FlowFuse / FlowFuse/flowfuse

Redirect unauthorized users from application creation and align `/check-name` behavior

Open
#6,110 0 comments 0 reactions 0 assignees View on GitHub
task
Dominant language
JavaScript
Stars
400
Forks
89
Avg merge
1d 20h
Merged PRs (30d)
149

Description

### Description

**Context / Problem**
Users without team-level permission to create an application can access the application creation form. They should be redirected instead. Additionally, the `/check-name` endpoint must consider both team and application contexts when checking instance names during application creation to avoid false negatives for users lacking proper rights.

**Acceptance criteria**
- Users without team permissions to create an application are redirected when accessing the application creation form.
- Direct URL access to the form results in a redirect to an authorized location with an appropriate message.
- Front end prevents navigation to the application creation form if permissions are missing.
- `/check-name` verifies both team and application context when invoked during creation.
- Tests cover redirect logic, correct authorization responses, and accurate `/check-name` validation for authorized vs unauthorized users.

### Epic/Story

_No response_

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.