fix(webhook-listeners): revert admin check and document delegation behaviour

Signed-off-by: Jana Peper <jana.peper@nextcloud.com>

Author: janepie

apps/webhook_listeners/lib/Controller/WebhooksController.php

@@ -26,10 +26,8 @@
 use OCP\AppFramework\OCS\OCSForbiddenException;
 use OCP\AppFramework\OCS\OCSNotFoundException;
 use OCP\AppFramework\OCSController;
-use OCP\IGroupManager;
 use OCP\IRequest;
 use OCP\ISession;
-use OCP\IUserSession;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -44,8 +42,6 @@ public function __construct(
 		private WebhookListenerMapper $mapper,
 		private ?string $userId,
 		private ISession $session,
-		private IUserSession $userSession,
-		private IGroupManager $groupManager,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -154,12 +150,6 @@ public function create(
 		} catch (\ValueError $e) {
 			throw new OCSBadRequestException('This auth method does not exist');
 		}
-
-		$user = $this->userSession->getUser();
-		if (!$user || !$this->groupManager->isAdmin($user->getUID())) {
-			$tokenNeeded = null;
-		}
-
 		try {
 			$webhookListener = $this->mapper->addWebhookListener(
 				$appId,

apps/webhook_listeners/lib/Service/TokenService.php

@@ -63,6 +63,8 @@ public function __construct(
 	 * ]
 	 * Created auth tokens are valid for 1 hour.
 	 *
+	 * With this, admin tokens can be created. Therefore, the admin delegation for webhooks is considered a full admin role. This is by design.
+	 *
 	 * @param WebhookListener $webhookListener
 	 * @param ?string $triggerUserId the user that triggered the webhook call
 	 * @return array{

apps/webhook_listeners/lib/Settings/Admin.php

@@ -15,6 +15,8 @@
 
 /**
  * Empty settings class, used only for admin delegation for now as there is no UI
+ * ATTENTION this admin delegation can create tokens with full admin rights and is therefore considered as a full admin role
+ *
  */
 class Admin implements IDelegatedSettings {
 	/**
@@ -38,7 +40,7 @@ public function getPriority(): int {
 	#[\Override]
 	public function getName(): ?string {
 		/* Use section name alone */
-		return null;
+		return 'Attention: can create tokens with full admin rights';
 	}
 
 	#[\Override]