feat: default steps are read only

server/internal/api/workflows.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -185,6 +186,10 @@ func updateStep(c *gin.Context) {
 		return
 	}
 	if err := services.UpdateStep(auth.InstanceID(c), c.Param("id"), s); err != nil {
+		if errors.Is(err, services.ErrDefaultStep) {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -194,6 +199,10 @@ func updateStep(c *gin.Context) {
 
 func deleteStep(c *gin.Context) {
 	if err := services.DeleteStep(auth.InstanceID(c), c.Param("id")); err != nil {
+		if errors.Is(err, services.ErrDefaultStep) {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}

server/internal/services/workflows.go

@@ -2,6 +2,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -13,6 +14,24 @@ import (
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
+// ErrDefaultStep is returned when a caller tries to edit or delete a step that
+// came from the image's default library. Those rows are re-seeded from disk on
+// every boot, so an edit would be silently reverted and a delete would come
+// back — refusing is honest about who owns them.
+var ErrDefaultStep = errors.New("this step ships with Vantage and cannot be edited or deleted; duplicate it to make your own copy")
+
+func isDefaultStep(ctx context.Context, instanceID, stepID string) (bool, error) {
+	var s models.WorkflowStep
+	err := db.Col("workflow_steps").FindOne(ctx, bson.M{"step_id": stepID, "instance_id": instanceID}).Decode(&s)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return s.Source == "default", nil
+}
+
 func wfCtx() (context.Context, context.CancelFunc) {
 	return context.WithTimeout(context.Background(), 10*time.Second)
 }
@@ -115,6 +134,11 @@ func CreateStep(instanceID string, s models.WorkflowStep) (*models.WorkflowStep,
 func UpdateStep(instanceID, stepID string, s models.WorkflowStep) error {
 	ctx, cancel := wfCtx()
 	defer cancel()
+	if def, err := isDefaultStep(ctx, instanceID, stepID); err != nil {
+		return err
+	} else if def {
+		return ErrDefaultStep
+	}
 	_, err := db.Col("workflow_steps").UpdateOne(ctx, bson.M{"step_id": stepID, "instance_id": instanceID}, bson.M{"$set": bson.M{
 		"name":             s.Name,
 		"description":      s.Description,
@@ -131,6 +155,11 @@ func UpdateStep(instanceID, stepID string, s models.WorkflowStep) error {
 func DeleteStep(instanceID, stepID string) error {
 	ctx, cancel := wfCtx()
 	defer cancel()
+	if def, err := isDefaultStep(ctx, instanceID, stepID); err != nil {
+		return err
+	} else if def {
+		return ErrDefaultStep
+	}
 	if _, err := db.Col("workflow_steps").DeleteOne(ctx, bson.M{"step_id": stepID, "instance_id": instanceID}); err != nil {
 		return err
 	}