From c44bc1c51998fdbb148c7909b414ff5318c3228d Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Thu, 16 Jul 2026 11:20:47 +0800 Subject: [PATCH 1/9] fix: clear modeList when it only contains 'LOCAL' --- ui/src/views/login/index.vue | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ui/src/views/login/index.vue b/ui/src/views/login/index.vue index 48549bee07e..70bcf5888d8 100644 --- a/ui/src/views/login/index.vue +++ b/ui/src/views/login/index.vue @@ -301,6 +301,10 @@ onBeforeMount(() => { modeList.value = ['QR_CODE', ...modeList.value] } } + // 如果modeList 只包含了LOCAL 就可以置空 + if (modeList.value.length === 1 && modeList.value[0] === 'LOCAL') { + modeList.value = [] + } const defaultMode = authSetting.value.default_value if (['lark', 'wecom', 'dingtalk'].includes(defaultMode)) { changeMode('QR_CODE', false) From 89e9306365fd385953739404646408d6e252b2bd Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Thu, 16 Jul 2026 11:52:25 +0800 Subject: [PATCH 2/9] fix: update chat authentication response paths to ensure trailing slashes --- apps/oss/serializers/file.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/apps/oss/serializers/file.py b/apps/oss/serializers/file.py index c7c043500d5..ecc026c5a94 100644 --- a/apps/oss/serializers/file.py +++ b/apps/oss/serializers/file.py @@ -166,6 +166,12 @@ def auth(file, mk_file_auth): # PublicFileAccess 中记录的文件允许公开访问 if QuerySet(PublicFileAccess).filter(source_type='FILE', source_id=str(file.id)).exists(): return + if file.source_type == FileSourceType.APPLICATION: + application = QuerySet(Application).filter(id=file.source_id).first() + if application is None: + _deny() + if file.meta.get('chat_id') is None: + return # 非公共文件,直接拒绝 if mk_file_auth is None: _deny() @@ -266,9 +272,6 @@ def _auth_system(file, user_id): application = QuerySet(Application).filter(id=file.source_id).first() if application is None: _deny() - # 如果是应用的高级设置的文件 - if file.meta.get('chat_id') is None: - return _check_workspace_resource_permission( user_auth, user_id, workspace_id=application.workspace_id, From a725adc9fd2019d836221101b43aa7916d5d162c Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 09:39:19 +0800 Subject: [PATCH 3/9] fix: standardize file URL generation in common.ts and ParagraphDocumentContent.vue --- .../ParagraphDocumentContent.vue | 2 +- ui/src/utils/common.ts | 73 +++++++++---------- 2 files changed, 37 insertions(+), 38 deletions(-) diff --git a/ui/src/components/ai-chat/component/knowledge-source-component/ParagraphDocumentContent.vue b/ui/src/components/ai-chat/component/knowledge-source-component/ParagraphDocumentContent.vue index dff38dfc205..37beb19e77e 100644 --- a/ui/src/components/ai-chat/component/knowledge-source-component/ParagraphDocumentContent.vue +++ b/ui/src/components/ai-chat/component/knowledge-source-component/ParagraphDocumentContent.vue @@ -66,7 +66,7 @@ const isPdf = computed(() => !!props.detail?.meta?.source_file_id) const pdfSrc = computed(() => { const fileId = props.detail?.meta?.source_file_id - return fileId ? `${window.MaxKB.prefix}/oss/file/${fileId}` : '' + return fileId ? `./oss/file/${fileId}` : '' }) const overlayText = computed(() => { diff --git a/ui/src/utils/common.ts b/ui/src/utils/common.ts index f3e6d83dd7e..ef92fa7c2ea 100644 --- a/ui/src/utils/common.ts +++ b/ui/src/utils/common.ts @@ -1,5 +1,5 @@ -import {nanoid} from 'nanoid' -import {t} from '@/locales' +import { nanoid } from 'nanoid' +import { t } from '@/locales' /** * 数字处理 @@ -11,7 +11,7 @@ export function toThousands(num: any) { } export function numberFormat(num: number) { - return num < 1000 ? toThousands(num): toThousands((num / 1000).toFixed(1)) + 'k' + return num < 1000 ? toThousands(num) : toThousands((num / 1000).toFixed(1)) + 'k' } export function filesize(size: number) { @@ -87,13 +87,13 @@ export function downloadByURL(url: string, name: string) { } // 替换固定数据国际化 -const i18n_default_name_map:any = { - "系统管理员": 'layout.about.inner_admin', - "工作空间管理员": 'layout.about.inner_wsm', - "普通用户": 'layout.about.inner_user', - "根目录": 'layout.about.root', - "默认工作空间": 'layout.about.default_workspace', - "默认用户组": 'layout.about.default_user_group', +const i18n_default_name_map: any = { + 系统管理员: 'layout.about.inner_admin', + 工作空间管理员: 'layout.about.inner_wsm', + 普通用户: 'layout.about.inner_user', + 根目录: 'layout.about.root', + 默认工作空间: 'layout.about.default_workspace', + 默认用户组: 'layout.about.default_user_group', } export function i18n_name(name: string) { @@ -101,7 +101,6 @@ export function i18n_name(name: string) { return key ? t(key) : name } - // 截取文件名 export function cutFilename(filename: string, num: number) { const lastIndex = filename.lastIndexOf('.') @@ -115,51 +114,51 @@ interface LoadScriptOptions { } export const loadScript = (url: string, options: LoadScriptOptions = {}): Promise => { - const { jsId, forceReload = false } = options; - const scriptId = jsId || `script-${btoa(url).slice(0, 12)}`; + const { jsId, forceReload = false } = options + const scriptId = jsId || `script-${btoa(url).slice(0, 12)}` const cleanupScript = (script: HTMLScriptElement) => { if (script && script.parentElement) { - script.parentElement.removeChild(script); + script.parentElement.removeChild(script) } - }; + } return new Promise((resolve, reject) => { if (typeof document === 'undefined') { - reject(new Error('Cannot load script in non-browser environment')); - return; + reject(new Error('Cannot load script in non-browser environment')) + return } - const existingScript = document.getElementById(scriptId) as HTMLScriptElement | null; + const existingScript = document.getElementById(scriptId) as HTMLScriptElement | null if (existingScript && !forceReload) { if (existingScript.src === url) { - console.log(`[loadScript] Reuse existing script: ${url}`); - resolve(); - return; + console.log(`[loadScript] Reuse existing script: ${url}`) + resolve() + return } - existingScript.remove(); + existingScript.remove() } - const script = document.createElement('script'); - script.id = scriptId; - script.src = url; - script.async = true; + const script = document.createElement('script') + script.id = scriptId + script.src = url + script.async = true script.onload = () => { - console.log(`[loadScript] Script loaded: ${url}`); - resolve(); - }; + console.log(`[loadScript] Script loaded: ${url}`) + resolve() + } script.onerror = () => { - console.error(`[loadScript] Failed to load: ${url}`); - cleanupScript(script); - reject(new Error(`Failed to load script: ${url}`)); - }; + console.error(`[loadScript] Failed to load: ${url}`) + cleanupScript(script) + reject(new Error(`Failed to load script: ${url}`)) + } - document.head.appendChild(script); - }); -}; + document.head.appendChild(script) + }) +} // 清理脚本（可选） const cleanupScript = (script: HTMLScriptElement) => { @@ -177,7 +176,7 @@ export function getNormalizedUrl(url: string) { export function getFileUrl(fileId?: string) { if (fileId) { - return `${window.MaxKB.prefix}/oss/file/${fileId}` + return `./oss/file/${fileId}` } return '' } From 0367e0c623889758dbcfed5bd65f021ae9509ac3 Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 10:06:29 +0800 Subject: [PATCH 4/9] fix: update translations for new chat and token index in django.po --- apps/locales/en_US/LC_MESSAGES/django.po | 3 +++ apps/locales/zh_CN/LC_MESSAGES/django.po | 3 +++ apps/locales/zh_Hant/LC_MESSAGES/django.po | 3 +++ 3 files changed, 9 insertions(+) diff --git a/apps/locales/en_US/LC_MESSAGES/django.po b/apps/locales/en_US/LC_MESSAGES/django.po index 37363750da2..e16b2487d66 100644 --- a/apps/locales/en_US/LC_MESSAGES/django.po +++ b/apps/locales/en_US/LC_MESSAGES/django.po @@ -9383,6 +9383,9 @@ msgstr "User Name" msgid "New chat" msgstr "A new conversation has been generated. Please ask your question again！" +msgid "Token Index" +msgstr "Token Index" + msgid "IAM" msgstr "IAM" diff --git a/apps/locales/zh_CN/LC_MESSAGES/django.po b/apps/locales/zh_CN/LC_MESSAGES/django.po index 042b4246c1b..2386d27d5ef 100644 --- a/apps/locales/zh_CN/LC_MESSAGES/django.po +++ b/apps/locales/zh_CN/LC_MESSAGES/django.po @@ -9506,6 +9506,9 @@ msgstr "用户名称" msgid "New chat" msgstr "已生成新对话，请重新提问！" +msgid "Token Index" +msgstr "分词索引" + msgid "IAM" msgstr "身份与权限" diff --git a/apps/locales/zh_Hant/LC_MESSAGES/django.po b/apps/locales/zh_Hant/LC_MESSAGES/django.po index 6d0ddefb9b5..b434ccaaca3 100644 --- a/apps/locales/zh_Hant/LC_MESSAGES/django.po +++ b/apps/locales/zh_Hant/LC_MESSAGES/django.po @@ -9506,6 +9506,9 @@ msgstr "用戶名稱" msgid "New chat" msgstr "已生成新對話，請重新提問！" +msgid "Token Index" +msgstr "分詞索引" + msgid "IAM" msgstr "身份與權限" From 3e7b384b8e2b6f95bf29849aceb138010a398a64 Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 10:07:24 +0800 Subject: [PATCH 5/9] fix: update permission constants for knowledge document token handling --- apps/common/constants/permission_constants.py | 25 +++++++++++++++++++ apps/knowledge/views/document.py | 4 +-- 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/apps/common/constants/permission_constants.py b/apps/common/constants/permission_constants.py index 5bdd2f8dc2e..88647c60e15 100644 --- a/apps/common/constants/permission_constants.py +++ b/apps/common/constants/permission_constants.py @@ -97,6 +97,7 @@ class Group(Enum): CHAT_USER_AUTH = "CHAT_USER_AUTH" OTHER = "OTHER" OVERVIEW = "OVERVIEW" + HOMEPAGE = "HOMEPAGE" OPERATION_LOG = "OPERATION_LOG" APPLICATION_FOLDER = "APPLICATION_FOLDER" @@ -132,6 +133,7 @@ class SystemGroup(Enum): class WorkspaceGroup(Enum): SYSTEM_MANAGEMENT = "SYSTEM_MANAGEMENT" + HOMEPAGE = "HOMEPAGE" APPLICATION = "APPLICATION" KNOWLEDGE = "KNOWLEDGE" MODEL = "MODEL" @@ -142,6 +144,7 @@ class WorkspaceGroup(Enum): class UserGroup(Enum): + HOMEPAGE = "HOMEPAGE" APPLICATION = "APPLICATION" KNOWLEDGE = "KNOWLEDGE" MODEL = "MODEL" @@ -220,6 +223,7 @@ class Operate(Enum): TRIGGER_DELETE = "READ+TRIGGER_DELETE" BATCH_DELETE = "READ+BATCH_DELETE" BATCH_MOVE = "READ+BATCH_MOVE" + TOKEN = "READ+TOKEN" # 分词索引 class RoleGroup(Enum): @@ -425,6 +429,7 @@ def get_workspace_role(self): Group.USER_GROUP.value: _("User Group"), Group.CHAT_USER_AUTH.value: _("Chat User Auth"), Group.OVERVIEW.value: _("Overview"), + Group.HOMEPAGE.value: _("Home page"), Group.SYSTEM_TOOL.value: _("Tool"), Group.SYSTEM_MODEL.value: _("Model"), Group.SYSTEM_KNOWLEDGE.value: _("Knowledge"), @@ -461,6 +466,8 @@ def get_workspace_role(self): Group.APPLICATION_FOLDER.value: _("Folder"), Group.KNOWLEDGE_FOLDER.value: _("Folder"), Group.TOOL_FOLDER.value: _("Folder"), + # SystemGroup.RESOURCE.value: _("Resource"), + Operate.TOKEN.value: _("Token Index"), TopLevelGroup.IAM.value: _("IAM"), TopLevelGroup.RESOURCE.value: _("Resource"), TopLevelGroup.SHARED.value: _("Shared"), @@ -552,6 +559,10 @@ class PermissionConstants(Enum): """ 权限枚举 """ + HOMEPAGE_READ = Permission( + group=Group.HOMEPAGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER], + parent_group=[WorkspaceGroup.HOMEPAGE, UserGroup.HOMEPAGE], + ) KNOWLEDGE = Permission( group=Group.KNOWLEDGE, operate=Operate.SELF, role_list=[RoleConstants.ADMIN, RoleConstants.USER] ) @@ -944,6 +955,12 @@ class