adminandClaude Opus 5.5 cbda6d64a7 Let only the owner delete a project, not an administrator (#272) ...

#179 decided that nobody deletes a project on someone else's behalf.
The API still let an administrator do it, because the admin store
treated every project as its own. Option A from the issue is now in
place: opening, editing, snapshots and release stay open to the
administrator, deleting stays with the owner.

- Store::delete checks the owner under the save lock and throws
  NotOwnerException for anyone else. It follows the pattern of
  StaleRevisionException.
- The route answers that with 403 "Only its owner may delete a
  project". A file without an owner is covered the same way.
  Non-admins still get 404 for a project that is not theirs.
- The editor has no way to delete a foreign project, the project
  picker lists only one's own. Nothing changes there.
- An account that owns projects can no longer be deleted by an
  administrator at all. Its owner has to delete them first.
- e2e 49 deleted the throwaway projects as administrator, both in
  its sweep and in 49i. It now signs in as the owner for that.
  49i checks both answers.

Tests:
- tests/php/accounts.test.php: 56 checks passed (was 52, one check
  turned around, five new)
- e2e 49: 22 checks passed (was 21), deleteByAdmin 403,
  deleteByOwner 204
- Gate: 197 files, 2855 tests passed
- Counter-checks: without the owner check 4 PHP checks and 49i fail
- The e2e total of 1603 is computed (1602 + 1), not measured

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 21:13:20 +02:00

..

assets

Add a four-direction walk demo that seeds its own sprite sheet

2026-09-12 12:13:13 +02:00

ci

Run CI on a WSL2 runner with the RTX 4070 (#283)

2026-09-29 20:56:50 +02:00

e2e

Let only the owner delete a project, not an administrator (#272)

2026-09-30 21:13:20 +02:00

lib

Run CI on a WSL2 runner with the RTX 4070 (#283)

2026-09-29 20:56:50 +02:00

e2e.mjs

A test that waits for a deadline somebody guessed is waiting for the wrong thing, so it waits for the editor (#93)

2026-09-16 08:08:10 +02:00

make-user.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

perf-shaders.mjs

Shaders draw in the sprite's own pass: a Mesh with the graph's fragment, no filter (#77)

2026-09-13 15:31:08 +02:00

seed-actor.mjs

An animation is a value a graph can pick, and playing a running one makes it win again (#97)

2026-09-16 20:47:31 +02:00

seed-e2e.mjs

Plugins belong to the project, and they load before it: the project file gained the field plugins: ["demo-plugin.js"] (default empty, no formatVersion bump), the Plugins tab's switch writes into it as an ordinary undo step (SetPluginActiveCommand) instead of into a server-wide plugins.json, and the start order is turned around - startPlugins only fetches the list of files, then editor.boot() runs and ProjectStore.load(id, prepare) hands the raw JSON through before it is deserialized, where pluginsOf(raw) reads the list and PluginManager.syncTo() activates exactly those; that is the point of the issue, because what a plugin registers has to stand there before normalizeGraph would throw it away as unknown (#126, #127), a project switch first stops what the new project does not name and then starts what it does, a file the server does not have is passed over silently, and after signing out the manager is dead so a late event cannot start anything in a torn-down session; on the server plugins.json, PluginStore::setActive, isActive, the route PUT ?r=plugins/{file} and the 403 for inactive modules are gone and GET ?r=plugins only answers {file,bytes,updatedAt}, which makes every plugin file fetchable - the consequence accepted in #117, written down in the wiki for #115 and #116; publishPlugins(root) only copies files now, the seeder switches the demo plugin on in the fixture project, and the Plugins tab carries a puzzle piece as its icon while only a plugin's own tab still goes without one (the knob and the socket are cubic curves, not arcs, which Pixi's parser draws as a spike after an L); 3 new e2e checks in module 38 and 5 new unit tests cover the project as the owner of the switch, its undo, the order, pluginsOf against crude input and an unknown file name (#119)

2026-09-20 14:24:27 +02:00

seed-jumprun.mjs

Shader assets: graph-built shaders, the Shader tab and sprite rows from the graph (#62)

2026-09-12 22:41:14 +02:00

seed-tetris.mjs

Shader assets: graph-built shaders, the Shader tab and sprite rows from the graph (#62)

2026-09-12 22:41:14 +02:00

smoke-actor.mjs

Make the actor smoke reach every sub pixel edge position again

2026-09-24 13:22:43 +02:00

smoke-jumprun.mjs

Replace the property nodes with one Properties node

2026-09-11 18:40:47 +02:00

smoke-tetris.mjs

Replace the property nodes with one Properties node

2026-09-11 18:40:47 +02:00