tanishqgandhi1908 opened a new pull request, #8890:
URL: https://github.com/apache/texera/pull/8890
### What changes were proposed in this PR?
ResourceAccess.grant and revoke only checked that the caller has write
access, so a WRITE collaborator could downgrade the owner to READ or remove the
owner's access row. The owner then got read-only controls on their own dataset
or model, or lost it from their list and search.
Both now refuse with 403 when the target user is the owner, with the message
workflows already use ("You cannot modify the owner's permissions!"). Datasets
and models share this code, so both are fixed.
Before: the collaborator shares the dataset with the owner as READ, and the
owner loses the Settings tab, delete button and upload panel:
<img width="1440" height="900" alt="before-2-collab-shares-owner-read"
src="https://github.com/user-attachments/assets/73d09dde-0f5d-47ed-87a5-28de28f47869";
/>
<img width="1440" height="900" alt="before-4-owner-after"
src="https://github.com/user-attachments/assets/e6c17268-d3dd-48fe-b181-d473051b14d9";
/>
After: the same share is refused, and the owner's page is unchanged:
<img width="1440" height="900" alt="after-1-share-refused"
src="https://github.com/user-attachments/assets/1989748e-e285-4d9d-b46b-2608817e88bb";
/>
<img width="1440" height="900" alt="after-2-owner-keeps-access"
src="https://github.com/user-attachments/assets/b5df49da-fc62-4366-bfa1-d03597a450fc";
/>
### Any related issues, documentation, discussions?
Closes #8889
### How was this PR tested?
Added two cases each to DatasetAccessResourceSpec and
ModelAccessResourceSpec: a WRITE grantee trying to change or revoke the owner's
access gets 403, and the owner's privilege stays WRITE. They fail without the
fix.
sbt "FileService/testOnly *DatasetAccessResourceSpec
*ModelAccessResourceSpec"
# Tests: succeeded 73, failed 0
Also checked against a local stack: sharing a dataset with its owner's email
as READ is refused in the UI, and DELETE
/api/access/dataset/revoke/{did}/{ownerEmail} returns 403.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5.5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
