Skip to content

fix(sidebar): Write members see active Delete menu but get 403 from API #4695

@minijeong-log

Description

@minijeong-log

Describe the bug

Write/Read workspace members can see the Delete option in the workflow/folder context menu, but the DELETE API enforces action: 'admin', so clicking Delete always fails silently (403).

  • Write members: Delete menu appears enabled, but clicking it does nothing (API returns 403)
  • Read members: Delete menu appears disabled, which is correct visually but the reason is !canEdit rather than the actual admin requirement

The ContextMenu component already has a showDelete prop with conditional rendering ({showDelete && ...}), but neither workflow-item.tsx nor folder-item.tsx passes this prop, so it defaults to true and the Delete option is always shown.

To Reproduce

  1. Add a user to a workspace with write permission
  2. Log in as that user
  3. Right-click a workflow or folder in the sidebar
  4. Observe the Delete menu item is enabled
  5. Click Delete → confirm in the modal
  6. Nothing happens (API returns 403, no error shown to user)

Expected behavior

Non-admin members should not see the Delete menu option at all, since only admins can delete workflows/folders.

Additional context

  • apps/sim/app/api/workflows/[id]/route.ts DELETE handler uses action: 'admin'
  • context-menu.tsx already has showDelete?: boolean (default true) with {showDelete && (...)} conditional rendering
  • The fix is to pass showDelete={userPermissions.canAdmin} from workflow-item.tsx and folder-item.tsx

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions