GrottoCenter / grottocenter-api / 33124790223

87%

develop: 91%

Pull #1797

github

docs(permissions): document guidelines, org associations and role gating

Two features shipped after the last update to PERMISSION_SYSTEM.md were
absent from it entirely, and an audit of the existing matrix found six
rows that contradicted the controllers.

- add legislation guidelines (#1452): public reads, author-gated
  update/rollback, moderator delete/restore, admin permanent delete
- add responsible organization associations (#1598): public reads,
  authenticated write with no role or membership check
- correct six matrix rows that assumed Administrator is a superset of
  Moderator, which the doc's own preamble denies
- split delete/restore rows by entity class, since no single rule covers
  them
- add Known Permission Inconsistencies section, distinguishing the
  tracked defects (#1796) from behaviour accepted via role cumulation
- record that the open observation import is intentional

5210 of 6257 branches covered (83.27%)

Branch coverage included in aggregate %.

9570 of 10667 relevant lines covered (89.72%)

142.21 hits per line