tanishqgandhi1908 opened a new issue, #8889:
URL: https://github.com/apache/texera/issues/8889
### What happened?
Anyone with WRITE access to a dataset or model can change the owner's own
access. The server only checks that the caller has write access, not whether
the target is the owner.
Sharing the resource with the owner's email as READ succeeds. The owner then
gets read-only controls on their own dataset or model: no Settings tab, no
upload panel, no file delete buttons.
Revoking the owner's access (DELETE
/api/access/dataset/revoke/{did}/{ownerEmail}, same for model) also succeeds,
and the resource disappears from the owner's Datasets/Models list and search.
Expected: changing or revoking the owner's access is refused, as it already
is for workflows ("You cannot modify the owner's permissions!").
The owner's dataset before:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/5ad7076b-0b82-46f3-bd19-2bd9a6f3d777";
/>
The collaborator shares it with the owner as READ:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/f3ba7b14-eb53-4f7f-8f02-612802082dfa";
/>
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/11f97398-5312-4ae6-af44-501f8aeb4b3b";
/>
The owner's dataset afterwards: Settings tab, delete button and upload panel
are gone:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/827c5992-51de-40b7-8a45-d27a18f6c39f";
/>
### How to reproduce?
1. User A creates a dataset and shares it with user B as WRITE.
2. B opens Datasets → Share on that dataset, enters A's email, picks "read",
and clicks Share. It succeeds.
3. A opens the dataset → "Versions & Files": the Settings tab, upload panel
and file delete buttons are gone.
The same steps work on a model.
### Version/Branch
1.4.0-incubating-SNAPSHOT (main)
### Commit Hash (Optional)
_No response_
### What browsers are you seeing the problem on?
_No response_
### Relevant log output
```shell
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
