From 067a60e0ac8d1d045bf49d018df32b3614e6c3ce Mon Sep 17 00:00:00 2001 From: Pranav Agarwal Date: Fri, 4 Sep 2026 09:17:41 +0000 Subject: [PATCH] fix(api): enforce admin and RBAC permissions on model provider model credential GET endpoint (#41599) (#41600) Co-authored-by: Yunlu Wen --- api/controllers/console/workspace/models.py | 2 ++ .../console/test_workspace_credential_mutation_permissions.py | 2 ++ 2 files changed, 4 insertions(+) diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py index 54d021251fd..02b5a68f9c8 100644 --- a/api/controllers/console/workspace/models.py +++ b/api/controllers/console/workspace/models.py @@ -349,6 +349,8 @@ class ModelProviderModelCredentialApi(Resource): ) @setup_required @login_required + @is_admin_or_owner_required + @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False) @account_initialization_required @with_current_user @with_current_tenant_id diff --git a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py index e6082a2e8b8..9714a7cceb9 100644 --- a/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py +++ b/api/tests/unit_tests/controllers/console/test_workspace_credential_mutation_permissions.py @@ -9,6 +9,7 @@ from controllers.console.agent.roster import AgentAppApi from controllers.console.datasets.data_source import DataSourceApi from controllers.console.datasets.rag_pipeline.datasource_auth import DatasourceAuth from controllers.console.workspace.model_providers import ModelProviderCredentialApi +from controllers.console.workspace.models import ModelProviderModelCredentialApi from controllers.console.workspace.tool_providers import ToolBuiltinProviderAddApi, ToolOAuthCustomClient @@ -37,6 +38,7 @@ def test_workspace_credential_mutations_require_management_permission( "method", [ ModelProviderCredentialApi.get, + ModelProviderModelCredentialApi.get, ], ) def test_model_provider_credential_get_requires_admin_and_rbac(