Add a workflow detail page exposing definition behavior and access (CL-7371) - #561
Merged
TheGreatAxios merged 8 commits intoSep 2, 2026
Merged
Conversation
TheGreatAxios
force-pushed
the
cl-7371-workflow-detail
branch
from
September 2, 2026 07:44
f907d04 to
6c76493
Compare
TheGreatAxios
changed the base branch from
cl-7362-deploy-approval
to
cl-7363-agent-builder-native
September 2, 2026 07:45
TheGreatAxios
force-pushed
the
cl-7371-workflow-detail
branch
from
September 2, 2026 08:50
6c76493 to
36d8f6d
Compare
TheGreatAxios
force-pushed
the
cl-7371-workflow-detail
branch
from
September 2, 2026 09:14
36d8f6d to
fc17285
Compare
TheGreatAxios
force-pushed
the
cl-7371-workflow-detail
branch
from
September 2, 2026 09:33
fc17285 to
9d24860
Compare
A create or PATCH-carried retarget now must clear the same two gates before it is persisted: resolveLaunchableDefinition must resolve the asset, and the acting principal must be authorized for workflow-definition:<id>/read — the same verb listRoutineTargets already checks per row. A denial is a typed 403 alongside the existing 400/404/409 target envelopes, on both the tenant-session and Myra's workflow-run-authenticated routine surfaces. Also routes a pre-existing catch in postRoutineEnabledNotice through reportError, since this change's diff now touches that line and check:report-error requires it.
Covers the pure lifecycle derivation (source-only, pending-approval, deployed, superseded, build-failed) and the detail route's authz-first, 404-on-unknown-asset, and happy-path shape, against a real Postgres.
Adds GET .../workflows/definitions/:definitionAssetId/detail (@corbits/workflow-catalog), authorized per-definition and 404 on an unknown or cross-tenant asset, answering lifecycle, steps, and declared vs. approved grants plus credential binding names (never a value) from native workflow_definition/workflow_definition_version rows and @corbits/workflow-deploy-source. Adds the read-only /workflows/:id page in apps/web with a header, step table, access section, and a why-not-launchable strip for anything short of deployed.
TheGreatAxios
force-pushed
the
cl-7371-workflow-detail
branch
from
September 2, 2026 10:58
e95ce7b to
8bbc6d3
Compare
TheGreatAxios
marked this pull request as ready for review
September 2, 2026 11:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /api/tenants/:tenantId/workflows/definitions/:definitionAssetId/detail(@corbits/workflow-catalog), authorized per-definition (requireGrant(idResource("workflow-definition", ...), "read")) with a 404 on an unknown or cross-tenant asset. Answers lifecycle (source-only/pending-approval/deployed/superseded/build-failed, a pure function unit-tested in isolation), steps in execution order off the frozen wire projection, and declared-vs-approved grants plus credential binding names — never a credential value./workflows/:definitionAssetIdpage inapps/web(header with lifecycle badge + source sha7, steps table, access section, a "why not launchable" strip for anything short of deployed).docs/workflow-detail.md.First useful version, not exhaustive — see that doc's own "left out" section. In particular: the target-picker/agents-settings cross-links the ticket named don't exist yet on this branch (
cl-7362-deploy-approval), so this ships with no inbound links yet; wiring those in is a natural follow-up once those surfaces land.Linear: https://linear.app/abklabs/issue/CL-7371
Test plan
bunx tsc --noEmit -p packages/workflow-catalog,-p apps/hub,-p apps/web— cleanbunx eslinton every touched file — cleanbun run scripts/checks/browser-safe-subpaths.tsandscripts/checks/report-error.ts— clean, no new findingsderiveWorkflowLifecycle(all five lifecycle states)docker compose -f docker-compose.test.yml up -d+bun scripts/db-setup.ts)Resolves CL-7371