Allow query path on disableWriteActions (#2601)

Author: Alex-Tideman

server/go.mod

@@ -1,6 +1,7 @@
 module github.com/temporalio/ui-server/v2
 
 go 1.23
+
 require (
 	github.com/coreos/go-oidc/v3 v3.11.0
 	github.com/gomarkdown/markdown v0.0.0-20241105142532-d03b89096d81

server/server/route/api.go

@@ -25,6 +25,7 @@ package route
 import (
 	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/labstack/echo/v4"
 
@@ -40,7 +41,19 @@ func DisableWriteMiddleware(cfgProvider *config.ConfigProviderWithRefresh) echo.
 				return c.JSON(http.StatusInternalServerError, err)
 			}
 
-			if cfg.DisableWriteActions && c.Request().Method != http.MethodGet {
+			if c.Request().Method == http.MethodGet {
+				return next(c)
+			}
+
+			if cfg.DisableWriteActions {
+				path := c.Request().URL.Path
+				method := c.Request().Method
+
+				if method == http.MethodPost && strings.HasPrefix(path, "/api/v1/namespaces/") &&
+					strings.Contains(path, "/workflows/") && strings.Contains(path, "/query/") {
+					return next(c)
+				}
+
 				return echo.ErrMethodNotAllowed
 			}
 

src/routes/(app)/namespaces/[namespace]/workflows/start-workflow/+page.ts

@@ -6,7 +6,11 @@ import { routeForWorkflows } from '$lib/utilities/route-for';
 
 export const load: PageLoad = async function ({ params, parent }) {
   const data = await parent();
-  if (data.settings.startWorkflowDisabled) {
+  const disabled =
+    data?.settings?.disableWriteActions ||
+    data?.settings?.startWorkflowDisabled;
+
+  if (disabled) {
     const { namespace } = params;
     redirect(302, routeForWorkflows({ namespace }));
   }