opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-15 04:59:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce edit and RBAC permissions on dataset API key GET endpoint (#40740) (#40743)

Browse Source
This commit is contained in:
Pranav Agarwal 2026-08-14 04:27:37 +00:00 committed by GitHub
parent f8e05ebfc0
commit e2852524be
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/controllers/console/apikey.py
View File

@ -278,6 +278,8 @@ class DatasetApiKeyListResource(BaseApiKeyListResource):
@console_ns.doc(params={"resource_id": "Dataset ID"})
@console_ns.response(200, "API keys retrieved successfully", console_ns.models[ApiKeyList.__name__])
@with_current_tenant_id
@edit_permission_required
@rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE)
@with_session(write=False)
def get(self, session: Session, current_tenant_id: str, resource_id: UUID) -> dict[str, object]:
"""Get all API keys for a dataset"""

6
api/tests/unit_tests/controllers/console/test_apikey.py
View File

@ -18,6 +18,7 @@ from controllers.console.apikey import (
AppApiKeyListResource,
BaseApiKeyListResource,
BaseApiKeyResource,
DatasetApiKeyListResource,
)
from controllers.console.datasets.datasets import DatasetApiKeyApi
from core.rbac import RBACPermission, RBACResourceScope
@ -268,6 +269,10 @@ def test_api_key_lists_require_matching_rbac_permission() -> None:
lambda: DatasetApiKeyApi().get(),
[(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE, False)],
),
(
lambda: DatasetApiKeyListResource().get(resource_id=api_id),
[(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE, True)],
),
]
with (
@ -316,6 +321,7 @@ def test_api_key_lists_reject_legacy_read_only_members() -> None:
lambda: AppApiKeyListResource().get(resource_id=api_id),
lambda: AgentApiKeyListApi().get(agent_id=api_id),
lambda: DatasetApiKeyApi().get(),
lambda: DatasetApiKeyListResource().get(resource_id=api_id),
):
with pytest.raises(Forbidden):
invoke()