Warn before the gate refuses, and check restore destinations

nodes#new marks the kinds that place under /updates, derived from each kind's
own path_prefix. The three parent pickers mark candidates the current user
cannot publish into; menu_search returns needs_redaktion per result, computed
per user rather than as a bare restricted flag, and the menu-item picker opts
out.

restore_from_trash! checks its destination: the restore is the move, applied
rather than staged, so no later publish would have caught it. The node
returns as a draft either way.

1 files changed, 23 insertions, 0 deletions

diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index aa714427..a34094a0 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -1049,4 +1049,27 @@ class NodeTest < ActiveSupport::TestCase
     assert_not squatter.valid?
     assert squatter.errors[:slug].any?
   end
+
+  test "restoring into a restricted subtree is refused" do
+    editor = User.create!(:login => "restore_editor", :email => "rs@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = Node.root.children.create!(:slug => "restorable")
+    node.reload.trash!
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.restore_from_trash!(updates, editor) }
+    assert node.reload.in_trash?
+  end
+
+  test "restoring into unrestricted space needs no role" do
+    editor = User.create!(:login => "restore_free", :email => "rf@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    club = Node.root.children.create!(:slug => "club")
+    node = Node.root.children.create!(:slug => "restorable_free")
+    node.reload.trash!
+
+    node.restore_from_trash!(club, editor)
+    assert_not node.reload.in_trash?
+    assert_equal club.id, node.parent_id
+  end
 end