From 731e2d5f26655f93f31e5ab73457ceac51d2d954 Mon Sep 17 00:00:00 2001 From: "Ramin M." <58203645+raminmardani@users.noreply.github.com> Date: Mon, 29 Dec 2025 19:27:04 -0800 Subject: [PATCH] api key delete bug - Bug #3045 (#12299) Description: Fixed an issue where deleting an API token would fail because it was incorrectly using current_user.id as the tenant_id instead of querying the actual tenant ID from UserTenantService. Changes: Updated rm() endpoint to fetch the correct tenant_id from UserTenantService before deleting the API token Added proper error handling with try/except block Code style cleanup: consistent quote usage and formatting Related Issue: #3045 https://github.com/infiniflow/ragflow/issues/3045 Co-authored-by: Mardani, Ramin --- api/apps/system_app.py | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/api/apps/system_app.py b/api/apps/system_app.py index 7e646927e..379b597de 100644 --- a/api/apps/system_app.py +++ b/api/apps/system_app.py @@ -177,7 +177,7 @@ def healthz(): return jsonify(result), (200 if all_ok else 500) -@manager.route("/ping", methods=["GET"]) # noqa: F821 +@manager.route("/ping", methods=["GET"]) # noqa: F821 def ping(): return "pong", 200 @@ -213,7 +213,7 @@ def new_token(): if not tenants: return get_data_error_result(message="Tenant not found!") - tenant_id = [tenant for tenant in tenants if tenant.role == 'owner'][0].tenant_id + tenant_id = [tenant for tenant in tenants if tenant.role == "owner"][0].tenant_id obj = { "tenant_id": tenant_id, "token": generate_confirmation_token(), @@ -268,13 +268,12 @@ def token_list(): if not tenants: return get_data_error_result(message="Tenant not found!") - tenant_id = [tenant for tenant in tenants if tenant.role == 'owner'][0].tenant_id + tenant_id = [tenant for tenant in tenants if tenant.role == "owner"][0].tenant_id objs = APITokenService.query(tenant_id=tenant_id) objs = [o.to_dict() for o in objs] for o in objs: if not o["beta"]: - o["beta"] = generate_confirmation_token().replace( - "ragflow-", "")[:32] + o["beta"] = generate_confirmation_token().replace("ragflow-", "")[:32] APITokenService.filter_update([APIToken.tenant_id == tenant_id, APIToken.token == o["token"]], o) return get_json_result(data=objs) except Exception as e: @@ -307,13 +306,19 @@ def rm(token): type: boolean description: Deletion status. """ - APITokenService.filter_delete( - [APIToken.tenant_id == current_user.id, APIToken.token == token] - ) - return get_json_result(data=True) + try: + tenants = UserTenantService.query(user_id=current_user.id) + if not tenants: + return get_data_error_result(message="Tenant not found!") + + tenant_id = tenants[0].tenant_id + APITokenService.filter_delete([APIToken.tenant_id == tenant_id, APIToken.token == token]) + return get_json_result(data=True) + except Exception as e: + return server_error_response(e) -@manager.route('/config', methods=['GET']) # noqa: F821 +@manager.route("/config", methods=["GET"]) # noqa: F821 def get_config(): """ Get system configuration. @@ -330,6 +335,4 @@ def get_config(): type: integer 0 means disabled, 1 means enabled description: Whether user registration is enabled """ - return get_json_result(data={ - "registerEnabled": settings.REGISTER_ENABLED - }) + return get_json_result(data={"registerEnabled": settings.REGISTER_ENABLED})