From 5f17f421b176d48ef556fb379f59bbb7d284b48e Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 31 Jul 2026 14:35:16 +0200
Subject: Retire the unused per-node permission subsystem

Every path through Permission raised or lied: validates_presence_of on a
boolean made granted = false unsaveable, since false.blank? is true;
get_permission_for read a nonexistent identifier attribute; has_permission?
called an undefined plural method and returned a truthy relation in every
case; and set_permission mutated granted without saving. Nothing outside the
model referenced it and the table was empty.
---
 app/models/node.rb                            |  1 -
 app/models/permission.rb                      | 13 -------
 app/models/user.rb                            | 55 ---------------------------
 db/migrate/20260731123346_drop_permissions.rb | 17 +++++++++
 test/fixtures/permissions.yml                 |  7 ----
 test/models/permission_test.rb                |  8 ----
 6 files changed, 17 insertions(+), 84 deletions(-)
 delete mode 100644 app/models/permission.rb
 create mode 100644 db/migrate/20260731123346_drop_permissions.rb
 delete mode 100644 test/fixtures/permissions.yml
 delete mode 100644 test/models/permission_test.rb

diff --git a/app/models/node.rb b/app/models/node.rb
index c8f9a210..1823daa4 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -18,7 +18,6 @@ class Node < ApplicationRecord
   # them -- this dependent: :destroy is their only cleanup on node destroy.
   belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
 
-  has_many    :permissions, :dependent => :destroy
   has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
diff --git a/app/models/permission.rb b/app/models/permission.rb
deleted file mode 100644
index 1383a4b8..00000000
--- a/app/models/permission.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-class Permission < ApplicationRecord
-  # Validations
-  validates_presence_of   :user_id, :node_id, :granted
-  validates_inclusion_of  :granted, :in => [true, false]
-  
-  # Associations
-  belongs_to :user
-  belongs_to :node
-  
-  # Named scopes
-  scope :for_node, ->(node) { where('node_id = ?', (node.is_a?(Node) ? node.id : node)) }
-  scope :for_user, ->(user) { where('user_id = ?', (user.is_a?(User) ? user.id : user)) }
-end
diff --git a/app/models/user.rb b/app/models/user.rb
index 4d712f6c..e1eff059 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -9,9 +9,6 @@ class User < ApplicationRecord
   include Authentication
   include Authentication::ByPassword
 
-  # Associations
-  has_many :permissions
-
   # Validations
   validates_presence_of     :login
   validates_length_of       :login, :within => 1..40
@@ -62,46 +59,6 @@ class User < ApplicationRecord
     write_attribute :email, (value ? value.downcase : nil)
   end
   
-  # Permission stuff
-  
-  def grant(node)
-    set_permission(true, node)
-  end
-  
-  def revoke(node)
-    set_permission(false, node)
-  end
-
-  def inherit(node)    
-    permission = self.permissions.for_node(node).first
-    permission.destroy if permission
-  end
-  
-  def get_permission_for(node)
-    permissions = {}
-    self.permissions.for_node(node).each do |permission|
-      permissions[permission.identifier.to_sym] = permission.granted
-    end
-    permissions
-  end
-  
-  # Checks for permission on the node and if necessary ascends the
-  # nodetree until permission is found or returns false if it is not found 
-  # at all.
-  def has_permission?(node)
-    node_permission = self.permissions.for_node(node)
-    return node_permission unless node_permission.nil?
-
-    node.ancestors.reverse.each do |p|
-      local_permission = self.get_permissions_for(p)[identifier]
-      unless local_permission.nil?
-        return local_permission
-      end
-    end
-    
-    return false
-  end
-  
   def is_admin?
     !!admin
   end
@@ -176,16 +133,4 @@ class User < ApplicationRecord
     end
     true
   end
-  
-  private
-    
-    def set_permission(granted, node)    
-      permission = self.permissions.for_node(node).first
-      if permission
-        permission.granted = granted
-      else
-        self.permissions.create!( :node       => node, 
-                                  :granted    => granted )
-      end
-    end
 end
diff --git a/db/migrate/20260731123346_drop_permissions.rb b/db/migrate/20260731123346_drop_permissions.rb
new file mode 100644
index 00000000..6ea7d2f0
--- /dev/null
+++ b/db/migrate/20260731123346_drop_permissions.rb
@@ -0,0 +1,17 @@
+class DropPermissions < ActiveRecord::Migration[8.1]
+  def up
+    drop_table :permissions
+  end
+
+  # Reversible for form's sake -- the table was empty and every write path
+  # in the model was broken, so there is nothing to restore.
+  def down
+    create_table :permissions, :id => :serial do |t|
+      t.boolean  :granted
+      t.integer  :node_id
+      t.integer  :user_id
+      t.datetime :created_at, :precision => nil
+      t.datetime :updated_at, :precision => nil
+    end
+  end
+end
diff --git a/test/fixtures/permissions.yml b/test/fixtures/permissions.yml
deleted file mode 100644
index 5bf02933..00000000
--- a/test/fixtures/permissions.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-#   column: value
-#
-# two:
-#   column: value
diff --git a/test/models/permission_test.rb b/test/models/permission_test.rb
deleted file mode 100644
index 08fcc0be..00000000
--- a/test/models/permission_test.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-require 'test_helper'
-
-class PermissionTest < ActiveSupport::TestCase
-  # Replace this with your real tests.
-  test "the truth" do
-    assert true
-  end
-end
-- 
cgit v1.3