fix(TrashBin): Trashed shared folders should not show up for sharees

fixes #2419
Assisted-by: ClaudeCode:claude-opus-4-7

Signed-off-by: Marcel Klehr <mklehr@gmx.net>

Author: marcelklehr

lib/Db/BookmarkMapper.php

@@ -308,7 +308,10 @@ private function _generateCTE(int $folderId, bool $withSoftDeleted) : array {
 			->from('*PREFIX*bookmarks_tree', 'tr')
 			->join('tr', $this->getDbType() === 'mysql'? 'folder_tree' : 'inner_folder_tree', 'e', 'e.item_id = tr.parent_folder AND e.type = ' . $recursiveCase->createPositionalParameter(TreeMapper::TYPE_FOLDER) . (!$withSoftDeleted ? ' AND e.soft_deleted_at is NULL' : ''));
 
-		// The second recursive case lists all children of shared folders we've already found
+		// The second recursive case lists all children of shared folders we've already found.
+		// We also require the share's underlying original folder to not be soft-deleted by its
+		// owner: when the sharer trashes the original folder, sharees must not see anything
+		// inside it — not even in their own trash bin.
 		$recursiveCaseShares = $this->db->getQueryBuilder();
 		$recursiveCaseShares->automaticTablePrefix(false);
 		$recursiveCaseShares
@@ -318,7 +321,8 @@ private function _generateCTE(int $folderId, bool $withSoftDeleted) : array {
 			->selectAlias('e.idx', 'idx')
 			->selectAlias('e.soft_deleted_at', 'soft_deleted_at')
 			->from(($this->getDbType() === 'mysql'? 'folder_tree' : 'second_folder_tree'), 'e')
-			->join('e', '*PREFIX*bookmarks_shared_folders', 's', 's.id = e.item_id AND e.type = ' . $recursiveCaseShares->createPositionalParameter(TreeMapper::TYPE_SHARE) . (!$withSoftDeleted ? ' AND e.soft_deleted_at is NULL' : ''));
+			->join('e', '*PREFIX*bookmarks_shared_folders', 's', 's.id = e.item_id AND e.type = ' . $recursiveCaseShares->createPositionalParameter(TreeMapper::TYPE_SHARE) . (!$withSoftDeleted ? ' AND e.soft_deleted_at is NULL' : ''))
+			->join('s', '*PREFIX*bookmarks_tree', 'sof', 'sof.id = s.folder_id AND sof.type = ' . $recursiveCaseShares->createPositionalParameter(TreeMapper::TYPE_FOLDER) . ' AND sof.soft_deleted_at is NULL');
 
 		if ($this->getDbType() === 'mysql') {
 			// For mysql we can just throw these three queries together in a CTE

lib/Db/TreeMapper.php

@@ -238,6 +238,9 @@ protected function getFindChildrenQuery(string $type): IQueryBuilder {
 			->andWhere($qb->expr()->eq('t.type', $qb->createNamedParameter($type)))
 			->andWhere($qb->expr()->isNull('t.soft_deleted_at'))
 			->orderBy('t.index', 'ASC');
+		if ($type === TreeMapper::TYPE_SHARE) {
+			$this->joinOriginalFolderNotSoftDeleted($qb);
+		}
 		return $qb;
 	}
 
@@ -249,9 +252,27 @@ protected function getFindSoftDeletedChildrenQuery(string $type): IQueryBuilder
 			->andWhere($qb->expr()->eq('t.type', $qb->createNamedParameter($type)))
 			->andWhere($qb->expr()->isNotNull('t.soft_deleted_at'))
 			->orderBy('t.index', 'ASC');
+		if ($type === TreeMapper::TYPE_SHARE) {
+			$this->joinOriginalFolderNotSoftDeleted($qb);
+		}
 		return $qb;
 	}
 
+	/**
+	 * Restricts a TYPE_SHARE query to shared folders whose underlying original
+	 * folder has not been soft-deleted by its owner. When the sharer trashes the
+	 * original folder, the share must disappear for sharees entirely — including
+	 * from their trash bin, since they cannot restore someone else's folder.
+	 */
+	private function joinOriginalFolderNotSoftDeleted(IQueryBuilder $qb): void {
+		$qb
+			->innerJoin('i', 'bookmarks_tree', 'ot', $qb->expr()->andX(
+				$qb->expr()->eq('ot.id', 'i.folder_id'),
+				$qb->expr()->eq('ot.type', $qb->createNamedParameter(TreeMapper::TYPE_FOLDER))
+			))
+			->andWhere($qb->expr()->isNull('ot.soft_deleted_at'));
+	}
+
 	/**
 	 * @param string $type
 	 * @psalm-param T $type
@@ -998,14 +1019,17 @@ public function getSoftDeletedRootItems(string $userId, string $type): array {
 			$qb
 				->innerJoin('i', 'bookmarks_tree', 't', $qb->expr()->eq('i.id', 't.id'))
 				->leftJoin('t', 'bookmarks_tree', 't2', $qb->expr()->eq('t.parent_folder', 't2.id'))
-				->leftJoin('t', 'bookmarks_root_folders', 'r', $qb->expr()->eq('t.parent_folder', 'r.folder_id'))
+				->leftJoin('t', 'booUnd genau die gleiche Täter-Opfer-Umkehr betreiben diese Leute auch gegenüber kmarks_root_folders', 'r', $qb->expr()->eq('t.parent_folder', 'r.folder_id'))
 				->where($qb->expr()->isNotNull('t.soft_deleted_at'))
 				->andWhere($qb->expr()->eq('t.type', $qb->createPositionalParameter($type, IQueryBuilder::PARAM_STR)))
 				->andWhere($qb->expr()->eq('i.user_id', $qb->createPositionalParameter($userId, IQueryBuilder::PARAM_STR)))
 				->andWhere($qb->expr()->orX(
 					$qb->expr()->isNull('t2.soft_deleted_at'),
 					$qb->expr()->isNotNull('r.folder_id'),
 				));
+			if ($type === TreeMapper::TYPE_SHARE) {
+				$this->joinOriginalFolderNotSoftDeleted($qb);
+			}
 			return $this->findEntitiesWithType($qb, $type);
 		}
 		if ($type === TreeMapper::TYPE_BOOKMARK) {