Dropbox Extensions opens to all developers!

This is great news.

However looks like there is a bug that needs fixing.

Scenario:

- Consider a Personal App with "Full Dropbox" permission (since thats only where its available as type of writing this) - will call it MyShare

1. User A oauth the app, we got user token - good so far

2. User A goes to DB and select a file from ROOT/FILE.txt and clicks share with MyShare - good so far

3. User A is taken to EXTENSIONURL?file_id... - very good so far

4. "MyShare App" looks up file_id and OOPS, it doesn't have access - very bad

5. Upon investigating it turns out that the "Full Dropbox" scope only has access to "User A's files and folders'

Problem

- As an extension I would like for it to work on any file, regardless of it being outsitde "my folder" or my files

-- It would defeat the purpose if extenion works only my files

- Right now I can select other users file, click on share - and it fails as the API doesn't have the ability to download it.

- The user doesn't have access to the folders outside his own folder and it fails with:

{
  "error_summary": "path/not_found/",
  "error": {
    ".tag": "path",
    "path": {
      ".tag": "not_found"
    }
  }
}

- Further more when you make the api call to: https://api.dropboxapi.com/2/files/list_folder, you are chrooted to user's folder and dont have visibility outside. This doesn't seem competable with extensions.

Hope this helps and looking forward to a fix/update on this.

Thanks