fix(licenses): expand delete permissions to org owners (not just site admins) #385

New Issue

2026-06-01T09:18:44Z

jmiller commented

2026-06-01 09:18:44 +00:00

Summary

Currently, only site admins can permanently delete license packages and keys. Org owners should also have this capability since they own the licensing data.

Current Behavior

LicensesDeletePackage checks ctx.IsUserSiteAdmin() only
LicensesDeleteKey checks ctx.IsUserSiteAdmin() only
Templates show delete buttons only when $.IsSiteAdmin

Expected Behavior

Site admins AND org owners can delete packages and keys
Repo-level: repo owner equivalent check
Org-level: ctx.Org.IsOwner check
Templates show delete buttons when $.IsSiteAdmin OR $.IsOrganizationOwner

Test Plan

Site admin can delete package
Org owner can delete package
Regular member cannot delete package
Site admin can delete key
Org owner can delete key
Regular member cannot see delete buttons

🤖 Generated with Claude Code

## Summary Currently, only site admins can permanently delete license packages and keys. Org owners should also have this capability since they own the licensing data. ## Current Behavior - `LicensesDeletePackage` checks `ctx.IsUserSiteAdmin()` only - `LicensesDeleteKey` checks `ctx.IsUserSiteAdmin()` only - Templates show delete buttons only when `$.IsSiteAdmin` ## Expected Behavior - Site admins AND org owners can delete packages and keys - Repo-level: repo owner equivalent check - Org-level: `ctx.Org.IsOwner` check - Templates show delete buttons when `$.IsSiteAdmin` OR `$.IsOrganizationOwner` ## Test Plan - [ ] Site admin can delete package - [ ] Org owner can delete package - [ ] Regular member cannot delete package - [ ] Site admin can delete key - [ ] Org owner can delete key - [ ] Regular member cannot see delete buttons 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jmiller commented

2026-06-01 10:10:53 +00:00

Testing Plan — Expanded Delete Permissions

API

Site admin can DELETE package → 204
Org owner can DELETE package → 204
Regular write member DELETE → 404
Site admin can DELETE key → 204
Org owner can DELETE key → 204

GUI

Delete (trash) buttons visible for site admins
Delete buttons visible for org owners
Delete buttons hidden for regular write-access members
Modal confirmation on all delete clicks

🤖 Generated with Claude Code

## Testing Plan — Expanded Delete Permissions ### API - [ ] Site admin can DELETE package → 204 - [ ] Org owner can DELETE package → 204 - [ ] Regular write member DELETE → 404 - [ ] Site admin can DELETE key → 204 - [ ] Org owner can DELETE key → 204 ### GUI - [ ] Delete (trash) buttons visible for site admins - [ ] Delete buttons visible for org owners - [ ] Delete buttons hidden for regular write-access members - [ ] Modal confirmation on all delete clicks 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jmiller added the pending: testing label 2026-06-01 10:13:50 +00:00

jmiller closed this issue

2026-06-02 11:21:11 +00:00

jmiller reopened this issue

2026-06-02 11:21:41 +00:00

jmiller referenced this issue from a commit

2026-06-02 11:47:40 +00:00

feat(licenses): archive, search, download gating, changelog XML, and expanded permissions

jmiller commented

2026-06-03 00:39:44 +00:00

Tested and verified in production on MokoWaaS. All three download gating modes (none/prerelease/all), feed visibility, XML metadata, download URLs, and access control confirmed working.

jmiller closed this issue

2026-06-03 00:39:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea#385