From 71e9548b2752edb2e1e4b502264a50ed462d74ef Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Mon, 16 Oct 2023 12:06:34 +0200
Subject: [PATCH 1/6] feat: add permission checks for creating shares and
 favorites

---
 .../src/components/FilesList/QuickActions.vue |  2 +-
 .../Shares/Collaborators/RoleDropdown.vue     |  5 +-
 .../components/SideBar/Shares/FileLinks.vue   |  5 +-
 .../components/SideBar/Shares/FileShares.vue  |  5 +-
 packages/web-app-files/src/index.ts           |  2 +-
 .../src/helpers/resource/functions.ts         |  8 +--
 .../web-client/src/helpers/resource/types.ts  |  4 +-
 .../{resource.spec.ts => functions.spec.ts}   | 49 +++++++++++++++++++
 .../web-pkg/src/components/AppBar/AppBar.vue  |  6 ++-
 .../files/useFileActionsCreateQuicklink.ts    |  2 +-
 .../actions/files/useFileActionsFavorite.ts   |  5 +-
 .../actions/files/useFileActionsShowShares.ts |  4 +-
 packages/web-pkg/src/quickActions.ts          |  4 +-
 .../src/services/auth/abilities.ts            |  6 +++
 14 files changed, 91 insertions(+), 16 deletions(-)
 rename packages/web-client/tests/unit/helpers/resource/{resource.spec.ts => functions.spec.ts} (58%)

diff --git a/packages/web-app-files/src/components/FilesList/QuickActions.vue b/packages/web-app-files/src/components/FilesList/QuickActions.vue
index 375bb623215..09a9d66718b 100644
--- a/packages/web-app-files/src/components/FilesList/QuickActions.vue
+++ b/packages/web-app-files/src/components/FilesList/QuickActions.vue
@@ -49,7 +49,7 @@ export default defineComponent({
     const language = useGettext()
 
     const filteredActions = computed(() =>
-      pickBy(props.actions, (action) => action.displayed(props.item, store) === true)
+      pickBy(props.actions, (action) => action.displayed(props.item, store, ability) === true)
     )
 
     return {
diff --git a/packages/web-app-files/src/components/SideBar/Shares/Collaborators/RoleDropdown.vue b/packages/web-app-files/src/components/SideBar/Shares/Collaborators/RoleDropdown.vue
index 5ead5e145f9..2e6bae8a174 100644
--- a/packages/web-app-files/src/components/SideBar/Shares/Collaborators/RoleDropdown.vue
+++ b/packages/web-app-files/src/components/SideBar/Shares/Collaborators/RoleDropdown.vue
@@ -122,6 +122,7 @@ import {
 import * as uuid from 'uuid'
 import { defineComponent, inject, PropType, ComponentPublicInstance } from 'vue'
 import {
+  useAbility,
   useCapabilityFilesSharingAllowCustomPermissions,
   useCapabilityFilesSharingResharingDefault,
   useStore
@@ -166,7 +167,9 @@ export default defineComponent({
   emits: ['optionChange'],
   setup() {
     const store = useStore()
+    const ability = useAbility()
     return {
+      ability,
       resource: inject<Resource>('resource'),
       incomingParentShare: inject<Share>('incomingParentShare'),
       hasRoleCustomPermissions: useCapabilityFilesSharingAllowCustomPermissions(store),
@@ -202,7 +205,7 @@ export default defineComponent({
       return PeopleShareRoles.custom(this.resource.isFolder)
     },
     resourceIsSharable() {
-      return this.allowSharePermission && this.resource.canShare()
+      return this.allowSharePermission && this.resource.canShare({ ability: this.ability })
     },
     availableRoles() {
       if (this.resourceIsSpace) {
diff --git a/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue b/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
index 2832009aa51..621a8156a26 100644
--- a/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
+++ b/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
@@ -158,7 +158,8 @@ export default defineComponent({
   },
   setup() {
     const store = useStore()
-    const { can } = useAbility()
+    const ability = useAbility()
+    const { can } = ability
     const passwordPolicyService = usePasswordPolicyService()
     const hasResharing = useCapabilityFilesSharingResharing()
 
@@ -206,7 +207,7 @@ export default defineComponent({
         return false
       }
 
