Synchronized organization directory with team member folders
The present technology pertains to a organization directory hosted by a synchronized content management system. The corporate directory can provide access to user accounts for all members of the organization to all content items in the organization directory on the respective file systems of the members' client devices. Members can reach any content item at the same path as other members relative to the organization directory root on their respective client device. In some embodiments novel access permissions are granted to maintain path consistency.
1. A method for controlling access to managed content items, the method comprising:
in response to a request from a user account to access a content item, determining whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determining whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determining whether the request can access a child content item of the content item; and
when the request can access the child content item of the content item, accessing the child content item.
2. The method of claim 1 , wherein the accessing the child content item includes traversing the content item.
3. The method of claim 2 , comprising:
storing the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.
4. The method of claim 1 , wherein the first access control provides default access to the content item and the child content item.
5. The method of claim 4 , wherein the second access control comprises a restrictive access control list that grants the access to user accounts identified in the restrictive access control list.
6. The method of claim 5 , wherein the second access control restricts the access to user accounts not identified in the restrictive access control list.
7. The method of claim 5 , further comprising:
in response to receiving a modification to the child content item,
synchronizing the modification to the child content item with devices associated with the user accounts identified in the restrictive access control list.
8. The method of claim 1 , further comprising:
after receiving a response to the request to access the content item, identifying a context of the request based on the request; and
based on the context of the request, determining whether to mount a namespace to list content items in a path to the child content item.
9. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
in response to a request from a user account to access a content item, determine whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determine whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determine whether the request can access a child content item of the content item;
when the request can access the child content item of the content item, access the child content item.
10. The computer readable medium of claim 9 , the accessing the child content item includes traversing the content item.
11. The computer readable medium of claim 10 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
store the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.
12. The computer readable medium of claim 9 , the first access control provides default access to the content item and the child content item.
13. The computer readable medium of claim 12 , the second access control comprises a restrictive access control list that grants the access to user accounts identified in the restrictive access control list.
14. The computer readable medium of claim 13 , the second access control restricts the access to user accounts not identified in the restrictive access control list.
15. The computer readable medium of claim 13 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
in response to receiving a modification to the child content item,
synchronize the modification to the child content item with devices associated with the user accounts identified in the restrictive access control list.
16. The computer readable medium of claim 9 , wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
after receiving a response to the request to access the content item, identify a context of the request based on the request; and
based on the context of the request, determine whether to mount a namespace to list content items in a path to the child content item.
17. A system comprising:
a storage configured to store instructions;
a processor configured to execute the instructions and cause the processor to:
in response to a request from a user account to access a content item, determine whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determine whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determine whether the request can access a child content item of the content item; and
when the request can access the child content item of the content item, access the child content item.
18. The system of claim 17 , wherein the accessing the child content item includes traversing the content item.
19. The system of claim 18 , wherein the processor is configured to execute the instructions and cause the processor to:
store the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.
20. The system of claim 17 , wherein the first access control provides default access to the content item and the child content item.