What causes "not implement: show role {role_name}" in infiniflow/ragflow?

Avoid role-permission queries; use user-level is_superuser and tenant membership for access decisions.

infiniflow/ragflow · warning · AdminException

not implement: show role {role_name}

Error message

not implement: show role {role_name}

What it means

RoleMgr.get_role_permission (admin/server/roles.py:52) is a stub: logs 'not implement: show role {role_name}' and raises AdminException. There is no permission model behind roles in this version, so querying a role's permissions always fails.

Source

Thrown at admin/server/roles.py:52

        raise AdminException(error_msg)

    @staticmethod
    def delete_role(role_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: drop role: {role_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def list_roles() -> Dict[str, Any]:
        error_msg = "not implement: list roles"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def get_role_permission(role_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: show role {role_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def grant_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:
        error_msg = f"not implement: grant role {role_name} actions: {actions} on {resource}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def revoke_role_permission(role_name: str, actions: list, resource: str) -> Dict[str, Any]:
        error_msg = f"not implement: revoke role {role_name} actions: {actions} on {resource}"
        logging.error(error_msg)
        raise AdminException(error_msg)

    @staticmethod
    def update_user_role(user_name: str, role_name: str) -> Dict[str, Any]:
        error_msg = f"not implement: update user role: {user_name} to role {role_name}"
        logging.error(error_msg)
        raise AdminException(error_msg)

View on GitHub (pinned to 554fb1133a)

Solutions

Avoid role-permission queries; use user-level is_superuser and tenant membership for access decisions.
Implement the method in a fork against your own RBAC tables.

Defensive patterns

Strategy: try-catch

Try / catch

from api.common.exceptions import AdminException
try:
    perms = RoleMgr.get_role_permission(role)
except AdminException as e:
    if str(e).startswith("not implement"):
        perms = None  # permissions unsupported
    else:
        raise

Prevention

For authorization decisions, read is_superuser/tenant roles, not role permissions.
Mark role-permission endpoints as no-ops in generated clients.

When it happens

Trigger: Calling RoleMgr.get_role_permission(role_name) from an admin route that shows role detail/permissions.

Common situations: RBAC audit tooling or UI detail views probing role permissions on RAGFlow.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/c94346e514ca837a. Report an issue: GitHub.