Nested namespaces for selective content sharing

1. A method comprising:

storing, by a content management system, a plurality of content items and metadata for the plurality of content items, the metadata indicating a plurality of folders arranged in a plurality of hierarchies, each hierarchy of the plurality of hierarchies having a respective root folder;

receiving, by the content management system, a request to share a particular folder that is a descendant folder of a shared folder in a first hierarchy of the plurality of hierarchies; and

mounting, by the content management system, the particular folder at a first location in a second hierarchy of the plurality of hierarchies, the first location having a first relative path, the first relative path relative to the respective root folder in the second hierarchy, the first relative path being different than a second relative path of a second location of the particular folder in the first hierarchy, the second relative path relative to the respective root folder in the first hierarchy.

2. The method of claim 1 , wherein mounting the particular folder at the first location in the second hierarchy is based at least in part on:

storing, by the content management system, metadata associating (a) the particular folder and the first relative path with (b) a user account with which the particular folder is being shared by another user account, wherein metadata stored by the content management system indicates that the another user account is sharing the particular folder with the user account.

3. The method of claim 1 , further comprising:

based on the receiving the request to share the particular folder, establishing, by the content management system, a namespace rooted to the particular folder; and

storing, by the content management system, metadata associating (a) the particular folder and the first relative path with (b) the namespace.

4. The method of claim 1 , further comprising:

unmounting, by the content management system, the particular folder from the first location in the second hierarchy; and

mounting, by the content management system, the particular folder at a third location in the second hierarchy, the third location having a third relative path, the third relative path relative to the respective root folder in the second hierarchy, the third relative path being different than the first relative path.

5. The method of claim 1 , further comprising:

storing, by the content management system, metadata associating (a) the particular folder and the second relative path with (b) a user account that shared the particular folder with one or more other user accounts, wherein metadata stored by the content management system indicates that the user account is sharing the particular folder with the one or more other user accounts.

6. The method of claim 1 , further comprising:

based on the receiving the request to share the particular folder, establishing, by the content management system, a first namespace rooted to the particular folder;

establishing, by the content management system, a second namespace rooted to the shared folder;

maintaining a first set of permissions for the first namespace, the first set of permissions granting access to the first namespace to a first set of user accounts; and

maintaining a second set of permissions for the second namespace, the second set of permissions granting access to the second namespace to a second set of user accounts.

7. A system comprising:

one or more processors; and

one or more non-transitory storage media storing instructions which, when executed by the one or more processors, cause the one or more processors to:

store a plurality of content items and metadata for the plurality of content items, the metadata indicating a plurality of folders arranged in a plurality of hierarchies, each hierarchy of the plurality of hierarchies having a respective root folder;

establish a first namespace rooted to a first shared folder of the plurality of folders;

maintain a first set of permissions for the first namespace, wherein the first set of permissions grants access to the first namespace to a first set of user accounts;

receive a request to share a second folder that is a descendant folder of the first shared folder in a first hierarchy of the plurality of hierarchies;

establish a second namespace rooted to the second folder;

maintain a second set of permissions for the second namespace, wherein the second set of permissions grants access to the second namespace to a second set of user accounts; and

mount the second folder at a first location in in a second hierarchy of the plurality of hierarchies, the first location having a first relative path, the first relative path relative to the respective root folder in the second hierarchy, the first relative path being different than a second relative path of a second location of the second folder in the first hierarchy, the second relative path relative to the respective root folder in the first hierarchy.

8. The system of claim 7 , further comprising instructions which, when executed by the one or more processors, cause the one or more processors to:

determine, based on at least one of the first set of permissions and the second set of permissions, that a particular user account has access to at least one of the first namespace and the second namespace;

when the particular user account has access to the first namespace and the second namespace, provide, to the particular user account, access to the first shared folder and its children in the first hierarchy, including the second folder;

when the particular user account has access to the first namespace and does not have access to the second namespace, provide, to the particular user account, access to the first shared folder and its children in the first hierarchy, excluding the second folder; and

when the particular user account does not have access to the first namespace and has access to the second namespace, provide, to the particular user account, access to the second folder.

