Repository navigation
Disabling and deleting Spaces with API when UI for disabling and deleting space is not shown in context menu #1799
Description
Describe the bug
You can delete a Space via API even when the WebUI does not show the menu items to delete a space.
OpenCloud 3.4.0
OpenCloud Web UI 3.2.0
Steps to reproduce deleting via UI without reloading the browser
- Create a space
- Disable the space via context menu
- Delete the space via context menu
Steps to reproduce deleting via API
- Create a space
- Disable the space
- Reload the Browser (otherwise the context menu to disable and delete the space is still there)
- After reloading the contextmenu items are gone. And it seems the permissions are missing. Are they?
- Copy a deletion API request. Put in disabled Space ID. Run CURL in the terminal
- Space deleted even when the UI was disabled.
Here is our custom role setup:
(This is the normal user. we just changed the Drives.Create constraint
from
"constraint": "CONSTRAINT_OWN"
to
"constraint": "CONSTRAINT_ALL"
Extension:
{
"id": "79e13b30-3e22-11eb-bc51-0b9f0bad9a58",
"name": "Drives.Create",
"displayName": "Create Space",
"description": "This permission allows creating new spaces.",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_ALL"
},
"resource": {
"type": "TYPE_SYSTEM"
}
},
{
"id": "b05e4935-0d1f-4c4c-9ba1-4aa48beb1a21",
"name": "spaceoperator",
"type": "TYPE_ROLE",
"extension": "opencloud-roles",
"displayName": "Space Operator",
"settings": [
{
"id": "4e41363c-a058-40a5-aec8-958897511209",
"name": "AutoAcceptShares.ReadWriteDisabled",
"displayName": "enable/disable auto accept shares",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "ec3ed4a3-3946-4efc-8f9f-76d38b12d3a9"
}
},
{
"id": "11516bbd-7157-49e1-b6ac-d00c820f980b",
"name": "PublicLink.Write",
"displayName": "Write publiclink",
"description": "This permission allows creating public links.",
"permissionValue": {
"operation": "OPERATION_WRITE",
"constraint": "CONSTRAINT_ALL"
},
"resource": {
"type": "TYPE_SHARE"
}
},
{
"id": "069c08b1-e31f-4799-9ed6-194b310e7244",
"name": "Shares.Write",
"displayName": "Write share",
"description": "This permission allows creating shares.",
"permissionValue": {
"operation": "OPERATION_WRITE",
"constraint": "CONSTRAINT_ALL"
},
"resource": {
"type": "TYPE_SHARE"
}
},
{
"id": "79e13b30-3e22-11eb-bc51-0b9f0bad9a58",
"name": "Drives.Create",
"displayName": "Create Space",
"description": "This permission allows creating new spaces.",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_ALL"
},
"resource": {
"type": "TYPE_SYSTEM"
}
},
{
"id": "ad5bb5e5-dc13-4cd3-9304-09a424564ea8",
"name": "EmailNotifications.ReadWriteDisabled",
"displayName": "Disable Email Notifications",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "33ffb5d6-cd07-4dc0-afb0-84f7559ae438"
}
},
{
"id": "7dc204ee-799a-43b6-b85d-425fb3b1fa5a",
"name": "EmailSendingInterval.ReadWrite",
"displayName": "Email Sending Interval",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "08dec2fe-3f97-42a9-9d1b-500855e92f25"
}
},
{
"id": "8a50540c-1cdd-481f-b85f-44654393c8f0",
"name": "Event.ShareCreated.ReadWrite",
"displayName": "Event Share Created",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "872d8ef6-6f2a-42ab-af7d-f53cc81d7046"
}
},
{
"id": "5ef55465-8e39-4a6c-ba97-1d19f5b07116",
"name": "Event.ShareRemoved.ReadWrite",
"displayName": "Event Share Removed",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "d7484394-8321-4c84-9677-741ba71e1f80"
}
},
{
"id": "7d4f961b-d471-451b-b1fd-ac6a9d59ce88",
"name": "Event.ShareExpired.ReadWrite",
"displayName": "Event Share Expired",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "e1aa0b7c-1b0f-4072-9325-c643c89fee4e"
}
},
{
"id": "feb16d2c-614c-4f79-ac37-755a028f5616",
"name": "Event.SpaceShared.ReadWrite",
"displayName": "Event Space Shared",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "694d5ee1-a41c-448c-8d14-396b95d2a918"
}
},
{
"id": "4f979732-631b-4f27-9be7-a89fb223a6d2",
"name": "Event.SpaceUnshared.ReadWrite",
"displayName": "Event Space Unshared",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "26c20e0e-98df-4483-8a77-759b3a766af0"
}
},
{
"id": "a3cc45bf-9720-4e08-b403-b9133fe33f0b",
"name": "Event.SpaceMembershipExpired.ReadWrite",
"displayName": "Event Space Membership Expired",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "7275921e-b737-4074-ba91-3c2983be3edd"
}
},
{
"id": "896194c2-5055-4ea3-94a3-0a1419187a00",
"name": "Event.SpaceDisabled.ReadWrite",
