KPI Overview: Users see links to reports they are not authorised to access

Brief summary of the issue. What is it ? Where is it ?

The process overview page lists KPIs reports even if the current user is not authorised to access them. Sample cases are e.g.:

• a private report of another user (created on home and not within a collection)
• a report from a collection the current user has no access to

After clicking the link Optimize shows "this link is not valid".

Steps to reproduce:

1. Login as demo:demo
2. create a private report (outside of a collection)
3. make it a kpi report of a process
4. Logout
5. Login as john:john
6. Open the process overview page

Actual result:

• the private report of demo:demo is listed as kpi and a link is present, clicking the link leads to an error page indicating that "this link is not valid".

Actions:

• At the moment this behaviour could be confusing as the problem is not that the link is not valid but that the user doesnt have authorizations for that report.. We should decide on whether the current solution is alright and if not.

Potential Solutions:

• We accept the current behaviour
• We convert the "this link is not valid" message to a more generic message which covers the case of not having authorisation for a report as well as the link being actually invalid
• We check on the BE whether a user has authorizations to every single kpi and return it to the frontend. Note that this operation could be really computationally expensive and would slow down the endpoint
• We could find another alternative as well