flomillot · Oct 26, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 13, 2026 · Oct 15, 2026
diff --git a/src/main/java/org/gridsuite/study/server/controller/StudyController.java b/src/main/java/org/gridsuite/study/server/controller/StudyController.java
@@ -980,11 +980,12 @@ public ResponseEntity<List<String>> getAvailableSvgComponentLibraries() {
         return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON).body(libraries);
     }
 
-    @GetMapping(value = "/studies/{studyUuid}/network-modifications/references/exists")
-    @Operation(summary = "Whether the study contains a shared modification, including nested in its composites")
-    @ApiResponse(responseCode = "200", description = "true if at least one shared modification is found")
-    public ResponseEntity<Boolean> hasSharedModifications(@PathVariable("studyUuid") UUID studyUuid) {
-        return ResponseEntity.ok().body(studyService.hasSharedModifications(studyUuid));
+    @GetMapping(value = "/studies/{studyUuid}/network-modifications/references/write-access")
+    @Operation(summary = "Whether the study contains shared modifications, including nested in its composites, and, if so, whether the user can write on all, some or none of them")
+    @ApiResponse(responseCode = "200", description = "The write access on the shared modifications was returned")
+    public ResponseEntity<SharedModificationsWriteAccess> getSharedModificationsWriteAccess(@PathVariable("studyUuid") UUID studyUuid,
+                                                                                            @RequestHeader(HEADER_USER_ID) String userId) {
+        return ResponseEntity.ok().body(studyService.getSharedModificationsWriteAccess(studyUuid, userId));
     }
 
     @GetMapping(value = "/studies/{studyUuid}/nodes/{nodeUuid}/network-modifications", produces = MediaType.TEXT_PLAIN_VALUE)

diff --git a/src/main/java/org/gridsuite/study/server/dto/RootNetworkTagsCheckInfos.java b/src/main/java/org/gridsuite/study/server/dto/RootNetworkTagsCheckInfos.java
@@ -0,0 +1,16 @@
+/**
+ * Copyright (c) 2026, RTE (http://www.rte-france.com)
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+package org.gridsuite.study.server.dto;
+
+import java.util.List;
+import java.util.UUID;
+
+/**
+ * Modifications to check against root network tags.
+ */
+public record RootNetworkTagsCheckInfos(List<UUID> containerUuids, List<String> tags) {
+}
diff --git a/src/main/java/org/gridsuite/study/server/dto/SharedModificationsWriteAccess.java b/src/main/java/org/gridsuite/study/server/dto/SharedModificationsWriteAccess.java
@@ -0,0 +1,19 @@
+/**
+ * Copyright (c) 2026, RTE (http://www.rte-france.com)
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+package org.gridsuite.study.server.dto;
+
+/**
+ * Whether a user can write on the shared modifications of a study.
+ *
+ * @author Florent MILLOT <florent.millot at rte-france.com>
+ */
+public enum SharedModificationsWriteAccess {
+    NO_SHARED_MODIFICATION,
+    ALL_WRITABLE,
+    SOME_WRITABLE,
+    NONE_WRITABLE
+}
diff --git a/src/main/java/org/gridsuite/study/server/service/StudyService.java b/src/main/java/org/gridsuite/study/server/service/StudyService.java
@@ -335,6 +335,9 @@ public void deleteRootNetworks(UUID studyUuid, List<UUID> rootNetworksUuids, Str
     @Transactional
     public RootNetworkRequestInfos createRootNetworkRequest(UUID studyUuid, RootNetworkInfos rootNetworkInfos, String userId) {
         rootNetworkService.assertCanCreateRootNetwork(studyUuid, rootNetworkInfos.getName(), rootNetworkInfos.getTag());
+        if (rootNetworkInfos.getTag() != null) {
+            assertCanAddRootNetworkTag(studyUuid, rootNetworkInfos.getTag(), userId);
+        }
         StudyEntity studyEntity = getStudy(studyUuid);
 
         rootNetworkInfos.setId(UUID.randomUUID());
@@ -391,33 +394,35 @@ private void invalidatePreviousRootNetworkNodeTree(StudyEntity studyEntity) {
         networkModificationTreeService.invalidateNodeTree(studyEntity.getId(), rootNodeUuid, studyEntity.getFirstRootNetwork().getId());
     }
 
