refactor: permission constants

apps/common/constants/exception_code_constants.py

@@ -41,3 +41,4 @@ class ExceptionCodeConstants(Enum):
                                                  _('The username cannot be empty and must be between 6 and 20 characters long.'))
     PASSWORD_NOT_EQ_RE_PASSWORD = ExceptionCodeConstantsValue(1007,
                                                               _('Password and confirmation password are inconsistent'))
+    NICKNAME_IS_EXIST = ExceptionCodeConstantsValue(1008, _('The nickname is already registered'))

apps/common/constants/permission_constants.py

@@ -10,13 +10,14 @@ from functools import reduce
 from typing import List
 
 from django.db import models
+from django.utils.translation import gettext as _
 
 
 class Group(Enum):
     """
     权限组 一个组一般对应前端一个菜单
     """
-    USER = "USER"
+    USER = "USER_MANAGEMENT"
 
     APPLICATION = "APPLICATION"
 
@@ -24,8 +25,6 @@ class Group(Enum):
 
     KNOWLEDGE_DOCUMENT = "KNOWLEDGE_DOCUMENT"
 
-    KNOWLEDGE_PARAGRAPH = "KNOWLEDGE_PARAGRAPH"
-
     KNOWLEDGE_PROBLEM = "KNOWLEDGE_PROBLEM"
 
     MODEL = "MODEL"
@@ -34,19 +33,69 @@ class Group(Enum):
 
     WORKSPACE_USER_RESOURCE_PERMISSION = "WORKSPACE_USER_RESOURCE_PERMISSION"
 
+    EMAIL_SETTING = "EMAIL_SETTING"
+    ROLE = "ROLE"
+
+
+class SystemGroup(Enum):
+    """
+    一级菜单
+    """
+    USER_MANAGEMENT = "USER_MANAGEMENT"
+    ROLE = "ROLE"
+    WORKSPACE = "WORKSPACE"
+    RESOURCE_APPLICATION = "RESOURCE_APPLICATION"
+    RESOURCE_KNOWLEDGE = "RESOURCE_KNOWLEDGE"
+    RESOURCE_TOOL = "RESOURCE_TOOL"
+    RESOURCE_MODEL = "RESOURCE_MODEL"
+    RESOURCE_PERMISSION = "RESOURCE_PERMISSION"
+    SHARED_KNOWLEDGE = "SHARED_KNOWLEDGE"
+    SHARED_MODEL = "SHARED_MODEL"
+    SHARED_TOOL = "SHARED_TOOL"
+    SYSTEM_SETTING = "SYSTEM_SETTING"
+    OPERATION_LOG = "OPERATION_LOG"
+    OTHER = "OTHER"
+
+
+class WorkspaceGroup(Enum):
+    SYSTEM_MANAGEMENT = "SYSTEM_MANAGEMENT"
+    APPLICATION = "APPLICATION"
+    KNOWLEDGE = "KNOWLEDGE"
+    MODEL = "MODEL"
+    TOOL = "TOOL"
+    OTHER = "OTHER"
+
+
+class UserGroup(Enum):
+    APPLICATION = "APPLICATION"
+    KNOWLEDGE = "KNOWLEDGE"
+    MODEL = "MODEL"
+    TOOL = "TOOL"
+    OTHER = "OTHER"
+
 
 class Operate(Enum):
     """
      一个权限组的操作权限
     """
     READ = 'READ'
-    EDIT = "EDIT"
-    CREATE = "CREATE"
-    DELETE = "DELETE"
+    EDIT = "READ+EDIT"
+    CREATE = "READ+CREATE"
+    DELETE = "READ+DELETE"
     """
     使用权限
     """
     USE = "USE"
+    IMPORT = "READ+IMPORT"
+    EXPORT = "READ+EXPORT"  # 导入导出
+    DEBUG = "READ+DEBUG"  # 调试
+    SYNC = "READ+SYNC"  # 同步
+    GENERATE = "READ+GENERATE"  # 生成
+    ADD_MEMBER = "READ+ADD_MEMBER"  # 添加成员
+    REMOVE_MEMBER = "READ+REMOVE_MEMBER"  # 添加成员
+    VECTOR = "READ+VECTOR"  # 向量化
+    MIGRATE = "READ+MIGRATE"  # 迁移
+    RELATE = "READ+RELATE"  # 关联
 
 
 class RoleGroup(Enum):
@@ -118,13 +167,57 @@ class RoleConstants(Enum):
                                       f"/WORKSPACE/{kwargs.get('workspace_id')}")
 
