zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-07-23 00:46:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Revert "fix(api): authorize owner_ids for list chats and search apps (#14775) (#15698)

Browse Source 
This reverts PR #14775  commit 5a5e766386.
This commit is contained in:
Wang Qi
2026-06-05 17:26:02 +08:00
committed by GitHub
parent 6cba5a544a
commit 214ee319f8
6 changed files with 52 additions and 254 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
api/apps/restful_apis/chat_api.py
View File

@@ -459,32 +459,21 @@ async def list_chats():
page_number = int(request.args.get("page", 0))
items_per_page = validate_rest_api_page_size(int(request.args.get("page_size", 0)))
tenants = TenantService.get_joined_tenants_by_user_id(current_user.id)
authorized_owner_ids = {member["tenant_id"] for member in tenants}
authorized_owner_ids.add(current_user.id)
if owner_ids:
requested_owner_ids = set(owner_ids)
unauthorized_owner_ids = requested_owner_ids - authorized_owner_ids
if unauthorized_owner_ids:
logging.warning(
"Rejected list_chats request: user=%s attempted unauthorized owner_ids=%s",
current_user.id,
sorted(unauthorized_owner_ids),
)
return get_json_result(
data=False,
message="Only authorized owner_ids can be queried.",
code=RetCode.OPERATING_ERROR,
)
effective_owner_ids = list(requested_owner_ids)
chats, total = await thread_pool_exec(
DialogService.get_by_tenant_ids,
owner_ids, current_user.id, 0, 0, orderby, desc, keywords, **exact_filters,
)
chats = [chat for chat in chats if chat["tenant_id"] in owner_ids]
total = len(chats)
if page_number and items_per_page:
start = (page_number - 1) * items_per_page
chats = chats[start : start + items_per_page]
else:
effective_owner_ids = list(authorized_owner_ids)
chats, total = await thread_pool_exec(
DialogService.get_by_tenant_ids,
effective_owner_ids, current_user.id, page_number, items_per_page, orderby, desc, keywords, **exact_filters,
)
chats, total = await thread_pool_exec(
DialogService.get_by_tenant_ids,
[], current_user.id, page_number, items_per_page, orderby, desc, keywords, **exact_filters,
)
return get_json_result(
data={"chats": [_build_chat_response(chat) for chat in chats], "total": total}

32
api/apps/restful_apis/search_api.py
View File

@@ -84,31 +84,15 @@ def list_searches():
owner_ids = request.args.getlist("owner_ids")
try:
tenants = TenantService.get_joined_tenants_by_user_id(current_user.id)
authorized_owner_ids = {member["tenant_id"] for member in tenants}
authorized_owner_ids.add(current_user.id)
if owner_ids:
requested_owner_ids = set(owner_ids)
unauthorized_owner_ids = requested_owner_ids - authorized_owner_ids
if unauthorized_owner_ids:
logging.warning(
"Rejected list_searches request: user=%s attempted unauthorized owner_ids=%s",
current_user.id,
sorted(unauthorized_owner_ids),
)
return get_json_result(
data=False,
message="Only authorized owner_ids can be queried.",
code=RetCode.OPERATING_ERROR,
)
effective_owner_ids = list(requested_owner_ids)
if not owner_ids:
tenants = []
search_apps, total = SearchService.get_by_tenant_ids(tenants, current_user.id, page_number, items_per_page, orderby, desc, keywords)
else:
effective_owner_ids = list(authorized_owner_ids)
search_apps, total = SearchService.get_by_tenant_ids(
effective_owner_ids, current_user.id, page_number, items_per_page, orderby, desc, keywords
)
search_apps, total = SearchService.get_by_tenant_ids(owner_ids, current_user.id, 0, 0, orderby, desc, keywords)
search_apps = [s for s in search_apps if s["tenant_id"] in owner_ids]
total = len(search_apps)
if page_number and items_per_page:
search_apps = search_apps[(page_number - 1) * items_per_page: page_number * items_per_page]
return get_json_result(data={"search_apps": search_apps, "total": total})
except Exception as e:
return server_error_response(e)