From f8080b97fd1e99f306fafc7087a7d4da58b0c67a Mon Sep 17 00:00:00 2001 From: Carlos Date: Tue, 13 Oct 2026 15:07:17 +0200 Subject: [PATCH] Assert API user has action-alias help permission. --- CHANGELOG.rst | 1 + st2api/st2api/controllers/v1/actionalias.py | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 9cf1fc3afe..e063fbff18 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -25,6 +25,7 @@ Fixed * Fix ``TypeError`` when displaying help for actions whose parameters have no ``description`` key. #6375 * Fix utf-8 encode before checking paramter max size #6352 * Fix stuck running workflow tasks #6398 (by @guzzijones12@gmail.com) +* Fixed action-alias help API returning 500 when RBAC enabled. #6414 (by @nzlosh) Changed ~~~~~~~ diff --git a/st2api/st2api/controllers/v1/actionalias.py b/st2api/st2api/controllers/v1/actionalias.py index 155ae81792..7065d8b888 100644 --- a/st2api/st2api/controllers/v1/actionalias.py +++ b/st2api/st2api/controllers/v1/actionalias.py @@ -107,7 +107,15 @@ def help(self, filter, pack, limit, offset, requester_user, **kwargs): GET /actionalias/help """ try: - aliases_resp = super(ActionAliasController, self)._get_all(**kwargs) + permission_type = PermissionType.ACTION_ALIAS_HELP + rbac_utils = get_rbac_backend().get_utils_class() + rbac_utils.assert_user_has_permission( + user_db=requester_user, + permission_type=permission_type, + ) + aliases_resp = super(ActionAliasController, self)._get_all( + requester_user=requester_user, **kwargs + ) aliases = [ActionAliasAPI(**alias) for alias in aliases_resp.json] return generate_helpstring_result( aliases, filter, pack, int(limit), int(offset)