Hass/xiaozhi-esp32-server
1
0
Fork 0
mirror of https://github.com/xinnan-tech/xiaozhi-esp32-server.git synced 2026-07-22 15:13:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

uptate:增加知识库权限判断

Browse Source
This commit is contained in:
rainv123
2025-11-05 17:02:27 +08:00
parent 289f2ad199
commit 873daf093d
6 changed files with 100 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main/manager-api/src/main/java/xiaozhi/common/exception/ErrorCode.java
+1
View File
@@ -207,4 +207,5 @@ public interface ErrorCode {
int RAG_DEFAULT_CONFIG_NOT_FOUND = 10166; // 默认RAG配置未找到
int RAG_CONFIG_MISSING_PARAMS = 10167; // RAG配置缺少必要参数
int UPLOAD_FILE_ERROR = 10168; // 上传文件失败
int NO_PERMISSION = 10169; // 没有权限
}
main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeBaseController.java
+48
View File
@@ -14,6 +14,7 @@ import org.springframework.web.bind.annotation.RestController;
import org.apache.commons.lang3.StringUtils;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.exception.RenException;
import xiaozhi.modules.security.user.SecurityUser;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.Parameter;
@@ -39,8 +40,13 @@ public class KnowledgeBaseController {
@RequestParam(required = false) String name,
@RequestParam(required = false, defaultValue = "1") Integer page,
@RequestParam(required = false, defaultValue = "10") Integer page_size) {
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
KnowledgeBaseDTO knowledgeBaseDTO = new KnowledgeBaseDTO();
knowledgeBaseDTO.setName(name);
knowledgeBaseDTO.setCreator(currentUserId); // 设置创建者ID，用于权限过滤
PageData<KnowledgeBaseDTO> pageData = knowledgeBaseService.getPageList(knowledgeBaseDTO, page, page_size);
return new Result<PageData<KnowledgeBaseDTO>>().ok(pageData);
}
@@ -49,7 +55,16 @@ public class KnowledgeBaseController {
@Operation(summary = "根据知识库ID获取知识库详情")
@RequiresPermissions("sys:role:normal")
public Result<KnowledgeBaseDTO> getByDatasetId(@PathVariable("dataset_id") String datasetId) {
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
KnowledgeBaseDTO knowledgeBaseDTO = knowledgeBaseService.getByDatasetId(datasetId);
// 检查权限：用户只能查看自己创建的知识库
if (knowledgeBaseDTO.getCreator() == null || !knowledgeBaseDTO.getCreator().equals(currentUserId)) {
throw new RenException(ErrorCode.NO_PERMISSION);
}
return new Result<KnowledgeBaseDTO>().ok(knowledgeBaseDTO);
}
@@ -66,6 +81,17 @@ public class KnowledgeBaseController {
@RequiresPermissions("sys:role:normal")
public Result<KnowledgeBaseDTO> update(@PathVariable("dataset_id") String datasetId,
@RequestBody @Validated KnowledgeBaseDTO knowledgeBaseDTO) {
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
// 先获取现有知识库信息以检查权限
KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId);
// 检查权限：用户只能更新自己创建的知识库
if (existingKnowledgeBase.getCreator() == null || !existingKnowledgeBase.getCreator().equals(currentUserId)) {
throw new RenException(ErrorCode.NO_PERMISSION);
}
knowledgeBaseDTO.setDatasetId(datasetId);
KnowledgeBaseDTO resp = knowledgeBaseService.update(knowledgeBaseDTO);
return new Result<KnowledgeBaseDTO>().ok(resp);
@@ -76,6 +102,17 @@ public class KnowledgeBaseController {
@Parameter(name = "dataset_id", description = "知识库ID", required = true)
@RequiresPermissions("sys:role:normal")
public Result<Void> delete(@PathVariable("dataset_id") String datasetId) {
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
// 先获取现有知识库信息以检查权限
KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId);
// 检查权限：用户只能删除自己创建的知识库
if (existingKnowledgeBase.getCreator() == null || !existingKnowledgeBase.getCreator().equals(currentUserId)) {
throw new RenException(ErrorCode.NO_PERMISSION);
}
knowledgeBaseService.deleteByDatasetId(datasetId);
return new Result<>();
}
@@ -89,9 +126,20 @@ public class KnowledgeBaseController {
throw new RenException(ErrorCode.PARAMS_GET_ERROR);
}
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
String[] idArray = ids.split(",");
for (String datasetId : idArray) {
if (StringUtils.isNotBlank(datasetId)) {
// 先获取现有知识库信息以检查权限
KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId.trim());
// 检查权限：用户只能删除自己创建的知识库
if (existingKnowledgeBase.getCreator() == null
|| !existingKnowledgeBase.getCreator().equals(currentUserId)) {
throw new RenException(ErrorCode.NO_PERMISSION);
}
knowledgeBaseService.deleteByDatasetId(datasetId.trim());
}
}
main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeFilesController.java
+42
View File
@@ -14,10 +14,15 @@ import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.Parameter;
import io.swagger.v3.oas.annotations.tags.Tag;
import lombok.AllArgsConstructor;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.exception.RenException;
import xiaozhi.common.page.PageData;
import xiaozhi.common.utils.Result;
import xiaozhi.modules.knowledge.dto.KnowledgeBaseDTO;
import xiaozhi.modules.knowledge.dto.KnowledgeFilesDTO;
import xiaozhi.modules.knowledge.service.KnowledgeBaseService;
import xiaozhi.modules.knowledge.service.KnowledgeFilesService;
import xiaozhi.modules.security.user.SecurityUser;
@AllArgsConstructor
@RestController
@@ -26,6 +31,25 @@ import xiaozhi.modules.knowledge.service.KnowledgeFilesService;
public class KnowledgeFilesController {
private final KnowledgeFilesService knowledgeFilesService;
private final KnowledgeBaseService knowledgeBaseService;
/**
* 验证当前用户是否有权限操作指定知识库
*
* @param datasetId 知识库ID
*/
private void validateKnowledgeBasePermission(String datasetId) {
// 获取当前登录用户ID
Long currentUserId = SecurityUser.getUserId();
// 获取知识库信息
KnowledgeBaseDTO knowledgeBase = knowledgeBaseService.getByDatasetId(datasetId);
// 检查权限：用户只能操作自己创建的知识库
if (knowledgeBase.getCreator() == null || !knowledgeBase.getCreator().equals(currentUserId)) {
throw new RenException(ErrorCode.NO_PERMISSION);
}
}
@GetMapping("/documents")
@Operation(summary = "分页查询文档列表")
@@ -35,6 +59,9 @@ public class KnowledgeFilesController {
@RequestParam(required = false) String name,
@RequestParam(required = false, defaultValue = "1") Integer page,
@RequestParam(required = false, defaultValue = "10") Integer page_size) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
KnowledgeFilesDTO knowledgeFilesDTO = new KnowledgeFilesDTO();
knowledgeFilesDTO.setDatasetId(datasetId);
knowledgeFilesDTO.setName(name);
@@ -53,6 +80,9 @@ public class KnowledgeFilesController {
@RequestParam(required = false) String metaFields,
@RequestParam(required = false) String parserConfig) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
KnowledgeFilesDTO resp = knowledgeFilesService.uploadDocument(datasetId, file, name,
metaFields != null ? parseJsonMap(metaFields) : null,
chunkMethod,
@@ -66,6 +96,9 @@ public class KnowledgeFilesController {
@RequiresPermissions("sys:role:normal")
public Result<Void> delete(@PathVariable("dataset_id") String datasetId,
@PathVariable("document_id") String documentId) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
knowledgeFilesService.deleteByDocumentId(documentId, datasetId);
return new Result<>();
}
@@ -75,6 +108,9 @@ public class KnowledgeFilesController {
@RequiresPermissions("sys:role:normal")
public Result<Void> parseDocuments(@PathVariable("dataset_id") String datasetId,
@RequestBody Map<String, List<String>> requestBody) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
List<String> documentIds = requestBody.get("document_ids");
if (documentIds == null || documentIds.isEmpty()) {
return new Result<Void>().error("document_ids参数不能为空");
@@ -97,6 +133,9 @@ public class KnowledgeFilesController {
@RequestParam(required = false, defaultValue = "1") Integer page,
@RequestParam(required = false, defaultValue = "1024") Integer page_size,
@RequestParam(required = false) String id) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
Map<String, Object> result = knowledgeFilesService.listChunks(datasetId, documentId, keywords, page, page_size,
id);
return new Result<Map<String, Object>>().ok(result);
@@ -110,6 +149,9 @@ public class KnowledgeFilesController {
@RequiresPermissions("sys:role:normal")
public Result<Map<String, Object>> retrievalTest(@PathVariable("dataset_id") String datasetId,
@RequestBody Map<String, Object> params) {
// 验证知识库权限
validateKnowledgeBasePermission(datasetId);
try {
// 提取参数
String question = (String) params.get("question");
main/manager-api/src/main/resources/i18n/messages_en_US.properties
+3 -7
View File
@@ -174,11 +174,7 @@
10165=RAG configuration type error
10166=Default RAG configuration not found
10167=RAG configuration missing required parameters
10168=RAG API create dataset failed
10169=RAG API update dataset failed
10170=RAG API delete dataset failed
10171=Upload file failed
10172=RAG API query failed
10173=RAG API parse failed
10174=RAG API operation failed
10168=Upload file failed
10169=No permission to operate this knowledge base
main/manager-api/src/main/resources/i18n/messages_zh_CN.properties
+2 -7
View File
@@ -174,10 +174,5 @@
10165=RAG\u914D\u7F6E\u7C7B\u578B\u9519\u8BEF
10166=\u9ED8\u8BA4RAG\u914D\u7F6E\u672A\u627E\u5230
10167=RAG\u914D\u7F6E\u7F3A\u5C11\u5FC5\u8981\u53C2\u6570
10168=RAG API\u521B\u5EFA\u6570\u636E\u96C6\u5931\u8D25
10169=RAG API\u66F4\u65B0\u6570\u636E\u96C6\u5931\u8D25
10170=RAG API\u5220\u9664\u6570\u636E\u96C6\u5931\u8D25
10171=\u4E0A\u4F20\u6587\u4EF6\u5931\u8D25
10172=RAG API\u67E5\u8BE2\u5931\u8D25
10173=RAG API\u89E3\u6790\u5931\u8D25
10174=RAG API\u64CD\u4F5C\u5931\u8D25
10168=\u4E0A\u4F20\u6587\u4EF6\u5931\u8D25
10169=\u60A8\u6CA1\u6709\u6743\u9650\u64CD\u4F5C\u8BE5\u8BB0\u5F55
main/manager-api/src/main/resources/i18n/messages_zh_TW.properties
+4 -7
View File
@@ -174,10 +174,7 @@
10165=RAG\u914D\u7F6E\u985E\u578B\u932F\u8AA4
10166=\u9810\u8A2DRAG\u914D\u7F6E\u672A\u627E\u5230
10167=RAG\u914D\u7F6E\u7F3A\u5C11\u5FC5\u8981\u53C3\u6578
10168=RAG API\u5275\u5EFA\u6578\u64DA\u96C6\u5931\u6557
10169=RAG API\u66F4\u65B0\u6578\u64DA\u96C6\u5931\u6557
10170=RAG API\u522A\u9664\u6578\u64DA\u96C6\u5931\u6557
10171=\u4E0A\u50B3\u6587\u4EF6\u5931\u6557
10172=RAG API\u67E5\u8A62\u5931\u6557
10173=RAG API\u5256\u6790\u5931\u6557
10174=RAG API\u64CD\u4F5C\u5931\u6557
10168=\u4E0A\u50B3\u6587\u4EF6\u5931\u6557
10169=\u60A8\u6CA1\u6709\u6743\u9650\u64CD\u4F5C\u8BE5\u8BB0\u5F55