ymy
1.2 KiB
ADR 0034: Permanent Delete Follows MANAGE, Not Website Administrator
Status
Accepted. Supersedes one clause of ADR-0031: "Permanent delete (彻底删除) is website-administrator only".
Context
ADR-0031 gated 彻底删除 to the website administrator as a high-risk-operation precaution. The product call is that this is inconsistent with the rest of the permission model: soft delete already requires only MANAGE on the node, and a MANAGE holder who can delete a node into the bin should also be able to purge it — the authority that grants deletion grants destruction. Admin-only purge strands non-admin managers with bins they cannot empty.
Decision
Permanent delete uses the same visibility rule as the bin entry itself: website
administrator, or an actor with an active MANAGE grant on the deleted node (direct
grant, USER or resolved GROUP). Anyone else gets 404 (D8). The double confirmation
in the UI and the node.purge audit entry are unchanged.
Consequences
- Purge auth = restore auth = bin-entry visibility: one rule, three surfaces.
- The operation remains irreversible and audited; no new capability is granted to anyone who could not already delete the node (soft) and see it in the bin.