 
+Permission_Label = {
+    SystemGroup.SYSTEM_SETTING.value: _("System Setting"),
+    SystemGroup.USER_MANAGEMENT.value: _("User Management"),
+    SystemGroup.ROLE.value: _("Role"),
+    SystemGroup.WORKSPACE.value: _("Workspace"),
+    SystemGroup.RESOURCE_APPLICATION.value: _("Resource Application"),
+    SystemGroup.RESOURCE_KNOWLEDGE.value: _("Resource Knowledge"),
+    SystemGroup.RESOURCE_TOOL.value: _("Resource Tool"),
+    SystemGroup.RESOURCE_MODEL.value: _("Resource Model"),
+    SystemGroup.RESOURCE_PERMISSION.value: _("Resource Permission"),
+    SystemGroup.SHARED_KNOWLEDGE.value: _("Shared Knowledge"),
+    SystemGroup.SHARED_MODEL.value: _("Shared Model"),
+    SystemGroup.SHARED_TOOL.value: _("Shared Tool"),
+    SystemGroup.OPERATION_LOG.value: _("Operation Log"),
+    SystemGroup.OTHER.value: _("Other"),
+    WorkspaceGroup.SYSTEM_MANAGEMENT.value: _("System Management"),
+    WorkspaceGroup.APPLICATION.value: _("Application"),
+    WorkspaceGroup.KNOWLEDGE.value: _("Knowledge"),
+    WorkspaceGroup.MODEL.value: _("Model"),
+    WorkspaceGroup.TOOL.value: _("Tool"),
+    WorkspaceGroup.OTHER.value: _("Other"),
+    Operate.READ.value: _("Read"),
+    Operate.EDIT.value: _("Edit"),
+    Operate.CREATE.value: _("Create"),
+    Operate.DELETE.value: _("Delete"),
+    Group.EMAIL_SETTING.value: _("Email Setting"),
+    Group.APPLICATION.value: _("Application"),
+    Group.KNOWLEDGE.value: _("Knowledge"),
+    Group.KNOWLEDGE_DOCUMENT.value: _("Document"),
+    Group.KNOWLEDGE_PROBLEM.value: _("Problem"),
+    Operate.IMPORT.value: _("Import"),
+    Operate.EXPORT.value: _("Export"),
+    Operate.DEBUG.value: _("Debug"),
+    Operate.SYNC.value: _("Sync"),
+    Operate.GENERATE.value: _("Generate"),
+    Operate.ADD_MEMBER.value: _("Add Member"),
+    Operate.REMOVE_MEMBER.value: _("Remove Member"),
+    Operate.VECTOR.value: _("Vector"),
+    Operate.MIGRATE.value: _("Migrate"),
+    Operate.RELATE.value: _("Relate"),
+
+}
+
+
 class Permission:
     """
     权限信息
     """
 
     def __init__(self, group: Group, operate: Operate, resource_path=None, role_list=None,
-                 resource_permission_group_list=None):
+                 resource_permission_group_list=None, parent_group=None, label=None):
         if role_list is None:
             role_list = []
         if resource_permission_group_list is None:
@@ -136,6 +229,8 @@ class Permission:
         self.role_list = role_list
         # 用于资源权限权限分组
         self.resource_permission_group_list = resource_permission_group_list
+        self.parent_group = parent_group  # 新增字段：父级组
+        self.label = label
 
     @staticmethod
     def new_instance(permission_str: str):
@@ -160,141 +255,191 @@ class PermissionConstants(Enum):
      权限枚举
     """
     USER_READ = Permission(
-        group=Group.USER, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.USER, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[SystemGroup.USER_MANAGEMENT]
     )
     USER_CREATE = Permission(
-        group=Group.USER, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN]
+        group=Group.USER, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.USER_MANAGEMENT]
     )
     USER_EDIT = Permission(
-        group=Group.USER, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN]
+        group=Group.USER, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.USER_MANAGEMENT]
     )
     USER_DELETE = Permission(
-        group=Group.USER, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN]
+        group=Group.USER, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.USER_MANAGEMENT]
+    )
+    ROLE_READ = Permission(
+        group=Group.ROLE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[SystemGroup.ROLE, WorkspaceGroup.SYSTEM_MANAGEMENT]
+    )
+    ROLE_CREATE = Permission(
+        group=Group.ROLE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.ROLE]
+    )
+    ROLE_EDIT = Permission(
+        group=Group.ROLE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.ROLE]
+    )
+    ROLE_DELETE = Permission(
+        group=Group.ROLE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN],
+        parent_group=[SystemGroup.ROLE]
     )
     MODEL_CREATE = Permission(
-        group=Group.MODEL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.MODEL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL]
     )
     MODEL_READ = Permission(
-        group=Group.MODEL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.MODEL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL]
     )
     MODEL_EDIT = Permission(
-        group=Group.MODEL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.MODEL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL]
     )
     MODEL_DELETE = Permission(
-        group=Group.MODEL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    TOOL_FOLDER_CREATE = Permission(
-        group=Group.TOOL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    TOOL_FOLDER_READ = Permission(
-        group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    TOOL_FOLDER_EDIT = Permission(
-        group=Group.TOOL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    TOOL_FOLDER_DELETE = Permission(
-        group=Group.TOOL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.MODEL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.MODEL, UserGroup.MODEL]
     )
     TOOL_CREATE = Permission(
-        group=Group.TOOL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_EDIT = Permission(
-        group=Group.TOOL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_READ = Permission(
-        group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_DELETE = Permission(
-        group=Group.TOOL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_DEBUG = Permission(
-        group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.DEBUG, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_IMPORT = Permission(
-        group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.TOOL, operate=Operate.IMPORT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     TOOL_EXPORT = Permission(
-        group=Group.TOOL, operate=Operate.USE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    KNOWLEDGE_FOLDER_CREATE = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
-    )
-    KNOWLEDGE_FOLDER_READ = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
-        resource_permission_group_list=[ResourcePermissionGroup.VIEW]
-    )
-    KNOWLEDGE_FOLDER_EDIT = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
-        resource_permission_group_list=[ResourcePermissionGroup.MANAGE]
-    )
-    KNOWLEDGE_FOLDER_DELETE = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
-        resource_permission_group_list=[ResourcePermissionGroup.MANAGE]
+        group=Group.TOOL, operate=Operate.EXPORT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.TOOL, UserGroup.TOOL]
     )
     KNOWLEDGE_READ = Permission(
         group=Group.KNOWLEDGE, operate=Operate.READ, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
-        resource_permission_group_list=[ResourcePermissionGroup.VIEW]
+        resource_permission_group_list=[ResourcePermissionGroup.VIEW],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_CREATE = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE, operate=Operate.CREATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_EDIT = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_DELETE = Permission(
-        group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+    KNOWLEDGE_SYNC = Permission(
+        group=Group.KNOWLEDGE, operate=Operate.SYNC, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+    KNOWLEDGE_EXPORT = Permission(
+        group=Group.KNOWLEDGE, operate=Operate.EXPORT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+    KNOWLEDGE_VECTOR = Permission(
+        group=Group.KNOWLEDGE, operate=Operate.VECTOR, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+    KNOWLEDGE_GENERATE = Permission(
+        group=Group.KNOWLEDGE, operate=Operate.GENERATE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_DOCUMENT_READ = Permission(
         group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.READ,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_DOCUMENT_CREATE = Permission(
         group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.CREATE,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_DOCUMENT_EDIT = Permission(
-        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_DOCUMENT_DELETE = Permission(
-        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
-    KNOWLEDGE_PARAGRAPH_READ = Permission(
-        group=Group.KNOWLEDGE_PARAGRAPH, operate=Operate.READ,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+    KNOWLEDGE_DOCUMENT_SYNC = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.SYNC, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
-    KNOWLEDGE_PARAGRAPH_CREATE = Permission(
-        group=Group.KNOWLEDGE_PARAGRAPH, operate=Operate.CREATE,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+    KNOWLEDGE_DOCUMENT_EXPORT = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.EXPORT,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
-    KNOWLEDGE_PARAGRAPH_EDIT = Permission(
-        group=Group.KNOWLEDGE_PARAGRAPH, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+    KNOWLEDGE_DOCUMENT_GENERATE = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.GENERATE,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
-    KNOWLEDGE_PARAGRAPH_DELETE = Permission(
-        group=Group.KNOWLEDGE_PARAGRAPH, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+    KNOWLEDGE_DOCUMENT_VECTOR = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.VECTOR,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
+    KNOWLEDGE_DOCUMENT_MIGRATE = Permission(
+        group=Group.KNOWLEDGE_DOCUMENT, operate=Operate.MIGRATE,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+
     KNOWLEDGE_PROBLEM_READ = Permission(
         group=Group.KNOWLEDGE_PROBLEM, operate=Operate.READ,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_PROBLEM_CREATE = Permission(
         group=Group.KNOWLEDGE_PROBLEM, operate=Operate.CREATE,
-        role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_PROBLEM_EDIT = Permission(
-        group=Group.KNOWLEDGE_PROBLEM, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE_PROBLEM, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     KNOWLEDGE_PROBLEM_DELETE = Permission(
-        group=Group.KNOWLEDGE_PROBLEM, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER]
+        group=Group.KNOWLEDGE_PROBLEM, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
+    )
+    KNOWLEDGE_PROBLEM_RELATE = Permission(
+        group=Group.KNOWLEDGE_PROBLEM, operate=Operate.RELATE,
+        role_list=[RoleConstants.ADMIN, RoleConstants.USER],
+        parent_group=[WorkspaceGroup.KNOWLEDGE, UserGroup.KNOWLEDGE]
     )
     WORKSPACE_USER_RESOURCE_PERMISSION_READ = Permission(
         group=Group.WORKSPACE_USER_RESOURCE_PERMISSION, operate=Operate.READ,
         role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE]
     )
     EMAIL_SETTING_READ = Permission(
-        group=Group.USER, operate=Operate.READ, role_list=[RoleConstants.ADMIN]
+        group=Group.EMAIL_SETTING, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
+        parent_group=SystemGroup.SYSTEM_SETTING
     )
     EMAIL_SETTING_EDIT = Permission(
-        group=Group.USER, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN]
+        group=Group.EMAIL_SETTING, operate=Operate.EDIT, role_list=[RoleConstants.ADMIN],
+        parent_group=SystemGroup.SYSTEM_SETTING
     )
 
     def get_workspace_application_permission(self):

apps/knowledge/views/document.py

@@ -188,7 +188,7 @@ class DocumentView(APIView):
             responses=SyncWebAPI.get_response(),
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_SYNC.get_workspace_permission())
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(DocumentSerializers.Sync(
                 data={'document_id': document_id, 'knowledge_id': knowledge_id, 'workspace_id': workspace_id}
@@ -207,7 +207,7 @@ class DocumentView(APIView):
             responses=RefreshAPI.get_response(),
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(DocumentSerializers.Operate(
                 data={'document_id': document_id, 'knowledge_id': knowledge_id, 'workspace_id': workspace_id}
@@ -285,7 +285,7 @@ class DocumentView(APIView):
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_SYNC.get_workspace_permission(),
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission(),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -307,7 +307,7 @@ class DocumentView(APIView):
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_DELETE.get_workspace_permission(),
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission(),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -328,7 +328,7 @@ class DocumentView(APIView):
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_VECTOR.get_workspace_permission(),
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission(),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -351,7 +351,7 @@ class DocumentView(APIView):
             tags=[_('Knowledge Base/Documentation')]  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission(),
+            PermissionConstants.KNOWLEDGE_DOCUMENT_GENERATE.get_workspace_permission(),
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission(),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str):

