Fix: ensure ownership for manual WF runs (#14762)

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.spec.ts

@@ -728,6 +728,27 @@ describe('BulkEditorComponent', () => {
     ) // listAllFilteredIds
   })
 
+  it('should require ownership of selected documents to run a workflow', () => {
+    component.manualWorkflows = [{ id: 5 }] as any
+    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
+    jest
+      .spyOn(permissionsService, 'currentUserHasObjectPermissions')
+      .mockReturnValue(true)
+    const ownsDocument = jest
+      .spyOn(permissionsService, 'currentUserOwnsObject')
+      .mockReturnValue(false)
+    jest
+      .spyOn(documentListViewService, 'documents', 'get')
+      .mockReturnValue([{ id: 3 }])
+    jest
+      .spyOn(documentListViewService, 'selected', 'get')
+      .mockReturnValue(new Set([3]))
+
+    expect(component.canRunWorkflow).toBe(false)
+    ownsDocument.mockReturnValue(true)
+    expect(component.canRunWorkflow).toBe(true)
+  })
+
   it('should set modal dialog text accordingly for tag edit confirmation', () => {
     let modal: NgbModalRef
     modalService.activeInstances.subscribe((m) => (modal = m[m.length - 1]))

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.ts

@@ -308,7 +308,9 @@ export class BulkEditorComponent
   }
 
   get canRunWorkflow(): boolean {
-    return this.userCanEditAll && this.manualWorkflows.length > 0
+    return (
+      this.userCanEditAll && this.userOwnsAll && this.manualWorkflows.length > 0
+    )
   }
 
   runWorkflowSelected() {