Skip to content

fix(sidebar): Write members see active Delete menu but get 403 from API #4695

Description

@minijeong-log

Describe the bug

Write/Read workspace members can see the Delete option in the workflow/folder context menu, but the DELETE API enforces action: 'admin', so clicking Delete always fails silently (403).

  • Write members: Delete menu appears enabled, but clicking it does nothing (API returns 403)
  • Read members: Delete menu appears disabled, which is correct visually but the reason is !canEdit rather than the actual admin requirement

The ContextMenu component already has a showDelete prop with conditional rendering ({showDelete && ...}), but neither workflow-item.tsx nor folder-item.tsx passes this prop, so it defaults to true and the Delete option is always shown.

To Reproduce

  1. Add a user to a workspace with write permission
  2. Log in as that user
  3. Right-click a workflow or folder in the sidebar
  4. Observe the Delete menu item is enabled
  5. Click Delete → confirm in the modal
  6. Nothing happens (API returns 403, no error shown to user)

Expected behavior

Non-admin members should not see the Delete menu option at all, since only admins can delete workflows/folders.

Additional context

  • apps/sim/app/api/workflows/[id]/route.ts DELETE handler uses action: 'admin'
  • context-menu.tsx already has showDelete?: boolean (default true) with {showDelete && (...)} conditional rendering
  • The fix is to pass showDelete={userPermissions.canAdmin} from workflow-item.tsx and folder-item.tsx

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions