dify - 💡(How to fix) Fix Console `POST .../tool-provider/builtin/<provider>/default-credential` missing `@is_admin_or_owner_required` (inconsistent ACL) [1 pull requests]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

latest

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

1. Sign in to the console as a workspace member who is not an admin or owner (e.g. normal editor role).
2. Call: POST /console/api/workspaces/current/tool-provider/builtin/<provider>/default-credential with JSON body {"id": "<credential_id>"} and a valid session for that workspace.
3. Before the fix: the request succeeds (HTTP 200) and updates the default builtin tool credential.
4. Compare with sibling endpoints on the same resource, e.g.:
   • POST .../builtin/<provider>/update
   • POST .../builtin/<provider>/delete Those require admin or owner and reject non-privileged members.

✔️ Expected Behavior

• Only workspace admins or owners may set the default credential for a builtin tool provider, consistent with update and delete on the same API surface.
• Non-admin/non-owner members receive the same authorization failure as other protected builtin tool management endpoints.

❌ Actual Behavior

Before fix: ToolBuiltinProviderSetDefaultApi.post had @setup_required, @login_required, and @account_initialization_required but not @is_admin_or_owner_required. Any authenticated, initialized workspace member could set the default credential.