Skip to content

feat: Restrict access to upload for Viewers profile (WPB-25257)#4849

Open
ohassine wants to merge 16 commits into
developfrom
Restrict-access-to-upload-for-Viewers-profile
Open

feat: Restrict access to upload for Viewers profile (WPB-25257)#4849
ohassine wants to merge 16 commits into
developfrom
Restrict-access-to-upload-for-Viewers-profile

Conversation

@ohassine

@ohassine ohassine commented May 20, 2026

Copy link
Copy Markdown
Member

https://wearezeta.atlassian.net/browse/WPB-25257


PR Submission Checklist for internal contributors

  • The PR Title

    • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
    • contains a reference JIRA issue number like SQPIT-764
    • answers the question: If merged, this PR will: ... ³
  • The PR Description

    • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

What's new in this PR?

Issues

Restrict access to upload files for Viewers profile by disabling attachments options

1000036466

Needs releases with:

  • GitHub link to other pull request

Testing

Test Coverage (Optional)

  • I have added automated test to this contribution

How to Test

Briefly describe how this change was tested and if applicable the exact steps taken to verify that it works as expected.

Notes (Optional)

Specify here any other facts that you think are important for this issue.

Attachments (Optional)

Attachments like images, videos, etc. (drag and drop in the text box)


PR Post Submission Checklist for internal contributors (Optional)

  • Wire's Github Workflow has automatically linked the PR to a JIRA issue

PR Post Merge Checklist for internal contributors

  • If any soft of configuration variable was introduced by this PR, it has been added to the relevant documents and the CI jobs have been updated.

References
  1. https://sparkbox.com/foundry/semantic_commit_messages
  2. https://github.com/wireapp/.github#usage
  3. E.g. feat(conversation-list): Sort conversations by most emojis in the title #SQPIT-764.

@codecov

codecov Bot commented May 20, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 70.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.14%. Comparing base (fd2041e) to head (c7ca9e9).

Files with missing lines Patch % Lines
.../conversations/ConversationCoreViewModelFactory.kt 0.00% 2 Missing ⚠️
...droid/ui/home/messagecomposer/AttachmentOptions.kt 0.00% 1 Missing ⚠️

❌ Your patch check has failed because the patch coverage (70.00%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files
@@           Coverage Diff            @@
##           develop    #4849   +/-   ##
========================================
  Coverage    49.14%   49.14%           
========================================
  Files          650      650           
  Lines        22989    22999   +10     
  Branches      3518     3518           
========================================
+ Hits         11297    11304    +7     
- Misses       10645    10648    +3     
  Partials      1047     1047           
Files with missing lines Coverage Δ
.../ui/home/conversations/MessageComposerViewState.kt 86.84% <100.00%> (+0.35%) ⬆️
...conversations/composer/MessageComposerViewModel.kt 76.76% <100.00%> (+1.49%) ⬆️
.../ui/home/messagecomposer/EnabledMessageComposer.kt 0.00% <ø> (ø)
...droid/ui/home/messagecomposer/AttachmentOptions.kt 0.00% <0.00%> (ø)
.../conversations/ConversationCoreViewModelFactory.kt 0.00% <0.00%> (ø)

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fd2041e...c7ca9e9. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@pull-request-size pull-request-size Bot added size/M and removed size/S labels May 20, 2026
@ohassine ohassine requested review from Garzas and sbakhtiarov May 21, 2026 10:07
}
}

private fun observeAttachmentOptionsAvailability() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not aware of this "Viewers profile" feature but it seems like this does not allow uploading to user from other team. This is a clear business logic and must be placed into kalium use case.

}
}

private fun observeAttachmentOptionsAvailability() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we disable attachment options, should we also disable sharing files into this conversation from other apps?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it will be next, we will restrict download, copy, move, screenshoots... step by step

onDrawingModeClicked = openDrawingCanvas,
isFileSharingEnabled = messageComposerViewState.value.isFileSharingEnabled
onDrawingModeClicked = {
if (messageComposerViewState.value.areAttachmentOptionsEnabled) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need for an extra condition here since the button will be disabled when areAttachmentOptionsEnabled == false

}
}

private fun observeAttachmentOptionsAvailability() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it will be better to to add a real restriction on the logic level to make sure we do not depend on the enabled/disabled button states.
Enable/disable buttons will only visualize the restriction.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This real restriction backend must enforce it


combine(
observeSelfUser().distinctUntilChanged(),
observeConversationDetails(conversationId)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Observing all conversations details just for reading two fields (wireCell and teamId) is probably an overkill.
Also this may update frequently causing UI updates.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's not all conversations, it's one conversation by Id

@ohassine ohassine requested a review from sbakhtiarov June 4, 2026 15:53
@pull-request-size pull-request-size Bot added size/S and removed size/M labels Jun 4, 2026
ohassine added 6 commits June 8, 2026 12:54
…-upload-for-Viewers-profile

# Conflicts:
#	app/src/main/kotlin/com/wire/android/ui/home/conversations/ConversationCoreViewModelFactory.kt
…ewers-profile' into Restrict-access-to-upload-for-Viewers-profile
@sonarqubecloud

sonarqubecloud Bot commented Jun 9, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants