From 05b00574aa3c1859b8d8c1de815f428a87a86aaf Mon Sep 17 00:00:00 2001 From: wangxiaolei Date: Thu, 27 Aug 2026 07:45:50 +0000 Subject: [PATCH] chore: add permission check back (#41369) --- api/controllers/console/workspace/models.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py index fb3d4fef1c7..54d021251fd 100644 --- a/api/controllers/console/workspace/models.py +++ b/api/controllers/console/workspace/models.py @@ -226,6 +226,8 @@ class DefaultModelApi(Resource): @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__]) @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserPostDefault) @@ -273,6 +275,8 @@ class ModelProviderModelApi(Resource): @console_ns.response(200, "Model updated successfully", console_ns.models[SimpleResultResponse.__name__]) @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserPostModels) @@ -320,6 +324,8 @@ class ModelProviderModelApi(Resource): @console_ns.response(204, "Model deleted successfully") @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserDeleteModels)