Support dynamic approvers based on requester's group (e.g. admin of group) #448

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Feature request

Which Nextcloud Version are you currently using: (see administration page)

v35.0.0

Is your feature request related to a problem? Please describe.

Currently, approval rules only support static approvers: a fixed user, a fixed group, or a fixed circle
(userIsAuthorizedByRule() in lib/Service/ApprovalService.php). There's no way to say "the approver is
dynamically derived from the requester", e.g. "the requester's group admin/subadmin".

For organizations with many teams (e.g. 100 groups, each with its own team lead), this currently requires
creating one rule + one dedicated set of tags per group, since a pending tag can only belong to one rule
(hasConflict() in lib/Service/RuleService.php). This does not scale.

Describe the solution you'd like

Add a new approver type, e.g. "group admin" (Nextcloud's group subadmin), so that a single rule can express:

• Requesters: members of group G
• Approvers: the subadmin(s)/manager of group G (dynamically resolved per requester, not a static user/group list)

This way, one rule can cover all groups: whichever group the requester belongs to, the request is routed only
to that group's admin, and other groups' admins never see it.

Describe alternatives you've considered

Creating one rule per group (with a dedicated set of hidden tags per rule) as a workaround, but this doesn't
scale to dozens/hundreds of groups and requires manual admin configuration for each one.

Additional context

This would likely need changes to:

• The Rule approver type handling (type: 'user' | 'group' | 'circle') to add a type: 'group_admin' option
• userIsAuthorizedByRule() to check if the current user is a subadmin of the requester's group
• The rule creation UI (src/components/AdminSettings.vue) to allow selecting this new approver type