feat: improve multi-user permission controls

chfs-ng/internal/auth/users.go

@@ -168,7 +168,18 @@ func (u *UserStore) Update(m *Manager, username, password string, enabled *bool,
 		a.Enabled = *enabled
 	}
 	if rules != nil {
-		a.Rules = rules
+		// A managed user's home is always their private working area. Keep the
+		// base RWD rule even when an administrator replaces the extra rules.
+		// Additional rules can grant or deny access elsewhere.
+		next := make([]PathRule, 0, len(rules)+1)
+		next = append(next, PathRule{Dir: a.Home, Mask: Read | Write | Delete})
+		for _, rule := range rules {
+			if strings.Trim(rule.Dir, "/") == strings.Trim(a.Home, "/") {
+				continue
+			}
+			next = append(next, rule)
+		}
+		a.Rules = next
 	}
 	return u.Save(m)
 }