Require elections.delete for election delete operation

README.md

@@ -31,7 +31,7 @@ Quick tip: the base command is `/elections` (alias: `/democracyelections`).
 - `elections.permissions.reload` (default: op)
   - Allows `/elections reloadperms`.
 - `elections.delete` (default: op)
-  - Extra gate for delete operations (used by `/elections export delete`). Managers/Admins can also delete.
+  - Extra gate for delete operations (used by `/elections export delete` and election deletion). Admins can also delete.
 - `elections.admin` (default: op)
   - Admin umbrella. Inherits all Elections permissions (including `elections.command`).
 - `elections.user` (default: true)
@@ -56,7 +56,7 @@ All commands require `elections.command` plus the specific node:
 - `/elections export ballots admin <local|online> <id>`
   - Export only ballots as JSON (pretty printed) with voter names. Ballots are objects with `id`, `voter`, and `selections`. Requires: `elections.export.ballots.admin` (or `elections.admin`).
 - `/elections export delete <pasteId> confirm`
-  - Delete a paste on paste.gg (needs a valid API key). Requires: `elections.export` + (`elections.delete` or `elections.manager`/`elections.admin`).
+  - Delete a paste on paste.gg (needs a valid API key). Requires: `elections.export` + (`elections.delete` or `elections.admin`).
 - `/elections export dispatch`
   - Process the local queue now (uploads pending files). Requires: `elections.manager` (or `elections.admin`).
 - `/elections reloadperms`

src/main/java/net/democracycraft/elections/internal/command/subcommands/ExportCommand.java

@@ -421,8 +421,7 @@ private void handleAdminRemoteExport(CommandContext context,
     private void executeDelete(CommandContext context, ExportMessagesConfig messages) {
         Elections plugin = context.plugin();
 
-        if (!context.sender().hasPermission("elections.manager") &&
-            !context.sender().hasPermission("elections.delete") &&
+        if (!context.sender().hasPermission("elections.delete") &&
             !context.sender().hasPermission("elections.admin")) {
             Component msg = MiniMessageUtil.parseOrPlain(messages.errorNoPermission);
             context.sender().sendMessage(msg);

src/main/java/net/democracycraft/elections/internal/ui/manager/ElectionManagerMenu.java

@@ -232,10 +232,10 @@ public void run() {
         builder.button(miniMessage(config.candidatesBtn, placeholders), context -> new CandidatesAddMenu(context.player(), this, electionService, electionId).open());
         builder.button(miniMessage(config.requirementsBtn, placeholders), context -> new RequirementsMenu(context.player(), this, electionService, electionId).open());
 
-        // Delete with double confirmation (requires manager permission); hidden for DELETED elections
+        // Delete with double confirmation (requires manager and delete permission); hidden for DELETED elections
         if (election.getStatus() != net.democracycraft.elections.internal.data.ElectionStatus.DELETED) {
             builder.button(miniMessage(config.deleteBtn, placeholders), context -> {
-                if (!context.player().hasPermission("elections.manager") && !context.player().hasPermission("elections.admin")) {
+                if ((!context.player().hasPermission("elections.manager") || !context.player().hasPermission("elections.delete")) && !context.player().hasPermission("elections.admin")) {
                     context.player().sendMessage(miniMessage(config.permissionDeniedMsg));
                     return;
                 }