From 5fb6019fd2d33ae4f59968284f37180e682f961a Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Wed, 28 Oct 2026 17:39:54 +0800 Subject: [PATCH] fix: enhance resource permission handling by adding support for user group permissions in knowledge and tool queries --- apps/knowledge/serializers/knowledge.py | 16 +++- apps/knowledge/sql/list_knowledge_user_ee.sql | 82 ++++++++++++------- apps/tools/serializers/tool.py | 16 +++- apps/tools/sql/list_tool_user_ee.sql | 29 +++++-- 4 files changed, 104 insertions(+), 39 deletions(-) diff --git a/apps/knowledge/serializers/knowledge.py b/apps/knowledge/serializers/knowledge.py index a83a666f748..a8dcd822828 100644 --- a/apps/knowledge/serializers/knowledge.py +++ b/apps/knowledge/serializers/knowledge.py @@ -38,7 +38,7 @@ from models_provider.models import Model from openpyxl.cell.cell import ILLEGAL_CHARACTERS_RE from rest_framework import serializers -from system_manage.models import AuthTargetType, WorkspaceUserResourcePermission +from system_manage.models import AuthTargetType, WorkspaceUserResourcePermission, WorkspaceUserGroupResourcePermission from system_manage.models.resource_mapping import ResourceMapping from system_manage.serializers.resource_mapping_serializers import ResourceMappingSerializer from system_manage.serializers.user_resource_permission import UserResourcePermissionSerializer @@ -312,6 +312,13 @@ def get_query_set(self, workspace_manage, is_x_pack_ee): query_set_dict["workspace_user_resource_permission_query_set"] = QuerySet( WorkspaceUserResourcePermission ).filter(auth_target_type="KNOWLEDGE", workspace_id=workspace_id, user_id=self.data.get("user_id")) + query_set_dict["workspace_user_group_resource_permission_query_set"] = QuerySet( + WorkspaceUserGroupResourcePermission + ).filter( + auth_target_type="KNOWLEDGE", + workspace_id=workspace_id, + user_group__user_relations__user_id=self.data.get("user_id"), + ) return query_set_dict def page(self, current_page: int, page_size: int): @@ -496,6 +503,13 @@ def one(self): workspace_id=self.data.get("workspace_id"), user_id=self.data.get("user_id"), ) + query_set_dict["workspace_user_group_resource_permission_query_set"] = QuerySet( + WorkspaceUserGroupResourcePermission + ).filter( + auth_target_type="KNOWLEDGE", + workspace_id=self.data.get("workspace_id"), + user_group__user_relations__user_id=self.data.get("user_id"), + ) all_application_list = [str(adm.get("id")) for adm in self.list_application(with_valid=False)] knowledge_dict = native_search( query_set_dict, diff --git a/apps/knowledge/sql/list_knowledge_user_ee.sql b/apps/knowledge/sql/list_knowledge_user_ee.sql index 09a1c72b12e..dc8e813769d 100644 --- a/apps/knowledge/sql/list_knowledge_user_ee.sql +++ b/apps/knowledge/sql/list_knowledge_user_ee.sql @@ -2,47 +2,70 @@ SELECT * FROM (SELECT "temp_knowledge".id::text, "temp_knowledge".name, "temp_knowledge".desc, "temp_knowledge".type, - 'knowledge' as resource_type, + 'knowledge' as resource_type, "temp_knowledge".workspace_id, "temp_knowledge".folder_id, "temp_knowledge".user_id, - "user"."nick_name" as nick_name, + "user"."nick_name" as nick_name, "temp_knowledge".create_time, "temp_knowledge".update_time, "temp_knowledge".file_size_limit, "temp_knowledge".file_count_limit, "temp_knowledge"."scope", - "temp_knowledge"."embedding_model_id"::text, - "document_temp"."char_length", - to_json("temp_knowledge".meta)::jsonb as meta, - CASE - WHEN - "app_knowledge_temp"."count" IS NULL THEN 0 - ELSE "app_knowledge_temp"."count" END AS application_mapping_count, + "temp_knowledge"."embedding_model_id"::text, "document_temp"."char_length", + to_json("temp_knowledge".meta)::jsonb as meta, CASE + WHEN + "app_knowledge_temp"."count" IS NULL THEN 0 + ELSE "app_knowledge_temp"."count" END AS application_mapping_count, "document_temp".document_count, "document_temp".image_count FROM (SELECT knowledge.