Navigating by id bypasses the publicstorageprovider, so the permission sets
are the owner's: a view-only link advertised delete and upload on items below
the root. Intersect with the link's permissions, the same reduction the
publicstorageprovider applies on its own responses; enforcement was always
intact through the token scope.
Dominik Schmidt
d18c1a1edb