From 873daf093dd99e0a65904838812e6abf81217b06 Mon Sep 17 00:00:00 2001 From: rainv123 <2148537152@qq.com> Date: Wed, 5 Nov 2025 17:02:27 +0800 Subject: [PATCH] =?UTF-8?q?uptate:=E5=A2=9E=E5=8A=A0=E7=9F=A5=E8=AF=86?= =?UTF-8?q?=E5=BA=93=E6=9D=83=E9=99=90=E5=88=A4=E6=96=AD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../xiaozhi/common/exception/ErrorCode.java | 1 + .../controller/KnowledgeBaseController.java | 48 +++++++++++++++++++ .../controller/KnowledgeFilesController.java | 42 ++++++++++++++++ .../resources/i18n/messages_en_US.properties | 10 ++-- .../resources/i18n/messages_zh_CN.properties | 9 +--- .../resources/i18n/messages_zh_TW.properties | 11 ++--- 6 files changed, 100 insertions(+), 21 deletions(-) diff --git a/main/manager-api/src/main/java/xiaozhi/common/exception/ErrorCode.java b/main/manager-api/src/main/java/xiaozhi/common/exception/ErrorCode.java index f3060fa8..0773092a 100644 --- a/main/manager-api/src/main/java/xiaozhi/common/exception/ErrorCode.java +++ b/main/manager-api/src/main/java/xiaozhi/common/exception/ErrorCode.java @@ -207,4 +207,5 @@ public interface ErrorCode { int RAG_DEFAULT_CONFIG_NOT_FOUND = 10166; // 默认RAG配置未找到 int RAG_CONFIG_MISSING_PARAMS = 10167; // RAG配置缺少必要参数 int UPLOAD_FILE_ERROR = 10168; // 上传文件失败 + int NO_PERMISSION = 10169; // 没有权限 } diff --git a/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeBaseController.java b/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeBaseController.java index 5c5d9011..c3d41066 100644 --- a/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeBaseController.java +++ b/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeBaseController.java @@ -14,6 +14,7 @@ import org.springframework.web.bind.annotation.RestController; import org.apache.commons.lang3.StringUtils; import xiaozhi.common.exception.ErrorCode; import xiaozhi.common.exception.RenException; +import xiaozhi.modules.security.user.SecurityUser; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.Parameter; @@ -39,8 +40,13 @@ public class KnowledgeBaseController { @RequestParam(required = false) String name, @RequestParam(required = false, defaultValue = "1") Integer page, @RequestParam(required = false, defaultValue = "10") Integer page_size) { + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); + KnowledgeBaseDTO knowledgeBaseDTO = new KnowledgeBaseDTO(); knowledgeBaseDTO.setName(name); + knowledgeBaseDTO.setCreator(currentUserId); // 设置创建者ID，用于权限过滤 + PageData pageData = knowledgeBaseService.getPageList(knowledgeBaseDTO, page, page_size); return new Result>().ok(pageData); } @@ -49,7 +55,16 @@ public class KnowledgeBaseController { @Operation(summary = "根据知识库ID获取知识库详情") @RequiresPermissions("sys:role:normal") public Result getByDatasetId(@PathVariable("dataset_id") String datasetId) { + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); + KnowledgeBaseDTO knowledgeBaseDTO = knowledgeBaseService.getByDatasetId(datasetId); + + // 检查权限：用户只能查看自己创建的知识库 + if (knowledgeBaseDTO.getCreator() == null || !knowledgeBaseDTO.getCreator().equals(currentUserId)) { + throw new RenException(ErrorCode.NO_PERMISSION); + } + return new Result().ok(knowledgeBaseDTO); } @@ -66,6 +81,17 @@ public class KnowledgeBaseController { @RequiresPermissions("sys:role:normal") public Result update(@PathVariable("dataset_id") String datasetId, @RequestBody @Validated KnowledgeBaseDTO knowledgeBaseDTO) { + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); + + // 先获取现有知识库信息以检查权限 + KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId); + + // 检查权限：用户只能更新自己创建的知识库 + if (existingKnowledgeBase.getCreator() == null || !existingKnowledgeBase.getCreator().equals(currentUserId)) { + throw new RenException(ErrorCode.NO_PERMISSION); + } + knowledgeBaseDTO.setDatasetId(datasetId); KnowledgeBaseDTO resp = knowledgeBaseService.update(knowledgeBaseDTO); return new Result().ok(resp); @@ -76,6 +102,17 @@ public class KnowledgeBaseController { @Parameter(name = "dataset_id", description = "知识库ID", required = true) @RequiresPermissions("sys:role:normal") public Result delete(@PathVariable("dataset_id") String datasetId) { + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); + + // 先获取现有知识库信息以检查权限 + KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId); + + // 检查权限：用户只能删除自己创建的知识库 + if (existingKnowledgeBase.getCreator() == null || !existingKnowledgeBase.getCreator().equals(currentUserId)) { + throw new RenException(ErrorCode.NO_PERMISSION); + } + knowledgeBaseService.deleteByDatasetId(datasetId); return new Result<>(); } @@ -89,9 +126,20 @@ public class KnowledgeBaseController { throw new RenException(ErrorCode.PARAMS_GET_ERROR); } + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); String[] idArray = ids.split(","); for (String datasetId : idArray) { if (StringUtils.isNotBlank(datasetId)) { + // 先获取现有知识库信息以检查权限 + KnowledgeBaseDTO existingKnowledgeBase = knowledgeBaseService.getByDatasetId(datasetId.trim()); + + // 检查权限：用户只能删除自己创建的知识库 + if (existingKnowledgeBase.getCreator() == null + || !existingKnowledgeBase.getCreator().equals(currentUserId)) { + throw new RenException(ErrorCode.NO_PERMISSION); + } + knowledgeBaseService.deleteByDatasetId(datasetId.trim()); } } diff --git a/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeFilesController.java b/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeFilesController.java index 059e5ffe..4f2f5ccc 100644 --- a/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeFilesController.java +++ b/main/manager-api/src/main/java/xiaozhi/modules/knowledge/controller/KnowledgeFilesController.java @@ -14,10 +14,15 @@ import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.Parameter; import io.swagger.v3.oas.annotations.tags.Tag; import lombok.AllArgsConstructor; +import xiaozhi.common.exception.ErrorCode; +import xiaozhi.common.exception.RenException; import xiaozhi.common.page.PageData; import xiaozhi.common.utils.Result; +import xiaozhi.modules.knowledge.dto.KnowledgeBaseDTO; import xiaozhi.modules.knowledge.dto.KnowledgeFilesDTO; +import xiaozhi.modules.knowledge.service.KnowledgeBaseService; import xiaozhi.modules.knowledge.service.KnowledgeFilesService; +import xiaozhi.modules.security.user.SecurityUser; @AllArgsConstructor @RestController @@ -26,6 +31,25 @@ import xiaozhi.modules.knowledge.service.KnowledgeFilesService; public class KnowledgeFilesController { private final KnowledgeFilesService knowledgeFilesService; + private final KnowledgeBaseService knowledgeBaseService; + + /** + * 验证当前用户是否有权限操作指定知识库 + * + * @param datasetId 知识库ID + */ + private void validateKnowledgeBasePermission(String datasetId) { + // 获取当前登录用户ID + Long currentUserId = SecurityUser.getUserId(); + + // 获取知识库信息 + KnowledgeBaseDTO knowledgeBase = knowledgeBaseService.getByDatasetId(datasetId); + + // 检查权限：用户只能操作自己创建的知识库 + if (knowledgeBase.getCreator() == null || !knowledgeBase.getCreator().equals(currentUserId)) { + throw new RenException(ErrorCode.NO_PERMISSION); + } + } @GetMapping("/documents") @Operation(summary = "分页查询文档列表") @@ -35,6 +59,9 @@ public class KnowledgeFilesController { @RequestParam(required = false) String name, @RequestParam(required = false, defaultValue = "1") Integer page, @RequestParam(required = false, defaultValue = "10") Integer page_size) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + KnowledgeFilesDTO knowledgeFilesDTO = new KnowledgeFilesDTO(); knowledgeFilesDTO.setDatasetId(datasetId); knowledgeFilesDTO.setName(name); @@ -53,6 +80,9 @@ public class KnowledgeFilesController { @RequestParam(required = false) String metaFields, @RequestParam(required = false) String parserConfig) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + KnowledgeFilesDTO resp = knowledgeFilesService.uploadDocument(datasetId, file, name, metaFields != null ? parseJsonMap(metaFields) : null, chunkMethod, @@ -66,6 +96,9 @@ public class KnowledgeFilesController { @RequiresPermissions("sys:role:normal") public Result delete(@PathVariable("dataset_id") String datasetId, @PathVariable("document_id") String