Implementation:Langgenius Dify Access Control Service

Knowledge Sources	Langgenius_Dify
Domains	Frontend, Access Control, Enterprise
Last Updated	2026-02-08 00:00 GMT

Overview

React Query hooks for managing enterprise web-app access control, including whitelist subjects, candidate search, and access mode updates.

Description

The Access Control Service provides a set of TanStack React Query hooks that interact with Dify's enterprise web-app access control API endpoints. It supports fetching whitelist subjects (groups and members) for an application, searching for candidates to add to the whitelist with infinite-scroll pagination, updating the access mode for an app (including adding/removing subjects), and checking whether the current user can access a specific app based on system authentication features. All queries use a shared access-control namespace for cache key management and automatic invalidation.

Usage

Use these hooks in enterprise-tier Dify deployments to enforce application-level access control in the console and web-app UIs. useAppWhiteListSubjects retrieves the current whitelist, useSearchForWhiteListCandidates provides paginated candidate search, useUpdateAccessMode mutates the access policy, and useGetUserCanAccessApp gates access to apps behind authentication checks.

Code Reference

Source Location

• Repository: Langgenius_Dify
• File: web/service/access-control.ts

Signature

export const useAppWhiteListSubjects: (appId: string | undefined, enabled: boolean) => UseQueryResult<{ groups: AccessControlGroup[], members: AccessControlAccount[] }>

export const useSearchForWhiteListCandidates: (query: { keyword?: string, groupId?: AccessControlGroup['id'], resultsPerPage?: number }, enabled: boolean) => UseInfiniteQueryResult<SearchResults>

export const useUpdateAccessMode: () => UseMutationResult<unknown, unknown, UpdateAccessModeParams>

export const useGetUserCanAccessApp: (params: { appId?: string, isInstalledApp?: boolean, enabled?: boolean }) => UseQueryResult<{ result: boolean }>

Import

import {
  useAppWhiteListSubjects,
  useSearchForWhiteListCandidates,
  useUpdateAccessMode,
  useGetUserCanAccessApp,
} from '@/service/access-control'

I/O Contract

Inputs

Name	Type	Required	Description
appId	undefined	Yes (for whitelist/access queries)	The application ID to query or mutate access for
enabled	boolean	Yes	Controls whether the query is enabled
query.keyword	string	No	Search keyword for filtering whitelist candidates
query.groupId	string	No	Filter candidates by group ID
query.resultsPerPage	number	No	Number of results per page for pagination
accessMode	AccessMode	Yes (mutation)	The new access mode to apply to the application
subjects	'subjectType'>[]	No (mutation)	Subjects to include in the access mode update

Outputs

Name	Type	Description
groups	AccessControlGroup[]	Groups currently on the app whitelist
members	AccessControlAccount[]	Individual accounts on the app whitelist
subjects	Subject[]	Candidate subjects from paginated search
hasMore	boolean	Whether more candidate pages are available
result	boolean	Whether the current user can access the app

Usage Examples

import { useAppWhiteListSubjects, useUpdateAccessMode, useGetUserCanAccessApp } from '@/service/access-control'

// Fetch whitelist for an app
const { data } = useAppWhiteListSubjects(appId, true)
console.log(data?.groups, data?.members)

// Update access mode
const { mutate } = useUpdateAccessMode()
mutate({ appId: 'app-123', accessMode: 'whitelist', subjects: [{ subjectId: 'user-1', subjectType: 'member' }] })

// Check user access
const { data: accessData } = useGetUserCanAccessApp({ appId: 'app-123', enabled: true })
if (accessData?.result) {
  // user can access
}

Related Pages

• Langgenius_Dify_Webapp_Auth - Web app authentication token management used by access control checks
• Langgenius_Dify_Fetch_Layer - Underlying HTTP fetch layer for API requests
• Langgenius_Dify_UseShare - Share service hooks that provide getUserCanAccess