Function authorize_listing 

pub fn authorize_listing(
    config: &Config,
    grants: &ResolvedGrants,
    requested: &Path,
) -> Option<ListingAuthorization>

Authorize a listing and report the boundary enumeration must be bound to.

None refuses. Returning the boundary rather than a bare bool is what lets the handler enumerate through a directory handle opened beneath the approved root: re-walking the pathname after this check would let a writable component be swapped for a link to another directory in between, exposing names the principal may not read.

The request is resolved once, up front, and the same canonical target is used for the readability check, the approved-root selection, and (via the returned value) the enumeration itself. Passing the raw request to approved_read_root while checking readability on a separately resolved target is the alias-swap escape this guards against.