Apply group limit on remove from group

[come-nc]

Summary

When removing a user from a group, remove shares which would not be creatable anymore according to group limit on sharing.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[come-nc]

/backport to stable29

[come-nc]

/backport to stable28

[hamza221]

/backport to stable26

[jonas2515]

Tbh this seems not very thought through, it makes the behavior of existing shares on settings and group membership changes super inconsistent.

While now existing shares are removed when manipulating the groups of a user, they aren't removed when enabling the "only share between users of group" setting. Neither are they removed when disabling the whole share API, nor when changing the "limit/exclude sharing to/from groups" settings. I assume the behavior for re-shared shares would also have to be considered.

I don't think a simple action like toggling group membership (or toggling a checkbox in settings) should do such destructive things as deleting shares, can we maybe just remove this behavior again?

@come-nc ping just in case you don't receive notifications for merged PRs.

[come-nc]

While now existing shares are removed when manipulating the groups of a user, they aren't removed when enabling the "only share between users of group" setting. Neither are they removed when disabling the whole share API, nor when changing the "limit/exclude sharing to/from groups" settings. I assume the behavior for re-shared shares would also have to be considered.

I don't think a simple action like toggling group membership (or toggling a checkbox in settings) should do such destructive things as deleting shares, can we maybe just remove this behavior again?

I think it’s for this reason that changing settings is not directly deleting shares. But it would be a nice feature to have a button to apply current settings to existing shares indeed.

But this PR is not when changing settings but when changing groups.
It’s fixing what was reported as a security issue, see GHSA-35gc-jc6x-29cm
When configuring sharing restriction based on groups, it should be expected that removing a user from a group has consequences.