browser/openspec/changes/allow-forced-server-deletion/specs/server-deletion/spec.md

ADDED Requirements

Requirement: Authorized server deletion

The system SHALL allow a server instance to be deleted only when the authenticated user is the instance owner or a platform administrator.

Scenario: Owner deletes a server

• WHEN the instance owner submits a delete request for their server
• THEN the system SHALL accept the request if all other delete checks pass

Scenario: Non-owner cannot delete

• WHEN an authenticated user who is neither the owner nor a platform administrator submits a delete request
• THEN the system SHALL reject the request with forbidden access

Requirement: Password confirmation for deletion

The system SHALL require the authenticated user to provide their current account password with every server delete request and SHALL reject the request if the password is missing or does not match the current session user.

Scenario: Password mismatch

• WHEN the authenticated user submits the delete request with an incorrect password
• THEN the system SHALL reject the request with forbidden access

Scenario: Password required

• WHEN the authenticated user submits the delete request without a password
• THEN the system SHALL reject the request as invalid input or forbidden access

Requirement: Forced active server deletion

The system SHALL reject deletion for a running or installing server instance by default, but SHALL allow the same soft deletion when the authenticated owner or platform administrator also submits an explicit forced-delete confirmation.

Scenario: Running server delete without force is rejected

• WHEN a delete request targets a running server instance without forced-delete confirmation
• THEN the system SHALL reject the request and keep the server instance intact

Scenario: Installing server delete without force is rejected

• WHEN a delete request targets an installing server instance without forced-delete confirmation
• THEN the system SHALL reject the request and keep the server instance intact

Scenario: Running server force delete marks deleted state

• WHEN a valid delete request targets a running server instance with forced-delete confirmation
• THEN the system SHALL mark the server instance as deleted while preserving historical records

Scenario: Installing server force delete marks deleted state

• WHEN a valid delete request targets an installing server instance with forced-delete confirmation
• THEN the system SHALL mark the server instance as deleted while preserving historical records

Requirement: Soft server removal state

The system SHALL mark deleted server instances with the deleted state and preserve historical records rather than hard-deleting metadata.

Scenario: Successful deletion marks deleted state

• WHEN a valid delete request targets a stopped, ready, failed, or force-confirmed active server instance
• THEN the system SHALL mark the server instance as deleted and preserve history