Make it possible to generate codes as sub admin

lib/Controller/AdminCodeController.php

@@ -30,8 +30,11 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\JSONResponse;
+use OCP\Group\ISubAdmin;
+use OCP\IGroupManager;
 use OCP\IRequest;
 use OCP\IUserManager;
+use OCP\IUserSession;
 
 class AdminCodeController extends Controller {
 
@@ -41,26 +44,54 @@ class AdminCodeController extends Controller {
 	/** @var CodeStorage */
 	private $codeStorage;
 
+	/** @var IGroupManager */
+	private $groupManager;
+
+	/** @var ISubAdmin */
+	private $subAdmin;
+
+	/** @var IUserSession */
+	private $userSession;
+
 	public function __construct(IRequest $request,
 								IUserManager $userManager,
-								CodeStorage $codeStorage) {
+								IGroupManager $groupManager,
+								ISubAdmin $subAdmin,
+								CodeStorage $codeStorage,
+								IUserSession $userSession) {
 		parent::__construct(Application::APP_ID, $request);
 		$this->codeStorage = $codeStorage;
 		$this->userManager = $userManager;
+		$this->groupManager = $groupManager;
+		$this->subAdmin = $subAdmin;
+		$this->userSession = $userSession;
 	}
 
 	/**
 	 * @param string $uid
 	 *
+	 * @SubAdminRequired
+	 *
 	 * @return JSONResponse
 	 */
 	public function create(string $uid): JSONResponse {
+		$currentUser = $this->userSession->getUser();
 		$user = $this->userManager->get($uid);
 
+		if ($currentUser === null) {
+			// This is pretty much impossible
+			return new JSONResponse(null, Http::STATUS_BAD_REQUEST);
+		}
 		if ($user === null) {
 			return new JSONResponse(null, Http::STATUS_NOT_FOUND);
 		}
 
+		if (!$this->groupManager->isAdmin($currentUser->getUID())
+			&& !$this->subAdmin->isUserAccessible($currentUser, $user)) {
+			// Nope
+			return new JSONResponse(null, Http::STATUS_FORBIDDEN);
+		}
+
 		return new JSONResponse([
 			'code' => $this->codeStorage->generateCode($user),
 			'validFor' => CodeStorage::CODE_TTL,

lib/Settings/AdminSettings.php

@@ -28,8 +28,9 @@
 use OCA\TwoFactorAdmin\AppInfo\Application;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\Settings\ISettings;
+use OCP\Settings\ISubAdminSettings;
 
-class AdminSettings implements ISettings {
+class AdminSettings implements ISubAdminSettings {
 
 	public function getForm() {
 		return new TemplateResponse(Application::APP_ID, 'settings-admin');

src/components/CodeGenerator.vue

@@ -75,6 +75,8 @@
 					.catch(e => {
 						if (e.response && e.response.status === 404) {
 							this.error = t('twofactor_admin', 'user {uid} does not exist', {uid: this.uid})
+						} else if (e.response && e.response.status === 403) {
+							this.error = t('twofactor_admin', 'you are not allowed to generate codes for this user')
 						} else {
 							this.error = t('twofactor_admin', 'unknown error', {uid: this.uid})
 						}