-    private void updateRootNetworkBasicInfos(UUID studyUuid, RootNetworkInfos rootNetworkInfos, boolean updateCase) {
+    private void updateRootNetworkBasicInfos(UUID studyUuid, RootNetworkInfos rootNetworkInfos, boolean updateCase, String userId) {
         String previousTag = rootNetworkService.getRootNetworkTag(rootNetworkInfos.getId());
         rootNetworkService.updateRootNetwork(rootNetworkInfos, updateCase);
         // the entity says what the tag really became, unlike the DTO
         String newTag = rootNetworkService.getRootNetworkTag(rootNetworkInfos.getId());
-        renameRootNetworkTagInApplicabilities(studyUuid, previousTag, newTag);
+        renameRootNetworkTagInApplicabilities(studyUuid, previousTag, newTag, userId);
         postRootNetworkUpdate(studyUuid, rootNetworkInfos.getId(), updateCase);
     }
 
-    private void renameRootNetworkTagInApplicabilities(UUID studyUuid, String previousTag, String newTag) {
+    private void renameRootNetworkTagInApplicabilities(UUID studyUuid, String previousTag, String newTag, String userId) {
         if (previousTag == null || previousTag.equals(newTag)) {
             return;
         }
-        networkModificationRestService.renameRootNetworkTag(getStudyModificationGroupUuids(studyUuid), previousTag, newTag);
+        networkModificationRestService.renameRootNetworkTag(getStudyModificationGroupUuids(studyUuid), previousTag, newTag, userId);
     }
 
     /**
-     * Renaming a tag rewrites the applicabilities the shared modifications of the study contain for every study
-     * referencing them: only a user allowed to write on all of them may do it.
+     * A root network tag of a study must be associated with all its shared modifications: the ones the user cannot
+     * write on, which they cannot associate with a new tag, must already be.
      */
-    private void assertCanRenameRootNetworkTag(UUID studyUuid, String userId) {
-        networkModificationRestService.assertReferencedModificationsAreWritable(getStudyModificationGroupUuids(studyUuid), userId);
+    private void assertCanAddRootNetworkTag(UUID studyUuid, String newTag, String userId) {
+        networkModificationRestService.assertRootNetworkTagsAllowed(getStudyModificationGroupUuids(studyUuid), List.of(newTag), userId);
     }
 
-    public boolean hasSharedModifications(UUID studyUuid) {
+    public SharedModificationsWriteAccess getSharedModificationsWriteAccess(UUID studyUuid, String userId) {
         List<UUID> groupUuids = getStudyModificationGroupUuids(studyUuid);
-        return !groupUuids.isEmpty() && networkModificationRestService.hasModificationReferences(groupUuids);
+        return groupUuids.isEmpty()
+                ? SharedModificationsWriteAccess.NO_SHARED_MODIFICATION
+                : networkModificationRestService.getReferencedModificationsWriteAccess(groupUuids, userId);
     }
 
     private List<UUID> getStudyModificationGroupUuids(UUID studyUuid) {
@@ -431,15 +436,15 @@ public void updateRootNetworkRequest(UUID studyUuid, RootNetworkInfos rootNetwor
         rootNetworkService.assertCanModifyRootNetwork(studyUuid, rootNetworkInfos.getId(), rootNetworkInfos.getName(), rootNetworkInfos.getTag());
         String newTag = rootNetworkInfos.getTag();
         if (newTag != null && !newTag.equals(rootNetworkService.getRootNetworkTag(rootNetworkInfos.getId()))) {
-            assertCanRenameRootNetworkTag(studyUuid, userId);
+            assertCanAddRootNetworkTag(studyUuid, newTag, userId);
         }
         StudyEntity studyEntity = getStudy(studyUuid);
 
