Harsh Kashyap fb2f881871 fix(api): authorize dataset and workspace commit routes (#19357) ...

Fixes #19356

The file-commit endpoints resolved a dataset or folder id but never
checked that the caller can access it. Any logged-in user could read
another tenant's commit history, diffs, and file contents, pull version
history for any file id, and create commits in a workspace they don't
own. Sibling artifact routes in dataset_api.py apply
KnowledgebaseService.accessible for the same data; these did not.

2026-09-09 10:33:23 +08:00

..

apps

fix(api): authorize dataset and workspace commit routes (#19357)

2026-09-09 10:33:23 +08:00

channels

feat(channels): allow chat channels to connect to agents (#19307)

2026-09-08 18:44:59 +08:00

common

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

db

Refactor: Add RERANK_TOKEN_LIMIT_MODE = truncate (default) / passthrough / raise_error (#19404)

2026-09-09 09:55:00 +08:00

utils

Refactor: combine 3 retrieval/search API as one (#19303)

2026-09-08 11:41:46 +08:00

__init__.py

Fix: incorrect async chat streamly output (#11679)

2025-12-03 11:15:45 +08:00

constants.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

ragflow_server.py

fix(agent): await MCP transport cleanup before stopping event loop (#19093)

2026-09-04 17:57:50 +08:00

settings.py

Move api.settings to common.settings (#11036)

2025-11-06 09:36:38 +08:00

validation.py

fix ci unit test not found in installed package 'wordnet' (#19251)

2026-09-04 13:52:43 +08:00