Skip to content

feat: Folder Permission #4222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhanweizhang7 merged 1 commit into from
Oct 21, 2025
Merged

feat: Folder Permission #4222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions apps/folders/views/folder.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ class FolderView(APIView):
lambda r, kwargs: Permission(group=Group(f"{kwargs.get('source')}_FOLDER"), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{r.data.get('parent_id')}"),
lambda r, kwargs: Permission(group=Group(kwargs.get('source')), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"
),
lambda r, kwargs: ViewPermission([RoleConstants.USER.get_workspace_role()],
[Permission(group=Group(f"{kwargs.get('source')}_FOLDER"),
Expand Down Expand Up @@ -100,7 +100,7 @@ class Operate(APIView):
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('source')), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"
),
lambda r, kwargs: Permission(group=Group(f"{kwargs.get('source')}_FOLDER"), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{kwargs.get('folder_id')}"
Expand Down Expand Up @@ -152,7 +152,7 @@ def get(self, request: Request, workspace_id: str, source: str, folder_id: str):
)
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('source')), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"
),
lambda r, kwargs: Permission(group=Group(f"{kwargs.get('source')}_FOLDER"), operate=Operate.EDIT,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{kwargs.get('folder_id')}"
Expand Down
6 changes: 3 additions & 3 deletions apps/system_manage/views/user_resource_permission.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ class WorkspaceResourceUserPermissionView(APIView):
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"),
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"),
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource')}/{kwargs.get('target')}"),
Expand Down Expand Up @@ -151,7 +151,7 @@ def get(self, request: Request, workspace_id: str, target: str, resource: str):
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"),
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"),
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource')}/{kwargs.get('target')}"),
Expand Down Expand Up @@ -181,7 +181,7 @@ class Page(APIView):
@has_permissions(
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/ROLE/WORKSPACE_MANAGE"),
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}:ROLE/WORKSPACE_MANAGE"),
lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
operate=Operate.AUTH,
resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource')}/{kwargs.get('target')}"),
Expand Down
21 changes: 11 additions & 10 deletions ui/src/components/folder-tree/index.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,36 +48,36 @@
</div>

<div
v-if="canOperation && permissionPrecise.folderManage(data.id)"
v-if="canOperation && MoreFilledPermission(node, data)"
@click.stop
v-show="hoverNodeId === data.id"
@mouseenter.stop="handleMouseEnter(data)"
@mouseleave.stop="handleMouseleave"
class="mr-16"
>
<el-dropdown trigger="click" :teleported="false">
<el-button text class="w-full" v-if="permissionPrecise.folderManage(data.id)">
<el-button text class="w-full" v-if="MoreFilledPermission(node, data)">
<AppIcon iconName="app-more"></AppIcon>
</el-button>
<template #dropdown>
<el-dropdown-menu>
<el-dropdown-item
@click.stop="openCreateFolder(data)"
v-if="node.level !== 3 && permissionPrecise.folderManage(data.id)"
v-if="node.level !== 3 && permissionPrecise.folderCreate(data.id)"
>
<AppIcon iconName="app-add-folder" class="color-secondary"></AppIcon>
{{ $t('components.folder.addChildFolder') }}
</el-dropdown-item>
<el-dropdown-item
@click.stop="openEditFolder(data)"
v-if="permissionPrecise.folderManage(data.id)"
v-if="permissionPrecise.folderEdit(data.id)"
>
<AppIcon iconName="app-edit" class="color-secondary"></AppIcon>
{{ $t('common.edit') }}
</el-dropdown-item>
<el-dropdown-item
@click.stop="openAuthorization(data)"
v-if="permissionPrecise.folderManage(data.id)"
v-if="permissionPrecise.folderAuth(data.id)"
>
<AppIcon iconName="app-resource-authorization" class="color-secondary"></AppIcon>
{{ $t('views.system.resourceAuthorization.title') }}
Expand All @@ -86,7 +86,7 @@
divided
@click.stop="deleteFolder(data)"
:disabled="!data.parent_id"
v-if="permissionPrecise.folderManage(data.id)"
v-if="permissionPrecise.folderDelete(data.id)"
>
<AppIcon iconName="app-delete" class="color-secondary"></AppIcon>
{{ $t('common.delete') }}
Expand Down Expand Up @@ -175,11 +175,12 @@ const permissionPrecise = computed(() => {
return permissionMap[resourceType.value!]['workspace']
})

const MoreFilledPermission = (node: any) => {
const MoreFilledPermission = (node: any, data: any) => {
return (
(node.level !== 3 && permissionPrecise.value.folderCreate()) ||
permissionPrecise.value.folderEdit() ||
permissionPrecise.value.folderDelete()
(node.level !== 3 && permissionPrecise.value.folderCreate(data.id)) ||
permissionPrecise.value.folderEdit(data.id) ||
permissionPrecise.value.folderDelete(data.id) ||
permissionPrecise.value.folderAuth(data.id)
)
}

