{"record":{"id":"595234857c4e3f77","repo":"langgenius/dify","slug":"unsupported-legacy-dataset-permission-permission","errorCode":null,"errorMessage":"Unsupported legacy dataset permission: {permission}","messagePattern":"Unsupported legacy dataset permission: (.+?)","errorType":"console","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"api/commands/rbac.py","lineNumber":298,"sourceCode":"            )\n        )\n    else:\n        click.echo(\n            click.style(\n                f\"RBAC member-role migration completed. Scanned {scanned_count} members across {tenant_count} tenants, \"\n                f\"migrated {migrated_count}, skipped {skipped_count} already up-to-date.\",\n                fg=\"green\",\n            )\n        )\n\n\ndef _dataset_permission_enum(permission: DatasetPermissionEnum | str | None) -> DatasetPermissionEnum:\n    if permission is None:\n        return DatasetPermissionEnum.ONLY_ME\n    try:\n        return DatasetPermissionEnum(permission)\n    except ValueError as exc:\n        raise ValueError(f\"Unsupported legacy dataset permission: {permission}\") from exc\n\n\ndef _rbac_dataset_scope_for_legacy_permission(permission: DatasetPermissionEnum) -> RBACResourceWhitelistScope:\n    if permission is DatasetPermissionEnum.ALL_TEAM:\n        return RBACResourceWhitelistScope.ALL\n    if permission in {DatasetPermissionEnum.ONLY_ME, DatasetPermissionEnum.PARTIAL_TEAM}:\n        return RBACResourceWhitelistScope.SPECIFIC\n    raise ValueError(f\"Unsupported legacy dataset permission: {permission}\")\n\n\ndef _emit_dataset_permission_migration_event(payload: dict[str, object]) -> None:\n    click.echo(json.dumps(payload, sort_keys=True))\n\n\n@click.command(\n    \"rbac-migrate-dataset-permissions\",\n    help=(\n        \"Migrate legacy dataset permission scopes and partial members into RBAC dataset access bindings. \"","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/commands/rbac.py#L280-L316","documentation":"ValueError raised by _dataset_permission_enum when DatasetPermissionEnum(permission) raises ValueError - i.e. the stored permission string (or value) does not correspond to any DatasetPermissionEnum member. The function accepts None (defaults to ONLY_ME) but any non-None unresolvable value triggers this.","triggerScenarios":"Triggered when DatasetPermission.permission in the DB holds a string/value that is not one of the DatasetPermissionEnum members (ALL_TEAM, ONLY_ME, PARTIAL_TEAM).","commonSituations":"A legacy or custom permission value was written to the dataset_permissions table, an enum member was renamed across versions, or corrupt data inserted an unknown code.","solutions":["Query `SELECT DISTINCT permission FROM dataset_permissions;` to find the offending value(s).","Map or correct unknown values to a supported DatasetPermissionEnum member.","If a new permission was introduced, extend DatasetPermissionEnum and the migration mapping.","Back up the table before mutating permission values."],"exampleFix":"-- before\nSELECT DISTINCT permission FROM dataset_permissions;\n-- 'all'  (not a valid enum value)\n\n-- after\nUPDATE dataset_permissions SET permission='all_team' WHERE permission='all';","handlingStrategy":"type-guard","validationCode":"def is_supported_dataset_permission(value: str | None) -> bool:\n    if value is None:\n        return True\n    try:\n        DatasetPermissionEnum(value)\n        return True\n    except ValueError:\n        return False","typeGuard":"def is_valid_permission_enum(value: str | None) -> bool:\n    if value is None:\n        return True\n    try:\n        DatasetPermissionEnum(value)\n        return True\n    except ValueError:\n        return False","tryCatchPattern":"try:\n    perm = _dataset_permission_enum(raw)\nexcept ValueError as exc:\n    click.echo(f\"Skipping dataset with unknown permission: {exc}\", err=True)\n    continue","preventionTips":["Audit `SELECT DISTINCT permission FROM dataset_permissions;` before migration.","Map unknown permission values to a supported enum member ahead of time.","Extend DatasetPermissionEnum and the mapping together when adding permission levels.","Back up dataset_permissions before mutating values."],"tags":["backend","cli","rbac","migration","enum","data-integrity"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}