feat: simplify permission model — all logged-in users can edit (#152)

[cheerc]

What

Simplify the permission model per #152: all logged-in users can now save, delete, copy, and rename schedules. Removes admin/creator permission gating.

Changes (5 files)

Backend: 程式碼.js

• _checkPermission: removed admin email comparison and createdBy check. Now only verifies the user is logged in (Session.getActiveUser().getEmail() is not empty).
• 4 call sites (saveData, deleteSchedule, copySchedule, updateScheduleMetadata) unchanged — they still call _checkPermission for login verification.

Frontend: ScheduleManager.js.html

• canManageCurrentScheduleSettings: simplified to only gate ALL_SCHEDULES_ID view. Returns true for any specific schedule.
• isCurrentUserAdmin: preserved for potential future admin-only UI features.

Frontend: Interaction.js.html

• adminOnlyMessage: updated from permission-denied message to view-mode guidance ("在「所有課表」檢視模式下無法使用此功能").

Tests: backend.test.js + businessLogicEdgeCases.test.js

• 5 "rejects unauthorized" tests → "allows any logged-in user" (expect success)
• 12 _checkPermission edge case tests rewritten for simplified model:
  • null/undefined createdBy no longer throws (param unused)
  • Whitespace emails now pass (only login check)
  • Missing ADMIN_EMAIL passes (no admin gating)

Preserved (no change)

• isCurrentUserAdmin() function
• IS_ADMIN injection in doGet / Index.html
• UI admin toggle in UI.js.html

Verification

• npm test: 1142 tests passed (36 files) ✅
• Net -62 lines (simplification)

Closes #152

[cheerc]

✅ VERIFIED

Reviewed HEAD: 21ab7f2
Reviewer: cb-team-reviewer
Audit mode: standard (D2, lenses: correctness + security)

Files Reviewed (5)

• 程式碼.js (+1/-4) — _checkPermission simplified to login-only guard
• ScheduleManager.js.html (+3/-9) — canManageCurrentScheduleSettings simplified
• Interaction.js.html (+1/-1) — message text updated to reflect new semantics
• tests/unit/backend.test.js (+16/-15) — authorization tests updated
• tests/unit/businessLogicEdgeCases.test.js (+23/-77) — edge cases updated, net -54 lines

Stage 1 — Correctness + Security

• Login guard preserved (Ref: [Security] _checkPermission 未防禦空字串 email 邊界條件 #62): if (!currentUser) throw new Error("未登入") still in _checkPermission ✓
• Backend-frontend consistency: both _checkPermission and canManageCurrentScheduleSettings now allow all logged-in users ✓
• ALL_SCHEDULES gate: canManageCurrentScheduleSettings still returns false for ALL_SCHEDULES_ID ✓
• 4 backend callers (L210, 370, 420, 462) unchanged — still call _checkPermission(createdBy), signature compatible ✓
• isCurrentUserAdmin/IS_ADMIN/doGet injection untouched ✓
• Message text: correctly reflects new semantics (ALL_SCHEDULES view restriction, not permission) ✓
• Test coverage: login guard test preserved, unauthorized→allowed tests updated, null/undefined createdBy tests updated ✓
• No conflict markers (4 files clean)

Stage 2 — Security Adversarial

• Non-logged-in bypass: impossible — Session.getActiveUser().getEmail() + falsy guard ✓
• _checkPermission still called on all 4 mutation paths (save/delete/copy/rename) ✓
• createdBy param unused but signature preserved — no caller breakage ✓
• Admin-only UI features (if any) still gated by IS_ADMIN injection in doGet (not modified) ✓

Evidence

• ran: grep _checkPermission 程式碼.js → 5 hits (1 def + 4 callers)
• ran: conflict marker scan (4 files) → all clean
• cited: 程式碼.js:45-46 — if (!currentUser) throw new Error("未登入") (login guard preserved)
• cited: 程式碼.js:47 — // Ref: #152 — All logged-in users can edit/delete/copy/rename (simplified)
• cited: ScheduleManager.js.html:348 — if (App.activeScheduleId === AppConfig.ALL_SCHEDULES_ID) return false (gate preserved)
• cited: ScheduleManager.js.html:351 — return true (simplified)