-      return unref(resource).canShare({ user: store.getters.user })
+      return unref(resource).canShare({ user: store.getters.user, ability })
     })
 
     const canEditLink = ({ permissions }: Share) => {
diff --git a/packages/web-app-files/src/components/SideBar/Shares/FileShares.vue b/packages/web-app-files/src/components/SideBar/Shares/FileShares.vue
index 37913851d4a..521cc41df18 100644
--- a/packages/web-app-files/src/components/SideBar/Shares/FileShares.vue
+++ b/packages/web-app-files/src/components/SideBar/Shares/FileShares.vue
@@ -89,6 +89,7 @@
 <script lang="ts">
 import { mapGetters, mapActions, mapState, mapMutations } from 'vuex'
 import {
+  useAbility,
   useStore,
   useCapabilityProjectSpacesEnabled,
   useCapabilityShareJailEnabled,
@@ -125,6 +126,7 @@ export default defineComponent({
   },
   setup() {
     const store = useStore()
+    const ability = useAbility()
     const { getMatchingSpace } = useGetMatchingSpace()
 
     const resource = inject<Ref<Resource>>('resource')
@@ -164,6 +166,7 @@ export default defineComponent({
 
     return {
       ...useShares(),
+      ability,
       resource,
       space: inject<Ref<SpaceResource>>('space'),
       matchingSpace,
@@ -270,7 +273,7 @@ export default defineComponent({
       if (isShareJail && !this.hasResharing) {
         return false
       }
-      return this.resource.canShare({ user: this.user })
+      return this.resource.canShare({ user: this.user, ability: this.ability })
     },
 
     noResharePermsMessage() {
diff --git a/packages/web-app-files/src/index.ts b/packages/web-app-files/src/index.ts
index 984466084a0..f25428d475a 100644
--- a/packages/web-app-files/src/index.ts
+++ b/packages/web-app-files/src/index.ts
@@ -76,7 +76,7 @@ export const navItems = (context): AppNavigationItem[] => {
         path: `/${appInfo.id}/favorites`
       },
       enabled(capabilities) {
-        return capabilities.files?.favorites
+        return capabilities.files?.favorites && context.$ability.can('read-all', 'Favorite')
       },
       priority: 20
     },
diff --git a/packages/web-client/src/helpers/resource/functions.ts b/packages/web-client/src/helpers/resource/functions.ts
index 7f3c144b55a..f54b3079a7e 100644
--- a/packages/web-client/src/helpers/resource/functions.ts
+++ b/packages/web-client/src/helpers/resource/functions.ts
@@ -155,8 +155,10 @@ export function buildResource(resource: WebDavResponseResource): Resource {
     canRename: function () {
       return this.permissions.indexOf(DavPermission.Renameable) >= 0
     },
-    canShare: function () {
-      return this.permissions.indexOf(DavPermission.Shareable) >= 0
+    canShare: function ({ ability }) {
+      return (
+        ability.can('create-all', 'Share') && this.permissions.indexOf(DavPermission.Shareable) >= 0
+      )
     },
     canCreate: function () {
       return this.permissions.indexOf(DavPermission.FolderCreateable) >= 0
@@ -182,7 +184,7 @@ export function buildResource(resource: WebDavResponseResource): Resource {
       return this.permissions.indexOf(DavPermission.Deny) >= 0
     },
     getDomSelector: () => extractDomSelector(id)
-  }
+  } satisfies Resource
   Object.defineProperty(r, 'nodeId', {
     get() {
       return extractNodeId(this.id)
diff --git a/packages/web-client/src/helpers/resource/types.ts b/packages/web-client/src/helpers/resource/types.ts
index ad075bf4364..fd590ada59c 100644
--- a/packages/web-client/src/helpers/resource/types.ts
+++ b/packages/web-client/src/helpers/resource/types.ts
@@ -18,6 +18,7 @@ export type AbilityActions =
 export type AbilitySubjects =
   | 'Account'
   | 'Drive'
+  | 'Favorite'
   | 'Group'
   | 'Language'
   | 'Logo'
@@ -25,6 +26,7 @@ export type AbilitySubjects =
   | 'ReadOnlyPublicLinkPassword'
   | 'Role'
   | 'Setting'
+  | 'Share'
 