Expand Down
25 changes: 24 additions & 1 deletion ui/src/components/resource-authorization-drawer/index.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,8 @@ import permissionMap from '@/permission'
import { loadSharedApi } from '@/utils/dynamics-api/shared-api'
const route = useRoute()
import useStore from '@/stores'
import { hasPermission } from '@/utils/permission/index'
import { PermissionConst, RoleConst } from '@/utils/permission/data'

const { user } = useStore()
const props = defineProps<{
Expand Down Expand Up @@ -229,9 +231,30 @@ function getAllFolderIds(data: any) {
return [data.id,...(data.children?.flatMap((child: any) => getAllFolderIds(child)) || [])]
}

const RESOURCE_PERMISSION_MAP = {
application: PermissionConst.APPLICATION_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole,
knowledge: PermissionConst.KNOWLEDGE_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole,
tool: PermissionConst.TOOL_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole,
}

const resourceAuthorizationOfManager = computed(() => {
return RESOURCE_PERMISSION_MAP[folderType.value]
})

// 过滤没有Manage权限的文件夹ID
function filterHasPermissionFolderIds(folderIds: string[]) {
return folderIds.filter(id => permissionPrecise.value.folderManage(id))
if (hasPermission(
[
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
resourceAuthorizationOfManager.value
],'OR'
)) {
return folderIds
}
else {
return folderIds.filter(id => permissionPrecise.value.folderManage(id))
}

}

function confirmSinglePermission() {
Expand Down
1 change: 1 addition & 0 deletions ui/src/permission/application/system-manage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ const systemManage = {
folderEdit: () => false,
folderRead: () => false,
folderManage: () => false,
folderAuth: () => false,
export: () =>
hasPermission(
[
Expand Down
59 changes: 35 additions & 24 deletions ui/src/permission/application/workspace.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ const workspace = {
],
'OR'
),
folderCreate: () =>
folderCreate: (folder_id: string) =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_CREATE.getWorkspacePermission,
PermissionConst.APPLICATION_FOLDER_EDIT.getApplicationWorkspaceResourcePermission(folder_id),
PermissionConst.APPLICATION_CREATE.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
Expand All @@ -29,7 +29,37 @@ const workspace = {
new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_FOLDER_READ.getApplicationWorkspaceResourcePermission(folder_id),
PermissionConst.APPLICATION_FOLDER_READ.getWorkspacePermissionWorkspaceManageRole,
PermissionConst.APPLICATION_READ.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderEdit: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_FOLDER_EDIT.getApplicationWorkspaceResourcePermission(folder_id),
PermissionConst.APPLICATION_EDIT.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderAuth: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_FOLDER_EDIT.getApplicationWorkspaceResourcePermission(folder_id),
PermissionConst.APPLICATION_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderDelete: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_FOLDER_EDIT.getApplicationWorkspaceResourcePermission(folder_id),
PermissionConst.APPLICATION_DELETE.getWorkspacePermissionWorkspaceManageRole
],
'OR'
),
Expand Down Expand Up @@ -73,16 +103,6 @@ const workspace = {
],
'OR'
),
folderEdit: () =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_EDIT.getWorkspacePermissionWorkspaceManageRole,
PermissionConst.APPLICATION_EDIT.getWorkspacePermission
],
'OR'
),
export: (source_id:string) =>
hasPermission(
[
Expand All @@ -103,16 +123,7 @@ const workspace = {
],
'OR'
),
folderDelete: () =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.APPLICATION_DELETE.getWorkspacePermissionWorkspaceManageRole,
PermissionConst.APPLICATION_DELETE.getWorkspacePermission
],
'OR'
),

overview_embed: (source_id:string) =>
hasPermission(
[
Copy link
Contributor Author

@shaohuzhang1 shaohuzhang1 Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provided TypeScript code snippet is a configuration file that defines permissions for various actions related to folders within a system. The hasPermission function checks if an actor has the necessary roles or permissions specified in the role-based access control (RBAC) setup.

Overall, there are no significant irregularities in the structure of the code but some optimizations can be made:

  1. Code Duplication: Functions like folderCreate, folderEdit, folderAuth, folderDelete, and overview_embed have almost identical logic except for different parameters and permission IDs. Consider creating a helper function to handle these repeated sections.

  2. Documentation: Adding comments explaining each part of the RBAC rules could improve maintainability and understanding.

