From 04c90830e4efaf60bbdd0586a11c85f660a63897 Mon Sep 17 00:00:00 2001
From: Ishank Arora <ishank011@gmail.com>
Date: Tue, 16 Nov 2021 17:14:27 +0100
Subject: [PATCH] Add public link access via mount-ID:token/relative-path to
 the scope

---
 changelog/unreleased/public-link-token-scope.md | 3 +++
 pkg/auth/scope/publicshare.go                   | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)
 create mode 100644 changelog/unreleased/public-link-token-scope.md

diff --git a/changelog/unreleased/public-link-token-scope.md b/changelog/unreleased/public-link-token-scope.md
new file mode 100644
index 0000000000..fa4b9ba2f9
--- /dev/null
+++ b/changelog/unreleased/public-link-token-scope.md
@@ -0,0 +1,3 @@
+Bugfix: Add public link access via mount-ID:token/relative-path to the scope
+
+https://github.com/cs3org/reva/pull/2287
\ No newline at end of file
diff --git a/pkg/auth/scope/publicshare.go b/pkg/auth/scope/publicshare.go
index 65d8d86b42..b7f7d078b6 100644
--- a/pkg/auth/scope/publicshare.go
+++ b/pkg/auth/scope/publicshare.go
@@ -87,9 +87,11 @@ func publicshareScope(ctx context.Context, scope *authpb.Scope, resource interfa
 }
 
 func checkStorageRef(ctx context.Context, s *link.PublicShare, r *provider.Reference) bool {
-	// r: <resource_id:<storage_id:$storageID opaque_id:$opaqueID> path:$path > >
+	// r: <resource_id:<storage_id:$storageID opaque_id:$opaqueID> >
+	// OR
+	// r: <resource_id:<storage_id:$public-storage-mount-ID opaque_id:$token/$relative-path> >
 	if r.ResourceId != nil && r.Path == "" { // path must be empty
-		return utils.ResourceIDEqual(s.ResourceId, r.GetResourceId())
+		return utils.ResourceIDEqual(s.ResourceId, r.GetResourceId()) || strings.HasPrefix(r.ResourceId.OpaqueId, s.Token)
 	}
 
 	// r: <path:"/public/$token" >