Feat(taskprocessing): add toggle for AI guest restriction

apps/settings/lib/Controller/AISettingsController.php

@@ -38,7 +38,7 @@ public function __construct(
 	 */
 	#[AuthorizedAdminSetting(settings: ArtificialIntelligence::class)]
 	public function update($settings) {
-		$keys = ['ai.stt_provider', 'ai.textprocessing_provider_preferences', 'ai.taskprocessing_provider_preferences','ai.taskprocessing_type_preferences', 'ai.translation_provider_preferences', 'ai.text2image_provider'];
+		$keys = ['ai.stt_provider', 'ai.textprocessing_provider_preferences', 'ai.taskprocessing_provider_preferences','ai.taskprocessing_type_preferences', 'ai.translation_provider_preferences', 'ai.text2image_provider', 'ai.taskprocessing_guests'];
 		foreach ($keys as $key) {
 			if (!isset($settings[$key])) {
 				continue;

apps/settings/lib/Settings/Admin/ArtificialIntelligence.php

@@ -125,6 +125,7 @@ public function getForm() {
 			$taskProcessingTypeSettings[$taskTypeId] = true;
 		}
 
+
 		$this->initialState->provideInitialState('ai-stt-providers', $sttProviders);
 		$this->initialState->provideInitialState('ai-translation-providers', $translationProviders);
 		$this->initialState->provideInitialState('ai-text-processing-providers', $textProcessingProviders);
@@ -140,6 +141,7 @@ public function getForm() {
 			'ai.text2image_provider' => count($text2imageProviders) > 0 ? $text2imageProviders[0]['id'] : null,
 			'ai.taskprocessing_provider_preferences' => $taskProcessingSettings,
 			'ai.taskprocessing_type_preferences' => $taskProcessingTypeSettings,
+			'ai.taskprocessing_guests' => false,
 		];
 		foreach ($settings as $key => $defaultValue) {
 			$value = $defaultValue;

apps/settings/src/components/AdminAI.vue

@@ -6,6 +6,11 @@
 	<div class="ai-settings">
 		<NcSettingsSection :name="t('settings', 'Unified task processing')"
 			:description="t('settings', 'AI tasks can be implemented by different apps. Here you can set which app should be used for which task.')">
+			<NcCheckboxRadioSwitch v-model="settings['ai.taskprocessing_guests']"
+				type="switch"
+				@update:modelValue="saveChanges">
+				{{ t('settings', 'Allow AI usage for guest users') }}
+			</NcCheckboxRadioSwitch>
 			<template v-for="type in taskProcessingTaskTypes">
 				<div :key="type">
 					<h3>{{ t('settings', 'Task:') }} {{ type.name }}</h3>

lib/private/TaskProcessing/Manager.php

@@ -36,6 +36,8 @@
 use OCP\IConfig;
 use OCP\IL10N;
 use OCP\IServerContainer;
+use OCP\IUserManager;
+use OCP\IUserSession;
 use OCP\L10N\IFactory;
 use OCP\Lock\LockedException;
 use OCP\SpeechToText\ISpeechToTextProvider;
@@ -103,6 +105,8 @@ public function __construct(
 		private IUserMountCache $userMountCache,
 		private IClientService $clientService,
 		private IAppManager $appManager,
+		private IUserManager $userManager,
+		private IUserSession $userSession,
 		ICacheFactory $cacheFactory,
 	) {
 		$this->appData = $appDataFactory->get('core');
@@ -809,7 +813,11 @@ public function getPreferredProvider(string $taskTypeId) {
 		throw new \OCP\TaskProcessing\Exception\Exception('No matching provider found');
 	}
 
-	public function getAvailableTaskTypes(bool $showDisabled = false): array {
+	public function getAvailableTaskTypes(bool $showDisabled = false, ?string $userId = null): array {
+		// userId will be obtained from the session if left to null
+		if (!$this->checkGuestAccess($userId)) {
+			return [];
+		}
 		if ($this->availableTaskTypes === null) {
 			$cachedValue = $this->distributedCache->get('available_task_types_v2');
 			if ($cachedValue !== null) {
@@ -868,7 +876,27 @@ public function canHandleTask(Task $task): bool {
 		return isset($this->getAvailableTaskTypes()[$task->getTaskTypeId()]);
 	}
 
