{"record":{"id":"f88bd7808b2974eb","repo":"infiniflow/ragflow","slug":"not-implement-revoke-role-role-name-actions-a","errorCode":null,"errorMessage":"not implement: revoke role {role_name} actions: {actions} on {resource}","messagePattern":"not implement: revoke role (.+?) actions: (.+?) on (.+?)","errorType":"http","errorClass":"AdminException","httpStatus":400,"severity":"warning","filePath":"admin/server/roles.py","lineNumber":64,"sourceCode":"        raise AdminException(error_msg)\n\n    @staticmethod\n    def get_role_permission(role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: show role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def grant_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: grant role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def revoke_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: revoke role {role_name} actions: {actions} on {resource}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def update_user_role(user_name: str, role_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: update user role: {user_name} to role {role_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n\n    @staticmethod\n    def get_user_permission(user_name: str) -> Dict[str, Any]:\n        error_msg = f\"not implement: get user permission: {user_name}\"\n        logging.error(error_msg)\n        raise AdminException(error_msg)\n","sourceCodeStart":46,"sourceCodeEnd":77,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/admin/server/roles.py#L46-L77","documentation":"RoleMgr.revoke_role_permission (admin/server/roles.py:64) is a stub: logs 'not implement: revoke role {role_name} actions {actions} on {resource}' and raises AdminException. Revocation never happens because no permission state exists to revoke.","triggerScenarios":"Calling RoleMgr.revoke_role_permission(role_name, actions, resource) during de-provisioning or lockdown scripts.","commonSituations":"Security runbooks trying to strip role rights; symmetric calls after (stubbed) grants failed.","solutions":["Skip role-revocation APIs in this version; adjust tenant roles or is_superuser instead.","Implement in a fork if real RBAC revocation is required."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from api.common.exceptions import AdminException\ntry:\n    RoleMgr.revoke_role_permission(role, actions, resource)\nexcept AdminException as e:\n    if str(e).startswith(\"not implement\"):\n        pass  # no permission state exists; revocation is a no-op conceptually\n    else:\n        raise","preventionTips":["Skip revocation flows in runbooks; adjust tenant membership instead.","Distinguish stub errors from real failures by the 'not implement' prefix before alerting."],"tags":["not-implemented","roles","rbac","permissions","admin"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}