mirror of
https://github.com/langgenius/dify.git
synced 2026-07-21 12:05:30 -04:00
GareArc
75cb8ea408
The app-scoped RBAC gate hand-rolled a query to turn an agent_id into the id of the App backing it, duplicating AgentRosterService.runtime_backing_app_id. Worse, it filtered on id and tenant only, so the auth check accepted archived Agents and sources the runtime resolver rejects -- a weaker notion of a valid Agent than the layer it guards. Add peek_runtime_backing_app_id, a read-only counterpart to get_agent_runtime_app_model that never materializes the hidden backing App, and share the eligibility filter between the two so they cannot drift. The tenant filter was also untested: deleting it left all 50 tests passing, since the specs stubbed the db module wholesale. Assert the resolver is called with the caller's tenant instead, and cover the precedence and read-only guarantees against the service directly.