Enforce delete_document too

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html

@@ -95,7 +95,7 @@
           <button ngbDropdownItem (click)="mergeSelected()" [disabled]="!userCanAdd || list.allSelected || list.selectedCount < 2">
             <i-bs name="journals" class="me-1"></i-bs><ng-container i18n>Merge</ng-container>
           </button>
-          <button ngbDropdownItem (click)="mergeSelectedAsVersions()" [disabled]="!userOwnsAll || !userCanEditAll || list.allSelected || list.selectedCount < 2">
+          <button ngbDropdownItem (click)="mergeSelectedAsVersions()" [disabled]="!userOwnsAll || !userCanEditAll || !userCanDelete || list.allSelected || list.selectedCount < 2">
             <i-bs name="journal-bookmark-fill" class="me-1"></i-bs><ng-container i18n>Merge as versions</ng-container>
           </button>
         </div>

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.ts

@@ -172,6 +172,13 @@ export class BulkEditorComponent
     )
   }
 
+  get userCanDelete(): boolean {
+    return this.permissionService.currentUserCan(
+      PermissionAction.Delete,
+      PermissionType.Document
+    )
+  }
+
   ngOnInit() {
     if (
       this.permissionService.currentUserCan(

src/documents/tests/test_merge_documents_as_versions.py

@@ -405,6 +405,7 @@ class TestMergeDocumentsAsVersionsAPI(APITestCase):
         self.user.user_permissions.add(
             Permission.objects.get(codename="change_document"),
             Permission.objects.get(codename="view_document"),
+            Permission.objects.get(codename="delete_document"),
         )
         self.doc1 = Document.objects.create(
             checksum="A",
@@ -466,6 +467,32 @@ class TestMergeDocumentsAsVersionsAPI(APITestCase):
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
         merge_mock.assert_not_called()
 
+    @mock.patch("documents.views.bulk_edit.merge_as_versions")
+    def test_requires_delete_permission(self, merge_mock) -> None:
+        merge_mock.__name__ = "merge_as_versions"
+        # Owns them and may change them, but may not make them stop being documents
+        user = User.objects.create_user(username="no-delete")
+        user.user_permissions.add(
+            Permission.objects.get(codename="change_document"),
+            Permission.objects.get(codename="view_document"),
+        )
+        for doc in (self.doc1, self.doc2):
+            doc.owner = user
+            doc.save()
+        self.client.force_authenticate(user=user)
+
+        response = self.client.post(
+            "/api/documents/merge_as_versions/",
+            {
+                "documents": [self.doc1.id, self.doc2.id],
+                "root_document_id": self.doc1.id,
+            },
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        merge_mock.assert_not_called()
+
     @mock.patch("documents.views.bulk_edit.merge_as_versions")
     def test_rejects_unselected_root(self, merge_mock) -> None:
         doc3 = Document.objects.create(

src/documents/views.py

@@ -2843,6 +2843,9 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
             has_perms
             and (
                 method == bulk_edit.delete
+                # Sources stop being documents of their own, and removing one
+                # again afterwards needs delete_document
+                or method == bulk_edit.merge_as_versions
                 or (
                     method in [bulk_edit.merge, bulk_edit.split]
                     and parameters.get("delete_originals")