[Bug]: Can't delete internal RagFlow API Key.. both users on my test box have the same API Key

[dgutman]

Is there an existing issue for the same bug?

• I have checked the existing issues.

Branch name

main

Commit ID

na

Other environment information

Running Ubuntu 22.04 with the latest docker version I pulled < 3 days ago

Actual behavior

The UI indicates I can delete the aPI Key, but if I refresh the page, it's still there. This is done in an incognito window, so this shouldn't have any saved cookies / tokens from previous logins. I think logged in using the admin account we set up , and it turns out both accounts had the same API_KEY which seems like a bigger problem. When I tried to upload documents to "my" repository, it kept saying I have the wrong knowledge base name. It turns out it was because I was using the "admin" api key... even though that is what was showing up in "my" account. I also couldn't create a second API Key, hoping maybe that would nudge the issue away.

Expected behavior

Should be able to delete/create new API Key's not just if I am the initial admin user.

Steps to reproduce

Simply had two accounts, and tried to delete the API KEy as the second user on the system.

Additional information

d

[KevinHuSh]

You mean you can't delete generated API key?
Sorry, I can't reporduce it here.

[dgutman]

So I couldn't delete the API Key... although there is now a possibly related issue. As user "two" I am seeing the API Key of user 1... and so perhaps it's the same bug as ... while I shouldn't be able to see User 1's API Key.. I also shouldn't be able to delete it.

MY system had an Admin user, and I also created a personal account. When I initially using "my" API key to try and upload documents, I was getting an error saying it could not find my knowledge base. That wound up being true.. because the API Key the UI was showing me was actually someone elses...

[KevinHuSh]

Is it about agent API key?
It's still on development.

[undcloud]

I also encountered this problem.
Multiple users joined each other's teams, and then api_key, multiple users had the same api_key, and they could not delete it.