2 files changed, 34 insertions, 3 deletions
diff --git a/lib/private/TaskProcessing/Manager.php b/lib/private/TaskProcessing/Manager.php
index 9992310dbbb..0ffd141543f 100644
--- a/lib/private/TaskProcessing/Manager.php
+++ b/lib/private/TaskProcessing/Manager.php
@@ -36,6 +36,8 @@ use OCP\ICacheFactory;
 use OCP\IConfig;
 use OCP\IL10N;
 use OCP\IServerContainer;
+use OCP\IUserManager;
+use OCP\IUserSession;
 use OCP\L10N\IFactory;
 use OCP\Lock\LockedException;
 use OCP\SpeechToText\ISpeechToTextProvider;
@@ -103,6 +105,8 @@ class Manager implements IManager {
 		private IUserMountCache $userMountCache,
 		private IClientService $clientService,
 		private IAppManager $appManager,
+		private IUserManager $userManager,
+		private IUserSession $userSession,
 		ICacheFactory $cacheFactory,
 	) {
 		$this->appData = $appDataFactory->get('core');
@@ -809,7 +813,11 @@ class Manager implements IManager {
 		throw new \OCP\TaskProcessing\Exception\Exception('No matching provider found');
 	}
 
-	public function getAvailableTaskTypes(bool $showDisabled = false): array {
+	public function getAvailableTaskTypes(bool $showDisabled = false, ?string $userId = null): array {
+		// userId will be obtained from the session if left to null
+		if (!$this->checkGuestAccess($userId)) {
+			return [];
+		}
 		if ($this->availableTaskTypes === null) {
 			$cachedValue = $this->distributedCache->get('available_task_types_v2');
 			if ($cachedValue !== null) {
@@ -868,7 +876,27 @@ class Manager implements IManager {
 		return isset($this->getAvailableTaskTypes()[$task->getTaskTypeId()]);
 	}
 
+	private function checkGuestAccess(?string $userId = null): bool {
+		if ($userId === null && !$this->userSession->isLoggedIn()) {
+			return true;
+		}
+		if ($userId === null) {
+			$user = $this->userSession->getUser();
+		} else {
+			$user = $this->userManager->get($userId);
+		}
+
+		$guestsAllowed = $this->config->getAppValue('core', 'ai.taskprocessing_guests', 'false');
+		if ($guestsAllowed == 'true' || !class_exists(\OCA\Guests\UserBackend::class) || !($user->getBackend() instanceof \OCA\Guests\UserBackend)) {
+			return true;
+		}
+		return false;
+	}
+
 	public function scheduleTask(Task $task): void {
+		if (!$this->checkGuestAccess($task->getUserId())) {
+			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('Access to this resource is forbidden for guests.');
+		}
 		if (!$this->canHandleTask($task)) {
 			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('No task processing provider is installed that can handle this task type: ' . $task->getTaskTypeId());
 		}
@@ -883,6 +911,9 @@ class Manager implements IManager {
 	}
 
 	public function runTask(Task $task): Task {
+		if (!$this->checkGuestAccess($task->getUserId())) {
+			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('Access to this resource is forbidden for guests.');
+		}
 		if (!$this->canHandleTask($task)) {
 			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('No task processing provider is installed that can handle this task type: ' . $task->getTaskTypeId());
 		}
diff --git a/lib/private/TaskProcessing/SynchronousBackgroundJob.php b/lib/private/TaskProcessing/SynchronousBackgroundJob.php
index de3b424176c..19c53d59932 100644
--- a/lib/private/TaskProcessing/SynchronousBackgroundJob.php
+++ b/lib/private/TaskProcessing/SynchronousBackgroundJob.php
@@ -59,8 +59,8 @@ class SynchronousBackgroundJob extends QueuedJob {
 
 		// check if this job needs to be scheduled again:
 		// if there is at least one preferred synchronous provider that has a scheduled task
-		$synchronousProviders = array_filter($providers, fn ($provider) =>
-			$provider instanceof ISynchronousProvider);
+		$synchronousProviders = array_filter($providers, fn ($provider)
+			=> $provider instanceof ISynchronousProvider);
 		$synchronousPreferredProviders = array_filter($synchronousProviders, function ($provider) {
 			$taskTypeId = $provider->getTaskTypeId();
 			$preferredProvider = $this->taskProcessingManager->getPreferredProvider($taskTypeId);