[mengw15]

What changes were proposed in this PR?

validateUserCanAccessExecutions now throws ForbiddenException (403) instead of a 401. The frontend reads any 401 on an authenticated request as an expired session, so a read-only user who bookmarked, renamed or deleted an execution was logged out. With a 403 they stay logged in.

Bookmark puts its icon back on a refusal. Rename and delete have no error handler, so they fail without a message; that is left out of this PR to keep it small.

Any related issues, documentation, discussions?

Closes #9324.

How was this PR tested?

Added a read-only bookmark case to WorkflowExecutionsResourceSpec, and the refusal cases now assert 403. Ran sbt "WorkflowExecutionService/testOnly *UserQuotaResourceSpec *WorkflowExecutionsResourceSpec": 84 of 85 pass. The other one, the per-user warehouse case of retrieveWorkflowRuntimeStatistics, fails the same way locally on unmodified main. Putting the 401 back fails the four cases this PR touches.

Not clicked through in a running instance.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-5-5)

[github-actions]

Backport auto-label report

This fix: PR was checked against each actively-supported release branch. A release/* label nominates a backport target; the branch's release manager approving this PR is what sends the fix there. The required Backport Approvals check stays red until every label below is approved, so each manager either approves or removes their own label — which is why the labels left on a merged PR are exactly the branches it reached.

Release branch	Analysis
✅ release/v1.3	Change detected on this branch — label added; this fix is queued to backport here.
✅ release/v1.2	Change detected on this branch — label added; this fix is queued to backport here. @xuang7 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other. Review requested.

Auto-label run.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Committers with relevant context: @parshimers
  You can request their reviews formally with /request-review @parshimers.

[github-actions]

⚠️ Benchmark changes need a look

🟢 0 better · 🔴 8 worse · ⚪ 7 noise (<±5%) · 0 without baseline

Compared against main e70d67e benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	401	0.245	24,220/32,628/32,628 us	🔴 +13.2% / 🔴 +148.6%
🔴	bs=100 sw=10 sl=64	799	0.488	120,698/147,885/147,885 us	🔴 +8.6% / 🔴 +62.3%
⚪	bs=1000 sw=10 sl=64	954	0.582	1,039,062/1,131,347/1,131,347 us	⚪ within ±5% / 🔴 +27.2%

Baseline details

Latest main e70d67e from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	401 tuples/sec	454 tuples/sec	931.98 tuples/sec	-11.7%	-57.0%
bs=10 sw=10 sl=64	MB/s	0.245 MB/s	0.277 MB/s	0.569 MB/s	-11.6%	-56.9%
bs=10 sw=10 sl=64	p50	24,220 us	21,539 us	10,818 us	+12.4%	+123.9%
bs=10 sw=10 sl=64	p95	32,628 us	28,828 us	13,127 us	+13.2%	+148.6%
bs=10 sw=10 sl=64	p99	32,628 us	28,828 us	16,504 us	+13.2%	+97.7%
bs=100 sw=10 sl=64	throughput	799 tuples/sec	854 tuples/sec	1,210 tuples/sec	-6.4%	-34.0%
bs=100 sw=10 sl=64	MB/s	0.488 MB/s	0.521 MB/s	0.739 MB/s	-6.3%	-33.9%
bs=100 sw=10 sl=64	p50	120,698 us	111,117 us	85,326 us	+8.6%	+41.5%
bs=100 sw=10 sl=64	p95	147,885 us	153,428 us	91,092 us	-3.6%	+62.3%
bs=100 sw=10 sl=64	p99	147,885 us	153,428 us	102,379 us	-3.6%	+44.4%
bs=1000 sw=10 sl=64	throughput	954 tuples/sec	955 tuples/sec	1,240 tuples/sec	-0.1%	-23.0%
bs=1000 sw=10 sl=64	MB/s	0.582 MB/s	0.583 MB/s	0.757 MB/s	-0.2%	-23.1%
bs=1000 sw=10 sl=64	p50	1,039,062 us	1,044,788 us	840,622 us	-0.5%	+23.6%
bs=1000 sw=10 sl=64	p95	1,131,347 us	1,107,648 us	889,172 us	+2.1%	+27.2%
bs=1000 sw=10 sl=64	p99	1,131,347 us	1,107,648 us	931,615 us	+2.1%	+21.4%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,498.31,200,128000,401,0.245,24220.27,32627.72,32627.72
1,100,10,64,20,2501.85,2000,1280000,799,0.488,120697.60,147884.58,147884.58
2,1000,10,64,20,20972.53,20000,12800000,954,0.582,1039061.73,1131346.82,1131346.82

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.40%. Comparing base (e70d67e) to head (92bb73b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #9325      +/-   ##
============================================
+ Coverage     92.20%   92.40%   +0.20%     
- Complexity     4977     6066    +1089     
============================================
  Files          1275     1307      +32     
  Lines         55568    59996    +4428     
  Branches       7163     7759     +596     
============================================
+ Hits          51237    55442    +4205     
- Misses         2555     2702     +147     
- Partials       1776     1852      +76     

Flag	Coverage Δ		*Carryforward flag
access-control-service	77.44% <ø> (ø)		Carriedforward from e70d67e
agent-service	99.53% <ø> (ø)		Carriedforward from e70d67e
amber	88.30% <ø> (+1.52%)	⬆️
computing-unit-managing-service	64.02% <ø> (ø)		Carriedforward from e70d67e
config-service	87.61% <ø> (ø)		Carriedforward from e70d67e
file-service	82.29% <ø> (ø)		Carriedforward from e70d67e
frontend	96.57% <ø> (ø)		Carriedforward from e70d67e
notebook-migration-service	83.77% <ø> (ø)		Carriedforward from e70d67e
pyamber	98.54% <ø> (ø)		Carriedforward from e70d67e
workflow-compiling-service	77.95% <ø> (ø)		Carriedforward from e70d67e

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.