fix: Built-in system resource permissions are invalid.

apps/common/auth/constants/permission_constants.py

@@ -4257,6 +4257,20 @@ def group_permissions_by_scope() -> Dict[str, List[Permission]]:
     return dict(grouped)
 
 
+def group_permissions_by_role() -> Dict[str, List[Permission]]:
+    grouped = {}
+
+    for _permission in PermissionConstants:
+        meta = _permission.meta
+        if meta.role_list:
+            for role_item in meta.role_list:
+                role_item = str(role_item)
+                _array = grouped.get(role_item) or []
+                _array.append(_permission)
+                grouped[role_item] = _array
+    return dict(grouped)
+
+
 # 权限字符串与权限对象的Map
 PERMISSION_STR_MAP = {_permission.value.__str__(): _permission for _permission in PermissionConstants}
 
@@ -4265,3 +4279,6 @@ def group_permissions_by_scope() -> Dict[str, List[Permission]]:
 
 # 权限 SCOPE Map
 SCOPE_PERMISSION_MAP = group_permissions_by_scope()
+
+# 角色 Map
+ROLE_PERMISSION_MAP = group_permissions_by_role()

apps/common/auth/handle/impl/user_token.py

@@ -13,7 +13,7 @@
 from django.db.models import QuerySet
 from django.utils.translation import gettext_lazy as _
 
-from common.auth.constants.permission_constants import RESOURCE_PERMISSION_MAP, PERMISSION_STR_MAP
+from common.auth.constants.permission_constants import RESOURCE_PERMISSION_MAP, PERMISSION_STR_MAP, ROLE_PERMISSION_MAP
 from common.auth.constants.permission_scope_constants import PermissionScopeConstants
 from common.constants.resource_permission_constants import ResourceAuthType
 from common.auth.constants.role_constants import RoleConstants
@@ -30,6 +30,8 @@
 from system_manage.models.workspace_user_permission import WorkspaceUserResourcePermission
 from users.models import User
 
+INNER_ROLE = [str(RoleConstants.USER), str(RoleConstants.WORKSPACE_MANAGE)]
+
 
 def get_permissions(
     user, workspace_user_role_mapping_model, workspace_model, role_model, role_permission_mapping_model
@@ -108,10 +110,16 @@ def get_permissions(
 
                     permissions = []
                     for role_id in role_ids:
-                        for m in role_permission_mapping_dict.get(str(role_id)) or []:
-                            p = PERMISSION_STR_MAP.get(m.permission_id)
-                            if p is not None and PermissionScopeConstants.WORKSPACE_RESOURCE in p.meta.scope:
-                                permissions.append(p)
+                        if INNER_ROLE.__contains__(role_id):
+                            permission_list = ROLE_PERMISSION_MAP.get(role_id)
+                            for p in permission_list:
+                                if p is not None and PermissionScopeConstants.WORKSPACE_RESOURCE in p.meta.scope:
+                                    permissions.append(p)
+                        else:
+                            for m in role_permission_mapping_dict.get(str(role_id)) or []:
+                                p = PERMISSION_STR_MAP.get(m.permission_id)
+                                if p is not None and PermissionScopeConstants.WORKSPACE_RESOURCE in p.meta.scope:
+                                    permissions.append(p)
 
                     for group, ps in group_by(permissions, lambda p: p.value.get_resource_permission_key(None)).items():
                         k = f"{group}:w:{_.workspace_id}:r:{_.target}"

apps/knowledge/permissions.py

@@ -15,7 +15,7 @@
 def knowledge_permission(permission):
     """Preserve workspace administrators, explicit ownership and scoped grants."""
     return AggregatePermission(
-        roles=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE.get_workspace_role()],
+        roles=[RoleConstants.WORKSPACE_MANAGE.get_workspace_role()],
         permissions=[
             permission.get_workspace_knowledge_permission(),
             permission.get_workspace_permission_workspace_manage_role(),