From 58ba7c716e90d09b11b96cbd0a5a4161a63de995 Mon Sep 17 00:00:00 2001
From: OpenClaw Agent <openclaw@example.com>
Date: Tue, 22 Sep 2026 00:18:22 +0800
Subject: [PATCH] test: verify folder download archive contents

---
 chfs-ng/internal/api/folder_download_test.go | 45 ++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/chfs-ng/internal/api/folder_download_test.go b/chfs-ng/internal/api/folder_download_test.go
index 0c88518..3318d5a 100644
--- a/chfs-ng/internal/api/folder_download_test.go
+++ b/chfs-ng/internal/api/folder_download_test.go
@@ -1,10 +1,14 @@
 package api
 
 import (
+	"archive/zip"
+	"bytes"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"
 
 	"chfs-ng/internal/auth"
@@ -53,3 +57,44 @@ func TestFolderDownloadModes(t *testing.T) {
 		})
 	}
 }
+
+func TestFolderDownloadZipContainsOnlyReadableFiles(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "parent", "child"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "parent", "a.txt"), []byte("A"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "parent", "child", "b.txt"), []byte("B"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{Store: storage.Local{Root: root}, Auth: &auth.Manager{Accounts: map[string]*auth.Account{}, Guest: &auth.Account{Mask: auth.Read | auth.Write | auth.Delete}}, FolderDownload: "enable"}
+	r := httptest.NewRequest(http.MethodGet, "/chfs/downloaddir/parent", nil)
+	w := httptest.NewRecorder()
+	s.Handler().ServeHTTP(w, r)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d", w.Code)
+	}
+	zr, err := zip.NewReader(bytes.NewReader(w.Body.Bytes()), int64(w.Body.Len()))
+	if err != nil {
+		t.Fatalf("invalid zip: %v", err)
+	}
+	got := map[string]string{}
+	for _, f := range zr.File {
+		body, err := f.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		b, err := io.ReadAll(body)
+		body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		got[f.Name] = string(b)
+	}
+	want := map[string]string{"a.txt": "A", "child/b.txt": "B"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("zip entries=%#v want=%#v", got, want)
+	}
+}