feat(drive): limit NC request by disk

src/application/services/file_retrieval_service.rs

@@ -286,13 +286,16 @@ impl FileRetrievalUseCase for FileRetrievalService {
     }
 
     // FIXME no authorisation at all
-    async fn get_file_by_path(&self, path: &str) -> Result<FileDto, DomainError> {
+    async fn get_file_by_path(&self, path: &str, drive_id: Uuid) -> Result<FileDto, DomainError> {
         // Direct SQL lookup — O(folder_depth) queries instead of O(total_files)
         // NOTE: This method does NOT perform any authorization check. Callers
         // that surface its result to a user-driven request MUST resolve the
         // file via get_file_owned afterwards, or call authz.require directly.
         // (Tracked in the audit punch-list under "path-based lookups".)
-        if let Some(file) = self.file_read.find_file_by_path(path).await? {
+        // `drive_id` scope axis prevents cross-drive resolution — without
+        // it, `find_file_by_path` would return a non-deterministic row
+        // when the same path exists in multiple drives.
+        if let Some(file) = self.file_read.find_file_by_path(path, drive_id).await? {
             return Ok(FileDto::from(file));
         }
 

src/application/services/file_upload_service.rs

@@ -348,13 +348,14 @@ impl FileUploadUseCase for FileUploadService {
     async fn update_file_streaming(
         &self,
         path: &str,
+        drive_id: Uuid,
         blob: StoredBlob,
         content_type: &str,
         modified_at: Option<i64>,
     ) -> Result<FileDto, DomainError> {
         // Try to find the existing file first
         if let Some(file_read) = &self.file_read
-            && let Some(file) = file_read.find_file_by_path(path).await?
+            && let Some(file) = file_read.find_file_by_path(path, drive_id).await?
         {
             let file_id = file.id().to_string();
             let (new_hash, updated_at) = self
@@ -402,9 +403,15 @@ impl FileUploadUseCase for FileUploadService {
 
         // get_parent_folder_id expects the full file path — it strips the
         // last segment (filename) internally to find the parent folder.
+        // `drive_id` scopes the parent lookup to the same drive as the
+        // incoming write (post-D0 `storage.folders.path` repeats across
+        // drives).
         let parent_id = if path_normalized.contains('/') {
             if let Some(file_read) = &self.file_read {
-                file_read.get_parent_folder_id(path_normalized).await.ok()
+                file_read
+                    .get_parent_folder_id(path_normalized, drive_id)
+                    .await
+                    .ok()
             } else {
                 None
             }

src/application/services/folder_service.rs

@@ -85,7 +85,7 @@ impl FolderService {
             async fn get_folder_by_path(
                 &self,
                 _path: &str,
-                _user_id: Uuid,
+                _drive_id: Uuid,
             ) -> Result<FolderDto, DomainError> {
                 Ok(FolderDto::empty())
             }
@@ -297,17 +297,17 @@ impl FolderUseCase for FolderService {
         self.get_folder(id).await
     }
 
-    /// Gets a folder by its path, scoped to the caller's tree.
+    /// Gets a folder by its path, scoped to a drive.
     async fn get_folder_by_path(
         &self,
         path: &str,
-        user_id: Uuid,
+        drive_id: Uuid,
     ) -> Result<FolderDto, DomainError> {
         let storage_path = StoragePath::from_string(path);
 
         let folder = self
             .folder_storage
-            .get_folder_by_path(&storage_path, user_id)
+            .get_folder_by_path(&storage_path, drive_id)
             .await
             .map_err(|e| {
                 DomainError::internal_error(

src/application/services/idor_protection_test.rs

@@ -101,7 +101,11 @@ impl FileReadPort for MockFileReadPort {
         unimplemented!()
     }
 
-    async fn get_parent_folder_id(&self, _path: &str) -> Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         unimplemented!()
     }
 
@@ -127,7 +131,11 @@ impl FileReadPort for MockFileReadPort {
         Ok(0)
     }
 
-    async fn get_folder_id_by_path(&self, _folder_path: &str) -> Result<String, DomainError> {
+    async fn get_folder_id_by_path(
+        &self,
+        _folder_path: &str,
+        _drive_id: Uuid,
+    ) -> Result<String, DomainError> {
         unimplemented!()
     }
 

src/application/services/share_service.rs

@@ -838,11 +838,19 @@ mod tests {
             unimplemented!()
         }
 
-        async fn get_parent_folder_id(&self, _path: &str) -> Result<String, DomainError> {
+        async fn get_parent_folder_id(
+            &self,
+            _path: &str,
+            _drive_id: uuid::Uuid,
+        ) -> Result<String, DomainError> {
             unimplemented!()
         }
 
-        async fn get_folder_id_by_path(&self, _folder_path: &str) -> Result<String, DomainError> {
+        async fn get_folder_id_by_path(
+            &self,
+            _folder_path: &str,
+            _drive_id: uuid::Uuid,
+        ) -> Result<String, DomainError> {
             unimplemented!()
         }
 
@@ -925,7 +933,7 @@ mod tests {
         async fn get_folder_by_path(
             &self,
             _storage_path: &crate::domain::services::path_service::StoragePath,
-            _user_id: uuid::Uuid,
+            _drive_id: uuid::Uuid,
         ) -> Result<crate::domain::entities::folder::Folder, DomainError> {
             unimplemented!()
         }
@@ -991,6 +999,7 @@ mod tests {
         async fn folder_exists(
             &self,
             _storage_path: &crate::domain::services::path_service::StoragePath,
+            _drive_id: uuid::Uuid,
         ) -> Result<bool, DomainError> {
             unimplemented!()
         }

src/application/services/trash_service.rs

@@ -821,6 +821,10 @@ fn row_to_item_dto(row: TrashResourceRow) -> TrashResourceItemDto {
             path,
             parent_id: row.parent_id.map(|u| u.to_string()),
             owner_id: Some(row.owner_id.to_string()),
+            // Trash listing — drive_id is informational and the trash
+            // row doesn't currently SELECT it. Path-based lookups
+            // never enter this code path.
+            drive_id: uuid::Uuid::nil(),
             created_at: row.resource_created_at.timestamp() as u64,
             modified_at: row.modified_at.timestamp() as u64,
             is_root: false,

src/application/services/trash_service_test.rs

@@ -500,13 +500,18 @@ impl FileReadPort for MockFileRepository {
         unimplemented!()
     }
 
-    async fn get_parent_folder_id(&self, _path: &str) -> std::result::Result<String, DomainError> {
+    async fn get_parent_folder_id(
+        &self,
+        _path: &str,
+        _drive_id: Uuid,
+    ) -> std::result::Result<String, DomainError> {
         unimplemented!()
     }
 
     async fn get_folder_id_by_path(
         &self,
         _folder_path: &str,
+        _drive_id: Uuid,
     ) -> std::result::Result<String, DomainError> {
         unimplemented!()
     }
@@ -709,7 +714,7 @@ impl FolderRepository for MockFolderRepository {
     async fn get_folder_by_path(
         &self,
         _storage_path: &StoragePath,
-        _user_id: Uuid,
+        _drive_id: Uuid,
     ) -> std::result::Result<Folder, DomainError> {
         unimplemented!()
     }
@@ -773,6 +778,7 @@ impl FolderRepository for MockFolderRepository {
     async fn folder_exists(
         &self,
         _storage_path: &StoragePath,
+        _drive_id: Uuid,
     ) -> std::result::Result<bool, DomainError> {
         Ok(false)
     }