[SharingNg] Cannot find {item-id} in share invite endpoint while resharing a resource inside a shared folder

[PrajwolAmatya]

Description

When a resource is shared with a user, and that user tries to reshare the shared resource, then the value of item-id in the API endpoint for share invite as mentioned in https://owncloud.dev/libre-graph-api/#/drives.permissions/Invite takes the share mount id of that resource, that is, v1beta1/drives/{drive-id}/items/{share-mount-id}/invite.

1. Alice creates a file testfile.txt
2. Alice shares file to user Brian
3. Brian reshares the file testfile.txt to user Carol using endpoint v1beta1/drives/{drive-id}/items/{share-mount-id}/invite.
4. Carol receives the file testfile.txt

But in the case as follows:

1. Alice creates a folder folderToShare
2. Alice uploads file testfile.txt inside folder folderToShare
3. Alice shares folder folderToShare to user Brian
4. Brian tries to reshare the file testfile.txt that is inside the shared folder folderToShare

In this case, what should be the value of item-id in the API endpoint? I tried using the file-id of file testfile.txt, and it returns the following error:

{
    "error": {
        "code": "itemNotFound",
        "innererror": {
            "date": "2024-01-09T03:26:25Z",
            "request-id": "prajwol-OptiPlex-3050/ijWx6R6gWr-000298"
        },
        "message": "driveID and itemID do not match"
    }
}

[SagarGi]

Leaving this issue for open now since the reshare feature to expected to be drop in feature as per this comment #8275 (review). So this can be left open untill decided.

[micbar]

@rhafer @fschade we should validate in the invite endpoint if a reshare is being created and deny that.

[rhafer]

we should validate in the invite endpoint if a reshare is being created and deny that.

@micbar That is bascially what happens here (in a more generic way). Though I guess we should return a 400 an not a 404 here.

@PrajwolAmatya please share the exact url of the request that you were using.

[PrajwolAmatya]

@rhafer This is the url I used for the share invitation as mentioned in https://owncloud.dev/libre-graph-api/#/drives.permissions/Invite. I was trying some tests on resharing cases, I found that while resharing, file-id cannot be used in the item-id of the url. Instead, it takes the share mount id, which is valid. But in the case of resharing the resource inside a shared folder, I could not find what exactly should be the value of item-id in the request url.

curl -kv -XPOST "https://localhost:9200/graph/v1beta1/drives/{drive-id}/items/{item-id}/invite" -d '{
  "recipients": [
    {
      "@libre.graph.recipient.type": "user",
      "objectId": "96641689-0e48-4c2d-80ff-3cf8facf69bd"
    }
  ],
  "roles": [
    "1c996275-f1c9-4e71-abdf-a42f6495e960"
  ]
}' -u<username>:<password>

[fschade]

@PrajwolAmatya i'm not sure if i understood your problem, the sharing-ng is currently in development and we still have lot of moving parts.

regarding the drive-id and item-id checks if the StorageId and SpaceId id match, that means we have to always provide a matching pair!

can you try to explain how we can help?

@micbar i agree, we should check and disallow, can you or ralf add the check, i have not enough time currently since the k6 squad starts tomorrow.

[PrajwolAmatya]

@fschade I was testing on resharing of a file that is inside of a shared folder. And, I could not figure out what should be the value of the item-id in the share invitation end point.

[amrita-shrestha]

Closing this issue because reshare has been deprecated from ocis on this PR #8762. Mentioned in migration doc https://github.com/owncloud/docs-ocis/pull/739/files#diff-04cd79e526c8a7f0162d8fc5bc5fa8c501fe9e5899024268837c05a74349b26cR148-R149