From db8de568a8182907e7347e9430f02f8c17e7a2c4 Mon Sep 17 00:00:00 2001 From: yau-wd Date: Wed, 1 Jul 2026 14:09:55 +0800 Subject: [PATCH 1/2] Fix Flowise 610 openai-realtime cross-workspace authorization (#6586) * fix(flowise-610): enforce workspace scoping and RBAC on openai-realtime routes * Update packages/server/src/services/openai-realtime/index.ts Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- .../src/controllers/openai-realtime/index.ts | 5 +++- .../src/routes/openai-realtime/index.ts | 13 ++++++++-- .../src/services/openai-realtime/index.ts | 24 ++++++++++--------- 3 files changed, 28 insertions(+), 14 deletions(-) diff --git a/packages/server/src/controllers/openai-realtime/index.ts b/packages/server/src/controllers/openai-realtime/index.ts index a16ea3db50c..381b9001cb2 100644 --- a/packages/server/src/controllers/openai-realtime/index.ts +++ b/packages/server/src/controllers/openai-realtime/index.ts @@ -11,7 +11,8 @@ const getAgentTools = async (req: Request, res: Response, next: NextFunction) => `Error: openaiRealTimeController.getAgentTools - id not provided!` ) } - const apiResponse = await openaiRealTimeService.getAgentTools(req.params.id) + const workspaceId = req.user?.activeWorkspaceId + const apiResponse = await openaiRealTimeService.getAgentTools(req.params.id, workspaceId) return res.json(apiResponse) } catch (error) { next(error) @@ -50,8 +51,10 @@ const executeAgentTool = async (req: Request, res: Response, next: NextFunction) `Error: openaiRealTimeController.executeAgentTool - body inputArgs not provided!` ) } + const workspaceId = req.user?.activeWorkspaceId const apiResponse = await openaiRealTimeService.executeAgentTool( req.params.id, + workspaceId, req.body.chatId, req.body.toolName, req.body.inputArgs, diff --git a/packages/server/src/routes/openai-realtime/index.ts b/packages/server/src/routes/openai-realtime/index.ts index 68ed0427da4..2aabc9a73c2 100644 --- a/packages/server/src/routes/openai-realtime/index.ts +++ b/packages/server/src/routes/openai-realtime/index.ts @@ -1,12 +1,21 @@ import express from 'express' import openaiRealTimeController from '../../controllers/openai-realtime' +import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck' const router = express.Router() // GET -router.get(['/', '/:id'], openaiRealTimeController.getAgentTools) +router.get( + ['/', '/:id'], + checkAnyPermission('chatflows:view,chatflows:create,chatflows:update,chatflows:delete'), + openaiRealTimeController.getAgentTools +) // EXECUTE -router.post(['/', '/:id'], openaiRealTimeController.executeAgentTool) +router.post( + ['/', '/:id'], + checkAnyPermission('chatflows:view,chatflows:create,chatflows:update,chatflows:delete'), + openaiRealTimeController.executeAgentTool +) export default router diff --git a/packages/server/src/services/openai-realtime/index.ts b/packages/server/src/services/openai-realtime/index.ts index 8877474bd84..f08779e59eb 100644 --- a/packages/server/src/services/openai-realtime/index.ts +++ b/packages/server/src/services/openai-realtime/index.ts @@ -12,7 +12,7 @@ import { } from '../../utils' import { checkStorage, updateStorageUsage } from '../../utils/quotaUsage' import { getRunningExpressApp } from '../../utils/getRunningExpressApp' -import { ChatFlow } from '../../database/entities/ChatFlow' +import chatflowsService from '../chatflows' import { IDepthQueue, IReactFlowNode } from '../../Interface' import { ICommonObject, INodeData } from 'flowise-components' import { convertToOpenAIFunction } from '@langchain/core/utils/function_calling' @@ -26,14 +26,9 @@ const SOURCE_DOCUMENTS_PREFIX = '\n\n----FLOWISE_SOURCE_DOCUMENTS----\n\n' const ARTIFACTS_PREFIX = '\n\n----FLOWISE_ARTIFACTS----\n\n' const TOOL_ARGS_PREFIX = '\n\n----FLOWISE_TOOL_ARGS----\n\n' -const buildAndInitTool = async (chatflowid: string, _chatId?: string, _apiMessageId?: string) => { +const buildAndInitTool = async (chatflowid: string, reqWorkspaceId?: string, _chatId?: string, _apiMessageId?: string) => { const appServer = getRunningExpressApp() - const chatflow = await appServer.AppDataSource.getRepository(ChatFlow).findOneBy({ - id: chatflowid - }) - if (!chatflow) { - throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Chatflow ${chatflowid} not found`) - } + const chatflow = await chatflowsService.getChatflowByIdForWorkspace(chatflowid, reqWorkspaceId) const chatId = _chatId || uuidv4() const apiMessageId = _apiMessageId || uuidv4() @@ -156,12 +151,15 @@ const buildAndInitTool = async (chatflowid: string, _chatId?: string, _apiMessag return agent } -const getAgentTools = async (chatflowid: string): Promise => { +const getAgentTools = async (chatflowid: string, workspaceId?: string): Promise => { try { - const agent = await buildAndInitTool(chatflowid) + const agent = await buildAndInitTool(chatflowid, workspaceId) const tools = agent.tools return tools.map(convertToOpenAIFunction) } catch (error) { + if (error instanceof InternalFlowiseError) { + throw error + } throw new InternalFlowiseError( StatusCodes.INTERNAL_SERVER_ERROR, `Error: openaiRealTimeService.getAgentTools - ${getErrorMessage(error)}` @@ -171,13 +169,14 @@ const getAgentTools = async (chatflowid: string): Promise => { const executeAgentTool = async ( chatflowid: string, + workspaceId: string | undefined, chatId: string, toolName: string, inputArgs: string, apiMessageId?: string ): Promise => { try { - const agent = await buildAndInitTool(chatflowid, chatId, apiMessageId) + const agent = await buildAndInitTool(chatflowid, workspaceId, chatId, apiMessageId) const tools = agent.tools const tool = tools.find((tool: any) => tool.name === toolName) @@ -228,6 +227,9 @@ const executeAgentTool = async ( artifacts } } catch (error) { + if (error instanceof InternalFlowiseError) { + throw error + } throw new InternalFlowiseError( StatusCodes.INTERNAL_SERVER_ERROR, `Error: openaiRealTimeService.executeAgentTool - ${getErrorMessage(error)}` From 096d2d4c14df1400e1c0158558688b78e30a393f Mon Sep 17 00:00:00 2001 From: Ilango Date: Wed, 1 Jul 2026 13:38:12 +0530 Subject: [PATCH 2/2] fix: exports contain variable values (#6556) * fix: exports contain variable values * Update packages/server/src/services/export-import/index.ts Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- packages/server/src/services/export-import/index.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/server/src/services/export-import/index.ts b/packages/server/src/services/export-import/index.ts index 0a0a60f1685..b51abe4cdb2 100644 --- a/packages/server/src/services/export-import/index.ts +++ b/packages/server/src/services/export-import/index.ts @@ -155,7 +155,8 @@ const exportData = async (exportInput: ExportInput, activeWorkspaceId: string): let Variable: Variable[] | { data: Variable[]; total: number } = exportInput.variable === true ? await variableService.getAllVariables(activeWorkspaceId) : [] - Variable = 'data' in Variable ? Variable.data : Variable + const variables = 'data' in Variable ? Variable.data : Variable + Variable = variables.map((v) => ({ ...v, value: '' })) return { FileDefaultName,