Harsh Kashyap fb2f881871 fix(api): authorize dataset and workspace commit routes (#19357) ...

Fixes #19356

The file-commit endpoints resolved a dataset or folder id but never
checked that the caller can access it. Any logged-in user could read
another tenant's commit history, diffs, and file contents, pull version
history for any file id, and create commits in a workspace they don't
own. Sibling artifact routes in dataset_api.py apply
KnowledgebaseService.accessible for the same data; these did not.

2026-09-09 10:33:23 +08:00

..

components_testpkg

refactor(chunker): replace QAChunker/PresentationChunker with PairChunker/PageChunker, drop TagChunker (#18523)

2026-08-20 11:53:00 +08:00

agent_attachment.go

Go: add context (#17314)

2026-07-24 16:47:12 +08:00

agent_component_test.go

Go: add context, part5 (#17392)

2026-07-27 10:20:16 +08:00

agent_component.go

Refactor: refine error messages - use %W (#18834)

2026-08-27 11:21:17 +08:00

agent_download_test.go

Go: add context (#17314)

2026-07-24 16:47:12 +08:00

agent_download.go

Go: add context (#17314)

2026-07-24 16:47:12 +08:00

agent_logs_test.go

Go: add context to redis client (#17689)

2026-08-02 22:50:54 +08:00

agent_openai.go

fix(agent): propagate webhook terminal states (#18758)

2026-08-26 15:32:21 +08:00

agent_pipeline_debug_test.go

Feat(ingestion): add canvas pipeline debug (dry-run) mode with View result log (#17538)

2026-07-31 13:10:08 +08:00

agent_run_event.go

fix(agent): propagate webhook terminal states (#18758)

2026-08-26 15:32:21 +08:00

agent_test.go

fix(agent): wire document service so dataflow rerun works instead of 500ing (#19094)

2026-09-04 10:02:08 +08:00

agent_upload_test.go

feat[Go]: port agent webhook trigger, agent file upload/download, component input-form + debug endpoints from Python (#16403)

2026-06-29 09:45:16 +08:00

agent_upload.go

Go: fix warnings (#17738)

2026-08-03 21:30:01 +08:00

agent_wait_for_user_test.go

Go: fix context, part2 (#18296)

2026-08-14 19:42:41 +08:00

agent_webhook_schema_test.go

feat[Go]: port agent webhook trigger, agent file upload/download, component input-form + debug endpoints from Python (#16403)

2026-06-29 09:45:16 +08:00

agent_webhook_schema.go

Refactor: refine error messages - use %W (#18834)

2026-08-27 11:21:17 +08:00

agent_webhook_security_test.go

Go: fix context (#18061)

2026-08-10 20:49:32 +08:00

agent_webhook_security.go

Refactor: refine error messages - use %W (#18834)

2026-08-27 11:21:17 +08:00

agent_webhook_test.go

fix(agent): finalize interrupted webhook traces (#19089)

2026-09-01 16:12:21 +08:00

agent_webhook_trace_test.go

fix(agent): prevent concurrent webhook trace overwrites (#19026)

2026-09-01 13:38:39 +08:00

agent_webhook_trace.go

fix(agent): prevent concurrent webhook trace overwrites (#19026)

2026-09-01 13:38:39 +08:00

agent_webhook.go

fix(agent): finalize interrupted webhook traces (#19089)

2026-09-01 16:12:21 +08:00

agent.go

fix(agent): wire document service so dataflow rerun works instead of 500ing (#19094)

2026-09-04 10:02:08 +08:00

api_token.go

Test: release Go-proxy RESTful contract tests verified passing in Go mode (#17468)

2026-07-30 19:58:49 +08:00

auth_test.go

Test: release Go-proxy RESTful contract tests verified passing in Go mode (#17468)

2026-07-30 19:58:49 +08:00

auth.go

Test: release Go-proxy RESTful contract tests verified passing in Go mode (#17468)

2026-07-30 19:58:49 +08:00

bot_test.go

fix(test): expect the bare attachment disposition the download path emits (#19132)

2026-09-02 13:42:24 +08:00

bot.go

feat(chat): add Querit web search provider (#17813)

2026-08-05 09:54:46 +08:00

chat_audio_wav_test.go

fix: implement Tongyi-Qianwen TTS via DashScope native endpoint (#17924)

