feat(graph): public links - #3472

Draft

dschmidt wants to merge 26 commits into

mainfrom

feat/graph-public-link-listing

Commits on Sep 8, 2026

feat(proxy): authenticate graph requests carrying a public link token
dschmidt
committed
46a7dbf
fix(graph): verify token scopes against the url path
dschmidt
committed
40f7aaa
feat(graph): address drive items below the public share drive
dschmidt
committed
1d65ce7
test(acceptance): list public links via the graph api
dschmidt
committed
aa03c6c
fix(graph): advertise only what the public link grants
dschmidt
committed
d18c1a1
fix(vendor): filterPermissions misses DenyGrant
dschmidt
committed
b045b2b
refactor: the public link reduction lives once, in reva
dschmidt
committed
af99934
docs: trim comments
dschmidt
committed
adb7327
chore: drop a local compose override that slipped in
dschmidt
committed
6eb235a
refactor(graph): fail when the public link does not resolve
dschmidt
committed
da421b6
refactor: keep the provider's filter naming
dschmidt
committed
1e29eb9
test(acceptance): pin the item anchored colon path in a public link
dschmidt
committed
f640858
style: satisfy the gherkin and php linters
dschmidt
committed
a9822a7
fix(graph): keep CreateUploadSession strict below the public drive
dschmidt
committed
8733428
Revert "fix(graph): keep CreateUploadSession strict below the public drive"
dschmidt
committed
84f9621
test(acceptance): pin the upload session authorization on public links
dschmidt
committed
5b26087
chore: drop the local compose override again
dschmidt
committed
bcfccc4
docs: shorter comments
dschmidt
committed
56bee0a
docs: say why the prefix check does not apply below the public drive
dschmidt
committed
f70d2c4
fix(scope): pin the public share scope to the link's own graph drive
dschmidt
committed
a0e1d7c
fix(graph): keep owner data out of public link responses
dschmidt
committed
6d09a83
test(acceptance): pin the closed surface around a public link
dschmidt
committed
6727cec
fix(proxy): log a token hint, not the token
dschmidt
committed
d9613a0
test(acceptance): pin that writes through the public link surface are rejected
dschmidt
committed
1e6d2ec
feat(graph): tell password-required from wrong-password on public links
dschmidt
committed
b392f43
feat(graph): expose the sharer as the owner of a public link drive
dschmidt
committed
359dd2f

Navigation Menu

Uh oh!

Uh oh!

feat(graph): public links - #3472

feat(graph): public links#3472
dschmidt wants to merge 26 commits into
mainfrom
feat/graph-public-link-listing

Commits on Sep 8, 2026

feat(proxy): authenticate graph requests carrying a public link token

fix(graph): verify token scopes against the url path

feat(graph): address drive items below the public share drive

test(acceptance): list public links via the graph api

fix(graph): advertise only what the public link grants

fix(vendor): filterPermissions misses DenyGrant

refactor: the public link reduction lives once, in reva

docs: trim comments

chore: drop a local compose override that slipped in

refactor(graph): fail when the public link does not resolve

refactor: keep the provider's filter naming

test(acceptance): pin the item anchored colon path in a public link

style: satisfy the gherkin and php linters

fix(graph): keep CreateUploadSession strict below the public drive

Revert "fix(graph): keep CreateUploadSession strict below the public drive"

test(acceptance): pin the upload session authorization on public links

chore: drop the local compose override again

docs: shorter comments

docs: say why the prefix check does not apply below the public drive

fix(scope): pin the public share scope to the link's own graph drive

fix(graph): keep owner data out of public link responses

test(acceptance): pin the closed surface around a public link

fix(proxy): log a token hint, not the token

test(acceptance): pin that writes through the public link surface are rejected

feat(graph): tell password-required from wrong-password on public links

feat(graph): expose the sharer as the owner of a public link drive