From bf15aebb48bbd8e0eeffff28d9e3afae6246797d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= <jfd@butonic.de>
Date: Fri, 11 Jun 2021 22:18:29 +0000
Subject: [PATCH] update to embedded reference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
---
 cmd/reva/ocm-share-list.go                    |  4 +-
 cmd/reva/public-share-list.go                 |  4 +-
 cmd/reva/recycle-list.go                      |  2 +-
 cmd/reva/recycle-purge.go                     |  2 +-
 cmd/reva/recycle-restore.go                   |  2 +-
 cmd/reva/share-list.go                        |  4 +-
 cmd/reva/upload.go                            |  2 +-
 go.mod                                        |  2 +-
 go.sum                                        |  4 +-
 internal/grpc/interceptors/auth/auth.go       |  2 +-
 .../grpc/services/appprovider/appprovider.go  |  2 +-
 .../grpc/services/gateway/ocmshareprovider.go | 10 ++---
 .../grpc/services/gateway/storageprovider.go  | 44 +++++++++----------
 .../services/gateway/usershareprovider.go     | 17 +++----
 internal/grpc/services/ocmcore/ocmcore.go     |  6 +--
 .../publicstorageprovider.go                  |  6 +--
 .../storageprovider/storageprovider.go        | 22 +++++-----
 internal/http/services/owncloud/ocdav/copy.go |  9 ++--
 .../http/services/owncloud/ocdav/ocdav.go     | 10 ++---
 .../http/services/owncloud/ocdav/spaces.go    |  5 +--
 .../http/services/owncloud/ocdav/trashbin.go  | 12 ++---
 .../http/services/owncloud/ocdav/versions.go  | 16 +++----
 .../handlers/apps/sharing/shares/public.go    |  2 +-
 .../handlers/apps/sharing/shares/shares.go    | 16 +++----
 .../ocs/handlers/cloud/users/users.go         |  2 +-
 pkg/app/provider/demo/demo.go                 |  3 +-
 pkg/auth/scope/publicshare.go                 |  7 +--
 pkg/auth/scope/resourceinfo.go                | 15 +++++--
 pkg/cbox/publicshare/sql/sql.go               |  4 +-
 pkg/cbox/share/sql/sql.go                     | 12 ++---
 pkg/cbox/utils/conversions.go                 |  4 +-
 pkg/ocm/share/manager/json/json.go            | 10 ++---
 pkg/ocm/share/share.go                        |  2 +-
 pkg/publicshare/manager/json/json.go          |  2 +-
 pkg/publicshare/manager/memory/memory.go      |  2 +-
 pkg/rhttp/datatx/manager/spaces/spaces.go     |  6 ++-
 pkg/rhttp/datatx/utils/download/download.go   | 14 +++++-
 pkg/sdk/action/download.go                    |  2 +-
 pkg/share/cache/cbox/cbox.go                  | 10 ++---
 pkg/share/manager/json/json.go                |  6 +--
 pkg/share/manager/memory/memory.go            |  6 +--
 pkg/storage/fs/owncloud/owncloud.go           | 22 +++++-----
 pkg/storage/fs/owncloudsql/owncloudsql.go     |  8 ++--
 pkg/storage/fs/s3/s3.go                       | 18 ++++----
 pkg/storage/registry/static/static.go         | 39 ++++++++--------
 pkg/storage/registry/static/static_test.go    |  4 +-
 pkg/storage/storage.go                        |  2 +-
 .../utils/decomposedfs/decomposedfs.go        |  6 +--
 pkg/storage/utils/decomposedfs/lookup.go      | 10 ++---
 pkg/storage/utils/decomposedfs/node/node.go   |  2 +-
 pkg/storage/utils/decomposedfs/tree/tree.go   |  2 +-
 pkg/storage/utils/eosfs/eosfs.go              | 16 +++----
 pkg/storage/utils/localfs/localfs.go          | 10 ++---
 pkg/utils/utils.go                            |  7 ++-
 54 files changed, 243 insertions(+), 215 deletions(-)

diff --git a/cmd/reva/ocm-share-list.go b/cmd/reva/ocm-share-list.go
index 17b0ff4106b..06b8836c9bb 100644
--- a/cmd/reva/ocm-share-list.go
+++ b/cmd/reva/ocm-share-list.go
@@ -56,9 +56,9 @@ func ocmShareListCommand() *command {
 			if len(tokens) != 2 {
 				return fmt.Errorf("resource id invalid")
 			}
-			id := &provider.Reference{
+			id := &provider.ResourceId{
 				StorageId: tokens[0],
-				NodeId:    tokens[1],
+				OpaqueId:  tokens[1],
 			}
 			shareRequest.Filters = []*ocm.ListOCMSharesRequest_Filter{
 				&ocm.ListOCMSharesRequest_Filter{
diff --git a/cmd/reva/public-share-list.go b/cmd/reva/public-share-list.go
index 1bbd4d35be6..b8dbf322cee 100644
--- a/cmd/reva/public-share-list.go
+++ b/cmd/reva/public-share-list.go
@@ -56,9 +56,9 @@ func publicShareListCommand() *command {
 			if len(tokens) != 2 {
 				return fmt.Errorf("resource id invalid")
 			}
-			id := &provider.Reference{
+			id := &provider.ResourceId{
 				StorageId: tokens[0],
-				NodeId:    tokens[1],
+				OpaqueId:  tokens[1],
 			}
 			shareRequest.Filters = []*link.ListPublicSharesRequest_Filter{
 				&link.ListPublicSharesRequest_Filter{
diff --git a/cmd/reva/recycle-list.go b/cmd/reva/recycle-list.go
index 7830ca61e66..b0011f784c2 100644
--- a/cmd/reva/recycle-list.go
+++ b/cmd/reva/recycle-list.go
@@ -46,7 +46,7 @@ func recycleListCommand() *command {
 		}
 
 		req := &gateway.ListRecycleRequest{
-			Ref: getHomeRes.Ref,
+			Ref: &provider.Reference{Path: getHomeRes.Path},
 		}
 		res, err := client.ListRecycle(ctx, req)
 		if err != nil {
diff --git a/cmd/reva/recycle-purge.go b/cmd/reva/recycle-purge.go
index c9f793edada..335bf3b4a6b 100644
--- a/cmd/reva/recycle-purge.go
+++ b/cmd/reva/recycle-purge.go
@@ -44,7 +44,7 @@ func recyclePurgeCommand() *command {
 			return err
 		}
 
-		req := &gateway.PurgeRecycleRequest{Ref: getHomeRes.Ref}
+		req := &gateway.PurgeRecycleRequest{Ref: &provider.Reference{Path: getHomeRes.Path}}
 
 		res, err := client.PurgeRecycle(ctx, req)
 		if err != nil {
diff --git a/cmd/reva/recycle-restore.go b/cmd/reva/recycle-restore.go
index 1b62778c496..ad0a02b95eb 100644
--- a/cmd/reva/recycle-restore.go
+++ b/cmd/reva/recycle-restore.go
@@ -51,7 +51,7 @@ func recycleRestoreCommand() *command {
 		}
 
 		req := &provider.RestoreRecycleItemRequest{
-			Ref: getHomeRes.Ref,
+			Ref: &provider.Reference{Path: getHomeRes.Path},
 			Key: key,
 		}
 
diff --git a/cmd/reva/share-list.go b/cmd/reva/share-list.go
index 3b869c685f2..73b005d0cd0 100644
--- a/cmd/reva/share-list.go
+++ b/cmd/reva/share-list.go
@@ -56,9 +56,9 @@ func shareListCommand() *command {
 			if len(tokens) != 2 {
 				return fmt.Errorf("resource id invalid")
 			}
-			id := &provider.Reference{
+			id := &provider.ResourceId{
 				StorageId: tokens[0],
-				NodeId:    tokens[1],
+				OpaqueId:  tokens[1],
 			}
 			shareRequest.Filters = []*collaboration.ListSharesRequest_Filter{
 				&collaboration.ListSharesRequest_Filter{
diff --git a/cmd/reva/upload.go b/cmd/reva/upload.go
index 335de6ac9fd..f9c969aba65 100644
--- a/cmd/reva/upload.go
+++ b/cmd/reva/upload.go
@@ -221,7 +221,7 @@ func uploadCommand() *command {
 
 		info := res2.Info
 
-		fmt.Printf("File uploaded: %s:%s %d %s\n", info.Id.StorageId, info.Id.NodeId, info.Size, info.Path)
+		fmt.Printf("File uploaded: %s:%s %d %s\n", info.Id.StorageId, info.Id.OpaqueId, info.Size, info.Path)
 
 		return nil
 	}
diff --git a/go.mod b/go.mod
index ddab8390082..3139a87d115 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 go 1.16
 
 replace (
-	github.com/cs3org/go-cs3apis => github.com/butonic/go-cs3apis v0.0.0-20210608111428-0b2c079174c9
+	github.com/cs3org/go-cs3apis => github.com/butonic/go-cs3apis v0.0.0-20210611201603-ddc97e244f3d
 	github.com/eventials/go-tus => github.com/andrewmostello/go-tus v0.0.0-20200314041820-904a9904af9a
 	github.com/oleiade/reflections => github.com/oleiade/reflections v1.0.1
 	google.golang.org/grpc => google.golang.org/grpc v1.26.0 // temporary downgrade
diff --git a/go.sum b/go.sum
index 5b7d45908cd..a1dc4335a9c 100644
--- a/go.sum
+++ b/go.sum
@@ -103,8 +103,8 @@ github.com/bmatcuk/doublestar/v2 v2.0.3/go.mod h1:QMmcs3H2AUQICWhfzLXz+IYln8lRQm
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40 h1:y4B3+GPxKlrigF1ha5FFErxK+sr6sWxQovRMzwMhejo=
 github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40/go.mod h1:8rLXio+WjiTceGBHIoTvn60HIbs7Hm7bcHjyrSqYB9c=
-github.com/butonic/go-cs3apis v0.0.0-20210608111428-0b2c079174c9 h1:q2UFrmiIZwdFOislnGjUWlyqIpttjBRIB6K3QOUmZkY=
-github.com/butonic/go-cs3apis v0.0.0-20210608111428-0b2c079174c9/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
+github.com/butonic/go-cs3apis v0.0.0-20210611201603-ddc97e244f3d h1:kcfcU1gtVWN1atA0gV6dfi7gOSDzGAUc9Ng7X7kGLRY=
+github.com/butonic/go-cs3apis v0.0.0-20210611201603-ddc97e244f3d/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
 github.com/c-bata/go-prompt v0.2.5 h1:3zg6PecEywxNn0xiqcXHD96fkbxghD+gdB2tbsYfl+Y=
 github.com/c-bata/go-prompt v0.2.5/go.mod h1:vFnjEGDIIA/Lib7giyE4E9c50Lvl8j0S+7FVlAwDAVw=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
diff --git a/internal/grpc/interceptors/auth/auth.go b/internal/grpc/interceptors/auth/auth.go
index 54b8a24dd9f..c821c289f9d 100644
--- a/internal/grpc/interceptors/auth/auth.go
+++ b/internal/grpc/interceptors/auth/auth.go
@@ -261,7 +261,7 @@ func dismantleToken(ctx context.Context, tkn string, req interface{}, mgr token.
 
