shared drive /open routes return the owner's public_name instead of the visitor's

[Crash--]

Summary

On a shared drive, GET /sharings/drives/:id/{notes,office,editor}/:file-id/open answers with public_name set to the drive owner, not to the member making the call. The same call on a regular cozy-to-cozy sharing correctly returns the caller's name.

public_name is what editors use to name the person opening the document (the Excalidraw live cursor, the OnlyOffice user), so the name is wrong whenever it is the one that gets used.

Observed

Instance qvalmori.twake.linagora.com opening an .excalidraw file in a drive owned by ashepilov.twake.linagora.com, on stack 52694defdd46b94d515081eeaaa46b3389dc07a9 (build 2026-09-08):

GET /sharings/drives/db6dcf8b.../editor/019f1da5.../open

{ "instance": "ashepilov.twake.linagora.com",
  "subdomain": "flat",
  "public_name": "ashepilov",
  "file_id": "019f1da5-...",
  "sharecode": "..." }

The sharecode itself is correct: its sub is interact:db6dcf8b...:qvalmori@linagora.com. Only public_name names the wrong person. /permissions/self on the owner's instance, with that same sharecode, returns Quentin Valmori.

Cause

The three open routes are registered behind proxy:

drive.GET("/notes/:file-id/open",  proxy(OpenNoteURL, true))
drive.GET("/office/:file-id/open", proxy(OpenOffice, true))
drive.GET("/editor/:file-id/open", proxy(OpenEditor, true))

On a recipient, proxy forwards the request to the owner, and takes a shortcut when both instances live on the same stack:

middlewares.SetInstance(c, owner)

So the handler runs with inst set to the owner. GetResult then computes:

if name, err := settings.PublicName(o.Inst); err == nil {
    result.PublicName = name
}

which is the owner's public name. The caller's identity is no longer reachable at that point: the authorization header has been replaced by the sharing's DriveToken.

On a non-drive sharing this does not happen, because openSharedFile forwards only the inner request and the caller's stack is the one running GetResult, so it overwrites PublicName with its own instance name.

Impact

Limited in practice for the web apps, since they prefer the name resolved from /permissions/self and only fall back to the username query parameter built from public_name. The wrong name surfaces when that lookup is unavailable, and any other consumer reading public_name directly gets the owner's name.

Affects notes, office and editor identically, since all three share the same wrapper.