feat: enforce folder download policy

chfs-ng/internal/api/folder_download_test.go

@@ -0,0 +1,55 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestFolderDownloadModes(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "parent", "child"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for _, p := range []string{
+		filepath.Join(root, "parent", "a.txt"),
+		filepath.Join(root, "parent", "child", "b.txt"),
+	} {
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mk := func(mode string) *Server {
+		return &Server{
+			Store: storage.Local{Root: root},
+			Auth: &auth.Manager{
+				Accounts: map[string]*auth.Account{},
+				Guest:    &auth.Account{Mask: auth.Read | auth.Write | auth.Delete},
+			},
+			FolderDownload: mode,
+		}
+	}
+	for _, tc := range []struct {
+		mode, path string
+		want       int
+	}{
+		{"disable", "parent", http.StatusForbidden},
+		{"leaf", "parent", http.StatusForbidden},
+		{"leaf", "parent/child", http.StatusOK},
+		{"enable", "parent", http.StatusOK},
+	} {
+		t.Run(tc.mode+"-"+tc.path, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/chfs/downloaddir/"+tc.path, nil)
+			w := httptest.NewRecorder()
+			mk(tc.mode).Handler().ServeHTTP(w, req)
+			if w.Code != tc.want {
+				t.Fatalf("status=%d want=%d body=%s", w.Code, tc.want, w.Body.String())
+			}
+		})
+	}
+}

chfs-ng/internal/api/server.go

@@ -43,6 +43,7 @@ type Server struct {
 	MultiRoot      bool
 	RemoveMode     int
 	ImagePreview   bool
+	FolderDownload string
 	Log            *opslog.Logger
 }
 type fileInfo struct {
@@ -815,6 +816,27 @@ func (s *Server) downloadDir(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
+	mode := strings.ToLower(strings.TrimSpace(s.FolderDownload))
+	if mode == "" {
+		mode = "enable"
+	}
+	if mode == "disable" || mode == "false" || mode == "0" {
+		writeJSONError(w, http.StatusForbidden, "folder download disabled")
+		return
+	}
+	if mode == "leaf" {
+		items, err := s.Store.List(p)
+		if err != nil {
+			http.Error(w, err.Error(), 500)
+			return
+		}
+		for _, item := range items {
+			if item.IsDir() {
+				writeJSONError(w, http.StatusForbidden, "folder download is only available for leaf directories")
+				return
+			}
+		}
+	}
 	name := fi.Name()
 	if name == "." || name == "" {
 		name = "download"