mkdir: return 403 error for mkdir action in the root dir

src/backend/src/filesystem/hl_operations/hl_mkdir.js

@@ -275,11 +275,20 @@ class HLMkdir extends HLFilesystemOperation {
         console.log('USING PARENT', parent_node.selector.describe());
         let target_basename = _path.basename(values.path);
 
+        // "top_parent" is the immediate parent of the target directory
+        // (e.g: /home/foo/bar -> /home/foo)
         const top_parent = values.create_missing_parents
             ? await this._create_top_parent({ top_parent: parent_node })
             : await this._get_existing_top_parent({ top_parent: parent_node })
             ;
 
+        if ( top_parent.isRoot ) {
+            // root directory is read-only
+            throw APIError.create('forbidden', null, {
+                message: 'Cannot create directories in the root directory.'
+            });
+        }
+
         // `parent_node` becomes the parent of the last directory name
         // specified under `path`.
         parent_node = await this._create_parents({