* FROM knowledge knowledge ${knowledge_custom_sql} AND "knowledge".id::text in (select target - from workspace_user_resource_permission - ${workspace_user_resource_permission_query_set} - and case - when auth_type = 'ROLE' then - 'ROLE' = any (permission_list) - and - 'KNOWLEDGE:READ' in (select (case when user_role_relation.role_id = any (array ['USER']) THEN 'KNOWLEDGE:READ' else role_permission.permission_id END) - from role_permission role_permission - right join user_role_relation user_role_relation - on user_role_relation.role_id=role_permission.role_id - where user_role_relation.user_id=workspace_user_resource_permission.user_id - and user_role_relation.workspace_id=workspace_user_resource_permission.workspace_id) - else - 'VIEW' = any (permission_list) - end - )) temp_knowledge - LEFT JOIN (SELECT "count"("id") FILTER (WHERE "resource_type" = 'document') AS document_count, - "count"("id") FILTER (WHERE "resource_type" = 'image') AS image_count, - "sum"("char_length") "char_length", + from workspace_user_resource_permission ${workspace_user_resource_permission_query_set} + and case + when auth_type = 'ROLE' then + 'ROLE' = any (permission_list) + and + 'KNOWLEDGE:READ' in (select (case when user_role_relation.role_id = any (array ['USER']) THEN 'KNOWLEDGE:READ' else role_permission.permission_id END) + from role_permission role_permission + right join user_role_relation user_role_relation + on user_role_relation.role_id=role_permission.role_id + where user_role_relation.user_id=workspace_user_resource_permission.user_id + and user_role_relation.workspace_id=workspace_user_resource_permission.workspace_id) + else + 'VIEW' = any (permission_list) + end + union + select distinct target + from workspace_user_group_resource_permission + inner join system_user_group_relation + on system_user_group_relation.group_id = + workspace_user_group_resource_permission.user_group_id + ${workspace_user_group_resource_permission_query_set} + and ( + 'VIEW' = any (permission_list) + or ( + auth_type = 'ROLE' + and 'ROLE' = any (permission_list) + and 'KNOWLEDGE:READ' in (select (case + when user_role_relation.role_id = + any (array ['USER']) + then 'KNOWLEDGE:READ' + else + role_permission.permission_id end) + from role_permission role_permission + right join user_role_relation user_role_relation + on user_role_relation.role_id = + role_permission.role_id + where user_role_relation.user_id = + system_user_group_relation.user_id + and user_role_relation.workspace_id = + workspace_user_group_resource_permission.workspace_id) + ) + ) + )) temp_knowledge + LEFT JOIN (SELECT "count"("id") FILTER (WHERE "resource_type" = 'document') AS document_count, "count"("id") FILTER (WHERE "resource_type" = 'image') AS image_count, "sum"("char_length") "char_length", knowledge_id FROM "document" GROUP BY knowledge_id) "document_temp" ON temp_knowledge."id" = "document_temp".knowledge_id @@ -50,6 +73,5 @@ FROM (SELECT "temp_knowledge".id::text, "temp_knowledge".name, FROM application_knowledge_mapping GROUP BY knowledge_id) app_knowledge_temp ON temp_knowledge."id" = "app_knowledge_temp".knowledge_id - left join "user" on "user".id = temp_knowledge.user_id - ) temp + left join "user" on "user".id = temp_knowledge.user_id) temp ${default_sql} diff --git a/apps/tools/serializers/tool.py