Here's an optimized version with minimal changes and additions:

const workspace = {
    // Function prototypes
    folderCreate: (folder_id: string) => {},
    folderEdit: (folder_id: string) => {},
    folderAuth: (folder_id: string) => {},
    folderDelete: (folder_id: string) => {},
    overview_embed: (source_id: string) => {},

    // Helper function for common permissions
    sharedPermissions: (...args) => [
        ...[RoleConst.USER],
        new ComplexPermission([RoleConst.USER], args.permissions, [], 'AND'),
        RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
        ...args.workspacePermissionList.map(permissionId =>
            PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(permissionId)
        ),
        ...args.workspaceManageRolePermissionList.map(roleId => `${roleName}.${roleId}`)
    ],

    // Permissions definitions
    folder_create_role_list: ['ROLE_USER', 'ROLE_WORKSPACE_MANAGER'],
    folder_edit_role_list: ['ROLE_USER', 'ROLE_WORKSPACE_MANAGER'], // Assuming ROLE_APPLICATION_EDITOR and similar exist
    folder_auth_role_list: [...this.folder_edit_role_list, ROLE_APPLICATION_ACCESS_CONTROL], 
    folder_delete_role_list: [...this.folder_edit_role_list, ROLE_PERMISSION_DELETE],

    folder_create_permission_list: [PERMISSION_ID_APPLICATION_ADD_FILE],
    folder_edit_workspace_management_permissions_list: ['workspace.application.edit.permission'],

    /**
     * Check permission to create a folder within a specific workspace.
     */
    async checkFolderCreatePermission(actor, workspace): Promise<boolean> {
        const params = this.sharedPermissions(this.constructor.name, {
            permissions: this.folder_create_permission_list,
            workspacePermissionList: this.folder_create_workspace ManagementPermissionsLiST,
            workspaceManageRolePermissionList: this.folder_create_role_list
        });
        return await hasPermission(params);
    },

    /**
     * Check permission to edit a folder within a specific workspace.
     */
    async checkFolderEditPermission(actor, workspace): Promise<boolean> {
        const params = this.sharedPermissions(this.constructor.name, {
            permissions: [
                PERMISSION_ID_APPLICATION_MODIFY_FILE,
                PERMISSION_ID_APPLICATION_VIEW_ALL_FILES
            ],
            workspacePermissionList: this.folder_edit_workspaceManagementPermissionsList,
            workspaceManageRolePermissionList: this.folder_edit_role_list
        });
        return await hasPermission(params);
    },
};

// Example usage:
async function exampleUsage() {
    const userActor = getActo('USER');
    const workspace = getWorkspace('EXAMPLE');

    console.log(await workspace.checkFolderCreatePermission(userActor, workspace));
    console.log(await workspace.checkFolderEditPermission(userActor, workspace));
}

exampleUsage();

Key Changes and Additions:

  • Reduced duplication by extracting common permission logic into a helper function.
  • Added documentation through annotations and comments.
  • Created method names for checking permissions (checkFolderxxxPermission) which are more descriptive and easier to understand when using the class methods.

