fix(conversations): Allow accessing avatars of listable conversations

Signed-off-by: Joas Schilling <coding@schilljs.com>

2 files changed, 44 insertions, 4 deletions

diff --git a/lib/Middleware/Attribute/RequireParticipantOrLoggedInAndListedConversation.php b/lib/Middleware/Attribute/RequireParticipantOrLoggedInAndListedConversation.php
new file mode 100644
index 000000000..746c0e134
--- /dev/null
+++ b/lib/Middleware/Attribute/RequireParticipantOrLoggedInAndListedConversation.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Talk\Middleware\Attribute;
+
+use Attribute;
+
+#[Attribute(Attribute::TARGET_METHOD)]
+class RequireParticipantOrLoggedInAndListedConversation extends RequireRoom {
+}
diff --git a/lib/Middleware/InjectionMiddleware.php b/lib/Middleware/InjectionMiddleware.php
index 77dc4d369..50ffda022 100644
--- a/lib/Middleware/InjectionMiddleware.php
+++ b/lib/Middleware/InjectionMiddleware.php
@@ -33,6 +33,7 @@ use OCA\Talk\Middleware\Attribute\RequireLoggedInParticipant;
 use OCA\Talk\Middleware\Attribute\RequireModeratorOrNoLobby;
 use OCA\Talk\Middleware\Attribute\RequireModeratorParticipant;
 use OCA\Talk\Middleware\Attribute\RequireParticipant;
+use OCA\Talk\Middleware\Attribute\RequireParticipantOrLoggedInAndListedConversation;
 use OCA\Talk\Middleware\Attribute\RequirePermission;
 use OCA\Talk\Middleware\Attribute\RequireReadWriteConversation;
 use OCA\Talk\Middleware\Attribute\RequireRoom;
@@ -96,6 +97,10 @@ class InjectionMiddleware extends Middleware {
 			$this->getLoggedIn($controller, true);
 		}
 
+		if (!empty($reflectionMethod->getAttributes(RequireParticipantOrLoggedInAndListedConversation::class))) {
+			$this->getLoggedInOrGuest($controller, false, true);
+		}
+
 		if (!empty($reflectionMethod->getAttributes(RequireParticipant::class))) {
 			$this->getLoggedInOrGuest($controller, false);
 		}
@@ -157,10 +162,11 @@ class InjectionMiddleware extends Middleware {
 	/**
 	 * @param AEnvironmentAwareController $controller
 	 * @param bool $moderatorRequired
+	 * @param bool $requireListedWhenNoParticipant
 	 * @throws NotAModeratorException
 	 * @throws ParticipantNotFoundException
 	 */
-	protected function getLoggedInOrGuest(AEnvironmentAwareController $controller, bool $moderatorRequired): void {
+	protected function getLoggedInOrGuest(AEnvironmentAwareController $controller, bool $moderatorRequired, bool $requireListedWhenNoParticipant = false): void {
 		$room = $controller->getRoom();
 		if (!$room instanceof Room) {
 			$token = $this->request->getParam('token');
@@ -175,6 +181,7 @@ class InjectionMiddleware extends Middleware {
 			if ($sessionId !== null) {
 				try {
 					$participant = $this->participantService->getParticipantBySession($room, $sessionId);
+					$controller->setParticipant($participant);
 				} catch (ParticipantNotFoundException $e) {
 					// ignore and fall back in case a concurrent request might have
 					// invalidated the session
@@ -182,10 +189,11 @@ class InjectionMiddleware extends Middleware {
 			}
 
 			if ($participant === null) {
-				$participant = $this->participantService->getParticipant($room, $this->userId);
+				if (!$requireListedWhenNoParticipant || !$this->manager->isRoomListableByUser($room, $this->userId)) {
+					$participant = $this->participantService->getParticipant($room, $this->userId);
+					$controller->setParticipant($participant);
+				}
 			}
-
-			$controller->setParticipant($participant);
 		}
 
 		if ($moderatorRequired && !$participant->hasModeratorPermissions()) {