PermissionConstants(Enum): resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANGE], parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE] ) + KNOWLEDGE_DOCUMENT_TOKEN = Permission( + group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN, + role_list=[RoleConstants.ADMIN, RoleConstants.USER], + resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW], + parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE] + ) KNOWLEDGE_HIT_TEST = Permission( group=Group.KNOWLEDGE_HIT_TEST, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER], @@ -1665,6 +1682,10 @@ class PermissionConstants(Enum): group=Group.SYSTEM_KNOWLEDGE_DOCUMENT, operate=Operate.REPLACE, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" ) + SHARED_KNOWLEDGE_DOCUMENT_TOKEN = Permission( + group=Group.SYSTEM_KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN, role_list=[RoleConstants.ADMIN], + parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" + ) SHARED_KNOWLEDGE_TAG_READ = Permission( group=Group.SYSTEM_KNOWLEDGE_TAG, operate=Operate.READ, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" @@ -1970,6 +1991,10 @@ class PermissionConstants(Enum): group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.REPLACE, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE" ) + RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN = Permission( + group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN, role_list=[RoleConstants.ADMIN], + parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE" + ) RESOURCE_KNOWLEDGE_HIT_TEST = Permission( group=Group.SYSTEM_RES_KNOWLEDGE_HIT_TEST, operate=Operate.READ, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE" diff --git a/apps/knowledge/views/document.py b/apps/knowledge/views/document.py index a39a14bd6a9..503a32bb668 100644 --- a/apps/knowledge/views/document.py +++ b/apps/knowledge/views/document.py @@ -677,8 +677,8 @@ class BatchTokenize(APIView): tags=[_("Knowledge Base/Documentation")], # type: ignore ) @has_permissions( - PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_knowledge_permission(), - PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_permission_workspace_manage_role(), + PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_knowledge_permission(), + PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_permission_workspace_manage_role(), PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_knowledge_permission(), PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(), RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), From 1db25fc424484792cecbe992c9d6ab651ed2e80b Mon Sep 17 00:00:00 2001 From: shaohuzhang1 <80892890+shaohuzhang1@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:52:08 +0800 Subject: [PATCH 6/9] fix: The opening remarks cannot transmit form_data (#6473) --- .../components/ai-chat/component/prologue-content/index.vue | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ui/src/components/ai-chat/component/prologue-content/index.vue b/ui/src/components/ai-chat/component/prologue-content/index.vue index a206fb61423..8176c63af26 100644 --- a/ui/src/components/ai-chat/component/prologue-content/index.vue +++ b/ui/src/components/ai-chat/component/prologue-content/index.vue @@ -15,7 +15,7 @@ void selection?: boolean }>() +const chatMessage = (question: string, type: 'old' | 'new', other_params_data?: any) => { + props.sendMessage(question, other_params_data) +} const showAvatar = computed(() => { return props.application.show_avatar == undefined ? true : props.application.show_avatar From 3a33351d6dd4bfc18dfa58f4a0a6102db24166f7 Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 15:07:03 +0800 Subject: [PATCH 7/9] fix: add token permissions for knowledge documents and update workspace authorization checks --- apps/locales/en_US/LC_MESSAGES/django.po | 3 + apps/locales/zh_CN/LC_MESSAGES/django.po | 3 + apps/locales/zh_Hant/LC_MESSAGES/django.po | 3 + ui/src/permission/knowledge/system-manage.ts | 3 + ui/src/permission/knowledge/system-share.ts | 4 + .../permission/knowledge/workspace-share.ts | 2 + ui/src/permission/knowledge/workspace.ts | 24 ++++- ui/src/permission/model/system-manage.ts | 24 ++--- ui/src/permission/model/system-share.ts | 52 ++--------- ui/src/permission/model/workspace.ts | 93 ++++++++++++------- ui/src/permission/tool/system-manage.ts | 1 + ui/src/permission/tool/system-share.ts | 2 + ui/src/permission/tool/workspace.ts | 1 + ui/src/utils/permission/data.ts | 10 +- ui/src/views/document/index.vue | 10 +- .../component/KnowledgeListContainer.vue | 2 +- ui/src/views/model/component/ModelCard.vue | 2 +- .../tool/component/ToolListContainer.vue | 2 +- 18 files changed, 140 insertions(+), 101 deletions(-) diff --git a/apps/locales/en_US/LC_MESSAGES/django.po b/apps/locales/en_US/LC_MESSAGES/django.po index e16b2487d66..4b9c70211f9 100644 --- a/apps/locales/en_US/LC_MESSAGES/django.po +++ b/apps/locales/en_US/LC_MESSAGES/django.po @@ -9386,6 +9386,9 @@ msgstr "A new conversation has been generated. Please ask your question again！ msgid "Token Index" msgstr "Token Index" +msgid "Authorize to Workspace" +msgstr "" + msgid "IAM" msgstr "IAM" diff --git a/apps/locales/zh_CN/LC_MESSAGES/django.po b/apps/locales/zh_CN/LC_MESSAGES/django.po index 2386d27d5ef..f153bc8d077 100644 --- a/apps/locales/zh_CN/LC_MESSAGES/django.po +++ b/apps/locales/zh_CN/LC_MESSAGES/django.po @@ -9509,6 +9509,9 @@ msgstr "已生成新对话，请重新提问！" msgid "Token Index" msgstr "分词索引" +msgid "Authorize to Workspace" +msgstr "授权工作空间" + msgid "IAM" msgstr "身份与权限" diff --git a/apps/locales/zh_Hant/LC_MESSAGES/django.po b/apps/locales/zh_Hant/LC_MESSAGES/django.po index b434ccaaca3..d30553a000d 100644 --- a/apps/locales/zh_Hant/LC_MESSAGES/django.po +++ b/apps/locales/zh_Hant/LC_MESSAGES/django.po @@ -9509,6 +9509,9 @@ msgstr "已生成新對話，請重新提問！" msgid "Token Index" msgstr "分詞索引" +msgid "Authorize to Workspace" +msgstr "授權工作空間" + msgid "IAM" msgstr "身份與權限" diff --git a/ui/src/permission/knowledge/system-manage.ts b/ui/src/permission/knowledge/system-manage.ts index 89b52fb72b1..cfc602e4aee 100644 --- a/ui/src/permission/knowledge/system-manage.ts +++ b/ui/src/permission/knowledge/system-manage.ts @@ -39,6 +39,8 @@ const systemManage = { hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_CREATE], 'OR'), doc_vector: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_VECTOR], 'OR'), + doc_token: () => + hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN], 'OR'), doc_generate: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_GENERATE], 'OR'), doc_migrate: () => @@ -102,6 +104,7 @@ const systemManage = { auth: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_AUTH], 'OR'), relate_map: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_RELATE_RESOURCE_VIEW], 'OR'), + auth_to_workspace: () => false, folderRead: () => false, folderManage: () => false, folderCreate: () => false, diff --git a/ui/src/permission/knowledge/system-share.ts b/ui/src/permission/knowledge/system-share.ts index f7828403efa..20941046bfa 100644 --- a/ui/src/permission/knowledge/system-share.ts +++ b/ui/src/permission/knowledge/system-share.ts @@ -28,6 +28,8 @@ const share = { hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_DOCUMENT_CREATE], 'OR'), doc_vector: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_DOCUMENT_VECTOR], 'OR'), + doc_token: () => + hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_DOCUMENT_TOKEN], 'OR'), doc_generate: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_DOCUMENT_GENERATE], 'OR'), doc_migrate: () => @@ -87,6 +89,8 @@ const share = { auth: () => false, relate_map: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_RELATE_RESOURCE_VIEW], 'OR'), + auth_to_workspace: () => + hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_KNOWLEDGE_TO_WORKSPACE], 'OR'), folderRead: () => false, folderManage: () => false, folderCreate: () => false, diff --git a/ui/src/permission/knowledge/workspace-share.ts b/ui/src/permission/knowledge/workspace-share.ts index f459603561a..2d3e42a8e2d 100644 --- a/ui/src/permission/knowledge/workspace-share.ts +++ b/ui/src/permission/knowledge/workspace-share.ts @@ -20,6 +20,7 @@ const workspaceShare = { jump_read: () => false, doc_create: () => false, doc_vector: () => false, + doc_token: () => false, doc_generate: () => false, doc_migrate: () => false, doc_edit: () => false, @@ -60,6 +61,7 @@ const workspaceShare = { debug: () => false, workflow_edit: () => false, workflow_export: () => false, + auth_to_workspace: () => false, } export default workspaceShare diff --git a/ui/src/permission/knowledge/workspace.ts b/ui/src/permission/knowledge/workspace.ts index b42228aa086..079f6ed2f5e 100644 --- a/ui/src/permission/knowledge/workspace.ts +++ b/ui/src/permission/knowledge/workspace.ts @@ -215,6 +215,7 @@ const workspace = { ], 'OR', ), + auth_to_workspace: () => false, export: (source_id: string) => hasPermission( [ @@ -312,6 +313,21 @@ const workspace = { ], 'OR', ), + doc_token: (source_id: string) => + hasPermission( + [ + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), + RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, + PermissionConst.KNOWLEDGE_DOCUMENT_TOKEN.getKnowledgeWorkspaceResourcePermission(source_id), + PermissionConst.KNOWLEDGE_DOCUMENT_TOKEN.getWorkspacePermissionWorkspaceManageRole, + ], + 'OR', + ), doc_generate: (source_id: string) => hasPermission( [ @@ -576,7 +592,9 @@ const workspace = { 'AND', ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, - PermissionConst.KNOWLEDGE_TERMBASE_CREATE.getKnowledgeWorkspaceResourcePermission(source_id), + PermissionConst.KNOWLEDGE_TERMBASE_CREATE.getKnowledgeWorkspaceResourcePermission( + source_id, + ), PermissionConst.KNOWLEDGE_TERMBASE_CREATE.getWorkspacePermissionWorkspaceManageRole, ], 'OR', @@ -591,7 +609,9 @@ const workspace = { 'AND', ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, - PermissionConst.KNOWLEDGE_TERMBASE_DELETE.getKnowledgeWorkspaceResourcePermission(source_id), + PermissionConst.KNOWLEDGE_TERMBASE_DELETE.getKnowledgeWorkspaceResourcePermission( + source_id, + ), PermissionConst.KNOWLEDGE_TERMBASE_DELETE.getWorkspacePermissionWorkspaceManageRole, ], 'OR', diff --git a/ui/src/permission/model/system-manage.ts b/ui/src/permission/model/system-manage.ts index dd498d1872b..d9b909e3954 100644 --- a/ui/src/permission/model/system-manage.ts +++ b/ui/src/permission/model/system-manage.ts @@ -14,22 +14,14 @@ const systemManage = { ), create: () => false, jump_read: () => false, - modify: () => - hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_EDIT], 'OR'), - paramSetting: () => - hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_EDIT], 'OR'), - delete: () => - hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_DELETE], 'OR'), + modify: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_EDIT], 'OR'), + paramSetting: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_EDIT], 'OR'), + delete: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_DELETE], 'OR'), + + auth: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_AUTH], 'OR'), + relate_map: () => + hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_RELATE_RESOURCE_VIEW], 'OR'), - auth: () => - hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_MODEL_AUTH], 'OR'), - relate_map: () => - hasPermission([ - RoleConst.ADMIN, - PermissionConst.RESOURCE_MODEL_RELATE_RESOURCE_VIEW - ],'OR' - ), - folderRead: () => false, folderManage: () => false, folderCreate: () => false, @@ -37,7 +29,7 @@ const systemManage = { folderAuth: () => false, folderDelete: () => false, debug: () => false, - + auth_to_workspace: () => false, } export default systemManage diff --git a/ui/src/permission/model/system-share.ts b/ui/src/permission/model/system-share.ts index ec4c5a0bf64..a52629f9da9 100644 --- a/ui/src/permission/model/system-share.ts +++ b/ui/src/permission/model/system-share.ts @@ -1,51 +1,19 @@ -import {hasPermission} from '@/utils/permission/index' -import {ComplexPermission} from '@/utils/permission/type' -import {EditionConst, PermissionConst, RoleConst} from '@/utils/permission/data' +import { hasPermission } from '@/utils/permission/index' +import { ComplexPermission } from '@/utils/permission/type' +import { EditionConst, PermissionConst, RoleConst } from '@/utils/permission/data' const share = { is_share: () => false, jump_read: () => false, - create: () => - hasPermission( - [ - RoleConst.ADMIN, - PermissionConst.SHARED_MODEL_CREATE, - ], - 'OR', - ), - modify: () => - hasPermission( - [ - RoleConst.ADMIN, - PermissionConst.SHARED_MODEL_EDIT, - ], - 'OR', - ), - paramSetting: () => - hasPermission( - [ - RoleConst.ADMIN, - PermissionConst.SHARED_MODEL_EDIT, - ], - 'OR', - ), - delete: () => - hasPermission( - [ - RoleConst.ADMIN, - PermissionConst.SHARED_MODEL_DELETE, - ], - 'OR', - ), + create: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_CREATE], 'OR'), + modify: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_EDIT], 'OR'), + paramSetting: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_EDIT], 'OR'), + delete: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_DELETE], 'OR'), auth: () => false, relate_map: () => - hasPermission( - [ - RoleConst.ADMIN, - PermissionConst.SHARED_MODEL_RELATE_RESOURCE_VIEW, - ], - 'OR', - ), + hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_RELATE_RESOURCE_VIEW], 'OR'), + auth_to_workspace: () => + hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_MODEL_TO_WORKSPACE], 'OR'), folderRead: () => false, folderManage: () => false, folderCreate: () => false, diff --git a/ui/src/permission/model/workspace.ts b/ui/src/permission/model/workspace.ts index 83bb59fdc5d..d7e39a4fb2e 100644 --- a/ui/src/permission/model/workspace.ts +++ b/ui/src/permission/model/workspace.ts @@ -5,9 +5,14 @@ const workspace = { is_share: () => hasPermission( new ComplexPermission( - [RoleConst.USER.getWorkspaceRole,RoleConst.WORKSPACE_MANAGE.getWorkspaceRole], - [PermissionConst.MODEL_READ.getWorkspacePermission,PermissionConst.MODEL_READ.getWorkspacePermissionWorkspaceManageRole], - [EditionConst.IS_EE],'OR'), + [RoleConst.USER.getWorkspaceRole, RoleConst.WORKSPACE_MANAGE.getWorkspaceRole], + [ + PermissionConst.MODEL_READ.getWorkspacePermission, + PermissionConst.MODEL_READ.getWorkspacePermissionWorkspaceManageRole, + ], + [EditionConst.IS_EE], + 'OR', + ), 'OR', ), jump_read: () => false, @@ -17,9 +22,9 @@ const workspace = { RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, RoleConst.USER.getWorkspaceRole, PermissionConst.MODEL_CREATE.getWorkspacePermission, - PermissionConst.MODEL_CREATE.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_CREATE.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), folderRead: () => true, folderManage: () => true, @@ -30,39 +35,54 @@ const workspace = { RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, RoleConst.USER.getWorkspaceRole, PermissionConst.MODEL_CREATE.getWorkspacePermission, - PermissionConst.MODEL_CREATE.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_CREATE.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), - modify: (source_id:string) => + modify: (source_id: string) => hasPermission( [ - new ComplexPermission([RoleConst.USER],[PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)],[],'AND'), + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, PermissionConst.MODEL_EDIT.getModelWorkspaceResourcePermission(source_id), - PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), - auth: (source_id:string) => + auth: (source_id: string) => hasPermission( [ - new ComplexPermission([RoleConst.USER],[PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)],[],'AND'), + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, PermissionConst.MODEL_RESOURCE_AUTHORIZATION.getModelWorkspaceResourcePermission(source_id), - PermissionConst.MODEL_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), - relate_map: (source_id:string) => + relate_map: (source_id: string) => hasPermission( [ - new ComplexPermission([RoleConst.USER],[PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)],[],'AND'), + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, PermissionConst.MODEL_RELATE_RESOURCE_VIEW.getModelWorkspaceResourcePermission(source_id), - PermissionConst.MODEL_RELATE_RESOURCE_VIEW.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_RELATE_RESOURCE_VIEW.