Nested namespaces for selective content sharing

• US 10,699,025 B2
• Filed: 02/07/2018
• Issued: 06/30/2020
• Est. Priority Date: 04/01/2015
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: von Muhlen, Marcio, Bunger, Nils Milton, Ibrishimov, Emil, Glik, Tsahi, Price, Greg
• Primary Examiner(s): Dolly, Kendall
• Application Number:
  US15/891,296
• Publication Number:
  US 20180165471A1
• Time in Patent Office: 874 Days
• CPC Class Codes: G06F 16/16 File or folder operations, e.g. details of user interfaces specifically adapted to file systems
• CPC Class Codes: G06F 16/185 Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof details of archiving G06F16/11
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

Nested namespaces for selective content sharing. In one embodiment, for example, a computer-implemented method includes the steps of: receiving a request to share a content item with a first set of user accounts held with a content management system; determining a first namespace to which the content item belongs; based on detecting that a second set of user accounts allowed to access the first namespace is different from the first set of user accounts, creating a second namespace nested in the first namespace; associating the first set of user accounts with the second namespace; and based on the first set of user accounts being associated with the second namespace, allowing the first set of user accounts to access content items, including the content item, belonging to the second namespace.

Claims

1. A computer-implemented method comprising:

receiving a request to share a content item with a first set of one or more user accounts held with a content management system;

based on receiving the request, determining a first namespace to which the content item belongs, and detecting that a second set of one or more user accounts allowed to access the first namespace is different from the first set of one or more user accounts;

based upon the detecting, creating a second namespace nested in the first namespace;

associating the first set of one or more user accounts with the second namespace; and

based on the first set of one or more user accounts being associated with the second namespace, allowing the first set of one or more user accounts to access content items, including the content item, belonging to the second namespace.

2. The computer-implemented method of claim 1, wherein:

the first namespace is rooted at a first folder in a folder hierarchy;

the second namespace is rooted at a second folder in the folder hierarchy; and

the second folder is a descendant of the first folder in the folder hierarchy.

3. The computer-implemented method of claim 1, wherein:

the first namespace is rooted at a first folder in a folder hierarchy;

the content item is a second folder in the folder hierarchy; and

the second folder is a descendant of the first folder in the folder hierarchy.

4. The computer-implemented method of claim 1, wherein the first set of one or more user accounts belong to a team of one or more user accounts.

5. The computer-implemented method of claim 1, further comprising creating the second namespace rooted at the content item including associating the second namespace with a path within a folder hierarchy to the content item.

6. The computer-implemented method of claim 1, wherein:

the first set of one or more user accounts includes a set of one or more particular user accounts that are not included in the second set of one or more user accounts; and

the computer-implemented method further comprises not allowing the set of one or more particular user accounts to access content items that belong only to the first namespace and that do not belong the second namespace.

7. The computer-implemented method of claim 1, further comprising:

after the allowing the first set of one or more user accounts to access content items, including the content item, belonging to the second namespace;

receiving a request to share the content item with the second set of one or more user accounts;

based on detecting that a same set of one or more user accounts have permission to access both the first namespace and the second namespace, deleting the second namespace; and

wherein the same set of one or more user accounts is the second set of one or more user accounts.

8. A non-transitory computer-readable medium containing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a request to share a content item with a first set of one or more access control permissions governing access to the content item, the content item hosted with a content management system;

based on receiving the request, determining a first namespace to which the content item belongs, and detecting that a second set of one or more access control permissions governing access to the first namespace is different from the first set of one or more access control permissions;

based upon the detecting, creating a second namespace;

associating the second namespace with the first set of one or more access control permissions; and

based on the first set of one or more access control permissions being associated with the second namespace, governing access to content items, including the content item, that belong to the second namespace according to the first set of one or more access control permissions.

9. The non-transitory computer-readable medium of claim 8, wherein:

the first namespace is rooted at a first folder in a folder hierarchy;

the second namespace is rooted at a second folder in the folder hierarchy; and

the second folder is a descendant of the first folder in the folder hierarchy.

10. The non-transitory computer-readable medium of claim 8, wherein:

the first namespace is rooted at a first folder in a folder hierarchy;

the content item is a second folder in the folder hierarchy; and

the second folder is a descendant of the first folder in the folder hierarchy.

11. The non-transitory computer-readable medium of claim 8, wherein the first set of one or more access control permissions are effective to grant access to a team of one or more user accounts.

12. The non-transitory computer-readable medium of claim 8, further comprising creating the second namespace rooted at the content item.

13. The non-transitory computer-readable medium of claim 8, further comprising:

governing access to content items that belong to the first namespace according to the second set of one or more access control permissions; and

governing access to content items, including the content item, that belong to the second namespace according to the first set of one or more access control permissions.

14. The non-transitory computer-readable medium of claim 8, further comprising:

after governing access to content items, including the content item, belonging to the second namespace according to the first set of one or more access control permissions;

receiving a request to share the content item with the second set of one or more access control permissions;

based on detecting that a same set of one or more access control permissions govern access to the first namespace and the second namespace, deleting the second namespace; and

wherein the same set of one or more access control permission is the second set of one or more access control permissions.

15. A computing system, comprising:

one or more processors;

one or more non-transitory storage media; and

instructions contained in the one or more non-transitory storage media and that, when executed by the one or more processors, cause the computing system to perform operations including;

receiving a request to share a first folder with a first set of one or more user accounts held with a content management system;

based on receiving the request, determining a first namespace to which the first folder belongs, and detecting that a second set of one or more user accounts allowed to access the first namespace is different from the first set of one or more user accounts;

wherein the first namespace is rooted at a second folder, the second folder being a parent of the first folder within in a folder hierarchy;

based upon the detecting, creating a second namespace rooted at the first folder;

associating the first set of one or more user accounts with the second namespace; and

based on the first set of one or more user accounts being associated with the second namespace, allowing the first set of one or more user accounts to access content items, including the first folder, belonging to the second namespace.

16. The computing system of claim 15, wherein the operations further include:

allowing a particular user account that is in the first set of one or more user accounts, but not in a second set of one or more user accounts associated with the first namespace, to mount the second namespace at a client device associated with the particular user account.

17. The computing system of claim 15, wherein the operations further include:

allowing a particular user account that is in the first set of one or more user accounts to mount the first namespace at a first filesystem folder of a filesystem of a client device associated with the particular user account; and

allowing the particular user account that is in the first set of one or more user accounts to mount the second namespace at a second filesystem folder of the filesystem of the client device associated with the particular user account.

18. The computer system of claim 17, wherein the second filesystem folder is not a descendant folder of the first filesystem folder in a folder hierarchy of the filesystem.

19. The computer system of claim 17, wherein the second filesystem folder is a child folder of the first filesystem folder in a folder hierarchy of the filesystem.

20. The computer system of claim 15, wherein:

the first set of one or more user accounts includes a set of one or more particular user accounts that are not included in a second set of one or more user accounts associated with the first namespace; and

the operations further include synchronizing content items that belong to the second namespace with one or more client devices associated with the set of one or more particular user accounts; and

not synchronizing content items that belong only to the first namespace and not the second namespace with the one or more client devices associated with the set of one or more particular user accounts.