refactor: flatten repository structure to root and archive research notes

internal/api/path_security_test.go

@@ -0,0 +1,42 @@
+package api
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestCheckDeleteTreeRejectsDeniedDescendant(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "public", "private"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "public", "private", "secret.txt"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	store := storage.Local{Root: root}
+	account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{{Dir: "public/private", Mask: auth.None}}}
+	if err := checkDeleteTree(store, account, "public"); err == nil {
+		t.Fatal("expected denied descendant to block recursive deletion")
+	}
+}
+
+func TestUnsafePath(t *testing.T) {
+	cases := map[string]bool{
+		"../secret":     true,
+		"a/../secret":   true,
+		`..\\secret`:    true,
+		"%2e%2e/secret": false,
+		"secret":        false,
+		"a//b":          false,
+		"":              false,
+	}
+	for p, want := range cases {
+		if got := unsafePath(p); got != want {
+			t.Fatalf("unsafePath(%q)=%v, want %v", p, got, want)
+		}
+	}
+}