feat: add user group resource permission management and related SQL queries

apps/system_manage/models/__init__.py

@@ -7,6 +7,7 @@
     @desc:
 """
 from .workspace_user_permission import *
+from .workspace_user_group_permission import *
 from .system_setting import *
 from .log_management import *
 from .chat_user import *

apps/system_manage/models/workspace_user_group_permission.py

@@ -0,0 +1,53 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎
+    @file： workspace_permission.py
+    @date：2025/4/16 18:25
+    @desc:
+"""
+
+import uuid_utils.compat as uuid
+from django.contrib.postgres.fields import ArrayField
+from django.db import models
+
+from common.constants.permission_constants import ResourceAuthType, ResourcePermissionRole, ResourcePermission
+from users.models.user_group import SystemUserGroup
+
+from .workspace_user_permission import AuthTargetType
+
+
+class WorkspaceUserGroupResourcePermission(models.Model):
+    """
+    工作空间用户组资源权限表
+    用于管理当前工作空间下用户组对某一个应用或者知识库的操作权限
+    """
+    id = models.UUIDField(primary_key=True, max_length=128, default=uuid.uuid7, editable=False, verbose_name="主键id")
+
+    workspace_id = models.CharField(max_length=128, verbose_name="工作空间id", default="default", db_index=True)
+
+    user_group = models.ForeignKey(SystemUserGroup, on_delete=models.CASCADE, verbose_name="用户组id", db_index=True)
+
+    auth_target_type = models.CharField(verbose_name='授权目标', max_length=128, choices=AuthTargetType.choices,
+                                        default=AuthTargetType.KNOWLEDGE, db_index=True)
+    # 授权的知识库或者应用的id
+    target = models.CharField(max_length=128, verbose_name="知识库/应用id", db_index=True)
+
+    # 授权类型 如果是Role那么就是角色的权限  如果是PERMISSION
+    auth_type = models.CharField(default=False, verbose_name="授权类型", choices=ResourceAuthType.choices,
+                                 db_default=ResourceAuthType.ROLE, db_index=True)
+    # 资源权限列表
+    permission_list = ArrayField(verbose_name="权限列表",
+                                 default=list,
+                                 base_field=models.CharField(max_length=256,
+                                                             blank=True,
+                                                             choices=ResourcePermission.choices + ResourcePermissionRole.choices,
+                                                             default=ResourcePermission.VIEW))
+
+    create_time = models.DateTimeField(verbose_name="创建时间", auto_now_add=True, db_index=True)
+
+    update_time = models.DateTimeField(verbose_name="修改时间", auto_now=True, db_index=True)
+
+    class Meta:
+        db_table = "workspace_user_group_resource_permission"
+        unique_together = ('workspace_id', 'user_group', 'auth_target_type', 'target')

apps/system_manage/models/workspace_user_permission.py

@@ -11,8 +11,7 @@
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 
-from common.constants.permission_constants import Group, ResourcePermissionGroup, ResourceAuthType, \
-    ResourcePermissionRole, ResourcePermission
+from common.constants.permission_constants import Group, ResourceAuthType, ResourcePermissionRole, ResourcePermission
 from users.models import User
 
 

apps/system_manage/sql/get_application_user_group_resource_permission.sql

@@ -0,0 +1,47 @@
+SELECT resource_or_folder.*,
+       CASE
+           WHEN wurp.permission IS NULL THEN 'NOT_AUTH'
+           ELSE wurp.permission
+       END
+FROM (
+         SELECT id::text,
+                "name",
+                'APPLICATION' AS "auth_target_type",
+                'application' AS "resource_type",
+                user_group_id,
+                workspace_id,
+                icon,
+                folder_id,
+                create_time
+         FROM application
+         ${query_set}
+         UNION
+         SELECT application_folder."id"::text,
+                application_folder."name",
+                'APPLICATION'                  AS "auth_target_type",
+                'folder'                       AS "resource_type",
+                application_folder."user_group_id",
+                application_folder."workspace_id",
+                NULL                           AS "icon",
+                application_folder."parent_id" AS "folder_id",
+                application_folder."create_time"
+         FROM application_folder
+         ${folder_query_set}
+     ) resource_or_folder
+LEFT JOIN (
+    SELECT target,
+           CASE
+               WHEN auth_type = 'ROLE'
+                   AND 'ROLE' = ANY (permission_list) THEN 'ROLE'
+               WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                   AND 'MANAGE' = ANY (permission_list) THEN 'MANAGE'
+               WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                   AND 'VIEW' = ANY (permission_list) THEN 'VIEW'
+               ELSE NULL
+               END AS permission
+    FROM workspace_user_group_resource_permission
+    ${workspace_user_group_resource_permission_query_set}
+) wurp
+ON wurp.target::text = resource_or_folder.id
+${resource_query_set}
+ORDER BY resource_or_folder.create_time DESC

