fix: extend content delete authorization to allow administrators alongside owners across all endpoints

devplacepy/routers/uploads.py

@@ -7,11 +7,11 @@ from fastapi import APIRouter, Form, Request
 from fastapi.responses import JSONResponse
 from devplacepy.database import get_table, get_int_setting
 from devplacepy.models import UploadUrlForm
-from devplacepy.utils import require_user_api
+from devplacepy.utils import require_user_api, is_admin
 from devplacepy.attachments import (
     store_attachment,
     store_attachment_from_url,
-    delete_attachment as _delete_attachment,
+    soft_delete_attachment,
     is_extension_allowed,
     RemoteFetchError,
 )
@@ -95,13 +95,13 @@ async def upload_from_url(request: Request, data: Annotated[UploadUrlForm, Form(
 @router.delete("/delete/{attachment_uid}")
 async def delete_attachment_route(request: Request, attachment_uid: str):
     user = require_user_api(request)
-    att = get_table("attachments").find_one(uid=attachment_uid)
+    att = get_table("attachments").find_one(uid=attachment_uid, deleted_at=None)
     if not att:
         return JSONResponse({"error": "Attachment not found"}, status_code=404)
-    if att.get("user_uid") and att["user_uid"] != user["uid"]:
+    if att.get("user_uid") and att["user_uid"] != user["uid"] and not is_admin(user):
         return JSONResponse({"error": "Not authorized"}, status_code=403)
-    _delete_attachment(attachment_uid)
-    logger.info(f"Attachment {attachment_uid} deleted by {user['username']}")
+    soft_delete_attachment(attachment_uid, deleted_by=user["uid"])
+    logger.info(f"Attachment {attachment_uid} soft-deleted by {user['username']}")
     audit.record(
         request,
         "attachment.delete",