mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-25 00:31:49 +08:00
6940cb463d
Completes the OSS admin surface for RBAC: full CRUD on authz_role,
authz_role_assignment, authz_team, and authz_team_member tables, plus a
per-user effective-permissions endpoint backing the frontend permission gate.
Plugin (enterprise Casbin) is invalidated on every write so the next enforce
sees the change.
New endpoints:
* GET/POST/PATCH/DELETE /api/v1/authz/roles -- custom-role CRUD with parent
cycle detection, system-role protection, and FK-aware delete (409 when
assignments still reference the role).
* GET/POST/DELETE /api/v1/authz/role-assignments -- list filterable by
user/role/domain; superuser-only for write, self-read allowed.
* GET/POST/PATCH/DELETE /api/v1/authz/teams + GET/POST/DELETE
/api/v1/authz/teams/{id}/members -- backs the share-with-team flow and
the team admin UI.
* POST /api/v1/authz/me/permissions -- returns per-resource allowed actions
for the current user (capped at 500 ids), backs the FE permission gate.
Base service additions (lfx.services.authorization.base):
* list_visible_resource_ids -- plugin SQL prefilter for list endpoints; OSS
returns None ("no prefilter, fall through to filter_visible_resources").
* get_effective_permissions -- default impl uses batch_enforce so plugins
inherit it for free; Casbin plugin can override for a tighter query.