fix: align CHFS directory rule inheritance

chfs-ng/internal/api/server.go

@@ -190,7 +190,7 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
 				}
 			}
 		}
-		out = append(out, fileInfo{Name: fi.Name(), Path: fp, Size: fi.Size(), Modified: originalTime(fi.ModTime()), Dir: fi.IsDir(), Mask: permString(a.MaskFor(fp)), GuestMask: permString(s.Auth.Guest.MaskFor(fp)), HasSubDir: sub, Icon: iconFor(fi)})
+		out = append(out, fileInfo{Name: fi.Name(), Path: fp, Size: fi.Size(), Modified: originalTime(fi.ModTime()), Dir: fi.IsDir(), Mask: permString(a.MaskForEntry(fp)), GuestMask: permString(s.Auth.Guest.MaskForEntry(fp)), HasSubDir: sub, Icon: iconFor(fi)})
 	}
 	virtual := p == "" && s.MultiRoot
 	writeJSON(w, map[string]any{"files": out, "currentMask": permString(m), "virtualRoot": virtual})
@@ -483,7 +483,7 @@ func (s *Server) search(w http.ResponseWriter, r *http.Request) {
 				continue
 			}
 			if needle == "" || strings.Contains(strings.ToLower(fi.Name()), needle) {
-				out = append(out, fileInfo{Name: fi.Name(), Path: "/" + strings.Trim(p, "/"), Size: fi.Size(), Modified: originalTime(fi.ModTime()), Dir: fi.IsDir(), Mask: permString(a.MaskFor(p)), GuestMask: permString(s.Auth.Guest.MaskFor(p)), HasSubDir: false, Icon: iconFor(fi)})
+				out = append(out, fileInfo{Name: fi.Name(), Path: "/" + strings.Trim(p, "/"), Size: fi.Size(), Modified: originalTime(fi.ModTime()), Dir: fi.IsDir(), Mask: permString(a.MaskForEntry(p)), GuestMask: permString(s.Auth.Guest.MaskForEntry(p)), HasSubDir: false, Icon: iconFor(fi)})
 			}
 			if fi.IsDir() {
 				if err := walk(p); err != nil {

chfs-ng/internal/auth/auth.go

@@ -89,6 +89,18 @@ func (m *Manager) Authenticate(user, pwd string) *Account {
 	return nil
 }
 func (a *Account) MaskFor(path string) PermMask {
+	return a.maskFor(path, false)
+}
+
+// MaskForEntry returns the permission shown for a directory/file while its
+// parent directory is being listed. CHFS section rules rule.r/rule.w/rule.d
+// affect the contents of the named directory, but the directory entry itself
+// keeps the inherited permission until it is opened.
+func (a *Account) MaskForEntry(path string) PermMask {
+	return a.maskFor(path, true)
+}
+
+func (a *Account) maskFor(path string, entry bool) PermMask {
 	path = strings.Trim(path, "/")
 	best := -1
 	mask := a.Mask
@@ -97,7 +109,7 @@ func (a *Account) MaskFor(path string) PermMask {
 		if !matchPath(d, path) {
 			continue
 		}
-		if r.ChildrenOnly && matchPathExact(d, path) {
+		if entry && r.ChildrenOnly && matchPathExact(d, path) {
 			continue
 		}
 		if len(d) > best {

chfs-ng/internal/auth/rules_test.go

@@ -14,9 +14,9 @@ func TestPathRuleSemantics(t *testing.T) {
 		{"", "R"},
 		{"private", ""},
 		{"private/x.txt", ""},
-		{"share", "R"},
+		{"share", "RW"},
 		{"share/x.txt", "RW"},
-		{"drop", "R"},
+		{"drop", "RWD"},
 		{"drop/x.txt", "RWD"},
 		{"public/x.txt", "R"},
 		{"public/sub/x.txt", "R"},