 			// Since the public share is obtained from the scope, the current token
 			// has access to it.
-			statReq := &provider.StatRequest{Ref: share.ResourceId}
+			statReq := &provider.StatRequest{Ref: &provider.Reference{ResourceId: share.ResourceId}}
 
 			statResponse, err := client.Stat(ctx, statReq)
 			if err != nil || statResponse.Status.Code != rpc.Code_CODE_OK {
diff --git a/internal/grpc/services/appprovider/appprovider.go b/internal/grpc/services/appprovider/appprovider.go
index 09cd9486ffc..b7545f7927e 100644
--- a/internal/grpc/services/appprovider/appprovider.go
+++ b/internal/grpc/services/appprovider/appprovider.go
@@ -165,7 +165,7 @@ func (s *service) OpenInApp(ctx context.Context, req *providerpb.OpenInAppReques
 	}
 
 	q := httpReq.URL.Query()
-	q.Add("fileid", req.ResourceInfo.GetId().NodeId)
+	q.Add("fileid", req.ResourceInfo.GetId().OpaqueId)
 	q.Add("endpoint", req.ResourceInfo.GetId().StorageId)
 	q.Add("viewmode", req.ViewMode.String())
 	// TODO the folder URL should be resolved as e.g. `'https://cernbox.cern.ch/index.php/apps/files/?dir=' + filepath.Dir(req.Ref.GetPath())`
diff --git a/internal/grpc/services/gateway/ocmshareprovider.go b/internal/grpc/services/gateway/ocmshareprovider.go
index 67b7d2fd315..753cd98b668 100644
--- a/internal/grpc/services/gateway/ocmshareprovider.go
+++ b/internal/grpc/services/gateway/ocmshareprovider.go
@@ -54,7 +54,7 @@ func (s *svc) CreateOCMShare(ctx context.Context, req *ocm.CreateOCMShareRequest
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		addGrantStatus, err := s.addGrant(ctx, req.ResourceId, req.Grant.Grantee, req.Grant.Permissions.Permissions)
+		addGrantStatus, err := s.addGrant(ctx, &provider.Reference{ResourceId: req.ResourceId}, req.Grant.Grantee, req.Grant.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error adding OCM grant to storage")
 		}
@@ -109,7 +109,7 @@ func (s *svc) RemoveOCMShare(ctx context.Context, req *ocm.RemoveOCMShareRequest
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		removeGrantStatus, err := s.removeGrant(ctx, share.ResourceId, share.Grantee, share.Permissions.Permissions)
+		removeGrantStatus, err := s.removeGrant(ctx, &provider.Reference{ResourceId: share.ResourceId}, share.Grantee, share.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error removing OCM grant from storage")
 		}
@@ -318,7 +318,7 @@ func (s *svc) createOCMReference(ctx context.Context, share *ocm.Share) (*rpc.St
 	if share.ShareType == ocm.Share_SHARE_TYPE_TRANSFER {
 		createTransferDir, err := s.CreateContainer(ctx, &provider.CreateContainerRequest{
 			Ref: &provider.Reference{
-				Path: path.Join(homeRes.Ref.Path, s.c.DataTransfersFolder),
+				Path: path.Join(homeRes.Path, s.c.DataTransfersFolder),
 			},
 		})
 		if err != nil {
@@ -329,14 +329,14 @@ func (s *svc) createOCMReference(ctx context.Context, share *ocm.Share) (*rpc.St
 			return status.NewInternal(ctx, err, "error creating transfers directory"), nil
 		}
 
-		refPath = path.Join(homeRes.Ref.Path, s.c.DataTransfersFolder, path.Base(share.Name))
+		refPath = path.Join(homeRes.Path, s.c.DataTransfersFolder, path.Base(share.Name))
 		targetURI = fmt.Sprintf("datatx://%s@%s?name=%s", token, share.Creator.Idp, share.Name)
 	} else {
 		// reference path is the home path + some name on the corresponding
 		// mesh provider (/home/MyShares/x)
 		// It is the responsibility of the gateway to resolve these references and merge the response back
 		// from the main request.
-		refPath = path.Join(homeRes.Ref.Path, s.c.ShareFolder, path.Base(share.Name))
+		refPath = path.Join(homeRes.Path, s.c.ShareFolder, path.Base(share.Name))
 		// webdav is the scheme, token@host the opaque part and the share name the query of the URL.
 		targetURI = fmt.Sprintf("webdav://%s@%s?name=%s", token, share.Creator.Idp, share.Name)
 	}
diff --git a/internal/grpc/services/gateway/storageprovider.go b/internal/grpc/services/gateway/storageprovider.go
index 9e626833f9d..976e236eb93 100644
--- a/internal/grpc/services/gateway/storageprovider.go
+++ b/internal/grpc/services/gateway/storageprovider.go
@@ -128,10 +128,10 @@ func (s *svc) ListStorageSpaces(ctx context.Context, req *provider.ListStorageSp
 			Status: status.NewInvalidArg(ctx, "space id must be separated by !"),
 		}, nil
 	}
-	c, err := s.find(ctx, &provider.Reference{
+	c, err := s.find(ctx, &provider.Reference{ResourceId: &provider.ResourceId{
 		StorageId: parts[0], // FIXME REFERENCE the StorageSpaceId is a storageid + a nodeid
-		NodeId:    parts[1],
-	})
+		OpaqueId:  parts[1],
+	}})
 	if err != nil {
 		return &provider.ListStorageSpacesResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding path", err),
@@ -151,7 +151,7 @@ func (s *svc) ListStorageSpaces(ctx context.Context, req *provider.ListStorageSp
 func (s *svc) UpdateStorageSpace(ctx context.Context, req *provider.UpdateStorageSpaceRequest) (*provider.UpdateStorageSpaceResponse, error) {
 	log := appctx.GetLogger(ctx)
 	// TODO: needs to be fixed
-	c, err := s.find(ctx, req.StorageSpace.Root)
+	c, err := s.find(ctx, &provider.Reference{ResourceId: req.StorageSpace.Root})
 	if err != nil {
 		return &provider.UpdateStorageSpaceResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding ID", err),
@@ -171,9 +171,9 @@ func (s *svc) UpdateStorageSpace(ctx context.Context, req *provider.UpdateStorag
 func (s *svc) DeleteStorageSpace(ctx context.Context, req *provider.DeleteStorageSpaceRequest) (*provider.DeleteStorageSpaceResponse, error) {
 	log := appctx.GetLogger(ctx)
 	// TODO: needs to be fixed
-	c, err := s.find(ctx, &provider.Reference{
+	c, err := s.find(ctx, &provider.Reference{ResourceId: &provider.ResourceId{
 		StorageId: req.Id.OpaqueId, // FIXME REFERENCE the StorageSpaceId is a storageid + a nodeid
-	})
+	}})
 	if err != nil {
 		return &provider.DeleteStorageSpaceResponse{
 			Status: status.NewStatusFromErrType(ctx, "error finding path", err),
@@ -192,7 +192,7 @@ func (s *svc) DeleteStorageSpace(ctx context.Context, req *provider.DeleteStorag
 
 func (s *svc) GetHome(ctx context.Context, _ *provider.GetHomeRequest) (*provider.GetHomeResponse, error) {
 	home := s.getHome(ctx)
-	homeRes := &provider.GetHomeResponse{Ref: &provider.Reference{Path: home}, Status: status.NewOK(ctx)}
+	homeRes := &provider.GetHomeResponse{Path: home, Status: status.NewOK(ctx)}
 	return homeRes, nil
 }
 
@@ -295,7 +295,7 @@ func (s *svc) InitiateFileDownload(ctx context.Context, req *provider.InitiateFi
 		if ri.Type == provider.ResourceType_RESOURCE_TYPE_FILE {
 			log.Debug().Str("path", p).Interface("ri", ri).Msg("path points to share name file")
 			req.Ref.Path = ri.Path
-			log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.NodeId).Str("path", req.Ref.Path).Msg("download")
+			log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.OpaqueId).Str("path", req.Ref.Path).Msg("download")
 			return s.initiateFileDownload(ctx, req)
 		}
 
@@ -357,7 +357,7 @@ func (s *svc) InitiateFileDownload(ctx context.Context, req *provider.InitiateFi
 
 		// append child to target
 		req.Ref.Path = path.Join(ri.Path, shareChild)
-		log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.NodeId).Str("path", req.Ref.Path).Msg("download")
+		log.Debug().Str("storage", ri.Id.StorageId).Str("node", ri.Id.OpaqueId).Str("path", req.Ref.Path).Msg("download")
 		return s.initiateFileDownload(ctx, req)
 	}
 
@@ -497,7 +497,7 @@ func (s *svc) InitiateFileUpload(ctx context.Context, req *provider.InitiateFile
 		if ri.Type == provider.ResourceType_RESOURCE_TYPE_FILE {
 			log.Debug().Str("path", p).Interface("ri", ri).Msg("path points to share name file")
 			req.Ref.Path = ri.Path
-			log.Debug().Str("storage", req.Ref.StorageId).Str("node", req.Ref.NodeId).Str("path", req.Ref.Path).Msg("upload")
+			log.Debug().Str("storage", req.Ref.ResourceId.StorageId).Str("node", req.Ref.ResourceId.OpaqueId).Str("path", req.Ref.Path).Msg("upload")
 			return s.initiateFileUpload(ctx, req)
 		}
 
@@ -622,7 +622,7 @@ func (s *svc) initiateFileUpload(ctx context.Context, req *provider.InitiateFile
 }
 
 func (s *svc) GetPath(ctx context.Context, req *provider.GetPathRequest) (*provider.GetPathResponse, error) {
-	statReq := &provider.StatRequest{Ref: req.ResourceId}
+	statReq := &provider.StatRequest{Ref: &provider.Reference{ResourceId: req.ResourceId}}
 	statRes, err := s.stat(ctx, statReq)
 	if err != nil {
 		err = errors.Wrap(err, "gateway: error stating ref:"+statReq.Ref.String())
@@ -1133,9 +1133,9 @@ func (s *svc) stat(ctx context.Context, req *provider.StatRequest) (*provider.St
 	return &provider.StatResponse{
 		Status: status.NewOK(ctx),
 		Info: &provider.ResourceInfo{
-			Id: &provider.Reference{
+			Id: &provider.ResourceId{
 				StorageId: "/",
-				NodeId:    uuid.New().String(),
+				OpaqueId:  uuid.New().String(),
 			},
 			Type: provider.ResourceType_RESOURCE_TYPE_CONTAINER,
 			Path: resPath,
@@ -1339,11 +1339,11 @@ func (s *svc) handleCS3Ref(ctx context.Context, opaque string) (*provider.Resour
 	// we could call here the Stat method again, but that is calling for problems in case
 	// there is a loop of targets pointing to targets, so better avoid it.
 
-	req := &provider.StatRequest{
-		Ref: &provider.Reference{
+	req := &provider.StatRequest{Ref: &provider.Reference{
+		ResourceId: &provider.ResourceId{
 			StorageId: parts[0],
-			NodeId:    parts[1],
-		},
+			OpaqueId:  parts[1],
+		}},
 	}
 	res, err := s.stat(ctx, req)
 	if err != nil {
@@ -1455,7 +1455,7 @@ func (s *svc) listSharesFolder(ctx context.Context) (*provider.ListContainerResp
 }
 
 func isStorageSpaceReference(ref *provider.Reference) bool {
-	return ref.StorageId != "" && ref.NodeId != "" && ref.Path != ""
+	return ref.ResourceId != nil && strings.HasPrefix(ref.Path, ".")
 }
 
 func (s *svc) listContainer(ctx context.Context, req *provider.ListContainerRequest) (*provider.ListContainerResponse, error) {
@@ -1498,9 +1498,9 @@ func (s *svc) listContainer(ctx context.Context, req *provider.ListContainerRequ
 
 	for k, v := range indirects {
 		inf := &provider.ResourceInfo{
-			Id: &provider.Reference{
+			Id: &provider.ResourceId{
 				StorageId: "/",
-				NodeId:    uuid.New().String(),
+				OpaqueId:  uuid.New().String(),
 			},
 			Type: provider.ResourceType_RESOURCE_TYPE_CONTAINER,
 			Etag: etag.GenerateEtagFromResources(nil, v),
@@ -1727,7 +1727,7 @@ func (s *svc) ListContainer(ctx context.Context, req *provider.ListContainerRequ
 func (s *svc) getPath(ctx context.Context, ref *provider.Reference, keys ...string) (string, *rpc.Status) {
 
 	// check if it is an id based or combined reference first
-	if ref.StorageId != "" && ref.NodeId != "" {
+	if ref.ResourceId != nil {
 		req := &provider.StatRequest{Ref: ref, ArbitraryMetadataKeys: keys}
 		res, err := s.stat(ctx, req)
 		if (res != nil && res.Status.Code != rpc.Code_CODE_OK) || err != nil {
@@ -1737,7 +1737,7 @@ func (s *svc) getPath(ctx context.Context, ref *provider.Reference, keys ...stri
 		return res.Info.Path, res.Status
 	}
 
-	if ref.StorageId == "" && ref.NodeId == "" && ref.Path != "" {
+	if ref.ResourceId == nil && strings.HasPrefix(ref.Path, "/") {
 		return ref.Path, &rpc.Status{Code: rpc.Code_CODE_OK}
 	}
 	return "", &rpc.Status{Code: rpc.Code_CODE_INTERNAL}
diff --git a/internal/grpc/services/gateway/usershareprovider.go b/internal/grpc/services/gateway/usershareprovider.go
index a070a6ee20a..a89f58a6547 100644
--- a/internal/grpc/services/gateway/usershareprovider.go
+++ b/internal/grpc/services/gateway/usershareprovider.go
@@ -63,7 +63,7 @@ func (s *svc) CreateShare(ctx context.Context, req *collaboration.CreateShareReq
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		addGrantStatus, err := s.addGrant(ctx, req.ResourceInfo.Id, req.Grant.Grantee, req.Grant.Permissions.Permissions)
+		addGrantStatus, err := s.addGrant(ctx, &provider.Reference{ResourceId: req.ResourceInfo.Id}, req.Grant.Grantee, req.Grant.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error adding grant to storage")
 		}
@@ -118,7 +118,7 @@ func (s *svc) RemoveShare(ctx context.Context, req *collaboration.RemoveShareReq
 
