Permit subadmins to add accessible users to groups they manage

[rpocklin]

This change aligns the provisioning API (and by extension, the owncloud-sdk) to allow subadministrators of groups (not just admins) to add users to groups they are a subadministrator of, providing that the user is already a member of a group managed by the subadmin. This is already permitted via the OC10 UI (which uses the PHP API directly toggleGroups).

Related Issue

• Fixes Subadmins cannot add users to groups they manage #38279 (incorporates all discussion points to date)

How Has This Been Tested?

Tested manually and updated and added several unit tests.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:
• Changelog item, see TEMPLATE

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[phil-davis]

LGTM. I pushed acceptance test scenarios to check this new behavior. They fail against master and pass in this branch - so there is a real and good difference in this PR.

IMO there is no security issue with this change. A subadmin who already has subadmin privileges over a user (because the user is in one group) can already delete the user etc. Now they are able to add them to another group which they are a subadmin of. That gives them no more power over the user.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

55.6% Coverage
1.6% Duplication

[phil-davis]

Thanks!