xinmi/internal/workbench/execution_access.go

package workbench

import (
	"context"
	"errors"
	"fmt"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	apperrors "github.com/Tencent/WeKnora/internal/errors"
	"gorm.io/gorm"
)

type agentExecutionContextProvider interface {
	PrepareAgentExecutionContext(context.Context, string) (context.Context, error)
}

func (s *Service) agentExecutionContext(ctx context.Context, id string) (context.Context, error) {
	if provider, ok := s.agents.(agentExecutionContextProvider); ok {
		return provider.PrepareAgentExecutionContext(ctx, id)
	}
	return ctx, nil
}

// Only live, readable canvas nodes can delegate execution of their owner's
// private Agents. Client input and old task snapshots cannot add dependencies.
func (s *Service) taskExecutionContext(ctx context.Context, d TaskData) (context.Context, error) {
	if !accesspolicy.Allowed(ctx, "flows.read") {
		return ctx, ErrForbidden
	}
	r, err := s.get(ctx, "flows", d.FlowID)
	if err != nil {
		return ctx, fmt.Errorf("%w: 请重新选择可用的画布模板", ErrInvalid)
	}
	if err = requireExecutable(r); err != nil {
		return ctx, err
	}
	flow, err := decode[FlowData](r.Data)
	if err != nil {
		return ctx, ErrInvalid
	}
	if err = validateFlow(flow); err != nil {
		return ctx, err
	}
	for _, node := range flow.Nodes {
		ctx = accesspolicy.WithExecutionDependency(ctx, r.TenantID, "agents", node.AgentID, r.OwnerID)
	}
	for _, node := range flow.Nodes {
		ctx, err = s.agentExecutionContext(ctx, node.AgentID)
		if err != nil {
			var appError *apperrors.AppError
			configurationError := errors.Is(err, ErrForbidden) || errors.Is(err, ErrInvalid) || errors.Is(err, gorm.ErrRecordNotFound) ||
				(errors.As(err, &appError) && appError.HTTPCode >= 400 && appError.HTTPCode < 500)
			if !configurationError {
				return ctx, err
			}
			label := node.Label
			if label == "" {
				label = node.ID
			}
			return ctx, fmt.Errorf("%w: 画布「%s」的「%s」节点引用的 Agent 或其绑定资源已删除、停用或无权使用，请在画布编排中重新选择可用 Agent 后保存", ErrInvalid, r.Name, label)
		}
	}
	return ctx, nil
}