2026-08-21 10:12:50 +08:00

chat_audio_wav.go

fix: implement Tongyi-Qianwen TTS via DashScope native endpoint (#17924)

2026-08-21 10:12:50 +08:00

chat_audio.go

fix: implement Tongyi-Qianwen TTS via DashScope native endpoint (#17924)

2026-08-21 10:12:50 +08:00

chat_channel_test.go

feat: make chat-channel and implement WhatsApp bot (#17518)

2026-07-29 18:55:22 +08:00

chat_channel.go

feat: make chat-channel and implement WhatsApp bot (#17518)

2026-07-29 18:55:22 +08:00

chat_recommendation.go

Go: add context to lots of interface (#17253)

2026-07-22 22:30:57 +08:00

chat_session_test.go

fix: chat did not pass model config to provider (#18485)

2026-08-19 18:43:15 +08:00

chat_session.go

fix: chat did not pass model config to provider (#18485)

2026-08-19 18:43:15 +08:00

chat_test.go

Go: refactor (#19084)

2026-09-01 12:34:08 +08:00

chat.go

Refactor: rename prefetch_size to rerank_candidates (#18718)

2026-08-25 11:35:53 +08:00

chunk_test.go

fix: filter chunks by requested IDs (#19377)

2026-09-09 10:00:24 +08:00

chunk.go

fix: filter chunks by requested IDs (#19377)

2026-09-09 10:00:24 +08:00

common.go

Add rename model directory to entity to avoid name misunderstanding (#13829)

2026-03-27 19:25:18 +08:00

compilation_status_test.go

Go knowledge compiler with scheduler-driven dataset compilation (#17913)

2026-08-06 15:54:00 +08:00

compilation_template_group.go

feat(go): port knowledge compilation template/group + wiki artifact/nav/skill REST APIs from Python (#17656)

2026-07-31 22:57:43 +08:00

compilation_template.go

feat(go): port knowledge compilation template/group + wiki artifact/nav/skill REST APIs from Python (#17656)

2026-07-31 22:57:43 +08:00

components.go

Go: merge functions (#16622)

2026-07-06 18:14:05 +08:00

connector_test.go

refactor(go-syncer): route GetConnector access errors through helper (#19146)

2026-09-02 16:41:33 +08:00

connector.go

refactor(go-syncer): route GetConnector access errors through helper (#19146)

2026-09-02 16:41:33 +08:00

dataset_aggregate_tags_test.go

Go: refactor (#16602)

2026-07-03 17:00:43 +08:00

dataset_artifact.go

fix: account for checkpointed ingestion progress (#18667)

2026-08-24 14:28:05 +08:00

dataset_list_tags_test.go

Go: refactor (#16602)

2026-07-03 17:00:43 +08:00

dataset_list_test.go

Go: support ids filter in list datasets API (#17705)

2026-08-03 13:54:44 +08:00

dataset_rename_tag_test.go

Go: refactor (#16602)

2026-07-03 17:00:43 +08:00

dataset_search_test.go

Refactor: combine 3 retrieval/search API as one (#19303)

2026-09-08 11:41:46 +08:00

dataset.go

Refactor: combine 3 retrieval/search API as one (#19303)

2026-09-08 11:41:46 +08:00

dify_retrieval_handler_test.go

fix(dify): return the custom document metadata the handler already fetches (#19123)

2026-09-02 19:19:02 +08:00

dify_retrieval_handler.go

fix(dify): return the custom document metadata the handler already fetches (#19123)

2026-09-02 19:19:02 +08:00

document_test.go

feat(ingestion): surface queued document task status (#19137)

2026-09-03 12:05:41 +08:00

document.go

feat(ingestion): surface queued document task status (#19137)

2026-09-03 12:05:41 +08:00

error_response_test.go

fix(go): redact internal handler errors (#15746)

2026-06-12 16:09:10 +08:00

error_test.go

Feat: add built in DSL file API (#17003)

2026-07-18 11:00:08 +08:00

error.go

Feat: add built in DSL file API (#17003)

2026-07-18 11:00:08 +08:00

file_commit_test.go

fix(api): authorize dataset and workspace commit routes (#19357)

2026-09-09 10:33:23 +08:00

file_commit.go

fix(api): authorize dataset and workspace commit routes (#19357)

