docs: restructure server and web documentation into ADR files and a

routing table
2026-07-17 22:07:55 +08:00
parent f8494a44ca
commit 519aa35f1f
23 changed files with 710 additions and 654 deletions
@@ -0,0 +1,22 @@
+# ADR-0006: Conceal File Ownership Boundaries
+
+Status: Accepted  
+Date: 2026-07-15
+
+## Context
+
+Authenticated callers must not infer the existence of files owned by another user from status codes or response messages.
+
+## Decision
+
+- Map missing, deleted, and cross-user file targets to the same not-found result.
+- Apply the same rule to parent-directory lookups.
+- Return success for one deletion of an active owned file.
+- Return not found for repeated deletion and cross-user deletion.
+- Guard soft deletion with ownership and active-state predicates.
+
+## Consequences
+
+- File responses conceal resource ownership from other authenticated users.
+- The first successful deletion returns `204 No Content`; later attempts return `404 Not Found`.
+- Non-empty directory deletion continues to return a conflict.