security: enforce recursive delete authorization

chfs-ng/internal/api/path_security_test.go

@@ -1,6 +1,28 @@
 package api
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestCheckDeleteTreeRejectsDeniedDescendant(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "public", "private"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "public", "private", "secret.txt"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	store := storage.Local{Root: root}
+	account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{{Dir: "public/private", Mask: auth.None}}}
+	if err := checkDeleteTree(store, account, "public"); err == nil {
+		t.Fatal("expected denied descendant to block recursive deletion")
+	}
+}
 
 func TestUnsafePath(t *testing.T) {
 	cases := map[string]bool{

chfs-ng/internal/api/server.go

@@ -336,6 +336,10 @@ func (s *Server) remove(w http.ResponseWriter, r *http.Request) {
 			writeJSONError(w, http.StatusForbidden, "has no privilege")
 			return
 		}
+		if e := checkDeleteTree(s.Store, a, p); e != nil {
+			writeJSONError(w, http.StatusForbidden, "has no privilege")
+			return
+		}
 		if e := s.removePath(p); e != nil {
 			http.Error(w, e.Error(), 500)
 			return