[shaohuzhang1]

fix: knowledge document create permission scope error

[shaohuzhang1]

Review result: the change itself looks like a likely bug fix, but it is security-sensitive and needs verification.

• The original scope=[WORKSPACE, WORKSPACE] is suspicious: a duplicated scope is usually a copy/paste bug unless duplicates are intentionally allowed.
• Changing the second value to WORKSPACE_RESOURCE is probably correct if scope is positionally aligned with role_list, i.e.:
  • WORKSPACE_MANAGE → WORKSPACE
  • USER → WORKSPACE_RESOURCE
• If scope is not positional and is instead a set of accepted scopes, this change expands the accepted scope set and may unintentionally grant or change access. Confirm the authorization semantics.
• Confirm PermissionScopeConstants.WORKSPACE_RESOURCE exists and is compatible with ResourcePermissionConst.KNOWLEDGE_MANAGE.
• Check whether permission definitions are cached, persisted, or seeded. If so, invalidate/backfill caches or data after this change.
• Add/update tests for both roles:
  • WORKSPACE_MANAGE still gets workspace-level access.
  • USER gets resource-level access and cannot perform workspace-level operations.
• A robustness improvement is to avoid positional lists for role/scope mapping, or at least validate length/alignment:

  scope_by_role = {
      RoleConstants.WORKSPACE_MANAGE: PermissionScopeConstants.WORKSPACE,
      RoleConstants.USER: PermissionScopeConstants.WORKSPACE_RESOURCE,
  }

  This reduces the risk of future role/scope misalignment.

Overall: no syntax problem in the diff, and the duplicate-scope fix is reasonable, but verify the intended mapping and downstream authorization behavior before merging.