opensource/dify
3
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-29 03:45:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce APP_EDIT RBAC permission on MCP server refresh endpoint (#41235)

Browse Source
This commit is contained in:
Rafli Surya Wijaya
2026-08-25 06:38:13 +00:00
committed by GitHub
parent 48315be2b1
commit cf236aed8a
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/controllers/console/app/mcp_server.py
+1 -1
View File
@@ -190,7 +190,7 @@ class AppMCPServerRefreshController(Resource):
@login_required
@account_initialization_required
@edit_permission_required
@rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
@rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
@with_current_tenant_id
@get_app_model
def post(self, current_tenant_id: str, app_model: App):
api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
+2 -2
View File
@@ -298,7 +298,7 @@ class TestAppMCPServerRefreshController:
assert hasattr(AppMCPServerRefreshController, "post")
assert not hasattr(AppMCPServerRefreshController, "get")
def test_post_requires_app_view_layout_permission(self):
def test_post_requires_app_edit_permission(self):
method = AppMCPServerRefreshController.post
while "rbac_permission_required" not in method.__code__.co_qualname:
method = method.__wrapped__
@@ -326,7 +326,7 @@ class TestAppMCPServerRefreshController:
tenant_id="tenant-1",
account_id="account-1",
resource_type=RBACResourceScope.APP,
scene=RBACPermission.APP_VIEW_LAYOUT,
scene=RBACPermission.APP_EDIT,
resource_required=True,
path_args={"app_id": "app-1"},
)