Create named subdirectories for new repositories

internal/model/validate.go

@@ -166,6 +166,12 @@ func ValidateRepository(r Repository) error {
 		if r.Mount.Remote == "" || !filepath.IsAbs(r.Mount.MountPoint) {
 			return errors.New("managed mount requires remote and absolute mountPoint")
 		}
+		location := filepath.Clean(r.Location)
+		mountPoint := filepath.Clean(r.Mount.MountPoint)
+		relative, err := filepath.Rel(mountPoint, location)
+		if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+			return errors.New("managed repository location must be inside mountPoint")
+		}
 	}
 	if r.Type == RepositorySFTP && r.CredentialRef != "" {
 		knownHosts := r.Options["knownHostsPath"]

internal/model/validate_test.go

@@ -79,3 +79,14 @@ func TestRetentionRequiresAtLeastOneRule(t *testing.T) {
 		t.Fatalf("age retention rejected: %v", err)
 	}
 }
+
+func TestManagedRepositoryLocationMustRemainInsideMountPoint(t *testing.T) {
+	repo := Repository{SchemaVersion: 1, ID: "repo", Name: "NAS", Type: RepositorySMB, Location: "/mnt/remotes/nas/NAS", PasswordRef: "password", Mount: &MountConfig{Managed: true, Remote: "//nas/backups", MountPoint: "/mnt/remotes/nas"}}
+	if err := ValidateRepository(repo); err != nil {
+		t.Fatalf("repository subdirectory rejected: %v", err)
+	}
+	repo.Location = "/mnt/remotes/other/NAS"
+	if err := ValidateRepository(repo); err == nil {
+		t.Fatal("repository location outside mountPoint accepted")
+	}
+}