update sync

apps/server/internal/httpserver/permissions_handlers.go

@@ -359,8 +359,30 @@ func (s *Server) canWriteNewDocument(r *http.Request, pagePath string) bool {
 	if principal.Role == auth.RoleAdmin {
 		return true
 	}
-	folder := strings.TrimSuffix(pagePath, "/"+lastPathSegment(pagePath))
-	return s.canWriteFolder(r, folder)
+	return s.canWriteFolder(r, documentFolder(pagePath))
+}
+
+func (s *Server) canReadNewDocument(r *http.Request, pagePath string) bool {
+	principal, ok := principalFromContext(r.Context())
+	if !ok {
+		return false
+	}
+	if principal.Role == auth.RoleAdmin {
+		return true
+	}
+	return s.canReadFolder(r, documentFolder(pagePath))
+}
+
+func (s *Server) canReadFolder(r *http.Request, folder string) bool {
+	principal, ok := principalFromContext(r.Context())
+	if !ok {
+		return false
+	}
+	if principal.Role == auth.RoleAdmin {
+		return true
+	}
+	permission, err := s.auth.EffectiveResourcePermission(r.Context(), principal, auth.ResourceFolder, folder, nil)
+	return err == nil && auth.PermissionAllows(permission, auth.PermissionRead)
 }
 
 func (s *Server) canWriteFolder(r *http.Request, folder string) bool {
@@ -395,6 +417,15 @@ func lastPathSegment(path string) string {
 	return parts[len(parts)-1]
 }
 
+func documentFolder(path string) string {
+	trimmed := strings.Trim(path, "/")
+	segment := lastPathSegment(trimmed)
+	if segment == "" || segment == trimmed {
+		return ""
+	}
+	return strings.TrimSuffix(trimmed, "/"+segment)
+}
+
 func queryEscape(value string) string {
 	return strings.NewReplacer("%", "%25", " ", "%20", "?", "%3F", "&", "%26", "=", "%3D", "#", "%23").Replace(value)
 }