GareArc 5b69467267 fix(api): enforce workspace membership + role checks in auth pipeline ...

Move workspace_id ownership validation from handler-level decorators into
the OpenAPI auth pipeline. guard_workspace() sets workspace_membership and
allowed_roles on RequestContext; pipeline steps load the tenant, verify
membership via TenantAccountJoin, check workspace_id mismatch, and gate
on role — all before the handler runs. Covers CE/EE/SaaS editions.

Migrates apps.py and workspaces.py endpoints; replaces the ad-hoc
require_workspace_role decorator with pipeline-native enforcement.

2026-06-01 23:06:00 -07:00

..

auth

fix(api): enforce workspace membership + role checks in auth pipeline

2026-06-01 23:06:00 -07:00

__init__.py

feat(openapi,cli): workspace switch + member management (#36651)

2026-05-27 03:05:47 +00:00

_audit.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

_input_schema.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

_meta.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

_models.py

feat(openapi,cli): workspace switch + member management (#36651)

2026-05-27 03:05:47 +00:00

account.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

app_run.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

apps_permitted_external.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

apps.py

fix(api): enforce workspace membership + role checks in auth pipeline

2026-06-01 23:06:00 -07:00

files.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

human_input_form.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

index.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

oauth_device_sso.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

oauth_device.py

feat: adding dify cli (#36348)

2026-05-26 01:12:36 +00:00

workflow_events.py

feat(openapi): redesign auth pipeline with per-token-type routing (#36693)

2026-05-27 12:45:30 +00:00

workspaces.py

fix(api): enforce workspace membership + role checks in auth pipeline

2026-06-01 23:06:00 -07:00