Move users_picker profile custom picker to contacts #4231

julien-nc · 2024-11-29T14:40:03Z

This replaces #3487. I can't push in the branch there.

It's rebased on main
Adjusted the vite config
The bio processing is now using multi-byte proof functions
Nitpick addressed: The condition in the reference provider was inverted
Now checks if the profile is enabled (when resolving a link)
Fixed widget style issues
Fixed the tests
Fixed the licenses

About #3487 (review) I'm not sure I see the issue. The frontend is using the ocs/v2.php/core/autocomplete/get endpoint which should respect the sharing settings.

The reference provider now checks if the profile is enabled or not with the IAccountManager::PROPERTY_PROFILE_ENABLED account property.
It seems fine to resolve any /u/USER_ID link as long as the profile is enabled.

SebastianKrupinski · 2024-11-29T15:11:46Z

Hi @julien-nc

How do I test? What am I looking for.

julien-nc · 2024-12-02T09:17:00Z

@SebastianKrupinski This adds a "profile picker" entry in the smart picker and a reference widget (link preview) for /u/USER_ID links.

codecov · 2024-12-04T14:22:48Z

Codecov Report

❌ Patch coverage is 34.43396% with 139 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../components/ProfilePicker/ProfilesCustomPicker.vue	0.00%	72 Missing ⚠️
...nts/ProfilePicker/ProfilePickerReferenceWidget.vue	0.00%	37 Missing ⚠️
src/reference.js	0.00%	17 Missing ⚠️
lib/Reference/ProfilePickerReferenceProvider.php	91.25%	7 Missing ⚠️
lib/Listener/ProfilePickerReferenceListener.php	0.00%	4 Missing ⚠️
lib/AppInfo/Application.php	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

julien-nc · 2024-12-04T14:24:23Z

@SebastianKrupinski I made a few more adjustments. CI is green. It is now ready to be tested.

ChristophWurst · 2024-12-04T14:50:35Z

Dear @julien-nc,

Thank you for your contribution!

About #3487 (review) I'm not sure I see the issue. The frontend is using the ocs/v2.php/core/autocomplete/get endpoint which should respect the sharing settings.

That is correct for the part of searching. But once a reference is selected, there is no more check in ProfilePickerReferenceProvider.
I could abuse that to render a reference to a user I would otherwise not see. The reference contains any non-private data.

I suggest we test this specific scenario and see how the code behaves. I just want to have clarity on this point before the code goes into the main branch.

ChristophWurst · 2024-12-04T14:55:51Z

@julien-nc on a higher level, what do you think about moving the app/code into server instead? The picker picks users, not contacts. There is nothing specific to contacts (or event teams) in the code.

julien-nc · 2024-12-05T16:41:22Z

@ChristophWurst Yes we can move it to server.

I'd still like to have your opinion on the last changes. We now check the visibility of the profile fields with the ProfileManager. This respects the scopes and the visibility settings.

I could abuse that to render a reference to a user I would otherwise not see. The reference contains any non-private data.

Now the preview can't display any information that would not be visible by clicking the link to browse the profile page.

ChristophWurst · 2025-01-16T13:18:13Z

lib/Reference/ProfilePickerReferenceProvider.php

+		$userDisplayName = $user->getDisplayName();
+		$userEmail = $user->getEMailAddress();
+		$userAvatarUrl = $this->urlGenerator->linkToRouteAbsolute('core.avatar.getAvatar', ['userId' => $userId, 'size' => '64']);
+
+		$bioProperty = $account->getProperty(IAccountManager::PROPERTY_BIOGRAPHY);
+		$bio = null;
+		$fullBio = null;
+		if ($this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_BIOGRAPHY, $user, $currentUser)) {
+			$fullBio = $bioProperty->getValue();
+			$bio = $fullBio !== ''
+				? (mb_strlen($fullBio) > 80
+					? (mb_substr($fullBio, 0, 80) . '...')
+					: $fullBio)
+				: null;
+		}
+		$headline = $account->getProperty(IAccountManager::PROPERTY_HEADLINE);
+		$location = $account->getProperty(IAccountManager::PROPERTY_ADDRESS);
+		$website = $account->getProperty(IAccountManager::PROPERTY_WEBSITE);
+		$organisation = $account->getProperty(IAccountManager::PROPERTY_ORGANISATION);
+		$role = $account->getProperty(IAccountManager::PROPERTY_ROLE);
+
+		// for clients who can't render the reference widgets
+		$reference->setTitle($userDisplayName);
+		$reference->setDescription($userEmail ?? $userDisplayName);
+		$reference->setImageUrl($userAvatarUrl);
+
+		$isLocationVisible = $this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_ADDRESS, $user, $currentUser);
+
+		// for the Vue reference widget
+		$reference->setRichObject(
+			self::RICH_OBJECT_TYPE,
+			[
+				'user_id' => $userId,
+				'title' => $userDisplayName,
+				'subline' => $userEmail ?? $userDisplayName,
+				'email' => $userEmail,
+				'bio' => $bio,
+				'full_bio' => $fullBio,
+				'headline' => $this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_HEADLINE, $user, $currentUser) ? $headline->getValue() : null,
+				'location' => $isLocationVisible ? $location->getValue() : null,
+				'location_url' => $isLocationVisible ? $this->getOpenStreetLocationUrl($location->getValue()) : null,
+				'website' => $this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_WEBSITE, $user, $currentUser) ? $website->getValue() : null,
+				'organisation' => $this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_ORGANISATION, $user, $currentUser) ? $organisation->getValue() : null,
+				'role' => $this->profileManager->isProfileFieldVisible(IAccountManager::PROPERTY_ROLE, $user, $currentUser) ? $role->getValue() : null,
+				'url' => $referenceText,
+			]
+		);
+		return $reference;


