fix: align CHFS directory rule inheritance

chfs-ng/cmd/chfs/main.go

@@ -67,16 +67,16 @@ func main() {
 	for _, ac := range cfg.Accounts {
 		a := &auth.Account{Username: ac.Username, Password: ac.Password, Mask: auth.ParseMask(ac.Default)}
 		for _, d := range ac.None {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Deny: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: accountRulePath(d, cfg.Path), Deny: true})
 		}
 		for _, d := range ac.Read {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.Read, ChildrenOnly: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: accountRulePath(d, cfg.Path), Mask: auth.Read, ChildrenOnly: true})
 		}
 		for _, d := range ac.Write {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.ParseMask("w"), ChildrenOnly: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: accountRulePath(d, cfg.Path), Mask: auth.ParseMask("w"), ChildrenOnly: true})
 		}
 		for _, d := range ac.Delete {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.ParseMask("d"), ChildrenOnly: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: accountRulePath(d, cfg.Path), Mask: auth.ParseMask("d"), ChildrenOnly: true})
 		}
 		if ac.Username == "guest" {
 			mgr.Guest = a
@@ -103,6 +103,29 @@ type multiFlag []string
 func (m *multiFlag) String() string     { return strings.Join(*m, "|") }
 func (m *multiFlag) Set(v string) error { *m = append(*m, v); return nil }
 
+func accountRulePath(rule string, roots []string) string {
+	rule = strings.TrimSpace(strings.Trim(rule, "\\\""))
+	if rule == "" {
+		return rule
+	}
+	rule = filepath.ToSlash(rule)
+	if !filepath.IsAbs(rule) {
+		return strings.Trim(rule, "/")
+	}
+	for _, root := range roots {
+		r := filepath.Clean(root)
+		rel, err := filepath.Rel(r, rule)
+		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+			continue
+		}
+		if rel == "." {
+			return ""
+		}
+		return filepath.ToSlash(rel)
+	}
+	return rule
+}
+
 func itoa(n int) string {
 	const d = "0123456789"
 	if n == 0 {