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 	if s.c.CommitShareToStorageGrant {
-		removeGrantStatus, err := s.removeGrant(ctx, share.ResourceId, share.Grantee, share.Permissions.Permissions)
+		removeGrantStatus, err := s.removeGrant(ctx, &provider.Reference{ResourceId: share.ResourceId}, share.Grantee, share.Permissions.Permissions)
 		if err != nil {
 			return nil, errors.Wrap(err, "gateway: error removing grant from storage")
 		}
@@ -196,7 +196,7 @@ func (s *svc) UpdateShare(ctx context.Context, req *collaboration.UpdateShareReq
 	// TODO(labkode): if both commits are enabled they could be done concurrently.
 
 	if s.c.CommitShareToStorageGrant {
-		updateGrantStatus, err := s.updateGrant(ctx, res.GetShare().GetResourceId(),
+		updateGrantStatus, err := s.updateGrant(ctx, &provider.Reference{ResourceId: res.GetShare().GetResourceId()},
 			res.GetShare().GetGrantee(),
 			res.GetShare().GetPermissions().GetPermissions())
 
@@ -320,12 +320,13 @@ func (s *svc) UpdateReceivedShare(ctx context.Context, req *collaboration.Update
 	}, nil
 }
 
-func (s *svc) createReference(ctx context.Context, resourceID *provider.Reference) *rpc.Status {
+func (s *svc) createReference(ctx context.Context, resourceID *provider.ResourceId) *rpc.Status {
 
 	log := appctx.GetLogger(ctx)
 
 	// get the metadata about the share
-	c, err := s.find(ctx, resourceID)
+	ref := &provider.Reference{ResourceId: resourceID}
+	c, err := s.find(ctx, ref)
 	if err != nil {
 		if _, ok := err.(errtypes.IsNotFound); ok {
 			return status.NewNotFound(ctx, "storage provider not found")
@@ -334,7 +335,7 @@ func (s *svc) createReference(ctx context.Context, resourceID *provider.Referenc
 	}
 
 	statReq := &provider.StatRequest{
-		Ref: resourceID,
+		Ref: ref,
 	}
 
 	statRes, err := c.Stat(ctx, statReq)
@@ -364,13 +365,13 @@ func (s *svc) createReference(ctx context.Context, resourceID *provider.Referenc
 	// It is the responsibility of the gateway to resolve these references and merge the response back
 	// from the main request.
 	// TODO(labkode): the name of the share should be the filename it points to by default.
-	refPath := path.Join(homeRes.Ref.Path, s.c.ShareFolder, path.Base(statRes.Info.Path))
+	refPath := path.Join(homeRes.Path, s.c.ShareFolder, path.Base(statRes.Info.Path))
 	log.Info().Msg("mount path will be:" + refPath)
 
 	createRefReq := &provider.CreateReferenceRequest{
 		Ref: &provider.Reference{Path: refPath},
 		// cs3 is the Scheme and %s/%s is the Opaque parts of a net.URL.
-		TargetUri: fmt.Sprintf("cs3:%s/%s", resourceID.GetStorageId(), resourceID.GetNodeId()),
+		TargetUri: fmt.Sprintf("cs3:%s/%s", resourceID.GetStorageId(), resourceID.GetOpaqueId()),
 	}
 
 	c, err = s.findByPath(ctx, refPath)
diff --git a/internal/grpc/services/ocmcore/ocmcore.go b/internal/grpc/services/ocmcore/ocmcore.go
index 0fcd1dba534..80939bb123e 100644
--- a/internal/grpc/services/ocmcore/ocmcore.go
+++ b/internal/grpc/services/ocmcore/ocmcore.go
@@ -116,9 +116,9 @@ func (s *service) CreateOCMCoreShare(ctx context.Context, req *ocmcore.CreateOCM
 		}, nil
 	}
 
-	resource := &provider.Reference{
+	rid := &provider.ResourceId{
 		StorageId: parts[0],
-		NodeId:    parts[1],
+		OpaqueId:  parts[1],
 	}
 
 	var resourcePermissions *provider.ResourcePermissions
@@ -180,7 +180,7 @@ func (s *service) CreateOCMCoreShare(ctx context.Context, req *ocmcore.CreateOCM
 		shareType = ocm.Share_SHARE_TYPE_REGULAR
 	}
 
-	share, err := s.sm.Share(ctx, resource, grant, req.Name, nil, "", req.Owner, token, shareType)
+	share, err := s.sm.Share(ctx, rid, grant, req.Name, nil, "", req.Owner, token, shareType)
 	if err != nil {
 		return &ocmcore.CreateOCMCoreShareResponse{
 			Status: status.NewInternal(ctx, err, "error creating ocm core share"),
diff --git a/internal/grpc/services/publicstorageprovider/publicstorageprovider.go b/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
index dcf8a4ff6bb..0996d65ceef 100644
--- a/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
+++ b/internal/grpc/services/publicstorageprovider/publicstorageprovider.go
@@ -573,11 +573,11 @@ func filterPermissions(l *provider.ResourcePermissions, r *provider.ResourcePerm
 }
 
 func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (token string, relativePath string, err error) {
-	if ref.StorageId != "" || ref.NodeId != "" {
+	if ref.ResourceId != nil {
 		return "", "", errtypes.BadRequest("need absolute path ref: got " + ref.String())
 	}
 
-	if ref.GetPath() == "" {
+	if !strings.HasPrefix(ref.GetPath(), "/") {
 		// abort, no valid id nor path
 		return "", "", errtypes.BadRequest("invalid ref: " + ref.String())
 	}
@@ -694,7 +694,7 @@ func (s *service) resolveToken(ctx context.Context, token string) (string, *link
 	}
 
 	sRes, err := s.gateway.Stat(ctx, &provider.StatRequest{
-		Ref: publicShareResponse.GetShare().GetResourceId(),
+		Ref: &provider.Reference{ResourceId: publicShareResponse.GetShare().GetResourceId()},
 	})
 	switch {
 	case err != nil:
diff --git a/internal/grpc/services/storageprovider/storageprovider.go b/internal/grpc/services/storageprovider/storageprovider.go
index 47ea82964bb..157c113aa40 100644
--- a/internal/grpc/services/storageprovider/storageprovider.go
+++ b/internal/grpc/services/storageprovider/storageprovider.go
@@ -274,7 +274,7 @@ func (s *service) InitiateFileDownload(ctx context.Context, req *provider.Initia
 
 	if isStorageSpaceReference(req.Ref) {
 		protocol.Protocol = "spaces"
-		u.Path = path.Join(u.Path, "spaces", req.Ref.StorageId+"!"+req.Ref.NodeId, req.Ref.Path)
+		u.Path = path.Join(u.Path, "spaces", req.Ref.ResourceId.StorageId+"!"+req.Ref.ResourceId.OpaqueId, req.Ref.Path)
 	} else {
 		ctx, newRef, err := s.unwrap(ctx, req.Ref)
 		if err != nil {
@@ -413,7 +413,7 @@ func (s *service) GetHome(ctx context.Context, req *provider.GetHomeRequest) (*p
 
 	res := &provider.GetHomeResponse{
 		Status: status.NewOK(ctx),
-		Ref:    &provider.Reference{Path: home},
+		Path:   home,
 	}
 
 	return res, nil
@@ -442,7 +442,7 @@ func (s *service) CreateStorageSpace(ctx context.Context, req *provider.CreateSt
 }
 
 func hasNodeID(s *provider.StorageSpace) bool {
-	return s != nil && s.Root != nil && s.Root.NodeId != ""
+	return s != nil && s.Root != nil && s.Root.OpaqueId != ""
 }
 
 func (s *service) ListStorageSpaces(ctx context.Context, req *provider.ListStorageSpacesRequest) (*provider.ListStorageSpacesResponse, error) {
@@ -466,7 +466,7 @@ func (s *service) ListStorageSpaces(ctx context.Context, req *provider.ListStora
 		if hasNodeID(spaces[i]) {
 			// fill in storagespace id if it is not set
 			if spaces[i].Id == nil || spaces[i].Id.OpaqueId == "" {
-				spaces[i].Id = &provider.StorageSpaceId{OpaqueId: s.mountID + "!" + spaces[i].Root.NodeId}
+				spaces[i].Id = &provider.StorageSpaceId{OpaqueId: s.mountID + "!" + spaces[i].Root.OpaqueId}
 			}
 			// fill in storage id if it is not set
 			if spaces[i].Root.StorageId == "" {
@@ -926,9 +926,9 @@ func (s *service) RestoreRecycleItem(ctx context.Context, req *provider.RestoreR
 }
 
 func (s *service) PurgeRecycle(ctx context.Context, req *provider.PurgeRecycleRequest) (*provider.PurgeRecycleResponse, error) {
-	// if a key was sent as opacque id purge only that item
-	if req.GetRef() != nil && req.GetRef().NodeId != "" {
-		if err := s.storage.PurgeRecycleItem(ctx, req.GetRef().NodeId); err != nil {
+	// if a key was sent as opaque id purge only that item
+	if req.GetRef() != nil && req.GetRef().ResourceId.OpaqueId != "" {
+		if err := s.storage.PurgeRecycleItem(ctx, req.GetRef().ResourceId.OpaqueId); err != nil {
 			var st *rpc.Status
 			switch err.(type) {
 			case errtypes.IsNotFound:
@@ -1183,7 +1183,7 @@ func getFS(c *config) (storage.FS, error) {
 }
 
 func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (context.Context, *provider.Reference, error) {
-	if ref.StorageId != "" && ref.NodeId != "" {
+	if ref.ResourceId != nil {
 		if ref.Path != "" {
 			// ListStorageSpaces filter by id -> root item
 			// Get path from root item
@@ -1196,7 +1196,7 @@ func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (context.
 					Type: provider.ListStorageSpacesRequest_Filter_TYPE_ID,
 					Term: &provider.ListStorageSpacesRequest_Filter_Id{
 						Id: &provider.StorageSpaceId{
-							OpaqueId: ref.StorageId + "!" + ref.NodeId,
+							OpaqueId: ref.ResourceId.StorageId + "!" + ref.ResourceId.OpaqueId,
 						},
 					},
 				},
@@ -1219,7 +1219,7 @@ func (s *service) unwrap(ctx context.Context, ref *provider.Reference) (context.
 			if err != nil {
 				return ctx, nil, err
 			}
-			return ctx, info.Id, nil
+			return ctx, &provider.Reference{ResourceId: info.Id}, nil
 		}
 
 		return ctx, ref, nil
@@ -1272,5 +1272,5 @@ func (s *service) wrap(ctx context.Context, ri *provider.ResourceInfo) error {
 // In the URL it looks like this: /a-storage-provider-id!a-storage-space-id/optional/relative/path
 // See https://github.com/cs3org/cs3apis/pull/125 for an extension to the CS3 ReferenceID to model this properly
 func isStorageSpaceReference(ref *provider.Reference) bool {
-	return ref.StorageId != "" && ref.NodeId != "" && ref.Path != ""
+	return ref.ResourceId != nil && strings.HasPrefix(ref.Path, ".")
 }
diff --git a/internal/http/services/owncloud/ocdav/copy.go b/internal/http/services/owncloud/ocdav/copy.go
index 83e16690410..d4e244886d4 100644
--- a/internal/http/services/owncloud/ocdav/copy.go
+++ b/internal/http/services/owncloud/ocdav/copy.go
@@ -311,7 +311,7 @@ func (s *svc) executeSpacesCopy(ctx context.Context, client gateway.GatewayAPICl
 		}
 
 		// descend for children
-		listReq := &provider.ListContainerRequest{Ref: src.Id}
+		listReq := &provider.ListContainerRequest{Ref: &provider.Reference{ResourceId: src.Id}}
 		res, err := client.ListContainer(ctx, listReq)
 		if err != nil {
 			return err
@@ -323,9 +323,8 @@ func (s *svc) executeSpacesCopy(ctx context.Context, client gateway.GatewayAPICl
 		for i := range res.Infos {
 			childPath := strings.TrimPrefix(res.Infos[i].Path, src.Path)
 			childRef := &provider.Reference{
-				StorageId: src.Id.StorageId,
-				NodeId:    src.Id.NodeId,
-				Path:      path.Join(dst.Path, childPath),
+				ResourceId: src.Id,
+				Path:       path.Join(dst.Path, childPath),
 			}
 			err := s.executeSpacesCopy(ctx, client, res.Infos[i], childRef, recurse)
 			if err != nil {
@@ -338,7 +337,7 @@ func (s *svc) executeSpacesCopy(ctx context.Context, client gateway.GatewayAPICl
 
 		// 1. get download url
 
-		dReq := &provider.InitiateFileDownloadRequest{Ref: src.Id}
+		dReq := &provider.InitiateFileDownloadRequest{Ref: &provider.Reference{ResourceId: src.Id}}
 
 		dRes, err := client.InitiateFileDownload(ctx, dReq)
 		if err != nil {
diff --git a/internal/http/services/owncloud/ocdav/ocdav.go b/internal/http/services/owncloud/ocdav/ocdav.go
index 3f8dd6d91a3..28da43e68fb 100644
--- a/internal/http/services/owncloud/ocdav/ocdav.go
+++ b/internal/http/services/owncloud/ocdav/ocdav.go
@@ -206,8 +206,8 @@ func applyLayout(ctx context.Context, ns string, useLoggedInUserNS bool, request
 	return templates.WithUser(u, ns)
 }
 
-func wrapResourceID(r *provider.Reference) string {
-	return wrap(r.StorageId, r.NodeId)
+func wrapResourceID(r *provider.ResourceId) string {
+	return wrap(r.StorageId, r.OpaqueId)
 }
 
 // The fileID must be encoded
@@ -218,7 +218,7 @@ func wrap(sid string, oid string) string {
 	return base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", sid, oid)))
 }
 
-func unwrap(rid string) *provider.Reference {
+func unwrap(rid string) *provider.ResourceId {
 	decodedID, err := base64.URLEncoding.DecodeString(rid)
 	if err != nil {
 		return nil
@@ -233,9 +233,9 @@ func unwrap(rid string) *provider.Reference {
 		return nil
 	}
 
-	return &provider.Reference{
+	return &provider.ResourceId{
 		StorageId: parts[0],
-		NodeId:    parts[1],
+		OpaqueId:  parts[1],
 	}
 }
 
diff --git a/internal/http/services/owncloud/ocdav/spaces.go b/internal/http/services/owncloud/ocdav/spaces.go
index f5dfd9cd5aa..6e296218ab8 100644
--- a/internal/http/services/owncloud/ocdav/spaces.go
+++ b/internal/http/services/owncloud/ocdav/spaces.go
@@ -125,8 +125,7 @@ func (s *svc) lookUpStorageSpaceReference(ctx context.Context, spaceID string, r
 	space := lSSRes.StorageSpaces[0]
 
 	return &storageProvider.Reference{
-		StorageId: space.Root.StorageId,
-		NodeId:    space.Root.NodeId,
-		Path:      relativePath,
+		ResourceId: space.Root,
+		Path:       relativePath,
 	}, lSSRes.Status, nil
 }
diff --git a/internal/http/services/owncloud/ocdav/trashbin.go b/internal/http/services/owncloud/ocdav/trashbin.go
index 51befc17b72..70237e298f8 100644
--- a/internal/http/services/owncloud/ocdav/trashbin.go
+++ b/internal/http/services/owncloud/ocdav/trashbin.go
@@ -178,7 +178,7 @@ func (h *TrashbinHandler) listTrashbin(w http.ResponseWriter, r *http.Request, s
 
 	// ask gateway for recycle items
 	// TODO(labkode): add Reference to ListRecycleRequest
-	getRecycleRes, err := gc.ListRecycle(ctx, &gateway.ListRecycleRequest{Ref: getHomeRes.Ref})
+	getRecycleRes, err := gc.ListRecycle(ctx, &gateway.ListRecycleRequest{Ref: &provider.Reference{Path: getHomeRes.Path}})
 
 	if err != nil {
 		sublog.Error().Err(err).Msg("error calling ListRecycle")
@@ -392,7 +392,7 @@ func (h *TrashbinHandler) restore(w http.ResponseWriter, r *http.Request, s *svc
 		// this means we can only undelete on the same storage, not to a different folder
 		// use the key which is prefixed with the StoragePath to lookup the correct storage ...
 		// TODO currently limited to the home storage
-		Ref:        getHomeRes.Ref,
+		Ref:        &provider.Reference{Path: getHomeRes.Path},
 		Key:        key,
 		RestoreRef: &provider.Reference{Path: dst},
 	}
@@ -436,7 +436,7 @@ func (h *TrashbinHandler) delete(w http.ResponseWriter, r *http.Request, s *svc,
 		HandleErrorStatus(&sublog, w, getHomeRes.Status)
 		return
 	}
-	sRes, err := client.Stat(ctx, &provider.StatRequest{Ref: getHomeRes.Ref})
+	sRes, err := client.Stat(ctx, &provider.StatRequest{Ref: &provider.Reference{Path: getHomeRes.Path}})
 	if err != nil {
 		sublog.Error().Err(err).Msg("error calling Stat")
 		w.WriteHeader(http.StatusInternalServerError)
@@ -451,10 +451,10 @@ func (h *TrashbinHandler) delete(w http.ResponseWriter, r *http.Request, s *svc,
 	// storage drives  PurgeRecycleItem key call
 
 	req := &gateway.PurgeRecycleRequest{
-		Ref: &provider.Reference{
-			NodeId:    key,
+		Ref: &provider.Reference{ResourceId: &provider.ResourceId{
+			OpaqueId:  key,
 			StorageId: sRes.Info.Id.StorageId,
-		},
+		}},
 	}
 
 	res, err := client.PurgeRecycle(ctx, req)
diff --git a/internal/http/services/owncloud/ocdav/versions.go b/internal/http/services/owncloud/ocdav/versions.go
index e247f857422..a1cc3557e2f 100644
--- a/internal/http/services/owncloud/ocdav/versions.go
+++ b/internal/http/services/owncloud/ocdav/versions.go
@@ -42,7 +42,7 @@ func (h *VersionsHandler) init(c *Config) error {
 // Handler handles requests
 // versions can be listed with a PROPFIND to /remote.php/dav/meta/<fileid>/v
 // a version is identified by a timestamp, eg. /remote.php/dav/meta/<fileid>/v/1561410426
-func (h *VersionsHandler) Handler(s *svc, rid *provider.Reference) http.Handler {
+func (h *VersionsHandler) Handler(s *svc, rid *provider.ResourceId) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
@@ -78,7 +78,7 @@ func (h *VersionsHandler) Handler(s *svc, rid *provider.Reference) http.Handler
 	})
 }
 
-func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.Reference) {
+func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.ResourceId) {
 	ctx := r.Context()
 	ctx, span := trace.StartSpan(ctx, "listVersions")
 	defer span.End()
@@ -99,7 +99,7 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	req := &provider.StatRequest{Ref: rid}
+	req := &provider.StatRequest{Ref: &provider.Reference{ResourceId: rid}}
 	res, err := client.Stat(ctx, req)
 	if err != nil {
 		sublog.Error().Err(err).Msg("error sending a grpc stat request")
@@ -114,7 +114,7 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 	info := res.Info
 
 	lvReq := &provider.ListFileVersionsRequest{
-		Ref: rid,
+		Ref: &provider.Reference{ResourceId: rid},
 	}
 	lvRes, err := client.ListFileVersions(ctx, lvReq)
 	if err != nil {
@@ -139,9 +139,9 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 			// TODO(jfd) we cannot access version content, this will be a problem when trying to fetch version thumbnails
 			// Opaque
 			Type: provider.ResourceType_RESOURCE_TYPE_FILE,
-			Id: &provider.Reference{
+			Id: &provider.ResourceId{
 				StorageId: "versions", // this is a virtual storage
-				NodeId:    info.Id.NodeId + "@" + versions[i].GetKey(),
+				OpaqueId:  info.Id.OpaqueId + "@" + versions[i].GetKey(),
 			},
 			// Checksum
 			Etag: versions[i].Etag,
@@ -175,7 +175,7 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 
 }
 
-func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.Reference, key string) {
+func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *svc, rid *provider.ResourceId, key string) {
 	ctx := r.Context()
 	ctx, span := trace.StartSpan(ctx, "restore")
 	defer span.End()
@@ -190,7 +190,7 @@ func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *s
 	}
 
 	req := &provider.RestoreFileVersionRequest{
-		Ref: rid,
+		Ref: &provider.Reference{ResourceId: rid},
 		Key: key,
 	}
 
diff --git a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
index 7f7427a5998..5e5115e23e5 100644
--- a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
+++ b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
@@ -377,7 +377,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 		return
 	}
 
-	statReq := provider.StatRequest{Ref: before.Share.ResourceId}
+	statReq := provider.StatRequest{Ref: &provider.Reference{ResourceId: before.Share.ResourceId}}
 
 	statRes, err := gwC.Stat(r.Context(), &statReq)
 	if err != nil {
diff --git a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
index 5eeb0dd0902..53dd89e7425 100644
--- a/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
+++ b/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
@@ -331,7 +331,7 @@ type PublicShareContextName string
 
 func (h *Handler) getShare(w http.ResponseWriter, r *http.Request, shareID string) {
 	var share *conversions.ShareData
-	var resourceID *provider.Reference
+	var resourceID *provider.ResourceId
 	ctx := r.Context()
 	logger := appctx.GetLogger(r.Context())
 	logger.Debug().Str("shareID", shareID).Msg("get share by id")
@@ -506,7 +506,7 @@ func (h *Handler) updateShare(w http.ResponseWriter, r *http.Request, shareID st
 		return
 	}
 
-	statReq := provider.StatRequest{Ref: uRes.Share.ResourceId}
+	statReq := provider.StatRequest{Ref: &provider.Reference{ResourceId: uRes.Share.ResourceId}}
 
 	statRes, err := client.Stat(r.Context(), &statReq)
 	if err != nil {
@@ -616,7 +616,7 @@ func (h *Handler) listSharesWithMe(w http.ResponseWriter, r *http.Request) {
 		var info *provider.ResourceInfo
 		if pinfo != nil {
 			// check if the shared resource matches the path resource
-			if !utils.ResourceEqual(rs.Share.ResourceId, pinfo.Id) {
+			if !utils.ResourceIdEqual(rs.Share.ResourceId, pinfo.Id) {
 				// try next share
 				continue
 			}
@@ -762,8 +762,8 @@ func (h *Handler) addFilters(w http.ResponseWriter, r *http.Request, prefix stri
 	return collaborationFilters, linkFilters, nil
 }
 
-func wrapResourceID(r *provider.Reference) string {
-	return wrap(r.StorageId, r.NodeId)
+func wrapResourceID(r *provider.ResourceId) string {
+	return wrap(r.StorageId, r.OpaqueId)
 }
 
 // The fileID must be encoded
@@ -785,7 +785,7 @@ func (h *Handler) addFileInfo(ctx context.Context, s *conversions.ShareData, inf
 		}
 		s.MimeType = parsedMt
 		// TODO STime:     &types.Timestamp{Seconds: info.Mtime.Seconds, Nanos: info.Mtime.Nanos},
-		s.StorageID = info.Id.StorageId + "!" + info.Id.NodeId
+		s.StorageID = info.Id.StorageId + "!" + info.Id.OpaqueId
 		// TODO Storage: int
 		s.ItemSource = wrapResourceID(info.Id)
 		s.FileSource = s.ItemSource
@@ -937,8 +937,8 @@ func (h *Handler) getResourceInfoByPath(ctx context.Context, client gateway.Gate
 	})
 }
 
-func (h *Handler) getResourceInfoByID(ctx context.Context, client gateway.GatewayAPIClient, id *provider.Reference) (*provider.ResourceInfo, *rpc.Status, error) {
-	return h.getResourceInfo(ctx, client, wrapResourceID(id), id)
+func (h *Handler) getResourceInfoByID(ctx context.Context, client gateway.GatewayAPIClient, id *provider.ResourceId) (*provider.ResourceInfo, *rpc.Status, error) {
+	return h.getResourceInfo(ctx, client, wrapResourceID(id), &provider.Reference{ResourceId: id})
 }
 
