fix: add HOMEPAGE_EXPORT permission and update related authorization checks

apps/common/constants/permission_constants.py

@@ -97,6 +97,7 @@ class Group(Enum):
     CHAT_USER_AUTH = "CHAT_USER_AUTH"
     OTHER = "OTHER"
     OVERVIEW = "OVERVIEW"
+    HOMEPAGE = "HOMEPAGE"
     OPERATION_LOG = "OPERATION_LOG"
 
     APPLICATION_FOLDER = "APPLICATION_FOLDER"
@@ -132,6 +133,7 @@ class SystemGroup(Enum):
 
 class WorkspaceGroup(Enum):
     SYSTEM_MANAGEMENT = "SYSTEM_MANAGEMENT"
+    HOMEPAGE = "HOMEPAGE"
     APPLICATION = "APPLICATION"
     KNOWLEDGE = "KNOWLEDGE"
     MODEL = "MODEL"
@@ -142,6 +144,7 @@ class WorkspaceGroup(Enum):
 
 
 class UserGroup(Enum):
+    HOMEPAGE = "HOMEPAGE"
     APPLICATION = "APPLICATION"
     KNOWLEDGE = "KNOWLEDGE"
     MODEL = "MODEL"
@@ -220,6 +223,8 @@ class Operate(Enum):
     TRIGGER_DELETE = "READ+TRIGGER_DELETE"
     BATCH_DELETE = "READ+BATCH_DELETE"
     BATCH_MOVE = "READ+BATCH_MOVE"
+    TOKEN = "READ+TOKEN" # 分词索引
+    TO_WORKSPACE= "READ+TO_WORKSPACE" # 授权到空间
 
 
 class RoleGroup(Enum):
@@ -425,6 +430,7 @@ def get_workspace_role(self):
     Group.USER_GROUP.value: _("User Group"),
     Group.CHAT_USER_AUTH.value: _("Chat User Auth"),
     Group.OVERVIEW.value: _("Overview"),
+    Group.HOMEPAGE.value: _("Home page"),
     Group.SYSTEM_TOOL.value: _("Tool"),
     Group.SYSTEM_MODEL.value: _("Model"),
     Group.SYSTEM_KNOWLEDGE.value: _("Knowledge"),
@@ -461,6 +467,9 @@ def get_workspace_role(self):
     Group.APPLICATION_FOLDER.value: _("Folder"),
     Group.KNOWLEDGE_FOLDER.value: _("Folder"),
     Group.TOOL_FOLDER.value: _("Folder"),
+    # SystemGroup.RESOURCE.value: _("Resource"),
+    Operate.TOKEN.value: _("Token Index"),
+    Operate.TO_WORKSPACE.value: _("Authorize to Workspace"),
     TopLevelGroup.IAM.value: _("IAM"),
     TopLevelGroup.RESOURCE.value: _("Resource"),
     TopLevelGroup.SHARED.value: _("Shared"),
@@ -552,6 +561,14 @@ class PermissionConstants(Enum):
     """
      权限枚举
     """
+    HOMEPAGE_READ = Permission(
+        group=Group.HOMEPAGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.HOMEPAGE, UserGroup.HOMEPAGE],
+    )
+    HOMEPAGE_EXPORT = Permission(
+        group=Group.HOMEPAGE, operate=Operate.EXPORT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.HOMEPAGE, UserGroup.HOMEPAGE],
+    )
     KNOWLEDGE = Permission(
         group=Group.KNOWLEDGE, operate=Operate.SELF, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
     )
@@ -944,6 +961,12 @@ class PermissionConstants(Enum):
         resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANGE],
         parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
+    KNOWLEDGE_DOCUMENT_TOKEN = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
     KNOWLEDGE_HIT_TEST = Permission(
         group=Group.KNOWLEDGE_HIT_TEST, operate=Operate.READ,
         role_list=[RoleConstants.ADMIN, RoleConstants.USER],
@@ -1565,6 +1588,10 @@ class PermissionConstants(Enum):
         group=Group.SYSTEM_TOOL, operate=Operate.RECORD, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_TOOL], is_ee=settings.edition == "EE"
     )
+    SHARED_TOOL_TO_WORKSPACE = Permission(
+        group=Group.SYSTEM_TOOL, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.SHARED_TOOL], is_ee=settings.edition == "EE"
+    )
     SHARED_KNOWLEDGE_READ = Permission(
         group=Group.SYSTEM_KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
@@ -1601,6 +1628,10 @@ class PermissionConstants(Enum):
         group=Group.SYSTEM_KNOWLEDGE, operate=Operate.RELATE_VIEW, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
     )
+    SHARED_KNOWLEDGE_TO_WORKSPACE = Permission(
+        group=Group.SYSTEM_KNOWLEDGE, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
+    )
     SHARED_KNOWLEDGE_WORKFLOW_READ = Permission(
         group=Group.SYSTEM_KNOWLEDGE_WORKFLOW, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
@@ -1665,6 +1696,10 @@ class PermissionConstants(Enum):
         group=Group.SYSTEM_KNOWLEDGE_DOCUMENT, operate=Operate.REPLACE, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
     )
+    SHARED_KNOWLEDGE_DOCUMENT_TOKEN = Permission(
+        group=Group.SYSTEM_KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
+    )
     SHARED_KNOWLEDGE_TAG_READ = Permission(
         group=Group.SYSTEM_KNOWLEDGE_TAG, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_KNOWLEDGE], is_ee=settings.edition == "EE"
@@ -1754,6 +1789,10 @@ class PermissionConstants(Enum):
         group=Group.SYSTEM_MODEL, operate=Operate.RELATE_VIEW, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.SHARED_MODEL], is_ee=settings.edition == "EE"
     )
+    SHARED_MODEL_TO_WORKSPACE = Permission(
+        group=Group.SYSTEM_MODEL, operate=Operate.TO_WORKSPACE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.SHARED_MODEL], is_ee=settings.edition == "EE"
+    )
     RESOURCE_APPLICATION_READ = Permission(
         group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.RESOURCE_APPLICATION], is_ee=settings.edition == "EE"
@@ -1970,6 +2009,10 @@ class PermissionConstants(Enum):
         group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.REPLACE, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE"
     )
+    RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN = Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.TOKEN, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE"
+    )
     RESOURCE_KNOWLEDGE_HIT_TEST = Permission(
         group=Group.SYSTEM_RES_KNOWLEDGE_HIT_TEST, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
         parent_group=[SystemGroup.RESOURCE_KNOWLEDGE], is_ee=settings.edition == "EE"

