https://gitlab.synchro.net/main/sbbs/-/commit/72303693ef1b8dc2c11ff006
Modified Files:
docs/v322_new.md src/sbbs3/websrvr.cpp
Log Message:
websrvr: enforce download credits for unauthenticated file requests

An anonymous request through the file-area virtual path
(FileVPathPrefix) was authorized by user_can_download() alone, with no
credit check, so every file in a directory with empty ARS downloaded
free of charge regardless of its cost. The FTP server applies the
credit gate to anonymous users, and issue #446 was closed with that
being the intended policy.

Both authorization paths now share check_file_download(), which applies
the credit gate before the ARS check. Putting the two callers on one
predicate is the point of the helper: the bypass existed because the
anonymous branch and the authenticated one had drifted apart.

The gate measures cost against user_available_credits() rather than
user.cdt, so a user's free credits now count toward a download, as they
already do on the Terminal and FTP servers, and as subtract_cdt()
already assumed when charging: it spends free credits first.

A refused anonymous request is logged at LOG_DEBUG. An insufficient
credit refusal now reports NotEnoughCredits; both this and the existing authenticated failure log previously reported CantDownloadFromDir for
it, naming the wrong cause.

Fixes #1192

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net