feat: RBAC

[WTW0313]

Important

1. Make sure you have read our contribution guidelines
2. Ensure there is an associated issue and you have been assigned to it
3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

Screenshots

Before	After
...	...

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

[github-actions]

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-06-05 11:39:14.353795348 +0000
+++ /tmp/pyrefly_pr.txt	2026-06-05 11:38:59.813584504 +0000
@@ -1,5 +1,11 @@
 ERROR `str` is not assignable to `Literal['advanced-chat', 'agent', 'agent-chat', 'all', 'channel', 'chat', 'completion', 'workflow']` [bad-assignment]
-  --> controllers/console/app/app.py:73:113
+  --> controllers/console/app/app.py:75:113
+ERROR Object of class `App` has no attribute `permission_keys` [missing-attribute]
+   --> controllers/console/app/app.py:634:9
+ERROR Object of class `App` has no attribute `permission_keys` [missing-attribute]
+   --> controllers/console/app/app.py:667:9
+ERROR Object of class `App` has no attribute `permission_keys` [missing-attribute]
+   --> controllers/console/app/app.py:788:13
 ERROR Argument `str | None` is not assignable to parameter `language` with type `str` in function `services.account_service.AccountService.send_email_register_email` [bad-argument-type]
   --> controllers/console/auth/email_register.py:86:108
 ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
@@ -14,6 +20,14 @@
   --> controllers/console/setup.py:65:2
 ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
   --> controllers/console/version.py:30:2
+ERROR Argument `list[RBACRole] | Unknown` is not assignable to parameter `member_roles` with type `list[MemberRoleSummary]` in function `_serialize_member_roles` [bad-argument-type]
+   --> controllers/console/workspace/members.py:183:68
+ERROR Argument `str` is not assignable to parameter `role` with type `TenantAccountRole | None` in function `models.account.TenantAccountRole.is_non_owner_role` [bad-argument-type]
+   --> controllers/console/workspace/members.py:210:109
+ERROR Returned type `dict[Any, dict[str, Any] | str]` is not assignable to declared return type `dict[str, dict[str, str]]` [bad-return]
+  --> controllers/console/workspace/rbac.py:85:12
+ERROR Argument `TokenType | None` is not assignable to parameter `key` with type `TokenType` in function `dict.get` [bad-argument-type]
+   --> controllers/openapi/auth/pipeline.py:220:34
 ERROR Class member `EasyUIBasedGenerateTaskPipeline._application_generate_entity` overrides parent class `BasedGenerateTaskPipeline` in an inconsistent manner [bad-override-mutable-attribute]
   --> core/app/task_pipeline/easy_ui_based_generate_task_pipeline.py:75:5
 ERROR `+=` is not supported between `list[PromptMessageContentUnionTypes]` and `str` [unsupported-operation]
@@ -555,7 +569,9 @@
 ERROR No matching overload found for function `redis.client.Redis.__init__` called with arguments: (host=int | str | Unknown, port=int | str | Unknown, password=int | str | Unknown | None, db=int, ssl=bool, ssl_ca_certs=str | None, ssl_cert_reqs=Any | None, ssl_certfile=Any | None, ssl_keyfile=Any | None, socket_timeout=Literal[5], socket_connect_timeout=Literal[5], health_check_interval=Literal[30]) [no-matching-overload]
   --> schedule/queue_monitor_task.py:14:21
 ERROR Object of class `Tenant` has no attribute `role` [missing-attribute]
-    --> services/account_service.py:1417:13
+    --> services/account_service.py:1491:13
+ERROR Object of class `NoneType` has no attribute `account_id` [missing-attribute]
+    --> services/account_service.py:1760:43
 ERROR `+` is not supported between `str` and `dict[Unknown, Unknown]` [unsupported-operation]
    --> services/app_service.py:558:53
 ERROR No matching overload found for function `flask.helpers.stream_with_context` called with arguments: (Generator[bytes]) [no-matching-overload]
@@ -565,11 +581,11 @@
 ERROR Argument `str | None` is not assignable to parameter `value` with type `SQLCoreOperations[str] | str` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
    --> services/conversation_service.py:131:33
 ERROR `dict[str, dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2237:56
+    --> services/dataset_service.py:2253:56
 ERROR `dict[str, dict[str, Any] | str | None]` is not assignable to variable `data_source_info` with type `dict[str, bool | str]` [bad-assignment]
-    --> services/dataset_service.py:2750:44
+    --> services/dataset_service.py:2766:44
 ERROR `None` is not assignable to attribute `rules` with type `Never` [bad-assignment]
-    --> services/dataset_service.py:2925:51
+    --> services/dataset_service.py:2941:51
 ERROR Class member `DocumentIndexingTaskProxy.NORMAL_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
   --> services/document_indexing_proxy/document_indexing_task_proxy.py:11:5
 ERROR Class member `DocumentIndexingTaskProxy.PRIORITY_TASK_FUNC` overrides parent class `BatchDocumentIndexingProxy` in an inconsistent manner [bad-override]
@@ -2016,6 +2032,16 @@
    --> tests/unit_tests/controllers/console/app/test_annotation_security.py:238:78
 ERROR Object of class `int` has no attribute `lower` [missing-attribute]
    --> tests/unit_tests/controllers/console/app/test_annotation_security.py:256:35
+ERROR No attribute `dify_config` in module `controllers.console.app.app_import` [missing-attribute]
+   --> tests/unit_tests/controllers/console/app/test_app_import_api.py:136:29
+ERROR No attribute `dify_config` in module `controllers.console.app.app_import` [missing-attribute]
+   --> tests/unit_tests/controllers/console/app/test_app_import_api.py:167:29
+ERROR No attribute `dify_config` in module `controllers.console.app.app_import` [missing-attribute]
+   --> tests/unit_tests/controllers/console/app/test_app_import_api.py:235:29