Expand Down
1 change: 1 addition & 0 deletions ui/src/permission/knowledge/system-manage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,7 @@ const systemManage = {
folderManage: () => false,
folderCreate: () => false,
folderEdit: () => false,
folderAuth: () => false,
folderDelete: () => false,
hit_test: () =>
hasPermission([
Expand Down
1 change: 1 addition & 0 deletions ui/src/permission/knowledge/system-share.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ const share = {
folderManage: () => false,
folderCreate: () => false,
folderEdit: () => false,
folderAuth: () => false,
folderDelete: () => false,
hit_test: () => false,
}
Expand Down
1 change: 1 addition & 0 deletions ui/src/permission/knowledge/workspace-share.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ const workspaceShare = {
folderManage: () => false,
folderCreate: () => false,
folderEdit: () => false,
folderAuth: () => false,
folderDelete: () => false,
hit_test: () => false,
}
Expand Down
79 changes: 49 additions & 30 deletions ui/src/permission/knowledge/workspace.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,56 @@ const workspace = {
],
'OR',
),
folderRead: () => true,
folderRead: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_FOLDER_READ.getKnowledgeWorkspaceResourcePermission(folder_id),
PermissionConst.KNOWLEDGE_READ.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderManage: () => true,
folderCreate: () =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_CREATE.getWorkspacePermission,
PermissionConst.KNOWLEDGE_CREATE.getWorkspacePermissionWorkspaceManageRole,
],
'OR',
folderAuth: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_FOLDER_EDIT.getKnowledgeWorkspaceResourcePermission(folder_id),
PermissionConst.KNOWLEDGE_RESOURCE_AUTHORIZATION.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderCreate: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_FOLDER_EDIT.getKnowledgeWorkspaceResourcePermission(folder_id),
PermissionConst.KNOWLEDGE_CREATE.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderDelete: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_FOLDER_EDIT.getKnowledgeWorkspaceResourcePermission(folder_id),
PermissionConst.KNOWLEDGE_DELETE.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
folderEdit: (folder_id: string) =>
hasPermission(
[
new ComplexPermission([RoleConst.USER],[PermissionConst.KNOWLEDGE.getKnowledgeWorkspaceResourcePermission(folder_id)],[],'AND'),
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_FOLDER_EDIT.getKnowledgeWorkspaceResourcePermission(folder_id),
PermissionConst.KNOWLEDGE_EDIT.getWorkspacePermissionWorkspaceManageRole,
],
'OR'
),
sync: (source_id:string) =>
hasPermission(
Expand Down Expand Up @@ -82,16 +121,6 @@ const workspace = {
],
'OR',
),
folderEdit: () =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_EDIT.getWorkspacePermission,
PermissionConst.KNOWLEDGE_EDIT.getWorkspacePermissionWorkspaceManageRole,
],
'OR',
),
export: (source_id:string) =>
hasPermission(
[
Expand All @@ -112,16 +141,6 @@ const workspace = {
],
'OR',
),
folderDelete: () =>
hasPermission(
[
RoleConst.USER.getWorkspaceRole,
RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
PermissionConst.KNOWLEDGE_DELETE.getWorkspacePermission,
PermissionConst.KNOWLEDGE_DELETE.getWorkspacePermissionWorkspaceManageRole,
],
'OR',
),
doc_read: () => false,
doc_create: (source_id:string) =>
hasPermission(
Copy link
Contributor Author

@shaohuzhang1 shaohuzhang1 Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provided code appears to be implementing permission checks using a complex hasPermission function with nested ComplexPermission objects. However, there are several improvements that can be made:

  1. Consistency: The method names for permissions (folderRead, folderCreate, etc.) should match the resource name they operate on.

  2. Duplicated Logic: Many of the methods share similar logic for checking permissions. This could be consolidated into fewer functions or abstracted away.

  3. Typo Correction: There is a typo in _rolePermissions which might be unintentional.

  4. Error Handling: Consider adding error handling to manage cases where permissions cannot be retrieved or checked due to exceptions.

Here's an optimized version of your code:

const workspace = {
  knowledgeRead: (workspaceId: string) => {
    return hasPermission([
      hasPermission(RoleConst.USER, WorkspaceRoles.workspaceManager),
      hasPermission(
        PermissionConst.KNOWLEDGE_WORKSPACE_RESOURCE_PERMISSION,
        { resourceIdType: ResourceTypeEnum.WORKSPACE, resourceId: workspaceId }
      )
    ]).OR;
  },
  // Consolidated folders management methods:
  folderPermissions(basePermissions: IHasBasePermissions): IFolderPermissions {
    [RoleConst.USER.getWorkspaceRole(), RoleConst.WORKSPACE_MANAGE.getWorkspaceRole()].
      forEach(role => basePermissions.addRole(role));

    ['read', 'create', 'edit', 'delete'].forEach(action => {
      const actionPermissionKey = PermissionConst[`${action.toUpperCase()}${capitalize('knowledge')}_${ResourceTypeEnum.FOLDER}_${action}`];
      if (!Object.keys(PermissionConst).includes(actionPermissionKey))
        throw new Error(`Missing ${action} permission key in PermissionConst`);

      basePermissions.addPermission({
        role: '',
        permissionKey: actionPermissionKey,
        target: ResourceTypeEnum.FOLDER,
        action
      });
    });

    return basePermissions;
  },

  folderAccess: (folderId: string) => this.folderPermissions(new HasBasePermissions())
    .checkPermission(ResourceTypeEnum.FOLDER),
};

Key Changes:

  • Logical Grouping: Folder operations have been consolidated into a single method folderPermissions.
  • Error Checking: A check is added at runtime to ensure all necessary permission keys exist in PermissionConst.
  • Template Literals: Used for constructing permission keys dynamically.
  • Method Naming: Renamed methods to be more descriptive and consistent with IHasBasePermissions.

These changes improve maintainability, reduce redundancy, and add better structure to the permission logic.

Expand Down
1 change: 1 addition & 0 deletions ui/src/permission/model/system-manage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ const systemManage = {
folderManage: () => false,
folderCreate: () => false,
folderEdit: () => false,
folderAuth: () => false,
folderDelete: () => false,
}

Expand Down
Loading
Loading