extensions/tests/test_delete.py

@@ -1,6 +1,7 @@
 from django.test import TestCase
 
 from common.tests.factories.extensions import create_approved_version
+from common.tests.factories.users import UserFactory
 
 
 class DeleteTest(TestCase):
@@ -18,3 +19,16 @@ class DeleteTest(TestCase):
         extension.refresh_from_db()
         self.assertIsNotNone(extension.date_deleted)
         self.assertTrue(all(v.date_deleted is not None for v in extension.versions.all()))
+
+    def test_random_user_cant_delete(self):
+        extension = create_approved_version().extension
+
+        url = extension.get_delete_url()
+        user = UserFactory()
+        self.client.force_login(user)
+        response = self.client.post(url)
+
+        self.assertEqual(response.status_code, 403)
+        extension.refresh_from_db()
+        self.assertIsNone(extension.date_deleted)
+        self.assertTrue(all(v.date_deleted is None for v in extension.versions.all()))

extensions/views/manage.py

@@ -162,7 +162,7 @@ class UpdateExtensionView(
 
 class DeleteExtensionView(
     LoginRequiredMixin,
-    MaintainedExtensionMixin,
+    UserPassesTestMixin,
     DeleteView,
 ):
     model = Extension
@@ -184,6 +184,10 @@ class DeleteExtensionView(
         context['confirm_url'] = self.object.get_delete_url()
         return context
 
+    def test_func(self) -> bool:
+        # Only maintainers allowed
+        return self.get_object().has_maintainer(self.request.user)
+
 
 class VersionDeleteView(
     LoginRequiredMixin,