fix: external dataset tenant checks for bound knowledge APIs by laipz8200 · Pull Request #34734 · langgenius/dify

laipz8200 · 2026-04-08T09:40:09Z

Fixes #

Summary

This PR closes the cross-tenant authorization gap for external dataset knowledge bindings.

validate external_knowledge_api_id against the dataset tenant before updating external dataset bindings
scope external knowledge API lookups by tenant_id in retrieval and dataset detail paths so mismatched bindings fail closed
add regression tests for cross-tenant update rejection, retrieval rejection, and hidden external_knowledge_info

Screenshots

Before	After
N/A (backend-only change)	N/A

Checklist

This change requires a documentation update, included: Dify Document
I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
I've updated the documentation accordingly.
I ran make lint and make type-check (backend) and cd web && npx lint-staged (frontend) to appease the lint gods

github-actions · 2026-04-08T09:41:35Z

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-04-08 09:41:19.951498911 +0000
+++ /tmp/pyrefly_pr.txt	2026-04-08 09:41:11.774582491 +0000
@@ -322,11 +322,11 @@
 ERROR Argument `str | None` is not assignable to parameter `value` with type `SQLCoreOperations[str] | str` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
    --> services/conversation_service.py:131:33
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2117:56
+    --> services/dataset_service.py:2118:56
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2630:44
+    --> services/dataset_service.py:2631:44
 ERROR `None` is not assignable to attribute `rules` with type `Never` [bad-assignment]
-    --> services/dataset_service.py:2805:51
+    --> services/dataset_service.py:2806:51
 ERROR Class member `DocumentIndexingTaskProxy.NORMAL_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
   --> services/document_indexing_proxy/document_indexing_task_proxy.py:11:5
 ERROR Class member `DocumentIndexingTaskProxy.PRIORITY_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
@@ -6174,13 +6174,13 @@
 ERROR `None` is not subscriptable [unsupported-operation]
     --> tests/unit_tests/models/test_app_models.py:1459:20
 ERROR `None` is not subscriptable [unsupported-operation]
-   --> tests/unit_tests/models/test_dataset_models.py:147:16
-ERROR `None` is not subscriptable [unsupported-operation]
    --> tests/unit_tests/models/test_dataset_models.py:148:16
+ERROR `None` is not subscriptable [unsupported-operation]
+   --> tests/unit_tests/models/test_dataset_models.py:149:16
 ERROR `in` is not supported between `Literal['pre_processing_rules']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:823:16
+   --> tests/unit_tests/models/test_dataset_models.py:842:16
 ERROR `in` is not supported between `Literal['segmentation']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:824:16
+   --> tests/unit_tests/models/test_dataset_models.py:843:16
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
    --> tests/unit_tests/models/test_provider_models.py:296:24
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
@@ -6409,37 +6409,37 @@
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_dataset.py:377:25
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:665:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:694:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:675:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:704:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:714:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:743:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:737:74
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:766:74
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:804:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:833:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:842:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:871:9
 ERROR Argument `None` is not assignable to parameter `embedding_model_provider` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:908:38
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:937:38
 ERROR Argument `None` is not assignable to parameter `embedding_model` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:909:29
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:938:29
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:967:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:996:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1002:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1031:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1410:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1413:81
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1442:81
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1426:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1455:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:71
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1468:71
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1498:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1527:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1520:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1549:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_document.py:340:34
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]

