fix: hide denied entries in CHFS listings

chfs-ng/internal/auth/rules_test.go

@@ -9,6 +9,7 @@ func TestPathRuleSemantics(t *testing.T) {
 		{Dir: "share", Mask: ParseMask("w"), ChildrenOnly: true},
 		{Dir: "drop", Mask: ParseMask("d"), ChildrenOnly: true},
 		{Dir: "pub*", Mask: ParseMask("r")},
+		{Dir: "team/?", Mask: ParseMask("w")},
 	}
 	cases := []struct{ path, want string }{
 		{"", "R"},
@@ -20,6 +21,42 @@ func TestPathRuleSemantics(t *testing.T) {
 		{"drop/x.txt", "RWD"},
 		{"public/x.txt", "R"},
 		{"public/sub/x.txt", "R"},
+		{"team/a", "RW"},
+		{"team/ab", "R"},
+	}
+	for _, tc := range cases {
+		if got := permStringForTest(a.MaskFor(tc.path)); got != tc.want {
+			t.Errorf("MaskFor(%q)=%q want %q", tc.path, got, tc.want)
+		}
+	}
+	entryCases := []struct{ path, want string }{
+		{"private", ""},
+		{"share", "R"},
+		{"drop", "R"},
+		{"public", "R"},
+		{"team/a", "RW"},
+	}
+	for _, tc := range entryCases {
+		if got := permStringForTest(a.MaskForEntry(tc.path)); got != tc.want {
+			t.Errorf("MaskForEntry(%q)=%q want %q", tc.path, got, tc.want)
+		}
+	}
+}
+
+func TestMoreSpecificRuleWins(t *testing.T) {
+	a := &Account{Mask: ParseMask("r")}
+	a.Rules = []PathRule{
+		{Dir: "share", Mask: ParseMask("w"), ChildrenOnly: true},
+		{Dir: "share/private", Deny: true},
+		{Dir: "share/public*", Mask: ParseMask("r")},
+	}
+	cases := []struct{ path, want string }{
+		{"share", "RW"},
+		{"share/file.txt", "RW"},
+		{"share/private", ""},
+		{"share/private/file.txt", ""},
+		{"share/public", "R"},
+		{"share/public/file.txt", "R"},
 	}
 	for _, tc := range cases {
 		if got := permStringForTest(a.MaskFor(tc.path)); got != tc.want {