GareArc
d16d2d1efa
Merge remote-tracking branch 'origin/gareth/esq1-170-rbac-for-agent' into gareth/esq1-170-rbac-for-agent
2026-07-22 21:32:30 -07:00
GareArc
91126a5fda
fix(agent): stack agent.manage onto agent app management and import paths
...
Roster composer writes keep their app_edit / snippets gate and require
workspace agent.manage in addition, instead of replacing it. Generic app
management routes (update/delete/copy/export/name/icon/site/site-enable/
api-enable/api-keys) enforce agent.manage when the target is a roster
Agent App and reject hidden workflow-only backing apps outright, which
stay usable only through the Agent runtime surfaces. Importing an Agent
DSL requires agent.manage and the denial surfaces as 403 instead of a
generic failed import.
2026-07-22 21:31:56 -07:00
GareArc
8482167f1c
fix(agent): authorize workflow-only agents against their parent workflow app
...
The RBAC resource resolver returned the hidden runtime backing app for
workflow-only agents, which never receives a resource access policy, so
per-resource overrides on the parent workflow app were ignored. Resolve
agent_id to the policy-owning agent.app_id instead and keep
backing_app_id strictly runtime-only.
2026-07-22 21:31:43 -07:00
yyh and GitHub
6cd10f5e04
Merge branch 'main' into gareth/esq1-170-rbac-for-agent
2026-07-23 12:07:51 +08:00
45711eb6dd
chore(api): cloud use presigned download url on api site ( #39436 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 03:34:49 +00:00
Asuka Minato and GitHub
fd703739b5
test: use sqlite3 session in test_async_workflow_service ( #38692 )
2026-07-23 03:34:10 +00:00
GareArc
1b5fbb2142
Merge remote-tracking branch 'origin/main' into gareth/esq1-170-rbac-for-agent
2026-07-22 20:24:53 -07:00
David Park and GitHub
da2177c7b2
fix(api): send valid body in external knowledge validation probe ( #39410 )
2026-07-23 02:52:52 +00:00
bd8f0104d6
feat(dataset): expose New RAG KnowledgeFS contracts ( #39314 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 01:48:36 +00:00
d5788cc019
feat: support tool multi-select input ( #39346 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: WH-2099 <wh2099@pm.me >
2026-07-23 00:38:54 +00:00
zyssyz123 and GitHub
4da4fa72cd
fix(agent): refresh stale inline preview drafts ( #39415 )
2026-07-22 12:54:09 +00:00
34a5ca191b
feat(dataset): add New Knowledge list and empty state ( #39300 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 12:00:50 +00:00
0f9fffb7a2
fix(agent): isolate build and preview chat conversations ( #39405 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 09:17:55 +00:00
林玮 (Jade Lin) and GitHub
c5aadfe557
fix(api,billing): invalidate vector space cache after cleanup ( #39404 )
2026-07-22 07:30:16 +00:00
Asuka Minato and GitHub
072953a83a
test: use sqlite3 session in test_export_service ( #38718 )
2026-07-22 04:52:19 +00:00
Asuka Minato and GitHub
66afa3bf4a
test: use sqlite3 session in test_clear_free_plan_tenant_expired_logs ( #38693 )
2026-07-22 04:16:21 +00:00
Asuka Minato and GitHub
b38caf3cdb
test: use SQLite sessions in services core ( #39111 )
2026-07-22 02:15:01 +00:00
Asuka Minato and GitHub
cb2b36f1aa
test: use SQLite sessions in services enterprise ( #39113 )
2026-07-22 02:13:52 +00:00
Asuka Minato and GitHub
2d15743b96
test: use SQLite sessions in services misc ( #39114 )
2026-07-22 02:11:52 +00:00
9b432d0d29
fix: enforce tool provider type contracts ( #39380 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 01:30:55 +00:00
GareArc
2279298c1a
Merge remote-tracking branch 'origin/main' into gareth/esq1-170-rbac-for-agent
2026-07-21 16:38:49 -07:00
GareArc
ac87341d69
Merge remote-tracking branch 'origin/main' into gareth/esq1-170-rbac-for-agent
...
# Conflicts:
# api/services/enterprise/rbac_service.py
2026-07-21 03:02:11 -07:00
QuantumGhost and GitHub
af465fb527
fix(api): scope HITL snapshot message lookup to utilize db index ( #39351 )
2026-07-21 09:47:17 +00:00
62bbc0dbeb
feat(webapp-access): add WEBAPP_PUBLIC_ACCESS_ENABLED toggle ( #38567 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-21 08:46:28 +00:00
GareArc
75cb8ea408
refactor(api): reuse the roster service's agent resolution for RBAC checks
...
