Support dynamic approvers based on requester's group (e.g. admin of group)

[watermelon0339]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Feature request

Which Nextcloud Version are you currently using: (see administration page)

v35.0.0

Is your feature request related to a problem? Please describe.

Currently, approval rules only support static approvers: a fixed user, a fixed group, or a fixed circle
(userIsAuthorizedByRule() in lib/Service/ApprovalService.php). There's no way to say "the approver is
dynamically derived from the requester", e.g. "the requester's group admin/subadmin".

For organizations with many teams (e.g. 100 groups, each with its own team lead), this currently requires
creating one rule + one dedicated set of tags per group, since a pending tag can only belong to one rule
(hasConflict() in lib/Service/RuleService.php). This does not scale.

Describe the solution you'd like

Add a new approver type, e.g. "group admin" (Nextcloud's group subadmin), so that a single rule can express:

• Requesters: members of group G
• Approvers: the subadmin(s)/manager of group G (dynamically resolved per requester, not a static user/group list)

This way, one rule can cover all groups: whichever group the requester belongs to, the request is routed only
to that group's admin, and other groups' admins never see it.

Describe alternatives you've considered

Creating one rule per group (with a dedicated set of hidden tags per rule) as a workaround, but this doesn't
scale to dozens/hundreds of groups and requires manual admin configuration for each one.

Additional context

This would likely need changes to:

• The Rule approver type handling (type: 'user' | 'group' | 'circle') to add a type: 'group_admin' option
• userIsAuthorizedByRule() to check if the current user is a subadmin of the requester's group
• The rule creation UI (src/components/AdminSettings.vue) to allow selecting this new approver type

[lukasdotcom]

Hi @watermelon0339,

I'm not sure if this approach would work as a user can be in multiple groups that all have different admins. Something that might work better is using the manager attribute for a user and creating a new special kind of approval rule that dynamically gets the approver based on the manager attribute.

[watermelon0339]

Hi @watermelon0339,

I'm not sure if this approach would work as a user can be in multiple groups that all have different admins. Something that might work better is using the manager attribute for a user and creating a new special kind of approval rule that dynamically gets the approver based on the manager attribute.

Using the manager attribute for a user looks like a very good approach. With it, workflows such as the following approval chain can be implemented very easily:

Workflow Chain:

[Workflow 1]
Tag to act on:            TagStage1
Who can request approval: GroupA
Who can approve:          Manager of the requester
Tag set on approval:      TagStage2
Tag set on rejection:     TagStage1Rejected

[Workflow 2]
Tag to act on:            TagStage2
Who can request approval: Nobody
Who can approve:          Manager of the requester
Tag set on approval:      TagStage3
Tag set on rejection:     TagStage2Rejected

[Workflow 3]
Tag to act on:            TagStage3
Who can request approval: Nobody
Who can approve:          Manager of the requester
Tag set on approval:      TagFinished
Tag set on rejection:     TagStage3Rejected

One potential limitation is that a user can only have a single manager attribute, which restricts the setup to a single approval hierarchy.

In the future, it might be useful to allow additional custom relationship attributes (for example, leader, department head, project owner, etc.). This would enable multiple approval chains to coexist and cover a wider range of organizational workflows.