feat(graph): public links

[dschmidt]

List a public link over the Graph API instead of WebDAV:

GET /drives/{pub}/items/{pub}/children?public-token={token}
GET /drives/{pub}/root:/sub:/children?public-token={token}
GET /drives/{pub}/items/{id}?$expand=children&public-token={token}

{pub} is 7993447f-...$7993447f-...!{token}, the public mountpoint space; the client builds it from the token. A link password goes in as basic auth public:{password}.

What the change does:

• proxy: the public share authenticator now also covers /graph/ requests that carry a public-token, the same way it already covers the archiver.
• graph auth: VerifyScope is given the url path; before it got an *http.Request, which no scope handler can match, so every public token was rejected.
• the scope permits only the link's own public drive. Below it, items are addressed by their real ids and the token scope decides what is reachable.
• id addressing skips the publicstorageprovider, so its path/permission reduction is now shared (publicshare.FilterResourceInfo) and graph applies it too: paths relative to the share root, permissions capped at the link role.
• the drive exposes its owner as the person who shared the link, so a visitor to the drop page sees who the link is from. The public mountpoint space has no space owner to report, but the request runs as the share creator (publicshares auth), so drive.Owner is filled from the context user (id and display name). This is the same value ocdav already returns as oc:owner-display-name for a public link, so graph and webdav agree; it also matches MS Graph's sharedDriveItem.owner. A deliberate disclosure of the sharer's name to the anonymous visitor.

reva changes sit in vendor/ until we agree on the shape and I open a reva PR: the scope path check, the shared publicshare.Filter* (which also adds the DenyGrant field the old private copy dropped), and whether the reduction belongs in a gateway middleware (reva's own FIXME) rather than in each caller.

Upload sessions follow the link role (edit 200, view 404). The upload itself does not complete for anyone yet, public or logged in: the session hands back the internal data server url. That is existing behaviour and belongs to the graph upload work.

Tests: apiGraph/publicLinkDriveItemListing.feature, 21 scenarios. They cover the listing, both colon-path forms, expand, passwords, the sharer showing up as the drive owner, and the boundaries: no drive enumeration, no reading a space by id, no foreign drive, no write, no leak of paths above the share, share types or the owner's favorite flag.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 critical

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
Security	2 critical

View in Codacy

🟢 Metrics 27 complexity

Metric	Results
Complexity	27

View in Codacy

🟢 Coverage 22.73% diff coverage · -0.02% coverage variation

Metric	Results
Coverage variation	✅ -0.02% coverage variation (-1.00%)
Diff coverage	✅ 22.73% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (391705b)	88344	20828	23.58%
Head commit (359dd2f)	88460 (+116)	20835 (+7)	23.55% (-0.02%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3472)	132	30	22.73%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}