+ERROR No attribute `dify_config` in module `controllers.console.app.app_import` [missing-attribute]
+   --> tests/unit_tests/controllers/console/app/test_app_import_api.py:273:29
+ERROR Could not find name `serialized` [unknown-name]
+   --> tests/unit_tests/controllers/console/app/test_app_response_models.py:491:12
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.conversation._get_conversation` [bad-argument-type]
   --> tests/unit_tests/controllers/console/app/test_conversation_api.py:97:52
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.conversation._get_conversation` [bad-argument-type]
@@ -2036,6 +2062,8 @@
    --> tests/unit_tests/controllers/console/app/test_wraps.py:148:26
 ERROR Cannot set item in `OrderedDict[str, bool | list[str] | str]` [unsupported-operation]
    --> tests/unit_tests/controllers/console/app/workflow_draft_variables_test.py:137:47
+ERROR Object of class `Dataset` has no attribute `permission_keys` [missing-attribute]
+   --> tests/unit_tests/controllers/console/datasets/test_datasets.py:590:16
 ERROR Object of class `BytesIO` has no attribute `filename` [missing-attribute]
    --> tests/unit_tests/controllers/console/explore/test_trial.py:651:9
 ERROR Object of class `BytesIO` has no attribute `filename` [missing-attribute]
@@ -2097,7 +2125,13 @@
 ERROR Object of class `Flask` has no attribute `login_manager` [missing-attribute]
   --> tests/unit_tests/controllers/console/test_workspace_members.py:16:5
 ERROR `SimpleNamespace` is not assignable to attribute `_current_tenant` with type `Tenant | None` [bad-assignment]
-  --> tests/unit_tests/controllers/console/test_workspace_members.py:63:43
+  --> tests/unit_tests/controllers/console/test_workspace_members.py:64:43
+ERROR `SimpleNamespace` is not assignable to attribute `_current_tenant` with type `Tenant | None` [bad-assignment]
+   --> tests/unit_tests/controllers/console/test_workspace_members.py:112:43
+ERROR `SimpleNamespace` is not assignable to attribute `_current_tenant` with type `Tenant | None` [bad-assignment]
+   --> tests/unit_tests/controllers/console/test_workspace_members.py:150:43
+ERROR `SimpleNamespace` is not assignable to attribute `_current_tenant` with type `Tenant | None` [bad-assignment]
+   --> tests/unit_tests/controllers/console/test_workspace_members.py:186:43
 ERROR `in` is not supported between `Literal['count']` and `None` [not-iterable]
    --> tests/unit_tests/controllers/console/test_wraps.py:213:16
 ERROR `SimpleNamespace` is not assignable to attribute `db` with type `SQLAlchemy` [bad-assignment]
@@ -2168,6 +2202,50 @@
    --> tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py:372:35
 ERROR Missing argument `payload` in function `protected_view` [missing-argument]
    --> tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py:378:36
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+ --> tests/unit_tests/controllers/openapi/auth/test_context.py:5:34
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_context.py:19:34
+ERROR `frozenset[str]` is not assignable to attribute `scopes` with type `frozenset[Scope]` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_context.py:20:18
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_app_resolver.py:13:35
+ERROR Object of class `NoneType` has no attribute `id` [missing-attribute]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_app_resolver.py:63:12
+ERROR Object of class `NoneType` has no attribute `id` [missing-attribute]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_app_resolver.py:64:12
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:14:32
+ERROR `str | Unknown` is not assignable to attribute `account_id` with type `UUID | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:17:20
+ERROR `SimpleNamespace` is not assignable to attribute `app` with type `App | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:18:13
+ERROR `SimpleNamespace` is not assignable to attribute `tenant` with type `Tenant | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:19:16
+ERROR Argument `() -> SimpleNamespace` is not assignable to parameter `resolve_strategy` with type `() -> AppAuthzStrategy` in function `controllers.openapi.auth.steps.AppAuthzCheck.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:70:23
+ERROR Argument `() -> SimpleNamespace` is not assignable to parameter `resolve_strategy` with type `() -> AppAuthzStrategy` in function `controllers.openapi.auth.steps.AppAuthzCheck.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_authz.py:76:19
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_bearer.py:22:35
+ERROR Argument `Literal['apps:read']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_layer0.py:18:32
+ERROR `SimpleNamespace | None` is not assignable to attribute `tenant` with type `Tenant | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_layer0.py:21:16
+ERROR Argument `Literal['apps:run']` is not assignable to parameter `required_scope` with type `Scope` in function `controllers.openapi.auth.context.Context.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_mount.py:15:32
+ERROR `SimpleNamespace` is not assignable to attribute `app` with type `App | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_mount.py:19:13
+ERROR `SimpleNamespace` is not assignable to attribute `tenant` with type `Tenant | None` [bad-assignment]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_mount.py:20:16
+ERROR Argument `test_caller_mount_dispatches_by_subject_type.Fake` is not assignable to parameter `*mounters` with type `CallerMounter` in function `controllers.openapi.auth.steps.CallerMount.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_mount.py:68:9
