feat(dashboards): reserve direct deletion for full access

[sdolidze]

Closes: https://linear.app/lightdash/issue/SPK-2067

Summary

Direct dashboard Can edit grants allow dashboard maintenance without authorizing deletion of the dashboard itself. Full access retains deletion and sharing management, subject to existing project capabilities and content protections.

How it works

A shared deletion-access filter excludes non-admin direct dashboard grants while preserving independent inherited access. Dashboard deletion, soft deletion, and the dashboard/list menus use this filter. Editing still uses the original access rows, including for adding and removing tiles. The sharing dialog explains the distinction.

Direct Can edit   → edit dashboard contents
Direct Full access → edit + delete + manage sharing
Other qualifying permissions → retain deletion rights

Regression analysis

• Existing direct editors lose deletion only when no other permission authorizes it. This is an intentional permission change.
• Space-editor rights, additive user/group and custom-role permissions, and project capability ceilings retain their existing behavior.
• Other content types, verified/Git-backed protections, and separate trash-management/restore permissions are unchanged.
• Bulk deletion uses the same service checks and reports unauthorized items as skipped. No migration or scope vocabulary change is needed.

Test plan

• Before: a real direct Editor deleted a private dashboard with HTTP 200; four new service regression cases failed.
• After: Editor GET/PATCH return 200 and DELETE returns 403. User/group Full access and inherited space Editor deletion succeed.
• Exercised hard and soft deletion on the local API; confirmed soft deletion in Postgres and restored local configuration afterward.
• Mixed bulk deletion deletes the Full-access item and skips the Editor-only item.
• Chrome DevTools: dashboard and Shared with me menus omit Delete for Editor and show it for Full access; sharing copy verified.
• Common authorization and role parity: 44 passed, one pre-existing skipped test. Backend service/access/verification suites: 183 passed. Direct-access modal: 18 passed.
• Common, backend, and frontend typechecks and lint pass; changed-file formatting and diff checks pass.

[linear-code]

SPK-2067

[rainbow-machine]

🌈 The environment for this PR was shut down when it closed. Reopening the PR brings it back at the same URL.

[github-actions]

🛡️ Upgrade safety for self-hosted customers

Comparing against main (e24853a471).

• ✅ Safe to upgrade normally. No downtime needed.
• No database changes in this release.

What we looked at

What	Result
Database changes	none
REST API	no breaking changes
MCP tools	no breaking changes
Config / environment	no breaking changes
Declared breaking changes	none
Upgrade notes	none

Technical details (raw JSON)

{
  "schemaVersion": "2",
  "version": "pr-29076",
  "previousVersion": "e24853a471",
  "releaseDate": "2026-09-11T14:05:04.392Z",
  "migrations": {
    "present": false,
    "count": 0,
    "coreCount": 0,
    "eeCount": 0,
    "files": []
  },
  "compatibility": {
    "rollingUpdateSafe": true,
    "recommendedStrategy": "RollingUpdate"
  },
  "api": {
    "rest": {
      "checked": true,
      "breaking": false,
      "changes": [],
      "breakingCount": 0,
      "advisories": [],
      "advisoryCount": 0
    },
    "mcp": {
      "checked": true,
      "breaking": false,
      "changes": [],
      "breakingCount": 0,
      "advisories": [],
      "advisoryCount": 0
    }
  },
  "config": {
    "checked": true,
    "breaking": false,
    "changes": []
  },
  "upgrade": {
    "minPreviousVersion": null,
    "requiredStops": []
  },
  "declaredBreaks": []
}

---

_{Automated upgrade-safety check. Once merged, it ships a small release-safety.json with the release so customers’ upgrade automation can read it. It covers database, API, and config/environment changes.}

[github-actions]

🧪 Test Selection

✅ Tests that will run

Test	Description
Preview Environment	Deploys a preview environment for testing
Frontend E2E Tests	Runs Cypress app tests
Backend API Tests	Runs Vitest API tests
CLI Tests	Runs CLI integration and dbt version tests

⏭️ Tests skipped (no relevant file changes detected)

Test	How to trigger manually
Timezone Tests	Add test-timezone to PR description

Tip: Add test-all to your PR description to run all tests.

[github-actions]

Your preview environment pr-29076 has been deployed.

Preview environment endpoints are available at:

• https://lightdash-pr-29076.lightdash.okteto.dev
• https://lightdash-preview-pr-29076.lightdash.okteto.dev

[github-actions]

Preview Environment

🌐 URL: https://lightdash-preview-pr-29076.lightdash.okteto.dev

📋 Logs: View in GCP Console

🔧 SSH: ./scripts/okteto-ssh.sh 29076

[lightdash-bot]

🎉 This PR is included in version 2.199.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