From 5a7345c32d4e598ee580136c67d0bf7e1ba0dcd6 Mon Sep 17 00:00:00 2001 From: fatelei Date: Thu, 27 Aug 2026 15:26:29 +0800 Subject: [PATCH] chore: add permission check back --- api/controllers/console/workspace/models.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py index fb3d4fef1c7..54d021251fd 100644 --- a/api/controllers/console/workspace/models.py +++ b/api/controllers/console/workspace/models.py @@ -226,6 +226,8 @@ class DefaultModelApi(Resource): @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__]) @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserPostDefault) @@ -273,6 +275,8 @@ class ModelProviderModelApi(Resource): @console_ns.response(200, "Model updated successfully", console_ns.models[SimpleResultResponse.__name__]) @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserPostModels) @@ -320,6 +324,8 @@ class ModelProviderModelApi(Resource): @console_ns.response(204, "Model deleted successfully") @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False) @account_initialization_required @with_current_tenant_id @model_validate(ParserDeleteModels)