3 files changed, 45 insertions, 0 deletions

diff --git a/app/models/asset.rb b/app/models/asset.rb
index 8cec4371..b256b929 100644
--- a/app/models/asset.rb
+++ b/app/models/asset.rb
@@ -41,6 +41,13 @@ class Asset < ApplicationRecord
                :ids => page_ids).distinct
   end
 
+  # An asset's reach is the reach of the pages carrying it: destroying one
+  # removes it from every live page at once, so a single restricted
+  # attachment makes the destruction a restricted act.
+  def restricted?
+    attached_nodes.any?(&:restricted?)
+  end
+
   # Witnessed destruction. Destroying an asset is a public-facing act
   # even when unattached. The original and its variants are publicly
   # reachable under /system/uploads, so an entry is always written,
@@ -49,6 +56,11 @@ class Asset < ApplicationRecord
   # participates as the first non-Node subject (its participant row
   # dangles after destroy, by design, the name lives on in metadata).
   def destroy_witnessed! user:
+    if user && !user.may_change_live?(self)
+      errors.add(:base, :not_permitted)
+      raise ActiveRecord::RecordInvalid.new(self)
+    end
+
     ActiveRecord::Base.transaction do
       affected = attached_nodes.to_a
       headline_losses = affected.select do |node|
diff --git a/app/models/node.rb b/app/models/node.rb
index 1823daa4..ac3a6160 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -236,6 +236,8 @@ class Node < ApplicationRecord
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
+    guard_live_change!(current_user)
+
     if in_trash? || trash_node?
       errors.add(:base, :publish_in_trash)
       raise ActiveRecord::RecordInvalid.new(self)
@@ -319,6 +321,9 @@ class Node < ApplicationRecord
   # at the root, carrying the leaving-public-view snapshot.
   def trash! current_user = nil
     return nil if in_trash?
+
+    guard_live_change!(current_user)
+
     if trash_node?
       errors.add(:base, :trash_the_trash)
       raise ActiveRecord::RecordInvalid.new(self)
@@ -391,6 +396,8 @@ class Node < ApplicationRecord
   # One log entry at the root, per the subtree rule, written before the
   # rows die.
   def destroy_from_trash! current_user = nil
+    guard_live_change!(current_user)
+
     unless in_trash?
       errors.add(:base, :destroy_outside_trash)
       raise ActiveRecord::RecordInvalid.new(self)
@@ -485,6 +492,8 @@ class Node < ApplicationRecord
   # Returns { :attached => n, :already => n,
   #           :headline => nil | :set | :kept_existing | :not_eligible }
   def attach_asset! asset, user:, headline: false
+    guard_live_change!(user)
+
     if in_trash? || trash_node?
       errors.add(:base, :attach_in_trash)
       raise ActiveRecord::RecordInvalid.new(self)
@@ -565,6 +574,17 @@ class Node < ApplicationRecord
     false
   end
 
+  def restricted?
+    return true if root?
+
+    name = unique_name.to_s
+    return false if name.empty?
+
+    CccConventions::RESTRICTED_SUBTREES.any? do |prefix|
+      name == prefix || name.start_with?("#{prefix}/")
+    end
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -677,6 +697,14 @@ class Node < ApplicationRecord
 
   private
 
+    def guard_live_change! user
+      return if user.nil?
+      return if user.may_change_live?(self)
+
+      errors.add(:base, :not_permitted)
+      raise ActiveRecord::RecordInvalid.new(self)
+    end
+
     def reserved_slug_stays_reserved
       if parent&.root? && !trash_node_already_me?
         errors.add(:slug, :reserved_for_trash) if slug == CccConventions::TRASH_SLUG
diff --git a/app/models/user.rb b/app/models/user.rb
index 1728521a..e8c3b9bb 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -105,6 +105,11 @@ class User < ApplicationRecord
     roles.map { |r| I18n.t("users.roles.#{r}", :default => r) }
   end
 
+  def may_change_live?(subject)
+    return true unless subject.restricted?
+    redaktion?
+  end
+
   def deactivate!(actor:)
     return false if alumni?
     transaction do