 export type Ability = MongoAbility<[AbilityActions, AbilitySubjects]>
 export type AbilityRule = SubjectRawRule<AbilityActions, AbilitySubjects, any>
@@ -84,7 +86,7 @@ export interface Resource {
   canCreate?(): boolean
   canUpload?({ user }: { user?: User }): boolean
   canDownload?(): boolean
-  canShare?({ user }?: { user?: User }): boolean
+  canShare?({ user, ability }?: { user?: User; ability?: Ability }): boolean
   canRename?({ user }?: { user?: User; ability?: Ability }): boolean
   canBeDeleted?({ user }?: { user?: User; ability?: Ability }): boolean
   canBeRestored?(): boolean
diff --git a/packages/web-client/tests/unit/helpers/resource/resource.spec.ts b/packages/web-client/tests/unit/helpers/resource/functions.spec.ts
similarity index 58%
rename from packages/web-client/tests/unit/helpers/resource/resource.spec.ts
rename to packages/web-client/tests/unit/helpers/resource/functions.spec.ts
index 8e215d0305f..bddc2ffaf7d 100644
--- a/packages/web-client/tests/unit/helpers/resource/resource.spec.ts
+++ b/packages/web-client/tests/unit/helpers/resource/functions.spec.ts
@@ -1,9 +1,14 @@
+import { mock, mockDeep } from 'jest-mock-extended'
 import {
+  Ability,
   Resource,
+  WebDavResponseResource,
+  buildResource,
   extractDomSelector,
   extractExtensionFromFile,
   extractNameWithoutExtension
 } from '../../../../src/helpers'
+import { DavPermission, DavProperty } from '../../../../src/webdav/constants'
 
 describe('extractDomSelector', () => {
   it.each([
@@ -75,3 +80,47 @@ describe('filterResources', () => {
     })
   })
 })
+
+describe('buildResource', () => {
+  describe('canShare', () => {
+    it('is true when ability and share permissions are given', () => {
+      const webDavResponse = mockDeep<WebDavResponseResource>({
+        props: {
+          [DavProperty.Permissions]: DavPermission.Shareable,
+          [DavProperty.Tags]: undefined
+        }
+      })
+      const resource = buildResource(webDavResponse)
+      const ability = mock<Ability>()
+      ability.can.mockReturnValue(true)
+      expect(resource.canShare({ ability })).toBeTruthy()
+      expect(ability.can).toHaveBeenCalledWith('create-all', 'Share')
+    })
+    it('is false when ability is not given', () => {
+      const webDavResponse = mockDeep<WebDavResponseResource>({
+        props: {
+          [DavProperty.Permissions]: DavPermission.Shareable,
+          [DavProperty.Tags]: undefined
+        }
+      })
+      const resource = buildResource(webDavResponse)
+      const ability = mock<Ability>()
+      ability.can.mockReturnValue(false)
+      expect(resource.canShare({ ability })).toBeFalsy()
+      expect(ability.can).toHaveBeenCalledWith('create-all', 'Share')
+    })
+    it('is false when share permissions are not given', () => {
+      const webDavResponse = mockDeep<WebDavResponseResource>({
+        props: {
+          [DavProperty.Permissions]: '',
+          [DavProperty.Tags]: undefined
+        }
+      })
+      const resource = buildResource(webDavResponse)
+      const ability = mock<Ability>()
+      ability.can.mockReturnValue(true)
+      expect(resource.canShare({ ability })).toBeFalsy()
+      expect(ability.can).toHaveBeenCalledWith('create-all', 'Share')
+    })
+  })
+})
diff --git a/packages/web-pkg/src/components/AppBar/AppBar.vue b/packages/web-pkg/src/components/AppBar/AppBar.vue
index ec4e8cc1695..6b64f01eb84 100644
--- a/packages/web-pkg/src/components/AppBar/AppBar.vue
+++ b/packages/web-pkg/src/components/AppBar/AppBar.vue
@@ -100,6 +100,7 @@ import {
   useFileActionsRestore
 } from '../../composables/actions'
 import {
+  useAbility,
   useCapabilitySpacesMaxQuota,
   useFileActionsToggleHideShare,
   useRouteMeta,
@@ -165,6 +166,7 @@ export default defineComponent({
   setup(props, { emit }) {
     const store = useStore()
     const { $gettext } = useGettext()
+    const { can } = useAbility()
 
     const { actions: acceptShareActions } = useFileActionsAcceptShare({ store })
     const { actions: hideShareActions } = useFileActionsToggleHideShare({ store })
@@ -188,7 +190,9 @@ export default defineComponent({
     const breadcrumbMaxWidth = ref<number>(0)
     const isSearchLocation = useActiveLocation(isLocationCommonActive, 'files-common-search')
 
