Fix Flowise 746 Chat Message Route

packages/server/src/routes/chat-messages/index.ts

@@ -1,18 +1,31 @@
 import express from 'express'
 import chatMessageController from '../../controllers/chat-messages'
+import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
 const router = express.Router()
 
 // CREATE
 // NOTE: Unused route
 // router.post(['/', '/:id'], chatMessageController.createChatMessage)
 
 // READ
-router.get(['/', '/:id'], chatMessageController.getAllChatMessages)
+router.get(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:view,chatflows:update,agentflows:view,agentflows:update'),
+    chatMessageController.getAllChatMessages
+)
 
 // UPDATE
-router.put(['/abort/', '/abort/:chatflowid/:chatid'], chatMessageController.abortChatMessage)
+router.put(
+    ['/abort/', '/abort/:chatflowid/:chatid'],
+    checkAnyPermission('chatflows:create,chatflows:update,agentflows:create,agentflows:update'),
+    chatMessageController.abortChatMessage
+)
 
 // DELETE
-router.delete(['/', '/:id'], chatMessageController.removeAllChatMessages)
+router.delete(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:delete,agentflows:delete,assistants:delete'),
+    chatMessageController.removeAllChatMessages
+)
 
 export default router

packages/server/src/routes/internal-chat-messages/index.ts

@@ -1,11 +1,16 @@
 import express from 'express'
 import chatMessagesController from '../../controllers/chat-messages'
+import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
 const router = express.Router()
 
 // CREATE
 
 // READ
-router.get(['/', '/:id'], chatMessagesController.getAllInternalChatMessages)
+router.get(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:view,chatflows:update,agentflows:view,agentflows:update'),
+    chatMessagesController.getAllInternalChatMessages
+)
 
 // UPDATE