Compare commits

...

1 Commits

Author SHA1 Message Date
Otto
1a3dbda073 fix(backend): allow admins to download submitted agents pending review
The get_graph_as_admin() function had an access check that required the
graph to be either owned by the requesting user or published (APPROVED) in
the marketplace. This caused admin download of submitted-but-not-yet-approved
agents to fail with a NotFoundError, surfacing as a Server Components render
error in the frontend.

Since get_graph_as_admin is only called from admin-protected routes, the
ownership/marketplace check is redundant — route-level auth already ensures
only admins can access these endpoints. The fix removes the check, keeping
only the null guard.
2026-03-24 05:03:28 +00:00

View File

@@ -1207,13 +1207,9 @@ async def get_graph_as_admin(
order={"version": "desc"},
)
# For access, the graph must be owned by the user or listed in the store
if graph is None or (
graph.userId != user_id
and not await is_graph_published_in_marketplace(
graph_id, version or graph.version
)
):
# Admin access bypasses ownership and marketplace checks — route-level
# auth already ensures only admins can call this function.
if graph is None:
return None
if for_export: