fix(permissions): add client-side permissions validation to prevent unauthorized actions, upgraded custom tool modal

[waleedlatif1]

Summary

• add client-side permissions validation to prevent unauthorized actions
• upgraded custom tool modal with better error messages and syntax highlighting and a better wand prompt

Type of Change

• Bug fix
• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Nov 28, 2025 8:24pm

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds client-side permissions validation to prevent unauthorized actions and improves the custom tool modal UX.

Key Changes:

• Added disableExport, disableRename, disableDuplicate, and disableDelete props to ContextMenu component to support permission-based UI disabling
• Connected workspace header and workspace selector components to check userPermissions.canEdit and userPermissions.canAdmin before enabling UI actions
• Fixed regex highlighting bug in code editor by using placeholder substitution approach instead of direct regex replacement on HTML-tagged content
• Improved custom tool modal AI prompts with better examples and clearer instructions for parameter referencing
• Enhanced error messages in custom tool modal to provide specific feedback (e.g., function name change restrictions)
• Updated API route to return actual error messages instead of generic messages
• Fixed React SVG attribute from clip-path to clipPath in icon components

Confidence Score: 5/5

• This PR is safe to merge with well-implemented client-side permission checks and improved UX
• All changes are defensive in nature (adding permission checks rather than removing them), the code editor fix properly addresses the previous regex bug using a sound placeholder approach, and the improvements to error messages and prompts enhance user experience without introducing security risks
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components-new/workflow-list/components/context-menu/context-menu.tsx	5/5	Added disable props for menu items to support permissions-based UI disabling
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components-new/workspace-header/workspace-header.tsx	5/5	Connected context menu with user permissions to disable actions based on access level
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-selector/workspace-selector.tsx	5/5	Added admin permission check to workspace export button with appropriate tooltip
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/code-editor/code-editor.tsx	5/5	Fixed regex highlighting by using placeholder substitution to avoid HTML tag conflicts
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/custom-tool-modal/custom-tool-modal.tsx	5/5	Improved AI prompts and error messages, cleaned up code comments, added better error handling for function name changes

Sequence Diagram

sequenceDiagram
    participant User
    participant UI as UI Component
    participant Permissions as Permission System
    participant ContextMenu
    participant API as Custom Tools API

    Note over User,API: Client-Side Permission Validation Flow
    
    User->>UI: Attempt workspace action (rename/duplicate/export/delete)
    UI->>Permissions: Check userPermissions.canEdit/canAdmin
    
    alt Has Permission
        Permissions-->>UI: Permission granted
        UI->>ContextMenu: Enable menu item
        User->>ContextMenu: Click action
        ContextMenu->>API: Execute action
        API-->>User: Action successful
    else No Permission
        Permissions-->>UI: Permission denied
        UI->>ContextMenu: Disable menu item (disabled=true)
        Note over User,ContextMenu: Menu item appears grayed out
        User->>ContextMenu: Click disabled item
        ContextMenu->>ContextMenu: Check if disabled before executing
        ContextMenu-->>User: No action (prevented client-side)
    end

    Note over User,API: Custom Tool Modal Enhancement Flow
    
    User->>UI: Open custom tool modal
    UI->>User: Display improved UI with syntax highlighting
    
    User->>UI: Request AI generation (wand button)
    UI->>API: Generate code with improved prompts
    API-->>UI: Return generated code
    UI->>User: Display with better formatting
    
    User->>UI: Submit invalid tool
    UI->>API: Attempt save
    API-->>UI: Return specific error message
    UI->>User: Display detailed error (e.g., "Cannot change function name")

Loading

[greptile-apps]

_{10 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

@greptile

[greptile-apps]

_{10 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}