GrottoCenter / grottocenter-api / 33914921889

87%

develop: 91%

Pull #1797

github

docs(permissions): narrow the ownership override claims per entity

The ownership summaries claimed Moderators and Administrators override
ownership uniformly, which contradicted the matrix and the controllers.

- Owner-Based Access Control: list the pending-approval document case
  (document/update.js checks modifiedDocJson) and state that
  Administrator overrides ownership only on guidelines, since comment
  and pending-document updates check MODERATOR alone
- Ownership-Based Access: replace the blanket "Moderators and
  Administrators can override ownership" with a pointer to the
  per-entity rules
- Organization-Based Permissions: split the two operations, explored
  caves accept either role but membership management is
  Administrator-only
- Fix the "Update any device/sensor configuration" matrix row, which
  granted Administrator; both controllers check MODERATOR only despite
  an in-code comment reading "moderator/admin"

5217 of 6267 branches covered (83.25%)

Branch coverage included in aggregate %.

9600 of 10702 relevant lines covered (89.7%)

146.75 hits per line