fix(mounts): scope external mounts to drives

src/application/services/folder_service.rs

@@ -1783,12 +1783,18 @@ mod mount_authz_integration {
     use crate::application::services::external_mount_router::{MountRouter, ResolvedId};
     use crate::application::services::file_retrieval_service::FileRetrievalService;
     use crate::application::services::mount_registry::MountRegistry;
+    use crate::domain::repositories::drive_repository::DriveRepository;
+    use crate::domain::repositories::folder_repository::FolderRepository;
+    use crate::domain::services::authorization::Subject;
     use crate::domain::services::external_mount_id::{NodeId, encode_child_id};
     use crate::infrastructure::repositories::pg::{
-        ExternalMountPgRepository, FileBlobReadRepository, SubjectGroupPgRepository,
+        DrivePgRepository, ExternalMountPgRepository, FileBlobReadRepository,
+        SubjectGroupPgRepository,
     };
     use crate::infrastructure::services::mount_provider_factory::DefaultMountProviderFactory;
-    use crate::mount_it_support::{fresh_db, insert_mount, make_user, provision_folder};
+    use crate::mount_it_support::{
+        Provisioned, fresh_db, insert_mount, make_user, provision_folder,
+    };
     use std::sync::Arc;
 
     fn opts<'a>() -> ListResourcesOptions<'a> {
@@ -2206,6 +2212,68 @@ mod mount_authz_integration {
         assert_eq!(err.kind, crate::domain::errors::ErrorKind::NotFound);
     }
 
+    /// A mount attached to a shared drive inherits that drive's grants rather
+    /// than the identity of the administrator who configured the provider.
+    #[tokio::test]
+    async fn shared_drive_member_lists_mount_non_member_denied() {
+        let (_c, pool) = fresh_db().await;
+        let host = tempfile::tempdir().unwrap();
+        std::fs::write(host.path().join("shared.txt"), b"shared").unwrap();
+
+        let admin_id = make_user(&pool, "mount-admin").await;
+        let member_id = make_user(&pool, "drive-member").await;
+        let drive = DrivePgRepository::new(pool.clone())
+            .create_shared_drive_atomic("Shared media", Subject::User(member_id), None, admin_id)
+            .await
+            .expect("create shared drive");
+        let folder = FolderDbRepository::new(pool.clone())
+            .create_folder(
+                "Media".to_string(),
+                Some(drive.drive.root_folder_id.to_string()),
+                admin_id,
+            )
+            .await
+            .expect("create mount root in shared drive");
+        let mount_folder_id = Uuid::parse_str(folder.id()).expect("folder UUID");
+        let provisioned = Provisioned {
+            owner_id: admin_id,
+            drive_id: drive.drive.id,
+            mount_folder_id,
+        };
+        insert_mount(&pool, &provisioned, host.path().to_str().unwrap()).await;
+
+        let registry = Arc::new(MountRegistry::empty());
+        registry
+            .reload(
+                &ExternalMountPgRepository::new(pool.clone()),
+                &DefaultMountProviderFactory::new(),
+            )
+            .await;
+        let folder_service = FolderService::new(
+            Arc::new(FolderDbRepository::new(pool.clone())),
+            acl(&pool),
+            Arc::new(
+                crate::application::services::file_lifecycle_service::FileLifecycleService::new(),
+            ),
+            Arc::new(MountRouter::new(registry.clone())),
+        );
+        let cfg = registry.get(&mount_folder_id).expect("mount registered");
+
+        let (entries, _) = folder_service
+            .list_mount_dir_with_perms(&cfg, &NodeId::default(), member_id, opts())
+            .await
+            .expect("shared drive member may list mount");
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "shared.txt");
+
+        let non_member = make_user(&pool, "non-member").await;
+        let err = folder_service
+            .list_mount_dir_with_perms(&cfg, &NodeId::default(), non_member, opts())
+            .await
+            .expect_err("non-member must be denied");
+        assert_eq!(err.kind, crate::domain::errors::ErrorKind::NotFound);
+    }
+
     /// Download path authz: owner can stat/open a mount file; stranger denied.
     #[tokio::test]
     async fn owner_reads_mount_file_stranger_denied() {

src/interfaces/api/handlers/admin_external_mounts.rs

@@ -1,7 +1,7 @@
 //! Admin CRUD for external file mounts (`/api/admin/external-mounts`).
 //!
 //! Creating a mount: validate the backend config, create a mount-root folder
-//! under the admin's drive, insert the `external_mounts` row, then hot-reload
+//! under the selected drive, insert the `external_mounts` row, then hot-reload
 //! the in-memory registry. Deleting: remove the row + the folder and reload.
 //! Every endpoint is admin-gated.
 
