Restricted access

CHANGELOG.md

@@ -8,6 +8,14 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ♻️(backend) route permission decisions through a swappable backend
+
+### Fixed
+
+- 🐛(backend) resolve the direct parent by exact path after a move
+
 ## [v0.21.1] - 2026-08-21
 
 ### Fixed

docker/auth/realm.json

@@ -64,6 +64,62 @@
         ],
         "realmRoles": ["user"]
       },
+      {
+        "username": "paige",
+        "email": "page.turner@library.book",
+        "firstName": "Paige",
+        "lastName": "Turner",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "miles",
+        "email": "miles.ahead@roadmap.fwd",
+        "firstName": "Miles",
+        "lastName": "Ahead",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "archie",
+        "email": "archie.vist@vaulted.docs",
+        "firstName": "Archie",
+        "lastName": "Vist",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "wade",
+        "email": "wade.wilson@maximum.effort",
+        "firstName": "Wade",
+        "lastName": "Wilson",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
       {
         "username": "user-e2e-chromium",
         "email": "user@chromium.test",

src/backend/core/api/serializers.py

@@ -2,6 +2,8 @@
 
 # pylint: disable=no-name-in-module
 
+from __future__ import annotations
+
 import json
 import logging
 from datetime import timedelta
@@ -744,15 +746,8 @@ class Meta:
             "link_reach",
         ]
 
-    def validate(self, attrs):
-        """Validate that link_role and link_reach are compatible using get_select_options."""
-        link_reach = attrs.get("link_reach")
-        link_role = attrs.get("link_role")
-
-        if not link_reach:
-            raise serializers.ValidationError({"link_reach": _("This field is required.")})
-
-        # Get available options based on ancestors' link definition
+    def _validate_against_ancestors(self, link_reach: str, link_role: str) -> None:
+        """Validate the link definition against the options allowed by ancestors."""
         available_options = LinkReachChoices.get_select_options(
             **self.instance.ancestors_link_definition
         )
@@ -784,12 +779,22 @@ def validate(self, attrs):
             raise serializers.ValidationError(
                 {
                     "link_role": (
-                        f"Link role '{link_role}' is not allowed for link reach '{link_reach}'. "
-                        f"Allowed roles: {allowed_roles_str}"
+                        f"Link role '{link_role}' is not allowed for link reach "
+                        f"'{link_reach}'. Allowed roles: {allowed_roles_str}"
                     )
                 }
             )
 
+    def validate(self, attrs: dict) -> dict:
+        """Validate that link_role and link_reach are compatible using get_select_options."""
+        link_reach = attrs.get("link_reach")
+        link_role = attrs.get("link_role")
+
+        if not link_reach:
+            raise serializers.ValidationError({"link_reach": _("This field is required.")})
+
+        self._validate_against_ancestors(link_reach, link_role)
+
         return attrs
 
 

src/backend/core/factories.py

@@ -68,7 +68,7 @@ class Meta:
     creator = factory.SubFactory(UserFactory)
     deleted_at = None
     link_reach = LinkReachChoices.RESTRICTED
-    type = factory.fuzzy.FuzzyChoice([t[0] for t in models.ItemTypeChoices.choices])
+    type = factory.fuzzy.FuzzyChoice([models.ItemTypeChoices.FOLDER, models.ItemTypeChoices.FILE])
     filename = factory.lazy_attribute(
         lambda o: fake.file_name() if o.type == models.ItemTypeChoices.FILE else None
     )
@@ -138,6 +138,18 @@ def upload_bytes(self, create, extracted, **kwargs):
             default_storage.save(self.file_key, BytesIO(content))
 
 
+class ShortcutFactory(ItemFactory):
+    """A factory to create shortcuts pointing to a restricted root folder."""
+
+    type = models.ItemTypeChoices.SHORTCUT
+    filename = None
+    target = factory.SubFactory(
+        ItemFactory,
+        type=models.ItemTypeChoices.FOLDER,
+        is_restricted=True,
+    )
+
+
 class UserItemAccessFactory(factory.django.DjangoModelFactory):
     """Create fake item user accesses for testing."""
 

src/backend/core/migrations/0029_item_add_is_restricted.py

@@ -0,0 +1,22 @@
+# Generated by Django 5.2.14 on 2026-07-24 15:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0028_item_creator_size_quota_idx'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='is_restricted',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddConstraint(
+            model_name='item',
+            constraint=models.CheckConstraint(condition=models.Q(('is_restricted', False), ('type', 'folder'), _connector='OR'), name='check_is_restricted_only_on_folders'),
+        ),
+    ]

src/backend/core/migrations/0030_item_add_shortcut_target.py

@@ -0,0 +1,32 @@
+# Generated by Django 5.2.14 on 2026-07-24 15:14
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0029_item_add_is_restricted'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='target',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='shortcuts', to='core.item'),
+        ),
+        migrations.AlterField(
+            model_name='item',
+            name='type',
+            field=models.CharField(choices=[('folder', 'Folder'), ('file', 'File'), ('shortcut', 'Shortcut')], default='folder', max_length=30),
+        ),
+        migrations.AddConstraint(
+            model_name='item',
+            constraint=models.CheckConstraint(condition=models.Q(models.Q(('type', 'shortcut'), ('target__isnull', False)), models.Q(models.Q(('type', 'shortcut'), _negated=True), ('target__isnull', True)), _connector='OR'), name='check_target_only_on_shortcuts'),
+        ),
+        migrations.AddConstraint(
+            model_name='item',
+            constraint=models.UniqueConstraint(fields=('target',), name='unique_shortcut_per_target'),
+        ),
+    ]