9. The system of claim 7 , wherein the first namespace is a shared namespace.

10. The system of claim 7 , wherein:

the first shared folder is in a subtree comprising a root folder of an entity account; and

the first set of user accounts comprises at least a subset of user accounts associated with the entity account.

11. The system of claim 7 , further comprising instructions which, when executed by the one or more processors, cause the one or more processors to:

determine, based on at least one of the first set of permissions and the second set of permissions, that a particular user account has access to at least one of the first namespace and the second namespace;

when the particular user account has access to the first namespace and the second namespace, provide, to the particular user account, hierarchical data describing the first hierarchy, including the second folder and its descendants;

when the particular user account has access to the first namespace and does not have access to the second namespace, provide, to the particular user account, hierarchical data describing the first hierarchy, excluding the second folder and its descendants; and

when the particular user account does not have access to the first namespace and has access to the second namespace, provide, to the particular user account, hierarchical data describing a subtree of the second folder.

12. The system of claim 7 , further comprising instructions which, when executed by the one or more processors, cause the one or more processors to:

receive a request associated with a particular user account to mount the second namespace to a particular path in a particular namespace, wherein the particular user account has access to the particular namespace, wherein the second set of permissions grants access to the second namespace to the particular user account;

determine whether a set of one or more constraints is satisfied; and

when the set of one or more constraints is satisfied, mount the second namespace to the particular path in the particular namespace.

13. The system of claim 12 , wherein the set of one or more constraints includes a constraint that the second namespace cannot be mounted to more than one path in any shared namespace that is not a root namespace.

14. The system of claim 12 , wherein the set of one or more constraints includes a constraint that the second namespace cannot be mounted to more than one path in a root namespace, or a child namespace thereof, for any user in the second set of user accounts.

15. The system of claim 12 , further comprising instructions which, when executed by the one or more processors, cause the one or more processors to:

receive a request from a particular user account to perform a mounting operation involving the second namespace; and

enforce at least one constraint by obtaining one or more mount locks for one or more affected namespaces, wherein the mounting operation fails if the one or more mount locks cannot be obtained.

16. One or more non-transitory storage media storing instructions which, when executed by a system comprising one or more processors, cause the system to perform:

storing a plurality of content items and metadata for the plurality of content items, the metadata indicating a plurality of folders arranged in a plurality of hierarchies, each hierarchy of the plurality of hierarchies having a respective root folder;

receiving a request to share a particular folder that is a descendant folder of a shared folder in a first hierarchy of the plurality of hierarchies; and

mounting the particular folder at a first location in a second hierarchy of the plurality of hierarchies, the first location having a first relative path, the first relative path relative to the respective root folder in the second hierarchy, the first relative path being different than a second relative path of a second location of the particular folder in the first hierarchy, the second relative path relative to the respective root folder in the first hierarchy.

17. The one or more non-transitory storage media of claim 16 , wherein mounting the particular folder at the first location in the second hierarchy is based at least in part on:

storing metadata associating (a) the particular folder and the first relative path with (b) a user account with which the particular folder is being shared by another user account, wherein metadata stored by the system indicates that the another user account is sharing the particular folder with the user account.

18. The one or more non-transitory storage media of claim 16 , further comprising instructions which, when executed by the system, cause the system to perform:

based on the receiving the request to share the particular folder, establishing a namespace rooted to the particular folder, wherein mounting the particular folder at the first location in the second hierarchy is based at least in part on storing, by the system, metadata associating (a) the particular folder and the first relative path with (b) the namespace.

19. The one or more non-transitory storage media of claim 16 , further comprising instructions which, when executed by the system, cause the system to perform:

unmounting the particular folder from the first location in the second hierarchy; and

mounting the particular folder at a third location in the second hierarchy, the third location having a third relative path, the third relative path relative to the respective root folder in the second hierarchy, the third relative path being different than the first relative path.

20. The one or more non-transitory storage media of claim 16 , further comprising instructions which, when executed by the system, cause the system to perform:

storing metadata associating (a) the particular folder and the second relative path with (b) a user account that is sharing the particular folder with one or more other user accounts, wherein metadata stored by the system indicates that the user account is sharing the particular folder with the one or more other user accounts.