fix: preserve composite permissions in account rules

chfs-ng/cmd/chfs/main.go

@@ -73,10 +73,10 @@ func main() {
 			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.Read, ChildrenOnly: true})
 		}
 		for _, d := range ac.Write {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.Write, ChildrenOnly: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.ParseMask("w"), ChildrenOnly: true})
 		}
 		for _, d := range ac.Delete {
-			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.Delete, ChildrenOnly: true})
+			a.Rules = append(a.Rules, auth.PathRule{Dir: d, Mask: auth.ParseMask("d"), ChildrenOnly: true})
 		}
 		if ac.Username == "guest" {
 			mgr.Guest = a

chfs-ng/internal/auth/rules_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import "testing"
+
+func TestPathRuleSemantics(t *testing.T) {
+	a := &Account{Mask: ParseMask("r")}
+	a.Rules = []PathRule{
+		{Dir: "private", Deny: true},
+		{Dir: "share", Mask: ParseMask("w"), ChildrenOnly: true},
+		{Dir: "drop", Mask: ParseMask("d"), ChildrenOnly: true},
+		{Dir: "pub*", Mask: ParseMask("r")},
+	}
+	cases := []struct{ path, want string }{
+		{"", "R"},
+		{"private", ""},
+		{"private/x.txt", ""},
+		{"share", "R"},
+		{"share/x.txt", "RW"},
+		{"drop", "R"},
+		{"drop/x.txt", "RWD"},
+		{"public/x.txt", "R"},
+		{"public/sub/x.txt", "R"},
+	}
+	for _, tc := range cases {
+		if got := permStringForTest(a.MaskFor(tc.path)); got != tc.want {
+			t.Errorf("MaskFor(%q)=%q want %q", tc.path, got, tc.want)
+		}
+	}
+}
+
+func permStringForTest(p PermMask) string {
+	if p.HasDelete() {
+		return "RWD"
+	}
+	if p.HasWrite() {
+		return "RW"
+	}
+	if p.HasRead() {
+		return "R"
+	}
+	return ""
+}