Use Effective Access In Shared-Drive File Routes

[shepilov]

Context

Shared-drive file routes currently authorize users mostly through the route shared drive ID, using direct membership checks on the corresponding io.cozy.sharings document. This is not enough for nested shared folders.

The backend should authorize file operations against the effective access of the target file or folder, not only against the direct members of /sharings/drives/:id.

Goal

Update shared-drive file routes so they use the effective access resolver for permission checks.

The check should answer:

• can the current user read this target file/folder?
• can the current user write/update/delete this target file/folder?
• can the current user create content inside this destination folder?

Scope

Update the shared-drive route authorization layer in web/sharings/drives.go, especially:

• proxy
• sharedDrivePermissionCheck
• checkSharedDrivePermission
• validateSharedDrivePermissionTargetID
• any middlewares.AllowVFS integration used by these routes

The route guard should become target-aware when a :file-id or destination folder is involved.

Related Endpoints

Read-like routes:

HEAD /sharings/drives/:id/download/:file-id
GET /sharings/drives/:id/download/:file-id
HEAD /sharings/drives/:id/download/:file-id/:version-id
GET /sharings/drives/:id/download/:file-id/:version-id
GET /sharings/drives/:id/_changes
HEAD /sharings/drives/:id/:file-id
GET /sharings/drives/:id/metadata
GET /sharings/drives/:id/:file-id
GET /sharings/drives/:id/:file-id/size
GET /sharings/drives/:id/:file-id/thumbnails/:secret/:format
POST /sharings/drives/:id/downloads
GET /sharings/drives/:id/downloads/:secret/:fake-name
POST /sharings/drives/:id/archive
GET /sharings/drives/:id/archive/:secret/:fake-name
GET /sharings/drives/:id/notes/:file-id/open
GET /sharings/drives/:id/office/:file-id/open
GET /sharings/drives/:id/shortcuts/:file-id
GET /sharings/drives/:id/realtime

Write-like routes:

POST /sharings/drives/:id/:file-id/versions
PATCH /sharings/drives/:id/:file-id
POST /sharings/drives/:id/
POST /sharings/drives/:id/:file-id
PUT /sharings/drives/:id/:file-id
POST /sharings/drives/:id/upload/metadata
POST /sharings/drives/:id/:file-id/copy
POST /sharings/drives/:id/trash/:file-id
DELETE /sharings/drives/:id/trash/:file-id
DELETE /sharings/drives/:id/:file-id
POST /sharings/drives/:id/notes

Permission Rules

For read routes: require effective read on the target file/folder
For write/update/delete routes: require effective write on the target file/folder
For create/upload routes: require effective write/create on the destination folder
For metadata update / rename / backend folder move through PATCH: require effective write on the source item

Out Of Scope

This task should not include:

• POST /sharings/drives/move, handled by a dedicated backend move task
• recipient management endpoints
• share-by-link permissions endpoints
• effective recipients API for the Share modal
• limited access / restrictive folder support