Arvados

When pressing the "cancel" button on a job as a user who isn't allowed to cancel the job, workbench is silent on the front-end -- although in the javascript console it gives a: "422 (Unprocessable Entity)" error.

In the workbench logs, it seems that it's request to the API server returned a 403 Permission Denied error:

Started POST "/jobs/z8ta6-8i9sb-q4mufvvy1sml85h/cancel" for 127.0.0.1 at 2016-02-08 17:01:14 +0000
Processing by JobsController#cancel as JS
  Parameters: {"utf8"=>"✓", "return_to"=>"/pipeline_instances/z8ta6-d1hrv-jdkrt8cdtjgiobw", "button"=>"", "id"=>"z8ta6-8i9sb-q4mufvvy1sml85h"}
#<ArvadosApiClient::AccessForbiddenException: #<ArvadosModel::PermissionDeniedError: ArvadosModel::PermissionDeniedError> [API: 403]>
/var/www/arvados-workbench/current/app/models/arvados_api_client.rb:167:in `api'
/var/www/arvados-workbench/current/app/models/job.rb:30:in `cancel'
/var/www/arvados-workbench/current/app/controllers/jobs_controller.rb:50:in `cancel'
...

In the API server logs:

User z8ta6-tpzed-s6urztfw1f2twvc tried to change protected job attributes on locked Job z8ta6-8i9sb-q4mufvvy1sml85h
#<ArvadosModel::PermissionDeniedError: ArvadosModel::PermissionDeniedError>

Indeed, I was trying to cancel the job by a user other than the user who started the jobs. However, my expectation would be that either the workbench would report back the error and give some indication that there is a problem to do with permissions, or perhaps that the cancel button should be disabled if there is in fact no point in pressing it.