Eliminate duplicate label code and fix permission requirements

Consolidate label resolution to single location after both regular launch
and resume workflow paths have set up body.launch. Both code paths
ultimately populate body.launch, so labels can be applied once instead of
duplicating the logic in two places.

Fix permission requirements in error messages and documentation:
- Change from incorrect "label:write" permission to "Maintain role or higher"
- Workspace labels (used by this node) can be created by Maintain role
- Resource labels (for cost tracking) require Admin/Owner roles

This reduces code duplication and provides accurate guidance to users about
required token permissions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: FriederikeHanssen

nodes/workflow-launch.html

@@ -66,7 +66,7 @@
 : Launchpad (string) : The human-readable name of a pipeline in the launchpad to launch. Supports autocomplete.
 : Run name (string) : Custom name for the workflow run (optional, defaults to auto-generated name).
 : Resume from (string) : Workflow ID from a previous run to resume (optional). Can be extracted from workflow monitor output using `msg.workflowId`.
-: Labels (string) : Comma-separated label names to assign to the workflow run (optional), e.g., `production,rnaseq,urgent`. Labels are automatically created if they don't exist (requires API token with `label:write` permission). The node resolves names to IDs automatically.
+: Labels (string) : Comma-separated label names to assign to the workflow run (optional), e.g., `production,rnaseq,urgent`. Labels are automatically created if they don't exist (requires API token with Maintain role or higher). The node resolves names to IDs automatically.
 : Parameters (array) : Individual parameter key-value pairs added via the editable list. Each parameter can be configured with a name and a value of any type (string, number, boolean, JSON, etc.). These take highest precedence when merging.
 : Params JSON (object) : A JSON object containing multiple parameters to merge with the launchpad's default parameters. Merged before individual parameters.
 : Workspace ID (string) : Override the workspace ID from the Seqera config node (optional).
@@ -107,10 +107,10 @@
 Labels help organize and track workflow runs in your workspace. Simply provide comma-separated label names (e.g., `production,rnaseq,urgent`) and the node will:
 
 1. Check if labels exist in the workspace
-2. Automatically create missing labels (requires `label:write` permission)
+2. Automatically create missing labels (requires Maintain role or higher)
 3. Resolve names to IDs and apply them to the workflow run
 
-**Token permissions:** Your API token needs `label:write` permission to create labels automatically. Without this permission, you'll need to create labels manually in the Seqera UI first.
+**Token permissions:** Your API token needs Maintain role or higher to create labels automatically. Without sufficient permissions, you'll need to create labels manually in the Seqera UI first.
 
 ### References
 

nodes/workflow-launch.js

@@ -165,7 +165,7 @@ module.exports = function (RED) {
 
             if (errorStatus === 403) {
               throw new Error(
-                `Cannot create label '${labelName}': API token missing 'label:write' permission. Add this permission or create labels manually in Seqera UI.`,
+                `Cannot create label '${labelName}': API token requires 'Maintain' role or higher. Use a token with sufficient permissions or create labels manually in Seqera UI.`,
               );
             } else {
               throw new Error(`Failed to create label '${labelName}': ${errorDetail}`);
@@ -289,21 +289,6 @@ module.exports = function (RED) {
         body.launch.runName = runName.trim();
       }
 
-      // Resolve label names to IDs if provided, creating labels as needed
-      if (labels) {
-        body.launch = body.launch || {};
-        try {
-          const labelIds = await resolveLabelIds(labels, workspaceId, baseUrl, msg);
-          if (labelIds.length > 0) {
-            body.launch.labelIds = labelIds;
-          }
-        } catch (errLabels) {
-          node.error(`Failed to resolve labels: ${errLabels.message}`, msg);
-          node.status({ fill: "red", shape: "ring", text: `error: ${formatDateTime()}` });
-          return;
-        }
-      }
-
       // Resume from a previous workflow if workflow ID is provided
       // This fetches the workflow's launch config and sessionId, then relaunches with resume enabled
       if (resumeWorkflowId && resumeWorkflowId.trim && resumeWorkflowId.trim()) {
@@ -370,20 +355,6 @@ module.exports = function (RED) {
             resumeLaunch.runName = runName.trim();
           }
 
-          // Resolve label names to IDs if provided, creating labels as needed
-          if (labels) {
-            try {
-              const labelIds = await resolveLabelIds(labels, workspaceId, baseUrl, msg);
-              if (labelIds.length > 0) {
-                resumeLaunch.labelIds = labelIds;
-              }
-            } catch (errLabels) {
-              node.error(`Failed to resolve labels for resume: ${errLabels.message}`, msg);
-              node.status({ fill: "red", shape: "ring", text: `error: ${formatDateTime()}` });
-              return;
-            }
-          }
-
           body.launch = resumeLaunch;
         } catch (errResume) {
           node.error(`Failed to fetch workflow launch config for resume: ${errResume.message}`, msg);
@@ -392,6 +363,22 @@ module.exports = function (RED) {
         }
       }
 
+      // Resolve label names to IDs if provided, creating labels as needed
+      // Applied after both regular launch and resume paths have set up body.launch
+      if (labels) {
+        body.launch = body.launch || {};
+        try {
+          const labelIds = await resolveLabelIds(labels, workspaceId, baseUrl, msg);
+          if (labelIds.length > 0) {
+            body.launch.labelIds = labelIds;
+          }
+        } catch (errLabels) {
+          node.error(`Failed to resolve labels: ${errLabels.message}`, msg);
+          node.status({ fill: "red", shape: "ring", text: `error: ${formatDateTime()}` });
+          return;
+        }
+      }
+
       // Build URL with query params
       let url = `${baseUrl.replace(/\/$/, "")}/workflow/launch`;
       const qs = new URLSearchParams();