apps/knowledge/views/knowledge.py

@@ -125,7 +125,7 @@ class KnowledgeView(APIView):
             responses=SyncWebAPI.get_response(),
             tags=[_('Knowledge Base')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_SYNC.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
             return result.success(KnowledgeSerializer.SyncWeb(
                 data={
@@ -176,7 +176,7 @@ class KnowledgeView(APIView):
             responses=EmbeddingAPI.get_response(),
             tags=[_('Knowledge Base')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_VECTOR.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
             return result.success(KnowledgeSerializer.Operate(
                 data={'knowledge_id': knowledge_id, 'workspace_id': workspace_id, 'user_id': request.user.id}
@@ -195,7 +195,7 @@ class KnowledgeView(APIView):
             responses=GenerateRelatedAPI.get_response(),
             tags=[_('Knowledge Base')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_GENERATE.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str):
             return result.success(KnowledgeSerializer.Operate(
                 data={'knowledge_id': knowledge_id, 'workspace_id': workspace_id, 'user_id': request.user.id}

apps/knowledge/views/paragraph.py

@@ -25,7 +25,7 @@ class ParagraphView(APIView):
         responses=ParagraphReadAPI.get_response(),
         tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
     )
-    @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_READ.get_workspace_permission())
+    @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_READ.get_workspace_permission())
     def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
         q = ParagraphSerializers.Query(
             data={
@@ -46,7 +46,7 @@ class ParagraphView(APIView):
         responses=ParagraphCreateAPI.get_response(),
         tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
     )
-    @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_CREATE.get_workspace_permission())
+    @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_CREATE.get_workspace_permission())
     def post(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
         return result.success(ParagraphSerializers.Create(
             data={'workspace_id': workspace_id, 'knowledge_id': knowledge_id, 'document_id': document_id}
@@ -65,7 +65,7 @@ class ParagraphView(APIView):
             responses=ParagraphBatchDeleteAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.Batch(
                 data={'workspace_id': workspace_id, 'knowledge_id': knowledge_id, 'document_id': document_id}
@@ -84,7 +84,7 @@ class ParagraphView(APIView):
             responses=ParagraphBatchGenerateRelatedAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_GENERATE.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.Batch(
                 data={'workspace_id': workspace_id, 'knowledge_id': knowledge_id, 'document_id': document_id}
@@ -103,7 +103,7 @@ class ParagraphView(APIView):
             responses=ParagraphEditAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             o = ParagraphSerializers.Operate(
                 data={
@@ -125,7 +125,7 @@ class ParagraphView(APIView):
             responses=ParagraphGetAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             o = ParagraphSerializers.Operate(
                 data={
@@ -146,7 +146,7 @@ class ParagraphView(APIView):
             parameters=ParagraphGetAPI.get_parameters(),
             responses=ParagraphGetAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')])  # type: ignore
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def delete(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             o = ParagraphSerializers.Operate(
                 data={
@@ -172,7 +172,7 @@ class ParagraphView(APIView):
             responses=ProblemCreateAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def post(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             return result.success(ParagraphSerializers.Problem(
                 data={
@@ -192,7 +192,7 @@ class ParagraphView(APIView):
             responses=ParagraphGetAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             return result.success(ParagraphSerializers.Problem(
                 data={
@@ -216,7 +216,7 @@ class ParagraphView(APIView):
             responses=UnAssociationAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.Association(
                 data={
@@ -241,7 +241,7 @@ class ParagraphView(APIView):
             responses=AssociationAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.Association(
                 data={
@@ -265,7 +265,7 @@ class ParagraphView(APIView):
             responses=ParagraphPageAPI.get_response(),
             tags=[_('Knowledge Base/Documentation/Paragraph')]  # type: ignore
         )
-        @has_permissions(PermissionConstants.KNOWLEDGE_PARAGRAPH_EDIT.get_workspace_permission())
+        @has_permissions(PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission())
         def get(self, request: Request,
                 workspace_id: str, knowledge_id: str, document_id: str, current_page: int, page_size: int):
             d = ParagraphSerializers.Query(

