fix: enforce group file upload governance

server/hdl_files.go

@@ -518,9 +518,22 @@ func authorizeUploadTopicLink(tenantID types.TenantID, uid types.Uid, topic stri
 	if !sub.ModeWant.IsReader() || !sub.ModeGiven.IsReader() {
 		return types.ErrPermissionDenied
 	}
+	if types.GetTopicCat(topic) == types.TopicCatGrp {
+		settings, err := store.GroupBusiness.GetSettings(tenantID, topic)
+		if err != nil {
+			return err
+		}
+		if settings != nil && !canUploadGroupFile(settings, sub.ModeGiven) {
+			return types.ErrPermissionDenied
+		}
+	}
 	return nil
 }
 
+func canUploadGroupFile(settings *types.GroupSettings, mode types.AccessMode) bool {
+	return settings == nil || settings.MemberUploadFiles || mode.IsAdmin()
+}
+
 func authorizeLargeFileDownload(tenantID types.TenantID, uid types.Uid, rawURL string, fd *types.FileDef) error {
 	if fd == nil {
 		return types.ErrNotFound

server/hdl_files_test.go

@@ -52,6 +52,23 @@ func (h *testLargeFileMediaHandler) GetIdFromUrl(string) types.Uid {
 	return h.fid
 }
 
+func TestCanUploadGroupFileHonorsGovernance(t *testing.T) {
+	settings := &types.GroupSettings{MemberUploadFiles: false}
+	if canUploadGroupFile(settings, types.ModeRead|types.ModeWrite) {
+		t.Fatal("ordinary member must not upload when group files are admin-only")
+	}
+	if !canUploadGroupFile(settings, types.ModeRead|types.ModeApprove) {
+		t.Fatal("group admin must be allowed to upload when group files are admin-only")
+	}
+	settings.MemberUploadFiles = true
+	if !canUploadGroupFile(settings, types.ModeRead|types.ModeWrite) {
+		t.Fatal("ordinary member must be allowed when group files are open to all")
+	}
+	if !canUploadGroupFile(nil, types.ModeRead|types.ModeWrite) {
+		t.Fatal("groups without business settings must retain the default allow behavior")
+	}
+}
+
 func TestLargeFileUploadPreflightAllowsPost(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()