langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #32097] fix(api): register knowledge pipeline service API routes #33548

New Issue
Closed
opened 2026-02-21 20:53:29 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:53:29 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/32097

State: closed
Merged: Yes

Fixes #32099

Summary

  • Register Knowledge Pipeline (RAG pipeline) Service API routes under /v1 by importing the controller module.
  • Fix invalid route patterns to use Flask converter syntax (<uuid:dataset_id>, <string:node_id>).
  • Prevent cross-tenant dataset access (IDOR) by scoping dataset lookups to the authenticated token tenant.

Screenshots

Before After
N/A N/A

Verification

# 1) routes exist (not 404)
curl -i -H "Authorization: Bearer $DIFY_API_KEY" \
  "$DIFY_BASE_URL/v1/datasets/<dataset_id>/pipeline/datasource-plugins"

# 2) file-upload route exists
curl -i -X POST -H "Authorization: Bearer $DIFY_API_KEY" \
  "$DIFY_BASE_URL/v1/datasets/pipeline/file-upload"
# -> 400 {"code":"no_file_uploaded",...}

# 3) pipeline run route exists
curl -i -X POST -H "Authorization: Bearer $DIFY_API_KEY" -H "Content-Type: application/json" \
  -d "{}" \
  "$DIFY_BASE_URL/v1/datasets/<dataset_id>/pipeline/run"
# -> 400/422 (validation), not 404

Tests

  • make test TARGET_TESTS=api/tests/unit_tests/controllers/service_api/dataset/test_rag_pipeline_route_registration.py

Checklist

  • This change requires a documentation update, included: https://github.com/langgenius/dify-docs
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran make lint and make type-check (backend) and cd web && npx lint-staged (frontend) to appease the lint gods

Note: As an external contributor I can’t self-assign to issues; please assign if needed.

**Original Pull Request:** https://github.com/langgenius/dify/pull/32097 **State:** closed **Merged:** Yes --- Fixes #32099 ## Summary - Register Knowledge Pipeline (RAG pipeline) Service API routes under `/v1` by importing the controller module. - Fix invalid route patterns to use Flask converter syntax (`<uuid:dataset_id>`, `<string:node_id>`). - Prevent cross-tenant dataset access (IDOR) by scoping dataset lookups to the authenticated token tenant. ## Screenshots | Before | After | |--------|-------| | N/A | N/A | ## Verification ```bash # 1) routes exist (not 404) curl -i -H "Authorization: Bearer $DIFY_API_KEY" \ "$DIFY_BASE_URL/v1/datasets/<dataset_id>/pipeline/datasource-plugins" # 2) file-upload route exists curl -i -X POST -H "Authorization: Bearer $DIFY_API_KEY" \ "$DIFY_BASE_URL/v1/datasets/pipeline/file-upload" # -> 400 {"code":"no_file_uploaded",...} # 3) pipeline run route exists curl -i -X POST -H "Authorization: Bearer $DIFY_API_KEY" -H "Content-Type: application/json" \ -d "{}" \ "$DIFY_BASE_URL/v1/datasets/<dataset_id>/pipeline/run" # -> 400/422 (validation), not 404 ``` ## Tests - `make test TARGET_TESTS=api/tests/unit_tests/controllers/service_api/dataset/test_rag_pipeline_route_registration.py` ## Checklist - [ ] This change requires a documentation update, included: https://github.com/langgenius/dify-docs - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [ ] I've updated the documentation accordingly. - [ ] I ran `make lint` and `make type-check` (backend) and `cd web && npx lint-staged` (frontend) to appease the lint gods > Note: As an external contributor I can’t self-assign to issues; please assign if needed.
yindo added the pull-request label 2026-02-21 20:53:29 -05:00
yindo closed this issue 2026-02-21 20:53:29 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#33548
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?