GrottoCenter / grottocenter-api / 33897361635

87%

develop: 91%

Pull #1797

github

docs(permissions): correct rollback and document unlink gating

Three corrections from PR review, all cases where the role summary
contradicted the controllers.

- Rollback: the only rollback route is v1/guideline/rollback, so the
  User section no longer claims rollback on "any content"
- Unlink: cave/entrance/massif unlink-document.js all require MODERATOR
  and do not accept ADMINISTRATOR, so the capability is removed from
  User/Leader/Administrator and the matrix row is now Moderator-only
- Split the two reasons guideline routes omit validateId: only rollback
  has the ISO :snapshotId param; get-snapshots takes a numeric :id and
  omits the policy because its controller checks the id itself

Also documents the link/unlink asymmetry found while verifying the
above: add-document performs no role check at all, so a plain user can
attach a document but cannot detach it, and a non-Moderator
Administrator cannot detach it either.

5217 of 6267 branches covered (83.25%)

Branch coverage included in aggregate %.

9600 of 10702 relevant lines covered (89.7%)

145.05 hits per line