medplum / medplum / 26766114446

92%

push

github

Allow project admins to expunge with everything=true (#9330) (#9363)

* Allow project admins to expunge with everything=true (#9330)

Project admins could not call Patient/<id>/$expunge?everything=true for
patients in their own project; they received a 403.

Two issues:
- The cross-project guard in expungeHandler applied to all everything=true
  requests, not just Project expunges. For a Patient, id never equals the
  caller's project id, so every non-super-admin was rejected. Scope the
  guard to resourceType === 'Project'. Non-Project expunges are already
  constrained by the project-scoped repo's compartment search.
- Expunger.expunge() iterates every resource type and would throw
  "forbidden" when a non-super-admin reached a protected resource type
  (Login/JsonWebKey/DomainConfiguration), aborting the whole async job.
  Skip resource types the repo cannot search.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Reagan Elm <reagan.elm@liza.health>

* [autofix.ci] apply automated fixes

---------

Signed-off-by: Reagan Elm <reagan.elm@liza.health>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

22514 of 25279 branches covered (89.06%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

35859 of 38086 relevant lines covered (94.15%)

23330.57 hits per line