fix: bypass admin users to use dataset api with API key (#2072)

e2c89a94 · Bowen Liang · GitHub · 869690c4 · e2c89a94
Unverified Commit e2c89a94 authored Jan 19, 2024 by Bowen Liang Committed by GitHub Jan 19, 2024
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

wraps.py api/controllers/service_api/wraps.py +1 -1

No files found.
--- a/api/controllers/service_api/wraps.py
+++ b/api/controllers/service_api/wraps.py
@@ -75,7 +75,7 @@ def validate_dataset_token(view=None):
            tenant_account_join = db.session.query(Tenant, TenantAccountJoin) \
                .filter(Tenant.id == api_token.tenant_id) \
                .filter(TenantAccountJoin.tenant_id == Tenant.id) \
-                .filter(TenantAccountJoin.role == 'owner') \
+                .filter(TenantAccountJoin.role.in_(['owner', 'admin'])) \
                .one_or_none()
            if tenant_account_join:
                tenant, ta = tenant_account_join