fix: API rename was not always returning proper error status based on permission
Massimo Melina committed
Jan 17, 2026 at 10:23 UTC
c0e85bb2990b3dd424528f1f3e94e42c53b8d0c7
2 files changed
+3
-3
src/frontEndApis.ts
+2
-2
@@ -88,8 +88,8 @@ export const frontEndApis: ApiHandlers = {
88
throw new ApiError(HTTP_NOT_FOUND)
89
if (isRoot(node) || dest.includes('/') || hasDirTraversal(dest))
90
throw new ApiError(HTTP_FORBIDDEN)
91
- if (!hasPermission(node, 'can_delete', ctx))
92
- throw new ApiError(HTTP_UNAUTHORIZED)
91
+ if (statusCodeForMissingPerm(node, 'can_delete', ctx))
92
+ throw new ApiError(ctx.status)
93
try {
94
if (!node.source)
95
throw new ApiError(HTTP_FAILED_DEPENDENCY)
tests/test.ts
+1
-1
@@ -206,7 +206,7 @@ describe('basics', () => {
206
test('create_folder.bad type', reqApi('create_folder', { uri: UPLOAD_ROOT, name: 123 }, { status: 400, re: /name/ }))
207
test('delete.no perm', req('/for-admins/', 405, { method: 'delete' }))
208
test('delete.need account', req(UPLOAD_ROOT + 'alfa.txt', 401, { method: 'delete'}))
209
- test('rename.no perm', reqApi('rename', { uri: '/for-admins', dest: 'any' }, 401))
209
+ test('rename.no perm', reqApi('rename', { uri: '/for-admins', dest: 'any' }, 403))
210
test('of_disabled.cantLogin', () => login('of_disabled').then(() => { throw "in" }, () => {}))
211
test('allow_net.canLogin', () => login(username))
212
test('allow_net.cantLogin', () => {