Skip to content

bug: Ingested documents are being shared will all users#1337

Open
ricofurtado wants to merge 3 commits intomainfrom
document-sharing-unsharing-with-acl-management
Open

bug: Ingested documents are being shared will all users#1337
ricofurtado wants to merge 3 commits intomainfrom
document-sharing-unsharing-with-acl-management

Conversation

@ricofurtado
Copy link
Copy Markdown
Collaborator

Files ingested by any user (including via IBM COS + IBM SSO) are currently visible to ALL authenticated users. The owner, allowed_users, and allowed_groups fields are stored in OpenSearch during ingestion but are never filtered

@github-actions github-actions Bot added frontend 🟨 Issues related to the UI/UX backend 🔷 Issues related to backend services (OpenSearch, Langflow, APIs) tests labels Apr 6, 2026
Comment thread src/api/acl.py
owner=user.user_id,
added_users=body.user_ids,
)
return JSONResponse({"success": True, "allowed_users": merged, "acl_result": str(result)})
Comment thread src/api/acl.py
owner=user.user_id,
removed_users=body.user_ids,
)
return JSONResponse({"success": True, "allowed_users": remaining, "acl_result": str(result)})
@edwinjosechittilappilly
Copy link
Copy Markdown
Collaborator

@ricofurtado The initial issue in cloud was because the DLS was not applied in Saas Deployments.

@ricofurtado ricofurtado changed the title Document sharing unsharing with acl management bug: Ingested documents are being shared will all users Apr 8, 2026
Copy link
Copy Markdown
Collaborator

@edwinjosechittilappilly edwinjosechittilappilly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The DLS releated changes are in #1296

Lets merge this 1296 once tested and then revisit this functionality. cause this might chnage the ACL behaviour

Comment thread src/api/acl.py

class ShareDocumentBody(BaseModel):
filename: str
user_ids: List[str]
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be potentialy the owner name and email.

ACL to be be deduced or inherited from the Source for most connectors which priovide ACL.
Suggestion toRefer: dependecies.py for more context!

Comment thread src/main.py
)

# Document ACL endpoints
app.add_api_route(
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good one!
Lets plan and implement it with respect to the product and Design team.

I like this idea of unshare.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend 🔷 Issues related to backend services (OpenSearch, Langflow, APIs) frontend 🟨 Issues related to the UI/UX tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants