[PATCH access-control 0/2] fix: #6510: Allow deleting ACLs for non-existent entities & add API tests

[Elias Huhsovitz <e.huhsovitz@proxmox.com>]

This series fixes Bug #6510, which prevents the deletion of ACLs
for non-existent users, groups, or API tokens.

Patch 1/2 modifies the `update_acl` API endpoint to bypass the
entity existence check when the `delete` flag is set. This change
allows administrators to clean up orphaned ACLs without weakening the
strict validation applied when adding new permissions.

Patch 2/2 introduces automated tests for the
`PUT /access/acl` endpoint. The test suite verifies standard creation,
modification, and deletion workflows, enforces privilege boundaries,
and specifically tests the edge case resolved in the first patch.

Elias Huhsovitz (2):
  fix #6510: api: acl: allow deleting ACLs for non-existent entities
  test: api: add tests for ACL modification endpoint

 src/PVE/API2/ACL.pm             |   6 +-
 src/test/api-tests.pl           |   2 +-
 src/test/api-update-acl-test.pl | 301 ++++++++++++++++++++++++++++++++
 3 files changed, 305 insertions(+), 4 deletions(-)
 create mode 100644 src/test/api-update-acl-test.pl

-- 
2.47.3