opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-09-05 08:48:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce edit and RBAC permissions on model provider credential GET endpoints (#40899) (#40900)

Browse Source
This commit is contained in:
Pranav Agarwal 2026-08-19 06:48:15 +00:00 committed by GitHub
parent 8874f3c80b
commit f1b48a93a9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/controllers/console/workspace/model_providers.py
View File

@ -209,6 +209,8 @@ class ModelProviderCredentialApi(Resource):
)
@setup_required
@login_required
@is_admin_or_owner_required
@rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
@account_initialization_required
@with_current_tenant_id
def get(self, tenant_id: str, provider: str):

2
api/controllers/console/workspace/models.py
View File

@ -349,6 +349,8 @@ class ModelProviderModelCredentialApi(Resource):
)
@setup_required
@login_required
@is_admin_or_owner_required
@rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
@account_initialization_required
@with_current_user
@with_current_tenant_id

24
api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
View File

@ -5,6 +5,8 @@ import pytest
from controllers.common.wraps import RBACPermission, RBACResourceScope
from controllers.console.datasets.data_source import DataSourceApi
from controllers.console.workspace.model_providers import ModelProviderCredentialApi
from controllers.console.workspace.models import ModelProviderModelCredentialApi
from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi
@ -26,3 +28,25 @@ def test_workspace_credential_mutations_require_management_permission(
assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
assert rbac_config["scene"] == permission
assert rbac_config["resource_required"] is False
@pytest.mark.parametrize(
"method",
[
ModelProviderCredentialApi.get,
ModelProviderModelCredentialApi.get,
],
)
def test_model_provider_credential_get_requires_admin_and_rbac(
method: FunctionType,
) -> None:
"""GET endpoints that return provider credential details must enforce
the same admin + RBAC gates as their sibling POST/PUT/DELETE methods."""
legacy_wrapper = unwrap(method, stop=lambda wrapper: "is_admin_or_owner_required" in wrapper.__code__.co_qualname)
assert "is_admin_or_owner_required" in legacy_wrapper.__code__.co_qualname
rbac_wrapper = unwrap(method, stop=lambda wrapper: "rbac_permission_required" in wrapper.__code__.co_qualname)
rbac_config = getclosurevars(rbac_wrapper).nonlocals
assert rbac_config["resource_type"] == RBACResourceScope.WORKSPACE
assert rbac_config["scene"] == RBACPermission.CREDENTIAL_MANAGE
assert rbac_config["resource_required"] is False