github-actions · 2026-04-08T09:56:41Z

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-04-08 09:56:27.552598041 +0000
+++ /tmp/pyrefly_pr.txt	2026-04-08 09:56:19.356504944 +0000
@@ -322,11 +322,11 @@
 ERROR Argument `str | None` is not assignable to parameter `value` with type `SQLCoreOperations[str] | str` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
    --> services/conversation_service.py:131:33
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2117:56
+    --> services/dataset_service.py:2118:56
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2630:44
+    --> services/dataset_service.py:2631:44
 ERROR `None` is not assignable to attribute `rules` with type `Never` [bad-assignment]
-    --> services/dataset_service.py:2805:51
+    --> services/dataset_service.py:2806:51
 ERROR Class member `DocumentIndexingTaskProxy.NORMAL_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
   --> services/document_indexing_proxy/document_indexing_task_proxy.py:11:5
 ERROR Class member `DocumentIndexingTaskProxy.PRIORITY_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
@@ -1004,9 +1004,9 @@
 ERROR Argument `Literal['knowledge']` is not assignable to parameter `type` with type `SQLCoreOperations[TagType] | TagType` in function `models.model.Tag.__init__` [bad-argument-type]
    --> tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py:179:18
 ERROR Argument `Literal['active']` is not assignable to parameter `status` with type `AccountStatus | SQLCoreOperations[AccountStatus]` in function `models.account.Account.__init__` [bad-argument-type]
-  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:28:20
+  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:29:20
 ERROR Argument `Literal['normal']` is not assignable to parameter `status` with type `SQLCoreOperations[TenantStatus] | TenantStatus` in function `models.account.Tenant.__init__` [bad-argument-type]
-  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:33:61
+  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:34:61
 ERROR Argument `Literal['owner']` is not assignable to parameter `role` with type `SQLCoreOperations[TenantAccountRole] | TenantAccountRole` in function `models.account.TenantAccountJoin.__init__` [bad-argument-type]
   --> tests/test_containers_integration_tests/services/test_end_user_service.py:37:18
 ERROR Argument `Literal['active']` is not assignable to parameter `status` with type `AccountStatus | SQLCoreOperations[AccountStatus]` in function `models.account.Account.__init__` [bad-argument-type]
@@ -6174,13 +6174,13 @@
 ERROR `None` is not subscriptable [unsupported-operation]
     --> tests/unit_tests/models/test_app_models.py:1459:20
 ERROR `None` is not subscriptable [unsupported-operation]
-   --> tests/unit_tests/models/test_dataset_models.py:147:16
-ERROR `None` is not subscriptable [unsupported-operation]
    --> tests/unit_tests/models/test_dataset_models.py:148:16
+ERROR `None` is not subscriptable [unsupported-operation]
+   --> tests/unit_tests/models/test_dataset_models.py:149:16
 ERROR `in` is not supported between `Literal['pre_processing_rules']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:823:16
+   --> tests/unit_tests/models/test_dataset_models.py:842:16
 ERROR `in` is not supported between `Literal['segmentation']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:824:16
+   --> tests/unit_tests/models/test_dataset_models.py:843:16
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
    --> tests/unit_tests/models/test_provider_models.py:296:24
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
@@ -6409,37 +6409,37 @@
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_dataset.py:377:25
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:665:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:694:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:675:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:704:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:714:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:743:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:737:74
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:766:74
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:804:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:833:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:842:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:871:9
 ERROR Argument `None` is not assignable to parameter `embedding_model_provider` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:908:38
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:937:38
 ERROR Argument `None` is not assignable to parameter `embedding_model` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:909:29
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:938:29
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:967:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:996:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1002:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1031:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1410:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1413:81
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1442:81
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1426:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1455:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:71
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1468:71
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1498:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1527:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1520:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1549:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_document.py:340:34
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]

codecov · 2026-04-08T10:05:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.91%. Comparing base (6612ba6) to head (f4b202c).
⚠️ Report is 48 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #34734   +/-   ##
=======================================
  Coverage   83.90%   83.91%           
=======================================
  Files        4190     4190           
  Lines      177214   177218    +4     
  Branches    35454    35454           
=======================================
+ Hits       148699   148708    +9     
+ Misses      25622    25615    -7     
- Partials     2893     2895    +2

Flag	Coverage Δ
api	`82.36% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

QuantumGhost

Is it better to add some integration tests for the relevant changes?

Other changes LGTM.

github-actions · 2026-04-10T11:20:36Z

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	38.95%	38.95%	+0.00%
Strict coverage	35.82%	35.82%	+0.00%
Typed symbols	18,688	18,694	+6
Untyped symbols	31,857	31,862	+5
Modules	2611	2611	0

