[boubaker]

Symptom: some draft site names also read as another user's draft: a site name holding _draft_ or ending with _draft, or a username starting with draft_. On such a name, opening the site layout editor removed and re-created the draft by name, which could drop the other user's draft. Once portal refuses such a name (Meeds-io/portal#1345), the editor stopped on a generic error instead. A deleted user's draft sites stayed, and a user whose name fits a leftover name could open them.

Cause: SiteLayoutService#createDraftSite builds <type>_<name>_draft_<user> and removes any site of that name before creating it, without checking that the user may edit that name. Nothing removed a user's draft sites when the user was deleted.

Fix:

• createDraftSite checks LayoutAclService#canEditSite(PortalConfig, String), a new overload, on the draft it built in memory, before removing or creating anything. When the check fails it refuses with IllegalArgumentException("layout.siteDraftNameConflict"). SiteLayoutRest answers 400 with that message code, and the editor shows its text. Administrators pass the check.
• SiteLayoutService#deleteUserDraftSites (@ContainerTransactional) removes every DRAFT site whose name ends with _draft_<username>, read in one unpaged listing. A removal that fails is logged and skipped. Two listeners call it off the deleting thread: DraftSiteOwnerAccountDeletedListener on social's social.account.deleted (@Asynchronous), and DraftSiteOwnerUserDeletedListener on UserEventListener#postDelete (CompletableFuture.runAsync).
• Tests:
  • SiteLayoutServiceTest: the refusal leaves the existing draft untouched; the removal by suffix; a failed removal; a blank username; the container binding.
  • LayoutAclServiceTest: a site not stored yet.
  • SiteLayoutRestTest: the 400.
  • Both listener tests.

Known limits (accepted):

• an administrator passes the check;
• resuming a draft through the user's co-editing revision shows the generic error, not the conflict message;
• an owner whose draft name collides with another existing user's is refused that draft;
• page and navigation-node drafts (<name>_draft_<user>) share the name ambiguity and are saved over by name;
• the draft sites stay for users deleted before this change, and for a user deleted through social's DELETE /v1/social/users/{id}, which fires no event;
• the removals run in one persistence context;
• a co-editing revision can still name a removed draft;
• removing a deleted user's draft sites also removes a draft whose name another user could own: while the deleted user existed, that name was refused to every non-administrator, and an administrator's draft of that name is removed too.

Stacked on #581. Merge after it and after Meeds-io/portal#1345.

Knowledge: Meeds-io/eng-standards#572, #522

This change is classified N1 (a new permission check on the draft site's write path): its approver must be an Archi/Dev who knows it is N1, not an approval on AI review alone, and author ≠ approver.

🤖 Generated with Claude Code

[boubaker]

Backport evidence

Source: #590, squash-merged into feature/maintenance. Its change is on origin/feature/maintenance at f5a9180825 (matched against the branch's current head, 2026-10-27). The PO validated it on the maintenance acceptance server on 2026-10-27.

Picks: ea6c223293 = git cherry-pick -x f5a9180825, on the EXO-91183 backport branch (af94c10a25, #603).

Adaptations: none. The pick applied cleanly, and no commit was added.

Verification

• git show -U0 <pick> | git patch-id --stable gives the same result on ea6c223293 and on f5a9180825: 451671dbab98.
• gh pr diff 590 | git patch-id --stable equals git show ea6c223293 | git patch-id --stable: 1bc556a07bf1.
• The source's approval is on its head: APPROVED by ahamdi at 16ebd6d8e1, which is the source PR's head. Earlier reviews on older heads were dismissed or left as comments.
• mvn -B -ntp -Dcheckstyle.skip=true -pl layout-service,layout-webapp -am verify at ea6c223293: Tests run: 401, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS.
• Merge order: after fix: Refuse to hand on the layout of a site that couldn't be read, and a site restore refreshes its pages' search index EXO-91183 #603, and after the Meeds-io/portal EXO-91427 backport (fix: A draft site no longer opens to a user whose name ends its owner's EXO-91427 portal#1356).
• Open-PR overlap: git merge-tree is clean against every open PR to develop.

Level: N1, restated from the source. A backport from feature/maintenance whose every pick's patch-id equals its source's diff merges on its first approval (ai-review-and-merge.md §3). It lands by squash, with the source's body as its message.

The merge-base changed after approval.

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud