Repository: kestra-io/kestra
Issue: Remove "Use" button for users without Flow CREATE right
Labels: bug
enhancement

### Expected Behavior

_No response_

### Actual Behaviour

https://demo.kestra.io/ui/blueprints/community/105 with "demo" user still shows the "Use" button

### Steps To Reproduce

_No response_

### Environment Information

- Kestra Version:
- Operating System (OS / Docker / Kubernetes):
- Java Version (If not docker):


### Example flow

_No response_

Issue comments:

Pull request review comments:

Patch that resolved the issue:
diff --git a/ui/src/components/flows/blueprints/BlueprintDetail.vue b/ui/src/components/flows/blueprints/BlueprintDetail.vue
index f30749c53b..56871259ba 100644
--- a/ui/src/components/flows/blueprints/BlueprintDetail.vue
+++ b/ui/src/components/flows/blueprints/BlueprintDetail.vue
@@ -11,7 +11,7 @@
                     <h2 class="blueprint-title align-self-center">
                         {{ blueprint.title }}
                     </h2>
-                    <div class="ms-auto align-self-center">
+                    <div v-if="userCanCreateFlow" class="ms-auto align-self-center">
                         <router-link :to="{name: 'flows/create'}" @click="asAutoRestoreDraft">
                             <el-button size="large" type="primary" v-if="!embed">
                                 {{ $t('use') }}
@@ -93,6 +93,9 @@
     import {shallowRef} from "vue";
     import ContentCopy from "vue-material-design-icons/ContentCopy.vue";
     import Markdown from "../../layout/Markdown.vue";
+    import {mapState} from "vuex";
+    import permission from "../../../models/permission";
+    import action from "../../../models/action";
 
 
     export default {
@@ -158,6 +161,10 @@
             }
         },
         computed: {
+            ...mapState("auth", ["user"]),
+            userCanCreateFlow() {
+                return this.user.hasAnyAction(permission.FLOW, action.CREATE);
+            },
             parsedFlow() {
                 return {
                     ...YamlUtils.parse(this.blueprint.flow),
diff --git a/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue b/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
index e5e04741eb..c44df698f8 100644
--- a/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
+++ b/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
@@ -56,7 +56,7 @@
                                     {{ $t('copy') }}
                                 </el-button>
                             </el-tooltip>
-                            <el-button v-else size="large" text bg @click="blueprintToEditor(blueprint.id)">
+                            <el-button v-else-if="userCanCreateFlow" size="large" text bg @click="blueprintToEditor(blueprint.id)">
                                 {{ $t('use') }}
                             </el-button>
                         </div>
@@ -76,6 +76,9 @@
     import {shallowRef} from "vue";
     import ContentCopy from "vue-material-design-icons/ContentCopy.vue";
     import RestoreUrl from "../../../../mixins/restoreUrl";
+    import permission from "../../../../models/permission";
+    import action from "../../../../models/action";
+    import {mapState} from "vuex";
 
     export default {
         mixins: [RestoreUrl, DataTableActions],
@@ -198,6 +201,12 @@
                 this.load(this.onDataLoaded);
             }
         },
+        computed: {
+            ...mapState("auth", ["user"]),
+            userCanCreateFlow() {
+                return this.user.hasAnyAction(permission.FLOW, action.CREATE);
+            }
+        },
         watch: {
             $route(newValue, oldValue) {
                 if (oldValue.name === newValue.name) {


Test patch: