manager' => $this->aclManager,
+			'in_share' => false,
+			'folder_id' => 0,
+			'storage_id' => $this->source->getCache()->getNumericStorageId(),
+			'is_team_space' => false,
+		]);
+
+		$this->assertFalse($storage->isReadable('.system'));
+	}
+
 	public function testNoReadImpliesNothing(): void {
 		$this->source->mkdir('foo');
 		$this->aclPermissions['foo'] = Constants::PERMISSION_ALL - Constants::PERMISSION_READ;

tests/TeamSpace/TeamSpaceServiceTest.php

@@ -58,6 +58,7 @@ static function (string $path) use (&$scannedPaths): void {
 		);
 		$this->folderManager->expects($this->once())->method('setFolderQuota')->with(42, 1024);
 		$this->folderManager->expects($this->once())->method('addApplicableGroup')->with(42, 'team-1');
+		$this->folderManager->expects($this->once())->method('setFolderACL')->with(42, true);
 		$this->folderManager->expects($this->once())->method('setManageACL')->with(42, 'circle', 'team-1', true);
 		$this->folderManager->expects($this->once())->method('setTeamCircleId')->with(42, 'team-1');