Traversal rights
The present technology pertains to a organization directory hosted by a synchronized content management system. The corporate directory can provide access to user accounts for all members of the organization to all content items in the organization directory on the respective file systems of the members' client devices. Members can reach any content item at the same path as other members relative to the organization directory root on their respective client device. In some embodiments novel access permissions are granted to maintain path consistency.
1. A non-transitory computer readable medium comprising instructions stored thereon, when executed the instructions are effective to cause a content management system to:
provide at least read access to a user account for a folder contained within a superordinate folder to which the user account does not have access due to an access policy for the superordinate folder;
determine that the user account is a member of an organization directory in which the superordinate folder is contained and has at least read access rights to the folder contained within the superordinate folder to which the user account does not have access rights to; and
in response to the determination that the user account is a member of the organization directory and has at least read access rights to the folder, automatically grant a traversal right to the user account for the superordinate folder, whereby the user account can navigate through the superordinate folder in a file explorer user interface to reach the folder to which the user account has been provided at least read access, wherein the superordinate folder further comprises other content items that are visible to another user account while excluded from being shown to the user account.
2. The non-transitory computer readable medium of claim 1 , comprising instructions to cause the content management system to:
detect that the folder has been mounted and that the user account has at least read access to the folder;
determine that a path to the folder includes the superordinate folder to which the user account does not have access; and
record a path to the superordinate folder to which the user account does not have access and the path to the folder in a traversal rights dictionary.
3. The non-transitory computer readable medium of claim 2 , comprising instructions to cause the content management system to:
communicate with a client device having access to the user account to synchronize the folder; and
send the folder and all content items within the folder to the client device, and send information regarding folders in the path to the folder.
4. The non-transitory computer readable medium of claim 3 , comprising instructions to cause the content management system to:
in addition to the sending of the folder and the information regarding the folders in the path, exclude any content items within the superordinate folder other than any folders identified in the path to the folder.
5. The non-transitory computer readable medium of claim 4 , comprising instructions to cause the content management system to:
send a cursor to the client device, the cursor including a record of the user account's at least read access to the folder, and including the path recorded in the traversal rights dictionary.
6. The non-transitory computer readable medium of claim 5 , comprising instructions to cause the content management system to:
receive a request to synchronize the folder, the request including the cursor; using the cursor to confirm the user account's at least read access to the folder, and the user account's traversal rights to the path included in the cursor; and
synchronize the folder.
7. The non-transitory computer readable medium of claim 6 , comprising instructions to cause the content management system to:
remove the at least read access from the user account for the folder contained within the superordinate folder to which the user account does not have access;
remove the path recorded in the traversal rights dictionary;
send an instruction to the client device to delete the folder, and any folders in the path to the folder to which the user account does not have access; and
send a second cursor to the client device without the record referencing the folder.
8. The non-transitory computer readable medium of claim 1 wherein the instructions to provide at least read access to the user account for the folder contained within the superordinate folder to which the user account does not have access further includes instructions that are effective to cause the content management system to:
associate the user account with the folder in a restrictive access control list;
wherein the restrictive access control list overrides the access policy for the superordinate folder including the folder to prohibit at least the user account having access to the superordinate folder from accessing the folder and from seeing an existence of the folder except for the user account that is included in the restrictive access control list in association with the folder, thereby providing the at least read access to the user account for the folder.
9. A method comprising:
detecting that a folder has been mounted and that a user account is a member of an organization directory in which a superordinate folder is contained and has at least read access to the folder;
determining that a path to the folder includes the superordinate folder that restricts access by the user account; and
in response to the determination that the user account is a member of the organization directory and has at least read access rights to the folder, automatically recording a path to the superordinate folder to which the user account does not have access and the path to the folder in a traversal rights dictionary, whereby the user account can navigate through the superordinate folder in a file explorer user interface to reach the folder to which the user account has been provided at least read access, wherein the superordinate folder further comprises other content items that are visible to another user account while not shown to the user account.
10. The method of claim 9 comprising:
sending an instruction to a client device that is authorized to access the user account to synchronize the folder;
sending the folder and all content items within the folder to the client device; and
sending information regarding folders in the path to the folder.
11. The method of claim 10 , comprising:
excluding any content items within the superordinate folder other than any folders identified in the path to the folder.
12. The method of claim 11 , comprising:
sending a cursor to the client device, the cursor including a record of the user account's at least read access to the folder, and including the path recorded in the traversal rights dictionary.
13. The method of claim 12 , comprising:
receiving a request to synchronize the folder, the request including the cursor;
confirming the user account's at least read access to the folder using the record in the cursor, and the user account's traversal rights to the path included in the cursor; and
synchronizing the folder.
14. The method of claim 13 , comprising:
removing the at least read access from the user account for the folder contained within the superordinate folder to which the user account does not have access;
removing the path recorded in the traversal rights dictionary;
sending an instruction to the client device to delete the folder, and any folders in the path to the folder to which the user account does not have access; and
sending a second cursor to the client device without the record referencing the folder.
15. A content management system comprising:
at least one processor; and
at least one memory having instructions stored thereon, that when executed the instructions are effective to cause the at least one processor to:
provide at least read access to a user account for a folder contained within a superordinate folder to which the user account does not have access due to an access policy for the superordinate folder;
determine that the user account is a member of an organization directory in which the superordinate folder is contained and has at least read access rights to the folder contained within the superordinate folder to which the user account does not have access rights to; and
in response to the determination that the user account is a member of the organization directory and has at least read access rights to the folder, automatically grant a traversal right to the user account for the superordinate folder, whereby the user account can navigate through the superordinate folder in a file explorer user interface to reach the folder to which the user account has been provided at least read access, wherein the superordinate folder further comprises other content items that are visible to another user account while excluded from being shown to the user account.
16. The content management system of claim 15 , comprising instructions to cause the at least one processor to:
detect that the folder has been mounted and that the user account has at least read access to the folder;
determine that a path to the folder includes the superordinate folder to which the user account does not have access; and
record a path to the superordinate folder to which the user account does not have access and the path to the folder in a traversal rights dictionary.
17. The content management system of claim 16 , comprising instructions to cause the at least one processor to:
communication with a client device having access to the user account to synchronize the folder; and
send the folder and all content items within the folder to the client device, and send information regarding folders in the path to the folder.
18. The content management system of claim 17 , comprising instructions to cause the at least one processor to:
in addition to the sending of the folder and the information regarding the folders in the path, exclude any content items within the superordinate folder other than any folders identified in the path to the folder.
19. The content management system of claim 18 , comprising instructions to cause the at least one processor to: send a cursor to the client device, the cursor including a record of the user account's at least read access to the folder, and including the path recorded in the traversal rights dictionary.
20. The content management system of claim 19 , comprising instructions to cause the at least one processor to:
receive a request to synchronize the folder, the request including the cursor;
using the cursor to confirm the user account's at least read access to the folder, and the user account's traversal rights to the path included in the cursor; and
synchronize the folder.
21. The content management system of claim 20 , comprising instructions to cause the at least one processor to:
remove the at least read access from the user account for the folder contained within the superordinate folder to which the user account does not have access;
remove the path recorded in the traversal rights dictionary;
send an instruction to the client device to delete the folder, and any folders in the path to the folder to which the user account does not have access; and
send a second cursor to the client device without the record referencing the folder.