User is able to view the edition page from an entry on a Workflow App when an entry is not assigned to itself

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.3.X, 7.3.10 DXP GA1, Master
• Fix Version/s: 7.3.X, 7.3.10 DXP FP1, 7.3.10.1 DXP SP1, 7.3.6 CE GA7, Master
• Component/s: App Builder, Workflow
• Labels:
  • backend_test
  • frontend
  • liferay-dxp-73-sp1
  • liferay-fixpack-dxp-1-7310
• Branch Version/s:
  7.3.x
• Backported to Branch:
  Committed
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/96384

Steps to Reproduce:

1. Create a new App Builder Object called "Employee Review".
2. Add a form view called "Name" with one field: "Name".
3. Create a second form view called "Manager Comments" with one field: "Manager Comments".
4. Create a table view called "Reviews" that lists out the "Name" field.
5. Create a new Regular Role: "Manager".
6. Create a new Workflow Powered App with the "Employee Review" object. 
7. For the "Start" step select the "Name" Form View and the "Reviews" table.
8. For step 1 select the "Manager" role as the assignee. For the form views set the "Name" form view as read-only and the "Manager Comments" form view as editable.
9. Save and Publish as both a Widget and a Product Menu App.
10. On a page, add the Name form view.
11. Add an entry by submitting the Name form view.
12. Make sure you are logged in as an Administrator that does not have the "Manager" role. 
13. Navigate to the Product Menu App. You should see a new submission.
14. From the ellipsis menu of the new entry, check to see if you have access to the "Edit" menu item.
15. From the ellipsis menu of the new entry, navigate to the "View" entry page.
16. Verify if you have the Edit button in the top right of the toolbar. (It has a pencil icon).
17. Click to edit the entry.
18. Verify that when editing the entry, that you are able to input text in the "Manager Comments" field, that the "Submit" button is not present, nor is the "Assign" button present.

Expected Result:

• "Edit" option should only be available for the user that has the entry assigned to itself
• If an entry is assigned to a role or to another user, the "Edit" option should not be available

Actual Result:

• "Edit" option is displayed to any user

NOTE: Allowing users with the manager role to edit an entry, but who are not currently assigned the entry, creates much ambiguity for the user. They are provided a page that lets them edit, but with no ability to submit their changes. In order to submit, they will have to assign the entry to themselves, which will require a refresh of the page. This will cause them to lose any changes they have made. The best way to remove this poor experience is to remove the option for users to edit the entry until the entry is assigned to them. By removing the "Edit" option at this stage, the "Assign" option will receive more prominence and naturally direct users to this path.