         if (rootNetworkInfos.hasCaseToImport()) {
             RootNetworkRequestEntity requestEntity = rootNetworkService.insertModificationRequest(studyEntity.getId(), rootNetworkInfos, userId);
             updateRootNetworkCaseInfos(studyEntity.getId(), rootNetworkInfos, userId, requestEntity);
         } else {
-            updateRootNetworkBasicInfos(studyEntity.getId(), rootNetworkInfos, false);
+            updateRootNetworkBasicInfos(studyEntity.getId(), rootNetworkInfos, false, userId);
         }
         notificationService.emitElementUpdated(studyUuid, userId);
     }
@@ -458,7 +463,7 @@ private void updateRootNetworkCaseInfos(UUID studyUuid, RootNetworkInfos rootNet
     @Transactional
     public void modifyRootNetwork(UUID studyUuid, RootNetworkInfos rootNetworkInfos, String userId) {
         invalidateStudyRootNetwork(studyUuid, rootNetworkInfos.getId(), userId, true);
-        updateRootNetworkBasicInfos(studyUuid, rootNetworkInfos, true);
+        updateRootNetworkBasicInfos(studyUuid, rootNetworkInfos, true, userId);
     }
 
     private void postRootNetworkUpdate(UUID studyUuid, UUID rootNetworkUuid, boolean updateCase) {

diff --git a/...rg/gridsuite/study/server/service/networkmodification/NetworkModificationRestService.java b/...rg/gridsuite/study/server/service/networkmodification/NetworkModificationRestService.java
@@ -14,6 +14,8 @@
 import org.gridsuite.study.server.dto.BuildInfos;
 import org.gridsuite.study.server.dto.ModificationReference;
 import org.gridsuite.study.server.dto.NodeReceiver;
+import org.gridsuite.study.server.dto.RootNetworkTagsCheckInfos;
+import org.gridsuite.study.server.dto.SharedModificationsWriteAccess;
 import org.gridsuite.study.server.dto.modification.*;
 import org.gridsuite.study.server.dto.workflow.AbstractWorkflowInfos;
 import org.gridsuite.study.server.service.RootNetworkService;
@@ -415,7 +417,7 @@ public void updateRootNetworkApplicability(List<UUID> modificationsUuids, String
     /**
      * Renames a root network tag in the applicabilities held by the modifications of the given groups.
      */
-    public void renameRootNetworkTag(List<UUID> groupUuids, String oldTag, String newTag) {
+    public void renameRootNetworkTag(List<UUID> groupUuids, String oldTag, String newTag, String userId) {
         Objects.requireNonNull(oldTag);
         Objects.requireNonNull(newTag);
         if (CollectionUtils.isEmpty(groupUuids)) {
@@ -431,6 +433,7 @@ public void renameRootNetworkTag(List<UUID> groupUuids, String oldTag, String ne
 
         HttpHeaders headers = new HttpHeaders();
         headers.setContentType(MediaType.APPLICATION_JSON);
+        headers.set(HEADER_USER_ID, userId);
 
         restTemplate.exchange(path, HttpMethod.PUT, new HttpEntity<>(headers), Void.class);
     }
@@ -774,19 +777,23 @@ public Set<UUID> getContainersWithModificationReferences(List<UUID> containerUui
         return containersWithReferenceModifications == null ? Set.of() : new HashSet<>(containersWithReferenceModifications);
     }
 
+    public SharedModificationsWriteAccess getReferencedModificationsWriteAccess(List<UUID> containerUuids, String userId) {
+        String path = UriComponentsBuilder.fromPath(CONTAINERS + DELIMITER + "references/write-access")
+                .queryParam(UUIDS, containerUuids)
+                .build().toUriString();
+        return restTemplate.exchange(getNetworkModificationServerURI(false) + path, HttpMethod.GET,
+                userIdEntity(userId), SharedModificationsWriteAccess.class).getBody();
+    }
+
     /**
-     * Asserts that the user may write on every shared modification the given containers point to, directly or through
-     * other shared modifications. Throws when they cannot.
+     * Throws forbidden when the unwritable shared modifications involved miss some of the tags.
      */
-    public void assertReferencedModificationsAreWritable(List<UUID> containerUuids, String userId) {
-        if (containerUuids.isEmpty()) {
+    public void assertRootNetworkTagsAllowed(List<UUID> containerUuids, List<String> rootNetworkTags, String userId) {
+        if (rootNetworkTags.isEmpty() || containerUuids.isEmpty()) {
             return;
         }
-        String path = UriComponentsBuilder.fromPath(CONTAINERS + DELIMITER + "references/authorized")
-                .queryParam(UUIDS, containerUuids)
-                .build().toUriString();
-
-        restTemplate.exchange(getNetworkModificationServerURI(false) + path, HttpMethod.GET, userIdEntity(userId), Void.class);
+        restTemplate.exchange(getNetworkModificationServerURI(false) + CONTAINERS + DELIMITER + "root-network-tags/authorized",
+                HttpMethod.POST, userIdEntity(userId, new RootNetworkTagsCheckInfos(containerUuids, rootNetworkTags)), Void.class);
     }
 