apps/homepage/views/homepage.py

@@ -13,6 +13,8 @@
 from application.api.application_stats import ApplicationStatsAPI
 from common import result
 from common.auth import TokenAuth
+from common.auth.authentication import has_permissions
+from common.constants.permission_constants import PermissionConstants, RoleConstants
 from homepage.api.home_page_api import ApplicationTokensRankingAPI, ApplicationQuestionRankingAPI, UserTokensRankingAPI, \
     ApplicationAggregationAPI, KnowledgeAggregationAPI, ToolAggregationAPI, ModelAggregationAPI, \
     ApplicationMonitoringAPI, RankingBaseAPI, TokensAggregationAPI, RankingBaseExportAPI
@@ -35,6 +37,9 @@ class ChatRecordAggregation(APIView):
             responses=TokensAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.ChatRecordAggregation(
@@ -57,6 +62,9 @@ class TokensAggregation(APIView):
             responses=TokensAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.TokensAggregation(
@@ -79,6 +87,9 @@ class ApplicationTokensRankingExport(APIView):
             responses=RankingBaseExportAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return HomePageSerializer.ApplicationTokensRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -101,6 +112,9 @@ class ApplicationTokensRanking(APIView):
             responses=ApplicationTokensRankingAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, current_page: int, page_size: int):
             return result.success(HomePageSerializer.ApplicationTokensRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -123,6 +137,9 @@ class ApplicationQuestionRankingExport(APIView):
             responses=RankingBaseExportAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return HomePageSerializer.ApplicationQuestionRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -145,6 +162,9 @@ class ApplicationQuestionRanking(APIView):
             responses=ApplicationQuestionRankingAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, current_page: int, page_size: int):
             return result.success(HomePageSerializer.ApplicationQuestionRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -167,6 +187,9 @@ class UserTokensRankingExport(APIView):
             responses=RankingBaseExportAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_EXPORT.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return HomePageSerializer.ApplicationUserTokenRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -188,6 +211,9 @@ class UserTokensRanking(APIView):
             responses=UserTokensRankingAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, current_page: int, page_size: int):
             return result.success(HomePageSerializer.ApplicationUserTokenRanking(
                 data={'user_id': request.user.id, 'workspace_id': workspace_id,
@@ -210,6 +236,9 @@ class ApplicationMonitoring(APIView):
             responses=ApplicationMonitoringAPI.get_response(),
             tags=[_('Home page')]  # type: ignore
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.ApplicationMonitoring(
@@ -234,6 +263,9 @@ class ApplicationAggregation(APIView):
             responses=ApplicationAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.Application(
@@ -252,6 +284,9 @@ class KnowledgeAggregation(APIView):
             responses=KnowledgeAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.Knowledge(
@@ -270,6 +305,9 @@ class ToolAggregation(APIView):
             responses=ToolAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.Tool(
@@ -288,6 +326,9 @@ class ModelAggregation(APIView):
             responses=ModelAggregationAPI.get_response(),
             tags=[_("Home page")],
         )
+        @has_permissions(PermissionConstants.HOMEPAGE_READ.get_workspace_permission(),
+                         RoleConstants.USER.get_workspace_role(),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str):
             return result.success(
                 HomePageSerializer.Model(

apps/knowledge/views/document.py

@@ -677,10 +677,8 @@ class BatchTokenize(APIView):
             tags=[_("Knowledge Base/Documentation")],  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_knowledge_permission(),
-            PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_permission_workspace_manage_role(),
-            PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_knowledge_permission(),
-            PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_knowledge_permission(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],

apps/locales/en_US/LC_MESSAGES/django.po

@@ -9383,6 +9383,12 @@ msgstr "User Name"
 msgid "New chat"
 msgstr "A new conversation has been generated. Please ask your question again！"
 
