Editor cannot select models in Agent Editor when storage-engine-config returns 403

[xincew404-lang]

Editor cannot select models in Agent Editor when storage-engine-config returns 403

Environment

• WeKnora: v0.7.0 Standard
• Backend commit: e8dcbb0
• UI version: v0.7.0
• Deployment: Self-hosted
• Models are already configured and working correctly.

Problem

An Owner user can create/edit an Agent and select Chat / ReRank models normally.

However, an Editor user can open the Agent editor, but the model selectors are empty and no model can be selected.

After promoting the same Editor user to Admin, the models immediately become selectable.

This appears to be related to an Admin-only integration configuration request failing during Agent Editor initialization.

Reproduction Steps

1. Configure several models in the workspace, for example:

   • qwen3:8b
   • qwen3.5:27b
   • qwen3.6:latest
   • bge-reranker-v2-m3

2. Log in with an Owner account.

3. Open:

   Agents -> Create/Edit Agent -> Model Configuration

4. The Chat Model and ReRank Model dropdowns work normally.

5. Log out and log in with an Editor account.

6. Open the same Agent editor.

7. Open Model Configuration.

8. The model dropdown is empty and the Editor cannot select a model.

Important Network Comparison

Editor account

The models API succeeds:

GET /api/v1/models
200 OK

The response contains valid active models, for example:

{
  "id": "<model-id>",
  "tenant_id": 10000,
  "name": "qwen3:8b",
  "type": "KnowledgeQA",
  "source": "local",
  "status": "active"
}

The response also contains an active ReRank model:

{
  "name": "bge-reranker-v2-m3",
  "type": "Rerank",
  "status": "active"
}

Therefore, the Editor account can successfully read the model list.

However, another request made while initializing the Agent editor fails:

GET /api/v1/tenants/kv/storage-engine-config
403 Forbidden

Response:

{
  "error": {
    "code": 1002,
    "details": null,
    "message": "integration configuration requires admin access"
  },
  "success": false
}

After this error, the model dropdown remains empty even though /api/v1/models successfully returned the models.

Owner account

The same storage-engine-config request succeeds:

{
  "data": {
    "default_provider": "minio",
    "local": {
      "path_prefix": ""
    },
    "minio": {
      "mode": "remote"
    }
  },
  "success": true
}

The Agent model selectors also work normally.

A/B Test

We tested the exact same user account with different roles.

As Editor

/models
→ 200 OK
→ models returned successfully

/storage-engine-config
→ 403
→ "integration configuration requires admin access"

Agent model dropdown
→ empty

After promoting the same user to Admin

/models
→ 200 OK

/storage-engine-config
→ 200 OK

Agent model dropdown
→ models are displayed normally

No model configuration was changed during this test.

Only the user's permission level was changed from Editor to Admin.

Expected Behavior

If an Editor is allowed to edit/build an Agent, an Admin-only integration configuration request should not prevent unrelated resources such as the model list from being initialized.

For example:

/models succeeds
→ Chat/ReRank models should still be displayed

/storage-engine-config returns 403
→ Storage-related Admin-only functionality can be disabled or hidden
→ It should not make the model selector empty

Alternatively, if selecting a model is intentionally restricted to Admin users, the UI should explicitly state that Admin permission is required instead of showing an empty model dropdown.

Actual Behavior

An Admin-only request fails with:

integration configuration requires admin access

and the Agent Editor subsequently does not display models that were already successfully returned by /api/v1/models.

This makes the UI look as if no models are configured, even though the models API returned valid models.

Suspected Root Cause

Based on the v0.7.0 frontend initialization flow, Agent Editor dependencies appear to be loaded together.

A likely failure chain is:

Agent Editor initialization
        |
        +-- load models --------------------> success
        |
        +-- load KB/resources --------------> success
        |
        +-- load storage-engine-config -----> 403
                                               |
                                               v
                                 dependency initialization rejects
                                               |
                                               v
                         model data is not assigned/rendered
                                               |
                                               v
                                  model dropdown is empty

In particular, if these dependencies are initialized through Promise.all(), an expected 403 from an Admin-only storage configuration API may reject the whole initialization even though the models request has already succeeded.

This would also explain why:

• Owner works;
• Admin works;
• Editor does not work;
• /api/v1/models still returns valid models for Editor.

Suggested Fix

Admin-only integration configuration failures should be isolated from Agent model initialization.

Possible approaches:

1. Catch 403 / code 1002 from Admin-only configuration requests and treat them as unavailable optional capabilities.

2. Load model / KB / integration dependencies independently.

3. Use failure isolation such as Promise.allSettled() where appropriate.

4. Do not block model rendering when unrelated Admin-only integration configuration cannot be read.

Conceptually:

const models = await loadModels();

try {
  storageConfig = await loadStorageConfig();
} catch (error) {
  if (error.status === 403) {
    storageConfig = null;
  } else {
    throw error;
  }
}

// Models should still be available here.

Security Consideration

I do not think the appropriate fix is to grant Editor users access to sensitive storage configuration.

storage-engine-config contains configuration structures for MinIO, S3, COS, OSS, TOS, OBS, etc., so requiring Admin permission for this API appears reasonable.

The issue is that failure to access this Admin-only resource seems to unintentionally affect unrelated Agent model selection.

Summary

The issue can be reproduced consistently:

Owner
→ Agent model selection works

Editor
→ /models returns models successfully
→ storage-engine-config returns 403
→ Agent model selector is empty

Promote Editor to Admin
→ storage-engine-config succeeds
→ Agent model selection immediately works

Please confirm whether an Organization Editor is expected to be able to select existing workspace models while editing an Agent.

If yes, this appears to be a frontend initialization / permission-degradation issue in v0.7.0.