-    const hasSharesNavigation = computed(() => useSlots().hasOwnProperty('navigation'))
+    const hasSharesNavigation = computed(
+      () => useSlots().hasOwnProperty('navigation') && can('create-all', 'Share')
+    )
 
     const batchActions = computed(() => {
       let actions = [
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsCreateQuicklink.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsCreateQuicklink.ts
index 3221b94ebcf..ad45d70bdef 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActionsCreateQuicklink.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsCreateQuicklink.ts
@@ -56,7 +56,7 @@ export const useFileActionsCreateQuickLink = ({
             return false
           }
         }
-        return canShare(resources[0], store)
+        return canShare(resources[0], store, ability)
       },
       componentType: 'button',
       class: 'oc-files-actions-create-quicklink-trigger'
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsFavorite.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsFavorite.ts
index 14c12439f0a..0859575436a 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActionsFavorite.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsFavorite.ts
@@ -8,6 +8,7 @@ import { FileAction, FileActionOptions, useIsFilesAppActive } from '../../action
 import { useStore } from '../../store'
 import { useRouter } from '../../router'
 import { useClientService } from '../../clientService'
+import { useAbility } from '../../ability'
 
 export const useFileActionsFavorite = ({ store }: { store?: Store<any> } = {}) => {
   store = store || useStore()
@@ -16,6 +17,8 @@ export const useFileActionsFavorite = ({ store }: { store?: Store<any> } = {}) =
   const clientService = useClientService()
   const hasFavorites = useCapabilityFilesFavorites()
   const isFilesAppActive = useIsFilesAppActive()
+  const ability = useAbility()
+
   const handler = ({ resources }: FileActionOptions) => {
     store
       .dispatch('Files/markFavorite', {
@@ -58,7 +61,7 @@ export const useFileActionsFavorite = ({ store }: { store?: Store<any> } = {}) =
           return false
         }
 
-        return unref(hasFavorites)
+        return unref(hasFavorites) && ability.can('create-all', 'Favorite')
       },
       componentType: 'button',
       class: 'oc-files-actions-favorite-trigger'
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsShowShares.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsShowShares.ts
index 96294158115..f32860f9e63 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActionsShowShares.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsShowShares.ts
@@ -10,10 +10,12 @@ import { useRouter } from '../../router'
 import { useStore } from '../../store'
 import { Store } from 'vuex'
 import { FileAction, FileActionOptions } from '../types'
+import { useAbility } from '../../ability'
 
 export const useFileActionsShowShares = ({ store }: { store?: Store<any> } = {}) => {
   store = store || useStore()
   const router = useRouter()
+  const ability = useAbility()
   const { $gettext } = useGettext()
   const isFilesAppActive = useIsFilesAppActive()
 
@@ -46,7 +48,7 @@ export const useFileActionsShowShares = ({ store }: { store?: Store<any> } = {})
             return false
           }
         }
-        return canShare(resources[0], store)
+        return canShare(resources[0], store, ability)
       },
       componentType: 'button',
       class: 'oc-files-actions-show-shares-trigger'
diff --git a/packages/web-pkg/src/quickActions.ts b/packages/web-pkg/src/quickActions.ts
index 702eaf17a78..d5020c3b5c6 100644
--- a/packages/web-pkg/src/quickActions.ts
+++ b/packages/web-pkg/src/quickActions.ts
@@ -8,7 +8,7 @@ import { Ability } from '@ownclouders/web-client/src/helpers/resource/types'
 import { Store } from 'vuex'
 import { ApplicationQuickActions } from './apps'
 
