From 1939b5f3747eff2641f3b7332e9fff33d637fbee Mon Sep 17 00:00:00 2001
From: Ilango <ilango.rajagopal@flowiseai.com>
Date: Fri, 7 Aug 2026 11:24:57 +0530
Subject: [PATCH] add: permissions for bullmq endpoint (#6713)

---
 packages/server/src/enterprise/rbac/Permissions.ts | 1 +
 packages/server/src/index.ts                       | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/server/src/enterprise/rbac/Permissions.ts b/packages/server/src/enterprise/rbac/Permissions.ts
index 9ba33a88e..c1ac8bb66 100644
--- a/packages/server/src/enterprise/rbac/Permissions.ts
+++ b/packages/server/src/enterprise/rbac/Permissions.ts
@@ -131,6 +131,7 @@ export class Permissions {
         adminCategory.addPermission(new Permission('users:manage', 'Manage Users', false, true, true))
         adminCategory.addPermission(new Permission('roles:manage', 'Manage Roles', false, true, true))
         adminCategory.addPermission(new Permission('sso:manage', 'Manage SSO', false, true, false))
+        adminCategory.addPermission(new Permission('admin:queues', 'View & Manage Queues Dashboard', true, true, false))
         this.categories.push(adminCategory)
 
         const logsCategory = new PermissionCategory('logs')
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index 566e7ddf1..dcf149132 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -14,6 +14,7 @@ import { Organization } from './enterprise/database/entities/organization.entity
 import { Workspace } from './enterprise/database/entities/workspace.entity'
 import { LoggedInUser } from './enterprise/Interface.Enterprise'
 import { initializeJwtCookieMiddleware, verifyToken, verifyTokenForBullMQDashboard } from './enterprise/middleware/passport'
+import { checkPermission } from './enterprise/rbac/PermissionCheck'
 import { initAuthSecrets } from './enterprise/utils/authSecrets'
 import { IdentityManager } from './IdentityManager'
 import { MODE, Platform } from './Interface'
@@ -347,7 +348,13 @@ export class App {
             )
 
             const rateLimiter = this.rateLimiterManager.getRateLimiterById(id)
-            this.app.use('/admin/queues', rateLimiter, verifyTokenForBullMQDashboard, this.queueManager.getBullBoardRouter())
+            this.app.use(
+                '/admin/queues',
+                rateLimiter,
+                verifyTokenForBullMQDashboard,
+                checkPermission('admin:queues'),
+                this.queueManager.getBullBoardRouter()
+            )
         }
 
         // ----------------------------------------