fix(web): a planless item names its automation by id only to an account that may read the automation, as it does by name

Merged
DA
4d ago
+32-18

A follow-up to #2688, from a Devin finding on #2701.

What changes

The account Inbox read (planless and automations, from #2688) already gave an automation's name only to a reader its READ rule allows, through automationReadableBy. It still gave every workspace member the automation's id. That let a teammate tell a colleague's personal automation's runs apart and correlate them, without being allowed to read the automation.

Now the id goes through the same gate:

  • Each planless entry's automationId comes from the gated join, so it is null wherever the name is: no automation, a deleted one, or one the reader may not read.
  • The automations groups join the same way and group by the gated id, so items whose automation the reader may not read fall into the null group. They are still listed, since D2 makes runs and questions workspace-visible.

Nothing draws these keys yet (step 9 does), so no client changes.

Tests

  • inbox-store.test.ts: once the automation is made personal, the teammate reads the item with automationId and automationName both null, under the null group, and the creator reads both. This fails without the change.

pnpm check:affected passes. This change is server only; CI cannot verify the Mac UI, and ./scripts/verify.sh was not run (LUKE-159 stands in before the first release).

šŸ¤– Generated with Claude Code

Open workspace in Conductor

Devin Review

Summary by cubic

Stops planless inbox items from leaking an automation's id to workspace members who aren't allowed to read the automation.

Previously, every workspace member could see the automation's id even when its name was gated by the automation's read rule. Now the id goes through the same gate as the name: it is null for an account that may not read the automation, and automations groups items whose automation the reader may not read into the null group, where they remain listed since runs and questions stay workspace-visible.

Tests updated to cover the teammate reading both automationId and automationName as null while the creator reads both.