Fix: ensure ownership for manual WF runs (#14762)

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.spec.ts

@@ -728,6 +728,27 @@ describe('BulkEditorComponent', () => {
     ) // listAllFilteredIds
   })
 
+  it('should require ownership of selected documents to run a workflow', () => {
+    component.manualWorkflows = [{ id: 5 }] as any
+    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
+    jest
+      .spyOn(permissionsService, 'currentUserHasObjectPermissions')
+      .mockReturnValue(true)
+    const ownsDocument = jest
+      .spyOn(permissionsService, 'currentUserOwnsObject')
+      .mockReturnValue(false)
+    jest
+      .spyOn(documentListViewService, 'documents', 'get')
+      .mockReturnValue([{ id: 3 }])
+    jest
+      .spyOn(documentListViewService, 'selected', 'get')
+      .mockReturnValue(new Set([3]))
+
+    expect(component.canRunWorkflow).toBe(false)
+    ownsDocument.mockReturnValue(true)
+    expect(component.canRunWorkflow).toBe(true)
+  })
+
   it('should set modal dialog text accordingly for tag edit confirmation', () => {
     let modal: NgbModalRef
     modalService.activeInstances.subscribe((m) => (modal = m[m.length - 1]))

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.ts

@@ -308,7 +308,9 @@ export class BulkEditorComponent
   }
 
   get canRunWorkflow(): boolean {
-    return this.userCanEditAll && this.manualWorkflows.length > 0
+    return (
+      this.userCanEditAll && this.userOwnsAll && this.manualWorkflows.length > 0
+    )
   }
 
   runWorkflowSelected() {

src/documents/permissions.py

@@ -789,6 +789,7 @@ def has_document_operation_permissions(
                 bulk_edit.edit_pdf,
                 bulk_edit.merge_as_versions,
                 bulk_edit.remove_password,
+                bulk_edit.run_workflow,
             ]
         )
         or (

src/documents/tests/test_api_bulk_edit.py

@@ -703,11 +703,12 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
 
     @mock.patch("documents.views.bulk_edit.run_workflow")
     def test_run_workflow_requires_ownership(self, m) -> None:
-        """A non-owner without document ownership is forbidden (actions mutate docs)."""
+        """A non-owner with change permission cannot run mutating workflow actions."""
         self.setup_mock(m, "run_workflow")
-        user = UserFactory(username="no_perms")
+        user = UserFactory(username="non_owner")
         grant_all_global(user)
         doc = DocumentFactory(owner=UserFactory(username="other"))
+        grant_object(user, doc, "change_document")
         workflow = self._make_manual_workflow()
         self.client.force_authenticate(user=user)