feat(google-drive): support group, domain, and gated anyone-with-link sharing

[peteski22]

Summary

google_drive_share_files only created type=user permissions from an email. Drive's permissions.create also supports group, domain, and anyone grants. This extends the tool to cover all four, keeping anyone-with-link behind an explicit gate.

Changes

ShareFilesParams — replaces the single required email with a typed target:

• share_type: Literal["user","group","domain"] (default user) + the matching field (email/group_email/domain).
• allow_anyone_with_link: bool = False — a separate, explicit opt-in for type=anyone, deliberately not folded into share_type. When set, it overrides share_type.
• @model_validator(mode="after") requires the field matching share_type (skipped for anyone-with-link), so a missing/mismatched target raises ValidationError before any HTTP request is made.

tools.py — _build_permission_body maps params onto the permissions.create body per type; _share_target_label produces the human-readable grantee. The bulk file_ids/role flow and per-file items (partial-failure surfacing) are unchanged. Docstrings carry NOTE: lines spelling out that anyone/domain are broad-exposure grants.

ShareFilesResult.email → target — the result now describes any grantee (group email, domain example.com, anyone with the link), not just a user email.

Security posture

type=anyone and type=domain are broad-exposure grants. Anyone-with-link is gated behind an explicit boolean (default False) and documented, keeping the footgun off the default path — the reason it is not a share_type value.

Tests

• group share → type=group body with the group email; result type=group.
• domain share → type=domain body with the domain; result type=domain.
• allow_anyone_with_link=True → type=anyone body created; also asserted it overrides share_type; default (False) never creates one.
• Exact request-body assertions per target type.
• Validation failures: missing email/group_email/domain for the chosen share_type, and invalid share_type.
• Existing bulk/partial-failure/empty-ids tests updated for the target field.

Verification

• make lint → all hooks pass (ruff, ruff-format, detect-secrets, ty, uv-lock).
• make test → 2235 passed, 49 skipped.

Note

Renames the result field email → target (breaking that field name) since it no longer always holds an email. Flagging in case backward-compat on the field name is preferred.

Closes #154

Summary by CodeRabbit

• New Features

  • Expanded file sharing options to support sharing with individuals, groups, domains, and anyone with the link.
  • Returned sharing results now show the resolved destination more clearly.

• Bug Fixes

  • Improved validation so sharing requests require the right details for each sharing type.
  • Updated sharing requests to use a consistent payload across multiple files.

• Tests

  • Added coverage for the new sharing modes and request payloads.
  • Updated existing checks to match the revised sharing result format.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6b4f1be6-f899-4001-a0c9-174d8268623f

📥 Commits

Reviewing files that changed from the base of the PR and between 1e37a2e and 53ce779.

📒 Files selected for processing (8)

• src/apron_tools/providers/google/drive/tools.py
• src/apron_tools/providers/google/drive/types.py
• tests/providers/google/drive/test_tools.py
• tests/providers/google/drive/test_types.py
• tests/providers/google/drive/testdata/_source.md
• tests/providers/google/drive/testdata/share_file_anyone.json
• tests/providers/google/drive/testdata/share_file_domain.json
• tests/providers/google/drive/testdata/share_file_group.json

---

Walkthrough

Google Drive file sharing was extended to support group, domain, and gated anyone-with-link targets alongside user sharing. ShareFilesParams gained a share_type discriminator and target fields with validation; ShareFilesResult.email was renamed to target. New helpers build the permission body and target label, and tests/fixtures were added accordingly.

Changes

Multi-target Drive sharing

Layer / File(s)	Summary
ShareFilesParams/ShareFilesResult contract and validation src/apron_tools/providers/google/drive/types.py	Adds share_type (user/group/domain), target fields (email, group_email, domain), and allow_anyone_with_link; adds a model validator requiring the matching target field unless anyone-with-link is set; renames ShareFilesResult.email to target and updates __str__.
Permission body construction and share tool wiring src/apron_tools/providers/google/drive/tools.py	Adds _build_permission_body and _share_target_label helpers; _share_one_file now takes a pre-built permission body; google_drive_share_files builds the body once, reuses it per file, and returns target instead of email.
Tests and fixtures for group/domain/anyone sharing tests/providers/google/drive/test_tools.py, tests/providers/google/drive/test_types.py, tests/providers/google/drive/testdata/*	Extends tests to cover group, domain, and anyone-with-link scenarios (including override behaviour and validation errors), updates result-field assertions to target, and adds corresponding JSON fixtures plus updated testdata documentation.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant google_drive_share_files
  participant _build_permission_body
  participant _share_one_file
  participant DriveAPI
  Caller->>google_drive_share_files: ShareFilesParams (share_type, target fields)
  google_drive_share_files->>_build_permission_body: params
  _build_permission_body-->>google_drive_share_files: permission body (type/role/target)
  loop each file_id
    google_drive_share_files->>_share_one_file: file_id, body
    _share_one_file->>DriveAPI: permissions.create(body)
    DriveAPI-->>_share_one_file: result/error
  end
  google_drive_share_files-->>Caller: ShareFilesResult(target=...)

Loading

Related issues: #154

Suggested labels: enhancement, google-drive, tests

Suggested reviewers: (none identified from provided context)

---

🐰 A hop through Drive's sharing lane,
Groups and domains join the chain,
"Anyone" waits behind a gate,
Targets replace the email trait,
Fixtures fresh, the tests remain.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarises the main change: expanded Google Drive sharing to groups, domains, and gated anyone-with-link access.
Linked Issues check	✅ Passed	The implementation matches the issue requirements for user, group, domain, and gated anyone-with-link sharing, with bulk behaviour preserved.
Out of Scope Changes check	✅ Passed	The diff stays within the requested Google Drive sharing and test updates, with no obvious unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/drive-share-group-domain-anyone

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}