feat: per path modify permissions (#57)

lib/user.go

@@ -11,6 +11,7 @@ import (
 type Rule struct {
 	Regex  bool
 	Allow  bool
+	Modify bool
 	Path   string
 	Regexp *regexp.Regexp
 }
@@ -26,23 +27,24 @@ type User struct {
 }
 
 // Allowed checks if the user has permission to access a directory/file
-func (u User) Allowed(url string) bool {
+func (u User) Allowed(url string, noModification bool) bool {
 	var rule *Rule
 	i := len(u.Rules) - 1
 
 	for i >= 0 {
 		rule = u.Rules[i]
 
+		isAllowed := rule.Allow && (noModification || rule.Modify)
 		if rule.Regex {
 			if rule.Regexp.MatchString(url) {
-				return rule.Allow
+				return isAllowed
 			}
 		} else if strings.HasPrefix(url, rule.Path) {
-			return rule.Allow
+			return isAllowed
 		}
 
 		i--
 	}
 
-	return true
+	return noModification || u.Modify
 }

lib/webdav.go

@@ -102,7 +102,9 @@ func (c *Config) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Checks for user permissions relatively to this PATH.
-	if !u.Allowed(r.URL.Path) {
+	noModification := r.Method == "GET" || r.Method == "HEAD" ||
+		r.Method == "OPTIONS" || r.Method == "PROPFIND"
+	if !u.Allowed(r.URL.Path, noModification) {
 		w.WriteHeader(http.StatusForbidden)
 		return
 	}
@@ -111,15 +113,6 @@ func (c *Config) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		w = newResponseWriterNoBody(w)
 	}
 
-	// If this request modified the files and the user doesn't have permission
-	// to do so, return forbidden.
-	if (r.Method == "PUT" || r.Method == "POST" || r.Method == "MKCOL" ||
-		r.Method == "DELETE" || r.Method == "COPY" || r.Method == "MOVE") &&
-		!u.Modify {
-		w.WriteHeader(http.StatusForbidden)
-		return
-	}
-
 	// Excerpt from RFC4918, section 9.4:
 	//
 	// 		GET, when applied to a collection, may return the contents of an