1.1 KiB
1.1 KiB
Why
Server deletion currently trusts role and ownership alone, which is too loose for a destructive action. The UI also lets users trigger deletion without re-entering their password, so a stolen session or stray click can remove a server too easily.
What Changes
- Require server delete to be explicitly confirmed with the current user password.
- Allow deletion only for the server creator/owner or a platform administrator.
- Keep the existing archive/delete flow, but expose the destructive action from the server list runtime actions with an intentional password confirmation.
- Return a clear authorization or password error when the confirmation fails.
Capabilities
New Capabilities
server-deletion: deletion authorization and password confirmation for server instances.
Modified Capabilities
Impact
platform/delete handler, service authorization, and password verification logic.platform_web/server list runtime-action delete confirmation dialog and API client request payload.- Automated tests covering authorization, password failure, and successful deletion.