@@ -20,7 +20,7 @@ use crate::application::ports::external_mount_ports::{
     ExternalMountRecord, ExternalMountRepositoryPort, MountProviderFactory, NewExternalMount,
 };
 use crate::common::di::AppState;
-use crate::domain::repositories::drive_repository::DriveRepository;
+use crate::domain::repositories::drive_repository::{DriveRepository, DriveRepositoryError};
 use crate::domain::repositories::folder_repository::FolderRepository;
 use crate::infrastructure::repositories::pg::ExternalMountPgRepository;
 use crate::infrastructure::services::mount_provider_factory::DefaultMountProviderFactory;
@@ -60,6 +60,8 @@ impl From<ExternalMountRecord> for ExternalMountResponse {
 pub struct CreateExternalMountRequest {
     /// Display name (also the mount-root folder name).
     pub name: String,
+    /// Drive that owns the mount and controls access through its grants.
+    pub drive_id: Uuid,
     /// Absolute host path for the `local_fs` provider.
     pub host_path: String,
     /// Provider kind. Defaults to `local_fs`.
@@ -96,7 +98,7 @@ pub async fn list_external_mounts(
     Ok(Json(out))
 }
 
-/// `POST /api/admin/external-mounts` — create a mount in the admin's drive.
+/// `POST /api/admin/external-mounts` — create a mount in the selected drive.
 pub async fn create_external_mount(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
@@ -116,12 +118,19 @@ pub async fn create_external_mount(
         .await
         .map_err(|e| AppError::bad_request(format!("invalid mount configuration: {e}")))?;
 
-    // Create the mount-root folder under the admin's default drive root.
+    // The mount-root is a normal folder in the selected drive. All access to
+    // the external provider is authorized against this folder, so personal
+    // and shared drive membership automatically applies to the mount.
     let drive = state
         .drive_repo
-        .find_default_for_user(admin_id)
+        .get_by_id(req.drive_id)
         .await
-        .map_err(|e| AppError::internal_error(format!("find default drive: {e}")))?;
+        .map_err(|e| match e {
+            DriveRepositoryError::NotFound(_) => {
+                AppError::bad_request("Destination drive not found")
+            }
+            other => AppError::internal_error(format!("find destination drive: {other}")),
+        })?;
     let root_folder_id = drive.drive.root_folder_id.to_string();
 
     let folder = state
@@ -153,6 +162,7 @@ pub async fn create_external_mount(
         event = "external_mount.config",
         action = "create",
         mount_id = %mount_folder_id,
+        drive_id = %req.drive_id,
         caller_id = %admin_id,
         kind = %req.kind,
         reason = "external_mount_admin",
@@ -212,3 +222,34 @@ pub async fn delete_external_mount(
 
     Ok(StatusCode::NO_CONTENT)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::CreateExternalMountRequest;
+
+    #[test]
+    fn create_request_requires_destination_drive() {
+        let missing_drive =
+            serde_json::from_value::<CreateExternalMountRequest>(serde_json::json!({
+                "name": "Media",
+                "host_path": "/srv/media"
+            }));
+
+        assert!(missing_drive.is_err());
+    }
+
+    #[test]
+    fn create_request_accepts_destination_drive() {
+        let drive_id = uuid::Uuid::new_v4();
+        let request = serde_json::from_value::<CreateExternalMountRequest>(serde_json::json!({
+            "name": "Media",
+            "host_path": "/srv/media",
+            "drive_id": drive_id
+        }))
+        .expect("valid external mount request");
+
+        assert_eq!(request.drive_id, drive_id);
+        assert_eq!(request.kind, "local_fs");
+        assert!(!request.read_only);
+    }
+}