WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/application/service/session_agent_execution.go

@@ -0,0 +1,51 @@
+package service
+
+import (
+	"context"
+
+	"github.com/Tencent/WeKnora/internal/accesspolicy"
+	apperrors "github.com/Tencent/WeKnora/internal/errors"
+	"github.com/Tencent/WeKnora/internal/im"
+	"github.com/Tencent/WeKnora/internal/types"
+)
+
+func (s *sessionService) prepareQAAgentExecution(ctx context.Context, req *types.QARequest) (context.Context, error) {
+	if req.CustomAgent == nil || s.customAgentService == nil {
+		return ctx, nil
+	}
+	provider, ok := s.customAgentService.(interface {
+		PrepareAgentExecutionContext(context.Context, string) (context.Context, error)
+	})
+	if !ok {
+		return ctx, apperrors.NewForbiddenError("Agent 执行授权校验不可用，请稍后重试")
+	}
+	agent := req.CustomAgent
+	executionCtx := ctx
+	if req.SharedAgentReadOnly {
+		if req.Session == nil || req.Session.TenantID == 0 || s.agentShareService == nil {
+			return ctx, apperrors.NewForbiddenError("共享 Agent 已失效或无权使用")
+		}
+		// The request handler already selected the source workspace. Recheck
+		// its organization share before granting that exact Agent execution.
+		shared, err := s.agentShareService.GetSharedAgentForTenant(ctx, req.Session.TenantID, types.TenantRoleFromContext(ctx), agent.ID, agent.TenantID)
+		if err != nil || shared == nil || shared.ID != agent.ID || shared.TenantID != agent.TenantID {
+			return ctx, apperrors.NewForbiddenError("共享 Agent 已失效或无权使用")
+		}
+		executionCtx = accesspolicy.WithExecutionDependency(ctx, shared.TenantID, "agents", shared.ID, shared.CreatedBy)
+	} else if im.IsVerifiedAgentExecution(ctx, agent) {
+		executionCtx = accesspolicy.WithExecutionDependency(ctx, agent.TenantID, "agents", agent.ID, agent.CreatedBy)
+	}
+	prepared, err := provider.PrepareAgentExecutionContext(executionCtx, agent.ID)
+	if err != nil {
+		return ctx, err
+	}
+	current, err := s.customAgentService.GetAgentByID(prepared, agent.ID)
+	if err != nil {
+		return ctx, err
+	}
+	if current == nil || current.TenantID != agent.TenantID {
+		return ctx, apperrors.NewForbiddenError("Agent 已删除或无权使用")
+	}
+	req.CustomAgent = current
+	return prepared, nil
+}