GareArc 990e8feee8 security: fix IDOR and privilege escalation in set_default_provider ...

- Add tenant_id verification to prevent IDOR attacks
- Add admin check for enterprise tenant-wide default changes
- Preserve non-enterprise behavior (users can set own defaults)

2026-02-06 13:32:18 +08:00

..

auth

fix: fix firecrawl url concat (#30008)

2025-12-24 09:40:32 +08:00

document_indexing_proxy

feat: enable tenant isolation on duplicate document indexing tasks (#29080)

2025-12-08 17:54:57 +08:00

enterprise

feat: add redis mq for account deletion cleanup

2026-02-06 13:31:50 +08:00

entities

feat: Add summary index for knowledge. (#31625)

2026-01-29 13:47:35 +08:00

errors

fix: consolidate duplicate InvokeRateLimitError definitions (#30229)

2025-12-28 03:03:42 +09:00

plugin

feat: Add option to delete or keep API keys when uninstalling plugin (#28201)

2026-01-14 10:09:30 +08:00

rag_pipeline

fix: summary index bug (#31810)

2026-02-02 09:45:17 +08:00

recommend_app

change all to httpx (#26119)

2025-10-10 23:41:16 +08:00

retention

feat: archive workflow run logs backend (#31310)

2026-01-23 13:11:56 +08:00

tools

security: fix IDOR and privilege escalation in set_default_provider

2026-02-06 13:32:18 +08:00

trigger

refactor: split changes for api/controllers/console/workspace/trigger… (#30627)

2026-01-07 21:18:02 +08:00

workflow

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

__init__.py

chore(api/services): apply ruff reformatting (#7599)

2024-08-26 13:43:57 +08:00

account_service.py

feat: add redis mq for account deletion cleanup

2026-02-06 13:31:50 +08:00

advanced_prompt_template_service.py

chore: adopt StrEnum and auto() for some string-typed enums (#25129)

2025-09-12 21:14:26 +08:00

agent_service.py

use deco to avoid current_user (#26077)

2025-10-16 15:45:51 +09:00

annotation_service.py

refactor: port api/controllers/console/app/annotation.py api/controllers/console/explore/trial.py api/controllers/console/workspace/account.py api/controllers/console/workspace/members.py api/controllers/service_api/app/annotation.py to basemodel (#31833)

2026-02-03 09:59:00 +08:00

api_based_extension_service.py

remove bare list, dict, Sequence, None, Any (#25058)

2025-09-06 03:32:23 +08:00

app_dsl_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

app_generate_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

app_model_config_service.py

remove bare list, dict, Sequence, None, Any (#25058)

2025-09-06 03:32:23 +08:00

app_service.py

refactor: port AppModelConfig (#30919)

2026-01-24 10:25:51 +08:00

app_task_service.py

fix: ensure advanced-chat workflows stop correctly (#27803)

2025-11-25 20:09:03 +08:00

async_workflow_service.py

fix: consolidate duplicate InvokeRateLimitError definitions (#30229)

2025-12-28 03:03:42 +09:00

attachment_service.py

Feat/support multimodal embedding (#29115)

2025-12-09 14:41:46 +08:00

audio_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

billing_service.py

fix: billing account deletion (#31556)

2026-01-27 11:18:23 +08:00

clear_free_plan_tenant_expired_logs.py

refactor: replace hardcoded user plan strings with CloudPlan enum (#27675)

2025-11-03 11:51:09 +08:00

code_based_extension_service.py

remove bare list, dict, Sequence, None, Any (#25058)

2025-09-06 03:32:23 +08:00

conversation_service.py

refactor(api): inject sessionmaker into conversation variable updater (#30609)

2026-01-06 14:52:59 +08:00

conversation_variable_updater.py

refactor(variables): clarify base vs union type naming (#30634)

2026-01-13 23:39:34 +09:00

credit_pool_service.py

feat: credit pool (#30720)

2026-01-08 13:17:30 +08:00

dataset_service.py

refactor: port api/controllers/console/datasets/data_source.py /datasets/metadata.py /service_api/dataset/metadata.py /nodes/agent/agent_node.py api/core/workflow/nodes/datasource/datasource_node.py api/services/dataset_service.py to match case (#31836)

2026-02-02 21:03:16 +09:00

datasource_provider_service.py

chore: update the error message (#29325)

2025-12-09 15:29:04 +08:00

end_user_service.py

fix: allow API to access conversations created before upgrade to 1.10.0 (#28462)

2025-11-21 10:34:55 +08:00

external_knowledge_service.py

fix(api): refactors the SQL LIKE pattern escaping logic to use a centralized utility function, ensuring consistent and secure handling of special characters across all database queries. (#30450)

2026-01-06 09:56:30 +08:00

feature_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

feedback_service.py

test: add comprehensive unit tests for FeedbackService (#28771)

2025-11-28 11:33:56 +08:00

file_service.py

feat: Download the uploaded files (#31068)

2026-01-19 16:48:13 +08:00

hit_testing_service.py

fix: hit-test failed when attachment id is not exist (#29563)

2025-12-12 13:45:00 +08:00

knowledge_service.py

rm type ignore (#25715)

2025-10-21 11:26:58 +08:00

message_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

metadata_service.py

feat: Implement partial update for document metadata, allowing merging of new values with existing ones. (#28390)

2025-11-21 12:58:20 +08:00

model_load_balancing_service.py

chore: add ast-grep rule to convert Optional[T] to T | None (#25560)

2025-09-15 13:06:33 +08:00

model_provider_service.py

chore: remove icon_large of models (#30466)

2026-01-03 02:35:17 +09:00

oauth_server.py

use deco to avoid current_user (#26077)

2025-10-16 15:45:51 +09:00

operation_service.py

more httpx (#25651)

2025-09-22 23:07:09 +08:00

ops_service.py

feat: MLflow tracing (#26093)

2025-11-22 13:53:58 +08:00

recommended_app_service.py

feat: app trial (#26281)

2026-01-22 15:42:54 +08:00

saved_message_service.py

use deco to avoid current_user (#26077)

2025-10-16 15:45:51 +09:00

summary_index_service.py

fix: summary index bug (#31810)

2026-02-02 09:45:17 +08:00

tag_service.py

fix: "refactor: port api/controllers/console/tag/tags.py to ov3" (#31887)

2026-02-03 22:18:53 +08:00

variable_truncator.py

chore: use from __future__ import annotations (#30254)

2026-01-06 23:57:20 +09:00

vector_service.py

Feat/support multimodal embedding (#29115)

2025-12-09 14:41:46 +08:00

web_conversation_service.py

use deco to avoid current_user (#26077)

2025-10-16 15:45:51 +09:00

webapp_auth_service.py

chore: case insensitive email (#29978)

2026-01-13 15:42:44 +08:00

website_service.py

chore: use from __future__ import annotations (#30254)

2026-01-06 23:57:20 +09:00

workflow_app_service.py

feat: archive workflow run logs backend (#31310)

2026-01-23 13:11:56 +08:00

workflow_draft_variable_service.py

refactor(variables): clarify base vs union type naming (#30634)

2026-01-13 23:39:34 +09:00

workflow_run_service.py

feat(api): Introduce workflow pause state management (#27298)

2025-10-30 14:41:09 +08:00

workflow_service.py

revert: revert human input relevant code (#31766)

2026-01-30 19:18:49 +08:00

workspace_service.py

feat: credit pool (#30720)

2026-01-08 13:17:30 +08:00