fix(security): ActionsController — require admin for all mutations

Every write surface (`create`/`update`/`patch`/`destroy`/`test`/
`migrateFromHooks`) was `@NoAdminRequired` with no per-tenant or owner
guard. Actions persist as workflow hooks that fire on every matching
object lifecycle event — a non-admin who briefly auths could register
attacker-chosen workflow logic that survives password reset, session
revocation, and even the source account being disabled (the action row
carries no owner check on execution → self-rearming hook).

Add `requireAdmin()` helper (returns 401/403 JSONResponse or null) and
call it at the top of every mutation. `index`/`show` stay
`@NoAdminRequired` so the management UI is still legible to non-admins.

Drive-by: `patch()` was forwarding to `update(objectId: $id)`, but
`update`'s signature is `update(int $id)` — fixed to `update(id: $id)`
so PATCH actually works.

Refs: #1419 review (blocker 6) — discussion_r3187494440

Author: rubenvdlinde

lib/Controller/ActionsController.php

@@ -31,7 +31,9 @@
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\JSONResponse;
+use OCP\IGroupManager;
 use OCP\IRequest;
+use OCP\IUserSession;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -89,7 +91,9 @@ public function __construct(
         ActionMapper $actionMapper,
         ActionLogMapper $actionLogMapper,
         ActionService $actionService,
-        LoggerInterface $logger
+        LoggerInterface $logger,
+        private readonly IUserSession $userSession,
+        private readonly IGroupManager $groupManager
     ) {
         parent::__construct(appName: $appName, request: $request);
         $this->actionMapper    = $actionMapper;
@@ -98,6 +102,40 @@ public function __construct(
         $this->logger          = $logger;
     }//end __construct()
 
+    /**
+     * Gate Actions mutations to admin group members.
+     *
+     * SECURITY: Actions persist as workflow hooks that fire on every
+     * matching object lifecycle event. A non-admin who briefly auth-es
+     * could otherwise register an attacker-chosen workflow that
+     * survives password reset, session revocation, and even the source
+     * account being disabled (the action row carries no owner check on
+     * execution). Gate every write surface (`create`/`update`/`patch`/
+     * `destroy`/`test`/`migrateFromHooks`) on admin-group membership.
+     *
+     * @return JSONResponse|null 403 response when not admin, null when allowed.
+     */
+    private function requireAdmin(): ?JSONResponse
+    {
+        $user = $this->userSession->getUser();
+        if ($user === null) {
+            return new JSONResponse(
+                data: ['error' => 'Authentication required'],
+                statusCode: 401
+            );
+        }
+
+        if ($this->groupManager->isAdmin($user->getUID()) === false) {
+            return new JSONResponse(
+                data: ['error' => 'Forbidden: Actions management is admin-only'],
+                statusCode: 403
+            );
+        }
+
+        return null;
+
+    }//end requireAdmin()
+
     /**
      * List all actions with pagination and filtering
      *
@@ -248,6 +286,10 @@ public function show(int $id): JSONResponse
     #[NoCSRFRequired]
     public function create(): JSONResponse
     {
+        if (($denial = $this->requireAdmin()) !== null) {
+            return $denial;
+        }
+
         try {
             $data = $this->request->getParams();
 
@@ -297,6 +339,10 @@ public function create(): JSONResponse
     #[NoCSRFRequired]
     public function update(int $id): JSONResponse
     {
+        if (($denial = $this->requireAdmin()) !== null) {
+            return $denial;
+        }
+
         try {
             $data = $this->request->getParams();
 
@@ -341,7 +387,8 @@ public function update(int $id): JSONResponse
     #[NoCSRFRequired]
     public function patch(int $id): JSONResponse
     {
-        return $this->update(objectId: $id);
+        // requireAdmin() runs inside update() — no need to duplicate here.
+        return $this->update(id: $id);
     }//end patch()
 
     /**
@@ -361,6 +408,10 @@ public function patch(int $id): JSONResponse
     #[NoCSRFRequired]
     public function destroy(int $id): JSONResponse
     {
+        if (($denial = $this->requireAdmin()) !== null) {
+            return $denial;
+        }
+
         try {
             $action = $this->actionService->deleteAction($id);
 
@@ -393,6 +444,10 @@ public function destroy(int $id): JSONResponse
     #[NoCSRFRequired]
     public function test(int $id): JSONResponse
     {
+        if (($denial = $this->requireAdmin()) !== null) {
+            return $denial;
+        }
+
         try {
             $data = $this->request->getParams();
 
@@ -483,6 +538,10 @@ function ($log) {
     #[NoCSRFRequired]
     public function migrateFromHooks(int $schemaId): JSONResponse
     {
+        if (($denial = $this->requireAdmin()) !== null) {
+            return $denial;
+        }
+
         try {
             $report = $this->actionService->migrateFromHooks($schemaId);