WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/application/service/asset_access.go

@@ -0,0 +1,85 @@
+package service
+
+import (
+	"context"
+	"github.com/Tencent/WeKnora/internal/accesspolicy"
+	apperrors "github.com/Tencent/WeKnora/internal/errors"
+
+	"github.com/Tencent/WeKnora/internal/types"
+)
+
+func assetAdministrator(ctx context.Context) bool {
+	return types.IsSystemAdminFromContext(ctx) || types.TenantRoleFromContext(ctx).HasPermission(types.TenantRoleAdmin)
+}
+
+func assetOwnedByCaller(ctx context.Context, tenant uint64, owner string) bool {
+	current, ok := types.TenantIDFromContext(ctx)
+	if !ok || current == 0 || current != tenant {
+		return false
+	}
+	if assetAdministrator(ctx) {
+		return true
+	}
+	user, ok := types.UserIDFromContext(ctx)
+	return ok && user != "" && !types.IsSyntheticUserID(user) && owner != "" && owner == user
+}
+
+// CheckKnowledgeBaseCopyPermission is used before enqueueing and again by the
+// worker. Jobs without a human initiator retain their internal tenant scope.
+func CheckKnowledgeBaseCopyPermission(ctx context.Context, kb *types.KnowledgeBase) error {
+	tenant, ok := types.TenantIDFromContext(ctx)
+	if kb == nil || !ok || tenant == 0 || kb.TenantID != tenant {
+		return apperrors.NewForbiddenError("没有此知识库的复制权限")
+	}
+	if assetAdministrator(ctx) {
+		return nil
+	}
+	user, hasUser := types.UserIDFromContext(ctx)
+	if _, apiKey := types.TenantAPIKeyScopeFromContext(ctx); apiKey {
+		return types.AuthorizeTenantAPIKeyKnowledgeBases(ctx, kb.ID)
+	}
+	if !hasUser && accesspolicy.FromContext(ctx) == nil {
+		return nil
+	}
+	if user == "" || types.IsSyntheticUserID(user) || user != kb.CreatorID {
+		return apperrors.NewForbiddenError("共享知识库仅支持查看和使用，不能复制")
+	}
+	if snapshot := accesspolicy.FromContext(ctx); snapshot != nil && snapshot.NoExport["knowledge:"+kb.ID] {
+		return apperrors.NewForbiddenError("此知识库不允许复制或导出")
+	}
+	return nil
+}
+
+func nativeAgentReadable(ctx context.Context, agent *types.CustomAgent) bool {
+	if agent == nil {
+		return false
+	}
+	agent.EnsureDefaults()
+	tenant, ok := types.TenantIDFromContext(ctx)
+	if !agent.Enabled && !assetOwnedByCaller(ctx, agent.TenantID, agent.CreatedBy) {
+		return false
+	}
+	return ok && tenant != 0 && tenant == agent.TenantID &&
+		accesspolicy.Allowed(ctx, "agents.read") && accesspolicy.Readable(ctx, "agents", agent.ID, assetOwnedByCaller(ctx, tenant, agent.CreatedBy), agent.Visibility == "global" && agent.Enabled)
+}
+
+func nativeAgentExecutableDependency(ctx context.Context, agent *types.CustomAgent) bool {
+	if agent == nil {
+		return false
+	}
+	agent.EnsureDefaults()
+	return agent.Enabled && accesspolicy.CanExecuteDependency(ctx, agent.TenantID, "agents", agent.ID, agent.CreatedBy)
+}
+
+func instructionSkillReadable(ctx context.Context, skill *types.TenantSkillCatalogEntity) bool {
+	if skill == nil || !skill.InstructionOnly {
+		return false
+	}
+	skill.EnsureInstructionDefaults()
+	tenant, ok := types.TenantIDFromContext(ctx)
+	if !skill.Enabled && !assetOwnedByCaller(ctx, skill.TenantID, skill.CreatedBy) {
+		return false
+	}
+	return ok && tenant != 0 && tenant == skill.TenantID &&
+		accesspolicy.Allowed(ctx, "agents.read") && accesspolicy.Readable(ctx, "skills", skill.ID, assetOwnedByCaller(ctx, tenant, skill.CreatedBy), skill.Visibility == "global" && skill.Enabled)
+}