From 6a1b23935f352c1a1fd85956575f9f11c2b0f4d5 Mon Sep 17 00:00:00 2001
From: wangxiaolei <fatelei@gmail.com>
Date: Thu, 27 Aug 2026 05:29:38 +0000
Subject: [PATCH] chore: remove permission check (#41349)

---
 api/controllers/console/workspace/models.py   | 12 ----------
 ...rkspace_credential_mutation_permissions.py | 24 -------------------
 2 files changed, 36 deletions(-)

diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py
index 388cef52761..fb3d4fef1c7 100644
--- a/api/controllers/console/workspace/models.py
+++ b/api/controllers/console/workspace/models.py
@@ -210,8 +210,6 @@ class DefaultModelApi(Resource):
     )
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     @model_validate(ParserGetDefault)
@@ -228,8 +226,6 @@ class DefaultModelApi(Resource):
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     @model_validate(ParserPostDefault)
@@ -265,8 +261,6 @@ class ModelProviderModelApi(Resource):
     )
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def get(self, tenant_id: str, provider: str):
@@ -279,8 +273,6 @@ class ModelProviderModelApi(Resource):
     @console_ns.response(200, "Model updated successfully", console_ns.models[SimpleResultResponse.__name__])
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     @model_validate(ParserPostModels)
@@ -328,8 +320,6 @@ class ModelProviderModelApi(Resource):
     @console_ns.response(204, "Model deleted successfully")
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     @model_validate(ParserDeleteModels)
@@ -353,8 +343,6 @@ class ModelProviderModelCredentialApi(Resource):
     )
     @setup_required
     @login_required
-    @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
diff --git a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
index 3c33a0d0627..e6082a2e8b8 100644
--- a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
+++ b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
@@ -9,7 +9,6 @@ from controllers.console.agent.roster import AgentAppApi
 from controllers.console.datasets.data_source import DataSourceApi
 from controllers.console.datasets.rag_pipeline.datasource_auth import DatasourceAuth
 from controllers.console.workspace.model_providers import ModelProviderCredentialApi
-from controllers.console.workspace.models import DefaultModelApi, ModelProviderModelApi, ModelProviderModelCredentialApi
 from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi, ToolOAuthCustomClient
 
 
@@ -38,7 +37,6 @@ def test_workspace_credential_mutations_require_management_permission(
     "method",
     [
         ModelProviderCredentialApi.get,
-        ModelProviderModelCredentialApi.get,
     ],
 )
 def test_model_provider_credential_get_requires_admin_and_rbac(
@@ -86,28 +84,6 @@ def test_datasource_auth_get_requires_edit_and_rbac() -> None:
     assert rbac_config["resource_required"] is False
 
 
-@pytest.mark.parametrize(
-    "method",
-    [
-        DefaultModelApi.get,
-        ModelProviderModelApi.get,
-    ],
-)
-def test_workspace_model_preferences_get_require_admin_and_rbac(
-    method: FunctionType,
-) -> None:
-    """GET endpoints that return workspace model preferences must enforce
-    the same admin + RBAC gates as their sibling POST/DELETE methods."""
-    legacy_wrapper = unwrap(method, stop=lambda wrapper: "is_admin_or_owner_required" in wrapper.__code__.co_qualname)
-    assert "is_admin_or_owner_required" in legacy_wrapper.__code__.co_qualname
-
-    rbac_wrapper = unwrap(method, stop=lambda wrapper: "rbac_permission_required" in wrapper.__code__.co_qualname)
-    rbac_config = getclosurevars(rbac_wrapper).nonlocals
-    assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
-    assert rbac_config["scene"] == RBACPermission.PLUGIN_PREFERENCES
-    assert rbac_config["resource_required"] is False
-
-
 @pytest.mark.parametrize(
     "method",
     [