Public shared files not getting downloaded

Description:

When a File Access Control rule is created based on a file tag, files with that tag cannot be downloaded via public share links, even if the rule is intended only to restrict access for authenticated users.

Steps to Reproduce:

Enable the Files Access Control app.

Create a new collaborative tag (e.g., LOCKED).

Add a File Access Control rule:

Tag is LOCKED

Operation: Deny update and delete

Apply the LOCKED tag to a file.

Create a public share link for that file.

Attempt to download the file using the public link.

Expected Behavior:

The file should download successfully via the public link (since the rule is only meant to block edits, not public access).

Actual Behavior:

The download is blocked with an “Access denied” error.

Logs show the File Access Control rule was triggered even though the user is anonymous (public share).

Log Snippet:

Access denied for path ... that matches rules: {"id":5,"operation":"deny"}
Exception: OC\ForbiddenException: Access denied

Start by reproducing the failure with a tagged file, a deny-update-and-delete rule, and an anonymous public share download. Read the Files Access Control handling for public-share requests and rule matching; done means the download succeeds for anonymous users while the rule still blocks updates and deletes.