- feat: cross-user file access returns not-found instead of
permission-denied
- fix: repository delete now only affects active rows and returns
ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
assert not-found behavior for cross-user and missing file operations
File repository now filters by status=active in all query methods (FindByID, FindByUserID, FindByParentID, FindByNameAndParent).
Delete now performs soft-delete by setting status to 'user_deleted' instead of physical row deletion.
Add ListIncludeDeleted to UserRepository for admin views of all users.
Add tests: StatusFilter, SoftDelete, DeleteIdempotent, StatusFilterCount.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Add GORM dependencies for SQLite and PostgreSQL
- Create domain models (User, Session, File) with common errors
- Implement repository interfaces and database layer with migrations
- Update WebApp to bootstrap with database and repositories
- Add comprehensive unit tests for repository methods
- Update config structure to support multiple database drivers
- Extend AGENTS.md with debugging principles and dependency rules
ld