mtfyun/dify
1
0 Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-11-13 23:06:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: remove unnessary rbac call (#45857)

Browse Source
This commit is contained in:
wangxiaolei authored and fatelei committed 2026-11-09 14:15:14 +08:00
1 parent ddd28f98ce
commit 7446bb35a3
4 files changed
+164 -60
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

api/services/knowledge/dataset_service.py
+28 -46
View File
@@ -133,15 +133,6 @@ class AutoDisableLogsDict(TypedDict):
class DatasetService:
@staticmethod
def _can_manage_all_datasets(tenant_id: str, account_id: str) -> bool:
if not dify_config.RBAC_ENABLED:
return False
permissions = enterprise_rbac_service.RBACService.MyPermissions.get(tenant_id, account_id)
workspace_permission_keys = getattr(getattr(permissions, "workspace", None), "permission_keys", []) or []
return "dataset.create_and_management" in workspace_permission_keys
@staticmethod
def get_datasets(
page: int,
@@ -164,6 +155,9 @@ class DatasetService:
Service API callers skip account ACLs while retaining the tenant boundary.
A resource-scoped grant further restricts the query to its authorized IDs.
Account callers must supply the resolved RBAC resource scope when restricted.
This method preserves that scope and pagination without fetching another
permission snapshot; include_all does not bypass the RBAC resource filter.
"""
query = select(Dataset).where(Dataset.tenant_id == tenant_id).order_by(Dataset.created_at.desc(), Dataset.id)
@@ -193,46 +187,34 @@ class DatasetService:
query = query.where(Dataset.id.in_(permitted_dataset_ids))
else:
return [], 0
else:
if dify_config.RBAC_ENABLED:
can_manage_all_datasets = include_all and DatasetService._can_manage_all_datasets(
str(tenant_id), str(user.id)
)
should_show_all_datasets = include_all and can_manage_all_datasets
else:
should_show_all_datasets = user.current_role == TenantAccountRole.OWNER and include_all
elif not dify_config.RBAC_ENABLED:
should_show_all_datasets = user.current_role == TenantAccountRole.OWNER and include_all
if not should_show_all_datasets:
if dify_config.RBAC_ENABLED:
# RBAC mode: show all datasets. Permission control is enforced
# via permission_keys on each item and @rbac_permission_required decorators.
pass
# Keep legacy visibility rules when RBAC is disabled.
if permitted_dataset_ids and len(permitted_dataset_ids) > 0:
query = query.where(
sa.or_(
Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
sa.and_(
Dataset.permission == DatasetPermissionEnum.ONLY_ME,
Dataset.maintainer == user.id,
),
sa.and_(
Dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM,
Dataset.id.in_(permitted_dataset_ids),
),
)
)
else:
# Keep legacy visibility rules when RBAC is disabled.
if permitted_dataset_ids and len(permitted_dataset_ids) > 0:
query = query.where(
sa.or_(
Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
sa.and_(
Dataset.permission == DatasetPermissionEnum.ONLY_ME,
Dataset.maintainer == user.id,
),
sa.and_(
Dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM,
Dataset.id.in_(permitted_dataset_ids),
),
)
)
else:
query = query.where(
sa.or_(
Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
sa.and_(
Dataset.permission == DatasetPermissionEnum.ONLY_ME,
Dataset.maintainer == user.id,
),
)
query = query.where(
sa.or_(
Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
sa.and_(
Dataset.permission == DatasetPermissionEnum.ONLY_ME,
Dataset.maintainer == user.id,
),
)
)
elif service_api_grant is None:
if dify_config.RBAC_ENABLED:
# Without an account we cannot resolve RBAC resource visibility.