-export function canShare(item, store) {
+export function canShare(item: Resource, store: Store<any>, ability: Ability) {
   const { capabilities } = store.state.user
   if (!capabilities.files_sharing || !capabilities.files_sharing.api_enabled) {
     return false
@@ -16,7 +16,7 @@ export function canShare(item, store) {
   if (item.isReceivedShare() && !capabilities.files_sharing.resharing) {
     return false
   }
-  return item.canShare()
+  return item.canShare({ ability })
 }
 
 export function showQuickLinkPasswordModal({ $gettext, store, passwordPolicyService }, onConfirm) {
diff --git a/packages/web-runtime/src/services/auth/abilities.ts b/packages/web-runtime/src/services/auth/abilities.ts
index 268329fb471..07c716e08b5 100644
--- a/packages/web-runtime/src/services/auth/abilities.ts
+++ b/packages/web-runtime/src/services/auth/abilities.ts
@@ -11,6 +11,11 @@ export const getAbilities = (
       { action: 'read-all', subject: 'Account' },
       { action: 'update-all', subject: 'Account' }
     ],
+    'Favorits.List.all': [{ action: 'read-all', subject: 'Favorite' }],
+    'Favorits.Write.all': [
+      { action: 'create-all', subject: 'Favorite' },
+      { action: 'update-all', subject: 'Favorite' }
+    ],
     'Groups.ReadWrite.all': [
       { action: 'create-all', subject: 'Group' },
       { action: 'delete-all', subject: 'Group' },
@@ -32,6 +37,7 @@ export const getAbilities = (
       { action: 'read-all', subject: 'Role' },
       { action: 'update-all', subject: 'Role' }
     ],
+    'Share.Create.all': [{ action: 'create-all', subject: 'Share' }],
     'Settings.ReadWrite.all': [
       { action: 'read-all', subject: 'Setting' },
       { action: 'update-all', subject: 'Setting' }

From a91091ca6d39b9185ee149119cf367e606baec80 Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Fri, 20 Oct 2023 13:19:10 +0200
Subject: [PATCH 2/6] test: add unit test for favorite permissions

---
 packages/web-runtime/src/services/auth/abilities.ts      | 4 ++--
 .../tests/unit/services/auth/abilities.spec.ts           | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/packages/web-runtime/src/services/auth/abilities.ts b/packages/web-runtime/src/services/auth/abilities.ts
index 07c716e08b5..4bb8a5e57a9 100644
--- a/packages/web-runtime/src/services/auth/abilities.ts
+++ b/packages/web-runtime/src/services/auth/abilities.ts
@@ -11,8 +11,8 @@ export const getAbilities = (
       { action: 'read-all', subject: 'Account' },
       { action: 'update-all', subject: 'Account' }
     ],
-    'Favorits.List.all': [{ action: 'read-all', subject: 'Favorite' }],
-    'Favorits.Write.all': [
+    'Favorites.List.all': [{ action: 'read-all', subject: 'Favorite' }],
+    'Favorites.Write.all': [
       { action: 'create-all', subject: 'Favorite' },
       { action: 'update-all', subject: 'Favorite' }
     ],
diff --git a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
index b874befa4c5..d061d538843 100644
--- a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
+++ b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
@@ -15,6 +15,15 @@ describe('getAbilities', () => {
     const expectedActions = ['create-all', 'delete-all', 'read-all', 'update-all']
     expect(abilities).toEqual(expectedActions.map((action) => ({ action, subject: 'Group' })))
   })
+  it.each([
+    { permissions: [''], expectedActions: [] },
+    { permissions: ['Favorites.List.all'], expectedActions: ['read-all'] },
+    { permissions: ['Favorites.Write.all'], expectedActions: ['create-all', 'update-all'] }
+  ])('gets correct abilities for subject "Favorites"', function (data) {
+    const abilities = getAbilities(data.permissions)
+    const expectedResult = data.expectedActions.map((action) => ({ action, subject: 'Favorite' }))
+    expect(abilities).toEqual(expectedResult)
+  })
   it('gets correct abilities for subject "Language"', function () {
     const abilities = getAbilities(['Language.ReadWrite.all'])
     const expectedActions = ['read-all', 'update-all']

From d51b3770514b3ec465ce71b4f581e9007f19d3e7 Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Fri, 20 Oct 2023 13:19:53 +0200
Subject: [PATCH 3/6] test: add unit test for share permissions

