Duplicate flows and dashboards: POST /flows/{name}/duplicate and /dashboards/{name}/duplicate copy the working copy into {name}_copy (then _copy_2, ...) as an unpublished draft with " (copy)" on the title. A flow copy takes its node sources as drafts and leaves origin and runtime.json behind; copying code nodes is a superuser's (the save check, now taking the replaced copy). Client regenerated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/api/routes/test_code_rights.py

@@ -90,6 +90,24 @@ def test_a_user_keeps_everything_but_the_code(
     assert saved.status_code == 200, saved.text
 
 
+@pytest.mark.usefixtures("save")
+def test_duplicating_code_nodes_is_a_superusers(
+    client: TestClient,
+    normal_user_token_headers: dict[str, str],
+    superuser_token_headers: dict[str, str],
+) -> None:
+    url = f"{PREFIX}/{FLOW}/duplicate"
+
+    refused = client.post(url, headers=normal_user_token_headers)
+    assert refused.status_code == 403
+    assert refused.json()["detail"].startswith(CODE_IS_SUPERUSERS)
+
+    copied = client.post(url, headers=superuser_token_headers)
+    assert copied.status_code == 200, copied.text
+    name = copied.json()["definition"]["name"]
+    client.delete(f"{PREFIX}/{name}", headers=superuser_token_headers)
+
+
 @pytest.mark.usefixtures("save")
 def test_node_source_is_a_superusers_to_write(
     client: TestClient,