tanishqgandhi1908 opened a new issue, #8349:
URL: https://github.com/apache/texera/issues/8349
### What happened?
A collaborator with READ access to a dataset sees write controls in the file
tree. Nothing insecure happens — the backend rejects the request — but the
buttons should not be there:
Delete: every file row shows a trash icon. On a dataset shared READ-only,
all 4 files showed one.
Set as cover: an image file shows the picture icon. Clicking it pops a red
"User has no access to this dataset" toast.
The delete icon is a dataset-only problem — the model detail page already
hides it from READ users.
"Set as cover" is offered on both pages: the same READ-only user sees it on
a model too, because the shared file tree gates that button on "is this an
image file" and nothing else.
Expected: neither control is rendered without write access, the way the
model page already handles delete.
READ-only collaborator on a shared dataset — trash icon on every file:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/6802c9e2-2799-49f8-95ae-331a6f7f9b2a";
/>
The image row also offers "Set as cover"; clicking it gives a 403 toast:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/4cb4f022-3e02-4100-81ee-4ef486a626aa";
/>
Same user on a shared model — no delete icons, but "Set as cover" is still
there:
<img width="1440" height="900" alt="Image"
src="https://github.com/user-attachments/assets/6da4f1e5-684c-4a5d-9759-3395be232045";
/>
### How to reproduce?
1. As the owner, create a dataset with a couple of files including an image
(e.g. images/preview.png), cut a version, and share it with a second user as
READ.
2. Log in as that second user and open the dataset → "Versions & Files".
3. Every file row shows a delete (trash) icon, and the image row also shows
a "Set as cover" icon. The Settings tab and the upload panel are correctly
hidden, so only these two controls leak.
4. Click "Set as cover": a red "User has no access to this dataset" toast
appears.
5. Repeat with a model shared READ-only: no delete icon (already fixed
there), but "Set as cover" is still offered.
### Version/Branch
1.4.0-incubating-SNAPSHOT (main)
### Commit Hash (Optional)
_No response_
### What browsers are you seeing the problem on?
Chrome
### Relevant log output
```shell
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
