From 44a365822bf11c06eec555cf82da0255d53788a2 Mon Sep 17 00:00:00 2001
From: OpenClaw Agent <openclaw@example.com>
Date: Thu, 17 Sep 2026 03:11:55 +0800
Subject: [PATCH] fix: give regular users global webdav access

---
 admin_users.go |  2 +-
 user_webdav.go | 20 ++++++++++++++------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/admin_users.go b/admin_users.go
index 2122523..dbad944 100644
--- a/admin_users.go
+++ b/admin_users.go
@@ -17,7 +17,7 @@ func defaultPermissions(role string) []string {
 		return []string{PermDownload, PermRedeem, PermWebDAV, PermWebDAVConfig}
 	}
 	if role == RoleUser {
-		return []string{PermDownload, PermRedeem}
+		return []string{PermDownload, PermRedeem, PermWebDAV}
 	}
 	return nil
 }
diff --git a/user_webdav.go b/user_webdav.go
index 33d39c2..b224768 100644
--- a/user_webdav.go
+++ b/user_webdav.go
@@ -89,15 +89,23 @@ func (a *App) storageForTask(t *Task) (RemoteStorage, string, bool) {
 	if a.db.First(&user, t.UserID).Error != nil {
 		return nil, "", false
 	}
-	if user.Role == RoleAdmin {
-		if a.cfg.WebDAVURL == "" {
-			return nil, "", false
-		}
-		return a.storage, a.cfg.WebDAVPath, a.storage != nil
-	}
 	if !a.hasPermission(user.ID, PermWebDAV) {
 		return nil, "", false
 	}
+	// Regular users use the system/global WebDAV only. They cannot override
+	// the destination; privileged users may have their own WebDAV config.
+	if user.Role == RoleUser {
+		if a.cfg.WebDAVURL == "" || a.storage == nil {
+			return nil, "", false
+		}
+		return a.storage, a.cfg.WebDAVPath, true
+	}
+	if user.Role == RoleAdmin {
+		if a.cfg.WebDAVURL == "" || a.storage == nil {
+			return nil, "", false
+		}
+		return a.storage, a.cfg.WebDAVPath, true
+	}
 	var cfg WebDAVConfig
 	if a.db.Where("user_id = ? AND enabled = ?", user.ID, true).First(&cfg).Error != nil || cfg.URL == "" {
 		return nil, "", false