security: harden WebDAV overwrite and multi-root routing

chfs-ng/internal/api/webdav_test.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -37,6 +38,42 @@ func TestWebDAVAuthFSCheckTree(t *testing.T) {
 	}
 }
 
+func TestWebDAVAuthFSOverwriteRequiresDelete(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "src.txt"), []byte("src"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "dst.txt"), []byte("dst"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	account := &auth.Account{Mask: auth.Write}
+	fs := &webdavAuthFS{inner: webdav.LocalFileSystem(root), account: account}
+	if err := fs.authorizeOverwrite(context.Background(), "/dst.txt"); err == nil {
+		t.Fatal("expected overwrite authorization to require delete permission")
+	}
+	account.Mask = auth.Delete
+	if err := fs.authorizeOverwrite(context.Background(), "/dst.txt"); err != nil {
+		t.Fatalf("delete permission should authorize overwrite: %v", err)
+	}
+}
+
+func TestSameWebDAVDestinationHost(t *testing.T) {
+	req := httptest.NewRequest("MOVE", "/webdav/src.txt", nil)
+	req.Host = "example.test"
+	req.Header.Set("Destination", "http://other.test/webdav/dst.txt")
+	if sameWebDAVDestinationHost(req) {
+		t.Fatal("cross-host destination should be rejected")
+	}
+	req.Header.Set("Destination", "http://example.test/webdav/dst.txt")
+	if !sameWebDAVDestinationHost(req) {
+		t.Fatal("same-host absolute destination should be accepted")
+	}
+	req.Header.Set("Destination", "/webdav/dst.txt")
+	if !sameWebDAVDestinationHost(req) {
+		t.Fatal("relative destination should be accepted")
+	}
+}
+
 func TestWebDAVStorageFSCopyAndMove(t *testing.T) {
 	root1 := t.TempDir()
 	root2 := t.TempDir()