cccms/test/models/asset_destroy_test.rb, branch master[no description]http://erdgeist.org/gitweb/cccms/atom?h=master2026-08-09T01:35:48ZRefuse destroying an asset that is still attached2026-08-09T01:35:48Zerdgeisterdgeist@erdgeist.org2026-08-09T01:35:48Zurn:sha1:d16161eab9029a509951146b80334c304c35fd34Gate live-content changes on restricted surfaces2026-07-31T16:14:30Zerdgeisterdgeist@erdgeist.org2026-07-31T16:14:30Zurn:sha1:464af1625349d557f688da9f845471ef8b80a5f9
publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.
Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.
A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.
Witness asset destruction, naming every node it strips2026-07-23T02:12:39Zerdgeisterdgeist@erdgeist.org2026-07-23T02:12:39Zurn:sha1:6ef98ad444631b1d5ba67bb16aaaa2afdfa53ae0