apps/system_manage/sql/get_knowledge_user_group_resource_permission.sql

@@ -0,0 +1,50 @@
+SELECT resource_or_folder.*,
+    CASE
+        WHEN wurp.permission IS NULL THEN 'NOT_AUTH'
+        ELSE wurp.permission
+    END
+FROM (
+        SELECT
+            id::text,
+            "name",
+            'KNOWLEDGE' AS "auth_target_type",
+            'knowledge' AS "resource_type",
+            user_group_id,
+            workspace_id,
+            "type"::varchar AS "icon",
+            folder_id,
+            create_time
+        FROM knowledge
+            ${query_set}
+        UNION
+        SELECT knowledge_folder."id"::text,
+               knowledge_folder."name",
+               'KNOWLEDGE'                  AS "auth_target_type",
+                    'folder'                       AS "resource_type",
+                    knowledge_folder."user_group_id",
+                    knowledge_folder."workspace_id",
+                    NULL                           AS "icon",
+                    knowledge_folder."parent_id" AS "folder_id",
+                    knowledge_folder."create_time"
+        FROM knowledge_folder
+        ${folder_query_set}
+    ) resource_or_folder
+LEFT JOIN (
+    SELECT
+        target,
+        CASE
+            WHEN auth_type = 'ROLE'
+                AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
+            WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
+            WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
+            ELSE null
+        END AS permission
+    FROM
+        workspace_user_group_resource_permission
+        ${workspace_user_group_resource_permission_query_set}
+) wurp
+ON wurp.target::text = resource_or_folder.id
+${resource_query_set}
+ORDER BY resource_or_folder.create_time DESC

apps/system_manage/sql/get_model_user_group_resource_permission.sql

@@ -0,0 +1,55 @@
+SELECT
+    resource_or_folder.*,
+    CASE
+		WHEN
+	      wurp."permission" is null then 'NOT_AUTH'
+		ELSE wurp."permission"
+	END
+FROM (
+    SELECT
+        "id"::text,
+        "name",
+        'MODEL' AS "auth_target_type",
+        'model' AS "resource_type",
+        user_group_id,
+        workspace_id,
+        provider as icon,
+        'default' as folder_id,
+        create_time
+    FROM
+        model
+        ${query_set}
+    UNION
+    SELECT
+        "id"::text,
+        "name",
+        'MODEL' AS "auth_target_type",
+        'folder' AS "resource_type",
+        user_group_id,
+        workspace_id,
+        provider as icon,
+        'default' as folder_id,
+        create_time
+    FROM model
+    ${folder_query_set}
+    AND 1=0
+) resource_or_folder
+LEFT JOIN (
+    SELECT
+        target,
+        CASE
+            WHEN auth_type = 'ROLE'
+                AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
+            WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
+            WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
+            ELSE null
+        END AS permission
+    FROM
+        workspace_user_group_resource_permission
+        ${workspace_user_group_resource_permission_query_set}
+) wurp
+ON wurp.target = resource_or_folder."id"
+${resource_query_set}
+ORDER BY resource_or_folder.create_time DESC

apps/system_manage/sql/get_resource_user_group_permission_detail.sql

@@ -0,0 +1,29 @@
+SELECT
+    u.id,
+    u.name,
+    case
+		when
+	      wurp."permission" is null then 'NOT_AUTH'
+		else wurp."permission"
+	end
+FROM
+    public."system_user_group" u
+LEFT JOIN (
+    SELECT
+        user_group_id ,
+	(case
+		when  auth_type = 'ROLE'
+		and  'ROLE' = any( permission_list) then 'ROLE'
+			when  auth_type = 'RESOURCE_PERMISSION_GROUP'
+			and 'MANAGE'= any(permission_list)   then 'MANAGE'
+			  when  auth_type = 'RESOURCE_PERMISSION_GROUP'
+			and 'VIEW' = any( permission_list) then 'VIEW'
+			else null
+		end) as "permission"
+    FROM
+        workspace_user_group_resource_permission
+        ${workspace_user_group_resource_permission_query_set}
+        ) wurp
+ON
+    u.id = wurp.user_group_id
+${user_query_set}

apps/system_manage/sql/get_tool_user_group_resource_permission.sql

@@ -0,0 +1,51 @@
+SELECT resource_or_folder.*,
+    CASE
+		WHEN wurp."permission" IS NULL THEN 'NOT_AUTH'
+		ELSE wurp."permission"
+	END
+FROM (
+        SELECT "id"::text,
+                "name",
+                'TOOL' AS "auth_target_type",
+                'tool' AS "resource_type",
+                user_group_id,
+                workspace_id,
+                icon,
+                folder_id,
+                tool_type,
+                create_time
+        FROM tool
+        ${query_set}
+        UNION
+        SELECT tool_folder."id"::text,
+               tool_folder."name",
+               'TOOL'                  AS "auth_target_type",
+               'folder'                AS "resource_type",
+               tool_folder."user_group_id",
+               tool_folder."workspace_id",
+               NULL                    AS "icon",
+               tool_folder."parent_id" AS "folder_id",
+               NULL                    AS "tool_type",
+               tool_folder."create_time"
+        FROM tool_folder
+        ${folder_query_set}
+    ) resource_or_folder
+LEFT JOIN (
+    SELECT target,
+            CASE
+                WHEN auth_type = 'ROLE'
+                    AND 'ROLE' = ANY(permission_list) THEN 'ROLE'
+                WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                    AND 'MANAGE' = ANY(permission_list) THEN 'MANAGE'
+                WHEN auth_type = 'RESOURCE_PERMISSION_GROUP'
+                    AND 'VIEW' = ANY(permission_list) THEN 'VIEW'
+                ELSE null
+            END AS permission
+    FROM
+        workspace_user_group_resource_permission
+        ${workspace_user_group_resource_permission_query_set}
+) wurp
+ON wurp.target::text = resource_or_folder."id"
+${resource_query_set}
+ORDER BY resource_or_folder.create_time DESC
+

apps/system_manage/urls.py

@@ -8,8 +8,12 @@
 urlpatterns = [
     path('workspace/<str:workspace_id>/user_resource_permission/user/<str:user_id>/resource/<str:resource>', views.WorkSpaceUserResourcePermissionView.as_view()),
     path('workspace/<str:workspace_id>/user_resource_permission/user/<str:user_id>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkSpaceUserResourcePermissionView.Page.as_view()),
+    path('workspace/<str:workspace_id>/user_group_resource_permission/user_group/<str:user_group_id>/resource/<str:resource>', views.WorkSpaceUserGroupResourcePermissionView.as_view()),
+    path('workspace/<str:workspace_id>/user_group_resource_permission/user_group/<str:user_group_id>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkSpaceUserGroupResourcePermissionView.Page.as_view()),
     path('workspace/<str:workspace_id>/resource_user_permission/resource/<str:target>/resource/<str:resource>', views.WorkspaceResourceUserPermissionView.as_view()),
     path('workspace/<str:workspace_id>/resource_user_permission/resource/<str:target>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkspaceResourceUserPermissionView.Page.as_view()),
+    path('workspace/<str:workspace_id>/resource_user_group_permission/resource/<str:target>/resource/<str:resource>', views.WorkspaceResourceUserGroupPermissionView.as_view()),
+    path('workspace/<str:workspace_id>/resource_user_group_permission/resource/<str:target>/resource/<str:resource>/<int:current_page>/<int:page_size>', views.WorkspaceResourceUserGroupPermissionView.Page.as_view()),
     path('workspace/<str:workspace_id>/resource_mapping/<str:resource>/<str:resource_id>/<int:current_page>/<int:page_size>', views.ResourceMappingView.as_view()),
     path('workspace/<str:workspace_id>/mapping_resource/<str:resource>/<str:resource_id>/<int:current_page>/<int:page_size>', views.MappingResourceView.as_view()),
     path('email_setting', views.SystemSetting.Email.as_view()),

apps/system_manage/views/__init__.py

@@ -12,3 +12,4 @@
 from .valid import *
 from .resource_mapping import *
 from .system_chat_user import *
+from .user_group_resource_permission import *