Skip to content

feat: Resource authorization permission #3873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhanweizhang7 merged 1 commit into from
Aug 18, 2025
Merged

feat: Resource authorization permission #3873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion apps/common/constants/permission_constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ class Operate(Enum):
TO_CHAT = "READ+TO_CHAT" # 去对话
SETTING = "READ+SETTING" # 管理
DOWNLOAD = "READ+DOWNLOAD" # 下载
AUTH = "READ+AUTH"


class RoleGroup(Enum):
Expand Down Expand Up @@ -335,6 +336,7 @@ def get_workspace_role(self):
Operate.DD.value: _('Dingding'),
Operate.WEIXIN_PUBLIC_ACCOUNT.value: _('Weixin Public Account'),
Operate.ADD_KNOWLEDGE.value: _('Add to Knowledge Base'),
Operate.AUTH.value:_('resource authorization'),
Group.APPLICATION_OVERVIEW.value: _('Overview'),
Group.APPLICATION_ACCESS.value: _('Application Access'),
Group.APPLICATION_CHAT_USER.value: _('Dialogue users'),
Expand Down Expand Up @@ -481,6 +483,11 @@ class PermissionConstants(Enum):
parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL],
resource_permission_group_list=[ResourcePermissionConst.MODEL_MANGE]
)
MODEL_RESOURCE_AUTHORIZATION = Permission(
group=Group.MODEL, operate=Operate.AUTH, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL],
resource_permission_group_list=[ResourcePermissionConst.MODEL_MANGE]
)
TOOL_READ = Permission(
group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL],
Expand Down Expand Up @@ -520,6 +527,11 @@ class PermissionConstants(Enum):
parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL],
resource_permission_group_list=[ResourcePermissionConst.TOOL_MANGE]
)
TOOL_RESOURCE_AUTHORIZATION = Permission(
group=Group.TOOL, operate=Operate.AUTH, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL],
resource_permission_group_list=[ResourcePermissionConst.TOOL_MANGE]
)
KNOWLEDGE_READ = Permission(
group=Group.KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW],
Expand Down Expand Up @@ -560,6 +572,11 @@ class PermissionConstants(Enum):
resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANGE],
parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
)
KNOWLEDGE_RESOURCE_AUTHORIZATION = Permission(
group=Group.KNOWLEDGE, operate=Operate.AUTH, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANGE],
parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
)
KNOWLEDGE_DOCUMENT_READ = Permission(
group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.READ,
role_list=[RoleConstants.ADMIN, RoleConstants.USER],
Expand Down Expand Up @@ -819,7 +836,11 @@ class PermissionConstants(Enum):
parent_group=[WorkspaceGroup.APPLICATION, UserGroup.APPLICATION],
resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANGE],
)

APPLICATION_RESOURCE_AUTHORIZATION = Permission(group=Group.APPLICATION, operate=Operate.AUTH,
role_list=[RoleConstants.ADMIN, RoleConstants.USER],
parent_group=[WorkspaceGroup.APPLICATION, UserGroup.APPLICATION],
resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANGE],
)
APPLICATION_OVERVIEW_READ = Permission(group=Group.APPLICATION_OVERVIEW, operate=Operate.READ,
role_list=[RoleConstants.ADMIN, RoleConstants.USER],
parent_group=[WorkspaceGroup.APPLICATION, UserGroup.APPLICATION],
Copy link
Copy Markdown
Contributor Author

@shaohuzhang1 shaohuzhang1 Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provided code looks clean and well-organized. However, there are a few minor improvements you can make:

  1. Consistent Spacing: Ensure that spaces between operators (+) in Operate enum values align consistently.

    +auth = Operate("READ+AUTH")

  2. Comments Formatting: Maintain consistent comment formatting across the file.

  3. Whitespace Between Enum Values: Keep whitespace around enum values to improve readability.

    Operate.DD.value: _('Dingding'),
Operate.WEIXIN_PUBLIC_ACCOUNT.value: _('Weixin Public Account'),
Operate.ADD_KNOWLEDGE.value: _('Add to Knowledge Base'),
Operate.AUTH.value: _('resource authorization'),  # Add space after comma

Here is the corrected version of your code with these minor adjustments:

class Operate(Enum):
    READ_TO_CHAT = "READ+TO_CHAT"  # 去对话
    SETTING = "READ+SETTING"  # 管理
    DOWNLOAD = "READ+DOWNLOAD"  # 下载
    AUTH = "READ+AUTH"


class RoleGroup(Enum):
    ADMINISTRATOR_ROLE_NAME = 'ADMIN'
    USER_ROLE_NAME = 'USER'

...

