Non-admins can create workflows but cannot view, edit or delete their own #22

New Issue

2026-09-08T20:57:28-04:00

jared commented

2026-09-08 20:57:28 -04:00

Overview

POST /api/workflows is open to any employee, but PUT/DELETE are admin-only and the Edit button (the only way to read a definition in the UI) is hidden for non-admins. An employee who makes a typo in a workflow they just created is stuck; they also cannot inspect what an existing workflow will do before pressing Execute.

Suggested fix

Add a read-only View definition modal for everyone (steps list rendered human-readably).
Allow the creator to edit/delete their own workflows, or make creation admin-only for consistency.

## Overview `POST /api/workflows` is open to any `employee`, but `PUT`/`DELETE` are admin-only and the Edit button (the only way to *read* a definition in the UI) is hidden for non-admins. An employee who makes a typo in a workflow they just created is stuck; they also cannot inspect what an existing workflow will do before pressing Execute. ## Suggested fix - Add a read-only **View definition** modal for everyone (steps list rendered human-readably). - Allow the creator to edit/delete their own workflows, or make creation admin-only for consistency.

jared added the enhancement ux frontend backend priority/medium labels 2026-09-08 20:57:28 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/pulse#22