- feat: cross-user file access returns not-found instead of
permission-denied
- fix: repository delete now only affects active rows and returns
ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
assert not-found behavior for cross-user and missing file operations
enforcement
- test: cover authenticated register, login, upload, list, and download
flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
tokens
- test: verify cross-user ownership isolation for all file CRUD
operations
- refactor: rename test-only header constant to clarify it is not used
in production
- test: exercise register, login, empty listing, small-file upload, updated listing, and authenticated download through the HTTP router.
- docs: mark the small-file integration flow as covered in the server roadmap.
- docs: move server docs to docs/server/ and update all cross-references
- docs: move web-roadmap.md to docs/web/roadmap.md and create
docs/web/decisions.md
- docs: update AGENTS.md with separate Server and Web sections
ld