* fix: [OCISDEV-810] fix the space role and custom role checks
* test: [OCISDEV-810] expect 400 when updating a share to a disabled role
The update (PATCH) permission handlers now enforce the admin role
allowlist, consistent with invite. Updating a share to a disabled role
(Secure Viewer, Denied, Space Editor Without Versions) therefore returns
400 instead of the previous silent 200. Update the @issue-10768 scenarios
to assert the new, correct behavior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
from now on, not all unified roles are enabled by default, instead the available roles are hand-picked in the default setup.
For advanced use-cases, the administrator is capable to enable the desired set of available roles.
Picking roles is not easy since the uid is NOT humanly readable, therefore a cli is contained which lists the available, disabled and enabled roles.
This is an initial implementation of PATCH support on drives/{driveid}/items/{itemid}/permissions/{id}.
It focusses on updating user shares for now. It's possible to update the
expirationDate, roles and/or libregraphResourceActions.
Updating the permissions of a space root or a public link share is currently
not implemeted.
