mtfyun/dify
1
0 Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-11-13 06:41:07 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,206 Commits 1,085 Branches 180 Tags
deploy/enterprise
Commit Graph
357 Commits
Author SHA1 Message Date
yunlu.wen 2f61bf62ba fix(rbac): gate member role assignment on member manage 
Assigning roles to a member is reached from Settings > Members > Assign roles,
which the console already shows only to holders of workspace.member.manage.
Gate the PUT handler on the same permission so the offered action and the
enforced permission agree for custom roles that hold one key but not the other.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
(cherry picked from commit eec128d9c4)
 2026-11-11 16:23:39 +08:00
yunlu.wen 26baa6e646 fix(rbac): keep member role reads ungated 
GET .../members/<id>/rbac-roles feeds the member details dialog, which every
workspace member can open from the Members tab, and the member list endpoint
already returns each member's roles without a permission check. Gating the read
on WORKSPACE_ROLE_MANAGE would 403 the dialog for editors and normal members.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
(cherry picked from commit a742ef60eb)
 2026-11-11 16:19:07 +08:00
yunlu.wen 5ba2200c09 fix(rbac): enforce workspace role manage on member role routes 
RBACMemberRolesApi only declared plain account admission, unlike its
sibling routes in the same package (roles, policies), so WORKSPACE_ROLE_MANAGE
was enforced only by the enterprise RBAC inner API. Declare the check at the
controller boundary so the Console API rejects unauthorized callers before the
remote call, consistent with the rest of the RBAC surface.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
(cherry picked from commit bd8a319430)
 2026-11-11 16:03:29 +08:00
非法操作 4350a19824 refactor(api): inject plugin dynamic option queries (#44576) 2026-11-09 14:14:40 +08:00
非法操作 25da472891 refactor(api): isolate trigger subscription management (#44541) 2026-11-09 14:14:36 +08:00
非法操作 4c9a888a22 refactor(api): inject trigger subscription builder lifecycle (#44532) 2026-11-09 14:14:35 +08:00
非法操作 ef64cb9331 refactor(api): isolate trigger provider and subscription queries (#44514) 2026-11-09 14:14:33 +08:00
非法操作 7138ad18db refactor(api): isolate trigger OAuth authorization flow (#44505) 2026-11-09 14:14:33 +08:00
非法操作 d4dda259f7 refactor(api): isolate trigger OAuth client configuration (#44469) 2026-11-09 14:14:28 +08:00
非法操作andautofix-ci[bot] 52ae152e00 fix(api): reject invalid model provider icon paths (#45445) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-11-03 10:01:37 +00:00
yyh 3ae9147417 feat(api): map billing error reasons to typed console errors (#45170) 2026-10-31 06:27:30 +00:00
yyhandClaude Opus 5.5 749754fcd9 feat(api): return education verification as a status-discriminated result (#45165) 
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-30 15:01:46 +00:00
yyhandhjlarry 4612a807fe refactor(api): call billing education, compliance, account and notification APIs through the generated client (#45136) 
Co-authored-by: hjlarry <hjlarry@163.com>
 2026-10-30 12:19:34 +00:00
yyhandhjlarry d945bea129 refactor(api): read billing subscription and usage through the generated client (#45131) 
Co-authored-by: hjlarry <hjlarry@163.com>
 2026-10-30 09:40:06 +00:00
QuantumGhostzxhlyhJzoNgautofix-ci[bot]
 		8cbb6c0130 feat: HITL IM integration (#44864) 
Co-authored-by: zxhlyh <jasonapring2015@outlook.com>
Co-authored-by: JzoNg <jzongcode@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-30 02:43:31 +00:00
非法操作 02ca1df07d refactor(api): remove legacy account update endpoints (#45015) 2026-10-29 12:40:31 +00:00
WH-2099 76979a1e24 Merge commit from fork 
https://github.com/langgenius/dify/security/advisories/GHSA-384g-pjvf-m9c9
 2026-10-26 15:34:16 +08:00
Stephen Zhouandautofix-ci[bot] 226110d611 feat(web): set up @dify/openapi-content-mapper foundations (#44627) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-26 05:06:34 +00:00
WH-2099 64fe95667b Merge commit from fork 
https://github.com/langgenius/dify/security/advisories/GHSA-94wf-cjw5-5974
 2026-10-26 12:04:28 +08:00
wangxiaolei b3d5d468af feat: network access group add rbac check (#44464) 2026-10-21 03:39:06 +00:00
林玮 (Jade Lin) 4e5424ed43 fix(plugin): pin daemon dispatches to package identifiers (#44396) 2026-10-21 02:58:44 +00:00
-LAN-andWH-2099 f5cdb80297 feat(workflow): execute workflow tools as nested containers (#42820) 
Co-authored-by: WH-2099 <wh2099@pm.me>
 2026-10-21 02:11:18 +00:00
zyssyz123autofix-ci[bot]CodingOnStarhjlarryyyhyyh
 		2a6764edc5 feat: add reusable network access group APIs (#41025) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: CodingOnStar <hanxujiang@dify.com>
Co-authored-by: hjlarry <hjlarry@163.com>
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com>
 2026-10-20 05:52:18 +00:00
Asuka MinatoCodexhjlarry
 		6f434baf93 ci: enable Ruff B904 (#44121) 
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: hjlarry <hjlarry@163.com>
 2026-10-19 12:47:53 +00:00
Asuka MinatoCodexautofix-ci[bot]
 		672a627fa5 ci: enable Ruff E402 (#44123) 
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-19 01:16:16 +00:00
Stephen ZhouClaude Opus 5.5autofix-ci[bot]
 		7cafd65d54 refactor(web): migrate handwritten console API calls to the generated oRPC contract (#44169) 
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-16 03:47:31 +00:00
Asuka MinatoandCodex 76f911c64f ci: enable Ruff TID252 (#44108) 
Co-authored-by: Codex <codex@openai.com>
 2026-10-15 04:59:00 +00:00
Stephen ZhouClaude Opus 5.5autofix-ci[bot]
 		33b1c57f9d feat: document API errors per code and narrow them with oRPC defined errors (#44001) 
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-14 08:25:50 +00:00
Yunlu Wen ed772cfcf7 Merge commit from fork 
* feat: add server side pepper

* fix(api): disallow plugin installation by default
 2026-10-13 13:46:46 +08:00
Byron.wang 2f20c7d958 refactor(api): separate workspace RBAC controllers and application service (#43323) 2026-10-10 09:46:01 +00:00
林玮 (Jade Lin)andautofix-ci[bot] 99650364b1 fix(api): validate member invitation email addresses (#43643) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-10-08 03:41:22 +00:00
Byron.wangandautofix-ci[bot] 95373bc4fd refactor(api): consolidate account modules and shared errors (#42570) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-30 07:26:44 +00:00
Byron.wangandJyong a67cd87eb0 refactor(api): establish dataset application boundaries (#41729) 
Co-authored-by: Jyong <jyong@dify.ai>
 2026-09-29 08:42:31 +00:00
Byron.wangandautofix-ci[bot] 635143cb88 refactor(api): thin console app controllers and separate application boundaries (#42671) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-24 06:17:38 +00:00
yyh 4192299ad4 refactor(plugins): migrate agent strategy queries to generated contracts (#42696) 2026-09-22 05:54:59 +00:00
yyh 6d358eb680 refactor(plugins): migrate endpoint queries to generated contracts (#42685) 2026-09-22 05:54:58 +00:00
林玮 (Jade Lin)andJoel 8e5b097011 fix(api): remove omitted tenant default models (#42572) 
Co-authored-by: Joel <iamjoel007@gmail.com>
 2026-09-20 09:19:51 +00:00
Asuka Minato 3a9636faad test: migrate console snippets sessions and ORM models to SQLite (#40565) 2026-09-19 09:26:43 +00:00
Yunlu Wenautofix-ci[bot]Copilot Autofix powered by AI
 		dbeebfc15d refactor: reduce ambiguity in mcp queries (#42395) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-09-18 09:17:36 +00:00
wangxiaoleiandautofix-ci[bot] bfd7ac015f feat: skill support duplicate and export use the latest draft (#42424) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-17 09:52:25 +00:00
Sourav Rajviandautofix-ci[bot] aa6dceeece fix(web): send model delete params as query string on DELETE (#42162) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-11 08:09:48 +00:00
Wu Tianweiandautofix-ci[bot] f89c3e6ec7 feat: add agent resource permissions (#41940) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-09 07:30:39 +00:00
L1nSn0w 8a69aa2884 fix(console): stop advertising the education plan outside Dify Cloud (#41898) 2026-09-09 04:38:50 +00:00
yyh 8acdb1538b refactor(api): trim workspace features response contract (#41948) 2026-09-08 05:42:22 +00:00
Pranav Agarwalandyunlu.wen a67f62e9aa fix(api): enforce RBAC permission on MCP tool provider GET endpoint (#41547) (#41548) 
Co-authored-by: yunlu.wen <yunlu.wen@dify.ai>
 2026-09-08 04:43:24 +00:00
Charles 2df92204e9 refactor(models): pass session into CustomizedSnippet accessors (#40379) 2026-09-07 05:37:43 +00:00
Xiyuan Chenandautofix-ci[bot] 86134ea99e feat(rbac): agent RBAC/ACL scenes and resource-locator check bundles (#41768) 
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
 2026-09-07 04:39:43 +00:00
Pranav AgarwalandYunlu Wen 067a60e0ac fix(api): enforce admin and RBAC permissions on model provider model credential GET endpoint (#41599) (#41600) 
Co-authored-by: Yunlu Wen <yunlu.wen@dify.ai>
 2026-09-04 09:17:41 +00:00
Byron.wang b015aa416f refactor(api): extract account login service and consolidate adapters (#41184) 2026-09-03 06:20:21 +00:00
非法操作 59ee8878f9 refactor(api): require active workspace in request context (#41280) 2026-09-02 06:54:47 +00:00