argoproj / argoproj/argo-workflows

UI: workflow details DELETE fails silently on Forbidden (no error shown)

Open Beginner friendly
#16,409 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 20h
Merged PRs (30d)
138

Description

### Pre-requisites

- [x] I have double-checked my configuration.
- [x] The issue can be reliably reproduced (with a readonly RBAC user).

### What happened/what you expected?

When a user without `delete` permission opens a workflow **details** page and clicks **DELETE**:

- The API correctly returns `403 Forbidden` and the workflow is **not** deleted.
- The UI shows **no error toast / ErrorNotice**.
- The page navigates back to the workflow list, so it looks like nothing happened.

On the **workflow list** page, the same Forbidden delete shows an error notification correctly.
On the same details page, **RESUBMIT** Forbidden also shows an `ErrorNotice` correctly.

### Expected

Stay on the details page and show the Forbidden error (same as Resubmit / list-page delete).

### Version

Observed on v3.7.0; still present on latest main / v4.0.7.

### How to reproduce

1. Log in as a readonly SSO / RBAC user (no `delete` on `workflows.argoproj.io`).
2. Open any workflow details page.
3. Click DELETE and confirm.
4. Observe: Network tab shows 403, workflow remains, UI has no error feedback and may navigate to the list.

### Root cause

In `ui/src/workflows/components/workflow-details/workflow-details.tsx`, the DELETE handler uses React `error` state after `await Promise.all(...)`:

```ts
.catch(setError)
...
if (error !== null) {
return;
}
navigation.goto(...);
```

Because of a stale closure, this reads the **old** `error` value (usually `null` after watch `onOpen` clears it), not the result of the delete call. A failed delete therefore still navigates away, and the details-page `ErrorNotice` never becomes visible.

Contributor guide

Open the contributing guide

Research direction

Start in ui/src/workflows/components/workflow-details/workflow-details.tsx and inspect the workflow-details DELETE handler, especially how the failed delete result is handled after await Promise.all(...). Reproduce with a readonly RBAC user and verify that a 403 keeps the user on the details page and displays the Forbidden error, while successful deletion still navigates to the workflow list.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.