langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Incorrect Dataset Ownership Assignment and Visibility in API #12249

New Issue
Closed
opened 2026-02-21 19:06:34 -05:00 by yindo · 6 comments
yindo commented 2026-02-21 19:06:34 -05:00
Owner
Copy Link
Copy Source

Originally created by @benjamin-mogensen on GitHub (Mar 27, 2025).

Originally assigned to: @JohnJyong on GitHub.

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.15.3

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

  1. Create a workflow with an HTTP node that ingests some data in to a knowledge base setting the permissions to only_me

✔️ Expected Behavior

  1. When using the POST /datasets Knowledge API endpoint with the "permission": "only_me" parameter from within workflow:

    • The user executing the workflow should be recognized as the current user.
    • The dataset should be created with visibility restricted to that individual (i.e., the one running the workflow).
    • The dataset should be visible in the Knowledge Base tab for that user.

  2. When using the GET /datasets endpoint:

    • All datasets created by the current user should be included in the response, even if the "permission" is set to "only_me".

❌ Actual Behavior

  1. When calling POST /datasets with "permission": "only_me":

    • The dataset is incorrectly assigned to the owner of the workspace, rather than the user running the workflow.
    • As a result, "only me" refers to the workspace owner, not the actual API caller.
    • The dataset is successfully created (verified), but is not visible in the Knowledge Base tab for the user who created it.

  2. When calling GET /datasets:

    • Datasets created under the "only_me" permission with the incorrect ownership are not included in the response.
    • Attempting to create a new dataset with the same name results in an error stating that a dataset with this name already exists—this is correct, indicating the dataset does exist, but the API fails to expose it to the user.
Originally created by @benjamin-mogensen on GitHub (Mar 27, 2025). Originally assigned to: @JohnJyong on GitHub. ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.15.3 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce 1. Create a workflow with an HTTP node that ingests some data in to a knowledge base setting the permissions to `only_me` ### ✔️ Expected Behavior 1. When using the `POST /datasets` Knowledge API endpoint with the `"permission": "only_me"` parameter from within workflow: - The user executing the workflow should be recognized as the current user. - The dataset should be created with visibility restricted to that individual (i.e., the one running the workflow). - The dataset should be visible in the Knowledge Base tab for that user. 2. When using the `GET /datasets` endpoint: - All datasets created by the current user should be included in the response, even if the `"permission"` is set to `"only_me"`. ### ❌ Actual Behavior 1. When calling `POST /datasets` with `"permission": "only_me"`: - The dataset is incorrectly assigned to the **owner of the workspace**, rather than the user running the workflow. - As a result, "only me" refers to the **workspace owner**, not the actual API caller. - The dataset is successfully created (verified), but is not visible in the Knowledge Base tab for the user who created it. 2. When calling `GET /datasets`: - Datasets created under the `"only_me"` permission with the incorrect ownership are not included in the response. - Attempting to create a new dataset with the same name results in an error stating that a dataset with this name already exists—this is correct, indicating the dataset does exist, but the API fails to expose it to the user.
yindo added the 🐞 bugstale labels 2026-02-21 19:06:34 -05:00
yindo closed this issue 2026-02-21 19:06:34 -05:00
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@benjamin-mogensen commented on GitHub (Mar 27, 2025):

@guchenhe @crazywoola please see this bug we found, thanks.

@benjamin-mogensen commented on GitHub (Mar 27, 2025): @guchenhe @crazywoola please see this bug we found, thanks.
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Mar 27, 2025):

"permission": "only_me"

Currently, only the owner can create API tokens, and all tokens are bound to the owner, not to individual users. Since there's no permission setting for who can create API tokens, they are all created under the owner account.

Although we are admins and have the same permissions as the owner within the knowledge base, only the owner has the ability to generate tokens. Members do not have these permissions.

We will refine this later.

@crazywoola commented on GitHub (Mar 27, 2025): ``` "permission": "only_me" ``` Currently, only the owner can create API tokens, and all tokens are bound to the owner, not to individual users. Since there's no permission setting for who can create API tokens, they are all created under the owner account. Although we are admins and have the same permissions as the owner within the knowledge base, only the owner has the ability to generate tokens. Members do not have these permissions. We will refine this later.
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@benjamin-mogensen commented on GitHub (Mar 27, 2025):

"permission": "only_me"

Currently, only the owner can create API tokens, and all tokens are bound to the owner, not to individual users. Since there's no permission setting for who can create API tokens, they are all created under the owner account.

Although we are admins and have the same permissions as the owner within the knowledge base, only the owner has the ability to generate tokens. Members do not have these permissions.

We will refine this later.

Thanks @crazywoola appreciate the quick reply and the explanation.

@benjamin-mogensen commented on GitHub (Mar 27, 2025): > ``` > "permission": "only_me" > ``` > > Currently, only the owner can create API tokens, and all tokens are bound to the owner, not to individual users. Since there's no permission setting for who can create API tokens, they are all created under the owner account. > > Although we are admins and have the same permissions as the owner within the knowledge base, only the owner has the ability to generate tokens. Members do not have these permissions. > > We will refine this later. Thanks @crazywoola appreciate the quick reply and the explanation.
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@benjamin-mogensen commented on GitHub (Apr 22, 2025):

@crazywoola @Yawen-1010 any update on this one?

@benjamin-mogensen commented on GitHub (Apr 22, 2025): @crazywoola @Yawen-1010 any update on this one?
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@Yawen-1010 commented on GitHub (Apr 25, 2025):

Hi, @benjamin-mogensen. This issue is planned to be addressed through the design of a permissions system, which is part of the enterprise edition roadmap. It will require time for both design and development. Currently, there is no temporary solution available. We will refine this later in a future release. Thank you for your patience!

@Yawen-1010 commented on GitHub (Apr 25, 2025): Hi, @benjamin-mogensen. This issue is planned to be addressed through the design of a permissions system, which is part of the enterprise edition roadmap. It will require time for both design and development. Currently, there is no temporary solution available. We will refine this later in a future release. Thank you for your patience!
yindo commented 2026-02-21 19:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Aug 27, 2025):

Hi, @benjamin-mogensen. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported that datasets created with "permission": "only_me" via the API are assigned to the workspace owner instead of the actual creator, causing visibility problems.
  • This happens because only the workspace owner can create API tokens, which are tied to the owner account; members cannot create tokens.
  • A permissions system redesign is planned for the enterprise edition to address this issue.
  • Currently, there is no temporary fix available.
  • I have acknowledged the problem and intend to refine it in a future release.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of Dify by commenting here to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Aug 27, 2025): Hi, @benjamin-mogensen. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported that datasets created with `"permission": "only_me"` via the API are assigned to the workspace owner instead of the actual creator, causing visibility problems. - This happens because only the workspace owner can create API tokens, which are tied to the owner account; members cannot create tokens. - A permissions system redesign is planned for the enterprise edition to address this issue. - Currently, there is no temporary fix available. - I have acknowledged the problem and intend to refine it in a future release. **Next Steps:** - Please let me know if this issue is still relevant with the latest version of Dify by commenting here to keep the discussion open. - Otherwise, this issue will be automatically closed in 15 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label stale 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#12249
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?