Gate live-content changes on restricted surfaces

publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.

Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.

A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.

1 files changed, 6 insertions, 0 deletions

diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb
index 988d56d1..03780c69 100644
--- a/app/controllers/assets_controller.rb
+++ b/app/controllers/assets_controller.rb
@@ -93,6 +93,12 @@ class AssetsController < ApplicationController
       format.html { redirect_to(assets_url) }
       format.xml  { head :ok }
     end
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:error] = e.message
+    respond_to do |format|
+      format.html { redirect_to(asset_path(@asset)) }
+      format.xml  { head :forbidden }
+    end
   end
 
   private