Fixed admins being able to see all directories.

Backend/Main.py

@@ -318,9 +318,10 @@ def PutGroupMembersEndpoint(
 
 
 # --- Locked files/directories -----------------------------------------------
-# Setting a lock is open to anyone who currently has access to the path —
+# Setting a lock is open to anyone who currently has access to the path -
 # not admin-only. If you can see it, you're trusted to decide who else can.
-# Admins additionally bypass every lock (see Locks.IsPathAccessible).
+# Admins do NOT bypass locks (see Locks.IsPathAccessible) - Admin is a
+# management group, not a way to view everyone's private directories.
 
 
 @Application.get("/api/lock")
@@ -384,7 +385,6 @@ def GetTreeEndpoint(
 
     Username = CurrentUser["Username"]
     UserGroups = CurrentUser.get("Groups", [])
-    IsAdmin = CurrentUser.get("IsAdmin", False)
 
     # A locked subdirectory (or anything inside one) shouldn't even appear
     # in its parent's listing for someone without access to it.
@@ -396,7 +396,6 @@ def GetTreeEndpoint(
             f"{Path}/{Entry['Name']}" if Path else Entry["Name"],
             Username,
             UserGroups,
-            IsAdmin,
         )
     ]