"displayName": "Event Space Disabled",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "eb5c716e-03be-42c6-9ed1-1105d24e109f"
}
},
{
"id": "2083c280-b140-4b73-a931-9a4af2931531",
"name": "Event.SpaceDeleted.ReadWrite",
"displayName": "Event Space Deleted",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "094ceca9-5a00-40ba-bb1a-bbc7bccd39ee"
}
},
{
"id": "27ba8e97-0bdf-4b18-97d4-df44c9568cda",
"name": "Event.PostprocessingStepFinished.ReadWrite",
"displayName": "Event Postprocessing Step Finished",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "fe0a3011-d886-49c8-b797-33d02fa426ef"
}
},
{
"id": "7d81f103-0488-4853-bce5-98dcce36d649",
"name": "Language.ReadWrite",
"displayName": "Permission to read and set the language",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SETTING",
"id": "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f"
}
},
{
"id": "4ebaa725-bfaa-43c5-9817-78bc9994bde4",
"name": "Favorites.List",
"displayName": "List Favorites",
"description": "This permission allows listing favorites.",
"permissionValue": {
"operation": "OPERATION_READ",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_SYSTEM"
}
},
{
"id": "e03070e9-4362-4cc6-a872-1c7cb2eb2b8e",
"name": "Self.ReadWrite",
"displayName": "Self Management",
"description": "This permission gives access to self management.",
"permissionValue": {
"operation": "OPERATION_READWRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_USER",
"id": "me"
}
},
{
"id": "a54778fd-1c45-47f0-892d-655caf5236f2",
"name": "Favorites.Write",
"displayName": "Write Favorites",
"description": "This permission allows marking files as favorites.",
"permissionValue": {
"operation": "OPERATION_WRITE",
"constraint": "CONSTRAINT_OWN"
},
"resource": {
"type": "TYPE_FILE"
}
}
],
"resource": {
"type": "TYPE_SYSTEM"
}
}
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
butonic commentedon Nov 12, 2025
So your expectation is that a user with Drives.Create permission and CONSTRAINT_ALL can create and disable spaces, but not delete them?
v-scharf commentedon Nov 12, 2025
You may need to add additional permissions, such as:
Drives.ListDrives.ReadWriteDrives.ReadWriteEnabledif you call POST https://demo.opencloud.eu/api/v0/settings/roles-list
you can see all Space Admin permissions:
tiran133 commentedon Nov 15, 2025
Hi, I manage the installation from @christophwolff and wanted to add some more information and to clear things up.
No, the user should at lease can create, disable, enable and delete his "own" spaces (Space the user
can manage). Which works fine when you operate without a page refresh. See screenshot. Disable/Activate/Delete all work fine.The issue is, the context menu in the frontend is disappearing after a page refresh. See Screenshot. But the user is still able to activate or delete the space via API call. Because the user `can manage` the space that would make sense.
In order to see the context menu after the refresh, you need
Drives.ReadWriteEnabledlike @ScharfViktor suggested.But this allows to disable ALL spaces, not just the ones the user has
can manage. The user does not see or can access the spaces' admin menu, but is able to disable all spaces where the permissions arecan vieworcan editorcan manage. See screenshot.I believe this is a bug! The user should not be able to do this. See below, delete and reactivate are not allowed.
So, the user is able to deactivate ANY space he/she is a member of. He/she is not able to delete the space afterward, but still sees the delete option in the menu. Which makes sense because he/she does not have the permissions to delete other spaces just by having
Drives.ReadWriteEnabledSee Screenshot.As mentioned above, the user is unable to reactivate the space. See screenshot
So either the
Drives.ReadWriteEnabledpermission is an "admin" permission and allows for all space you are a member of to be deactivated and reactivated. Regardless of space permissions. Then the reactivation needs to be fixed.In this case, I don't want to give it to a user.
Then the context menu needs to be fixed /shown in the frontend when the user deactivated a space with
can manageand refreshes the page.Or
It acts in conjunction with the space permission
can manage. Then the deactivation of spaces you are onlycan viewcan editneeds to be removed. As the actual permissions to deactivate and the context menu needs to be removed too.Hope this is not too complicated of an explanation.
Feel free to ask if something is unclear.
v-scharf commentedon Nov 17, 2025
Then I would say this is a feature request, not a bug.
