feat: Add the possibility to create invitation links to circles by Koc · Pull Request #2254 · nextcloud/circles

Koc · 2025-11-29T22:39:24Z

This PR adds possibility to generate invitation link (even for completely hidden/closed Circles). Any user is able to join to the circle by opening this link.

Dependencies

has to be merged before feat: Create invitation links for join to team contacts#4887

artonge · 2026-05-22T08:52:08Z

+		$initiatorHelper = new MemberHelper($circle->getInitiator());
+		$initiatorHelper->mustBeAdmin();
+
+		$new = clone $circle;


Why is it needed to clone the circle object?

I've just inspired from already existent verify method implementations:

circles/lib/FederatedItems/CircleConfig.php

Line 128 in 6c37964

$new = clone $circle;

circles/lib/FederatedItems/CircleSettings.php

Line 44 in 6c37964

$new = clone $circle;

...

artonge · 2026-06-10T13:25:18Z

+	 *
+	 * @throws InvalidIdException
+	 */
+	public function replace(CircleInvitation $circleInvitation): void {


Could there be multiple invitation per circle? If so, shouldn't we delete a specific invitation, and not all of them?

not now. In theory we can add that, but in this case we need rework UI and introduce something like "invitation link name" to distinguish links.

I would like to start with something really simple and improve it later

artonge · 2026-06-10T13:28:13Z

 			$qb->limitToInitiator(CoreQueryBuilder::CIRCLE, $initiator);
 			$qb->orderBy($qb->generateAlias(CoreQueryBuilder::CIRCLE, CoreQueryBuilder::INITIATOR) . '.level', 'desc');
 			$qb->addOrderBy(CoreQueryBuilder::CIRCLE . '.display_name', 'asc');
+			$qb->leftJoinCircleInvitation(CoreQueryBuilder::CIRCLE);


Shouldn't we join only if $probe->hasInvitationCode() === true?

no, because we need to respond with invitationCode in GET https://nextcloud.test/ocs/v2.php/apps/circles/circles endpoint

Koc · 2026-06-28T11:24:14Z

Error: lib/FederatedItems/CircleCreateInvitation.php:47:36: DeprecatedMethod: The method OCP\Security\ISecureRandom::generate has been marked as deprecated (see https://psalm.dev/001)

@deprecated 35.0.0 Use {@see Randomizer::getBytesFromString()} available in PHP 8.3+ instead.

I can't use Randomizer as module still relies on PHP 8.1

Signed-off-by: Kostiantyn Miakshyn <molodchick@gmail.com>

cristianscheid · 2026-07-07T21:57:50Z

 		} catch (MemberNotFoundException) {
-			if (!$circle->isConfig(Circle::CFG_OPEN)) {
+			$allowedToJoin = $invitationCode && $circle->getCircleInvitation()?->getInvitationCode() === $invitationCode;
+			if (!$circle->isConfig(Circle::CFG_OPEN) && !$allowedToJoin) {


since invitationCode is returned in GET ocs/v2.php/apps/circles/circles, that would mean every member of the circle, regardless of membership level, can see the code, right? So in the following scenario:

circle_abc does not have Circle::CFG_OPEN enabled

a member of circle_abc gets the invitationCode from the response (network tab)

shares the code with john

john uses it to call POST ocs/v2.php/apps/circles/invitations/{invitationCode}

when reaching this if statement, $allowedToJoin would resolve to true, so even though the circle isn't open, john would be able to bypass the config and join it, no?

cristianscheid · 2026-07-07T22:03:02Z

+		try {
+			$this->setCurrentFederatedUser();
+
+			$outcome = $this->circleService->createInvitation($circleId);


shouldn't this only be reachable by members with certain levels (e.g. admin, owner)? as it is right now, seems like anyone can create invitations

you can see on other methods of this controller how permissions are handled, for example here:
https://github.com/nextcloud/circles/blob/master/lib/Controller/LocalController.php#L423

cristianscheid · 2026-07-07T22:03:14Z

+		try {
+			$this->setCurrentFederatedUser();
+
+			$outcome = $this->circleService->revokeInvitation($circleId);


same as createInvitation()

Koc mentioned this pull request Nov 29, 2025

feat: Create invitation links for join to team nextcloud/contacts#4887

Open

Koc force-pushed the feature/invitation-links-to-circles branch 13 times, most recently from 8301408 to a89bf72 Compare November 30, 2025 22:40

Koc force-pushed the feature/invitation-links-to-circles branch 3 times, most recently from baffcc3 to af15456 Compare December 7, 2025 13:19

Koc marked this pull request as ready for review December 7, 2025 13:26

Koc requested a review from ArtificialOwl December 7, 2025 13:27

Koc force-pushed the feature/invitation-links-to-circles branch from af15456 to 018eea9 Compare April 16, 2026 09:12

Koc force-pushed the feature/invitation-links-to-circles branch from 018eea9 to 08b6110 Compare May 4, 2026 14:09

jancborchardt requested review from artonge and cristianscheid May 21, 2026 17:03

Koc force-pushed the feature/invitation-links-to-circles branch 2 times, most recently from 213cfc1 to b01cd7a Compare June 9, 2026 19:16

artonge reviewed Jun 10, 2026

View reviewed changes

Koc force-pushed the feature/invitation-links-to-circles branch 2 times, most recently from bac0d4e to 524ff22 Compare June 28, 2026 10:56

Koc requested a review from mejo- June 28, 2026 11:08

Koc force-pushed the feature/invitation-links-to-circles branch from 524ff22 to 63d11c0 Compare June 28, 2026 11:16

Koc requested a review from provokateurin as a code owner June 28, 2026 11:16

Koc force-pushed the feature/invitation-links-to-circles branch from 63d11c0 to 23a9469 Compare June 28, 2026 11:21

Koc force-pushed the feature/invitation-links-to-circles branch 2 times, most recently from cb5808c to c1227d7 Compare June 28, 2026 12:30

feat: Add the possibility to create invitation links to circles

ab2ab91

Signed-off-by: Kostiantyn Miakshyn <molodchick@gmail.com>

Koc force-pushed the feature/invitation-links-to-circles branch from c1227d7 to ab2ab91 Compare June 28, 2026 12:49

cristianscheid reviewed Jul 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add the possibility to create invitation links to circles#2254

feat: Add the possibility to create invitation links to circles#2254
Koc wants to merge 1 commit into
masterfrom
feature/invitation-links-to-circles

Koc commented Nov 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

artonge May 22, 2026

Uh oh!

Koc Jun 27, 2026

Uh oh!

artonge Jun 10, 2026

Uh oh!

Koc Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

artonge Jun 10, 2026

Uh oh!

Koc Jun 28, 2026

Uh oh!

Uh oh!

Uh oh!

Koc commented Jun 28, 2026

Uh oh!

cristianscheid Jul 7, 2026

Uh oh!

cristianscheid Jul 7, 2026

Uh oh!

cristianscheid Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Koc commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependencies

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Koc Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Koc commented Jun 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Koc commented Nov 29, 2025 •

edited

Loading

Koc Jun 28, 2026 •

edited

Loading