fix: The site layout editor refuses a draft it can't tell apart from another user's, and a deleted user's draft sites are removed EXO-91427 (#604)

**Symptom**: some draft site names also read as another user's draft: a
site name holding `_draft_` or ending with `_draft`, or a username
starting with `draft_`. On such a name, opening the site layout editor
removed and re-created the draft by name, which could drop the other
user's draft. Once portal refuses such a name (Meeds-io/portal#1345),
the editor stopped on a generic error instead. A deleted user's draft
sites stayed, and a user whose name fits a leftover name could open
them.

**Cause**: `SiteLayoutService#createDraftSite` builds
`<type>_<name>_draft_<user>` and removes any site of that name before
creating it, without checking that the user may edit that name. Nothing
removed a user's draft sites when the user was deleted.

**Fix**:
- `createDraftSite` checks `LayoutAclService#canEditSite(PortalConfig,
String)`, a new overload, on the draft it built in memory, before
removing or creating anything. When the check fails it refuses with
`IllegalArgumentException("layout.siteDraftNameConflict")`.
`SiteLayoutRest` answers 400 with that message code, and the editor
shows its text. Administrators pass the check.
- `SiteLayoutService#deleteUserDraftSites` (`@ContainerTransactional`)
removes every `DRAFT` site whose name ends with `_draft_<username>`,
read in one unpaged listing. A removal that fails is logged and skipped.
Two listeners call it off the deleting thread:
`DraftSiteOwnerAccountDeletedListener` on social's
`social.account.deleted` (`@Asynchronous`), and
`DraftSiteOwnerUserDeletedListener` on `UserEventListener#postDelete`
(`CompletableFuture.runAsync`).
- Tests:
- `SiteLayoutServiceTest`: the refusal leaves the existing draft
untouched; the removal by suffix; a failed removal; a blank username;
the container binding.
  - `LayoutAclServiceTest`: a site not stored yet.
  - `SiteLayoutRestTest`: the 400.
  - Both listener tests.

**Known limits** (accepted):
- an administrator passes the check;
- resuming a draft through the user's co-editing revision shows the
generic error, not the conflict message;
- an owner whose draft name collides with another existing user's is
refused that draft;
- page and navigation-node drafts (`<name>_draft_<user>`) share the name
ambiguity and are saved over by name;
- the draft sites stay for users deleted before this change, and for a
user deleted through social's `DELETE /v1/social/users/{id}`, which
fires no event;
- the removals run in one persistence context;
- a co-editing revision can still name a removed draft;
- removing a deleted user's draft sites also removes a draft whose name
another user could own: while the deleted user existed, that name was
refused to every non-administrator, and an administrator's draft of that
name is removed too.

Stacked on #581. Merge after it and after
Meeds-io/portal#1345.

Knowledge: Meeds-io/eng-standards#572, #522

This change is classified N1 (a new permission check on the draft site's
write path): its approver must be an Archi/Dev who knows it is N1, not
an approval on AI review alone, and author ≠ approver.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: boubaker

layout-service/src/main/java/io/meeds/layout/listener/DraftSiteOwnerAccountDeletedListener.java

@@ -0,0 +1,58 @@
+/**
+ * This file is part of the Meeds project (https://meeds.io/).
+ *
+ * Copyright (C) 2026 Meeds Association contact@meeds.io
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package io.meeds.layout.listener;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import org.exoplatform.services.listener.Asynchronous;
+import org.exoplatform.services.listener.Event;
+import org.exoplatform.services.listener.ListenerBase;
+import org.exoplatform.services.listener.ListenerService;
+
+import io.meeds.layout.service.SiteLayoutService;
+import io.meeds.social.security.service.AccountDeletionService;
+
+import jakarta.annotation.PostConstruct;
+
+/**
+ * Removes the draft sites of an account the account deletion job deleted: the
+ * job removes the user without the user event listeners.
+ */
+@Asynchronous
+@Component
+public class DraftSiteOwnerAccountDeletedListener implements ListenerBase<String, Object> {
+
+  @Autowired
+  private ListenerService   listenerService;
+
+  @Autowired
+  private SiteLayoutService siteLayoutService;
+
+  @PostConstruct
+  public void init() {
+    listenerService.addListener(AccountDeletionService.ACCOUNT_DELETED_EVENT, this);
+  }
+
+  @Override
+  public void onEvent(Event<String, Object> event) {
+    siteLayoutService.deleteUserDraftSites(event.getSource());
+  }
+
+}

layout-service/src/main/java/io/meeds/layout/listener/DraftSiteOwnerUserDeletedListener.java

