A quick progress update after digging into the existing permanent-deletion code:
I found that Discourse already has the actual bulk deletion behaviour needed here. When the first post is permanently destroyed, PostDestroyer can already recursively permanently destroy the remaining posts in the topic. The restriction is mainly in the permission/policy checks which currently require the other posts to be permanently deleted first.
I’ve therefore moved away from the site-wide enum I suggested above and have a working implementation using a more conservative opt-in model:
- the existing
can_permanently_deletesetting remains the master switch - there is an additional hidden operator-level gate, disabled by default
- when both are enabled, each admin can individually opt in under Preferences → Interface
- one admin opting in does not change the behaviour for any other admin
- disabling the hidden gate immediately restores the existing behaviour globally
- the existing permanent-deletion confirmation and other safeguards remain in place
The preference is currently labelled:
Allow permanent topic deletion to delete all posts
with the explanation:
When permanently deleting a topic, also permanently delete all remaining posts instead of requiring them to be permanently deleted individually.
I’ve added backend policy/security tests, controller coverage confirming that the topic and all remaining posts are actually permanently removed, serializer/API coverage, and frontend acceptance tests for the preference visibility and saving. Those are passing.
I’m also looking at recording changes to this per-admin opt-in in the Staff Action Logs, since enabling a more destructive deletion mode seems worth having as a timestamped audit event.
I’ll post the GitHub PR once I’ve finished that and the final review.