{"record":{"id":"c94346e514ca837a","repo":"infiniflow/ragflow","slug":"not-implement-show-role-role-name","errorCode":null,"errorMessage":"not implement: show role {role_name}","messagePattern":"not implement: show role (.+?)","errorType":"http","errorClass":"AdminException","httpStatus":400,"severity":"warning","filePath":"admin/server/roles.py","lineNumber":52,"sourceCode":"        raise AdminException(error_msg)\n\n    @staticmethod\n    def delete_role(role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: drop role: {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def list_roles() -> Dict[str, Any]:\n        error_msg = \"not implement: list roles\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def get_role_permission(role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: show role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def grant_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: grant role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def revoke_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: revoke role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def update_user_role(user_name: str, role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: update user role: {user_name} to role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/admin/server/roles.py#L34-L70","documentation":"RoleMgr.get_role_permission (admin/server/roles.py:52) is a stub: logs 'not implement: show role {role_name}' and raises AdminException. There is no permission model behind roles in this version, so querying a role's permissions always fails.","triggerScenarios":"Calling RoleMgr.get_role_permission(role_name) from an admin route that shows role detail/permissions.","commonSituations":"RBAC audit tooling or UI detail views probing role permissions on RAGFlow.","solutions":["Avoid role-permission queries; use user-level is_superuser and tenant membership for access decisions.","Implement the method in a fork against your own RBAC tables."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from api.common.exceptions import AdminException\ntry:\n    perms = RoleMgr.get_role_permission(role)\nexcept AdminException as e:\n    if str(e).startswith(\"not implement\"):\n        perms = None  # permissions unsupported\n    else:\n        raise","preventionTips":["For authorization decisions, read is_superuser/tenant roles, not role permissions.","Mark role-permission endpoints as no-ops in generated clients."],"tags":["not-implemented","roles","rbac","permissions","admin"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}