fix(ai): don't require admin ability to resolve org default model in Slack

[joaoviana]

Problem

Every Slack @mention of an AI agent that falls back to the org default model crashes with:

TypeError: Cannot read properties of undefined (reading 'can')
    at CaslAuditWrapper.can (caslAuditWrapper.ts:293)
    at AiOrganizationSettingsService.canManageAiAgent
    at AiOrganizationSettingsService.getSettings
    at AiAgentService.createSlackPrompt
    at AiAgentService.handleAppMention

createSlackPrompt resolves the default model by calling AiOrganizationSettingsService.getSettings, passing a user built from userModel.getUserDetailsByUuid — a LightdashUser, which has no CASL ability — cast as SessionUser. The as SessionUser cast hid the mismatch.

getSettings gained a permission check in #25194 (canManageAiAgent → createAuditedAbility(user)), which dereferences user.ability. On the ability-less Slack user that is undefined, so wrappedAbility.can(...) throws.

Fix

The Slack path only needs the non-secret model selection ({ modelName, modelProvider, reasoning }) — it does not need the admin-facing settings payload or its provider-key-hint masking. So this separates the two concerns:

• Use the org's configured model → new getDefaultModelConfig(organizationUuid), ungated (no ability, no manage permission). The Slack flow uses this.
• See / change the provider key → getSettings keeps its admin-gated maskProviderKeyExposure(…, canManage); upsertSettings keeps checkManageAiAgentAccess.

This also removes the as SessionUser lie — the internal flow no longer masquerades as an interactive user.

The model config carries no secret (the API key lives in providerApiKeys, resolved server-side), so exposing it ungated is safe: anyone can use the admin's key via the agent; only admins can see/change it.

Regression analysis

• Affected (crashing before this fix): Slack @mention where the agent uses the org default model — i.e. neither the request (data.modelConfig) nor the agent (agent.modelConfig) pins a model. Introduced by feat(backend): org-aware AI model options and provider key settings #25194 (merged the same day).
• Not affected: agents/requests with an explicit modelConfig (they skip the settings read entirely); the web-app prompt path and MCP path, which pass a real SessionUser with a populated ability.

Test plan

• pnpm -F backend typecheck:fast
• AiOrganizationSettingsService.test.ts passes (7/7)
• pnpm -F backend lint clean on changed files
• Manual: @mention an agent (no per-agent/per-request model) in Slack and confirm it responds instead of crashing

Notes

• Root cause is feat(backend): org-aware AI model options and provider key settings #25194, not the base PR of this stack (fix(ai): disable OpenAI parallel tool calls to stop dropped tool executions #25256).
• Stacked on fix(ai): disable OpenAI parallel tool calls to stop dropped tool executions #25256.

Relates: #25194

[joaoviana]

• fix(ai): don't require admin ability to resolve org default model in Slack #25265 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🧪 Test Selection

✅ Tests that will run

Test	Description
Preview Environment	Deploys a preview environment for testing
Backend API Tests	Runs Vitest API tests

⏭️ Tests skipped (no relevant file changes detected)

Test	How to trigger manually
Frontend E2E Tests	Add test-frontend to PR description
Timezone Tests	Add test-timezone to PR description
CLI Tests	Add test-cli to PR description

Tip: Add test-all to your PR description to run all tests.

[graphite-app]

The backend rules require that all service methods have permission checks. getDefaultModelConfig reads org-level settings (which may include sensitive model configuration) but performs no authorization check whatsoever — any caller with an organizationUuid can retrieve this data. Even if the returned value is non-secret, the method should at minimum verify the caller belongs to the organization (e.g. check organizationUuid matches the caller's org) to prevent cross-org data leakage (IDOR). Consider adding a lightweight membership/ownership check, or at minimum document and enforce that callers are already scoped to the correct org.

Suggested change

	async getDefaultModelConfig(
	organizationUuid: string,
	): Promise<AiAgentModelConfig | null> {
	const settings =
	await this.aiOrganizationSettingsModel.findByOrganizationUuid(
	organizationUuid,
	);
	return settings?.defaultAiAgentModelConfig ?? null;
	}
	async getDefaultModelConfig(
	user: SessionUser,
	organizationUuid: string,
	): Promise<AiAgentModelConfig | null> {
	if (user.organizationUuid !== organizationUuid) {
	throw new ForbiddenError(
	'You do not have permission to access this organization settings',
	);
	}
	const settings =
	await this.aiOrganizationSettingsModel.findByOrganizationUuid(
	organizationUuid,
	);
	return settings?.defaultAiAgentModelConfig ?? null;
	}

Spotted by Graphite (based on custom rule: packages/backend rules)



Is this helpful? React 👍 or 👎 to let us know.

[github-actions]

Your preview environment pr-25265 has been deployed.

[github-actions]

Preview Environment

🌐 URL: https://lightdash-preview-pr-25265.lightdash.okteto.dev

📋 Logs: View in GCP Console

🔧 SSH: ./scripts/okteto-ssh.sh 25265

[lightdash-bot]

🎉 This PR is included in version 0.3328.1 🎉

The release is available on:

• 0.3328.1
• GitHub release

Your semantic-release bot 📦🚀