opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-09-09 05:41:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce RBAC permission on MCP tool provider GET endpoint (#41547) (#41548)

Browse Source 
Co-authored-by: yunlu.wen <yunlu.wen@dify.ai>
This commit is contained in:
Pranav Agarwal 2026-09-08 04:43:24 +00:00 committed by GitHub
parent efe506a0f5
commit a67f62e9aa
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
api/controllers/console/workspace/tool_providers.py
View File

@ -1582,6 +1582,7 @@ class ToolMCPDetailApi(Resource):
@setup_required
@login_required
@account_initialization_required
@rbac_permission_required(RBACCheck(RBACPermission.MCP_MANAGE, Workspace()))
@with_current_tenant_id
def get(self, tenant_id: str, provider_id: str):
with sessionmaker(db.engine).begin() as session:

16
api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py
View File

@ -10,7 +10,11 @@ from controllers.console.datasets.data_source import DataSourceApi
from controllers.console.datasets.rag_pipeline.datasource_auth import DatasourceAuth
from controllers.console.workspace.model_providers import ModelProviderCredentialApi
from controllers.console.workspace.models import ModelProviderModelCredentialApi
from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi, ToolOAuthCustomClient
from controllers.console.workspace.tool_providers import (
ToolBuiltinProviderAddApi,
ToolMCPDetailApi,
ToolOAuthCustomClient,
)
from tests.unit_tests.controllers.rbac_introspection import rbac_checks
@ -92,3 +96,13 @@ def test_agent_app_get_requires_rbac(method: FunctionType) -> None:
[check] = rbac_checks(method)
assert check.scene == RBACPermission.AGENT_PREVIEW
assert isinstance(check.locator, AgentId)
def test_tool_mcp_detail_get_requires_rbac() -> None:
"""GET endpoint that returns MCP provider details must enforce
the workspace MCP management RBAC gate."""
method = ToolMCPDetailApi.get
[check] = rbac_checks(method)
assert check.scene == RBACPermission.MCP_MANAGE
assert isinstance(check.locator, Workspace)