 // getResourceInfo retrieves the resource info to a target.
diff --git a/internal/http/services/owncloud/ocs/handlers/cloud/users/users.go b/internal/http/services/owncloud/ocs/handlers/cloud/users/users.go
index f99dbb6b46d..37f6232784a 100644
--- a/internal/http/services/owncloud/ocs/handlers/cloud/users/users.go
+++ b/internal/http/services/owncloud/ocs/handlers/cloud/users/users.go
@@ -126,7 +126,7 @@ func (h *Handler) handleUsers(w http.ResponseWriter, r *http.Request, u *userpb.
 		return
 	}
 
-	getQuotaRes, err := gc.GetQuota(ctx, &gateway.GetQuotaRequest{Ref: getHomeRes.Ref})
+	getQuotaRes, err := gc.GetQuota(ctx, &gateway.GetQuotaRequest{Ref: &provider.Reference{Path: getHomeRes.Path}})
 	if err != nil {
 		sublog.Error().Err(err).Msg("error calling GetQuota")
 		w.WriteHeader(http.StatusInternalServerError)
diff --git a/pkg/app/provider/demo/demo.go b/pkg/app/provider/demo/demo.go
index ba934dac2ca..361a8616038 100644
--- a/pkg/app/provider/demo/demo.go
+++ b/pkg/app/provider/demo/demo.go
@@ -33,7 +33,8 @@ type provider struct {
 }
 
 func (p *provider) GetIFrame(ctx context.Context, resID *providerpb.Reference, token string) (string, error) {
-	msg := fmt.Sprintf("<iframe src=%s/open/%s?access-token=%s />", p.iframeUIProvider, resID.StorageId+":"+resID.NodeId, token)
+	// TODO @labkode @ishank011 should we use <storageid>!<nodeid>:<path> here? Or verify resource id is set and path is empty? or change signature to use a ResourceID directly?
+	msg := fmt.Sprintf("<iframe src=%s/open/%s?access-token=%s />", p.iframeUIProvider, resID.ResourceId.StorageId+":"+resID.ResourceId.OpaqueId, token)
 	return msg, nil
 }
 
diff --git a/pkg/auth/scope/publicshare.go b/pkg/auth/scope/publicshare.go
index 2f2f00eda17..f8855d83772 100644
--- a/pkg/auth/scope/publicshare.go
+++ b/pkg/auth/scope/publicshare.go
@@ -71,9 +71,10 @@ func publicshareScope(scope *authpb.Scope, resource interface{}) (bool, error) {
 }
 
 func checkStorageRef(s *link.PublicShare, r *provider.Reference) bool {
-	// r: <id:<storage_id:$storageID node_id:$nodeID path:$path > >
-	if (r.StorageId != "" || r.NodeId != "") && r.Path == "" { // path must be empty
-		return s.ResourceId.StorageId == r.StorageId && s.ResourceId.NodeId == r.NodeId
+	// TODO @ishank011 con you explain how this is used?
+	// r: <resource_id:<storage_id:$storageID opaque_id:$opaqueID> path:$path > >
+	if (r.ResourceId.StorageId != "" || r.ResourceId.OpaqueId != "") && r.Path == "" { // path must be empty
+		return s.ResourceId.StorageId == r.ResourceId.StorageId && s.ResourceId.OpaqueId == r.ResourceId.OpaqueId
 	}
 
 	// r: <path:"/public/$token" >
diff --git a/pkg/auth/scope/resourceinfo.go b/pkg/auth/scope/resourceinfo.go
index 374b8d54493..d7a0706b2bb 100644
--- a/pkg/auth/scope/resourceinfo.go
+++ b/pkg/auth/scope/resourceinfo.go
@@ -68,9 +68,18 @@ func resourceinfoScope(scope *authpb.Scope, resource interface{}) (bool, error)
 }
 
 func checkResourceInfo(inf *provider.ResourceInfo, ref *provider.Reference) bool {
-	// ref: <id:<storage_id:$storageID node_id:$nodeID path:$path> >
-	if ref.StorageId != "" || ref.NodeId != "" { // path can be empty or a relative path
-		return inf.Id.StorageId == ref.StorageId && inf.Id.NodeId == ref.NodeId && inf.Id.Path == ref.Path
+	// TODO @ishank011 con you explain how this is used?
+	// ref: <resource_id:<storage_id:$storageID opaque_id:$opaqueID path:$path> >
+	if ref.ResourceId != nil { // path can be empty or a relative path
+		if inf.Id.StorageId == ref.ResourceId.StorageId && inf.Id.OpaqueId == ref.ResourceId.OpaqueId {
+			if ref.Path == "" {
+				// id only reference
+				return true
+			}
+			// check path has same prefix below
+		} else {
+			return false
+		}
 	}
 	// ref: <path:$path >
 	if strings.HasPrefix(ref.GetPath(), inf.Path) {
diff --git a/pkg/cbox/publicshare/sql/sql.go b/pkg/cbox/publicshare/sql/sql.go
index 66b846cc72d..cfc0ba6796b 100644
--- a/pkg/cbox/publicshare/sql/sql.go
+++ b/pkg/cbox/publicshare/sql/sql.go
@@ -134,7 +134,7 @@ func (m *manager) CreatePublicShare(ctx context.Context, u *user.User, rInfo *pr
 	permissions := conversions.SharePermToInt(g.Permissions.Permissions)
 	itemType := conversions.ResourceTypeToItem(rInfo.Type)
 	prefix := rInfo.Id.StorageId
-	itemSource := rInfo.Id.NodeId
+	itemSource := rInfo.Id.OpaqueId
 	fileSource, err := strconv.ParseUint(itemSource, 10, 64)
 	if err != nil {
 		// it can be the case that the item source may be a character string
@@ -318,7 +318,7 @@ func (m *manager) ListPublicShares(ctx context.Context, u *user.User, filters []
 			if i != len(filters)-1 {
 				filterQuery += " AND "
 			}
-			params = append(params, f.GetResourceId().StorageId, f.GetResourceId().NodeId)
+			params = append(params, f.GetResourceId().StorageId, f.GetResourceId().OpaqueId)
 		case link.ListPublicSharesRequest_Filter_TYPE_OWNER:
 			filterQuery += "(uid_owner=?)"
 			if i != len(filters)-1 {
diff --git a/pkg/cbox/share/sql/sql.go b/pkg/cbox/share/sql/sql.go
index 21cca37e4a5..f9b0e5eb180 100644
--- a/pkg/cbox/share/sql/sql.go
+++ b/pkg/cbox/share/sql/sql.go
@@ -120,7 +120,7 @@ func (m *mgr) Share(ctx context.Context, md *provider.ResourceInfo, g *collabora
 	targetPath := path.Join("/", path.Base(md.Path))
 	permissions := conversions.SharePermToInt(g.Permissions.Permissions)
 	prefix := md.Id.StorageId
-	itemSource := md.Id.NodeId
+	itemSource := md.Id.OpaqueId
 	fileSource, err := strconv.ParseUint(itemSource, 10, 64)
 	if err != nil {
 		// it can be the case that the item source may be a character string
@@ -178,7 +178,7 @@ func (m *mgr) getByKey(ctx context.Context, key *collaboration.ShareKey) (*colla
 	s := conversions.DBShare{}
 	shareType, shareWith := conversions.FormatGrantee(key.Grantee)
 	query := "select coalesce(uid_owner, '') as uid_owner, coalesce(uid_initiator, '') as uid_initiator, coalesce(share_with, '') as share_with, coalesce(fileid_prefix, '') as fileid_prefix, coalesce(item_source, '') as item_source, id, stime, permissions, share_type FROM oc_share WHERE (orphan = 0 or orphan IS NULL) AND uid_owner=? AND fileid_prefix=? AND item_source=? AND share_type=? AND share_with=? AND (uid_owner=? or uid_initiator=?)"
-	if err := m.db.QueryRow(query, owner, key.ResourceId.StorageId, key.ResourceId.NodeId, shareType, shareWith, uid, uid).Scan(&s.UIDOwner, &s.UIDInitiator, &s.ShareWith, &s.Prefix, &s.ItemSource, &s.ID, &s.STime, &s.Permissions, &s.ShareType); err != nil {
+	if err := m.db.QueryRow(query, owner, key.ResourceId.StorageId, key.ResourceId.OpaqueId, shareType, shareWith, uid, uid).Scan(&s.UIDOwner, &s.UIDInitiator, &s.ShareWith, &s.Prefix, &s.ItemSource, &s.ID, &s.STime, &s.Permissions, &s.ShareType); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, errtypes.NotFound(key.String())
 		}
@@ -219,7 +219,7 @@ func (m *mgr) Unshare(ctx context.Context, ref *collaboration.ShareReference) er
 		shareType, shareWith := conversions.FormatGrantee(key.Grantee)
 		owner := conversions.FormatUserID(key.Owner)
 		query = "delete from oc_share where uid_owner=? AND fileid_prefix=? AND item_source=? AND share_type=? AND share_with=? AND (uid_owner=? or uid_initiator=?)"
-		params = append(params, owner, key.ResourceId.StorageId, key.ResourceId.NodeId, shareType, shareWith, uid, uid)
+		params = append(params, owner, key.ResourceId.StorageId, key.ResourceId.OpaqueId, shareType, shareWith, uid, uid)
 	default:
 		return errtypes.NotFound(ref.String())
 	}
@@ -258,7 +258,7 @@ func (m *mgr) UpdateShare(ctx context.Context, ref *collaboration.ShareReference
 		shareType, shareWith := conversions.FormatGrantee(key.Grantee)
 		owner := conversions.FormatUserID(key.Owner)
 		query = "update oc_share set permissions=?,stime=? where (uid_owner=? or uid_initiator=?) AND fileid_prefix=? AND item_source=? AND share_type=? AND share_with=? AND (uid_owner=? or uid_initiator=?)"
-		params = append(params, permissions, time.Now().Unix(), owner, owner, key.ResourceId.StorageId, key.ResourceId.NodeId, shareType, shareWith, uid, uid)
+		params = append(params, permissions, time.Now().Unix(), owner, owner, key.ResourceId.StorageId, key.ResourceId.OpaqueId, shareType, shareWith, uid, uid)
 	default:
 		return nil, errtypes.NotFound(ref.String())
 	}
@@ -285,7 +285,7 @@ func (m *mgr) ListShares(ctx context.Context, filters []*collaboration.ListShare
 			if i != len(filters)-1 {
 				filterQuery += " AND "
 			}
-			params = append(params, f.GetResourceId().StorageId, f.GetResourceId().NodeId)
+			params = append(params, f.GetResourceId().StorageId, f.GetResourceId().OpaqueId)
 		}
 	}
 	if filterQuery != "" {
@@ -381,7 +381,7 @@ func (m *mgr) getReceivedByKey(ctx context.Context, key *collaboration.ShareKey)
 	uid := conversions.FormatUserID(user.Id)
 
 	shareType, shareWith := conversions.FormatGrantee(key.Grantee)
-	params := []interface{}{uid, conversions.FormatUserID(key.Owner), key.ResourceId.StorageId, key.ResourceId.NodeId, shareType, shareWith, shareWith}
+	params := []interface{}{uid, conversions.FormatUserID(key.Owner), key.ResourceId.StorageId, key.ResourceId.OpaqueId, shareType, shareWith, shareWith}
 	for _, v := range user.Groups {
 		params = append(params, v)
 	}
diff --git a/pkg/cbox/utils/conversions.go b/pkg/cbox/utils/conversions.go
index e2081d60149..78d405dfac2 100644
--- a/pkg/cbox/utils/conversions.go
+++ b/pkg/cbox/utils/conversions.go
@@ -187,7 +187,7 @@ func ConvertToCS3Share(s DBShare) *collaboration.Share {
 		Id: &collaboration.ShareId{
 			OpaqueId: s.ID,
 		},
-		ResourceId:  &provider.Reference{StorageId: s.Prefix, NodeId: s.ItemSource},
+		ResourceId:  &provider.ResourceId{StorageId: s.Prefix, OpaqueId: s.ItemSource},
 		Permissions: &collaboration.SharePermissions{Permissions: IntTosharePerm(s.Permissions)},
 		Grantee:     ExtractGrantee(s.ShareType, s.ShareWith),
 		Owner:       ExtractUserID(s.UIDOwner),
@@ -234,7 +234,7 @@ func ConvertToCS3PublicShare(s DBShare) *link.PublicShare {
 		Id: &link.PublicShareId{
 			OpaqueId: s.ID,
 		},
-		ResourceId:        &provider.Reference{StorageId: s.Prefix, NodeId: s.ItemSource},
+		ResourceId:        &provider.ResourceId{StorageId: s.Prefix, OpaqueId: s.ItemSource},
 		Permissions:       &link.PublicSharePermissions{Permissions: IntTosharePerm(s.Permissions)},
 		Owner:             ExtractUserID(s.UIDOwner),
 		Creator:           ExtractUserID(s.UIDInitiator),
diff --git a/pkg/ocm/share/manager/json/json.go b/pkg/ocm/share/manager/json/json.go
index 0caa6f56aeb..f3454c95fda 100644
--- a/pkg/ocm/share/manager/json/json.go
+++ b/pkg/ocm/share/manager/json/json.go
@@ -195,7 +195,7 @@ func getOCMEndpoint(originProvider *ocmprovider.ProviderInfo) (string, error) {
 	return "", errors.New("json: ocm endpoint not specified for mesh provider")
 }
 
