Child Item

Sharing - how to share a folder with edit access when don't know my friend's dropbox user id?

I have an App built on the Dropbox API (https://songdocs.io).

I want to send a link to a folder to a friend, and I know I can get a shared link (which gives anyone with it view permissions) and send that to them.

I would like to give them editable accessto the folder but a) I don't know how I would figure out their dropbox user id. Is there a way to get that? (assuming I've never shared anything with them before fwiw). I don't see anything about Contacts in the API.

Maybe there's another way to accomplish this though too? Totally open to suggestions here. But if user #2 has the shared view link and they gain access to it in my app is there a way for user #2 to request access to mount the folder with edit permissions somehow from my app and for me to communicate that to user #1?

Find more posts tagged with

API

Abuse

Accepted answers

Greg-DB

The 'sharing_info' is only set on a folder if the folder is itself shared as a shared folder (or is inside a shared folder). Note that this is different than the kind of sharing offered by /2/sharing/create_shared_link_with_settings. Calling /2/sharing/create_shared_link_with_settings for a folder will not make it a "shared folder"; it only creates a "shared link" for it.

To first share the folder as a shared folder, so that it will receive 'sharing_info' with a 'shared_folder_id' that you can then use with /2/sharing/add_folder_member, you should first call /2/sharing/share_folder.

All comments

Greg-DB

If you don't already have a connection to the other user in Dropbox, there isn't a way to retrieve it. Instead, you can share it with them via their email address.

To give them access to mount and edit the folder, you would first share the folder, then add them to the folder. In that second step, you can specify the recipient either by Dropbox ID or email address.

elsigh

What if I do already have a connection to the other user in dropbox (we've previously shared some things)? How would I go about getting their dropbox id? Is there a way (short of just walking through every file and every share bit on it) that I can access my contacts in dropbox?

Also what if I send it to user #2's email but it's not precisely the dropbox account email that user #2 uses?

Greg-DB

The Dropbox API doesn't offer a way to list all known contacts, so you'd need to find the account by listing the members of the relevant existing shared folder(s).

The recipient can still accept the invitation if they happen to use a different email address on their Dropbox account.

elsigh

My application wouldn't know existing folders my user has shared with their friends, but could walk their dropbox and amass a contacts list (yucky though).

Looking at SharingAddFolderMemberError it does appear that if I tried to share with an incorrect email it might not work though.. if I shared a SharedLink would there be any way for the receiving user to request access to mount it / gain edit privileges using the API?

I think it's more intuitive that I should send my friend a shared link and then either they do or don't have a dropbox account and then could gain edit access if they did (it would match my goals and I think help incentivize a user to login with their Dropbox account to be able to contribute vs just view/participate/lurk).

Greg-DB

By "it does appear that if I tried to share with an incorrect email it might not work", are you referring to the 'email_unverified' or 'invalid_email' errors, perhaps? Those actually just refer to the connected user's account (i.e., for the access token you're using) not being verified, or the email address value for the recipient not being in the expected email address format, respectively. Those are not referring to the state, or lack thereof, of the recipient's Dropbox account.

Anyway, there isn't a way for a recipient of a shared link for a folder to both view and optionally then directly get access to mount and edit the folder in their Dropbox account using just the one shared link unfortunately. These are different types of Dropbox sharing that don't directly connect to each other.

You can accomplish this using multiple links though. You can create shared links to send to the other users so they can view/download the content, and also get the "preview_url" of the shared folder which other users can use to request access to the shared folder for mounting and editing.

elsigh

Ah, that last part sounds exactly like what I want to explore, thanks Greg!

So I've created a shareLink for my folder and requested the `short_url`.

`folder.url` is https://www.dropbox.com/sh/is3b7lj3go9g9ul/AACKo9xo_qf0rn0kh4TIZSgza?dl=0

`short_url` is https://db.tt/eMUUFEZY8d

When I try to use that `short_url` in a call to `get_shared_link_metadata` I get `error: {.tag: "shared_link_not_found"}` but when I use the resolved URL (aka `folder.url`) it works. Is that to be expected?

