feat(graph): expose @microsoft.graph.downloadUrl and /content on driveItems - #3248
Open
dschmidt wants to merge 3 commits into
Open
feat(graph): expose @microsoft.graph.downloadUrl and /content on driveItems#3248dschmidt wants to merge 3 commits into
dschmidt wants to merge 3 commits into
Conversation
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 47 |
🟢 Coverage 63.16% diff coverage
Metric Results Coverage variation Report missing for 81536bb1 Diff coverage ✅ 63.16% diff coverage Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (81536bb) Report Missing Report Missing Report Missing Head commit (5807eea) 88461 20882 23.61% Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#3248) 171 108 63.16% Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
dschmidt
force-pushed
the
feat/graph-driveitem-download-url
branch
5 times, most recently
from
August 5, 2026 22:51
787b304 to
0844883
Compare
This was referenced Aug 5, 2026
dschmidt
force-pushed
the
feat/graph-driveitem-download-url
branch
from
August 18, 2026 14:42
99c7867 to
7dd1e0e
Compare
dschmidt
force-pushed
the
feat/graph-driveitem-download-url
branch
3 times, most recently
from
September 6, 2026 19:17
f72ad4e to
6d8b5fd
Compare
This was referenced Sep 7, 2026
dschmidt
force-pushed
the
feat/graph-driveitem-download-url
branch
3 times, most recently
from
September 7, 2026 10:04
43e31e0 to
a1fd00a
Compare
dschmidt
marked this pull request as ready for review
September 7, 2026 10:32
drive.WebUrl, driveItem.WebUrl and the public share link WebUrl all derive from the same config value (graph.spaces.webdav_base), but only driveItem.WebUrl used the pre-parsed BaseGraphService.publicBaseURL. The other two re-parsed the config on every call. Add a webURLForResource method on BaseGraphService for the /f/<id> URLs (used twice, with a *string return matching the libregraph DriveItem field shape), and inline g.publicBaseURL for the single /s/<token> share-link case. Convert cs3ResourceToDriveItem and formatDriveItems from free functions into BaseGraphService methods so they pick up logger and publicBaseURL from the receiver. This also aligns them with the surrounding code: BaseGraphService already exposes ~15 similar methods, so the two free functions were the odd ones out. Net: all three WebUrls are now constructed from a single pre-parsed URL, and the (g.logger, g.publicBaseURL) plumbing at 7 call sites disappears.
…eItems
Populates @microsoft.graph.downloadUrl on file driveItems when requested
via $select and implements GET .../items/{item-id}/content as a 302 to
the same URL: a by-id WebDAV URL signed with OC_URL_SIGNING_SECRET,
verified by the proxy, valid for 30 minutes. Folders answer 404 on
/content and never carry the annotation.
The annotation is available on the driveItem stat, the children and
root children listings and the share jail item endpoint.
dschmidt
force-pushed
the
feat/graph-driveitem-download-url
branch
from
September 7, 2026 11:00
a1fd00a to
5807eea
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Populates
@microsoft.graph.downloadUrlon file driveItems and implements the v1beta1GET .../items/{item-id}/contentredirect (302). Both point at the same signed, short-lived by-id WebDAV URL, signed withOC_URL_SIGNING_SECRETand verified by the proxy, so noAuthorizationheader is needed. The TTL is 30 minutes.The annotation is opt-in via
$select(comma-separated values are supported) and only ever set on items with afilefacet. It is available on the driveItem stat, the children and root children listings and the v1beta1 share jail item, which is everywhere the spec attachesdriveItemSelect./contentanswers 404 for folders.The first commit integrates the
BaseGraphService.publicBaseURLrefactor from #2770, so #2770 is superseded by this PR. The signer lives onBaseGraphServiceso the share jail endpoint can reuse it throughBaseGraphProvider.Related: the proxy currently accepts any HTTP method on a JWT-signed URL, so a leaked download URL also allows writes for its lifetime. That predates this PR (reva's
oc:downloadURLuses the same mechanism) and is fixed separately in the proxy.