-func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGrant, name string,
+func (m *mgr) Share(ctx context.Context, md *provider.ResourceId, g *ocm.ShareGrant, name string,
 	pi *ocmprovider.ProviderInfo, pm string, owner *userpb.UserId, token string, st ocm.Share_ShareType) (*ocm.Share, error) {
 
 	id := genID()
@@ -308,7 +308,7 @@ func (m *mgr) Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGra
 		requestBody := url.Values{
 			"shareWith":    {g.Grantee.GetUserId().OpaqueId},
 			"name":         {name},
-			"providerId":   {fmt.Sprintf("%s:%s", md.StorageId, md.NodeId)},
+			"providerId":   {fmt.Sprintf("%s:%s", md.StorageId, md.OpaqueId)},
 			"owner":        {userID.OpaqueId},
 			"protocol":     {string(protocol)},
 			"meshProvider": {userID.Idp},
@@ -416,7 +416,7 @@ func (m *mgr) getByKey(ctx context.Context, key *ocm.ShareKey) (*ocm.Share, erro
 			continue
 		}
 		if (utils.UserEqual(key.Owner, share.Owner) || utils.UserEqual(key.Owner, share.Creator)) &&
-			utils.ResourceEqual(key.ResourceId, share.ResourceId) && utils.GranteeEqual(key.Grantee, share.Grantee) {
+			utils.ResourceIdEqual(key.ResourceId, share.ResourceId) && utils.GranteeEqual(key.Grantee, share.Grantee) {
 			return &share, nil
 		}
 	}
@@ -492,7 +492,7 @@ func sharesEqual(ref *ocm.ShareReference, s *ocm.Share) bool {
 		}
 	} else if ref.GetKey() != nil {
 		if (utils.UserEqual(ref.GetKey().Owner, s.Owner) || utils.UserEqual(ref.GetKey().Owner, s.Creator)) &&
-			utils.ResourceEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
+			utils.ResourceIdEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
 			return true
 		}
 	}
@@ -563,7 +563,7 @@ func (m *mgr) ListShares(ctx context.Context, filters []*ocm.ListOCMSharesReques
 				// TODO(labkode): add the rest of filters.
 				for _, f := range filters {
 					if f.Type == ocm.ListOCMSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(share.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIdEqual(share.ResourceId, f.GetResourceId()) {
 							ss = append(ss, &share)
 						}
 					}
diff --git a/pkg/ocm/share/share.go b/pkg/ocm/share/share.go
index 45237d4be81..9eb439a6e04 100644
--- a/pkg/ocm/share/share.go
+++ b/pkg/ocm/share/share.go
@@ -30,7 +30,7 @@ import (
 // Manager is the interface that manipulates the OCM shares.
 type Manager interface {
 	// Create a new share in fn with the given acl.
-	Share(ctx context.Context, md *provider.Reference, g *ocm.ShareGrant, name string,
+	Share(ctx context.Context, md *provider.ResourceId, g *ocm.ShareGrant, name string,
 		pi *ocmprovider.ProviderInfo, pm string, owner *userpb.UserId, token string, st ocm.Share_ShareType) (*ocm.Share, error)
 
 	// GetShare gets the information for a share by the given ref.
diff --git a/pkg/publicshare/manager/json/json.go b/pkg/publicshare/manager/json/json.go
index 7ec59eef78d..c75eb2f006c 100644
--- a/pkg/publicshare/manager/json/json.go
+++ b/pkg/publicshare/manager/json/json.go
@@ -379,7 +379,7 @@ func (m *manager) ListPublicShares(ctx context.Context, u *user.User, filters []
 		} else {
 			for i := range filters {
 				if filters[i].Type == link.ListPublicSharesRequest_Filter_TYPE_RESOURCE_ID {
-					if utils.ResourceEqual(local.ResourceId, filters[i].GetResourceId()) {
+					if utils.ResourceIdEqual(local.ResourceId, filters[i].GetResourceId()) {
 						if notExpired(&local.PublicShare) {
 							shares = append(shares, &local.PublicShare)
 						} else if err := m.revokeExpiredPublicShare(ctx, &local.PublicShare, u); err != nil {
diff --git a/pkg/publicshare/manager/memory/memory.go b/pkg/publicshare/manager/memory/memory.go
index 1a24fe9e0d2..b891b37c361 100644
--- a/pkg/publicshare/manager/memory/memory.go
+++ b/pkg/publicshare/manager/memory/memory.go
@@ -180,7 +180,7 @@ func (m *manager) ListPublicShares(ctx context.Context, u *user.User, filters []
 			} else {
 				for _, f := range filters {
 					if f.Type == link.ListPublicSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(s.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIdEqual(s.ResourceId, f.GetResourceId()) {
 							shares = append(shares, s)
 						}
 					}
diff --git a/pkg/rhttp/datatx/manager/spaces/spaces.go b/pkg/rhttp/datatx/manager/spaces/spaces.go
index c546f0e90b9..fce7af32f04 100644
--- a/pkg/rhttp/datatx/manager/spaces/spaces.go
+++ b/pkg/rhttp/datatx/manager/spaces/spaces.go
@@ -20,6 +20,7 @@ package spaces
 
 import (
 	"net/http"
+	"path"
 	"strings"
 
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
@@ -76,7 +77,8 @@ func (m *manager) Handler(fs storage.FS) (http.Handler, error) {
 		case "GET", "HEAD":
 			download.GetOrHeadFile(w, r, fs, spaceID)
 		case "PUT":
-			fn := r.URL.Path
+			// make a clean relative path
+			fn := path.Clean(strings.TrimLeft(r.URL.Path, "/"))
 			defer r.Body.Close()
 
 			// TODO refactor: pass Reference to Upload & GetOrHeadFile
@@ -86,7 +88,7 @@ func (m *manager) Handler(fs storage.FS) (http.Handler, error) {
 				sublog.Error().Msg("space id must be separated by !")
 				w.WriteHeader(http.StatusBadRequest)
 			}
-			ref := &provider.Reference{StorageId: parts[0], NodeId: parts[1], Path: fn}
+			ref := &provider.Reference{ResourceId: &provider.ResourceId{StorageId: parts[0], OpaqueId: parts[1]}, Path: fn}
 
 			err := fs.Upload(ctx, ref, r.Body)
 			switch v := err.(type) {
diff --git a/pkg/rhttp/datatx/utils/download/download.go b/pkg/rhttp/datatx/utils/download/download.go
index c61f24364f2..4d22a76b3cf 100644
--- a/pkg/rhttp/datatx/utils/download/download.go
+++ b/pkg/rhttp/datatx/utils/download/download.go
@@ -24,6 +24,7 @@ import (
 	"io"
 	"mime/multipart"
 	"net/http"
+	"path"
 	"strconv"
 	"strings"
 
@@ -49,12 +50,21 @@ func GetOrHeadFile(w http.ResponseWriter, r *http.Request, fs storage.FS, spaceI
 
 	var ref *provider.Reference
 	if spaceID == "" {
-		ref = &provider.Reference{Path: fn}
+		// ensure the absolute path starts with '/'
+		ref = &provider.Reference{Path: path.Join("/", fn)}
 	} else {
 		// build a storage space reference
 		parts := strings.SplitN(spaceID, "!", 2)
 		if len(parts) == 2 {
-			ref = &provider.Reference{StorageId: parts[0], NodeId: parts[1], Path: fn}
+			ref = &provider.Reference{
+				ResourceId: &provider.ResourceId{StorageId: parts[0], OpaqueId: parts[1]},
+				// ensure the relative path starts with '.'
+				Path: path.Clean(strings.TrimLeft(fn, "/")),
+			}
+		} else {
+			sublog.Error().Str("space_id", spaceID).Str("path", fn).Msg("invalid reference")
+			w.WriteHeader(http.StatusBadRequest)
+			return
 		}
 	}
 	// TODO check preconditions like If-Range, If-Match ...
diff --git a/pkg/sdk/action/download.go b/pkg/sdk/action/download.go
index 0ba5851c942..9c7a2169591 100644
--- a/pkg/sdk/action/download.go
+++ b/pkg/sdk/action/download.go
@@ -89,7 +89,7 @@ func (action *DownloadAction) Download(fileInfo *storage.ResourceInfo) ([]byte,
 
 func (action *DownloadAction) initiateDownload(fileInfo *storage.ResourceInfo) (*gateway.InitiateFileDownloadResponse, error) {
 	// Initiating a download request gets us the download endpoint for the specified resource
-	req := &provider.InitiateFileDownloadRequest{Ref: fileInfo.Id}
+	req := &provider.InitiateFileDownloadRequest{Ref: &storage.Reference{ResourceId: fileInfo.Id}}
 	res, err := action.session.Client().InitiateFileDownload(action.session.Context(), req)
 	if err := net.CheckRPCInvocation("initiating download", res, err); err != nil {
 		return nil, err
diff --git a/pkg/share/cache/cbox/cbox.go b/pkg/share/cache/cbox/cbox.go
index 057644e336b..02502cadafc 100644
--- a/pkg/share/cache/cbox/cbox.go
+++ b/pkg/share/cache/cbox/cbox.go
@@ -92,8 +92,8 @@ func (m *manager) GetResourceInfos() ([]*provider.ResourceInfo, error) {
 
 	infos := []*provider.ResourceInfo{}
 	for rows.Next() {
-		var storageID, nodeID string
-		if err := rows.Scan(&storageID, &nodeID); err != nil {
+		var storageID, opaqueID string
+		if err := rows.Scan(&storageID, &opaqueID); err != nil {
 			continue
 		}
 
@@ -126,10 +126,10 @@ func (m *manager) GetResourceInfos() ([]*provider.ResourceInfo, error) {
 			},
 		})
 
-		inf, err := eos.GetMD(ctx, &provider.Reference{
+		inf, err := eos.GetMD(ctx, &provider.Reference{ResourceId: &provider.ResourceId{
 			StorageId: storageID,
-			NodeId:    nodeID,
-		}, []string{})
+			OpaqueId:  opaqueID,
+		}}, []string{})
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/share/manager/json/json.go b/pkg/share/manager/json/json.go
index 586978933b6..4494c1a2151 100644
--- a/pkg/share/manager/json/json.go
+++ b/pkg/share/manager/json/json.go
@@ -245,7 +245,7 @@ func (m *mgr) getByKey(ctx context.Context, key *collaboration.ShareKey) (*colla
 	defer m.Unlock()
 	for _, s := range m.model.Shares {
 		if (utils.UserEqual(key.Owner, s.Owner) || utils.UserEqual(key.Owner, s.Creator)) &&
-			utils.ResourceEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
+			utils.ResourceIdEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
 			return s, nil
 		}
 	}
@@ -323,7 +323,7 @@ func sharesEqual(ref *collaboration.ShareReference, s *collaboration.Share) bool
 		}
 	} else if ref.GetKey() != nil {
 		if (utils.UserEqual(ref.GetKey().Owner, s.Owner) || utils.UserEqual(ref.GetKey().Owner, s.Creator)) &&
-			utils.ResourceEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
+			utils.ResourceIdEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
 			return true
 		}
 	}
@@ -369,7 +369,7 @@ func (m *mgr) ListShares(ctx context.Context, filters []*collaboration.ListShare
 				// TODO(labkode): add the rest of filters.
 				for _, f := range filters {
 					if f.Type == collaboration.ListSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(s.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIdEqual(s.ResourceId, f.GetResourceId()) {
 							ss = append(ss, s)
 						}
 					}
diff --git a/pkg/share/manager/memory/memory.go b/pkg/share/manager/memory/memory.go
index e3d6cda8bb0..98d4301ed29 100644
--- a/pkg/share/manager/memory/memory.go
+++ b/pkg/share/manager/memory/memory.go
@@ -125,7 +125,7 @@ func (m *manager) getByKey(ctx context.Context, key *collaboration.ShareKey) (*c
 	defer m.lock.Unlock()
 	for _, s := range m.shares {
 		if (utils.UserEqual(key.Owner, s.Owner) || utils.UserEqual(key.Owner, s.Creator)) &&
-			utils.ResourceEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
+			utils.ResourceIdEqual(key.ResourceId, s.ResourceId) && utils.GranteeEqual(key.Grantee, s.Grantee) {
 			return s, nil
 		}
 	}
@@ -188,7 +188,7 @@ func sharesEqual(ref *collaboration.ShareReference, s *collaboration.Share) bool
 		}
 	} else if ref.GetKey() != nil {
 		if (utils.UserEqual(ref.GetKey().Owner, s.Owner) || utils.UserEqual(ref.GetKey().Owner, s.Creator)) &&
-			utils.ResourceEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
+			utils.ResourceIdEqual(ref.GetKey().ResourceId, s.ResourceId) && utils.GranteeEqual(ref.GetKey().Grantee, s.Grantee) {
 			return true
 		}
 	}
@@ -230,7 +230,7 @@ func (m *manager) ListShares(ctx context.Context, filters []*collaboration.ListS
 				// TODO(labkode): add the rest of filters.
 				for _, f := range filters {
 					if f.Type == collaboration.ListSharesRequest_Filter_TYPE_RESOURCE_ID {
-						if utils.ResourceEqual(s.ResourceId, f.GetResourceId()) {
+						if utils.ResourceIdEqual(s.ResourceId, f.GetResourceId()) {
 							ss = append(ss, s)
 						}
 					}
diff --git a/pkg/storage/fs/owncloud/owncloud.go b/pkg/storage/fs/owncloud/owncloud.go
index 646a127fd22..b3f08c32c35 100644
--- a/pkg/storage/fs/owncloud/owncloud.go
+++ b/pkg/storage/fs/owncloud/owncloud.go
@@ -661,7 +661,7 @@ func (fs *ocfs) convertToResourceInfo(ctx context.Context, fi os.FileInfo, ip st
 	}
 
