fix: allow users with view-only permissions to execute workflows

[vijaygovindaraja]

Summary

Users with view-only permissions for workflows cannot trigger active workflows (#15231). The SettingsPermissionGuard(PermissionFlagType.WORKFLOWS) was applied at the class level on WorkflowTriggerResolver, requiring "manage workflow" permission for ALL mutations — including runWorkflowVersion.

Fix

Move the WORKFLOWS permission guard from class-level to method-level on the three management mutations. runWorkflowVersion now only requires authentication (WorkspaceAuthGuard + UserAuthGuard).

Before: Class-level guard blocks all mutations for view-only users

@UseGuards(
  WorkspaceAuthGuard,
  UserAuthGuard,
  SettingsPermissionGuard(PermissionFlagType.WORKFLOWS), // blocks everything
)
export class WorkflowTriggerResolver { ... }

After: Method-level guards on management mutations only

@UseGuards(WorkspaceAuthGuard, UserAuthGuard) // auth only at class level

@UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
async activateWorkflowVersion() { ... }  // manage permission required

@UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
async deactivateWorkflowVersion() { ... } // manage permission required

async runWorkflowVersion() { ... }        // any authenticated user

@UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
async stopWorkflowRun() { ... }           // manage permission required

Permission model after this change

Mutation	Permission required
activateWorkflowVersion	WORKFLOWS (manage)
deactivateWorkflowVersion	WORKFLOWS (manage)
stopWorkflowRun	WORKFLOWS (manage)
runWorkflowVersion	Authentication only (view access)

Fixes #15231

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[github-actions]

Welcome!

Hello there, congrats on your first PR! We're excited to have you contributing to this project.
By submitting your Pull Request, you acknowledge that you agree with the terms of our Contributor License Agreement.

Generated by 🚫 dangerJS against 325d83b

[cubic-dev-ai]

No issues found across 1 file