No capabilities in public context with password

[pascalwengerter]

Steps to reproduce

1. Receive a public link share with password
2. Don't see any behavior that is communicated via capabilities from the backend

Expected behaviour

Not necessarily all capabilities, but at least the most interesting ones should be available for the web frontend in an unauthenticated password protected context

Actual behaviour

No capabilities are available in an unauthenticated password protected context since they only get loaded when initializing a user session (

web/packages/web-runtime/src/store/user.js

Line 99 in 808be1a

const capabilities = await client.getCapabilities()

)

Qualification

• Check if fetching capabilities is authenticated in OC10
• Check if fetching capabilities is authenticated in oCIS

[kulmann]

Capabilities for public links are not available as of now. Ideally we would use the public auth middleware for oCIS for making capabilities available on public links. For oc10 the solution is not clear, but less pressing since the two linked tickets are oCIS-only features so far.

[fschade]

currently this is fixed for public links without password, but not for public links with password, we use this as tracking issue.

[diocas]

can we have an ETA for this?