Restricted access

CHANGELOG.md

@@ -44,6 +44,9 @@ and this project adheres to
 - ✨(frontend) add location, file type, contact and date search filters
 - ✨(backend) add a local entitlements backend with per-user storage limits
 - ✨(frontend) add storage gauge and settings modal
+- ♻️(backend) route permission decisions through a swappable backend
+- ✨(backend) add restricted access on folders, detached behind a shortcut
+- ✨(backend) allow restricting a folder at creation
 
 ### Fixed
 
@@ -52,6 +55,7 @@ and this project adheres to
 - 🐛(backend) exclude folders from file type search results
 - 🐛(frontend) keep uploaded items usable while malware analysis runs
 - 🐛(backend) stream export files from S3 without buffering
+- 🐛(backend) resolve the direct parent by exact path after a move
 
 ## [v0.19.0] - 2026-06-09
 

docker/auth/realm.json

@@ -64,6 +64,62 @@
         ],
         "realmRoles": ["user"]
       },
+      {
+        "username": "paige",
+        "email": "page.turner@library.book",
+        "firstName": "Paige",
+        "lastName": "Turner",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "miles",
+        "email": "miles.ahead@roadmap.fwd",
+        "firstName": "Miles",
+        "lastName": "Ahead",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "archie",
+        "email": "archie.vist@vaulted.docs",
+        "firstName": "Archie",
+        "lastName": "Vist",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
+      {
+        "username": "wade",
+        "email": "wade.wilson@maximum.effort",
+        "firstName": "Wade",
+        "lastName": "Wilson",
+        "enabled": true,
+        "credentials": [
+          {
+            "type": "password",
+            "value": "pass"
+          }
+        ],
+        "realmRoles": ["user"]
+      },
       {
         "username": "user-e2e-chromium",
         "email": "user@chromium.test",

src/backend/core/api/serializers.py

@@ -2,18 +2,21 @@
 
 # pylint: disable=no-name-in-module
 
+from __future__ import annotations
+
 import json
 import logging
 from datetime import timedelta
 from os.path import splitext
 from urllib.parse import quote
 
 from django.conf import settings
+from django.db.models import Q
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 
 from lasuite.drf.models.choices import LinkReachChoices, get_equivalent_link_definition
-from rest_framework import serializers
+from rest_framework import exceptions, serializers
 
 from core import enums, models
 from core.api import utils
@@ -219,6 +222,43 @@ class Meta:
         ]
 
 
+class ShortcutTargetSerializer(serializers.ModelSerializer):
+    """Serialize the restricted folder a shortcut points to."""
+
+    deleted = serializers.SerializerMethodField()
+    can_access = serializers.SerializerMethodField()
+
+    class Meta:
+        model = models.Item
+        fields = ["id", "title", "is_restricted", "deleted", "can_access"]
+        read_only_fields = ["id", "title", "is_restricted", "deleted", "can_access"]
+
+    def get_deleted(self, target) -> bool:
+        """Return whether the target is in the trash."""
+        return target.deleted_at is not None
+
+    def get_can_access(self, target) -> bool:
+        """Return whether the request user can open the target."""
+        request = self.context.get("request")
+        user = request.user if request else None
+        if user is not None and user.is_authenticated:
+            accesses = getattr(target, "viewer_accesses", None)
+            if accesses is None:
+                has_access = models.ItemAccess.objects.filter(
+                    Q(user=user) | Q(team__in=user.teams),
+                    item=target,
+                ).exists()
+            else:
+                has_access = bool(accesses)
+            if has_access:
+                return True
+        return target.link_reach == LinkReachChoices.PUBLIC or (
+            target.link_reach == LinkReachChoices.AUTHENTICATED
+            and user is not None
+            and user.is_authenticated
+        )
+
+
 class ListItemSerializer(serializers.ModelSerializer):
     """Serialize items with limited fields for display in lists."""
 
