GrottoCenter / grottocenter-api / 33455061369

87%

develop: 91%

Pull #1797

github

docs(permissions): correct caver deletion role gating

Cavers were grouped with devices, sensor configurations and guidelines as
entities whose soft-delete/restore accepts either Moderator or
Administrator. Both halves of that claim were wrong.

- Remove cavers from the soft-delete grouping: caver/delete.js ends in
  TCaver.destroyOne and there is no caver/restore endpoint, so deletion
  is always permanent
- Add a "Caver Deletion" subsection documenting the type-dependent rule
  (CAVER requires Administrator, AUTHOR requires Moderator), the
  DEFAULT_DELETED_CAVER_ID guard, and the entityId merge behaviour
- Split the "Delete user accounts" matrix row in two, since the two
  caver types are gated on different roles
- Correct the Administrator role section, which claimed blanket account
  deletion, and add the AUTHOR case to the Moderator section

5209 of 6257 branches covered (83.25%)

Branch coverage included in aggregate %.

9570 of 10667 relevant lines covered (89.72%)

142.32 hits per line