{"record":{"id":"1fbe53950f8e1b7b","repo":"infiniflow/ragflow","slug":"not-implement-grant-role-role-name-actions-ac","errorCode":null,"errorMessage":"not implement: grant role {role_name} actions: {actions} on {resource}","messagePattern":"not implement: grant role (.+?) actions: (.+?) on (.+?)","errorType":"http","errorClass":"AdminException","httpStatus":400,"severity":"warning","filePath":"admin/server/roles.py","lineNumber":58,"sourceCode":"        raise AdminException(error_msg)\n\n    @staticmethod\n    def list_roles() -> Dict[str, Any]:\n        error_msg = \"not implement: list roles\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def get_role_permission(role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: show role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def grant_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: grant role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def revoke_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: revoke role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def update_user_role(user_name: str, role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: update user role: {user_name} to role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def get_user_permission(user_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: get user permission: {user_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/admin/server/roles.py#L40-L76","documentation":"RoleMgr.grant_role_permission (admin/server/roles.py:58) is a stub: logs 'not implement: grant role {role_name} actions {actions} on {resource}' and raises AdminException. Granting actions on resources to roles is not implemented; the call mutates nothing.","triggerScenarios":"Calling RoleMgr.grant_role_permission(role_name, actions, resource) — e.g. provisioning scripts that try to authorize a role for dataset/tenant resources.","commonSituations":"Automation generated from RBAC-style API docs; migrating an ACL model from another system into RAGFlow.","solutions":["Stop using role-grant APIs; control access via tenant membership (UserTenantService) and is_superuser.","Implement grant_role_permission in a fork backed by your own policy store."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from api.common.exceptions import AdminException\ntry:\n    RoleMgr.grant_role_permission(role, actions, resource)\nexcept AdminException as e:\n    if str(e).startswith(\"not implement\"):\n        # fall back to tenant membership / is_superuser management\n        raise NotImplementedError(\"RBAC grants unsupported; use tenant roles\") from e\n    raise","preventionTips":["Don't port ACL models onto RAGFlow role APIs; they are stubs.","Model access via tenants (UserTenantService) and superuser flags."],"tags":["not-implemented","roles","rbac","permissions","admin"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}