Right now we have the following roles:
create/disable/deleteall project spaces; has access toAdmin Settings → Spacescreate/disable/deleteproject spaces; has no access toAdmin Settings → SpacesNew feature proposal:
Add a new role: user + project space creator
Expected: user with this role should be able to
create/disable/delete/set quota/etconlyownproject spaces or spaces where he/shecan manage(it's space role). He/she should not have access toAdmin Settings → Spaces, to don’t see other project spaces.12 remaining items
tiran133 commentedon Mar 31, 2026
Is there any progress on this one?
Currently we need to manually delete spaces for users (with our custom role
spaceoperator), which creates overhead.It would be so much easier for them to do it themselfs.
Is there a UI fix comming?
Thank you for the update
JammingBen commentedon Jun 8, 2026
See here for the desired behavior: opencloud-eu/web#2475 (comment)
Let's use this issue for keeping track of the necessary adjustments, hence making it a p2. @micbar @rhafer fyi
tiran133 commentedon Jun 8, 2026
Hi and thank you for addressing this.
Thank you for clarifying the desired behavior!
We have the requirement that certain Persons should be able to create spaces without being a "Space Admin" that can manage all spaces.
I would like to clarify what exactly that means for us.
Since we could not give these persons the "Space Admin" role we created a new role.
See above.
This works fine for us. Except the deleting, the situation we're trying to solve here.
Because our desired behavioir would be that the user with our custom role can create and delete spaces he/she can manage.
I understand that might not be possible based on your desired behavioir, but it would be nice to discuss this and to find a solution that can work for both of us.
Just to clarify: when you say that only a "Space Admin" should be able to delete spaces, do you mean any role that has the required permissions, rather than a role specifically named "Space Admin"?
For example, I could create a custom role called "Space Verwalter" with the same permissions, and I would expect it to be able to delete spaces as well.
I just want to confirm that the system is checking for permissions and not the literal role name "Space Admin".
My questions would then be
You mentioned in the desired behavior that “only users that can create spaces should be able to delete them.”
{ "id": "79e13b30-3e22-11eb-bc51-0b9f0bad9a58", "name": "Drives.Create", "displayName": "Create Space", "description": "This permission allows creating new spaces.", "permissionValue": { "operation": "OPERATION_READWRITE", "constraint": "CONSTRAINT_ALL" }, "resource": { "type": "TYPE_SYSTEM" } },Would it be possible to support our desired behavior by introducing a new, dedicated permission for deleting spaces that the user can manage?
Some suggestions.
You already have permission
Drives.DeleteProjectyou could use that with a different constraint?Maybe with something like
CONSTRAINT_CAN_MANAGEinstead ofCONSTRAINT_ALL{ "id": "fb60b004-c1fa-4f09-bf87-55ce7d46ac61", "name": "Drives.DeleteProject", "displayName": "Delete Spaces", "description": "This permission allows deleting spaces.", "permissionValue": { "operation": "OPERATION_DELETE", "constraint": "CONSTRAINT_CAN_MANAGE" }, "resource": { "type": "TYPE_SYSTEM" } },Or a completely new permission
{ "id": "e557dc12-308e-4f13-9ea9-7af1da8a8548", "name": "Drives.DeleteManagedProject", "displayName": "Delete managed Spaces", "description": "This permission allows deleting managedspaces.", "permissionValue": { "operation": "OPERATION_DELETE", "constraint": "CONSTRAINT_ALL" }, "resource": { "type": "TYPE_SYSTEM" } },ChristophWolffNabu commentedon Jun 8, 2026
Regarding your plan to only allow deletion only for Space Admins especially in huge OC Deplyment: this could end up in a massive amount of disabled spaces and blocked storage.
You should take in account, that spaces are used for fine granular permissions, so there could be a alot of spaces in a huge organisation.
That means, that users/spaceowner/space creators/managers are not able to delete there own spaces if needed.
The OpenCloud Admin could be confronted with countless disabled spaces or has to establish a whole new internal process to deal with this. As a Space Admin you could not just delete them (via script or manuall), because you dont know if these spaces are disabled for i.e. Project halt or simlar and the data is still needed or if this spaces are ready for deletion and not needed anymore.
Please consider to create a special permission "delete own space if space manager" or something.
What about Multitenants? Is there a Space Admin for every Tenant then?
Thank you.
micbar commentedon Jun 15, 2026
We will take that into account after the release.
For now, there has been a higher risk to mitigate. Having Users delete a space which they are not allowed to is critical and needed an urgent bugfix in the scope of the current production release.
tiran133 commentedon Jun 17, 2026
Fair enough!
Since this is now closed. How do we go from here so this issue is not lost?
We would really appreciate it if there would be an option like I described above.
JammingBen commentedon Jun 17, 2026
I created #2962 to keep track of it.