Skip to content

Re-enable ACL's for Teamfolders #2893

Open
Open
Re-enable ACL's for Teamfolders#2893
Assignees
hefftich
Labels
Needs discussionenhancement
Milestone
Nextcloud 35.0.3

Description

@jospoortvliet
jospoortvliet
opened on Sep 8, 2026

For several organizations, ACL's are really a key feature for Team folders. We should re-enable this for 35.0.1.

We disabled it to keep things simpler, but it would mean quite some orgs can't use 35's new Team folder concept. I would thus suggest simply turning it on again.

NOTE, quoting @artonge

Also, I can see an issue coming with ACL + .system folder in which we store the Teams data, which means, everybody should be able to read and write to it.

So we have to solve that first. Let's see if that is doable for .1

Activity

  1. jospoortvliet
    added
    0. Needs triage
    enhancement
    on Sep 8, 2026
  2. jospoortvliet
    added this to the Nextcloud 35 milestone on Sep 8, 2026
  3. jospoortvliet
    added this to 👥 Teamson Sep 8, 2026
  4. jospoortvliet
    moved this to Ready in 👥 Teamson Sep 8, 2026
  5. nextcloud-bot
    modified the milestones: Nextcloud 35, Nextcloud 35.0.1 on Sep 15, 2026
  6. hefftich
    self-assigned this
    on Sep 21, 2026
  7. hefftich
    added
    2. developing
    on Sep 21, 2026
  8. hefftich
    moved this from Ready to In progress in 👥 Teamson Sep 21, 2026

  9. hefftich commented on Sep 23, 2026

    @hefftich
    hefftich
    on Sep 23, 2026
    Contributor

    PR for changes in groupfolders: #5123

  10. nextcloud-bot
    modified the milestones: Nextcloud 35.0.1, Nextcloud 35.0.2 on Sep 24, 2026
  11. marcoambrosini
    added
    Needs discussion
    and removed
    0. Needs triage
    2. developing
    on Sep 30, 2026
  12. nextcloud-bot
    modified the milestones: Nextcloud 35.0.2, Nextcloud 35.0.3 on Oct 15, 2026

  13. jospoortvliet commented on Oct 17, 2026

    @jospoortvliet
    jospoortvliet
    on Oct 17, 2026
    MemberAuthor

    We (@marcoambrosini and myself) believe we can satisfy ACL use cases with a much simpler feature (implemented, under the hood, using ACL's), a few other tweaks, and the existing features in Nextcloud.

    Use cases

    • Confidential corner. Folder where only a subset of members can get to. For example a management subfolder, or a sub folder with resume's, etc.
      • Separate team and team folder is possible for each of those but messy, you get a lot of folders.
    • Reference area. Folder where only a subset of members has editing permissions. Templates, a handbook, documented policies.
      • Sometimes other apps (Collectives for example) are more suitable for this. But if you have data in other formats, it can be helpful to have it in the Teamfolder.
    • Freeze or archive. Final contracts, read-only after closing of a project, ...
      • Governance retention features can do this, but is less visible to users.
    • Lock folder structure. The root folder structure should not be messed with.

    The features to add:

    1. Restricted folders

    Admins have to explicitly add people or groups to give them access to a restricted folder. This is simpler than full ACL's as, within the folder, restrictions inherit downwards.

    Mode What it means stored via ACLs as
    Limited to… Only the listed members, roles or sub-teams see the folder Deny read for the team, allow for the list
    Read-only except… Everyone reads; only the listed ones edit Deny write/create/delete for the team, allow for the list

    Details:

    • Rule targets are members, roles (once implemented) and sub-teams (if we allow those).
    • Restrictions are inherited downward.
    • A restricted folder is visible but locked to those without access, with a "request access" option (Google pattern).
    • Admins have always r/w access
    • A team-level view lists every restricted folder in one place, so access can be audited.
    • A restricted folder has a "disallow sharing" option

    This should pretty much satisfy the first 3 use cases.

    2. Private area

    See #2999

    3. Special folders

    One folder gets special treatment: .system

    Should always be accessible by everyone, and can't be changed/renamed/moved/deleted.

    For convenience, we could create two more special folders:

    • Templates. Templates is read-only except for admins. Makes most sense if the templates are then of course used across the Team folder. Can be done with 1. restricted folders.
    • Archive. Archive is read and add but no modify. Would work best with either option: deletion = move to archive or a ... menu option to move something to the archive. Can't be done with restricted folders, but Governance has Archiving feature.

    These can't be renamed; everyone has access.

    4. Lock folder structure

    "Lock folder structure" toggle per team folder: non-admins can't rename, move or delete the top-level folders. This protects the structure.

    Other use cases

    • File drop area. Folder where ppl can add but not see files. Kind-of works with ACL's but isn't great, users can't see their own uploads.
      • ✅ covered by basic Nextcloud features: File requests, Forms with upload.
    • Outsider slice. Folder accessible to outsiders.
    • per-entity folders. Per-client folders, per student, per employee...
      • ✅ Create team or group folder per entity; or use 1. Restricted folder or 2. private space. Perhaps a flow or folder templates (a feature the Files team wants to build for 36).
    • Organization hierarchy. Represent organisational hierarchy in Teams.
      • ✅ Use groups and hierarchy; Groupfolders.

    Note that Group folders will keep ACL's.

    What use cases are missing, esp @Rikdekker @LieSoo @alimmroth ??

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Needs discussionenhancement

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions