Wikiページ並び替えAPIに書き込み権限チェックを追加

[NishikawaKoharu]

Purpose

Add write permission check to the wiki page sort API (project_update_wiki_page_sort), which was missing authorization controls.

Changes

• Added @must_have_permission(WRITE) and @must_not_be_registration decorators to project_update_wiki_page_sort in addons/wiki/views.py
• Added tests for unauthorized (401) and forbidden (403) responses in addons/wiki/tests/test_wiki.py

QA Notes

• Does this change require a data migration? No
• What is the level of risk?
  • Any permissions code touched? Yes. Added permission decorators to an endpoint that previously had none. - Is this an additive or subtractive change, other?
  • Is this an additive or subtractive change, other? Additive (adding checks that were missing)
• How can QA verify? (Through UI, API, AdminApp or AdminAdminApp?)
  • Through API. No version change. Endpoint: POST /api/v1/project//wiki/sort/update/
  • Verify that a logged-in user with WRITE permission can sort wiki pages (200)
  • Verify that an unauthenticated request is rejected (401)
  • Verify that a READ-only contributor is rejected (403)
  • Verify that the request is rejected for registrations (400)
• What features or workflows might this change impact? Wiki page reordering only
• How will this impact performance? No impact

Documentation

No documentation changes required.

Side Effects

None. The UI already restricts the sort button to users with write permission. This change aligns the API behavior with the existing UI behavior.

Ticket

https://redmine.devops.rcos.nii.ac.jp/issues/60809