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), folderEdit: () => hasPermission( @@ -70,29 +90,39 @@ const workspace = { RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, RoleConst.USER.getWorkspaceRole, PermissionConst.MODEL_EDIT.getWorkspacePermission, - PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), - paramSetting: (source_id:string) => + paramSetting: (source_id: string) => hasPermission( [ - new ComplexPermission([RoleConst.USER],[PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)],[],'AND'), + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, PermissionConst.MODEL_EDIT.getModelWorkspaceResourcePermission(source_id), - PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), - delete: (source_id:string) => + delete: (source_id: string) => hasPermission( [ - new ComplexPermission([RoleConst.USER],[PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)],[],'AND'), + new ComplexPermission( + [RoleConst.USER], + [PermissionConst.MODEL.getModelWorkspaceResourcePermission(source_id)], + [], + 'AND', + ), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, PermissionConst.MODEL_DELETE.getModelWorkspaceResourcePermission(source_id), - PermissionConst.MODEL_DELETE.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_DELETE.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), folderDelete: () => hasPermission( @@ -100,10 +130,11 @@ const workspace = { RoleConst.WORKSPACE_MANAGE.getWorkspaceRole, RoleConst.USER.getWorkspaceRole, PermissionConst.MODEL_DELETE.getWorkspacePermission, - PermissionConst.MODEL_DELETE.getWorkspacePermissionWorkspaceManageRole + PermissionConst.MODEL_DELETE.getWorkspacePermissionWorkspaceManageRole, ], - 'OR' + 'OR', ), + auth_to_workspace: () => false, debug: () => false, } diff --git a/ui/src/permission/tool/system-manage.ts b/ui/src/permission/tool/system-manage.ts index 304dbc48d39..4399ee5941e 100644 --- a/ui/src/permission/tool/system-manage.ts +++ b/ui/src/permission/tool/system-manage.ts @@ -46,6 +46,7 @@ const systemManage = { folderEdit: () => false, folderAuth: () => false, folderDelete: () => false, + auth_to_workspace: () => false, } export default systemManage diff --git a/ui/src/permission/tool/system-share.ts b/ui/src/permission/tool/system-share.ts index 229033128c0..c7426559f15 100644 --- a/ui/src/permission/tool/system-share.ts +++ b/ui/src/permission/tool/system-share.ts @@ -25,6 +25,8 @@ const share = { auth: () => false, relate_map: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_TOOL_RELATE_RESOURCE_VIEW], 'OR'), + auth_to_workspace: () => + hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_TOOL_TO_WORKSPACE], 'OR'), record: () => hasPermission([RoleConst.ADMIN, PermissionConst.SHARED_TOOL_EXECUTE_RECORD], 'OR'), folderRead: () => false, folderManage: () => false, diff --git a/ui/src/permission/tool/workspace.ts b/ui/src/permission/tool/workspace.ts index f81617af2ab..29da164da66 100644 --- a/ui/src/permission/tool/workspace.ts +++ b/ui/src/permission/tool/workspace.ts @@ -351,6 +351,7 @@ const workspace = { ], 'OR', ), + auth_to_workspace: () => false, } export default workspace diff --git a/ui/src/utils/permission/data.ts b/ui/src/utils/permission/data.ts index 61e794f02aa..dfeac345e15 100644 --- a/ui/src/utils/permission/data.ts +++ b/ui/src/utils/permission/data.ts @@ -149,6 +149,7 @@ const PermissionConst = { KNOWLEDGE_DOCUMENT_SYNC: new Permission('KNOWLEDGE_DOCUMENT:READ+SYNC'), KNOWLEDGE_DOCUMENT_MIGRATE: new Permission('KNOWLEDGE_DOCUMENT:READ+MIGRATE'), KNOWLEDGE_DOCUMENT_VECTOR: new Permission('KNOWLEDGE_DOCUMENT:READ+VECTOR'), + KNOWLEDGE_DOCUMENT_TOKEN: new Permission('KNOWLEDGE_DOCUMENT:READ+TOKEN'), KNOWLEDGE_DOCUMENT_GENERATE: new Permission('KNOWLEDGE_DOCUMENT:READ+GENERATE'), KNOWLEDGE_DOCUMENT_EXPORT: new Permission('KNOWLEDGE_DOCUMENT:READ+EXPORT'), KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE: new Permission('KNOWLEDGE_DOCUMENT:READ+DOWNLOAD'), @@ -221,13 +222,13 @@ const PermissionConst = { SHARED_TOOL_EXPORT: new Permission('SYSTEM_TOOL:READ+EXPORT'), SHARED_TOOL_RELATE_RESOURCE_VIEW: new Permission('SYSTEM_TOOL:READ+RELATE_VIEW'), SHARED_TOOL_EXECUTE_RECORD: new Permission('SYSTEM_TOOL:READ+RECORD'), - + SHARED_TOOL_TO_WORKSPACE: new Permission('SYSTEM_TOOL:READ+TO_WORKSPACE'), SHARED_MODEL_READ: new Permission('SYSTEM_MODEL:READ'), SHARED_MODEL_CREATE: new Permission('SYSTEM_MODEL:READ+CREATE'), SHARED_MODEL_EDIT: new Permission('SYSTEM_MODEL:READ+EDIT'), SHARED_MODEL_DELETE: new Permission('SYSTEM_MODEL:READ+DELETE'), SHARED_MODEL_RELATE_RESOURCE_VIEW: new Permission('SYSTEM_MODEL:READ+RELATE_VIEW'), - + SHARED_MODEL_TO_WORKSPACE: new Permission('SYSTEM_MODEL:READ+TO_WORKSPACE'), SHARED_KNOWLEDGE_READ: new Permission('SYSTEM_KNOWLEDGE:READ'), SHARED_KNOWLEDGE_CREATE: new Permission('SYSTEM_KNOWLEDGE:READ+CREATE'), SHARED_KNOWLEDGE_EDIT: new Permission('SYSTEM_KNOWLEDGE:READ+EDIT'), @@ -237,6 +238,7 @@ const PermissionConst = { SHARED_KNOWLEDGE_GENERATE: new Permission('SYSTEM_KNOWLEDGE:READ+GENERATE'), SHARED_KNOWLEDGE_DELETE: new Permission('SYSTEM_KNOWLEDGE:READ+DELETE'), SHARED_KNOWLEDGE_RELATE_RESOURCE_VIEW: new Permission('SYSTEM_KNOWLEDGE:READ+RELATE_VIEW'), + SHARED_KNOWLEDGE_TO_WORKSPACE: new Permission('SYSTEM_KNOWLEDGE:READ+TO_WORKSPACE'), SHARED_KNOWLEDGE_WORKFLOW_READ: new Permission('SYSTEM_KNOWLEDGE_WORKFLOW:READ'), SHARED_KNOWLEDGE_WORKFLOW_EDIT: new Permission('SYSTEM_KNOWLEDGE_WORKFLOW:READ+EDIT'), @@ -248,6 +250,7 @@ const PermissionConst = { SHARED_KNOWLEDGE_DOCUMENT_DELETE: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+DELETE'), SHARED_KNOWLEDGE_DOCUMENT_SYNC: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+SYNC'), SHARED_KNOWLEDGE_DOCUMENT_VECTOR: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+VECTOR'), + SHARED_KNOWLEDGE_DOCUMENT_TOKEN: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+TOKEN'), SHARED_KNOWLEDGE_DOCUMENT_GENERATE: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+GENERATE'), SHARED_KNOWLEDGE_DOCUMENT_MIGRATE: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+MIGRATE'), SHARED_KNOWLEDGE_DOCUMENT_EXPORT: