append: only allow with reflink or !dedup;

un-dedup of target file is likely too expensive, and
relying on up2k.db to do it conditionally too dangerous

copyparty/authsrv.py

@@ -2650,6 +2650,13 @@ class AuthSrv(object):
                 self.log(t, 1)
                 raise Exception(t)
 
+            if (
+                "dedup" in vol.flags
+                and "reflink" not in vol.flags
+                and vol.flags["apnd_who"] != "no"
+            ):
+                vol.flags["apnd_who"] = "ndd"
+
             # verify tags mentioned by -mt[mp] are used by -mte
             local_mtp = {}
             local_only_mtp = {}

copyparty/httpcli.py

@@ -2553,6 +2553,8 @@ class HttpCli(object):
                 or (zs == "dw" and self.can_delete)
             ):
                 pass
+            elif zs == "ndd":
+                raise Pebkac(400, "append is denied here due to non-reflink dedup")
             else:
                 raise Pebkac(400, "you do not have permission to append")
             zs = os.path.join(params["fdir"], fn)