[Sharing NG] Link password capabilities are not being respected on update

[JammingBen]

Describe the bug

The capabilities for link passwords are not being respected on update.

Steps to reproduce

1. Make sure oCIS is configured to have passwords enforced for all link types
2. Create a public link for a file and give it a password
3. Change the link's type to internal, which will remove the password because internal links don't have a password
4. Update the link's type to edit without setting a new password (PATCH to e.g. https://host.docker.internal:9200/graph/v1beta1/drives/e310554b-25a9-4f97-a423-8b1ff5d77254%24ff10588e-0c68-46c1-a984-c859f8fbdd20/items/e310554b-25a9-4f97-a423-8b1ff5d77254%24ff10588e-0c68-46c1-a984-c859f8fbdd20\u0021c984993a-d361-45a1-b829-9231ee827c81/permissions/tSclcXHFrIvAnaB)

Expected behavior

The server should throw an error like "passwords are enforced".

Actual behavior

The link is being updated sucsessfully.

Note that there are some edge cases to this scenario. I don't remember the details, but if I'm not mistaken, admins can remove an existing password for the view role despite passwords being enforced. So in the example above, changing the type to view should still be possible without password (for admins). Maybe @micbar or @tbsbdr can confirm this.

[micbar]

There is a special case: some users can leave the password out when updating.

[micbar]

Story: #7538

[micbar]

@JammingBen Can we close this? Please check if you can follow my understanding of the expected behavior.

@AlexAndBear Was implementing that.

[JammingBen]

@JammingBen Can we close this? Please check if you can follow my understanding of the expected behavior.

@AlexAndBear Was implementing that.

Alex implemented this in Web. But the API still allows to change the role, therefore ignoring the capabilities. IMO that should be fixed.

[micbar]

You are right!
4.) is exactly the case where you PATCH the link, but that should only allow view links.

@rhafer @fschade Should be a quick fix.

[rhafer]

This was fixed with cs3org/reva#4622