@@ -232,6 +272,7 @@ class ListItemSerializer(serializers.ModelSerializer):
     creator = UserLightSerializer(read_only=True)
     hard_delete_at = serializers.SerializerMethodField(read_only=True)
     is_wopi_supported = serializers.SerializerMethodField()
+    target = ShortcutTargetSerializer(read_only=True, allow_null=True)
 
     class Meta:
         model = models.Item
@@ -248,10 +289,12 @@ class Meta:
             "is_favorite",
             "link_role",
             "link_reach",
+            "is_restricted",
             "nb_accesses",
             "numchild",
             "numchild_folder",
             "path",
+            "target",
             "title",
             "updated_at",
             "user_role",
@@ -280,10 +323,12 @@ class Meta:
             "creator",
             "depth",
             "is_favorite",
+            "is_restricted",
             "link_role",
             "link_reach",
             "nb_accesses",
             "path",
+            "target",
             "updated_at",
             "user_role",
             "type",
@@ -478,10 +523,12 @@ class Meta:
             "is_favorite",
             "link_role",
             "link_reach",
+            "is_restricted",
             "nb_accesses",
             "numchild",
             "numchild_folder",
             "path",
+            "target",
             "title",
             "updated_at",
             "user_role",
@@ -534,7 +581,19 @@ def create(self, validated_data):
         raise NotImplementedError("Create method can not be used.")
 
     def update(self, instance, validated_data):
-        """Validate that the title is unique in the current path."""
+        """Update an item, handling restriction and title uniqueness."""
+        is_restricted = validated_data.pop("is_restricted", None)
+        if is_restricted is not None and is_restricted != instance.is_restricted:
+            user = self.context["request"].user
+            if not instance.get_abilities(user).get("restrict"):
+                raise exceptions.PermissionDenied()
+            # Toggling restriction moves the item: keep working on the
+            # returned instance so its refreshed path is not overwritten
+            if is_restricted:
+                instance = instance.restrict(user)
+            else:
+                instance = instance.unrestrict()
+
         if validated_data.get("title") and instance.title != validated_data.get("title"):
             if instance.depth > 1:
                 validated_data["title"] = instance.manage_unique_title(validated_data.get("title"))
@@ -577,6 +636,7 @@ class Meta:
             "creator",
             "depth",
             "is_favorite",
+            "is_restricted",
             "link_role",
             "link_reach",
             "nb_accesses",
@@ -687,6 +747,18 @@ def validate(self, attrs):
                 code="item_create_folder_title_required",
             )
 
+        if attrs["type"] == models.ItemTypeChoices.SHORTCUT:
+            raise serializers.ValidationError(
+                {"type": _("Shortcuts can only be created by restricting a folder.")},
+                code="item_create_shortcut_forbidden",
+            )
+
+        if attrs.get("is_restricted") and attrs["type"] != models.ItemTypeChoices.FOLDER:
+            raise serializers.ValidationError(
+                {"is_restricted": _("Only folders can be restricted.")},
+                code="item_create_restricted_only_on_folders",
+            )
+
         return super().validate(attrs)
 
     def get_policy(self, item):
@@ -744,15 +816,8 @@ class Meta:
             "link_reach",
         ]
 
-    def validate(self, attrs):
-        """Validate that link_role and link_reach are compatible using get_select_options."""
-        link_reach = attrs.get("link_reach")
-        link_role = attrs.get("link_role")
-
-        if not link_reach:
-            raise serializers.ValidationError({"link_reach": _("This field is required.")})
-
-        # Get available options based on ancestors' link definition
+    def _validate_against_ancestors(self, link_reach: str, link_role: str) -> None:
+        """Validate the link definition against the options allowed by ancestors."""
         available_options = LinkReachChoices.get_select_options(
             **self.instance.ancestors_link_definition
         )
@@ -784,12 +849,22 @@ def validate(self, attrs):
             raise serializers.ValidationError(
                 {
                     "link_role": (
-                        f"Link role '{link_role}' is not allowed for link reach '{link_reach}'. "
-                        f"Allowed roles: {allowed_roles_str}"
+                        f"Link role '{link_role}' is not allowed for link reach "
+                        f"'{link_reach}'. Allowed roles: {allowed_roles_str}"
                     )
                 }
             )
 
+    def validate(self, attrs: dict) -> dict:
+        """Validate that link_role and link_reach are compatible using get_select_options."""
+        link_reach = attrs.get("link_reach")
+        link_role = attrs.get("link_role")
+
+        if not link_reach:
+            raise serializers.ValidationError({"link_reach": _("This field is required.")})
+
+        self._validate_against_ancestors(link_reach, link_role)
+
         return attrs