With these new checks it looks like we are only exposing data that should be visible to the active user 👍

Looks good

chore: bump app version, NC30-31 chore: update changelog enh: migrate adjustments from (nextcloud/contacts#4231) chore: update npm packages Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

ChristophWurst · 2026-01-13T12:32:16Z

Is the plan to move the user picker into the Contacts app still?

julien-nc · 2026-01-13T12:35:57Z

No. Let's decide how to move it to server. Should it be a shipped app or in the core? I leaning towards a shipped app to isolate it (and make the move simpler 😁 ).

ChristophWurst · 2026-01-14T15:02:58Z

I'm fine with either. Shipped app is easy to set up, but cumbersome to maintain. Moving to server is more work now but easier to keep alive in the long run because it will live in a very active repository.

julien-nc added enhancement New feature or request 3. to review Waiting for reviews labels Nov 29, 2024

julien-nc requested a review from ChristophWurst November 29, 2024 14:40

julien-nc requested review from GVodyanov, SebastianKrupinski and hamza221 as code owners November 29, 2024 14:40

julien-nc force-pushed the enh/noid/profile-picker-move branch 4 times, most recently from 9090d67 to 4fb561f Compare December 4, 2024 14:15

julien-nc force-pushed the enh/noid/profile-picker-move branch 2 times, most recently from a8bdf1e to 686282e Compare December 5, 2024 16:39

julien-nc force-pushed the enh/noid/profile-picker-move branch 2 times, most recently from cbc1051 to a7cc035 Compare December 17, 2024 12:00

ChristophWurst reviewed Jan 16, 2025

View reviewed changes

andrey18106 mentioned this pull request Jan 21, 2025

feat: v1.2.0 maintenance update nextcloud/users_picker#21

Merged

andrey18106 and others added 4 commits January 12, 2026 11:25

feat(picker): Move users_picker profile custom picker to contacts

0a4b32c

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

chore: fix licenses

b086f6c

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

fix: profile picker tests

f14afb5

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

feat(profilepicker): check fields visibility in reference provider

d0bc3c1

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

julien-nc force-pushed the enh/noid/profile-picker-move branch from a7cc035 to d0bc3c1 Compare January 12, 2026 10:26

julien-nc added 2 commits January 13, 2026 11:39

feat(profilepicker): migrate to vue 3

de80604

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

feat(profilepicker): fix CI errors

98d8e16

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

julien-nc force-pushed the enh/noid/profile-picker-move branch from da271f4 to 98d8e16 Compare January 13, 2026 11:02

julien-nc requested a review from ChristophWurst January 13, 2026 12:22

ChristophWurst removed their request for review January 13, 2026 12:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move users_picker profile custom picker to contacts #4231

Move users_picker profile custom picker to contacts #4231

julien-nc commented Nov 29, 2024 •

edited

Loading

Uh oh!

SebastianKrupinski commented Nov 29, 2024

Uh oh!

julien-nc commented Dec 2, 2024

Uh oh!

codecov bot commented Dec 4, 2024 •

edited

Loading

Uh oh!

julien-nc commented Dec 4, 2024 •

edited

Loading

Uh oh!

ChristophWurst commented Dec 4, 2024

Uh oh!

ChristophWurst commented Dec 4, 2024

Uh oh!

julien-nc commented Dec 5, 2024

Uh oh!

ChristophWurst Jan 16, 2025

Uh oh!

ChristophWurst commented Jan 13, 2026

Uh oh!

julien-nc commented Jan 13, 2026 •

edited

Loading

Uh oh!

ChristophWurst commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Move users_picker profile custom picker to contacts #4231

Are you sure you want to change the base?

Move users_picker profile custom picker to contacts #4231

Conversation

julien-nc commented Nov 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SebastianKrupinski commented Nov 29, 2024

Uh oh!

julien-nc commented Dec 2, 2024

Uh oh!

codecov bot commented Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

julien-nc commented Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristophWurst commented Dec 4, 2024

Uh oh!

ChristophWurst commented Dec 4, 2024

Uh oh!

julien-nc commented Dec 5, 2024

Uh oh!

ChristophWurst Jan 16, 2025

Choose a reason for hiding this comment

Uh oh!

ChristophWurst commented Jan 13, 2026

Uh oh!

julien-nc commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristophWurst commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

julien-nc commented Nov 29, 2024 •

edited

Loading

codecov bot commented Dec 4, 2024 •

edited

Loading

julien-nc commented Dec 4, 2024 •

edited

Loading

julien-nc commented Jan 13, 2026 •

edited

Loading