From 6cc862fc0031bda03c6ff1bf9928002ccfbd4b78 Mon Sep 17 00:00:00 2001
From: euvre <93761161+euvre@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:58:43 +0800
Subject: [PATCH] Fix: agent list owner filter not applied (#17410)

---
 api/db/services/canvas_service.py |  9 +++-----
 internal/dao/user_canvas.go       | 36 ++++++++++++++-----------------
 2 files changed, 19 insertions(+), 26 deletions(-)

diff --git a/api/db/services/canvas_service.py b/api/db/services/canvas_service.py
index 9aa250c7a7..e9b7d5750b 100644
--- a/api/db/services/canvas_service.py
+++ b/api/db/services/canvas_service.py
@@ -148,21 +148,18 @@ class UserCanvasService(CommonService):
             cls.model.canvas_category,
             cls.model.tags,
         ]
+        owner_filter = cls.model.user_id.in_(joined_tenant_ids) & ((cls.model.permission == TenantPermission.TEAM.value) | (cls.model.user_id == user_id))
         if keywords:
             agents = (
                 cls.model.select(*fields)
                 .join(User, on=(cls.model.user_id == User.id))
                 .where(
-                    (((cls.model.user_id.in_(joined_tenant_ids)) & (cls.model.permission == TenantPermission.TEAM.value)) | (cls.model.user_id == user_id)),
+                    owner_filter,
                     (fn.LOWER(cls.model.title).contains(keywords.lower())),
                 )
             )
         else:
-            agents = (
-                cls.model.select(*fields)
-                .join(User, on=(cls.model.user_id == User.id))
-                .where((((cls.model.user_id.in_(joined_tenant_ids)) & (cls.model.permission == TenantPermission.TEAM.value)) | (cls.model.user_id == user_id)))
-            )
+            agents = cls.model.select(*fields).join(User, on=(cls.model.user_id == User.id)).where(owner_filter)
         if canvas_category:
             agents = agents.where(cls.model.canvas_category == canvas_category)
         if canvas_type:
diff --git a/internal/dao/user_canvas.go b/internal/dao/user_canvas.go
index 0ef1e21f6a..451c0aca0d 100644
--- a/internal/dao/user_canvas.go
+++ b/internal/dao/user_canvas.go
@@ -357,28 +357,24 @@ func (dao *UserCanvasDAO) ListByTenantIDs(ownerIDs []string, userID string, page
 	// Canvases owned by any of the ownerIDs that are "team"-permission, plus all owned by userID.
 	base := DB.Model(&entity.UserCanvas{}).
 		Select(`user_canvas.id,
-			user_canvas.avatar,
-			user_canvas.title,
-			user_canvas.description,
-			user_canvas.permission,
-			user_canvas.user_id,
-			user_canvas.user_id AS tenant_id,
-			user.nickname,
-			user.avatar AS tenant_avatar,
-			user_canvas.canvas_type,
-			user_canvas.canvas_category,
-			user_canvas.tags,
-			user_canvas.create_time,
-			user_canvas.update_time`).
+		user_canvas.avatar,
+		user_canvas.title,
+		user_canvas.description,
+		user_canvas.permission,
+		user_canvas.user_id,
+		user_canvas.user_id AS tenant_id,
+		user.nickname,
+		user.avatar AS tenant_avatar,
+		user_canvas.canvas_type,
+		user_canvas.canvas_category,
+		user_canvas.tags,
+		user_canvas.create_time,
+		user_canvas.update_time`).
 		Joins("LEFT JOIN user ON user_canvas.user_id = user.id").
+		Where("user_canvas.user_id IN ?", ownerIDs).
 		Where(
-			DB.Where("user_canvas.user_id IN ? AND user_canvas.permission = ?", ownerIDs, "team").
-				Or("user_canvas.user_id = ?", userID),
-			"user_canvas.user_id IN ?",
-			ownerIDs,
-		).Where(
-		DB.Where("user_canvas.permission = ?", "team").
-			Or("user_canvas.user_id = ?", userID))
+			DB.Where("user_canvas.permission = ?", "team").
+				Or("user_canvas.user_id = ?", userID))
 
 	if canvasCategory != "" {
 		base = base.Where("user_canvas.canvas_category = ?", canvasCategory)