[asaah262]

Description

Adds endpoints to retrieve a single sharing permission via the Graph API:

• GET /graph/v1beta1/drives/{driveID}/items/{itemID}/permissions/{permissionID}
• GET /graph/v1beta1/drives/{driveID}/root/permissions/{permissionID}

Both endpoints reuse ListPermissions and return the permission with the requested ID. As a result, a permission can be retrieved only if it is also visible in the corresponding permission listing for the same user. If no matching permission is found, the endpoints return 404 itemNotFound.

The space-root endpoint supports project spaces only, consistent with the existing DELETE and PATCH space-root permission endpoints. Requests for personal or virtual spaces return 400 invalidRequest with unsupported space type. ListSpaceRootPermissions and all other existing endpoints are unchanged.

Error handling follows the existing permission handlers:

• Item endpoint: 400 for malformed IDs, 404 when the item does not belong to the drive.
• Space-root endpoint: 422 for an invalid driveID.
• Both endpoints: 400 for an empty or invalid permissionID.

Related Issue

• Related: feat(graph): improve logging and tracing for drive item permissions #3881 (Graph logging and tracing)

Motivation and Context

Clients could only list all permissions of a drive item or space root, or update and delete a single permission. There was no way to retrieve a single permission by ID. The OpenCloud Libre Graph API specification already defines both single-permission GET operations, but the Graph service did not implement their corresponding HTTP handlers and routes. Requests to these endpoints previously returned 405 Method Not Allowed.

Web-client impact

Additive only: no existing Graph route, response or status code changes, and no web change is required. The web client's existing permissions.getPermission wrapper (item endpoint) previously received 405 and will now return the permission.

Logging and tracing (follow-up)

The new endpoints are not instrumented with the logging and tracing introduced in #3881, because #3881 has not been merged yet. This is tracked in a separate follow-up issue and will be added once #3881 is merged.

• Spans for GetPermission and GetSpaceRootPermission
• Request-ID logging for both methods
• Debug-level logs for expected outcomes ("permission not found", "unsupported space type")
• Matching tests following the conventions established in feat(graph): improve logging and tracing for drive item permissions #3881

How Has This Been Tested?

• Test environment: Local Go development environment (Ginkgo/Gomega, testify and CS3 gateway mocks).
• New Go specs (11):
  • Routed: GET requests for both endpoints through the real router. These initially failed with 405.
  • Service: unlisted permission IDs return itemNotFound without falling back to a direct share lookup; Stat errors are propagated; personal and virtual spaces are rejected.
  • Handler: ID and permissionID decoding, and the 400, 404 and 422 responses.
• go test ./services/graph/... passes in all 11 packages, including all 482 service/v0 specs.
• go test -race ./services/graph/pkg/service/v0/ passes.
• golangci-lint reports 0 new issues compared with related base branch. gofmt and git diff --check are clean.
• Acceptance test added: apiSharingNg1/listPermissions.feature, "user gets a single link permission of a project space using root endpoint".
• Not run locally: the new Behat scenario and make test-php-style. The changed PHP files pass php -l only. CI will be the first to run both.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation added

AI assistance: Claude Code (claude-opus-5-5) wrote the first draft of the code and the tests.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 34 complexity

Metric	Results
Complexity	34

View in Codacy

🟢 Coverage 31.95% diff coverage · +0.01% coverage variation

Metric	Results
Coverage variation	✅ +0.01% coverage variation (-1.00%)
Diff coverage	✅ 31.95% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (83615f2)	Report Missing	Report Missing	Report Missing
Head commit (64a1ac8)	92809 (+169)	25477 (+59)	27.45% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3928)	169	54	31.95%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[pbleser-oc]

Looks good to me