browser/openspec/changes/restrict-server-delete-with-password-confirmation/specs/server-deletion/spec.md

ADDED Requirements

Requirement: Authorized server deletion

The system SHALL allow a server instance to be deleted only when the authenticated user is the instance owner or a platform administrator.

Scenario: Owner deletes a server

• WHEN the instance owner submits a delete request for their server
• THEN the system SHALL accept the request if all other delete checks pass

Scenario: Non-owner cannot delete

• WHEN an authenticated user who is neither the owner nor a platform administrator submits a delete request
• THEN the system SHALL reject the request with forbidden access

Requirement: Password confirmation for deletion

The system SHALL require the authenticated user to provide their current account password with every server delete request and SHALL reject the request if the password is missing or does not match the current session user.

Scenario: Password mismatch

• WHEN the authenticated user submits the delete request with an incorrect password
• THEN the system SHALL reject the request with forbidden access

Scenario: Password required

• WHEN the authenticated user submits the delete request without a password
• THEN the system SHALL reject the request as invalid input or forbidden access

Requirement: Safe server removal state

The system SHALL continue to reject deletion when the server instance is running or installing, and SHALL otherwise mark the server instance as deleted while preserving historical records.

Scenario: Running server cannot be deleted

• WHEN a delete request targets a running server instance
• THEN the system SHALL reject the request and keep the server instance intact

Scenario: Successful deletion marks deleted state

• WHEN a valid delete request targets a stopped or ready server instance
• THEN the system SHALL mark the server instance as deleted and return the updated instance