fix: show ToS on non-files public pages (calendar/collectives/talk), Files on Nextcloud 31 and Login-flow

[ShGKme]

Resolves

• Fix: ToS Blocking File Access on Public Shares (e.g. in memories app) #949
• Fix: ToS produces OCP\Files\NotPermittedException on public shares #819
• Fix: TOS for Nextcloud Talk/spreed guest links #346

ToS checks for public pages by #sharingToken element. It doesn't work:

• In Nextcloud 31+ (must use initial state via @nextcloud/sharing)
• For pages, that are public, but not Files, e.g.
  • Calendar
  • Collectives
  • Talk

Instead - check for the current user.

How to test

1. Enable ToS, add terms of settings
2. Enable ToS for public pages
3. Create a calendar
4. Share calendar by link
5. Open as a guest

Changed behavior for logged-in users on public pages

• Fix: Sending External Link to Internal users breaks things. #1013
• Disable ToS for logged-in users
• Enable ToS for public shares

• Before:
  • Logged-in users have to accept ToS on public shares (because it is a public share)
• After:
  • Logged-in users don't have to accept ToS on public shares (because they a logged-in)

Login flow

• Fix: Accept ToS during login flow v2 #989
• Because login pages are also "public" pages, they are now manually excluded
• Except the login flow grant pages
• As a side effect - it fixes the client

How to test

1. Enable ToS, add terms of settings
2. Enable ToS for logged-in users
3. Try to log in in the Files client (Login Flow v2)
   • Before: login fails and you see login flow again
   • After: you need to accept ToS on the last step
4. Try to log in in the Talk Desktop (Login Flow v1)
   • Before: login is a success, but you cannot send/see files
   • After: you need to accept ToS on the last step

Screenshots

Before	After

[GretaD]

tested and it works as described. I would like Joas to have a saying if the approach is what we want

[nickvergessen]

Changed behavior for logged-in users on public pages

✔️ Sounds like a desired change

There is one more change - it also applied to the login page, which might be unexpected

Similarly the registration app should be excluded, as it has a dedicated integration with the app.

[nickvergessen]

it also applied to the login page, which might be unexpected

To fix login and registration app, I suggest to check those parts in
https://github.com/nextcloud/terms_of_service/blob/master/lib/AppInfo/Application.php#L89
like /login/ is already checked for logged in users.

Also we need to check what happens with 2FA apps

[ShGKme]

it also applied to the login page, which might be unexpected

Fixed with an exception for login flow grant. It also fixes the issue with the clients.

[ShGKme]

Tested:

• Login
• Login + twofactor_totp
• Login Flow v1 (via Talk Desktop)
• Login Flow v2 (via Files Android)
• Login + user_saml
• Login + user_oidc

[ShGKme]

/compile amend

[ShGKme]

@GretaD Can you merge? Psalm is read on every PR and unrelated

[GretaD]

/backport to stable27