mirror of
https://github.com/sol1/rustguac.git
synced 2026-09-10 09:35:45 +00:00
Dave Kempe
89129a54b5
Closes #147. ab_list_subfolders checked access to the parent folder but then returned every subfolder unfiltered, so a user who could open a parent saw all of its children regardless of per-child group ACLs - clicking one they weren't entitled to gave "no access". (Top-level folders were already filtered; this was the subfolder gap.) Subfolders are now filtered per child. A folder is shown if the user can access it directly OR can access any descendant of it, so a deeper grant (child with its own allowed_groups and inherit_from_parent=false under a denied folder) is never orphaned out of the tree. Admins still see all. New folder_or_descendant_accessible helper does the recursive (boxed async) OR over resolve_folder_access, short-circuiting on the first accessible folder. No Vault mock harness exists to unit-test the Vault-backed path; verified via build + the logic being a thin recursive wrapper over the already-shipping resolve_folder_access. docs/roles-and-access-control.md gains explicit notes that inaccessible folders are hidden (not shown-then-denied) at every level, the descendant-visibility rule, and how inheritance interacts.