Share notifications are sent to disabled users

[michaelstingl]

Describe the bug

OpenCloud sends space-share notification emails to disabled users. This occurs both when a space is shared directly with a disabled user and when it is shared with a group containing a disabled member.

Steps to reproduce

The following was reproduced locally with the existing acceptance-test stack and Inbucket as the SMTP sink.

1. Start opencloudeu/opencloud-rolling:7.5.0 with the notifications service and SMTP delivery to Inbucket.
2. Create a disposable space owned by Alice.
3. For the direct-share case, disable Brian through the Graph API and share the space directly with Brian.
4. For the group-share case, create a group containing Brian and active Carol, disable Brian through the Graph API, and share the space with the group.
5. Check the Inbucket mailboxes.

Expected behavior

Disabled users should not receive space-share notification emails. Active members of a shared group should continue to receive them.

Actual behavior

Both share operations returned HTTP 200, but Brian's Inbucket mailbox contained one email although no email was expected. In the group-share case, active Carol also received her notification. The behavior was reproduced with both direct and group shares on 7.5.0.

Setup

• Server image: opencloudeu/opencloud-rolling:7.5.0
• Acceptance runner: local woodpecker-cli exec on Rancher Desktop Moby
• Mail sink: inbucket/inbucket:latest, SMTP on email:2500, API on email:9000
• Storage driver: posix

Source trace

The observed direct-share path is:

Graph API direct share
  -> SpaceShared event
    -> notifications: handleSpaceShared()
      -> ensureGranteeList() / getGranteeList()
        -> direct grantee: disableEmails() check
          -> GetUser() returns the CS3 user object
            -> missing-email check
              -> render and send the email to Brian's address

The observed group-share path is:

Graph API group share
  -> SpaceShared event
    -> notifications: handleSpaceShared()
      -> ensureGranteeList() / getGranteeList()
        -> GetGroup() and iterate all group members
          -> filter executant and notification opt-out
            -> GetUser() returns the CS3 user object
              -> missing-email check
                -> render and send the email to Brian's address

In the v7.5.0 source, getGranteeList() has no account-state filter for expanded group members (services/notifications/pkg/service/service.go:200-249). The CS3 user object used by GetUser() contains identity and mail fields but no AccountEnabled field. The Graph/LDAP model maps account state separately.

_{🤖 drafted with OpenAI Codex, reviewed before submitting.}

[rhafer]

@tbsbdr This is probably something for the product board to discuss.

I already wrote it in the related PR, but I guess it fits here better:

When adding that enabled/disable feature on the Graph API the only purpose of it was to be able to prevent users from being able to login to OpenCloud. We deliberately accepted the fact that it is still possible to create shares with users that are disabled (and by that also send notifications to those users).