v1.5.1

[github-actions[bot]]

Every deployment should upgrade, and soon: a signed-in user who is not an admin
could chat as another user, the admin included, by sending a second spelling of the
user id (userId) that the proxy did not check. The release also makes the role
check refuse when it cannot decide instead of letting the call through, stops
agents named like a system agent from skipping it, ties file search stores and
budgets to the agent's own project, and deletes a project's integrations, budgets
and test cases with it.

Before upgrading:

• A request to /run or /run_sse whose body gives user_id and userId (or
  app_name and appName) with different values is refused. MATE's own clients
  send one spelling.
• With MATE_PLUGINS_ENABLED=true, an agent built in code needs an agents_config
  row, or the role check refuses it.

No migrations.

Fixed

• Deleting a project left its integrations, budgets and test cases behind - _delete_project removed the project's agents, stores, memory blocks, widget keys, triggers and alert rules, but not:

  • its Slack and other channel integrations, and integrations of other projects pointing at its agents, which stayed active for an agent that no longer existed;
  • the rate-limit configs of the project and its agents;
  • its agents' eval test cases and their results.

  A new agent with a deleted one's name inherited its budget and its test cases. They are deleted with the project now; deleting a single agent still leaves them (Plan for 1.5.1 and 1.6.0 #276)

• The Edit Memory Block dialog had controls that did nothing (Clean-up: leftover console.log and dead buttons in the memory block modal #243) - its minimize and restore buttons and its drag handle are gone, and so are six debug console.log calls in the agent form scripts. Thanks to @sourabh65mehta

Security

• A signed-in user could chat as someone else, the admin included - the proxy lets a user who is not an admin run an agent only as themselves, and checked the user_id in the body of /run and /run_sse. ADK also accepts userId and uses it when a body has both, so a body with the user's own user_id and "userId": "admin" passed the check and ran as the admin: past the agents' role checks, and into the admin's conversations, memory and profile. Both spellings are checked now, and a body where they differ is refused. The rate-limit middleware had the same blind spot with appName, which let a request be checked against one agent's budget while another agent ran; it now reads the same values ADK uses and refuses a body whose spellings disagree. See docs/dev/auth-and-access.md (Plan for 1.5.1 and 1.6.0 #276)
• The role check let a model call through when it couldn't decide - before each model call the RBAC callback compares the caller's roles with the agent's allowed_for_roles, but it allowed the call, with a warning, when there was no user id in the context, no agent name, or no enabled config for the agent, which also happens when the config lookup fails on a database error. It now refuses in all three cases, as it already did when the check raised, and so does the callback chain if the check itself fails to run; the LangGraph runtime's hook refuses an agent without a config the same way. Eval and Playground runs and the system agents still skip the check. With MATE_PLUGINS_ENABLED=true the check runs for every LLM agent in the app, so an agent built in code needs an agents_config row now. See docs/dev/auth-and-access.md (Plan for 1.5.1 and 1.6.0 #276)
• Agents named like a system agent skipped the role check - the RBAC callback skipped any agent named mate_fallback_agent, system_agent or health_check_agent, and the dashboard and the create_agent tool accept any name, so an agent given one of them answered everyone, whatever its allowed_for_roles. Only the fallback agent MATE builds itself when the configuration cannot load skips the check now, recognised by its class rather than by name; the other two names belonged to no agent (Plan for 1.5.1 and 1.6.0 #276)
• A chat request could pick the project its budget was checked against - the rate-limit middleware read project_id (or projectId) from the body of /run_sse and checked the request against that project's limits instead of the agent's, so a caller could name a project without a budget and escape the one on the agent's project. It now ignores the body's project and the rate limit service looks the project up from the agent, as the OpenAI-compatible API already did (Plan for 1.5.1 and 1.6.0 #276)
• A file search store could be assigned to an agent of another project - assign_store_to_agent, behind POST /dashboard/api/agents/{name}/file-search/stores/assign, checked that the agent and the store existed, not that they belonged to the same project, so an agent could be given another project's documents. It now refuses a store of another project. The dashboard already offered only the project's own stores; Clone to Project with file search still shares the source's stores on purpose (Plan for 1.5.1 and 1.6.0 #276)

---

This discussion was created from the release v1.5.1.