From 0d05eae517210a9f809748542cc7984937efa15e Mon Sep 17 00:00:00 2001 From: Pranav Agarwal Date: Wed, 26 Aug 2026 20:09:25 +0000 Subject: [PATCH] fix(api): enforce RBAC permission on agent composer GET endpoint (#41324) (#41325) --- api/controllers/console/agent/composer.py | 1 + ..._workspace_credential_mutation_permissions.py | 16 +++++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/api/controllers/console/agent/composer.py b/api/controllers/console/agent/composer.py index 66192940fc1..8ae2db85ff0 100644 --- a/api/controllers/console/agent/composer.py +++ b/api/controllers/console/agent/composer.py @@ -512,6 +512,7 @@ class AgentComposerApi(Resource): @setup_required @login_required @account_initialization_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False) @with_current_tenant_id @with_session def get(self, session: Session, tenant_id: str, agent_id: UUID): diff --git a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py index 4e9b62eee3e..3c33a0d0627 100644 --- a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py +++ b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py @@ -4,6 +4,7 @@ from types import FunctionType import pytest from controllers.common.wraps import RBACPermission, RBACResourceScope +from controllers.console.agent.composer import AgentComposerApi from controllers.console.agent.roster import AgentAppApi from controllers.console.datasets.data_source import DataSourceApi from controllers.console.datasets.rag_pipeline.datasource_auth import DatasourceAuth @@ -107,11 +108,16 @@ def test_workspace_model_preferences_get_require_admin_and_rbac( assert rbac_config["resource_required"] is False -def test_agent_app_get_requires_rbac() -> None: - """GET endpoint that returns agent app details must enforce - the same RBAC gates as its sibling PUT/DELETE methods.""" - method = AgentAppApi.get - +@pytest.mark.parametrize( + "method", + [ + AgentAppApi.get, + AgentComposerApi.get, + ], +) +def test_agent_app_get_requires_rbac(method: FunctionType) -> None: + """GET endpoints that return agent app details or composer state must enforce + the same RBAC gates as their sibling PUT/DELETE methods.""" rbac_wrapper = unwrap(method, stop=lambda wrapper: "rbac_permission_required" in wrapper.__code__.co_qualname) rbac_config = getclosurevars(rbac_wrapper).nonlocals assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE