Deploy from markdownfs@1a8d486

src/auth/session.rs

@@ -1,5 +1,5 @@
 use super::perms::{check_permission, Access};
-use super::{Gid, Uid, ROOT_UID};
+use super::{Gid, Uid, ROOT_UID, WHEEL_GID};
 use crate::fs::inode::Inode;
 
 /// Context for the user an agent is acting on behalf of.
@@ -105,10 +105,29 @@ impl Session {
         }
     }
 
+    /// Whether the principal is a wheel-group member (admin-equivalent).
+    pub fn is_wheel(&self) -> bool {
+        self.groups.contains(&WHEEL_GID)
+    }
+
+    /// Whether the session may bypass per-file Read checks (i.e., see every
+    /// directory entry and read every file). True for literal uid=0 or any
+    /// wheel-group member. Privileged write ops (chmod-across-owner,
+    /// chown-uid) still go through the stricter `is_effectively_root` check.
+    /// When delegating, the delegate must also be admin-equivalent.
+    pub fn can_read_anywhere(&self) -> bool {
+        let principal_admin = self.uid == ROOT_UID || self.is_wheel();
+        if !principal_admin {
+            return false;
+        }
+        match &self.delegate {
+            Some(d) => d.uid == ROOT_UID || d.groups.contains(&WHEEL_GID),
+            None => true,
+        }
+    }
+
     /// Whether either the principal or (if delegating) the delegate is root.
-    /// For intersection: both must pass, so root status only helps if the OTHER side passes.
-    /// This is used for checks like "is this session effectively root?" — answer: only if
-    /// there's no delegate constraining it.
+    /// Strict: only literal uid=0 qualifies. Used by privileged write ops.
     pub fn is_effectively_root(&self) -> bool {
         if self.uid != ROOT_UID {
             return false;

src/db.rs

@@ -683,7 +683,13 @@ impl MarkdownDb {
             .map(|u| u.groups[0])
             .unwrap_or(0);
         let home = format!("/home/{name}");
+        let already_exists = guard.fs.stat(&home).is_ok();
         let _ = guard.fs.mkdir_p(&home, uid, gid);
+        // If the home directory was orphaned by a prior user with the same
+        // name (and a now-stale uid), reclaim it for the new account.
+        if already_exists {
+            let _ = guard.fs.chown(&home, uid, gid);
+        }
         // Lock the home dir down: only the owner can list/enter it.
         let _ = guard.fs.chmod(&home, 0o700);
         drop(guard);

src/fs/mod.rs

@@ -1250,6 +1250,9 @@ impl VirtualFs {
             Some(s) => s,
             None => return true,
         };
+        if session.can_read_anywhere() {
+            return self.get_inode(id).is_ok();
+        }
         let inode = match self.get_inode(id) {
             Ok(i) => i,
             Err(_) => return false,

src/server/perms.rs

@@ -23,7 +23,9 @@ pub async fn require_perm(
     path: &str,
     access: Access,
 ) -> Result<bool, VfsError> {
-    if session.is_effectively_root() {
+    if session.is_effectively_root()
+        || (matches!(access, Access::Read | Access::Execute) && session.can_read_anywhere())
+    {
         return Ok(db.stat(path).await.is_ok());
     }
     match db.stat(path).await {

src/server/routes_fs.rs

@@ -86,6 +86,7 @@ async fn get_fs_root(State(state): State<AppState>, headers: HeaderMap) -> impl
                 .into_iter()
                 .filter(|e| {
                     session.is_effectively_root()
+                        || session.can_read_anywhere()
                         || session.has_permission_bits(e.mode, e.uid, e.gid, Access::Read)
                 })
                 .collect();

tests/permissions/main.rs

@@ -55,7 +55,7 @@ fn try_run(line: &str, fs: &mut VirtualFs, session: &mut Session) -> Result<Stri
 ///
 /// Users:
 ///   - root (uid=0) — superuser
-///   - alice (uid=1) — member of: alice, engineering, wheel
+///   - alice (uid=1) — member of: alice, engineering (regular user; wheel = admin)
 ///   - bob (uid=2) — member of: bob, engineering
 ///   - carol (uid=3) — member of: carol, finance
 ///   - agent-x (uid=4) — agent, member of: agent-x, engineering
@@ -75,7 +75,6 @@ fn setup() -> (VirtualFs, Session, Session, Session, Session, Session) {
 
     // Group memberships
     run("usermod -aG engineering alice", &mut fs, &mut root);
-    run("usermod -aG wheel alice", &mut fs, &mut root);
     run("usermod -aG engineering bob", &mut fs, &mut root);
     run("usermod -aG finance carol", &mut fs, &mut root);
     run("usermod -aG engineering agent-x", &mut fs, &mut root);