From 05b96f1831e08370c211ce4bc73e5dab1954a7be Mon Sep 17 00:00:00 2001
From: OpenClaw Agent <openclaw@example.com>
Date: Mon, 21 Sep 2026 22:13:33 +0800
Subject: [PATCH] fix: require delete permission for WebDAV overwrite

---
 chfs-ng/internal/api/server.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 7a78dc1..7f390f1 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -1372,9 +1372,9 @@ func (f *webdavAuthFS) Create(ctx context.Context, name string, body io.ReadClos
 		return nil, false, err
 	}
 	// CHFS permits PUT to overwrite an existing file only when the target
-	// itself is writable. A writable parent alone is enough for creation.
+	// itself is deletable. A writable parent alone is enough for creation.
 	if _, err := f.inner.Stat(ctx, name); err == nil {
-		if err := f.allow(name, auth.Write); err != nil {
+		if err := f.allow(name, auth.Delete); err != nil {
 			return nil, false, err
 		}
 	} else if !os.IsNotExist(err) {