infiniflow/ragflow · warning · AdminException

not implement: grant role {role_name} actions: {actions} on

Error message

not implement: grant role {role_name} actions: {actions} on {resource}

What it means

RoleMgr.grant_role_permission (admin/server/roles.py:58) is a stub: logs 'not implement: grant role {role_name} actions {actions} on {resource}' and raises AdminException. Granting actions on resources to roles is not implemented; the call mutates nothing.

Source

Thrown at admin/server/roles.py:58

        raise AdminException(error_msg)

    @staticmethod
    def list_roles() -> Dict[str, Any]:
        error_msg = "not implement: list roles"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def get_role_permission(role_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: show role {role_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def grant_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:
        error_msg = f"not implement: grant role {role_name} actions: {actions} on {resource}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def revoke_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:
        error_msg = f"not implement: revoke role {role_name} actions: {actions} on {resource}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def update_user_role(user_name: str, role_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: update user role: {user_name} to role {role_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def get_user_permission(user_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: get user permission: {user_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

View on GitHub (pinned to 554fb1133a)

Solutions

Stop using role-grant APIs; control access via tenant membership (UserTenantService) and is_superuser.
Implement grant_role_permission in a fork backed by your own policy store.

Defensive patterns

Strategy: try-catch

Try / catch

from api.common.exceptions import AdminException
try:
    RoleMgr.grant_role_permission(role, actions, resource)
except AdminException as e:
    if str(e).startswith("not implement"):
        # fall back to tenant membership / is_superuser management
        raise NotImplementedError("RBAC grants unsupported; use tenant roles") from e
    raise

Prevention

Don't port ACL models onto RAGFlow role APIs; they are stubs.
Model access via tenants (UserTenantService) and superuser flags.

When it happens

Trigger: Calling RoleMgr.grant_role_permission(role_name, actions, resource) — e.g. provisioning scripts that try to authorize a role for dataset/tenant resources.

Common situations: Automation generated from RBAC-style API docs; migrating an ACL model from another system into RAGFlow.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/1fbe53950f8e1b7b. Report an issue: GitHub.