3 files changed, 191 insertions, 0 deletions
diff --git a/apps/settings/lib/Command/AdminDelegation/Add.php b/apps/settings/lib/Command/AdminDelegation/Add.php
new file mode 100644
index 00000000000..5cbef5c5d15
--- /dev/null
+++ b/apps/settings/lib/Command/AdminDelegation/Add.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\IGroupManager;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Settings\IManager;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Add extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+		private IGroupManager $groupManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:add')
+			->setDescription('add setting delegation to a group')
+			->addArgument('settingClass', InputArgument::REQUIRED, 'Admin setting class')
+			->addArgument('groupId', InputArgument::REQUIRED, 'Delegate to group ID')
+			->addUsage('\'OCA\Settings\Settings\Admin\Server\' mygroup')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$settingClass = $input->getArgument('settingClass');
+		if (!in_array(IDelegatedSettings::class, (array)class_implements($settingClass), true)) {
+			$io->error('The specified class isn’t a valid delegated setting.');
+			return 2;
+		}
+
+		$groupId = $input->getArgument('groupId');
+		if (!$this->groupManager->groupExists($groupId)) {
+			$io->error('The specified group didn’t exist.');
+			return 3;
+		}
+
+		$this->authorizedGroupService->create($groupId, $settingClass);
+
+		$io->success('Administration of ' . $settingClass . ' delegated to ' . $groupId . '.');
+
+		return 0;
+	}
+}
diff --git a/apps/settings/lib/Command/AdminDelegation/Remove.php b/apps/settings/lib/Command/AdminDelegation/Remove.php
new file mode 100644
index 00000000000..6b5347ce89f
--- /dev/null
+++ b/apps/settings/lib/Command/AdminDelegation/Remove.php
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\IGroupManager;
+use OCP\Settings\IManager;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Remove extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+		private IGroupManager $groupManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:remove')
+			->setDescription('remove settings delegation from a group')
+			->addArgument('settingClass', InputArgument::REQUIRED, 'Admin setting class')
+			->addArgument('groupId', InputArgument::REQUIRED, 'Group ID to remove')
+			->addUsage('\'OCA\Settings\Settings\Admin\Server\' mygroup')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$settingClass = $input->getArgument('settingClass');
+		$groups = $this->authorizedGroupService->findExistingGroupsForClass($settingClass);
+		$groupId = $input->getArgument('groupId');
+		foreach ($groups as $group) {
+			if ($group->getGroupId() === $groupId) {
+				$this->authorizedGroupService->delete($group->getId());
+				$io->success('Removed delegation of ' . $settingClass . ' to ' . $groupId . '.');
+				return 0;
+			}
+		}
+
+		$io->success('Group ' . $groupId . ' didn’t have delegation for ' . $settingClass . '.');
+
+		return 0;
+	}
+}
diff --git a/apps/settings/lib/Command/AdminDelegation/Show.php b/apps/settings/lib/Command/AdminDelegation/Show.php
new file mode 100644
index 00000000000..9aba6bc0cb7
--- /dev/null
+++ b/apps/settings/lib/Command/AdminDelegation/Show.php
@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OC\Settings\AuthorizedGroup;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Settings\IManager;
+use OCP\Settings\ISettings;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Show extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:show')
+			->setDescription('show delegated settings')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$io->title('Current delegations');
+
+		$sections = $this->settingManager->getAdminSections();
+		$settings = [];
+		$headers = ['Name', 'SettingId', 'Delegated to groups'];
+		foreach ($sections as $sectionPriority) {
+			foreach ($sectionPriority as $section) {
+				$sectionSettings = $this->settingManager->getAdminSettings($section->getId());
+				$sectionSettings = array_reduce($sectionSettings, [$this, 'getDelegatedSettings'], []);
+				if (empty($sectionSettings)) {
+					continue;
+				}
+
+				$io->section('Section: ' . $section->getID());
+				$io->table($headers, array_map(function (IDelegatedSettings $setting) use ($section) {
+					$className = get_class($setting);
+					$groups = array_map(
+						static fn (AuthorizedGroup $group) => $group->getGroupId(),
+						$this->authorizedGroupService->findExistingGroupsForClass($className)
+					);
+					natsort($groups);
+					return [
+						$setting->getName() ?: 'Global',
+						$className,
+						implode(', ', $groups),
+					];
+				}, $sectionSettings));
+			}
+		}
+
+		return 0;
+	}
+
+	/**
+	 * @param IDelegatedSettings[] $settings
+	 * @param array $innerSection
+	 */
+	private function getDelegatedSettings(array $settings, array $innerSection): array {
+		return $settings + array_filter($innerSection, fn (ISettings $setting) => $setting instanceof IDelegatedSettings);
+	}
+}