b/apps/tools/serializers/tool.py index bf4250f0c60..ef60e43cb69 100644 --- a/apps/tools/serializers/tool.py +++ b/apps/tools/serializers/tool.py @@ -40,7 +40,7 @@ from maxkb.const import CONFIG, PROJECT_DIR from models_provider.models import Model from rest_framework import serializers, status -from system_manage.models import AuthTargetType, WorkspaceUserResourcePermission +from system_manage.models import AuthTargetType, WorkspaceUserResourcePermission, WorkspaceUserGroupResourcePermission from system_manage.models.resource_mapping import ResourceMapping from system_manage.serializers.resource_mapping_serializers import ResourceMappingSerializer from system_manage.serializers.user_resource_permission import UserResourcePermissionSerializer @@ -392,6 +392,13 @@ def get_query_set(self, workspace_manage, is_x_pack_ee): query_set_dict["workspace_user_resource_permission_query_set"] = QuerySet( WorkspaceUserResourcePermission ).filter(auth_target_type="TOOL", workspace_id=workspace_id, user_id=user_id) + query_set_dict["workspace_user_group_resource_permission_query_set"] = QuerySet( + WorkspaceUserGroupResourcePermission + ).filter( + auth_target_type="TOOL", + workspace_id=workspace_id, + user_group__user_relations__user_id=user_id, + ) return query_set_dict def get_authorized_query_set(self): @@ -1812,6 +1819,13 @@ def get_query_set(self, workspace_manage, is_x_pack_ee): query_set_dict["workspace_user_resource_permission_query_set"] = QuerySet( WorkspaceUserResourcePermission ).filter(auth_target_type="TOOL", workspace_id=workspace_id, user_id=user_id) + query_set_dict["workspace_user_group_resource_permission_query_set"] = QuerySet( + WorkspaceUserGroupResourcePermission + ).filter( + auth_target_type="TOOL", + workspace_id=workspace_id, + user_group__user_relations__user_id=user_id, + ) return query_set_dict @staticmethod diff --git a/apps/tools/sql/list_tool_user_ee.sql b/apps/tools/sql/list_tool_user_ee.sql index 8a4de8708f0..a7b806af418 100644 --- a/apps/tools/sql/list_tool_user_ee.sql +++ b/apps/tools/sql/list_tool_user_ee.sql @@ -1,6 +1,5 @@ SELECT * -FROM (SELECT tool."id"::text, - tool."name", +FROM (SELECT tool."id"::text, tool."name", tool."desc", tool."tool_type", tool."scope", @@ -11,8 +10,7 @@ FROM (SELECT tool."id"::text, "user".nick_name AS "nick_name", tool."icon", tool.label, - tool."template_id"::text, - tool."create_time", + tool."template_id"::text, tool."create_time", tool."update_time", tool.init_field_list, tool.input_field_list, @@ -34,7 +32,24 @@ FROM (SELECT tool."id"::text, ELSE 'VIEW' = ANY (permission_list) END + UNION + SELECT DISTINCT target + FROM workspace_user_group_resource_permission + INNER JOIN system_user_group_relation + ON system_user_group_relation.group_id = workspace_user_group_resource_permission.user_group_id + ${workspace_user_group_resource_permission_query_set} + AND ( + 'VIEW' = ANY (permission_list) + OR ( + auth_type = 'ROLE' + AND 'ROLE' = ANY (permission_list) + AND 'TOOL:READ' IN (SELECT (CASE WHEN user_role_relation.role_id = ANY (ARRAY ['USER']) THEN 'TOOL:READ' ELSE role_permission.permission_id END) + FROM role_permission role_permission + RIGHT JOIN user_role_relation user_role_relation ON user_role_relation.role_id=role_permission.role_id + WHERE user_role_relation.user_id=system_user_group_relation.user_id + AND user_role_relation.workspace_id=workspace_user_group_resource_permission.workspace_id) + ) + ) )) AS tool - LEFT JOIN "user" ON "user".id = user_id - ) temp - ${default_query_set} \ No newline at end of file + LEFT JOIN "user" ON "user".id = user_id) temp + ${default_query_set}