forked from EduCraft/curriculum-project-hub
ymy
29 lines
1.2 KiB
Markdown
29 lines
1.2 KiB
Markdown
# ADR 0034: Permanent Delete Follows MANAGE, Not Website Administrator
|
|
|
|
## Status
|
|
|
|
Accepted. **Supersedes one clause of ADR-0031**: "Permanent delete (彻底删除) is
|
|
website-administrator only".
|
|
|
|
## Context
|
|
|
|
ADR-0031 gated 彻底删除 to the website administrator as a high-risk-operation
|
|
precaution. The product call is that this is inconsistent with the rest of the
|
|
permission model: soft delete already requires only MANAGE on the node, and a
|
|
MANAGE holder who can delete a node into the bin should also be able to purge it —
|
|
the authority that grants deletion grants destruction. Admin-only purge strands
|
|
non-admin managers with bins they cannot empty.
|
|
|
|
## Decision
|
|
|
|
Permanent delete uses **the same visibility rule as the bin entry itself**: website
|
|
administrator, or an actor with an active MANAGE grant on the deleted node (direct
|
|
grant, USER or resolved GROUP). Anyone else gets 404 (D8). The double confirmation
|
|
in the UI and the `node.purge` audit entry are unchanged.
|
|
|
|
## Consequences
|
|
|
|
- Purge auth = restore auth = bin-entry visibility: one rule, three surfaces.
|
|
- The operation remains irreversible and audited; no new capability is granted to
|
|
anyone who could not already delete the node (soft) and see it in the bin.
|