@@ -0,0 +1,66 @@
+/**
+ * This file is part of the Meeds project (https://meeds.io/).
+ *
+ * Copyright (C) 2026 Meeds Association contact@meeds.io
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package io.meeds.layout.listener;
+
+import java.util.concurrent.CompletableFuture;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import org.exoplatform.services.log.ExoLogger;
+import org.exoplatform.services.log.Log;
+import org.exoplatform.services.organization.OrganizationService;
+import org.exoplatform.services.organization.User;
+import org.exoplatform.services.organization.UserEventListener;
+
+import io.meeds.layout.service.SiteLayoutService;
+
+import jakarta.annotation.PostConstruct;
+
+/**
+ * Removes the draft sites of a user deleted through the user handler with its
+ * listeners, as an administrator's deletion is, outside the deleting request.
+ */
+@Component
+public class DraftSiteOwnerUserDeletedListener extends UserEventListener {
+
+  private static final Log    LOG = ExoLogger.getLogger(DraftSiteOwnerUserDeletedListener.class);
+
+  @Autowired
+  private OrganizationService organizationService;
+
+  @Autowired
+  private SiteLayoutService   siteLayoutService;
+
+  @PostConstruct
+  public void init() {
+    organizationService.getUserHandler().addUserEventListener(this);
+  }
+
+  @Override
+  public void postDelete(User user) {
+    String username = user.getUserName();
+    CompletableFuture.runAsync(() -> siteLayoutService.deleteUserDraftSites(username))
+                     .exceptionally(e -> {
+                       LOG.warn("Error while removing the draft sites of deleted user {}", username, e);
+                       return null;
+                     });
+  }
+
+}

layout-service/src/main/java/io/meeds/layout/rest/SiteLayoutRest.java

@@ -346,6 +346,7 @@ public ResponseEntity<SiteEntity> createSite(
   @Operation(summary = "create a site", method = "POST", description = "This create a new site")
   @ApiResponses(value = {
     @ApiResponse(responseCode = "200", description = "Request fulfilled"),
+    @ApiResponse(responseCode = "400", description = "The draft's name is also another user's draft"),
     @ApiResponse(responseCode = "403", description = "Forbidden"),
     @ApiResponse(responseCode = "404", description = "Not found"),
     @ApiResponse(responseCode = "409", description = "Site layout not readable"),
@@ -368,6 +369,8 @@ public ResponseEntity<SiteEntity> createDraftSite(
       throw new ResponseStatusException(HttpStatus.FORBIDDEN, e.getMessage());
     } catch (SiteLayoutUnresolvedException e) {
       throw new ResponseStatusException(HttpStatus.CONFLICT, e.getMessage());
+    } catch (IllegalArgumentException e) {
+      throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
     }
   }
 

layout-service/src/main/java/io/meeds/layout/service/LayoutAclService.java

@@ -58,6 +58,10 @@ public boolean canEditSite(SiteKey siteKey, String username) {
     if (portalConfig == null) {
       return false;
     }
+    return canEditSite(portalConfig, username);
+  }
+
+  public boolean canEditSite(PortalConfig portalConfig, String username) {
     return userAcl.hasEditPermission(portalConfig, userAcl.getUserIdentity(username));
   }
 

layout-service/src/main/java/io/meeds/layout/service/SiteLayoutService.java

@@ -20,6 +20,7 @@
 
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
@@ -38,6 +39,7 @@
 import org.exoplatform.portal.config.model.ModelObject;
 import org.exoplatform.portal.config.model.Page;
 import org.exoplatform.portal.config.model.PortalConfig;
+import org.exoplatform.portal.mop.SiteFilter;
 import org.exoplatform.portal.mop.SiteKey;
 import org.exoplatform.portal.mop.SiteType;
 import org.exoplatform.portal.mop.importer.ImportMode;
@@ -53,6 +55,7 @@
 import org.exoplatform.services.resources.LocaleConfigService;
 import org.exoplatform.services.resources.LocaleContextInfo;
 
+import io.meeds.common.ContainerTransactional;
 import io.meeds.layout.util.LayoutStyleValidator;
 
 import lombok.SneakyThrows;
@@ -66,6 +69,10 @@ public class SiteLayoutService {
 
   private static final String     SITE_DOESNT_EXIST_MSG  = "Site %s doesn't exist";
 
+  private static final String     DRAFT_NAME_CONFLICT    = "layout.siteDraftNameConflict";
+
+  private static final String     DRAFT_OWNER_SEPARATOR  = "_draft_";
+
   private static final Log        LOG                    = ExoLogger.getLogger(SiteLayoutService.class);
 
   @Autowired
@@ -174,11 +181,16 @@ public SiteKey createDraftSite(SiteKey siteKey, String username) throws ObjectNo
     PortalConfig site = getSite(siteKey, username);
     SiteLayoutUnresolvedException.checkResolved(site);
 
-    String clonedSiteName = site.getType() + "_" + site.getName() + "_draft_" + username;
+    String clonedSiteName = site.getType() + "_" + site.getName() + DRAFT_OWNER_SEPARATOR + username;
 