+ERROR Argument `test_caller_mount_dispatches_by_subject_type.Fake` is not assignable to parameter `*mounters` with type `CallerMounter` in function `controllers.openapi.auth.steps.CallerMount.__init__` [bad-argument-type]
+  --> tests/unit_tests/controllers/openapi/auth/test_step_mount.py:69:9
+ERROR `in` is not supported between `Literal['wrong_surface']` and `None` [not-iterable]
+  --> tests/unit_tests/controllers/openapi/auth/test_surface_gate.py:93:20
+ERROR `in` is not supported between `Literal['/openapi/v1/apps']` and `None` [not-iterable]
+  --> tests/unit_tests/controllers/openapi/auth/test_surface_gate.py:96:20
 ERROR Object of class `FunctionType` has no attribute `view_class` [missing-attribute]
   --> tests/unit_tests/controllers/openapi/test_account.py:40:12
 ERROR Object of class `FunctionType` has no attribute `view_class` [missing-attribute]
@@ -6189,11 +6267,11 @@
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account | None` in function `libs.helper.TokenManager.generate_token` [bad-argument-type]
   --> tests/unit_tests/libs/test_token_manager.py:76:17
 ERROR TypedDict `TenantCustomConfigDict` does not have key `feature1` [bad-typed-dict-key]
-   --> tests/unit_tests/models/test_account_models.py:551:23
+   --> tests/unit_tests/models/test_account_models.py:594:23
 ERROR TypedDict `TenantCustomConfigDict` does not have key `feature2` [bad-typed-dict-key]
-   --> tests/unit_tests/models/test_account_models.py:552:23
+   --> tests/unit_tests/models/test_account_models.py:595:23
 ERROR Argument `dict[str, bool | str]` is not assignable to parameter `value` with type `TenantCustomConfigDict` in function `models.account.Tenant.custom_config_dict` [bad-argument-type]
-   --> tests/unit_tests/models/test_account_models.py:573:37
+   --> tests/unit_tests/models/test_account_models.py:616:37
 ERROR `None` is not subscriptable [unsupported-operation]
    --> tests/unit_tests/models/test_dataset_models.py:150:16
 ERROR `None` is not subscriptable [unsupported-operation]
@@ -6428,35 +6506,35 @@
 ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
    --> tests/unit_tests/services/test_credit_pool_service.py:127:5
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:180:93
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:252:93
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:204:25
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:276:25
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:247:25
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:319:25
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:564:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:636:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:574:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:646:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:613:70
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:685:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset` in function `services.dataset_service.DatasetService._update_pipeline_knowledge_base_node_data` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:636:74
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:708:74
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:703:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:775:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:741:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:813:9
 ERROR Argument `None` is not assignable to parameter `embedding_model_provider` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:807:38
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:879:38
 ERROR Argument `None` is not assignable to parameter `embedding_model` with type `str` in function `tests.unit_tests.services.dataset_service_test_helpers.DatasetServiceUnitDataFactory.create_dataset_mock` [bad-argument-type]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:808:29
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:880:29
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:866:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:938:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]
-   --> tests/unit_tests/services/test_dataset_service_dataset.py:901:9
+   --> tests/unit_tests/services/test_dataset_service_dataset.py:973:9
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1212:67
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1284:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `dataset` with type `Dataset | None` in function `services.dataset_service.DatasetService.check_dataset_operator_permission` [bad-argument-type]
-    --> tests/unit_tests/services/test_dataset_service_dataset.py:1215:81
+    --> tests/unit_tests/services/test_dataset_service_dataset.py:1287:81
 ERROR Object of class `FakeAccount` has no attribute `id` [missing-attribute]
   --> tests/unit_tests/services/test_dataset_service_document.py:91:9
 ERROR Object of class `FakeAccount` has no attribute `current_tenant_id` [missing-attribute]

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	46.96%	47.04%	+0.07%
Strict coverage	46.46%	46.54%	+0.08%
Typed symbols	26,217	26,570	+353
Untyped symbols	29,926	30,235	+309
Modules	2840	2858	+18

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.02%. Comparing base (00ac937) to head (544c6f6).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #37107      +/-   ##
==========================================
- Coverage   86.02%   86.02%   -0.01%     
==========================================
  Files        4661     4661              
  Lines      231336   231153     -183     
  Branches    42653    42567      -86     
==========================================
- Hits       199016   198838     -178     
+ Misses      28457    28453       -4     
+ Partials     3863     3862       -1     

Flag	Coverage Δ
dify-ui	95.57% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.