     /**

diff --git a/src/test/java/org/gridsuite/study/server/rootnetworks/RootNetworkApplicabilityTest.java b/src/test/java/org/gridsuite/study/server/rootnetworks/RootNetworkApplicabilityTest.java
@@ -41,6 +41,7 @@
 
 import java.util.*;
 
+import static org.gridsuite.study.server.StudyConstants.HEADER_USER_ID;
 import static org.gridsuite.study.server.utils.TestUtils.createModificationNodeInfo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -281,64 +282,66 @@ void testRenamingARootNetworkTagCarriesTheApplicabilitiesAlong() throws Exceptio
         updateRootNetwork(studyEntity.getId(), rootNetworkUuid, ROOT_NETWORK_TAG_2);
 
         ArgumentCaptor<List<UUID>> groupUuidsCaptor = ArgumentCaptor.captor();
-        verify(networkModificationRestService, times(1)).renameRootNetworkTag(groupUuidsCaptor.capture(), eq(ROOT_NETWORK_TAG_1), eq(ROOT_NETWORK_TAG_2));
+        verify(networkModificationRestService, times(1)).renameRootNetworkTag(groupUuidsCaptor.capture(), eq(ROOT_NETWORK_TAG_1), eq(ROOT_NETWORK_TAG_2), eq(USER_ID));
         assertEquals(Set.of(firstNode.getModificationGroupUuid(), secondNode.getModificationGroupUuid()), Set.copyOf(groupUuidsCaptor.getValue()));
 
         // an update carrying no tag at all leaves it as it was, so it is not a rename
         updateRootNetwork(studyEntity.getId(), rootNetworkUuid, null);
-        verify(networkModificationRestService, times(1)).renameRootNetworkTag(any(), any(), any());
+        verify(networkModificationRestService, times(1)).renameRootNetworkTag(any(), any(), any(), any());
 
         // and neither is an update carrying the tag the root network already has
         updateRootNetwork(studyEntity.getId(), rootNetworkUuid, ROOT_NETWORK_TAG_2);
-        verify(networkModificationRestService, times(1)).renameRootNetworkTag(any(), any(), any());
+        verify(networkModificationRestService, times(1)).renameRootNetworkTag(any(), any(), any(), any());
     }
 
     @Test
-    void testRenamingARootNetworkTagNeedsWritePermissionOnTheSharedModifications() throws Exception {
+    void testRenamingARootNetworkTagNeedsTheSharedModificationsTheUserCannotWriteOnToBeAssociatedWithIt() throws Exception {
         StudyEntity studyEntity = TestUtils.createDummyStudy(NETWORK_UUID, CASE_UUID, CASE_NAME, CASE_FORMAT, REPORT_UUID);
         studyRepository.save(studyEntity);
         UUID rootNetworkUuid = studyService.getExistingBasicRootNetworkInfos(studyEntity.getId()).getFirst().rootNetworkUuid();
 
         NodeEntity rootNode = networkModificationTreeService.createRoot(studyEntity);
         NetworkModificationNode firstNode = networkModificationTreeService.createNode(studyEntity, rootNode.getIdNode(), createModificationNodeInfo(NODE_1_NAME), InsertMode.AFTER, null);
 