Greg-DB

Yes, that endpoint expects the full shared link, not the short version.

By the way, it sounds like you're using the /2/sharing/create_shared_link endpoint to get that short URL. That endpoint is deprecated, so you should use the /2/sharing/create_shared_link_with_settings replacement instead. That doesn't offer the ability to get short URLs though.

elsigh

Hey @Greg-DB - thank you for going through this with me.. you mentioned: "get the "preview_url" of the shared folder which other users can use to request access to the shared folder for mounting and editing." above.

Can you describe how this flow might work in terms of the API?

e.g. User #1 sends a text with a sharedLink to User #2.. how can User #2 request access in my app? I wonder if maybe you meant they could request access in Dropbox?

Greg-DB

Sure, this would look like this:

the app calls /2/sharing/get_folder_metadata and gets the 'preview_url' for the shared folder from user #1's account (here's an actual sample from a test account: https://www.dropbox.com/scl/fo/dh2dl2yrb4xk52n/AAAzPALQwplEJLHvONWVy1XTa?dl=0 )
the app sends that URL to user #2
user #2 accesses that URL in their browser
user #2 signs in or signs up for Dropbox, if not already signed in
user #2 uses the "Request access" functionality on that page to request access to the shared folder
user #1 is notified and can then choose to add user #2 to the shared folder

elsigh

So those interactions need to happen in Dropbox and can't be done via API right?

Also, at the end of it all, how will I as a developer on behalf of user #2, know that User #1 has granted access? I guess once I know that I can 1) mount the folder if needed and then 2) get it's real id to store in my app and fetch contents from there. (not sure how exactly I'll get that when all I have in the app is the preview_url, e.g. my app won't know about anything happening behind the scenes in dropbox I don't believe.

Greg-DB

That's correct, this flow is part of the Dropbox web site, not the API.

From the app's perspective, it can also store the shared folder ID when retrieving the preview_url. The shared folder ID is unique for shared folders across Dropbox, and consistent across accounts. So, you would see the same shared folder ID for API calls for any member of the folder.

The app can also check on the current members of the shared folder at any point in time via /2/sharing/list_folder_members[/continue], e.g., from user #1's account in this case.

The app can also check for any shared folders that the user has been given access to via /2/sharing/list_mountable_folders[/continue], e.g., from user #2's account in this case.

elsigh

So I'm taking a stab at this.. My User #2 who has a shared link sends a request to sharingGetSharedLinkMetadata and gets back a folder object but the id in that response doesn't work as the shared_folder_id arg to sharingGetFolderMetadata.

When I get a files within that folder though each file object includes a parent_shared_folder_id that looks like the correct format for sharingGetFolderMetadata. Seems like I'm doing something wrong and I should be able to get the shared_folder_id somehow with 1 API call and the shared link url. I'm probably missing something obvious.. Thoughts?

Greg-DB

The 'id' for a file or folder, such as returned by sharingGetSharedLinkMetadata, is not the same thing as a 'shared_folder_id', and the two are not interchangeable.

In the flow we discussed, you would get the shared folder ID from user 1's side, anywhere you can get the metadata for the folder, such as from filesGetMetadata. You can then use that to get the 'preview_url' from sharingGetFolderMetadata as user 1. User 2 doesn't need the shared_folder_id in that flow. User 2 just receives the shared link, for viewing the file/folder, or the preview_url, for requesting access to the folder.

elsigh

Yeah, I think when I've talked to the designer about a flow that makes sense we settled on:

User #1 shares a sharedLink with User #2, which gives User #2 read-access in our App to all the content in the folder. This way we at least can deliver value to user #2 as context. Otherwise someone is just going to out of the blue get a dropbox email that doesn't appear to be related to our application.

Once User #2 wants to "upgrade" to contribute or make edits they would then ask for permission and we'd bounce them out to the preview_url. Once User #1 grants User #2 permission, I'm hoping be able to make some change (if needed) so that User #2 can now write back new files to the folder or edit files in that folder.

It's odd to me that as a developer I can peek into any of the files inside of the sharedLink folder contents to obtain the parent_shared_folder_id that I'll need to use to get at the preview url. So I kind of wondered if I was doing something wrong or missing an API endpoint that might have it. I suppose this means that a sharedLink to a folder without files in it would be busted (not the end of the world).

Let me paint a picture of the App in case it gives you any other ideas..

I'm a songwriter. I write chords and lyrics in my app which saves a text file to a folder inside of an App Folder.

You and I are going camping and we both play guitar and you write songs too.

I want to share a folder of all my songs with you so we can play them together. So I send you a magic link to my app that gives you the sharedLink and then when you open my app you see my songs which makes you excited to participate.

Now if you want to add yours too (which I hope, but don't presume that you'll necessarily want to), so you sign in to dropbox, and then ask me for edit permission to the shared folder (via the preview_url). Once I grant you access I hope that you can just refresh the App and then you can add your songs to the folder.

That's at least the flow we're trying to build. Not sure if you can think of a better pattern.

Greg-DB

I see, thanks for the additional context. I can't think of a better system for this use case unfortunately.

elsigh

Hey @Greg-DB

So I'm trying to get the `shared_folder_id` as user #1 but I'm not successful.

Heres' what I see in Dropbox for the folder. I'm the owner:

I call `/files/get_metadat` but I don't see anything to use as a `shared_folder_id`:

The folder is link-shared:

So it seems I don't have what I need to programmatically add someone by email address. Ideas?

elsigh

Ah, I'm just now seeing the "This folder can only be shared as a link" banner, which must be relevant.. I wonder if it's because this is a folder at the root level of my App Folder? aka it's /Apps/Songbook.Studio/Commoner .. maybe I'm heading into the rabbit hole.

elsigh

I tried to share the folder in the Dropbox MacOS client but get this:

Starting to wonder if the "App Folder" permission is at the root of what's dogging me. I don't recall being so hamstrung until we made the decision to change that in the interest of user privacy.

elsigh

I tried creating another folder in the Dropbox web client and choosing "Share with specific people" and got this, which is stuck:

elsigh

Ok, so I tried another direction.

I sent a shared link from user #1 to user #2 but then trying to access it as user #2:

{"error_summary": "shared_link_access_denied/..", "error": {".tag": "shared_link_access_denied"}}

Greg-DB

@elsigh Yes, apologies for the confusion, but currently, app folders are incompatible with shared folders, meaning you can't share an app folder as a shared folder (only as a read-only link), put a shared folder inside an app folder or put an app folder in a shared folder. So, the behavior and restrictions you're seeing on the web site and desktop client are expected for app folders.

Instead, for any part of your app where you want to use the API with shared folders, you'll need to use "full Dropbox" permission, as opposed to the app folder permission.

And the 'shared_link_access_denied' issue you mentioned appears to be the same as what you reported in this other thread. That's still open with the team.

elsigh

I feel like I'd never want to give any app (certainly some utility app) the ability to read every folder/file in my dropbox, but I'd trust almost app to a particular directory and contents within, just like I do with users.

This seems like an pretty unfortunate design in terms of user privacy. I can't imagine users will give my app a try if I ask to read their whole dropbox. Am I missing anything?

Greg-DB

No, I don't believe you're missing anything. It sounds like you have a good understanding of the Dropbox API permissions options currently available, but we appreciate the feedback. There isn't currently a way to allow an app to access only a specific pre-existing path, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.

elsigh

Hey @Greg-DB - I've changed our app back to the full dropbox permission for now, but I have a couple more challenges trying to implement the approach we outlined before.

I'll start with this one since it would give two users a shared-editable folder:

Use case: User #1 adds User #2 to a folder by email in our App

User #1 creates a new folder (we do it in /Apps/Songbook.Studio/${newFolderName})
User #1 tries to invite User #2 by email to that folder using sharingAddFolderMember, but we’re stuck without sharing_info.shared_folder_id

The folder metadata has no sharing_info key on it. I’ve tried called sharingCreateSharedLinkWithSettings in advance. The only way I can seem to get sharing_info to be populated is if User #1 goes to the Dropbox client and adds any user by email there.

Greg-DB