Cannot update public link role when password is required for writable shares

[ScharfViktor]

Describe the bug

opencloud version 4.1.0
run opencloud with:

• OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false
• OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=true

Steps to reproduce

1. create file or space
2. create public link with view role (no password required)
3. try to change role

Expected behavior

A password dialog should appear prompting the user to set a password

Actual behavior

web issue:

• no password dialog so you send Patch request without password and get 400 message: "password protection is enforced"

Screen.Recording.2025-12-17.at.11.33.02.mov

backend issue:
when I send request curl --location --request PATCH 'https://opencloud-server:9200/graph/v1beta1/drives/driveId/items/itemId/permissions/qVomPXGDjTzOHZP' --data '{"link":{"type": "edit"}, "password":"8Ogw=\"sYL-09"} I get 400

but docs says I can update password in the patch request
https://docs.opencloud.eu/swagger/libre-graph-api/#/drives.permissions/UpdatePermission

here is workaround:

1. set password using https://docs.opencloud.eu/swagger/libre-graph-api/#/drives.permissions/SetPermissionPassword
2. update role https://docs.opencloud.eu/swagger/libre-graph-api/#/drives.permissions/UpdatePermission

Setup

Please describe how you started the server and provide a list of relevant environment variables or configuration files.

Details

OC_XXX=somevalue
OC_YYY=somevalue
PROXY_XXX=somevalue

Additional context

Add any other context about the problem here.

[micbar]

@jammin @kulmann

This is the third time we are having this bug. Should we write more tests?

[rhafer]

@micbar As @ScharfViktor mentioned it seems that the API spec is wrong (https://docs.opencloud.eu/swagger/libre-graph-api/#/drives.permissions/UpdatePermission).`

It says: "Only the roles, expirationDateTime and password properties can be modified this way."

But the password can only be changed via the setPassword endpoint (https://docs.opencloud.eu/swagger/libre-graph-api/#/drives.permissions/SetPermissionPassword)

[ScharfViktor]

Not reproducible. Sorry for the noise.