renjianbo
51eafb23f3
Three changes to fix the CS agent (3490efa8) and other public agents not being accessible to regular users: - agents.py: include is_public=1 agents in listing query for non-admin users - agent_chat.py: add is_public check in chat/stream permission guards - permission_service.py: grant read+execute to all users for public agents Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
115 lines
2.9 KiB
Python
115 lines
2.9 KiB
Python
"""
|
||
权限服务
|
||
提供权限检查的辅助函数
|
||
"""
|
||
from sqlalchemy.orm import Session
|
||
from app.models.permission import WorkflowPermission, AgentPermission
|
||
from app.models.user import User
|
||
from app.models.workflow import Workflow
|
||
from app.models.agent import Agent
|
||
from typing import Optional
|
||
|
||
|
||
def check_workflow_permission(
|
||
db: Session,
|
||
user: User,
|
||
workflow: Workflow,
|
||
permission_type: str
|
||
) -> bool:
|
||
"""
|
||
检查用户对工作流的权限
|
||
|
||
Args:
|
||
db: 数据库会话
|
||
user: 用户对象
|
||
workflow: 工作流对象
|
||
permission_type: 权限类型（read/write/execute/share）
|
||
|
||
Returns:
|
||
bool: 是否有权限
|
||
"""
|
||
# 管理员拥有所有权限
|
||
if user.role == "admin":
|
||
return True
|
||
|
||
# 工作流所有者拥有所有权限
|
||
if workflow.user_id == user.id:
|
||
return True
|
||
|
||
# 检查用户直接权限
|
||
user_permission = db.query(WorkflowPermission).filter(
|
||
WorkflowPermission.workflow_id == workflow.id,
|
||
WorkflowPermission.user_id == user.id,
|
||
WorkflowPermission.permission_type == permission_type
|
||
).first()
|
||
|
||
if user_permission:
|
||
return True
|
||
|
||
# 检查角色权限
|
||
for role in user.roles:
|
||
role_permission = db.query(WorkflowPermission).filter(
|
||
WorkflowPermission.workflow_id == workflow.id,
|
||
WorkflowPermission.role_id == role.id,
|
||
WorkflowPermission.permission_type == permission_type
|
||
).first()
|
||
|
||
if role_permission:
|
||
return True
|
||
|
||
return False
|
||
|
||
|
||
def check_agent_permission(
|
||
db: Session,
|
||
user: User,
|
||
agent: Agent,
|
||
permission_type: str
|
||
) -> bool:
|
||
"""
|
||
检查用户对Agent的权限
|
||
|
||
Args:
|
||
db: 数据库会话
|
||
user: 用户对象
|
||
agent: Agent对象
|
||
permission_type: 权限类型（read/write/execute/deploy）
|
||
|
||
Returns:
|
||
bool: 是否有权限
|
||
"""
|
||
# 管理员拥有所有权限
|
||
if user.role == "admin":
|
||
return True
|
||
|
||
# Agent所有者拥有所有权限
|
||
if agent.user_id == user.id:
|
||
return True
|
||
|
||
# 公开Agent允许所有用户read和execute
|
||
if agent.is_public and permission_type in ("read", "execute"):
|
||
return True
|
||
|
||
# 检查用户直接权限
|
||
user_permission = db.query(AgentPermission).filter(
|
||
AgentPermission.agent_id == agent.id,
|
||
AgentPermission.user_id == user.id,
|
||
AgentPermission.permission_type == permission_type
|
||
).first()
|
||
|
||
if user_permission:
|
||
return True
|
||
|
||
# 检查角色权限
|
||
for role in user.roles:
|
||
role_permission = db.query(AgentPermission).filter(
|
||
AgentPermission.agent_id == agent.id,
|
||
AgentPermission.role_id == role.id,
|
||
AgentPermission.permission_type == permission_type
|
||
).first()
|
||
|
||
if role_permission:
|
||
return True
|
||
|
||
return False
|