new Permission('SYSTEM_KNOWLEDGE_DOCUMENT:READ+EXPORT'), @@ -335,6 +338,9 @@ const PermissionConst = { RESOURCE_KNOWLEDGE_DOCUMENT_VECTOR: new Permission( 'SYSTEM_RESOURCE_KNOWLEDGE_DOCUMENT:READ+VECTOR', ), + RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN: new Permission( + 'SYSTEM_RESOURCE_KNOWLEDGE_DOCUMENT:READ+TOKEN', + ), RESOURCE_KNOWLEDGE_DOCUMENT_GENERATE: new Permission( 'SYSTEM_RESOURCE_KNOWLEDGE_DOCUMENT:READ+GENERATE', ), diff --git a/ui/src/views/document/index.vue b/ui/src/views/document/index.vue index c44ce3c96ff..c1862bd9149 100644 --- a/ui/src/views/document/index.vue +++ b/ui/src/views/document/index.vue @@ -53,7 +53,7 @@ {{ $t('views.knowledge.customSegmentation.wordIndexing') }} @@ -597,7 +597,7 @@ placement="top" v-else > - + @@ -764,7 +764,7 @@ placement="top" v-else > - + diff --git a/ui/src/views/model/component/ModelCard.vue b/ui/src/views/model/component/ModelCard.vue index 8e64dc5b28e..d9e75e56525 100644 --- a/ui/src/views/model/component/ModelCard.vue +++ b/ui/src/views/model/component/ModelCard.vue @@ -84,7 +84,7 @@ {{ $t('common.edit') }} diff --git a/ui/src/views/tool/component/ToolListContainer.vue b/ui/src/views/tool/component/ToolListContainer.vue index fc74d9005fc..b5f5ceeb997 100644 --- a/ui/src/views/tool/component/ToolListContainer.vue +++ b/ui/src/views/tool/component/ToolListContainer.vue @@ -382,7 +382,7 @@ {{ $t('common.moveTo') }} From dbdd389c13711d5c2335e0217684caed028b3e4c Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 15:10:32 +0800 Subject: [PATCH 8/9] chore: update community submodule commit hash --- apps/common/constants/permission_constants.py | 14 ++++++++++++++ apps/knowledge/views/document.py | 2 -- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/apps/common/constants/permission_constants.py b/apps/common/constants/permission_constants.py index 88647c60e15..1dd9c5e0ab3 100644 --- a/apps/common/constants/permission_constants.py +++ b/apps/common/constants/permission_constants.py @@ -224,6 +224,7 @@ class Operate(Enum): BATCH_DELETE = "READ+BATCH_DELETE" BATCH_MOVE = "READ+BATCH_MOVE" TOKEN = "READ+TOKEN" # 分词索引 + TO_WORKSPACE= "READ+TO_WORKSPACE" # 授权到空间 class RoleGroup(Enum): @@ -468,6 +469,7 @@ def get_workspace_role(self): Group.TOOL_FOLDER.value: _("Folder"), # SystemGroup.RESOURCE.value: _("Resource"), Operate.TOKEN.value: _("Token Index"), + Operate.TO_WORKSPACE.value: _("Authorize to Workspace"), TopLevelGroup.IAM.value: _("IAM"), TopLevelGroup.RESOURCE.value: _("Resource"), TopLevelGroup.SHARED.value: _("Shared"), @@ -1582,6 +1584,10 @@ class PermissionConstants(Enum): group=Group.SYSTEM_TOOL, operate=Operate.RECORD, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_TOOL], is_ee=settings.edition == "EE" ) + SHARED_TOOL_TO_WORKSPACE = Permission( + group=Group.SYSTEM_TOOL, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN], + parent_group=[SystemGroup.SHARED_TOOL], is_ee=settings.edition == "EE" + ) SHARED_KNOWLEDGE_READ = Permission( group=Group.SYSTEM_KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" @@ -1618,6 +1624,10 @@ class PermissionConstants(Enum): group=Group.SYSTEM_KNOWLEDGE, operate=Operate.RELATE_VIEW, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" ) + SHARED_KNOWLEDGE_TO_WORKSPACE = Permission( + group=Group.SYSTEM_KNOWLEDGE, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN], + parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" + ) SHARED_KNOWLEDGE_WORKFLOW_READ = Permission( group=Group.SYSTEM_KNOWLEDGE_WORKFLOW, operate=Operate.READ, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE" @@ -1775,6 +1785,10 @@ class PermissionConstants(Enum): group=Group.SYSTEM_MODEL, operate=Operate.RELATE_VIEW, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.SHARED_MODEL], is_ee=settings.edition == "EE" ) + SHARED_MODEL_TO_WORKSPACE = Permission( + group=Group.SYSTEM_MODEL, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN], + parent_group=[SystemGroup.SHARED_MODEL], is_ee=settings.edition == "EE" + ) RESOURCE_APPLICATION_READ = Permission( group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ, role_list=[RoleConstants.ADMIN], parent_group=[SystemGroup.RESOURCE_APPLICATION], is_ee=settings.edition == "EE" diff --git a/apps/knowledge/views/document.py b/apps/knowledge/views/document.py index 503a32bb668..1984ed4b54a 100644 --- a/apps/knowledge/views/document.py +++ b/apps/knowledge/views/document.py @@ -679,8 +679,6 @@ class BatchTokenize(APIView): @has_permissions( PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_knowledge_permission(), PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_permission_workspace_manage_role(), - PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_knowledge_permission(), - PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(), RoleConstants.WORKSPACE_MANAGE.get_workspace_role(), ViewPermission( [RoleConstants.USER.get_workspace_role()], From b5275a0c71a3da341e07b006ef769e2a9b582a1a Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Tue, 21 Jul 2026 16:14:49 +0800 Subject: [PATCH 9/9] fix: add HOMEPAGE_EXPORT permission and update related authorization checks --- apps/common/constants/permission_constants.py | 4 ++ apps/homepage/views/homepage.py | 41 +++++++++++++++++++ ui/src/utils/permission/data.ts | 1 + ui/src/views/home/component/RankingDrawer.vue | 26 +++++++++--- 4 files changed, 67 insertions(+), 5 deletions(-) diff --git a/apps/common/constants/permission_constants.py b/apps/common/constants/permission_constants.py index 1dd9c5e0ab3..f1d0b863952 100644 --- a/apps/common/constants/permission_constants.py +++ b/apps/common/constants/permission_constants.py @@ -565,6 +565,10 @@ class PermissionConstants(Enum): group=Group.HOMEPAGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER], parent_group=[WorkspaceGroup.HOMEPAGE, UserGroup.HOMEPAGE], ) + HOMEPAGE_EXPORT = Permission( + group=Group.HOMEPAGE, operate=Operate.EXPORT, role_list=[RoleConstants.ADMIN, RoleConstants.USER], + parent_group=[WorkspaceGroup.HOMEPAGE, UserGroup.HOMEPAGE], + ) KNOWLEDGE = Permission( group=Group.KNOWLEDGE, operate=Operate.SELF, role_list=[RoleConstants.ADMIN, RoleConstants.USER] ) diff --git a/apps/homepage/views/homepage.py b/apps/homepage/views/homepage.py index 1dea5cf8d47..0cb04f68afa 100644 --- a/apps/homepage/views/homepage.py +++ b/apps/homepage/views/homepage.py @@ -13,6 +13,8 @@ from application.api.application_stats import ApplicationStatsAPI from common import result from common.auth import TokenAuth +from common.auth.authentication import has_permissions +from common.constants.permission_constants import PermissionConstants, RoleConstants from homepage.api.home_page_api import ApplicationTokensRankingAPI, ApplicationQuestionRankingAPI, UserTokensRankingAPI, \ ApplicationAggregationAPI, KnowledgeAggregationAPI, ToolAggregationAPI, ModelAggregationAPI, \ ApplicationMonitoringAPI, RankingBaseAPI, TokensAggregationAPI, RankingBaseExportAPI @@ -35,6 +37,9 @@ class ChatRecordAggregation(APIView): responses=TokensAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.ChatRecordAggregation( @@ -57,6 +62,9 @@ class TokensAggregation(APIView): responses=TokensAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.TokensAggregation( @@ -79,6 +87,9 @@ class ApplicationTokensRankingExport(APIView): responses=RankingBaseExportAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return HomePageSerializer.ApplicationTokensRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -101,6 +112,9 @@ class ApplicationTokensRanking(APIView): responses=ApplicationTokensRankingAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str, current_page: int, page_size: int): return result.success(HomePageSerializer.ApplicationTokensRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -123,6 +137,9 @@ class ApplicationQuestionRankingExport(APIView): responses=RankingBaseExportAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return HomePageSerializer.ApplicationQuestionRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -145,6 +162,9 @@ class ApplicationQuestionRanking(APIView): responses=ApplicationQuestionRankingAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str, current_page: int, page_size: int): return result.success(HomePageSerializer.ApplicationQuestionRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -167,6 +187,9 @@ class UserTokensRankingExport(APIView): responses=RankingBaseExportAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return HomePageSerializer.ApplicationUserTokenRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -188,6 +211,9 @@ class UserTokensRanking(APIView): responses=UserTokensRankingAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str, current_page: int, page_size: int): return result.success(HomePageSerializer.ApplicationUserTokenRanking( data={'user_id': request.user.id, 'workspace_id': workspace_id, @@ -210,6 +236,9 @@ class ApplicationMonitoring(APIView): responses=ApplicationMonitoringAPI.get_response(), tags=[_('Home page')] # type: ignore ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.ApplicationMonitoring( @@ -234,6 +263,9 @@ class ApplicationAggregation(APIView): responses=ApplicationAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.Application( @@ -252,6 +284,9 @@ class KnowledgeAggregation(APIView): responses=KnowledgeAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.Knowledge( @@ -270,6 +305,9 @@ class ToolAggregation(APIView): responses=ToolAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.Tool( @@ -288,6 +326,9 @@ class ModelAggregation(APIView): responses=ModelAggregationAPI.get_response(), tags=[_("Home page")], ) + @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(), + RoleConstants.USER.get_workspace_role(), + RoleConstants.WORKSPACE_MANAGE.get_workspace_role()) def get(self, request: Request, workspace_id: str): return result.success( HomePageSerializer.Model( diff --git a/ui/src/utils/permission/data.ts b/ui/src/utils/permission/data.ts index dfeac345e15..afb030465ee 100644 --- a/ui/src/utils/permission/data.ts +++ b/ui/src/utils/permission/data.ts @@ -25,6 +25,7 @@ import { Permission, Role, Edition } from '@/utils/permission/type' // CLEAR_POLICY = "READ+CLEAR_POLICY" const PermissionConst = { HOMEPAGE_READ: new Permission('HOMEPAGE:READ'), + HOMEPAGE_EXPORT: new Permission('HOMEPAGE:READ+EXPORT'), APPLICATION: new Permission('APPLICATION'), KNOWLEDGE: new Permission('KNOWLEDGE'), TOOL: new Permission('TOOL'), diff --git a/ui/src/views/home/component/RankingDrawer.vue b/ui/src/views/home/component/RankingDrawer.vue index 767726ff93e..9be14f9c66f 100644 --- a/ui/src/views/home/component/RankingDrawer.vue +++ b/ui/src/views/home/component/RankingDrawer.vue @@ -40,7 +40,20 @@ @change="changeDayRangeHandle" /> - + {{ $t('common.export') }} @@ -270,13 +283,17 @@