Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[PR #629] [MERGED] Implement total permission overhaul #3434

New Issue
Closed
opened 2026-02-22 18:33:46 -05:00 by yindo · 0 comments
yindo commented 2026-02-22 18:33:46 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/Mintplex-Labs/anything-llm/pull/629
Author: @timothycarambat
Created: 1/19/2024
Status: ✅ Merged
Merged: 1/22/2024
Merged by: @timothycarambat

Base: master ← Head: permission-overhaul

📝 Commits (5)

  • a67583e Implement total permission overhaul
  • 0fe1a3e update comments
  • daae14b remove permissions to API-keys for manager. Manager could generate API-key and using high-privelege api-key give themselves admin
  • 509d837 update sidebar permissions for multi-user and single user
  • cab9895 update options for mobile sidebar

📊 Changes

16 files changed (+611 additions, -374 deletions)

View changed files

📝 frontend/src/App.jsx (+1 -1)
📝 frontend/src/components/SettingsSidebar/index.jsx (+138 -75)
📝 frontend/src/models/system.js (+2 -0)
📝 frontend/src/pages/Admin/Users/UserRow/index.jsx (+29 -6)
📝 frontend/src/pages/Admin/Users/index.jsx (+2 -1)
📝 server/endpoints/admin.js (+62 -32)
📝 server/endpoints/api/admin/index.js (+7 -16)
📝 server/endpoints/chat.js (+6 -2)
📝 server/endpoints/extensions/index.js (+4 -3)
📝 server/endpoints/system.js (+76 -132)
📝 server/endpoints/utils.js (+22 -53)
📝 server/endpoints/workspaces.js (+42 -30)
📝 server/models/workspace.js (+4 -2)
➕ server/utils/helpers/admin/index.js (+52 -0)
➕ server/utils/helpers/chat/convertTo.js (+113 -0)
📝 server/utils/middleware/multiUserProtected.js (+51 -21)

📄 Description

Pull Request Type

  • ✨ feat
  • 🐛 fix
  • ♻️ refactor
  • 💄 style
  • 🔨 chore
  • 📝 docs

What is in this change?

Add explicit permissions on each flex and strict route
Patch issues with role escalation and CRUD of users
Patch permissions on all routes for coverage
Improve middleware to accept role array for clarity
Refactor various routes and paths
Add security to all routes where minimal security could be required.

Additional Information

Functionally, the roles and permissions are the same to the end user. This was a backend chore task that sets up AnythingLLM for greater permission access in future.

Developer Validations

  • I ran yarn lint from the root of the repo & committed changes
  • Relevant documentation has been updated
  • I have tested my code functionality
  • Docker build succeeds locally

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Mintplex-Labs/anything-llm/pull/629 **Author:** [@timothycarambat](https://github.com/timothycarambat) **Created:** 1/19/2024 **Status:** ✅ Merged **Merged:** 1/22/2024 **Merged by:** [@timothycarambat](https://github.com/timothycarambat) **Base:** `master` ← **Head:** `permission-overhaul` --- ### 📝 Commits (5) - [`a67583e`](https://github.com/Mintplex-Labs/anything-llm/commit/a67583ea05dac27ff1243dbf6c34dfda049abc15) Implement total permission overhaul - [`0fe1a3e`](https://github.com/Mintplex-Labs/anything-llm/commit/0fe1a3e4c64163421d929cd95a8367c19907430c) update comments - [`daae14b`](https://github.com/Mintplex-Labs/anything-llm/commit/daae14bef26d79bbfeb809dccebc79e436a5f69e) remove permissions to API-keys for manager. Manager could generate API-key and using high-privelege api-key give themselves admin - [`509d837`](https://github.com/Mintplex-Labs/anything-llm/commit/509d8378372f0c1bd42454ffeb6a4e29207dd326) update sidebar permissions for multi-user and single user - [`cab9895`](https://github.com/Mintplex-Labs/anything-llm/commit/cab9895a7472078fcd4ac1d39b4e8e4d3b7e75e0) update options for mobile sidebar ### 📊 Changes **16 files changed** (+611 additions, -374 deletions) <details> <summary>View changed files</summary> 📝 `frontend/src/App.jsx` (+1 -1) 📝 `frontend/src/components/SettingsSidebar/index.jsx` (+138 -75) 📝 `frontend/src/models/system.js` (+2 -0) 📝 `frontend/src/pages/Admin/Users/UserRow/index.jsx` (+29 -6) 📝 `frontend/src/pages/Admin/Users/index.jsx` (+2 -1) 📝 `server/endpoints/admin.js` (+62 -32) 📝 `server/endpoints/api/admin/index.js` (+7 -16) 📝 `server/endpoints/chat.js` (+6 -2) 📝 `server/endpoints/extensions/index.js` (+4 -3) 📝 `server/endpoints/system.js` (+76 -132) 📝 `server/endpoints/utils.js` (+22 -53) 📝 `server/endpoints/workspaces.js` (+42 -30) 📝 `server/models/workspace.js` (+4 -2) ➕ `server/utils/helpers/admin/index.js` (+52 -0) ➕ `server/utils/helpers/chat/convertTo.js` (+113 -0) 📝 `server/utils/middleware/multiUserProtected.js` (+51 -21) </details> ### 📄 Description ### Pull Request Type <!-- For change type, change [ ] to [x]. --> - [ ] ✨ feat - [x] 🐛 fix - [x] ♻️ refactor - [ ] 💄 style - [x] 🔨 chore - [ ] 📝 docs ### What is in this change? Add explicit permissions on each flex and strict route Patch issues with role escalation and CRUD of users Patch permissions on all routes for coverage Improve middleware to accept role array for clarity Refactor various routes and paths Add security to all routes where minimal security could be required. ### Additional Information Functionally, the roles and permissions are the same to the end user. This was a backend chore task that sets up AnythingLLM for greater permission access in future. ### Developer Validations <!-- All of the applicable items should be checked. --> - [x] I ran `yarn lint` from the root of the repo & committed changes - [x] Relevant documentation has been updated - [x] I have tested my code functionality - [x] Docker build succeeds locally --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-22 18:33:46 -05:00
yindo closed this issue 2026-02-22 18:33:46 -05:00
yindo changed title from [PR #629] Implement total permission overhaul to [PR #629] [MERGED] Implement total permission overhaul 2026-06-05 15:13:24 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#3434
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?