decomposedfs: prevent direct access to trash items

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

changelog/unreleased/hide-trash-items.md

@@ -0,0 +1,5 @@
+Bugfix: prevent direct access to trash items
+
+decomposedfs now prevents direct access to trash items
+
+https://github.com/cs3org/reva/pull/3977

pkg/storage/utils/decomposedfs/node/permissions.go

@@ -114,12 +114,7 @@ func (p *Permissions) AssemblePermissions(ctx context.Context, n *Node) (ap prov
 		n.ID = kp[0]
 	}
 
-	// check if the current user is the owner
-	if utils.UserIDEqual(u.Id, n.Owner()) {
-		return OwnerPermissions(), nil
-	}
 	// determine root
-
 	rn := n.SpaceRoot
 
 	cn := n
@@ -154,6 +149,10 @@ func (p *Permissions) AssemblePermissions(ctx context.Context, n *Node) (ap prov
 			// We do not have a parent, so we assume the next valid parent is the spaceRoot (which must always exist)
 			cn = n.SpaceRoot
 		}
+		if !cn.Exists {
+			return NoPermissions(), errtypes.NotFound(n.ID)
+		}
+
 	}
 
 	// for the root node
@@ -167,6 +166,11 @@ func (p *Permissions) AssemblePermissions(ctx context.Context, n *Node) (ap prov
 		appctx.GetLogger(ctx).Error().Err(err).Interface("node", cn.ID).Msg("error reading root node permissions")
 	}
 
+	// check if the current user is the owner
+	if utils.UserIDEqual(u.Id, n.Owner()) {
+		return OwnerPermissions(), nil
+	}
+
 	appctx.GetLogger(ctx).Debug().Interface("permissions", ap).Interface("node", n.ID).Interface("user", u).Msg("returning agregated permissions")
 	return ap, nil
 }