Marcel 5b18b87450 test(security): add 403 permission test for annotation DELETE endpoint ...

Confirms that DELETE /api/documents/{id}/annotations/{id} requires at
least ANNOTATE_ALL; a user with only READ_ALL receives 403 Forbidden.
Closes the permission audit raised during PR review.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-26 21:56:37 +02:00

..

main

refactor(audit): extract createUserForBootstrap() to make null actorId contract explicit

2026-04-26 17:39:09 +02:00

test

test(security): add 403 permission test for annotation DELETE endpoint

2026-04-26 21:56:37 +02:00