+	private function checkGuestAccess(?string $userId = null): bool {
+		if ($userId === null && !$this->userSession->isLoggedIn()) {
+			return true;
+		}
+		if ($userId === null) {
+			$user = $this->userSession->getUser();
+		} else {
+			$user = $this->userManager->get($userId);
+		}
+
+		$guestsAllowed = $this->config->getAppValue('core', 'ai.taskprocessing_guests', 'false');
+		if ($guestsAllowed == 'true' || !class_exists(\OCA\Guests\UserBackend::class) || !($user->getBackend() instanceof \OCA\Guests\UserBackend)) {
+			return true;
+		}
+		return false;
+	}
+
 	public function scheduleTask(Task $task): void {
+		if (!$this->checkGuestAccess($task->getUserId())) {
+			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('Access to this resource is forbidden for guests.');
+		}
 		if (!$this->canHandleTask($task)) {
 			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('No task processing provider is installed that can handle this task type: ' . $task->getTaskTypeId());
 		}
@@ -883,6 +911,9 @@ public function scheduleTask(Task $task): void {
 	}
 
 	public function runTask(Task $task): Task {
+		if (!$this->checkGuestAccess($task->getUserId())) {
+			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('Access to this resource is forbidden for guests.');
+		}
 		if (!$this->canHandleTask($task)) {
 			throw new \OCP\TaskProcessing\Exception\PreConditionNotMetException('No task processing provider is installed that can handle this task type: ' . $task->getTaskTypeId());
 		}

lib/public/TaskProcessing/IManager.php

@@ -47,11 +47,13 @@ public function getPreferredProvider(string $taskTypeId);
 
 	/**
 	 * @param bool $showDisabled if false, disabled task types will be filtered
+	 * @param ?string $userId to check if the user is a guest. Will be obtained from session if left to default
 	 * @return array<string, array{name: string, description: string, inputShape: ShapeDescriptor[], inputShapeEnumValues: ShapeEnumValue[][], inputShapeDefaults: array<array-key, numeric|string>, optionalInputShape: ShapeDescriptor[], optionalInputShapeEnumValues: ShapeEnumValue[][], optionalInputShapeDefaults: array<array-key, numeric|string>, outputShape: ShapeDescriptor[], outputShapeEnumValues: ShapeEnumValue[][], optionalOutputShape: ShapeDescriptor[], optionalOutputShapeEnumValues: ShapeEnumValue[][]}>
 	 * @since 30.0.0
 	 * @since 31.0.0 Added the `showDisabled` argument.
+	 * @since 31.0.7 Added the `userId` argument
 	 */
-	public function getAvailableTaskTypes(bool $showDisabled = false): array;
+	public function getAvailableTaskTypes(bool $showDisabled = false, ?string $userId = null): array;
 
 	/**
 	 * @param Task $task The task to run

psalm.xml

@@ -109,6 +109,7 @@
 				<referencedClass name="OCA\GroupFolders\Mount\GroupFolderStorage"/>
 				<referencedClass name="OCA\TwoFactorNextcloudNotification\Controller\APIController"/>
 				<referencedClass name="OCA\GlobalSiteSelector\Service\SlaveService"/>
+				<referencedClass name="OCA\Guests\UserBackend"/>
 			</errorLevel>
 		</UndefinedClass>
 		<UndefinedFunction>

tests/lib/TaskProcessing/TaskProcessingTest.php

@@ -30,6 +30,7 @@
 use OCP\IServerContainer;
 use OCP\IUser;
 use OCP\IUserManager;
+use OCP\IUserSession;
 use OCP\Server;
 use OCP\TaskProcessing\EShapeType;
 use OCP\TaskProcessing\Events\GetTaskProcessingProvidersEvent;
@@ -613,6 +614,8 @@ protected function setUp(): void {
 			$this->userMountCache,
 			Server::get(IClientService::class),
 			Server::get(IAppManager::class),
+			$userManager,
+			Server::get(IUserSession::class),
 			Server::get(ICacheFactory::class),
 		);
 	}
@@ -1263,6 +1266,8 @@ private function createManagerInstance(): Manager {
 			$this->userMountCache,
 			Server::get(IClientService::class),
 			Server::get(IAppManager::class),
+			Server::get(IUserManager::class),
+			Server::get(IUserSession::class),
 			Server::get(ICacheFactory::class),
 		);
 	}