feat: enforce folder download policy

chfs-ng/internal/api/server.go

@@ -43,6 +43,7 @@ type Server struct {
 	MultiRoot      bool
 	RemoveMode     int
 	ImagePreview   bool
+	FolderDownload string
 	Log            *opslog.Logger
 }
 type fileInfo struct {
@@ -815,6 +816,27 @@ func (s *Server) downloadDir(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
+	mode := strings.ToLower(strings.TrimSpace(s.FolderDownload))
+	if mode == "" {
+		mode = "enable"
+	}
+	if mode == "disable" || mode == "false" || mode == "0" {
+		writeJSONError(w, http.StatusForbidden, "folder download disabled")
+		return
+	}
+	if mode == "leaf" {
+		items, err := s.Store.List(p)
+		if err != nil {
+			http.Error(w, err.Error(), 500)
+			return
+		}
+		for _, item := range items {
+			if item.IsDir() {
+				writeJSONError(w, http.StatusForbidden, "folder download is only available for leaf directories")
+				return
+			}
+		}
+	}
 	name := fi.Name()
 	if name == "." || name == "" {
 		name = "download"