fix(graph): verify token scopes against the url path

The scope handlers know CS3 request types and url paths; handing them the
*http.Request made every restricted scope fail with a type assertion error.
Pass the path, like reva's own http auth interceptor, and allow the graph
drives surface in the public share scope.

The vendored reva change (checkGraphDrivesPath) needs a reva PR before this
can go anywhere.

services/graph/pkg/middleware/auth.go

@@ -67,7 +67,10 @@ func Auth(opts ...account.Option) func(http.Handler) http.Handler {
 				errorcode.InvalidAuthenticationToken.Render(w, r, http.StatusUnauthorized, "invalid token")
 				return
 			}
-			if ok, err := scope.VerifyScope(ctx, tokenScope, r); err != nil || !ok {
+			// scope handlers know CS3 request types and URL paths; a restricted
+			// scope (a public share token, say) cannot judge an *http.Request.
+			// Pass the path, exactly like reva's own http auth interceptor.
+			if ok, err := scope.VerifyScope(ctx, tokenScope, r.URL.Path); err != nil || !ok {
 				opt.Logger.Error().Str(log.RequestIDString, r.Header.Get("X-Request-ID")).Err(err).Msg("verifying scope failed")
 				errorcode.InvalidAuthenticationToken.Render(w, r, http.StatusUnauthorized, "verifying scope failed")
 				return

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go

@@ -143,7 +143,7 @@ func publicshareScope(ctx context.Context, scope *authpb.Scope, resource interfa
 		// public links must not leak info about collaborative shares
 		return false, nil
 	case string:
-		return checkResourcePath(v), nil
+		return checkResourcePath(v) || checkGraphDrivesPath(v), nil
 	}
 
 	msg := "public resource type assertion failed"
@@ -151,6 +151,13 @@ func publicshareScope(ctx context.Context, scope *authpb.Scope, resource interfa
 	return false, errtypes.InternalError(msg)
 }
 
+// checkGraphDrivesPath allows the graph drive item surface. Which items a
+// public token may actually read is enforced per CS3 request (checkStorageRef);
+// this only opens the HTTP route, like /archiver or /app/open in checkResourcePath.
+func checkGraphDrivesPath(path string) bool {
+	return strings.HasPrefix(path, "/graph/v1.0/drives/") || strings.HasPrefix(path, "/graph/v1beta1/drives/")
+}
+
 func checkStorageRef(ctx context.Context, s *link.PublicShare, r *provider.Reference) bool {
 	// r: <resource_id:<storage_id:$storageID space_id:$spaceID opaque_id:$opaqueID> path:$path > >
 	if utils.ResourceIDEqual(s.ResourceId, r.GetResourceId()) {