feat: enforce folder download policy

chfs-ng/internal/api/folder_download_test.go

@@ -0,0 +1,55 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestFolderDownloadModes(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "parent", "child"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for _, p := range []string{
+		filepath.Join(root, "parent", "a.txt"),
+		filepath.Join(root, "parent", "child", "b.txt"),
+	} {
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mk := func(mode string) *Server {
+		return &Server{
+			Store: storage.Local{Root: root},
+			Auth: &auth.Manager{
+				Accounts: map[string]*auth.Account{},
+				Guest:    &auth.Account{Mask: auth.Read | auth.Write | auth.Delete},
+			},
+			FolderDownload: mode,
+		}
+	}
+	for _, tc := range []struct {
+		mode, path string
+		want       int
+	}{
+		{"disable", "parent", http.StatusForbidden},
+		{"leaf", "parent", http.StatusForbidden},
+		{"leaf", "parent/child", http.StatusOK},
+		{"enable", "parent", http.StatusOK},
+	} {
+		t.Run(tc.mode+"-"+tc.path, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/chfs/downloaddir/"+tc.path, nil)
+			w := httptest.NewRecorder()
+			mk(tc.mode).Handler().ServeHTTP(w, req)
+			if w.Code != tc.want {
+				t.Fatalf("status=%d want=%d body=%s", w.Code, tc.want, w.Body.String())
+			}
+		})
+	}
+}