The app-scoped RBAC gate hand-rolled a query to turn an agent_id into the id
of the App backing it, duplicating AgentRosterService.runtime_backing_app_id.
Worse, it filtered on id and tenant only, so the auth check accepted archived
Agents and sources the runtime resolver rejects -- a weaker notion of a valid
Agent than the layer it guards.
Add peek_runtime_backing_app_id, a read-only counterpart to
get_agent_runtime_app_model that never materializes the hidden backing App,
and share the eligibility filter between the two so they cannot drift.
The tenant filter was also untested: deleting it left all 50 tests passing,
since the specs stubbed the db module wholesale. Assert the resolver is called
with the caller's tenant instead, and cover the precedence and read-only
guarantees against the service directly.
2026-07-21 01:34:16 -07:00
zyssyz123 and GitHub
ed1289281d
fix(agent): include workflow runs in monitoring stats ( #39354 )
2026-07-21 08:33:23 +00:00
a5194ff17b
test: move human input delivery coverage to unit tests ( #38926 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-21 08:18:32 +00:00
Asuka Minato and GitHub
b99f8941bb
test: use sqlite3 session in test_database_retrieval ( #38743 )
2026-07-21 07:56:34 +00:00
Asuka Minato and GitHub
f6db23444d
test: move API token service coverage to unit tests ( #38918 )
2026-07-21 07:48:10 +00:00
a5c989d82b
test: use sqlite3 session in test_conversation_service ( #38774 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-21 07:38:53 +00:00
Asuka Minato and GitHub
1e672530c4
test: use sqlite3 session in test_built_in_retrieval ( #38735 )
2026-07-21 07:36:42 +00:00
Asuka Minato and GitHub
d7860571aa
test: use SQLite sessions in services workflow ( #39115 )
2026-07-21 07:24:52 +00:00
GareArc
edbaaeae23
fix(api): resolve agent routes to their backing app for app-scoped RBAC
2026-07-21 00:22:24 -07:00
Asuka Minato and GitHub
3683831738
test: use sqlite3 session in test_account_service ( #38751 )
2026-07-21 07:22:05 +00:00
yyh and GitHub
fcc1d39f5e
fix(web): restore billing access boundary ( #39343 )
2026-07-21 05:35:36 +00:00
d333aa31ea
test: use SQLite sessions in services workflow ( #39116 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-21 03:40:02 +00:00
97e6a14c13
test: use SQLite sessions in unit misc ( #39119 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-21 03:20:59 +00:00
林玮 (Jade Lin) and GitHub
28d17da3b1
fix(api): use resource tenant for draft variable files ( #39307 )
2026-07-21 02:07:47 +00:00
GareArc
e606156580
Merge branch 'main' into gareth/esq1-170-rbac-for-agent
2026-07-20 03:47:12 -07:00
23882a704e
test: use SQLite sessions in unit misc ( #39122 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 10:38:49 +00:00
1bd5254ea7
test: use SQLite sessions in unit misc ( #39123 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 10:38:46 +00:00
GareArc
181f58ed9c
Merge branch 'main' into gareth/esq1-170-rbac-for-agent
2026-07-20 02:31:18 -07:00
cb64446fa3
feat(web): add step-by-step tour shell ( #38785 )
...
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-07-20 09:23:25 +00:00
GareArc
f947cbfffb
test: cover the agents access guard and unbreak the roster layout suite
...
AgentsAccessGuard calls useRouter, which threw "invariant expected app
router to be mounted" in the existing roster layout suite. Mock the guard
there so that suite stays scoped to the feature flag, and give the guard
its own spec covering loading, redirect and pass-through.
Also assert the disabled edit-in-console control through its accessible
role, and move the legacy-key test into a class like its neighbours.
2026-07-20 02:09:31 -07:00
43d725a1ce
feat(dataset): proxy KnowledgeFS Console requests ( #39158 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 08:10:06 +00:00
Ingram Z and GitHub
b7edc5ef0c
refactor: use catalog for workflow archive maintenance ( #39001 )
2026-07-20 07:59:29 +00:00
6022939bf0
fix: prevent hidden-tab collaboration leader from saving stale drafts ( #38997 )
...
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-07-20 06:58:01 +00:00
非法操作 and GitHub
30df1433cc
fix: can't create chat app when get tenant default model schema error ( #39266 )
2026-07-20 06:47:16 +00:00
GareArc
5c42d0928b
feat(api): add agent.manage RBAC permission and legacy fallback keys
2026-07-19 23:04:12 -07:00
Checo and GitHub
5ea884f799
fix(dataset_service): use flush() instead of commit() to preserve caller transaction ( #39223 )
2026-07-19 07:00:50 +00:00
GareArc