chore: remove dead _checkPermission param + CI coverage gate (#107)

.github/workflows/ci.yml

@@ -24,8 +24,8 @@ jobs:
         run: bash scripts/check-tailwind.sh
       - name: t7 PHP syntax check
         run: find classroom_viewer -name '*.php' ! -path '*/vendor/*' -exec php -l {} \;
-      - name: t8 Vitest
-        run: npm test
+      - name: t8 Vitest + coverage gate
+        run: npx vitest run --coverage
       - name: Install pcov for PHP coverage
         run: |
           sudo pecl install pcov

tests/unit/backendSignatureContracts.test.js

@@ -58,7 +58,7 @@ const EXPECTED_SIGNATURES = [
   ['_getSs', 0],
   ['getConfig', 1],
   ['_findScheduleRowInfo', 2],
-  ['_checkPermission', 1],
+  ['_checkPermission', 0],
   ['getSheet', 1],
   ['getOrCreateSheet', 1],
   ['doGet', 0],

程式碼.js

@@ -38,9 +38,9 @@
 /**
  * Checks if the current user has permission to manage a schedule.
  * Throws an error if permission is denied.
- * @param {string} createdBy The email of the user who created the schedule.
+ * Ref: #152 — No per-user check needed; all logged-in users can edit.
  */
-function _checkPermission(createdBy) {
+function _checkPermission() {
   const currentUser = Session.getActiveUser().getEmail();
   // Ref: #62 — Guard against empty email (e.g. time-driven triggers return '')
   if (!currentUser) throw new Error('未登入，無法執行此操作');
@@ -197,7 +197,7 @@
       throw new Error("無效的數據格式。數據必須包含 scheduleId, scheduleData, 和 lastModified 時間戳。");
     }
 
     const ss = _getSs();
     const dataSheet = getOrCreateSheet(SHEET_DATA);
 
     const { index: rowIndex, values: rowValues } = _findScheduleRowInfo(scheduleId, dataSheet);
@@ -205,9 +205,8 @@
       throw new Error(`在索引中找不到 ID 為 "${scheduleId}" 的課表。`);
     }
 
-    // Ref: #5 — Enforce admin/creator permission before modifying schedule data
-    const createdBy = rowValues[3];
-    _checkPermission(createdBy);
+    // Ref: #5 — Enforce login check before modifying schedule data
+    _checkPermission();
 
     const serverLastModified = new Date(rowValues[2]).toISOString();
     if (serverLastModified !== lastModified) {
@@ -361,13 +360,12 @@
     const dataSheet = getOrCreateSheet(SHEET_DATA);
     const newMetaTimestamp = checkMetadata(dataSheet, metadataTimestamp);
 
-    const { index: rowIndex, values: rowValues } = _findScheduleRowInfo(id, dataSheet);
+    const { index: rowIndex } = _findScheduleRowInfo(id, dataSheet);
     if (rowIndex === -1) {
       throw new Error(`在索引中找不到 ID 為 \"${id}\" 的課表。`);
     }
 
-    const createdBy = rowValues[3];
-    _checkPermission(createdBy);
+    _checkPermission();
 
     // Update name if provided
     if (newName) {
@@ -408,16 +406,15 @@
     const dataSheet = getOrCreateSheet(SHEET_DATA);
     const newMetaTimestamp = checkMetadata(dataSheet, metadataTimestamp);
 
-    const { index: rowIndex, values: rowValues } = _findScheduleRowInfo(id, dataSheet);
+    const { index: rowIndex } = _findScheduleRowInfo(id, dataSheet);
     if (rowIndex === -1) {
       // Ref: #67.6 — Intentional idempotent design: if schedule is already gone from index,
       // return success rather than error. This handles race conditions and retries gracefully.
       Logger.log(`嘗試刪除一個在索引中不存在的課表: ${id}`);
       return { success: true, newMetadataTimestamp: newMetaTimestamp };
     }
 
-    const createdBy = rowValues[3];
-    _checkPermission(createdBy);
+    _checkPermission();
 
     const ss = _getSs();
     const scheduleSheet = ss.getSheetByName(id);
@@ -458,8 +455,7 @@
       throw new Error(`在索引中找不到來源課表 (ID: ${sourceId})。`);
     }
     // Ref: #41 — Enforce permission check before copying (same pattern as rename/delete)
-    const createdBy = sourceRowValues[3];
-    _checkPermission(createdBy);
+    _checkPermission();
     const sourceIsDraft = sourceRowValues[4] === true;
 
     const ss = _getSs();