Require delete permission for blog posts

[ahmetcelik05]

Description

Remove the ownership-based fallback that allowed post creators to delete their own posts in Detail.cshtml. Deletion now strictly requires BloggingPermissions.Posts.Delete, centralizing authorization on explicit permissions to enforce consistent access control.

Resolves vs-internal-issue-#8299

Checklist

• I fully tested it as developer
• no need to document

[Copilot]

Pull request overview

Tightens blog post deletion UI authorization by removing the “creator can delete own post” fallback and showing the Delete action only when the explicit delete permission is granted.

Changes:

• Updated the post detail page to render the Delete link only when BloggingPermissions.Posts.Delete is granted.

Comments suppressed due to low confidence (1)

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml:102

• The UI now hides the Delete link unless BloggingPermissions.Posts.Delete is granted, but the backend authorization policy still has an ownership-based fallback for delete (PostAuthorizationHandler.HasDeletePermission returns true for the creator). This means deletion is not strictly permission-based as described, and any code path that relies on CommonOperations.Delete without the [Authorize(BloggingPermissions.Posts.Delete)] attribute would still allow creators to delete. Consider removing the creator/owner fallback for delete in PostAuthorizationHandler (and ensure update/delete policies align with the intended permission model).

                                        @if (await Authorization.IsGrantedAsync(BloggingPermissions.Posts.Delete))
                                        {
                                            <span class="seperator">|</span>
                                            <a href="#" id="DeletePostLink" data-postid="@Model.Post.Id" data-blogShortName="@Model.BlogShortName">
                                                <i class="fa fa-trash"></i> @L["Delete"]

[yagmurcelk]

Once the release for version 10.2 comes out, it will be tested live.