Function TestWritePermissionCombinations

server/common/check_test.go:617–950

TestWritePermissionCombinations tests the combined permission check logic that is actually used in the codebase: if !user.CanWriteContent() && !CanWriteContentBypassUserPerms(meta, path) { deny } if !CanWrite(user, meta, path) { deny } This ensures the three-layer permission system w

(t *testing.T)

// 2. Meta-level global write permission (CanWriteContentBypassUserPerms)
// 3. Meta-level user whitelist (CanWrite)
func TestWritePermissionCombinations(t *testing.T) {
	tests := []struct {
		name               string
		user               *model.User
		meta               *model.Meta
		path               string
		want               bool
		reason             string
		checkFirstLayer    bool // whether first layer should pass
		checkSecondLayer   bool // whether second layer should pass
		expectedDenyReason string
	}{
		// === Scenario 1: User has global write permission ===
		{
			name: "user has CanWriteContent + in WriteUsers whitelist",
			user: &model.User{
				ID:         1,
				Permission: 1 << 3, // CanWriteContent = true
			},
			meta: &model.Meta{
				Path:          "/folder",
				Write:         false,
				WriteUsers:    []uint{1},
				WriteUsersSub: false,
			},
			path:               "/folder",
			want:               true,
			reason:             "user has global write permission AND is in whitelist",
			checkFirstLayer:    true,
			checkSecondLayer:   true,
			expectedDenyReason: "",
		},
		{
			name: "user has CanWriteContent but NOT in WriteUsers whitelist",
			user: &model.User{
				ID:         1,
				Permission: 1 << 3, // CanWriteContent = true
			},
			meta: &model.Meta{
				Path:          "/folder",
				Write:         false,
				WriteUsers:    []uint{2, 3}, // user 1 not in list
				WriteUsersSub: false,
			},
			path:               "/folder",
			want:               false,
			reason:             "even with global write permission, must pass whitelist check",
			checkFirstLayer:    true,
			checkSecondLayer:   false,
			expectedDenyReason: "whitelist check failed",
		},

		// === Scenario 2: User lacks global permission but meta.Write=true ===
		{
			name: "no CanWriteContent + meta.Write=true + in WriteUsers",
			user: &model.User{
				ID:         1,
				Permission: 0, // CanWriteContent = false