48 lines
1.6 KiB
Go
48 lines
1.6 KiB
Go
|
package middleware
|
||
|
|
|
||
|
|
import (
|
||
|
|
"github.com/Tencent/WeKnora/internal/accesspolicy"
|
||
|
|
apperrors "github.com/Tencent/WeKnora/internal/errors"
|
||
|
|
"github.com/Tencent/WeKnora/internal/types"
|
||
|
|
"github.com/gin-gonic/gin"
|
||
|
|
)
|
||
|
|
|
||
|
|
// RequireKnowledgeExport runs after RequireKBAccess. Published and granted
|
||
|
|
// resources are read/use only; API keys retain their route and KB scopes.
|
||
|
|
func RequireKnowledgeExport() gin.HandlerFunc {
|
||
|
|
return func(c *gin.Context) {
|
||
|
|
ctx := c.Request.Context()
|
||
|
|
if _, apiKey := types.TenantAPIKeyScopeFromContext(ctx); apiKey {
|
||
|
|
c.Next()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if types.IsSystemAdminFromContext(ctx) || types.TenantRoleFromContext(ctx).HasPermission(types.TenantRoleAdmin) {
|
||
|
|
c.Next()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
snapshot := accesspolicy.FromContext(ctx)
|
||
|
|
if snapshot == nil {
|
||
|
|
c.Next()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
access, ok := KBAccessFromContext(c)
|
||
|
|
if !ok || access == nil || access.KnowledgeBase == nil {
|
||
|
|
_ = c.Error(apperrors.NewServiceUnavailableError("cannot verify knowledge export permission"))
|
||
|
|
c.Abort()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if snapshot.Publications["knowledge:"+access.KnowledgeBase.ID] || snapshot.NoExport["knowledge:"+access.KnowledgeBase.ID] {
|
||
|
|
_ = c.Error(apperrors.NewForbiddenError("全局知识库仅支持查看和使用，普通用户不能导出"))
|
||
|
|
c.Abort()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
userID, _ := types.UserIDFromContext(ctx)
|
||
|
|
if userID == "" || access.KnowledgeBase.CreatorID == "" || access.KnowledgeBase.CreatorID != userID {
|
||
|
|
_ = c.Error(apperrors.NewForbiddenError("授权知识库仅支持查看和使用，非所有者不能导出"))
|
||
|
|
c.Abort()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
c.Next()
|
||
|
|
}
|
||
|
|
}
|