Guard against null workflow item in the WORKFLOWITEM permission evaluator

WorkflowRestPermissionEvaluatorPlugin dereferenced the result of
workflowItemService.find() without a null check, so an unknown id from an
authenticated non-admin threw a NullPointerException (HTTP 500) instead of
404. The sibling PoolTask/ClaimedTask evaluators already guard this case;
mirror them by returning true for a null item so the handler can produce the
proper 404. Now reachable via the newly authorized /step subresource.

Add a regression test asserting an unknown workflowitem /step id yields 404.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: MatusBeke

dspace-server-webapp/src/main/java/org/dspace/app/rest/security/WorkflowRestPermissionEvaluatorPlugin.java

@@ -81,6 +81,10 @@ public boolean hasDSpacePermission(Authentication authentication, Serializable t
             }
             int dsoId = Integer.parseInt(targetId.toString());
             XmlWorkflowItem workflowItem = workflowItemService.find(context, dsoId);
+            // If the workflow item is null then we give permission so we can throw another status code instead
+            if (workflowItem == null) {
+                return true;
+            }
             // submitter can see their inprogress submission
             if (ePerson.equals(workflowItem.getSubmitter())) {
                 return true;

dspace-server-webapp/src/test/java/org/dspace/app/rest/WorkflowStepLinkRepositoryIT.java

@@ -148,4 +148,21 @@ public void workflowItemStepEnforcesAuthorization() throws Exception {
         getClient(adminToken).perform(get(stepPath)).andExpect(status().isOk());
     }
 
+    @Test
+    public void workflowItemStepWithUnknownIdIsNotFound() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        EPerson ePerson = EPersonBuilder.createEPerson(context)
+                .withEmail("lookup-step@example.com").withPassword(password).build();
+
+        context.restoreAuthSystemState();
+
+        String token = getAuthToken(ePerson.getEmail(), password);
+
+        // an authenticated (non-admin) user requesting an unknown workflow item id must get 404, not a 500
+        // caused by an unchecked null in the WORKFLOWITEM permission evaluator
+        getClient(token).perform(get("/api/workflow/workflowitems/" + Integer.MAX_VALUE + "/step"))
+                .andExpect(status().isNotFound());
+    }
+
 }