fix: tighten rag permissions and area scope

fastapi_modules/fastapi_leaudit/controllers/ragChatController.py

@@ -53,6 +53,10 @@ class RagChatController(BaseController):
         "message_feedback": "rag:message:feedback",
         "app_read": "rag:app:read",
         "dataset_read": "rag:dataset:read",
+        "dataset_manage": "rag:dataset:manage",
+        "dataset_create": "rag:dataset:create",
+        "dataset_update": "rag:dataset:update",
+        "dataset_delete": "rag:dataset:delete",
     }
 
     def __init__(self):
@@ -102,7 +106,7 @@ class RagChatController(BaseController):
             pageSize: int = Query(20, ge=1, le=200),
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_manage"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有管理知识库权限", "data": None})
             data = await self.RagDatasetService.GetAdminDatasets(
                 CurrentUserId=int(payload["user_id"]),
@@ -117,7 +121,7 @@ class RagChatController(BaseController):
 
         @self.router.post("/datasets/admin", response_model=Result[RagDatasetDetailVO])
         async def CreateAdminDataset(Body: dict[str, Any], payload: dict[str, Any] = Depends(verify_access_token)):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_create"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有创建知识库权限", "data": None})
             data = await self.RagDatasetService.CreateAdminDataset(
                 CurrentUserId=int(payload["user_id"]),
@@ -129,7 +133,7 @@ class RagChatController(BaseController):
 
         @self.router.put("/datasets/admin/{DatasetId}", response_model=Result[RagDatasetDetailVO | None])
         async def UpdateAdminDataset(DatasetId: int, Body: dict[str, Any], payload: dict[str, Any] = Depends(verify_access_token)):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有更新知识库权限", "data": None})
             data = await self.RagDatasetService.UpdateAdminDataset(
                 CurrentUserId=int(payload["user_id"]),
@@ -142,7 +146,7 @@ class RagChatController(BaseController):
 
         @self.router.delete("/datasets/admin/{DatasetId}", response_model=Result[RagOperationResultVO])
         async def DeleteAdminDataset(DatasetId: int, payload: dict[str, Any] = Depends(verify_access_token)):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_delete"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有删除知识库权限", "data": None})
             data = await self.RagDatasetService.DeleteAdminDataset(
                 CurrentUserId=int(payload["user_id"]),
@@ -166,7 +170,7 @@ class RagChatController(BaseController):
 
         @self.router.patch("/datasets/{DatasetId}", response_model=Result[RagDatasetDetailVO | None])
         async def UpdateDataset(DatasetId: int, Body: RagDatasetUpdateDTO, payload: dict[str, Any] = Depends(verify_access_token)):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有修改知识库权限", "data": None})
             data = await self.RagDatasetService.UpdateDataset(
                 CurrentUserId=int(payload["user_id"]),
@@ -222,7 +226,7 @@ class RagChatController(BaseController):
             data: str | None = Form(None),
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有上传知识库文档权限", "data": None})
             process_config = json.loads(data) if data else None
             file_bytes = await file.read()
@@ -246,7 +250,7 @@ class RagChatController(BaseController):
             data: str | None = Form(None),
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有重处理知识库文档权限", "data": None})
             process_config = json.loads(data) if data else None
             file_bytes = await file.read()
@@ -287,7 +291,7 @@ class RagChatController(BaseController):
             Body: dict[str, Any],
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有修改知识库文档状态权限", "data": None})
             enabled = Action == "enable"
             if Action not in {"enable", "disable"}:
@@ -332,7 +336,7 @@ class RagChatController(BaseController):
             DocumentId: int,
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_delete"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有删除知识库文档权限", "data": None})
             result = await self.RagDatasetService.DeleteDatasetDocument(
                 CurrentUserId=int(payload["user_id"]),
@@ -388,7 +392,7 @@ class RagChatController(BaseController):
             Body: dict[str, Any],
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_update"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有修改知识库分段权限", "data": None})
             result = await self.RagDatasetService.UpdateDatasetDocumentSegment(
                 CurrentUserId=int(payload["user_id"]),
@@ -408,7 +412,7 @@ class RagChatController(BaseController):
             SegmentId: str,
             payload: dict[str, Any] = Depends(verify_access_token),
         ):
-            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_read"]]):
+            if not await self._check_permission(int(payload["user_id"]), [self._PERMISSIONS["dataset_delete"]]):
                 return JSONResponse(status_code=403, content={"code": 403, "msg": "当前用户没有删除知识库分段权限", "data": None})
             result = await self.RagDatasetService.DeleteDatasetDocumentSegment(
                 CurrentUserId=int(payload["user_id"]),