opensource/dify
3
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-09-01 15:09:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce edit and RBAC permissions on datasource credential …fix(api): enforce edit and RBAC permissions on datasource credential GET endpoint (#41040) (#41041)

Browse Source
This commit is contained in:
Pranav Agarwal
2026-08-21 02:11:46 +00:00
committed by GitHub
parent edc805c453
commit 43e59d3bc5
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/controllers/console/datasets/rag_pipeline/datasource_auth.py
+2
View File
@@ -336,6 +336,8 @@ class DatasourceAuth(Resource):
@setup_required
@login_required
@account_initialization_required
@edit_permission_required
@rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
@with_current_user
@with_current_tenant_id
def get(self, current_tenant_id: str, user: Account, provider_id: str):
api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
+16
View File
@@ -5,6 +5,7 @@ import pytest
from controllers.common.wraps import RBACPermission, RBACResourceScope
from controllers.console.datasets.data_source import DataSourceApi
from controllers.console.datasets.rag_pipeline.datasource_auth import DatasourceAuth
from controllers.console.workspace.model_providers import ModelProviderCredentialApi
from controllers.console.workspace.models import ModelProviderModelCredentialApi
from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi, ToolOAuthCustomClient
@@ -65,3 +66,18 @@ def test_tool_oauth_custom_client_get_requires_admin_and_rbac() -> None:
assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
assert rbac_config["scene"] == RBACPermission.CREDENTIAL_MANAGE
assert rbac_config["resource_required"] is False
def test_datasource_auth_get_requires_edit_and_rbac() -> None:
"""GET endpoint that lists datasource credentials must enforce
the same edit + RBAC gates as its sibling POST method."""
method = DatasourceAuth.get
edit_wrapper = unwrap(method, stop=lambda wrapper: "edit_permission_required" in wrapper.__code__.co_qualname)
assert "edit_permission_required" in edit_wrapper.__code__.co_qualname
rbac_wrapper = unwrap(method, stop=lambda wrapper: "rbac_permission_required" in wrapper.__code__.co_qualname)
rbac_config = getclosurevars(rbac_wrapper).nonlocals
assert rbac_config["resource_type"] == RBACResourceScope.DATASET
assert rbac_config["scene"] == RBACPermission.CREDENTIAL_MANAGE
assert rbac_config["resource_required"] is False