[JammingBen]

Description

Guest links now open the file listing, scoped to the share the guest was invited to.

Known limitations

These are backend limitations. The UI doesn't hide the affected actions, because backend support is planned:

• Archive download: downloading folders or multiple files fails, because the archiver and OCS URL signing don't accept the guest session. see Guests can't download archives opencloud#3741.
• Version download: fails, because URL signing requires a user.

More general limitations:

• Collaboration via yjs: guestlinks: test/fix collaboration via YJS opencloud#3628
• Search: the search bar is hidden for guests. [Guests] Search for guests #3819
• Live updates (SSE): [Guests] Live share updates for guests #3818
• Permanent link: not available, see [Guests] Open permanent links as a guest #3817
• Tags: not available
• Versions: not available for share reciever. see [Guests] Versions don't get listed #3833
• Activities: not available for share reciever

Issue

closes #2825

Fixes #3831

How to test

1. Pull the latest opencloud image
2. run docker run --rm --network container:web_oc natsio/nats-box nats -s nats://127.0.0.1:9233 sub main-queue --raw | jq --unbuffered -r 'select(.Metadata.eventtype | test("GuestTokenCreated")) | .Payload | @base64d | fromjson | .Token'
3. create a guest invite
4. copy the token from the output of (1)
5. use the token in the URL https://host.docker.internal:9200/g/

[JammingBen]

Ah wait, I found an issue with file shares, converting back to draft for now. Now it's good to go.

[AlexAndBear]

Remaining frontend differences (compared to public link context):

• Upload-only: New → Markdown creates an empty file (201), then opens it read-only without Save. Public links hide document creation for this permission. The creation guard only checks public spaces.
• Viewer: Guests get Copy to and Save as, but every destination is unwritable. Public viewers hide both. The copy guard assumes authenticated users have a writable home; the Save as guard allows every non-public context.
• Single-file invitations: Save as is also offered without an accessible destination folder. Public single-file links hide it.

Please apply the corresponding permission/destination checks to guests.

Additional backend/session limitations to document, beyond those already listed in the PR (tested with rolling 8.1.0+40095460):

• Office: /app/open and /app/new return 401 with a valid guest cookie; equivalent public links return 200. Both paths are missing from the backend guest-auth allowlist. This also affects the Collabora-based secure PDF viewer.
• Parallel invitations: Opening Guest B in another tab replaces Guest A's session. Reloading A requires invitation renewal; two public links remain usable in parallel.
• Whole project spaces: Adding a guest reports success and creates membership, but emits SpaceShared without GuestTokenCreated, so no invitation token is generated. A public link to the same space root works.

[AlexAndBear]

🙌

[AlexAndBear]

Exploratory browser testing found two additional issues. Approval stands — please fix these in a follow-up PR.

• Share-root Copy/Move: As a Guest with Can edit, open the shared root’s breadcrumb menu → Copy to / Move to. The destination dialog is blank: its iframe opens the regular authenticated route and redirects to login. Public Links hide these root actions; operations on files/subfolders work. Please hide root actions without a valid destination.
• SVG preview with separate Web/API origins: Open an SVG as Guest → blank preview, DAV GET 401 because the renderer omits the guest cookie. The equivalent Public Link renders correctly. Reproduced in Chromium, Firefox and WebKit; same-origin Guest preview works. Please use credentialed SVG loading.

Tested at 5a199ef3, backend 8.1.0+40095460. Already documented limitations excluded.