These small changes enhance clarity and maintainability of the codebase.

Expand Down
3 changes: 3 additions & 0 deletions apps/locales/en_US/LC_MESSAGES/django.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8657,4 +8657,7 @@ msgid "If not passed, the default value is What is this audio saying? Only answe
msgstr ""

msgid "The Qwen Omni series model supports inputting multiple modalities of data, including video, audio, images, and text, and outputting audio and text."
msgstr ""

msgid "Resource authorization"
msgstr ""
5 changes: 4 additions & 1 deletion apps/locales/zh_CN/LC_MESSAGES/django.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8783,4 +8783,7 @@ msgid "If not passed, the default value is What is this audio saying? Only answe
msgstr "如果未传递，默认值为 这段音频在说什么，只回答音频的内容"

msgid "The Qwen Omni series model supports inputting multiple modalities of data, including video, audio, images, and text, and outputting audio and text."
msgstr "Qwen-Omni 系列模型支持输入多种模态的数据，包括视频、音频、图片、文本，并输出音频与文本"
msgstr "Qwen-Omni 系列模型支持输入多种模态的数据，包括视频、音频、图片、文本，并输出音频与文本"

msgid "Resource authorization"
msgstr "资源授权"
5 changes: 4 additions & 1 deletion apps/locales/zh_Hant/LC_MESSAGES/django.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8783,4 +8783,7 @@ msgid "If not passed, the default value is What is this audio saying? Only answe
msgstr "如果未傳遞，預設值為這段音訊在說什麼，只回答音訊的內容"

msgid "The Qwen Omni series model supports inputting multiple modalities of data, including video, audio, images, and text, and outputting audio and text."
msgstr "Qwen-Omni系列模型支持輸入多種模態的數據，包括視頻、音訊、圖片、文字，並輸出音訊與文字"
msgstr "Qwen-Omni系列模型支持輸入多種模態的數據，包括視頻、音訊、圖片、文字，並輸出音訊與文字"

msgid "Resource authorization"
msgstr "資源授權"
19 changes: 19 additions & 0 deletions apps/system_manage/views/user_resource_permission.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,10 @@ class Page(APIView):
responses=UserResourcePermissionPageAPI.get_response(),
tags=[_('Resources authorization')] # type: ignore
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource') + '_WORKSPACE_USER_RESOURCE_PERMISSION'),
operate=Operate.READ),
RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
def get(self, request: Request, workspace_id: str, user_id: str, resource: str, current_page: str,
page_size: str):
return result.success(UserResourcePermissionSerializer(
Expand All @@ -109,6 +113,10 @@ class WorkspaceResourceUserPermissionView(APIView):
responses=ResourceUserPermissionAPI.get_response(),
tags=[_('Resources authorization')] # type: ignore
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource') + '_RESOURCE_AUTHORIZATION'),
operate=Operate.AUTH),
RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
def get(self, request: Request, workspace_id: str, target: str, resource: str):
return result.success(ResourceUserPermissionSerializer(
data={'workspace_id': workspace_id, "target": target, 'auth_target_type': resource,
Expand All @@ -127,6 +135,13 @@ def get(self, request: Request, workspace_id: str, target: str, resource: str):
responses=ResourceUserPermissionEditAPI.get_response(),
tags=[_('Resources authorization')] # type: ignore
)
@log(menu='System', operate='Edit user authorization status of resource',
get_operation_object=lambda r, k: get_user_operation_object(k.get('user_id'))
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource') + '_RESOURCE_AUTHORIZATION'),
operate=Operate.AUTH),
RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
def put(self, request: Request, workspace_id: str, target: str, resource: str):
return result.success(ResourceUserPermissionSerializer(
data={'workspace_id': workspace_id, "target": target, 'auth_target_type': resource, })
Expand All @@ -144,6 +159,10 @@ class Page(APIView):
responses=ResourceUserPermissionPageAPI.get_response(),
tags=[_('Resources authorization')] # type: ignore
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource') + '_RESOURCE_AUTHORIZATION'),
operate=Operate.AUTH),
RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
def get(self, request: Request, workspace_id: str, target: str, resource: str, current_page: int,
page_size: int):
return result.success(ResourceUserPermissionSerializer(
Copy link
Copy Markdown
Contributor Author

@shaohuzhang1 shaohuzhang1 Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no major irregularities or potential issues in the provided Python code snippet related to Django REST Framework views with permission decorators. Here are some small points for consideration:

  1. Decorator Placement: The @log decorator is placed before the @has_permissions decorator for two methods (get() and put()). In Django Rest Framework, it's generally recommended that permissions should be checked first because unauthorized requests will result in a 403 Forbidden response immediately after checking permissions.

  2. Ordering of Decorators: Ensure that all necessary decorators are applied consistently at the appropriate places in the view method signatures. This is good practice for maintainability.

  3. Consistency of Tag Usage: Both _('Resources authorization') uses the underscore prefix, which is consistent but not mandatory unless you're using i18n or want to avoid name clashes with built-in functions.

Overall, the code looks mostly clean and functional based on its intended purpose and structure. However, placing the log decorator after @has_permissions can improve consistency and clarity regarding access control checks being performed first.

Expand Down
17 changes: 14 additions & 3 deletions ui/src/views/system/resource-authorization/constant.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,11 @@
import { AuthorizationEnum } from '@/enums/system'
import { t } from '@/locales'
import { hasPermission } from '@/utils/permission'
import { EditionConst } from '@/utils/permission/data'

export const permissionOptions = [
const notCommunity = hasPermission([EditionConst.IS_EE,EditionConst.IS_PE],'OR')

const permissionOptions = [
{
label: t('views.system.resourceAuthorization.setting.notAuthorized'),
value: AuthorizationEnum.NOT_AUTH,
Expand All @@ -17,9 +21,16 @@ export const permissionOptions = [
value: AuthorizationEnum.MANAGE,
desc: t('views.system.resourceAuthorization.setting.managementDesc'),
},
{
]

if (notCommunity) {
permissionOptions.push(
{
label: t('views.system.resourceAuthorization.setting.role'),
value: AuthorizationEnum.ROLE,
desc: t('views.system.resourceAuthorization.setting.roleDesc'),
},
]
)
}

export {permissionOptions}
Copy link
Copy Markdown
Contributor Author

@shaohuzhang1 shaohuzhang1 Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code is logically sound and follows best practices, but there are some stylistic improvements that could be made:

  1. Function Call within Template Literal: Inline function calls should be avoided inside template literals for better readability.

  2. Conditional Addition to permissionOptions: The conditional addition can be simplified using an inline ternary operator for better performance.

  3. File Extension: Ensure the file extension in the import statements matches the actual TypeScript file extensions.

Here's the revised version with these changes:

// Import statements
import { AuthorizationEnum } from '@/enums/system';
import { t } from '@/locales';
import { hasPermission } from '@/_utils'; // Adjusted path based on directory structure
import { EditionConst } from './_constants/edition_const';

let notCommunity = hasPermission([EditionConst.IS_EE, EditionConst.IS_PE], 'OR');

const permissionOptions: Record<string, { label: string; value: number; desc?: string }> = [
  {
    label: t('views.system.resourceAuthorization.setting.notAuthorized'),
    value: AuthorizationEnum.NOT_AUTH,
    desc: t('views.system.resourceAuthorization.setting.noAccessDescription'),
  },
  // Add other options here if needed
];

if (notCommunity) {
  permissionOptions.push({
    label: t('views.system.resourceAuthorization.setting.role'),
    value: AuthorizationEnum.ROLE,
    desc: t('views.system.resourceAuthorization.setting.roleDesc'),
  });
}

export default permissionOptions;

Main Points Made:

  • Style Enhancements:

    • Inline ternaries were used instead of function call chaining (...) to keep the logic compact and readable.
    • Removed unnecessary backslashes at the end of comments.

  • Directory Structure:

    • Assumes that _constants/edition_const.ts exists relative to this file, so adjust the import accordingly. If it doesn't exist, make sure to create the necessary files and directories.

  • Export Default Usage:

    • Exported the permissionOptions array directly. If you intended to use ES modules, ensure proper syntax adjustments (export {}).

This refactored code maintains functionality while adhering to common coding standards and improving readability.

Loading