feat: Disable copy and download files actions

lib/Connector/Sabre/PropFindPlugin.php

@@ -39,7 +39,7 @@ public function __construct(
 		private UserAgentManager $userAgentManager,
 		private IRequest $request,
 		private IMetaDataStorage $metaDataStorage,
-		private Folder $userFolder,
+		private ?Folder $userFolder,
 	) {
 		parent::__construct($rootFolder, $userSession, $pathCache);
 	}
@@ -83,15 +83,17 @@ public function setE2EEProperties(PropFind $propFind, \Sabre\DAV\INode $node) {
 			});
 		}
 
-		$propFind->handle(self::E2EE_IS_ENCRYPTED, function () use ($node) {
-			if ($node instanceof File) {
-				$isEncrypted = $this->userFolder->getFirstNodeById($node->getFileInfo()->getParentId())->isEncrypted() ? '1' : '0';
-			} else {
-				$isEncrypted = $node->getFileInfo()->isEncrypted();
-			}
+		if ($this->userFolder !== null) {
+			$propFind->handle(self::E2EE_IS_ENCRYPTED, function () use ($node) {
+				if ($node instanceof File) {
+					$isEncrypted = $this->userFolder->getFirstNodeById($node->getFileInfo()->getParentId())->isEncrypted() ? '1' : '0';
+				} else {
+					$isEncrypted = $node->getFileInfo()->isEncrypted();
+				}
 
-			return $isEncrypted ? '1' : '0';
-		});
+				return $isEncrypted ? '1' : '0';
+			});
+		}
 	}
 
 	/**

src/files.ts

@@ -3,18 +3,40 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 
+/* eslint-disable jsdoc/require-jsdoc */
+
 import { loadState } from '@nextcloud/initial-state'
-import { registerFileAction } from '@nextcloud/files'
+import { registerFileAction, getFileActions, Node, View } from '@nextcloud/files'
 import { registerDavProperty } from '@nextcloud/files/dav'
 
 import { setupWebDavDecryptionProxy } from './services/webDavProxy.ts'
 import downloadUnencryptedAction from './services/downloadUnencryptedAction.ts'
+import logger from './services/logger.ts'
 
 const userConfig = loadState('end_to_end_encryption', 'userConfig', { e2eeInBrowserEnabled: false })
 
 if (userConfig.e2eeInBrowserEnabled) {
 	setupWebDavDecryptionProxy()
+	registerDavProperty('nc:e2ee-is-encrypted', { nc: 'http://nextcloud.org/ns' })
 	registerDavProperty('nc:e2ee-metadata', { nc: 'http://nextcloud.org/ns' })
 	registerDavProperty('nc:e2ee-metadata-signature', { nc: 'http://nextcloud.org/ns' })
 	registerFileAction(downloadUnencryptedAction)
+	disableFileAction('download')
+	disableFileAction('move-copy')
+}
+
+function disableFileAction(actionId: string) {
+	logger.debug('Disabling file action', { actionId })
+	const actions = getFileActions()
+
+	const action = actions.find(action => action.id === actionId) as any
+	const originalEnabled = action._action.enabled
+
+	action._action.enabled = (nodes: Node[], view: View) => {
+		if (nodes.some(node => node.attributes['e2ee-is-encrypted'] === 1)) {
+			return false
+		}
+
+		return originalEnabled(nodes, view)
+	}
 }

src/services/downloadUnencryptedAction.ts

@@ -35,6 +35,10 @@
 			return false
 		}
 
+		if (nodes.some(node => node.attributes['e2ee-is-encrypted'] !== 1)) {
+			return false
+		}
+
 		// We can only download dav ressource
 		if (nodes.some(node => !node.isDavRessource)) {
 			return false