The test creates a script in the default app earlier in the body, so a plain DELETE /apps/default hits the soft no-cascade guard and 409s before the capability check runs. The intent is to validate that admin holds AppAdmin everywhere, not to exercise the cascade contract — pass ?force=true so we reach the gate we're trying to test. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 KiB
41 KiB