fix: enforce recursive WebDAV permissions

chfs-ng/internal/api/server.go

@@ -829,6 +829,9 @@ func (f *webdavAuthFS) RemoveAll(ctx context.Context, name string, opts *webdav.
 	if err := f.allow(name, auth.Delete); err != nil {
 		return err
 	}
+	if err := f.checkTree(ctx, name, auth.Delete); err != nil {
+		return err
+	}
 	return f.inner.RemoveAll(ctx, name, opts)
 }
 func (f *webdavAuthFS) Mkdir(ctx context.Context, name string) error {
@@ -845,6 +848,9 @@ func (f *webdavAuthFS) Copy(ctx context.Context, name, dest string, opts *webdav
 	if err := f.allow(name, auth.Read); err != nil {
 		return false, err
 	}
+	if err := f.checkTree(ctx, name, auth.Read); err != nil {
+		return false, err
+	}
 	parent := path.Dir(strings.Trim(dest, "/"))
 	if parent == "." {
 		parent = ""
@@ -855,7 +861,10 @@ func (f *webdavAuthFS) Copy(ctx context.Context, name, dest string, opts *webdav
 	return f.inner.Copy(ctx, name, dest, opts)
 }
 func (f *webdavAuthFS) Move(ctx context.Context, name, dest string, opts *webdav.MoveOptions) (bool, error) {
-	if err := f.allow(name, auth.Write); err != nil {
+	if err := f.allow(name, auth.Delete); err != nil {
+		return false, err
+	}
+	if err := f.checkTree(ctx, name, auth.Delete); err != nil {
 		return false, err
 	}
 	parent := path.Dir(strings.Trim(dest, "/"))
@@ -868,6 +877,27 @@ func (f *webdavAuthFS) Move(ctx context.Context, name, dest string, opts *webdav
 	return f.inner.Move(ctx, name, dest, opts)
 }
 
+func (f *webdavAuthFS) checkTree(ctx context.Context, name string, p auth.PermMask) error {
+	info, err := f.inner.Stat(ctx, name)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir {
+		return nil
+	}
+	items, err := f.inner.ReadDir(ctx, name, true)
+	if err != nil {
+		return err
+	}
+	for _, item := range items {
+		itemPath := strings.Trim(item.Path, "/")
+		if err := f.allow(itemPath, p); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (s *Server) ipFilter(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if s.Allow != "" && !allowedIP(s.Allow, clientIP(r)) {