     PortalConfig draftSite = site.clone();
     draftSite.setType(PortalConfig.DRAFT);
     draftSite.setName(clonedSiteName);
+    if (!aclService.canEditSite(draftSite, username)) {
+      // The name could also be another existing user's draft of another site:
+      // the user couldn't open it, and replacing it could drop that user's draft
+      throw new IllegalArgumentException(DRAFT_NAME_CONFLICT);
+    }
     LayoutModel siteLayoutModel = new LayoutModel(site.getPortalLayout(), portletInstanceService, new PortletInstanceContext(false, null));
     siteLayoutModel.resetStorage();
     draftSite.setPortalLayout(siteLayoutModel.toSite().getPortalLayout());
@@ -191,6 +203,20 @@ public SiteKey createDraftSite(SiteKey siteKey, String username) throws ObjectNo
     return draftSiteKey;
   }
 
+  /**
+   * Removes the draft sites of a deleted user: every draft site whose name ends
+   * with {@code _draft_<username>}, a name another user could also have
+   * produced included. A non-administrator couldn't open such a draft while the
+   * deleted user existed and might afterwards; an administrator's draft of that
+   * name is removed too.
+   *
+   * @param username deleted user
+   */
+  @ContainerTransactional
+  public void deleteUserDraftSites(String username) {
+    removeUserDraftSites(username);
+  }
+
   public void updateSite(SiteUpdateModel updateModel, String username) throws IllegalAccessException,
                                                                        ObjectNotFoundException {
     SiteKey siteKey = new SiteKey(updateModel.getSiteType(), updateModel.getSiteName());
@@ -415,4 +441,29 @@ private void broadcastRestoredPages(SiteKey siteKey,
     }
   }
 
+  void removeUserDraftSites(String username) {
+    if (StringUtils.isBlank(username)) {
+      return;
+    }
+    String draftSiteNameSuffix = DRAFT_OWNER_SEPARATOR + username;
+    // Sites are sorted by label, which a draft shares with the site it drafts:
+    // pages of that order could skip a draft, so all draft sites are read at once
+    SiteFilter siteFilter = new SiteFilter();
+    siteFilter.setSiteType(SiteType.DRAFT);
+    List<PortalConfig> userDraftSites = layoutService.getSites(siteFilter)
+                                                     .stream()
+                                                     .filter(draftSite -> StringUtils.endsWith(draftSite.getName(),
+                                                                                               draftSiteNameSuffix))
+                                                     .toList();
+    userDraftSites.forEach(this::removeDraftSite);
+  }
+
+  private void removeDraftSite(PortalConfig draftSite) {
+    try {
+      layoutService.remove(draftSite);
+    } catch (Exception e) {
+      LOG.warn("Error while removing the draft site {} of a deleted user", draftSite.getName(), e);
+    }
+  }
+
 }

layout-service/src/test/java/io/meeds/layout/listener/DraftSiteOwnerAccountDeletedListenerTest.java

@@ -0,0 +1,82 @@
+/**
+ * This file is part of the Meeds project (https://meeds.io/).
+ *
+ * Copyright (C) 2026 Meeds Association contact@meeds.io
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package io.meeds.layout.listener;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.verify;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import org.exoplatform.services.listener.Asynchronous;
+import org.exoplatform.services.listener.Event;
+import org.exoplatform.services.listener.ListenerService;
+
+import io.meeds.layout.service.SiteLayoutService;
+import io.meeds.social.security.service.AccountDeletionService;
+
+import jakarta.annotation.PostConstruct;
+import lombok.SneakyThrows;
+
+@ExtendWith(MockitoExtension.class)
+public class DraftSiteOwnerAccountDeletedListenerTest {
+
+  @Mock
+  private ListenerService                      listenerService;
+
+  @Mock
+  private SiteLayoutService                    siteLayoutService;
+
+  @InjectMocks
+  private DraftSiteOwnerAccountDeletedListener listener;
+
+  /**
+   * Spring calls init: the annotation-removed mutant passes the call made by
+   * hand.
+   */
+  @Test
+  @SneakyThrows
+  public void init() {
+    listener.init();
+
+    verify(listenerService).addListener(AccountDeletionService.ACCOUNT_DELETED_EVENT, listener);
+    assertTrue(DraftSiteOwnerAccountDeletedListener.class.getMethod("init").isAnnotationPresent(PostConstruct.class));
+  }
+
+  /**
+   * The listener service runs a listener outside the broadcasting thread only
+   * when its class carries the annotation: the annotation-removed mutant passes
+   * every other test.
+   */
+  @Test
+  public void isAsynchronous() {
+    assertTrue(DraftSiteOwnerAccountDeletedListener.class.isAnnotationPresent(Asynchronous.class));
+  }
+
+  @Test
+  public void onEvent() {
+    listener.onEvent(new Event<>(AccountDeletionService.ACCOUNT_DELETED_EVENT, "john", null));
+
+    verify(siteLayoutService).deleteUserDraftSites("john");
+  }
+
+}