 	ri := &provider.ResourceInfo{
-		Id:       &provider.Reference{NodeId: id},
+		Id:       &provider.ResourceId{OpaqueId: id},
 		Path:     sp,
 		Type:     getResourceType(fi.IsDir()),
 		Etag:     etag,
@@ -738,19 +738,19 @@ func readOrCreateID(ctx context.Context, ip string, conn redis.Conn) string {
 	return uid.String()
 }
 
-func (fs *ocfs) getPath(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *ocfs) getPath(ctx context.Context, id *provider.ResourceId) (string, error) {
 	log := appctx.GetLogger(ctx)
 	c := fs.pool.Get()
 	defer c.Close()
 	fs.scanFiles(ctx, c)
-	ip, err := redis.String(c.Do("GET", id.NodeId))
+	ip, err := redis.String(c.Do("GET", id.OpaqueId))
 	if err != nil {
-		return "", errtypes.NotFound(id.NodeId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	idFromXattr, err := xattr.Get(ip, idAttribute)
 	if err != nil {
-		return "", errtypes.NotFound(id.NodeId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	uid, err := uuid.FromBytes(idFromXattr)
@@ -758,18 +758,18 @@ func (fs *ocfs) getPath(ctx context.Context, id *provider.Reference) (string, er
 		log.Error().Err(err).Msg("error parsing uuid")
 	}
 
-	if uid.String() != id.NodeId {
-		if _, err := c.Do("DEL", id.NodeId); err != nil {
+	if uid.String() != id.OpaqueId {
+		if _, err := c.Do("DEL", id.OpaqueId); err != nil {
 			return "", err
 		}
-		return "", errtypes.NotFound(id.NodeId)
+		return "", errtypes.NotFound(id.OpaqueId)
 	}
 
 	return ip, nil
 }
 
 // GetPathByID returns the storage relative path for the file id, without the internal namespace
-func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	ip, err := fs.getPath(ctx, id)
 	if err != nil {
 		return "", err
@@ -794,8 +794,8 @@ func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.Reference) (string
 func (fs *ocfs) resolve(ctx context.Context, ref *provider.Reference) (string, error) {
 
 	// if storage id is set look up that
-	if ref.StorageId != "" || ref.NodeId != "" {
-		ip, err := fs.getPath(ctx, ref)
+	if ref.ResourceId != nil {
+		ip, err := fs.getPath(ctx, ref.ResourceId)
 		if err != nil {
 			return "", err
 		}
diff --git a/pkg/storage/fs/owncloudsql/owncloudsql.go b/pkg/storage/fs/owncloudsql/owncloudsql.go
index af40d50bf7d..a624bb25b3e 100644
--- a/pkg/storage/fs/owncloudsql/owncloudsql.go
+++ b/pkg/storage/fs/owncloudsql/owncloudsql.go
@@ -585,7 +585,7 @@ func (fs *ocfs) convertToResourceInfo(ctx context.Context, fi os.FileInfo, ip st
 	}
 
 	ri := &provider.ResourceInfo{
-		Id:       &provider.Reference{NodeId: strconv.Itoa(cacheEntry.ID)},
+		Id:       &provider.ResourceId{OpaqueId: strconv.Itoa(cacheEntry.ID)},
 		Path:     sp,
 		Type:     getResourceType(fi.IsDir()),
 		Etag:     cacheEntry.Etag,
@@ -628,8 +628,8 @@ func getResourceType(isDir bool) provider.ResourceType {
 }
 
 // GetPathByID returns the storage relative path for the file id, without the internal namespace
-func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
-	ip, err := fs.filecache.Path(id.NodeId)
+func (fs *ocfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
+	ip, err := fs.filecache.Path(id.OpaqueId)
 	if err != nil {
 		return "", err
 	}
@@ -655,7 +655,7 @@ func (fs *ocfs) resolve(ctx context.Context, ref *provider.Reference) (string, e
 		return fs.toInternalPath(ctx, ref.GetPath()), nil
 	}
 
-	p, err := fs.filecache.Path(ref.NodeId)
+	p, err := fs.filecache.Path(ref.ResourceId.OpaqueId)
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/storage/fs/s3/s3.go b/pkg/storage/fs/s3/s3.go
index 49f21bfce3b..90561627733 100644
--- a/pkg/storage/fs/s3/s3.go
+++ b/pkg/storage/fs/s3/s3.go
@@ -115,12 +115,12 @@ func (fs *s3FS) addRoot(p string) string {
 }
 
 func (fs *s3FS) resolve(ctx context.Context, ref *provider.Reference) (string, error) {
-	if ref.Path != "" {
+	if strings.HasPrefix(ref.Path, "/") {
 		return fs.addRoot(ref.GetPath()), nil
 	}
 
-	if ref.NodeId != "" {
-		fn := path.Join("/", strings.TrimPrefix(ref.NodeId, "fileid-"))
+	if ref.ResourceId != nil && ref.ResourceId.OpaqueId != "" {
+		fn := path.Join("/", strings.TrimPrefix(ref.ResourceId.OpaqueId, "fileid-"))
 		fn = fs.addRoot(fn)
 		return fn, nil
 	}
@@ -172,8 +172,8 @@ func (fs *s3FS) normalizeObject(ctx context.Context, o *s3.Object, fn string) *p
 	fn = fs.removeRoot(path.Join("/", fn))
 	isDir := strings.HasSuffix(*o.Key, "/")
 	md := &provider.ResourceInfo{
-		Id: &provider.Reference{
-			NodeId: "fileid-" + strings.TrimPrefix(fn, "/"),
+		Id: &provider.ResourceId{
+			OpaqueId: "fileid-" + strings.TrimPrefix(fn, "/"),
 		},
 		Path:          fn,
 		Type:          getResourceType(isDir),
@@ -203,7 +203,7 @@ func (fs *s3FS) normalizeHead(ctx context.Context, o *s3.HeadObjectOutput, fn st
 	fn = fs.removeRoot(path.Join("/", fn))
 	isDir := strings.HasSuffix(fn, "/")
 	md := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: "fileid-" + strings.TrimPrefix(fn, "/")},
+		Id:            &provider.ResourceId{OpaqueId: "fileid-" + strings.TrimPrefix(fn, "/")},
 		Path:          fn,
 		Type:          getResourceType(isDir),
 		Etag:          *o.ETag,
@@ -223,7 +223,7 @@ func (fs *s3FS) normalizeHead(ctx context.Context, o *s3.HeadObjectOutput, fn st
 func (fs *s3FS) normalizeCommonPrefix(ctx context.Context, p *s3.CommonPrefix) *provider.ResourceInfo {
 	fn := fs.removeRoot(path.Join("/", *p.Prefix))
 	md := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: "fileid-" + strings.TrimPrefix(fn, "/")},
+		Id:            &provider.ResourceId{OpaqueId: "fileid-" + strings.TrimPrefix(fn, "/")},
 		Path:          fn,
 		Type:          getResourceType(true),
 		Etag:          "TODO(labkode)",
@@ -244,8 +244,8 @@ func (fs *s3FS) normalizeCommonPrefix(ctx context.Context, p *s3.CommonPrefix) *
 // GetPathByID returns the path pointed by the file id
 // In this implementation the file id is that path of the file without the first slash
 // thus the file id always points to the filename
-func (fs *s3FS) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
-	return path.Join("/", strings.TrimPrefix(id.NodeId, "fileid-")), nil
+func (fs *s3FS) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
+	return path.Join("/", strings.TrimPrefix(id.OpaqueId, "fileid-")), nil
 }
 
 func (fs *s3FS) AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error {
diff --git a/pkg/storage/registry/static/static.go b/pkg/storage/registry/static/static.go
index 298adcf786e..69ce5e27cc8 100644
--- a/pkg/storage/registry/static/static.go
+++ b/pkg/storage/registry/static/static.go
@@ -143,30 +143,31 @@ func (b *reg) FindProviders(ctx context.Context, ref *provider.Reference) ([]*re
 	var match *registrypb.ProviderInfo
 	var shardedMatches []*registrypb.ProviderInfo
 
-	// If the reference has a storage id set, use it to route
-	if ref.StorageId != "" {
-		for prefix, rule := range b.c.Rules {
-			addr := getProviderAddr(ctx, rule)
-			r, err := regexp.Compile("^" + prefix + "$")
-			if err != nil {
-				continue
+	// If the reference has a resource id set, use it to route
+	if ref.ResourceId != nil {
+		if ref.ResourceId.StorageId != "" {
+			for prefix, rule := range b.c.Rules {
+				addr := getProviderAddr(ctx, rule)
+				r, err := regexp.Compile("^" + prefix + "$")
+				if err != nil {
+					continue
+				}
+				// TODO(labkode): fill path info based on provider id, if path and storage id points to same id, take that.
+				if m := r.FindString(ref.ResourceId.StorageId); m != "" {
+					return []*registrypb.ProviderInfo{{
+						ProviderId: ref.ResourceId.StorageId,
+						Address:    addr,
+					}}, nil
+				}
 			}
-			// TODO(labkode): fill path info based on provider id, if path and storage id points to same id, take that.
-			if m := r.FindString(ref.StorageId); m != "" {
-				return []*registrypb.ProviderInfo{{
-					ProviderId: ref.StorageId,
-					Address:    addr,
-				}}, nil
+			// TODO if the storage id is not set but node id is set we could poll all storage providers to check if the node is known there
+			// for now, say the reference is invalid
+			if ref.ResourceId.OpaqueId != "" {
+				return nil, errtypes.BadRequest("invalid reference " + ref.String())
 			}
 		}
 	}
 
-	// TODO if the storage id is not set but node id is set we could poll all storage providers to check if the node is known there
-	// for now, say the reference is invalid
-	if ref.NodeId != "" {
-		return nil, errtypes.BadRequest("invalid reference " + ref.String())
-	}
-
 	// Try to find by path  as most storage operations will be done using the path.
 	// TODO this needs to be reevaluated once all clients query the storage registry for a list of storage providers
 	fn := path.Clean(ref.GetPath())
diff --git a/pkg/storage/registry/static/static_test.go b/pkg/storage/registry/static/static_test.go
index 49ee3020b4b..3d390d0ab1a 100644
--- a/pkg/storage/registry/static/static_test.go
+++ b/pkg/storage/registry/static/static_test.go
@@ -226,9 +226,9 @@ var _ = Describe("Static", func() {
 	})
 
 	Describe("FindProviders for reference containing ID", func() {
-		ref := &provider.Reference{
+		ref := &provider.Reference{ResourceId: &provider.ResourceId{
 			StorageId: "123e4567-e89b-12d3-a456-426655440000",
-		}
+		}}
 