github-actions · 2026-04-10T11:20:52Z

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-04-10 11:20:36.834275427 +0000
+++ /tmp/pyrefly_pr.txt	2026-04-10 11:20:27.178162333 +0000
@@ -324,11 +324,11 @@
 ERROR Argument `str | None` is not assignable to parameter `value` with type `SQLCoreOperations[str] | str` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
    --> services/conversation_service.py:131:33
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2117:56
+    --> services/dataset_service.py:2119:56
 ERROR `dict[str, bool | dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2630:44
+    --> services/dataset_service.py:2632:44
 ERROR `None` is not assignable to attribute `rules` with type `Never` [bad-assignment]
-    --> services/dataset_service.py:2805:51
+    --> services/dataset_service.py:2807:51
 ERROR Class member `DocumentIndexingTaskProxy.NORMAL_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
   --> services/document_indexing_proxy/document_indexing_task_proxy.py:11:5
 ERROR Class member `DocumentIndexingTaskProxy.PRIORITY_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
@@ -996,9 +996,9 @@
 ERROR Argument `Literal['knowledge']` is not assignable to parameter `type` with type `SQLCoreOperations[TagType] | TagType` in function `models.model.Tag.__init__` [bad-argument-type]
    --> tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py:179:18
 ERROR Argument `Literal['active']` is not assignable to parameter `status` with type `AccountStatus | SQLCoreOperations[AccountStatus]` in function `models.account.Account.__init__` [bad-argument-type]
-  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:28:20
+  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:29:20
 ERROR Argument `Literal['normal']` is not assignable to parameter `status` with type `SQLCoreOperations[TenantStatus] | TenantStatus` in function `models.account.Tenant.__init__` [bad-argument-type]
-  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:33:61
+  --> tests/test_containers_integration_tests/services/test_dataset_service_update_dataset.py:34:61
 ERROR Argument `Literal['owner']` is not assignable to parameter `role` with type `SQLCoreOperations[TenantAccountRole] | TenantAccountRole` in function `models.account.TenantAccountJoin.__init__` [bad-argument-type]
   --> tests/test_containers_integration_tests/services/test_end_user_service.py:37:18
 ERROR Argument `Literal['active']` is not assignable to parameter `status` with type `AccountStatus | SQLCoreOperations[AccountStatus]` in function `models.account.Account.__init__` [bad-argument-type]
@@ -6182,13 +6182,13 @@
 ERROR `None` is not subscriptable [unsupported-operation]
     --> tests/unit_tests/models/test_app_models.py:1459:20
 ERROR `None` is not subscriptable [unsupported-operation]
-   --> tests/unit_tests/models/test_dataset_models.py:147:16
-ERROR `None` is not subscriptable [unsupported-operation]
    --> tests/unit_tests/models/test_dataset_models.py:148:16
+ERROR `None` is not subscriptable [unsupported-operation]
+   --> tests/unit_tests/models/test_dataset_models.py:149:16
 ERROR `in` is not supported between `Literal['pre_processing_rules']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:823:16
+   --> tests/unit_tests/models/test_dataset_models.py:842:16
 ERROR `in` is not supported between `Literal['segmentation']` and `None` [not-iterable]
-   --> tests/unit_tests/models/test_dataset_models.py:824:16
+   --> tests/unit_tests/models/test_dataset_models.py:843:16
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
    --> tests/unit_tests/models/test_provider_models.py:296:24
 ERROR Argument `Literal['llm']` is not assignable to parameter `model_type` with type `ModelType | SQLCoreOperations[ModelType]` in function `models.provider.ProviderModel.__init__` [bad-argument-type]
@@ -6417,37 +6417,37 @@
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_dataset.py:377:25
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:665:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:694:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:675:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:704:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:714:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:743:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:737:74
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:766:74
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:804:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:833:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:842:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:871:9
 ERROR Argument `None` is not assignable to parameter `embedding_model_provider` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:908:38
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:937:38
 ERROR Argument `None` is not assignable to parameter `embedding_model` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:909:29
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:938:29
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:967:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:996:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1002:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1031:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1410:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1413:81
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1442:81
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1426:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1455:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1439:71
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1468:71
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1498:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1527:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1520:9
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1549:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_document.py:340:34
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `services.dataset_service.DocumentService.prepare_document_batch_download_zip` [bad-argument-type]

…ius#34734)

laipz8200 changed the title ~~Fix external dataset tenant checks for bound knowledge APIs 🤖🤖🤖~~ Fix external dataset tenant checks for bound knowledge APIs Apr 8, 2026

laipz8200 changed the title ~~Fix external dataset tenant checks for bound knowledge APIs~~ fix: external dataset tenant checks for bound knowledge APIs Apr 8, 2026

laipz8200 marked this pull request as ready for review April 8, 2026 10:16

laipz8200 requested review from JohnJyong and QuantumGhost as code owners April 8, 2026 10:16

dosubot Bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Apr 8, 2026

QuantumGhost reviewed Apr 9, 2026

View reviewed changes

Comment thread api/services/dataset_service.py

QuantumGhost reviewed Apr 9, 2026

View reviewed changes

laipz8200 added 3 commits April 10, 2026 19:16

Enforce tenant checks for external knowledge bindings

9880296

test: fix external dataset update integration fixtures

3493ca1

docs: clarify external dataset tenant guard

f4b202c

laipz8200 force-pushed the verify-dataset-auth-bypass branch from 17127b1 to f4b202c Compare April 10, 2026 11:19

QuantumGhost approved these changes Apr 13, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Apr 13, 2026

QuantumGhost added this pull request to the merge queue Apr 13, 2026

Merged via the queue into main with commit 8c4ea5c Apr 13, 2026
33 checks passed

QuantumGhost deleted the verify-dataset-auth-bypass branch April 13, 2026 01:57

HanqingZ pushed a commit to HanqingZ/dify that referenced this pull request Apr 23, 2026

fix: external dataset tenant checks for bound knowledge APIs (langgen…

1c32111

…ius#34734)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: external dataset tenant checks for bound knowledge APIs #34734

fix: external dataset tenant checks for bound knowledge APIs #34734
QuantumGhost merged 3 commits intomainfrom
verify-dataset-auth-bypass

laipz8200 commented Apr 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 8, 2026

Uh oh!

github-actions Bot commented Apr 8, 2026

Uh oh!

codecov Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

QuantumGhost left a comment

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

github-actions Bot commented Apr 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

laipz8200 commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Checklist

Uh oh!

github-actions Bot commented Apr 8, 2026

Pyrefly Diff

Uh oh!

github-actions Bot commented Apr 8, 2026

Pyrefly Diff

Uh oh!

codecov Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

QuantumGhost left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 10, 2026

Pyrefly Type Coverage

Uh oh!

github-actions Bot commented Apr 10, 2026

Pyrefly Diff

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

laipz8200 commented Apr 8, 2026 •

edited

Loading

codecov Bot commented Apr 8, 2026 •

edited

Loading