Repository navigation
fix: system shared knowledge setting permission - #7761
Conversation
| <MkDropdownItem v-if="perm.knowledge.share.settingRead()" @click.stop="handleOpenKnowledgeSetting(knowledge)"> | ||
| <template #icon><MkIcon name="icon_setting" /></template> | ||
| 设置 | ||
| </MkDropdownItem> |
There was a problem hiding this comment.
The change looks reasonable at a glance, but here are things to verify:
-
Permission method name mismatch risk – Confirm that
perm.knowledge.share.settingRead()actually exists in thepermobject/module. If it's a newly added method, ensure it's defined and exported; otherwise this will throw at runtime (or beundefined→ falsy → menu item silently hidden). -
Naming semantics vs. action – The handler is
handleOpenKnowledgeSetting(an edit action). IfsettingRead()only grants read permission for settings, opening the settings dialog may still allow edits inside it — check that the inner settings UI also enforces write permissions. Otherwise you've only changed the visibility of the entry point, not the actual authorization. -
Consistency with sibling items – The item above uses
perm.knowledge.share.generate()(a verb). Mixinggenerate()/edit()/settingRead()naming styles is inconsistent; consider a uniform convention (e.g.,canEditSettingsvssettingsReadable) to avoid confusion later. -
v-ifvsv-show– Fine as-is if this is a dropdown that conditionally renders; no issue. -
Hardening suggestion – For defense-in-depth, add a guard inside
handleOpenKnowledgeSetting:if (!perm.knowledge.share.settingRead()) return;
so permission is enforced even if the template check is accidentally removed or the method is called from elsewhere.
-
Test coverage – Add/verify unit tests for: user with read-only settings permission (item visible, edit controls disabled), user without any permission (item hidden), and admin (full access).
-
i18n – The label
设置is hardcoded Chinese; if the project uses i18n elsewhere in this component, wrap it ({{ $t('...') }}) for consistency. (Pre-existing issue, not introduced by this diff.)
No functional bug is evident in the diff itself, but points 1 and 2 are the ones most likely to bite you.
fix: system shared knowledge setting permission