From 5cb4f83afaee7b6ce3b596d5f1ac185a7ee06e17 Mon Sep 17 00:00:00 2001 From: cybermaggedon Date: Mon, 29 Jun 2026 09:13:05 +0100 Subject: [PATCH] fix: list-my-workspaces permissions were broken (#1002) list-my-workspaces has AUTHENTICATED scope, so anyone is permitted to run the operation. No specific permission grant is needed. --- docs/tech-specs/capabilities.md | 3 +-- trustgraph-flow/trustgraph/gateway/registry.py | 2 +- trustgraph-flow/trustgraph/iam/service/iam.py | 1 - 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/docs/tech-specs/capabilities.md b/docs/tech-specs/capabilities.md index ba27c738..7717cbc9 100644 --- a/docs/tech-specs/capabilities.md +++ b/docs/tech-specs/capabilities.md @@ -100,7 +100,6 @@ multi-word subsystems. | `users:admin` | Assign / remove roles on users within the workspace | | `keys:self` | Create / revoke / list **own** API keys | | `keys:admin` | Create / revoke / list **any user's** API keys within the workspace | -| `workspaces:list-own` | List workspaces the caller has access to | | `workspaces:admin` | Create / delete / disable workspaces (system-level) | | `iam:admin` | JWT signing-key rotation, IAM-level operations | | `metrics:read` | Prometheus metrics proxy | @@ -111,7 +110,7 @@ The open-source edition ships three roles: | Role | Capabilities | |---|---| -| `reader` | `agent`, `graph:read`, `documents:read`, `rows:read`, `llm`, `embeddings`, `mcp`, `collections:read`, `knowledge:read`, `flows:read`, `config:read`, `keys:self`, `workspaces:list-own` | +| `reader` | `agent`, `graph:read`, `documents:read`, `rows:read`, `llm`, `embeddings`, `mcp`, `collections:read`, `knowledge:read`, `flows:read`, `config:read`, `keys:self` | | `writer` | everything in `reader` **+** `graph:write`, `documents:write`, `rows:write`, `collections:write`, `knowledge:write` | | `admin` | everything in `writer` **+** `config:write`, `flows:write`, `users:read`, `users:write`, `users:admin`, `keys:admin`, `workspaces:admin`, `iam:admin`, `metrics:read` | diff --git a/trustgraph-flow/trustgraph/gateway/registry.py b/trustgraph-flow/trustgraph/gateway/registry.py index f7f9f882..bdc3ed4c 100644 --- a/trustgraph-flow/trustgraph/gateway/registry.py +++ b/trustgraph-flow/trustgraph/gateway/registry.py @@ -311,7 +311,7 @@ register(Operation( )) register(Operation( name="list-my-workspaces", - capability="workspaces:list-own", + capability=AUTHENTICATED, resource_level=ResourceLevel.SYSTEM, extract_resource=_empty_resource, extract_parameters=_no_parameters, diff --git a/trustgraph-flow/trustgraph/iam/service/iam.py b/trustgraph-flow/trustgraph/iam/service/iam.py index e945df82..f1f7d92d 100644 --- a/trustgraph-flow/trustgraph/iam/service/iam.py +++ b/trustgraph-flow/trustgraph/iam/service/iam.py @@ -78,7 +78,6 @@ _READER_CAPS = { "collections:read", "knowledge:read", "keys:self", - "workspaces:list-own", } _WRITER_CAPS = _READER_CAPS | {