-        // the study points to a shared modification the user is not allowed to write on
+        // the study points to a shared modification the user is not allowed to write on, and not associated with the new tag
         doThrow(HttpClientErrorException.create(HttpStatus.FORBIDDEN, "Forbidden", null, null, null))
-            .when(networkModificationRestService).assertReferencedModificationsAreWritable(List.of(firstNode.getModificationGroupUuid()), USER_ID);
+            .when(networkModificationRestService).assertRootNetworkTagsAllowed(List.of(firstNode.getModificationGroupUuid()), List.of(ROOT_NETWORK_TAG_2), USER_ID);
 
         UUID studyUuid = studyEntity.getId();
         RootNetworkInfos renamingTagInfos = RootNetworkInfos.builder().id(rootNetworkUuid).tag(ROOT_NETWORK_TAG_2).build();
         assertThrows(HttpClientErrorException.class, () -> studyService.updateRootNetworkRequest(studyUuid, renamingTagInfos, USER_ID));
 
         // neither the tag nor the applicabilities are touched
         assertEquals(ROOT_NETWORK_TAG_1, rootNetworkService.getRootNetworkTag(rootNetworkUuid));
-        verify(networkModificationRestService, never()).renameRootNetworkTag(any(), any(), any());
+        verify(networkModificationRestService, never()).renameRootNetworkTag(any(), any(), any(), any());
 
         // an update keeping the tag is no rename, so it needs no permission
         updateRootNetwork(studyUuid, rootNetworkUuid, ROOT_NETWORK_TAG_1);
-        verify(networkModificationRestService, times(1)).assertReferencedModificationsAreWritable(any(), any());
+        verify(networkModificationRestService, times(1)).assertRootNetworkTagsAllowed(any(), any(), any());
     }
 
     @Test
-    void testHasSharedModifications() throws Exception {
+    void testGetSharedModificationsWriteAccess() throws Exception {
         StudyEntity studyEntity = TestUtils.createDummyStudy(NETWORK_UUID, CASE_UUID, CASE_NAME, CASE_FORMAT, REPORT_UUID);
         studyRepository.save(studyEntity);
         UUID studyUuid = studyEntity.getId();
 
         // a study with no modification node contains no shared modification, and the server is not even asked
-        assertFalse(hasSharedModifications(studyUuid));
-        verify(networkModificationRestService, never()).hasModificationReferences(any());
+        assertEquals(SharedModificationsWriteAccess.NO_SHARED_MODIFICATION, getSharedModificationsWriteAccess(studyUuid));
+        verify(networkModificationRestService, never()).getReferencedModificationsWriteAccess(any(), any());
 
         NodeEntity rootNode = networkModificationTreeService.createRoot(studyEntity);
         NetworkModificationNode firstNode = networkModificationTreeService.createNode(studyEntity, rootNode.getIdNode(), createModificationNodeInfo(NODE_1_NAME), InsertMode.AFTER, null);
-        doReturn(true).when(networkModificationRestService).hasModificationReferences(List.of(firstNode.getModificationGroupUuid()));
+        doReturn(SharedModificationsWriteAccess.NONE_WRITABLE).when(networkModificationRestService)
+            .getReferencedModificationsWriteAccess(List.of(firstNode.getModificationGroupUuid()), USER_ID);
 
-        assertTrue(hasSharedModifications(studyUuid));
+        assertEquals(SharedModificationsWriteAccess.NONE_WRITABLE, getSharedModificationsWriteAccess(studyUuid));
     }
 
-    private boolean hasSharedModifications(UUID studyUuid) throws Exception {
-        return Boolean.parseBoolean(mockMvc.perform(get("/v1/studies/{studyUuid}/network-modifications/references/exists", studyUuid))
-            .andExpect(status().isOk()).andReturn().getResponse().getContentAsString());
+    private SharedModificationsWriteAccess getSharedModificationsWriteAccess(UUID studyUuid) throws Exception {
+        return objectMapper.readValue(mockMvc.perform(get("/v1/studies/{studyUuid}/network-modifications/references/write-access", studyUuid)
+                .header(HEADER_USER_ID, USER_ID))
+            .andExpect(status().isOk()).andReturn().getResponse().getContentAsString(), SharedModificationsWriteAccess.class);
     }
 
     @Test