fix: enforce recursive WebDAV permissions

chfs-ng/internal/api/webdav_test.go

@@ -0,0 +1,37 @@
+package api
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"github.com/emersion/go-webdav"
+)
+
+func TestWebDAVAuthFSCheckTree(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "test", "private"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "test", "public.txt"), []byte("public"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "test", "private", "secret.txt"), []byte("secret"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{
+		{Dir: "test", Mask: auth.Delete},
+		{Dir: "test/private", Mask: auth.None},
+	}}
+	fs := &webdavAuthFS{inner: webdav.LocalFileSystem(root), account: account}
+
+	if err := fs.checkTree(context.Background(), "/test", auth.Delete); err == nil {
+		t.Fatal("expected recursive delete permission check to reject inaccessible descendant")
+	}
+	if err := fs.checkTree(context.Background(), "/test/public.txt", auth.Delete); err != nil {
+		t.Fatalf("public file should be deletable: %v", err)
+	}
+}