allow non-admins to list their own groupfolders

[icewind1991]

Allow regular users access to

• GET apps/groupfolders/folders
• GET apps/groupfolders/folders/$folderId

They only see groupfolders they have access to and only the permissions for groups they belong to

[juliushaertl]

Should we somehow also limit the listing for the admin for the cases where this is used in the clients or files app? Otherwise for admins and delegated admins it would list all folders, also those that are not accessible through the filesystem just for group folder management.

https://github.com/nextcloud/groupfolders/pull/2326/files seems much cleaner for that approach, but as I understood clients would prefer ocs, right? Maybe we can just have separate endpoints for the user scoped list.

[tobiasKaminsky]

Yes, ocs is better than webdav in this case, as we only want to use these folders as shortcuts to our regular webdav.
Having a separate webdav path would require way much work.

Good point with admin, so a separate endpoint is indeed better.

[AndyScherzinger]

Would we want/need brute force / throttling on them ? cc @nickvergessen since we lately discussed this and touch endpoints here.

[nickvergessen]

I don't have troubles with listing them. Listing does not DDoS/load other users, so that should be fine.

[come-nc]

Looks good codewise, not sure about Julius remark.

[icewind1991]

Added an option to filter the listing response for admins by adding applicable=1 to the request params.