Add missing @PreAuthorize to ProcessRestRepository#delete

[MatusBeke]

Problem

DELETE /api/system/processes/{id} had no method-level authorization check. An anonymous, unauthenticated request could delete any process record.

Root cause

ProcessRestRepository#delete lacked @PreAuthorize, unlike its siblings (findOne, findAll, findByCurrentUser). The only authorization check lived inside ProcessServiceImpl#delete's per-bitstream loop (via bitstreamService.delete()). A process with zero bitstreams (e.g. status SCHEDULED) skips that loop entirely, so the check never runs and the delete proceeds unauthorized.

Change set

Adds @PreAuthorize("hasPermission(#integer, 'PROCESS', 'DELETE')") on ProcessRestRepository#delete, mirroring the existing pattern already used on findOne. Reuses the existing ProcessRestPermissionEvaluatorPlugin (owner-or-admin check, independent of READ/WRITE/DELETE) — no new plugin needed. One line, no other changes; out of scope: adding a regression IT for the zero-bitstream case (flagged below as a follow-up).

Test evidence

mvn -pl dspace-server-webapp -am -DskipTests install   -> BUILD SUCCESS
mvn checkstyle:check -pl dspace-server-webapp          -> 0 Checkstyle violations

Risk & rollback

Purely additive authorization check — only tightens access; the existing owner/admin callers are unaffected. Rollback = revert the single annotation line.

Notes / assumptions

• Originated from security audit (2026_07_20_dq)
• Follow-up (not blocking): add a ProcessRestRepositoryIT case asserting an anonymous DELETE on a bitstream-less (SCHEDULED) process now returns 401/403 instead of 204.

[Copilot]

Pull request overview

Tightens security on the System Processes REST API by adding a missing method-level authorization check to prevent unauthorized deletion of process records via DELETE /api/system/processes/{id}.

Changes:

• Adds @PreAuthorize("hasPermission(#…, 'PROCESS', 'DELETE')") to ProcessRestRepository#delete to align with existing authorization patterns on related endpoints.

[MatusBeke]

Fixed: renamed the parameter from integer to id (and updated the SpEL expression to #id), matching the convention used elsewhere in this class. Files: ProcessRestRepository.java. Validation: mvn -pl dspace-server-webapp -am install (BUILD SUCCESS) + checkstyle:check (0 violations).

[MatusBeke]

Fixed: added 3 cases to ProcessRestRepositoryIT covering DELETE authorization on the exact bitstream-less/SCHEDULED process shape that bypassed the check: deleteProcessAdmin (204, then 404 on re-fetch), deleteProcessAnonymousUnauthorizedException (401), deleteProcessForDifferentUserForbiddenException (403). Files: ProcessRestRepositoryIT.java. Validation: compiles clean under failsafe locally; full run needs the Docker Postgres/Solr stack this repo's CI already provisions (skipIntegrationTests=false in build.yml), so the authoritative run is the CI check on this PR.