---
 .../web-runtime/tests/unit/services/auth/abilities.spec.ts   | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
index d061d538843..d76edb71882 100644
--- a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
+++ b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
@@ -44,6 +44,11 @@ describe('getAbilities', () => {
     const expectedActions = ['create-all']
     expect(abilities).toEqual(expectedActions.map((action) => ({ action, subject: 'PublicLink' })))
   })
+  it('gets correct abilities for subject "Share"', function () {
+    const abilities = getAbilities(['Share.Create.all'])
+    const expectedActions = ['create-all']
+    expect(abilities).toEqual(expectedActions.map((action) => ({ action, subject: 'Share' })))
+  })
   it('gets correct abilities for subject "Setting"', function () {
     const abilities = getAbilities(['Settings.ReadWrite.all'])
     const expectedActions = ['read-all', 'update-all']

From ef4766b63bcd152b443f58553e26aa69cf206b88 Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Mon, 13 Nov 2023 15:30:06 +0100
Subject: [PATCH 4/6] fix: share create permission naming

---
 packages/web-runtime/src/services/auth/abilities.ts          | 5 ++++-
 .../web-runtime/tests/unit/services/auth/abilities.spec.ts   | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/packages/web-runtime/src/services/auth/abilities.ts b/packages/web-runtime/src/services/auth/abilities.ts
index 4bb8a5e57a9..1cbcd803938 100644
--- a/packages/web-runtime/src/services/auth/abilities.ts
+++ b/packages/web-runtime/src/services/auth/abilities.ts
@@ -37,7 +37,10 @@ export const getAbilities = (
       { action: 'read-all', subject: 'Role' },
       { action: 'update-all', subject: 'Role' }
     ],
-    'Share.Create.all': [{ action: 'create-all', subject: 'Share' }],
+    'Shares.Write.all': [
+      { action: 'create-all', subject: 'Share' },
+      { action: 'update-all', subject: 'Share' }
+    ],
     'Settings.ReadWrite.all': [
       { action: 'read-all', subject: 'Setting' },
       { action: 'update-all', subject: 'Setting' }
diff --git a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
index d76edb71882..d85e158cdb7 100644
--- a/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
+++ b/packages/web-runtime/tests/unit/services/auth/abilities.spec.ts
@@ -45,8 +45,8 @@ describe('getAbilities', () => {
     expect(abilities).toEqual(expectedActions.map((action) => ({ action, subject: 'PublicLink' })))
   })
   it('gets correct abilities for subject "Share"', function () {
-    const abilities = getAbilities(['Share.Create.all'])
-    const expectedActions = ['create-all']
+    const abilities = getAbilities(['Shares.Write.all'])
+    const expectedActions = ['create-all', 'update-all']
     expect(abilities).toEqual(expectedActions.map((action) => ({ action, subject: 'Share' })))
   })
   it('gets correct abilities for subject "Setting"', function () {

From 7bff54fe9dd44bbd2497d3a3ca4fc001cc72d4d3 Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Mon, 13 Nov 2023 15:54:33 +0100
Subject: [PATCH 5/6] chore: bump ocis commit id

---
 .drone.env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.drone.env b/.drone.env
index 282dfe22d2b..c8fe09bb93b 100644
--- a/.drone.env
+++ b/.drone.env
@@ -1,3 +1,3 @@
 # The version of OCIS to use in pipelines that test against OCIS
-OCIS_COMMITID=c4d3ec7e5b07abe00ce3d9c322387eba80224ecf
+OCIS_COMMITID=a9366caa0cb97de0c4a68a43f05156cc584bee16
 OCIS_BRANCH=master

From 8971f8dad1edfb5ee01e180820c1e769a7b3908d Mon Sep 17 00:00:00 2001
From: Jannik Stehle <jannik.stehle@gmail.com>
Date: Mon, 13 Nov 2023 16:41:28 +0100
Subject: [PATCH 6/6] docs: add changelog item

---
 .../enhancement-share-and-favorite-permission-checks        | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 changelog/unreleased/enhancement-share-and-favorite-permission-checks

diff --git a/changelog/unreleased/enhancement-share-and-favorite-permission-checks b/changelog/unreleased/enhancement-share-and-favorite-permission-checks
new file mode 100644
index 00000000000..2d04711e041
--- /dev/null
+++ b/changelog/unreleased/enhancement-share-and-favorite-permission-checks
@@ -0,0 +1,6 @@
+Enhancement: Permission checks for shares and favorites
+
+Permission checks for creating shares and favorites have been added.
+
+https://github.com/owncloud/ocis/issues/7497
+https://github.com/owncloud/web/pull/9810