opensource/dify
3
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-09-01 15:09:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce admin and RBAC permissions on tool OAuth custom client GET endpoint (#40944) (#40945)

Browse Source
This commit is contained in:
Pranav Agarwal
2026-08-20 09:10:02 +00:00
committed by GitHub
parent 248df5dd25
commit 43b6d8e32e
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/controllers/console/workspace/tool_providers.py
+2
View File
@@ -1296,6 +1296,8 @@ class ToolOAuthCustomClient(Resource):
)
@setup_required
@login_required
@is_admin_or_owner_required
@rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
@account_initialization_required
@with_current_tenant_id
def get(self, current_tenant_id: str, provider: str):
api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
+16 -1
View File
@@ -7,7 +7,7 @@ from controllers.common.wraps import RBACPermission, RBACResourceScope
from controllers.console.datasets.data_source import DataSourceApi
from controllers.console.workspace.model_providers import ModelProviderCredentialApi
from controllers.console.workspace.models import ModelProviderModelCredentialApi
from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi
from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi, ToolOAuthCustomClient
@pytest.mark.parametrize(
@@ -50,3 +50,18 @@ def test_model_provider_credential_get_requires_admin_and_rbac(
assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
assert rbac_config["scene"] == RBACPermission.CREDENTIAL_MANAGE
assert rbac_config["resource_required"] is False
def test_tool_oauth_custom_client_get_requires_admin_and_rbac() -> None:
"""GET endpoint that returns custom OAuth client params must enforce
the same admin + RBAC gates as its sibling POST and DELETE methods."""
method = ToolOAuthCustomClient.get
legacy_wrapper = unwrap(method, stop=lambda wrapper: "is_admin_or_owner_required" in wrapper.__code__.co_qualname)
assert "is_admin_or_owner_required" in legacy_wrapper.__code__.co_qualname
rbac_wrapper = unwrap(method, stop=lambda wrapper: "rbac_permission_required" in wrapper.__code__.co_qualname)
rbac_config = getclosurevars(rbac_wrapper).nonlocals
assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
assert rbac_config["scene"] == RBACPermission.CREDENTIAL_MANAGE
assert rbac_config["resource_required"] is False