documentId) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + knowledgeFilesService.deleteByDocumentId(documentId, datasetId); return new Result<>(); } @@ -75,6 +108,9 @@ public class KnowledgeFilesController { @RequiresPermissions("sys:role:normal") public Result parseDocuments(@PathVariable("dataset_id") String datasetId, @RequestBody Map> requestBody) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + List documentIds = requestBody.get("document_ids"); if (documentIds == null || documentIds.isEmpty()) { return new Result().error("document_ids参数不能为空"); @@ -97,6 +133,9 @@ public class KnowledgeFilesController { @RequestParam(required = false, defaultValue = "1") Integer page, @RequestParam(required = false, defaultValue = "1024") Integer page_size, @RequestParam(required = false) String id) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + Map result = knowledgeFilesService.listChunks(datasetId, documentId, keywords, page, page_size, id); return new Result>().ok(result); @@ -110,6 +149,9 @@ public class KnowledgeFilesController { @RequiresPermissions("sys:role:normal") public Result> retrievalTest(@PathVariable("dataset_id") String datasetId, @RequestBody Map params) { + // 验证知识库权限 + validateKnowledgeBasePermission(datasetId); + try { // 提取参数 String question = (String) params.get("question"); diff --git a/main/manager-api/src/main/resources/i18n/messages_en_US.properties b/main/manager-api/src/main/resources/i18n/messages_en_US.properties index 6d77df3e..a6c4696e 100644 --- a/main/manager-api/src/main/resources/i18n/messages_en_US.properties +++ b/main/manager-api/src/main/resources/i18n/messages_en_US.properties @@ -174,11 +174,7 @@ 10165=RAG configuration type error 10166=Default RAG configuration not found 10167=RAG configuration missing required parameters -10168=RAG API create dataset failed -10169=RAG API update dataset failed -10170=RAG API delete dataset failed -10171=Upload file failed -10172=RAG API query failed -10173=RAG API parse failed -10174=RAG API operation failed +10168=Upload file failed +10169=No permission to operate this knowledge base + diff --git a/main/manager-api/src/main/resources/i18n/messages_zh_CN.properties b/main/manager-api/src/main/resources/i18n/messages_zh_CN.properties index a92ab1d3..05d9b87f 100644 --- a/main/manager-api/src/main/resources/i18n/messages_zh_CN.properties +++ b/main/manager-api/src/main/resources/i18n/messages_zh_CN.properties @@ -174,10 +174,5 @@ 10165=RAG\u914D\u7F6E\u7C7B\u578B\u9519\u8BEF 10166=\u9ED8\u8BA4RAG\u914D\u7F6E\u672A\u627E\u5230 10167=RAG\u914D\u7F6E\u7F3A\u5C11\u5FC5\u8981\u53C2\u6570 -10168=RAG API\u521B\u5EFA\u6570\u636E\u96C6\u5931\u8D25 -10169=RAG API\u66F4\u65B0\u6570\u636E\u96C6\u5931\u8D25 -10170=RAG API\u5220\u9664\u6570\u636E\u96C6\u5931\u8D25 -10171=\u4E0A\u4F20\u6587\u4EF6\u5931\u8D25 -10172=RAG API\u67E5\u8BE2\u5931\u8D25 -10173=RAG API\u89E3\u6790\u5931\u8D25 -10174=RAG API\u64CD\u4F5C\u5931\u8D25 +10168=\u4E0A\u4F20\u6587\u4EF6\u5931\u8D25 +10169=\u60A8\u6CA1\u6709\u6743\u9650\u64CD\u4F5C\u8BE5\u8BB0\u5F55 diff --git a/main/manager-api/src/main/resources/i18n/messages_zh_TW.properties b/main/manager-api/src/main/resources/i18n/messages_zh_TW.properties index 3d45ff3c..ed070001 100644 --- a/main/manager-api/src/main/resources/i18n/messages_zh_TW.properties +++ b/main/manager-api/src/main/resources/i18n/messages_zh_TW.properties @@ -174,10 +174,7 @@ 10165=RAG\u914D\u7F6E\u985E\u578B\u932F\u8AA4 10166=\u9810\u8A2DRAG\u914D\u7F6E\u672A\u627E\u5230 10167=RAG\u914D\u7F6E\u7F3A\u5C11\u5FC5\u8981\u53C3\u6578 -10168=RAG API\u5275\u5EFA\u6578\u64DA\u96C6\u5931\u6557 -10169=RAG API\u66F4\u65B0\u6578\u64DA\u96C6\u5931\u6557 -10170=RAG API\u522A\u9664\u6578\u64DA\u96C6\u5931\u6557 -10171=\u4E0A\u50B3\u6587\u4EF6\u5931\u6557 -10172=RAG API\u67E5\u8A62\u5931\u6557 -10173=RAG API\u5256\u6790\u5931\u6557 -10174=RAG API\u64CD\u4F5C\u5931\u6557 +10168=\u4E0A\u50B3\u6587\u4EF6\u5931\u6557 +10169=\u60A8\u6CA1\u6709\u6743\u9650\u64CD\u4F5C\u8BE5\u8BB0\u5F55 + +