diff --git a/server/internal/core/db/fs.sql.go b/server/internal/core/db/fs.sql.go
index 988bb828..9cb56a95 100644
--- a/server/internal/core/db/fs.sql.go
+++ b/server/internal/core/db/fs.sql.go
@@ -235,30 +235,6 @@ func (q *Queries) ReadDir(ctx context.Context, arg ReadDirParams) ([]Resource, e
 	return items, nil
 }
 
-const resourceByID = `-- name: ResourceByID :one
-SELECT id, name, parent, dir, created, modified, deleted, content_length, content_type, content_sha256, permissions, grants FROM resources WHERE id = $1::UUID
-`
-
-func (q *Queries) ResourceByID(ctx context.Context, resourceID uuid.UUID) (Resource, error) {
-	row := q.db.QueryRow(ctx, resourceByID, resourceID)
-	var i Resource
-	err := row.Scan(
-		&i.ID,
-		&i.Name,
-		&i.Parent,
-		&i.Dir,
-		&i.Created,
-		&i.Modified,
-		&i.Deleted,
-		&i.ContentLength,
-		&i.ContentType,
-		&i.ContentSha256,
-		&i.Permissions,
-		&i.Grants,
-	)
-	return i, err
-}
-
 const resourceByPath = `-- name: ResourceByPath :one
 WITH RECURSIVE nodes(id, parent, search, depth) AS (
     SELECT r.id, r.parent, array_remove(string_to_array($1::text, '/', NULL), ''), 0
diff --git a/server/internal/core/fs/find.go b/server/internal/core/fs/find.go
index b9ca2400..09edfc92 100644
--- a/server/internal/core/fs/find.go
+++ b/server/internal/core/fs/find.go
@@ -13,7 +13,12 @@ func (f filesystem) ResourceByPath(path string) (Resource, error) {
 }
 
 func (f filesystem) ResourceByID(id uuid.UUID) (Resource, error) {
-	return f.resourceFromResult(f.db.ResourceByID(f.ctx, id))
+	const query = "SELECT * FROM resources WHERE id = $1::UUID"
+	if rows, err := f.db.Query(f.ctx, query, id); err != nil {
+		return Resource{}, err
+	} else {
+		return pgx.CollectExactlyOneRow(rows, pgx.RowToFunc[Resource](f.readResource))
+	}
 }
 
 func (f filesystem) resourceFromResult(r db.Resource, err error) (Resource, error) {
diff --git a/server/internal/core/fs/sql_common.go b/server/internal/core/fs/sql_common.go
index 6129451c..af479b15 100644
--- a/server/internal/core/fs/sql_common.go
+++ b/server/internal/core/fs/sql_common.go
@@ -49,6 +49,27 @@ func scanResourceRow(row pgx.CollectableRow) (Resource, error) {
 	return r, err
 }
 
+func (f filesystem) readResource(row pgx.CollectableRow) (Resource, error) {
+	r, err := scanResourceRow(row)
+	if err != nil {
+		return r, err
+	}
+	permission := Permission(0)
+	if f.fullAccess {
+		permission = -1
+	} else if p, err := readPermissionFromJson(r.permissions, f.username); err != nil {
+		return Resource{}, err
+	} else {
+		permission = p
+	}
+	if permission&PermissionRead == 0 {
+		return Resource{}, ErrResourceNotFound
+	}
+	r.f = f
+	r.userPermission = permission
+	return r, err
+}
+
 func collectNonDirResourceIDs(rows pgx.Rows, e error) (total int, ids []uuid.UUID, err error) {
 	if e != nil {
 		return 0, nil, e
diff --git a/server/internal/core/fs/trash_list.go b/server/internal/core/fs/trash_list.go
index ba3d75e8..3de9ecd2 100644
--- a/server/internal/core/fs/trash_list.go
+++ b/server/internal/core/fs/trash_list.go
@@ -51,7 +51,7 @@ func (f filesystem) TrashList(cursor string, n uint) ([]Resource, string, error)
 
 	if rows, err := f.db.Query(f.ctx, query, params...); err != nil {
 		return nil, "", err
-	} else if res, err := pgx.CollectRows(rows, scanResourceRow); err != nil {
+	} else if res, err := pgx.CollectRows(rows, f.readResource); err != nil {
 		return nil, "", err
 	} else {
 		if res == nil {
diff --git a/server/sql/queries/fs.sql b/server/sql/queries/fs.sql
index a5794b01..b96bddab 100644
--- a/server/sql/queries/fs.sql
+++ b/server/sql/queries/fs.sql
@@ -31,9 +31,6 @@ SELECT r.*
         ON r.id = n.id
     WHERE cardinality(n.search) = n.depth;
 
--- name: ResourceByID :one
-SELECT * FROM resources WHERE id = @resource_id::UUID;
-
 -- name: GetAncestors :many
 WITH RECURSIVE nodes(id, name, parent, permissions, self) AS (
     SELECT r.id, r.name, r.parent, r.permissions, TRUE