mtfyun/dify
1
0 Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-11-13 23:06:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(rbac): agent RBAC/ACL scenes and resource-locator check bundles (#41768)

Browse Source 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
This commit is contained in:
Xiyuan Chenandautofix-ci[bot] authored and GitHub committed 2026-09-07 04:39:43 +00:00
1 parent 60e983c493
commit 86134ea99e
152 files changed
+5360 -3405
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

api/controllers/console/auth/data_source_bearer_auth.py
+4 -7
View File
@@ -5,6 +5,7 @@ from flask_restx import Resource
from pydantic import BaseModel, ConfigDict, Field
from controllers.common.fields import SimpleResultResponse
from controllers.common.rbac import RBACCheck, Workspace
from controllers.common.schema import register_response_schema_models, register_schema_models
from controllers.console import console_ns
from controllers.console.auth.error import (
@@ -14,7 +15,7 @@ from controllers.console.auth.error import (
InvalidDataSourceApiKeyAuthCredentialsRequestError,
)
from controllers.console.flask_admission import console_account_admission
from controllers.console.wraps import RBACPermission, RBACResourceScope, model_validate
from controllers.console.wraps import RBACPermission, model_validate
from extensions.ext_application_services import application_services
from fields.base import ResponseModel
from libs.helper import dump_response
@@ -104,9 +105,7 @@ class ApiKeyAuthDataSourceBinding(Resource):
@console_ns.expect(console_ns.models[ApiKeyAuthBindingPayload.__name__])
@console_account_admission(
allowed_roles=_ADMIN_OR_OWNER_ROLES,
rbac_resource_scope=RBACResourceScope.WORKSPACE,
rbac_permission=RBACPermission.CREDENTIAL_CREATE,
rbac_resource_required=False,
rbac_checks=[RBACCheck(RBACPermission.CREDENTIAL_CREATE, Workspace())],
)
@model_validate(ApiKeyAuthBindingPayload)
def post(self, req_data: ApiKeyAuthBindingPayload, request_context: RequestContext):
@@ -138,9 +137,7 @@ class ApiKeyAuthDataSourceBindingDelete(Resource):
@console_ns.response(HTTPStatus.NO_CONTENT, "Binding deleted successfully")
@console_account_admission(
allowed_roles=_ADMIN_OR_OWNER_ROLES,
rbac_resource_scope=RBACResourceScope.WORKSPACE,
rbac_permission=RBACPermission.CREDENTIAL_MANAGE,
rbac_resource_required=False,
rbac_checks=[RBACCheck(RBACPermission.CREDENTIAL_MANAGE, Workspace())],
)
def delete(self, request_context: RequestContext, binding_id: UUID):
application_services().data_source_api_key_auth.delete_binding(request_context, str(binding_id))
api/controllers/console/auth/data_source_oauth.py
+3 -4
View File
@@ -9,6 +9,7 @@ from pydantic import BaseModel, Field, ValidationError
from configs import dify_config
from controllers.common.fields import RedirectResponse
from controllers.common.rbac import RBACCheck, Workspace
from controllers.common.schema import (
query_params_from_model,
query_params_from_request,
@@ -17,7 +18,7 @@ from controllers.common.schema import (
register_schema_models,
)
from controllers.console.flask_admission import console_account_admission
from core.rbac import RBACPermission, RBACResourceScope
from core.rbac import RBACPermission
from extensions.ext_application_services import application_services
from fields.base import ResponseModel
from libs.helper import dump_response
@@ -111,9 +112,7 @@ class OAuthDataSource(Resource):
@console_ns.response(HTTPStatus.FORBIDDEN, "Admin privileges required")
@console_account_admission(
allowed_roles=_ADMIN_OR_OWNER_ROLES,
rbac_resource_scope=RBACResourceScope.WORKSPACE,
rbac_permission=RBACPermission.CREDENTIAL_MANAGE,
rbac_resource_required=False,
rbac_checks=[RBACCheck(RBACPermission.CREDENTIAL_MANAGE, Workspace())],
)
def get(self, request_context: RequestContext, provider: str):
try: