Курнат Андрей
3.3 KiB
QSfera Sharing Controls Production Audit
Date: 2026-06-10.
External Benchmarks
- Google Drive documents file-sharing roles, per-link/general access, download control for viewers/commenters, and folder permission inheritance on its Android sharing help page: https://support.google.com/drive/answer/2494822?co=GENIE.Platform%3DAndroid&hl=en.
- Yandex Disk documents mobile link security settings for view-only access, disabling downloads, link password, expiration date, and organization-only links on its Android sharing help page: https://yandex.com/support/yandex-360/customers/disk/app/android/en/actions/share.
Verified QSfera Coverage
| Benchmark control | QSfera evidence | Status |
|---|---|---|
| Public-link password | Android exposes shareViaLinkPasswordSwitch; Graph CreateLink stores Password; acceptance tests create and update password-protected link shares and verify old passwords fail with HTTP 401. |
Covered for Android OCS links and Graph links. |
| Public-link expiration | Android exposes shareViaLinkExpirationSwitch; Graph CreateLink reads expirationDateTime; acceptance tests create, update, and remove expiration dates. |
Covered for Android OCS links and Graph links. |
| Link access role | Android exposes read-only, read/write, and upload-only radio options; Graph link types include view, edit, upload, and createOnly; acceptance tests cover those roles for files, folders, and project-space links. |
Covered, with different Android OCS labels and Graph role names. |
| Disable downloads / secure view | Graph link types include blocksDownload; acceptance tests also verify the Secure Viewer role cannot download files. Android public-link rows now display non-standard link permissions as Custom access. |
Server/API coverage exists; Android does not expose a dedicated blocksDownload switch. |
| Organization-only access | Graph link types include internal; frontend config documents default link permission 0 as an internal/member-only link; server rejects redundant passwords on internal links; acceptance tests create and update internal links. |
Server/API coverage exists; Android does not expose a separate organization-only/internal link choice. |
| Role inheritance / resharing | Space sharing acceptance tests verify managers can reshare spaces, editors/viewers cannot, and project-space public-link creation requires manager rights. | Covered by server acceptance scenarios. |
Repeatable Local Check
Run from the repository root:
.\scripts\verify-sharing-controls-coverage.ps1
The script is a static coverage gate over Android UI files, Graph link type code, server link creation code, and acceptance feature files. It does not replace a full server acceptance run.
Remaining Product Gap
The Android public-link dialog currently exposes the OCS link controls already present in the client: password, expiration, read-only, read/write, and upload-only. It does not expose dedicated Graph internal or blocksDownload controls. If QSfera wants Android parity with Yandex Disk's organization-only and disable-download controls, the next client/server integration step is to add Android Graph-link creation/editing paths for those two link types or define an explicit product decision that Android continues to show them as server-managed/custom access states.