Gate live-content changes on restricted surfaces

publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.

Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.

A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.

1 files changed, 13 insertions, 0 deletions

diff --git a/test/models/asset_destroy_test.rb b/test/models/asset_destroy_test.rb
index 5583f685..2f38d692 100644
--- a/test/models/asset_destroy_test.rb
+++ b/test/models/asset_destroy_test.rb
@@ -48,4 +48,17 @@ class AssetDestroyTest < ActiveSupport::TestCase
     assert_equal "Doomed asset", action.metadata["asset_name"]
     assert_nil action.action_participants.first.subject
   end
+
+  test "destroying an asset attached to a restricted node needs the redaktion role" do
+    editor = User.create!(:login => "asset_gate", :email => "ag@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "gated-attachment")
+    node.reload.attach_asset!(@asset, :user => nil)
+
+    error = assert_raises(ActiveRecord::RecordInvalid) { @asset.destroy_witnessed!(:user => editor) }
+    assert_includes error.message,
+                    I18n.t("activerecord.errors.models.asset.attributes.base.not_permitted")
+    assert Asset.exists?(@asset.id)
+  end
 end