security(authz): a shared item must not return it's full path

src/application/dtos/file_dto.rs

@@ -119,6 +119,21 @@ impl From<FileDto> for File {
 }
 
 impl FileDto {
+    /// Returns a copy of this DTO with the `path` field cleared.
+    ///
+    /// Used when a file is returned to a share recipient: `path` reveals the
+    /// full folder hierarchy above the file which the recipient may not have
+    /// access to.  `folder_id` and `owner_id` are intentionally kept — the
+    /// former is needed for sub-folder navigation (covered by the cascade
+    /// grant), and the latter is harmless metadata.
+    #[must_use]
+    pub fn without_hierarchy_info(self) -> Self {
+        Self {
+            path: String::new(),
+            ..self
+        }
+    }
+
     /// Creates an empty file DTO for stub implementations
     pub fn empty() -> Self {
         Self {

src/application/dtos/folder_dto.rs

@@ -107,6 +107,21 @@ impl From<FolderDto> for Folder {
 }
 
 impl FolderDto {
+    /// Returns a copy of this DTO with the `path` field cleared.
+    ///
+    /// Used when a folder is returned to a share recipient: `path` reveals the
+    /// full folder hierarchy above the shared folder which the recipient may
+    /// not have access to.  `parent_id` and `owner_id` are intentionally kept
+    /// — the former is needed for sub-folder navigation (covered by the
+    /// cascade grant), and the latter is harmless metadata.
+    #[must_use]
+    pub fn without_hierarchy_info(self) -> Self {
+        Self {
+            path: String::new(),
+            ..self
+        }
+    }
+
     /// Creates an empty folder DTO for stub implementations
     pub fn empty() -> Self {
         Self {

src/interfaces/api/handlers/grant_handler.rs

@@ -384,7 +384,7 @@ pub async fn list_shared_with_me(
                             permissions: summary.permissions.iter().map(|p| (*p).into()).collect(),
                             granted_at: summary.granted_at,
                             granted_by: summary.granted_by,
-                            file: Some(file_dto.clone()),
+                            file: Some(file_dto.clone().without_hierarchy_info()),
                             folder: None,
                         });
                     }
@@ -415,7 +415,7 @@ pub async fn list_shared_with_me(
                             granted_at: summary.granted_at,
                             granted_by: summary.granted_by,
                             file: None,
-                            folder: Some(folder_dto.clone()),
+                            folder: Some(folder_dto.clone().without_hierarchy_info()),
                         });
                     }
                     Err(e) if e.kind == ErrorKind::NotFound => {