+msgid "Token Index"
+msgstr "Token Index"
+
+msgid "Authorize to Workspace"
+msgstr ""
+
 msgid "IAM"
 msgstr "IAM"
 

apps/locales/zh_CN/LC_MESSAGES/django.po

@@ -9506,6 +9506,12 @@ msgstr "用户名称"
 msgid "New chat"
 msgstr "已生成新对话，请重新提问！"
 
+msgid "Token Index"
+msgstr "分词索引"
+
+msgid "Authorize to Workspace"
+msgstr "授权工作空间"
+
 msgid "IAM"
 msgstr "身份与权限"
 

apps/locales/zh_Hant/LC_MESSAGES/django.po

@@ -9506,6 +9506,12 @@ msgstr "用戶名稱"
 msgid "New chat"
 msgstr "已生成新對話，請重新提問！"
 
+msgid "Token Index"
+msgstr "分詞索引"
+
+msgid "Authorize to Workspace"
+msgstr "授權工作空間"
+
 msgid "IAM"
 msgstr "身份與權限"
 

apps/oss/serializers/file.py

@@ -166,6 +166,12 @@ def auth(file, mk_file_auth):
     # PublicFileAccess 中记录的文件允许公开访问
     if QuerySet(PublicFileAccess).filter(source_type='FILE', source_id=str(file.id)).exists():
         return
+    if file.source_type == FileSourceType.APPLICATION:
+        application = QuerySet(Application).filter(id=file.source_id).first()
+        if application is None:
+            _deny()
+        if file.meta.get('chat_id') is None:
+            return
     # 非公共文件,直接拒绝
     if mk_file_auth is None:
         _deny()
@@ -266,9 +272,6 @@ def _auth_system(file, user_id):
         application = QuerySet(Application).filter(id=file.source_id).first()
         if application is None:
             _deny()
-        # 如果是应用的高级设置的文件
-        if file.meta.get('chat_id') is None:
-            return
         _check_workspace_resource_permission(
             user_auth, user_id,
             workspace_id=application.workspace_id,

ui/src/components/ai-chat/component/knowledge-source-component/ParagraphDocumentContent.vue

@@ -66,7 +66,7 @@ const isPdf = computed(() => !!props.detail?.meta?.source_file_id)
 
 const pdfSrc = computed(() => {
   const fileId = props.detail?.meta?.source_file_id
-  return fileId ? `${window.MaxKB.prefix}/oss/file/${fileId}` : ''
+  return fileId ? `./oss/file/${fileId}` : ''
 })
 
 const overlayText = computed(() => {

ui/src/components/ai-chat/component/prologue-content/index.vue

@@ -15,7 +15,7 @@
       <el-card shadow="always" class="border-r-8" style="--el-card-padding: 10px 16px 12px">
         <MdRenderer
           :source="prologue"
-          :send-message="sendMessage"
+          :send-message="chatMessage"
           reasoning_content=""
           :type="type"
           :selection="selection"
@@ -37,6 +37,9 @@ const props = defineProps<{
   sendMessage: (question: string, other_params_data?: any, chat?: chatType) => void
   selection?: boolean
 }>()
+const chatMessage = (question: string, type: 'old' | 'new', other_params_data?: any) => {
+  props.sendMessage(question, other_params_data)
+}
 
 const showAvatar = computed(() => {
   return props.application.show_avatar == undefined ? true : props.application.show_avatar

ui/src/permission/knowledge/system-manage.ts

@@ -39,6 +39,8 @@ const systemManage = {
     hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_CREATE], 'OR'),
   doc_vector: () =>
     hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_VECTOR], 'OR'),
+  doc_token: () =>
+    hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN], 'OR'),
   doc_generate: () =>
     hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_DOCUMENT_GENERATE], 'OR'),
   doc_migrate: () =>
@@ -102,6 +104,7 @@ const systemManage = {
   auth: () => hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_AUTH], 'OR'),
   relate_map: () =>
     hasPermission([RoleConst.ADMIN, PermissionConst.RESOURCE_KNOWLEDGE_RELATE_RESOURCE_VIEW], 'OR'),
+  auth_to_workspace: () => false,
   folderRead: () => false,
   folderManage: () => false,
   folderCreate: () => false,