Fix: Hide Try Out pages from read-only users in Publisher Portal

[Copilot]

Problem

Read-only users in the Publisher Portal were experiencing errors when accessing Try Out pages. While the Try Out menu items were properly hidden from these users, the underlying routes remained accessible via direct URL navigation. This created a security gap and poor user experience, as read-only users could still navigate to /apis/:api_uuid/test-console and similar URLs, encountering errors when attempting to invoke APIs.

Root Cause

The codebase had inconsistent protection for Try Out functionality:

• Menu items were already protected with {!readOnlyUser && ...} conditional rendering (line 1004)
• Routes were registered unconditionally, allowing direct URL access to Try Out pages

Solution

This PR adds route-level protection by wrapping the Try Out routes with the same {!readOnlyUser && ...} conditional check used for menu items. This ensures that read-only users cannot access Try Out pages through any means.

Changes Made

File: portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/index.jsx

Protected three Try Out routes with conditional rendering:

{!readOnlyUser && (
    <>
        <Route path={Details.subPaths.TRYOUT} ... />
        <Route path={Details.subPaths.TRYOUT_PRODUCT} ... />
        <Route path={Details.subPaths.MCP_PLAYGROUND} ... />
    </>
)}

Routes Protected

1. /apis/:api_uuid/test-console (API Try Out)
2. /api-products/:apiprod_uuid/test-console (API Product Try Out)
3. /mcp-servers/:mcpserver_uuid/mcp-playground (MCP Playground)

Impact

• Read-only users: Cannot access Try Out pages via menu or direct URL, preventing errors
• Regular users: No changes to existing functionality - full access to Try Out pages
• Security: Consistent authorization enforcement across UI and routing layers

Testing

• ✅ Linting passed with no errors
• ✅ Code follows existing patterns in the codebase
• ✅ Minimal changes (4 lines added to wrap existing routes)
• ✅ Non-breaking change - no impact on existing users

Fixes #[issue-number]

[!WARNING]

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scarf.sh
  • Triggering command: node ./report.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Hide the tryout page for read only users</issue_title> <issue_description>### Description

In publisher portal, we need to hide the "Tryout" pages of the APIs for read only users as those user's cannot invoke the APIs

Steps to Reproduce

1. Create a read-only user
2. Go to an API
3. See error

Version

4.6.0

Environment Details (with versions)

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes wso2/api-manager#4340

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud