From 40f7aaa327b9dfd85b120d625f432d762a82e6f2 Mon Sep 17 00:00:00 2001
From: Dominik Schmidt <dev@dominik-schmidt.de>
Date: Sun, 6 Sep 2026 22:55:52 +0200
Subject: [PATCH] fix(graph): verify token scopes against the url path

The scope handlers know CS3 request types and url paths; handing them the
*http.Request made every restricted scope fail with a type assertion error.
Pass the path, like reva's own http auth interceptor, and allow the graph
drives surface in the public share scope.

The vendored reva change (checkGraphDrivesPath) needs a reva PR before this
can go anywhere.
---
 services/graph/pkg/middleware/auth.go                    | 5 ++++-
 .../opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go   | 9 ++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/services/graph/pkg/middleware/auth.go b/services/graph/pkg/middleware/auth.go
index aba4d44b3d..b24e6c5f29 100644
--- a/services/graph/pkg/middleware/auth.go
+++ b/services/graph/pkg/middleware/auth.go
@@ -67,7 +67,10 @@ func Auth(opts ...account.Option) func(http.Handler) http.Handler {
 				errorcode.InvalidAuthenticationToken.Render(w, r, http.StatusUnauthorized, "invalid token")
 				return
 			}
-			if ok, err := scope.VerifyScope(ctx, tokenScope, r); err != nil || !ok {
+			// scope handlers know CS3 request types and URL paths; a restricted
+			// scope (a public share token, say) cannot judge an *http.Request.
+			// Pass the path, exactly like reva's own http auth interceptor.
+			if ok, err := scope.VerifyScope(ctx, tokenScope, r.URL.Path); err != nil || !ok {
 				opt.Logger.Error().Str(log.RequestIDString, r.Header.Get("X-Request-ID")).Err(err).Msg("verifying scope failed")
 				errorcode.InvalidAuthenticationToken.Render(w, r, http.StatusUnauthorized, "verifying scope failed")
 				return
diff --git a/vendor/github.com/opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go b/vendor/github.com/opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go
index ce1a9e29e2..0dc4bb763f 100644
--- a/vendor/github.com/opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go
+++ b/vendor/github.com/opencloud-eu/reva/v2/pkg/auth/scope/publicshare.go
@@ -143,7 +143,7 @@ func publicshareScope(ctx context.Context, scope *authpb.Scope, resource interfa
 		// public links must not leak info about collaborative shares
 		return false, nil
 	case string:
-		return checkResourcePath(v), nil
+		return checkResourcePath(v) || checkGraphDrivesPath(v), nil
 	}
 
 	msg := "public resource type assertion failed"
@@ -151,6 +151,13 @@ func publicshareScope(ctx context.Context, scope *authpb.Scope, resource interfa
 	return false, errtypes.InternalError(msg)
 }
 
+// checkGraphDrivesPath allows the graph drive item surface. Which items a
+// public token may actually read is enforced per CS3 request (checkStorageRef);
+// this only opens the HTTP route, like /archiver or /app/open in checkResourcePath.
+func checkGraphDrivesPath(path string) bool {
+	return strings.HasPrefix(path, "/graph/v1.0/drives/") || strings.HasPrefix(path, "/graph/v1beta1/drives/")
+}
+
 func checkStorageRef(ctx context.Context, s *link.PublicShare, r *provider.Reference) bool {
 	// r: <resource_id:<storage_id:$storageID space_id:$spaceID opaque_id:$opaqueID> path:$path > >
 	if utils.ResourceIDEqual(s.ResourceId, r.GetResourceId()) {