 		It("finds all providers for user alice for ref containing ID", func() {
 			providers, err := handler.FindProviders(ctxAlice, ref)
diff --git a/pkg/storage/storage.go b/pkg/storage/storage.go
index 9f985a1aca4..ecc8a3addfb 100644
--- a/pkg/storage/storage.go
+++ b/pkg/storage/storage.go
@@ -46,7 +46,7 @@ type FS interface {
 	RestoreRecycleItem(ctx context.Context, key string, restoreRef *provider.Reference) error
 	PurgeRecycleItem(ctx context.Context, key string) error
 	EmptyRecycle(ctx context.Context) error
-	GetPathByID(ctx context.Context, id *provider.Reference) (string, error)
+	GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error)
 	AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
 	RemoveGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
 	UpdateGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error
diff --git a/pkg/storage/utils/decomposedfs/decomposedfs.go b/pkg/storage/utils/decomposedfs/decomposedfs.go
index 818d83d90ba..3bbcf83d148 100644
--- a/pkg/storage/utils/decomposedfs/decomposedfs.go
+++ b/pkg/storage/utils/decomposedfs/decomposedfs.go
@@ -251,7 +251,7 @@ func (fs *Decomposedfs) GetHome(ctx context.Context) (string, error) {
 }
 
 // GetPathByID returns the fn pointed by the file id, without the internal namespace
-func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *Decomposedfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	node, err := fs.lu.NodeFromID(ctx, id)
 	if err != nil {
 		return "", err
@@ -579,10 +579,10 @@ func (fs *Decomposedfs) ListStorageSpaces(ctx context.Context, filter []*provide
 			space := &provider.StorageSpace{
 				// FIXME the driver should know its id move setting the spaceid from the storage provider to the drivers
 				//Id: &provider.StorageSpaceId{OpaqueId: "1284d238-aa92-42ce-bdc4-0b0000009157!" + n.ID},
-				Root: &provider.Reference{
+				Root: &provider.ResourceId{
 					// FIXME the driver should know its id move setting the spaceid from the storage provider to the drivers
 					//StorageId: "1284d238-aa92-42ce-bdc4-0b0000009157",
-					NodeId: n.ID,
+					OpaqueId: n.ID,
 				},
 				Name:      n.Name,
 				SpaceType: filepath.Base(filepath.Dir(matches[i])),
diff --git a/pkg/storage/utils/decomposedfs/lookup.go b/pkg/storage/utils/decomposedfs/lookup.go
index eea6885161c..644b2d4ec1d 100644
--- a/pkg/storage/utils/decomposedfs/lookup.go
+++ b/pkg/storage/utils/decomposedfs/lookup.go
@@ -41,10 +41,10 @@ type Lookup struct {
 // NodeFromResource takes in a request path or request id and converts it to a Node
 func (lu *Lookup) NodeFromResource(ctx context.Context, ref *provider.Reference) (*node.Node, error) {
 
-	if ref.StorageId != "" || ref.NodeId != "" {
+	if ref.ResourceId != nil {
 		// check if a storage space reference is used
 		// currently, the decomposed fs uses the root node id as the space id
-		n, err := lu.NodeFromID(ctx, ref)
+		n, err := lu.NodeFromID(ctx, ref.ResourceId)
 		if err != nil {
 			return nil, err
 		}
@@ -98,11 +98,11 @@ func (lu *Lookup) NodeFromPath(ctx context.Context, fn string) (*node.Node, erro
 }
 
 // NodeFromID returns the internal path for the id
-func (lu *Lookup) NodeFromID(ctx context.Context, id *provider.Reference) (n *node.Node, err error) {
-	if id == nil || id.NodeId == "" {
+func (lu *Lookup) NodeFromID(ctx context.Context, id *provider.ResourceId) (n *node.Node, err error) {
+	if id == nil || id.OpaqueId == "" {
 		return nil, fmt.Errorf("invalid resource id %+v", id)
 	}
-	return node.ReadNode(ctx, lu, id.NodeId)
+	return node.ReadNode(ctx, lu, id.OpaqueId)
 }
 
 // Path returns the path for node
diff --git a/pkg/storage/utils/decomposedfs/node/node.go b/pkg/storage/utils/decomposedfs/node/node.go
index 16c6168aa92..09820f52a98 100644
--- a/pkg/storage/utils/decomposedfs/node/node.go
+++ b/pkg/storage/utils/decomposedfs/node/node.go
@@ -444,7 +444,7 @@ func (n *Node) AsResourceInfo(ctx context.Context, rp *provider.ResourcePermissi
 		// nodeType = provider.ResourceType_RESOURCE_TYPE_REFERENCE
 	}
 
-	id := &provider.Reference{NodeId: n.ID}
+	id := &provider.ResourceId{OpaqueId: n.ID}
 
 	fn, err = n.lu.Path(ctx, n)
 	if err != nil {
diff --git a/pkg/storage/utils/decomposedfs/tree/tree.go b/pkg/storage/utils/decomposedfs/tree/tree.go
index d2c40a69d23..2ae7df0f973 100644
--- a/pkg/storage/utils/decomposedfs/tree/tree.go
+++ b/pkg/storage/utils/decomposedfs/tree/tree.go
@@ -52,7 +52,7 @@ type Blobstore interface {
 // PathLookup defines the interface for the lookup component
 type PathLookup interface {
 	NodeFromPath(ctx context.Context, fn string) (*node.Node, error)
-	NodeFromID(ctx context.Context, id *provider.Reference) (n *node.Node, err error)
+	NodeFromID(ctx context.Context, id *provider.ResourceId) (n *node.Node, err error)
 	RootNode(ctx context.Context) (node *node.Node, err error)
 	HomeOrRootNode(ctx context.Context) (node *node.Node, err error)
 
diff --git a/pkg/storage/utils/eosfs/eosfs.go b/pkg/storage/utils/eosfs/eosfs.go
index 2a96122ef30..c02a598b339 100644
--- a/pkg/storage/utils/eosfs/eosfs.go
+++ b/pkg/storage/utils/eosfs/eosfs.go
@@ -291,8 +291,8 @@ func (fs *eosfs) unwrapInternal(ctx context.Context, ns, np, layout string) (str
 // resolve takes in a request path or request id and returns the unwrappedNominal path.
 func (fs *eosfs) resolve(ctx context.Context, u *userpb.User, ref *provider.Reference) (string, error) {
 
-	if ref.StorageId != "" || ref.NodeId != "" {
-		p, err := fs.getPath(ctx, u, ref)
+	if ref.ResourceId != nil {
+		p, err := fs.getPath(ctx, u, ref.ResourceId)
 		if err != nil {
 			return "", err
 		}
@@ -307,10 +307,10 @@ func (fs *eosfs) resolve(ctx context.Context, u *userpb.User, ref *provider.Refe
 	return "", fmt.Errorf("invalid reference %+v. id and path are missing", ref)
 }
 
-func (fs *eosfs) getPath(ctx context.Context, u *userpb.User, id *provider.Reference) (string, error) {
-	fid, err := strconv.ParseUint(id.NodeId, 10, 64)
+func (fs *eosfs) getPath(ctx context.Context, u *userpb.User, id *provider.ResourceId) (string, error) {
+	fid, err := strconv.ParseUint(id.OpaqueId, 10, 64)
 	if err != nil {
-		return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.NodeId)
+		return "", fmt.Errorf("error converting string to int for eos fileid: %s", id.OpaqueId)
 	}
 
 	uid, gid, err := fs.getUserUIDAndGID(ctx, u)
@@ -340,7 +340,7 @@ func (fs *eosfs) isShareFolderChild(ctx context.Context, p string) bool {
 	return len(vals) > 1 && vals[1] != ""
 }
 
-func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.Reference) (string, error) {
+func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (string, error) {
 	u, err := getUser(ctx)
 	if err != nil {
 		return "", errors.Wrap(err, "eos: no user in ctx")
@@ -348,7 +348,7 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.Reference) (strin
 
 	// parts[0] = 868317, parts[1] = photos, ...
 	// FIXME REFERENCE ... umm ... 868317/photos? @ishank011 might be a leftover
-	parts := strings.Split(id.NodeId, "/")
+	parts := strings.Split(id.OpaqueId, "/")
 	fileID, err := strconv.ParseUint(parts[0], 10, 64)
 	if err != nil {
 		return "", errors.Wrap(err, "eos: error parsing fileid string")
@@ -1475,7 +1475,7 @@ func (fs *eosfs) convert(ctx context.Context, eosFileInfo *eosclient.FileInfo, v
 	}
 
 	info := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: fmt.Sprintf("%d", eosFileInfo.Inode)},
+		Id:            &provider.ResourceId{OpaqueId: fmt.Sprintf("%d", eosFileInfo.Inode)},
 		Path:          path,
 		Owner:         owner,
 		Etag:          fmt.Sprintf("\"%s\"", strings.Trim(eosFileInfo.ETag, "\"")),
diff --git a/pkg/storage/utils/localfs/localfs.go b/pkg/storage/utils/localfs/localfs.go
index 245f1980de2..30290bb91e2 100644
--- a/pkg/storage/utils/localfs/localfs.go
+++ b/pkg/storage/utils/localfs/localfs.go
@@ -136,8 +136,8 @@ func (fs *localfs) Shutdown(ctx context.Context) error {
 }
 
 func (fs *localfs) resolve(ctx context.Context, ref *provider.Reference) (p string, err error) {
-	if ref.StorageId != "" || ref.NodeId != "" {
-		if p, err = fs.GetPathByID(ctx, ref); err != nil {
+	if ref.ResourceId != nil {
+		if p, err = fs.GetPathByID(ctx, ref.ResourceId); err != nil {
 			return "", err
 		}
 		return path.Join(p, ref.Path), nil
@@ -341,7 +341,7 @@ func (fs *localfs) normalize(ctx context.Context, fi os.FileInfo, fn string, mdK
 
 	// A fileid is constructed like `fileid-url_encoded_path`. See GetPathByID for the inverse conversion
 	md := &provider.ResourceInfo{
-		Id:            &provider.Reference{NodeId: "fileid-" + url.QueryEscape(path.Join(layout, fp))},
+		Id:            &provider.ResourceId{OpaqueId: "fileid-" + url.QueryEscape(path.Join(layout, fp))},
 		Path:          fp,
 		Type:          getResourceType(fi.IsDir()),
 		Etag:          calcEtag(ctx, fi),
@@ -413,7 +413,7 @@ func (fs *localfs) retrieveArbitraryMetadata(ctx context.Context, fn string, mdK
 
 // GetPathByID returns the path pointed by the file id
 // In this implementation the file id is in the form `fileid-url_encoded_path`
-func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.Reference) (string, error) {
+func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.ResourceId) (string, error) {
 	var layout string
 	if !fs.conf.DisableHome {
 		var err error
@@ -422,7 +422,7 @@ func (fs *localfs) GetPathByID(ctx context.Context, ref *provider.Reference) (st
 			return "", err
 		}
 	}
-	return url.QueryUnescape(strings.TrimPrefix(ref.NodeId, "fileid-"+layout))
+	return url.QueryUnescape(strings.TrimPrefix(ref.OpaqueId, "fileid-"+layout))
 }
 
 func (fs *localfs) AddGrant(ctx context.Context, ref *provider.Reference, g *provider.Grant) error {
diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go
index d5e77a4347d..9ab1747fa16 100644
--- a/pkg/utils/utils.go
+++ b/pkg/utils/utils.go
@@ -152,9 +152,14 @@ func GroupEqual(u, v *grouppb.GroupId) bool {
 	return u != nil && v != nil && u.Idp == v.Idp && u.OpaqueId == v.OpaqueId
 }
 
+// ResourceIdEqual returns whether two resources have the same field values.
+func ResourceIdEqual(u, v *provider.ResourceId) bool {
+	return u != nil && v != nil && u.StorageId == v.StorageId && u.OpaqueId == v.OpaqueId
+}
+
 // ResourceEqual returns whether two resources have the same field values.
 func ResourceEqual(u, v *provider.Reference) bool {
-	return u != nil && v != nil && u.StorageId == v.StorageId && u.NodeId == v.NodeId && u.Path == v.Path
+	return u != nil && v != nil && u.Path == v.Path && ((u.ResourceId == nil && v.ResourceId == nil) || (ResourceIdEqual(u.ResourceId, v.ResourceId)))
 }
 
 // GranteeEqual returns whether two grantees have the same field values.