Raja-Hamid opened a new pull request, #6834:
URL: https://github.com/apache/texera/pull/6834
### What changes were proposed in this PR?
On the workflow list, the description of a **read-only** workflow was still
editable. `ListItemComponent`'s `editable` input only means "this is the
private dashboard view" and is hardcoded `[editable]="true"` by the container
(`user-workflow.component.html:184,193`), so it was never an access check —
`onEditDescription()` guarded on it alone. A user with READ-only access to a
shared workflow could open the editor, and only the backend rejected the save
(`WorkflowResource.scala:153-164`, `ForbiddenException("No sufficient access
privilege.")`).
The access data was already on the bound entry and already used in the same
file (e.g. `list-item.component.ts:219` for the share modal) — it just wasn't
consulted for editing.
**Fix** (`list-item.component.ts` / `.html`):
- new `canEditDescription` getter: `editable && entry.accessLevel ===
"WRITE"`
- `onEditDescription()` guards on it — both entry points funnel through it,
so the modal and the failing request are unreachable without WRITE
- the *Edit Description* control and the "Write a description…" hover
placeholder are hidden for read-only entries
Mirrors the existing dataset pattern
(`user-dataset-list-item.component.html:49`).
Scope is deliberately limited to the description, per the issue. Rename
(`onEditName()`) and the card view share the same class of bug and are better
handled separately, as is the duplicate error toast.
<img width="1918" height="1016" alt="Recording 2026-07-23 202732"
src="https://github.com/user-attachments/assets/87577378-be10-4af1-a22f-57f7d1c42f97";
/>
### Any related issues, documentation, discussions?
Closes #3497
### How was this PR tested?
Unit tests (Vitest) — 4 new cases in `list-item.component.spec.ts` (no-modal
+ control-hidden for READ, plus WRITE regression guards):
corepack yarn ng test --watch=false
--include="**/list-item.component.spec.ts"
→ **24/24 passing**; 2 of the new cases were red before the fix.
Regression across components embedding `ListItemComponent`:
corepack yarn ng test --watch=false
--include="/list-item.component.spec.ts"
--include="/card-item.component.spec.ts"
--include="/search-results.component.spec.ts"
--include="/user-workflow.component.spec.ts"
--include="**/hub-search-result.component.spec.ts"
→ **5 files, 180/180 passing**
Manual: `bin/single-node` stack + `ng serve`; seeded a workflow owned by
another user and shared READ-only. In **Your Work → Workflows** the read-only
row no longer exposes the Edit Description control or the hover placeholder and
clicking does nothing, while WRITE rows still open the editor and save
successfully.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Yes alongside Claude Code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