2026-09-09 10:33:23 +08:00

file_error_test.go

fix(file): classify ancestry authorization failures as data errors (#19157)

2026-09-03 10:05:05 +08:00

file.go

fix(file): classify ancestry authorization failures as data errors (#19157)

2026-09-03 10:05:05 +08:00

langfuse_test.go

Go: add context, part6 (#17399)

2026-07-27 11:09:17 +08:00

langfuse.go

Go: add context, part6 (#17399)

2026-07-27 11:09:17 +08:00

llm.go

Go: add context, part6 (#17399)

2026-07-27 11:09:17 +08:00

mcp_pagination_test.go

fix(mcp): read total_datasets so the fetch-all early-exit works (#19020)

2026-09-02 19:05:50 +08:00

mcp_server.go

Refactor: combine 3 retrieval/search API as one (#19303)

2026-09-08 11:41:46 +08:00

mcp_test.go

feat(go-api): migrate MCP server detail and download API to Go (#16113)

2026-06-18 11:09:22 +08:00

mcp.go

Go: fix context (#18060)

2026-08-10 19:11:43 +08:00

memory_message_test.go

feat: Implement API of ragflow server in Go (#15256)

2026-06-10 21:27:35 +08:00

memory.go

fix(api): accept repeated memory_type and tenant_id filters when listing memories (#19281)

2026-09-08 11:48:16 +08:00

mindmap_test.go

Go: fix context, part3 (#18821)

2026-08-26 22:33:10 +08:00

mindmap.go

fix(chat): propagate mind map stream failures (#18733)

2026-08-25 19:34:40 +08:00

models.go

Go: add tools for gitee, volcengine and zhipuAI (#17091)

2026-07-20 19:18:48 +08:00

openai_chat_test.go

fix: chat did not pass model config to provider (#18485)

2026-08-19 18:43:15 +08:00

openai_chat.go

Go: fix warnings (#17738)

2026-08-03 21:30:01 +08:00

pipeline_test.go

Feat: add built in DSL file API (#17003)

2026-07-18 11:00:08 +08:00

pipeline.go

Feat: add built in DSL file API (#17003)

2026-07-18 11:00:08 +08:00

plugin_test.go

feat[Go]: implement GET /plugin/tools (issue #15240) (#15570)

2026-06-08 11:53:19 +08:00

plugin.go

Fix internal/handler test failures, align response with Python contract, and re-enable handler/storage/agent tests in CI (#17554)

2026-07-30 16:59:39 +08:00

providers_test.go

feat(go): port knowledge compilation template/group + wiki artifact/nav/skill REST APIs from Python (#17656)

2026-07-31 22:57:43 +08:00

providers.go

feat(bedrock): support API key authentication (#18301)

2026-08-25 11:08:24 +08:00

search_handler_test.go

Test(handler): fix failing TestSearchHandlerUpdateRejectsInvalidSearchID assertion (#17622)

2026-07-31 15:44:49 +08:00

search.go

Go: fix warnings (#17738)

2026-08-03 21:30:01 +08:00

searchbot_detail_test.go

Go: add context to lots of interface (#17253)

2026-07-22 22:30:57 +08:00

searchbot_test.go

Go: add context (#17314)

2026-07-24 16:47:12 +08:00

searchbot.go

Refactor: rename prefetch_size to rerank_candidates (#18718)

2026-08-25 11:35:53 +08:00

skill_search.go

Go: add context, part9 (#17412)

2026-07-27 15:06:48 +08:00

stats.go

Go: add context to DAO (#17269)

2026-07-23 12:15:58 +08:00

streaming_test.go

fix: SSE write timeout (#15852)

2026-06-12 20:49:34 +08:00

streaming.go

fix: SSE write timeout (#15852)

2026-06-12 20:49:34 +08:00

system_ee.go

Go: more APIs (#16850)

2026-07-13 15:24:17 +08:00

system.go

Go: add context to redis client (#17689)

2026-08-02 22:50:54 +08:00

tenant.go

Go: fix go context (#18052)

2026-08-10 18:04:17 +08:00

user_auth_ee.go

Go: refactor (#17635)

2026-07-31 17:48:35 +08:00

user.go

Go: add context to redis client (#17689)

2026-08-02 22:50:54 +08:00