argoproj / argoproj/argo-workflows
UI: workflow details DELETE fails silently on Forbidden (no error shown)
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 138
Description
### Pre-requisites
- [x] I have double-checked my configuration.
- [x] The issue can be reliably reproduced (with a readonly RBAC user).
### What happened/what you expected?
When a user without `delete` permission opens a workflow **details** page and clicks **DELETE**:
- The API correctly returns `403 Forbidden` and the workflow is **not** deleted.
- The UI shows **no error toast / ErrorNotice**.
- The page navigates back to the workflow list, so it looks like nothing happened.
On the **workflow list** page, the same Forbidden delete shows an error notification correctly.
On the same details page, **RESUBMIT** Forbidden also shows an `ErrorNotice` correctly.
### Expected
Stay on the details page and show the Forbidden error (same as Resubmit / list-page delete).
### Version
Observed on v3.7.0; still present on latest main / v4.0.7.
### How to reproduce
1. Log in as a readonly SSO / RBAC user (no `delete` on `workflows.argoproj.io`).
2. Open any workflow details page.
3. Click DELETE and confirm.
4. Observe: Network tab shows 403, workflow remains, UI has no error feedback and may navigate to the list.
### Root cause
In `ui/src/workflows/components/workflow-details/workflow-details.tsx`, the DELETE handler uses React `error` state after `await Promise.all(...)`:
```ts
.catch(setError)
...
if (error !== null) {
return;
}
navigation.goto(...);
```
Because of a stale closure, this reads the **old** `error` value (usually `null` after watch `onOpen` clears it), not the result of the delete call. A failed delete therefore still navigates away, and the details-page `ErrorNotice` never becomes visible.
Contributor guide
Research direction
Start in ui/src/workflows/components/workflow-details/workflow-details.tsx and inspect the workflow-details DELETE handler, especially how the failed delete result is handled after await Promise.all(...). Reproduce with a readonly RBAC user and verify that a 403 keeps the user on the details page and displays the Forbidden error, while successful deletion still navigates to the workflow list.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100