apps/users/models/user.py

@@ -17,7 +17,7 @@ class User(models.Model):
     id = models.UUIDField(primary_key=True, max_length=128, default=uuid.uuid7, editable=False, verbose_name="主键id")
     email = models.EmailField(unique=True, null=True, blank=True, verbose_name="邮箱")
     phone = models.CharField(max_length=20, verbose_name="电话", default="")
-    nick_name = models.CharField(max_length=150, verbose_name="昵称", default="")
+    nick_name = models.CharField(max_length=150, verbose_name="昵称", unique=True)
     username = models.CharField(max_length=150, unique=True, verbose_name="用户名")
     password = models.CharField(max_length=150, verbose_name="密码")
     role = models.CharField(max_length=150, verbose_name="角色")

apps/users/serializers/user.py

@@ -110,11 +110,9 @@ class UserManageSerializer(serializers.Serializer):
             ]
         )
         nick_name = serializers.CharField(
-            required=False,
+            required=True,
             label=_("Nick name"),
             max_length=64,
-            allow_null=True,
-            allow_blank=True
         )
         phone = serializers.CharField(
             required=False,
@@ -131,12 +129,15 @@ class UserManageSerializer(serializers.Serializer):
         def _check_unique_username_and_email(self):
             username = self.data.get('username')
             email = self.data.get('email')
-            user = User.objects.filter(Q(username=username) | Q(email=email)).first()
+            nick_name = self.data.get('nick_name')
+            user = User.objects.filter(Q(username=username) | Q(email=email) | Q(nick_name=nick_name)).first()
             if user:
                 if user.email == email:
                     raise ExceptionCodeConstants.EMAIL_IS_EXIST.value.to_app_api_exception()
                 if user.username == username:
                     raise ExceptionCodeConstants.USERNAME_IS_EXIST.value.to_app_api_exception()
+                if user.nick_name == nick_name:
+                    raise ExceptionCodeConstants.NICKNAME_IS_EXIST.value.to_app_api_exception()
 
     class Query(serializers.Serializer):
         email_or_username = serializers.CharField(required=False, allow_null=True,
@@ -147,7 +148,8 @@ class UserManageSerializer(serializers.Serializer):
             query_set = QuerySet(User)
             if email_or_username is not None:
                 query_set = query_set.filter(
-                    Q(username__contains=email_or_username) | Q(email__contains=email_or_username))
+                    Q(username__contains=email_or_username) | Q(email__contains=email_or_username) | Q(
+                        nick_name__contains=email_or_username))
             query_set = query_set.order_by("-create_time")
             return query_set
 
@@ -211,11 +213,9 @@ class UserManageSerializer(serializers.Serializer):
             )]
         )
         nick_name = serializers.CharField(
-            required=False,
+            required=True,
             label=_("Name"),
             max_length=64,
-            allow_null=True,
-            allow_blank=True
         )
         phone = serializers.CharField(
             required=False,
@@ -232,6 +232,12 @@ class UserManageSerializer(serializers.Serializer):
         def is_valid(self, *, user_id=None, raise_exception=False):
             super().is_valid(raise_exception=True)
             self._check_unique_email(user_id)
+            self._check_unique_nick_name(user_id)
+
+        def _check_unique_nick_name(self, user_id):
+            nick_name = self.data.get('nick_name')
+            if nick_name and User.objects.filter(nick_name=nick_name).exclude(id=user_id).exists():
+                raise AppApiException(1008, _('Nickname is already in use'))
 
         def _check_unique_email(self, user_id):
             email = self.data.get('email')
@@ -390,5 +396,5 @@ class UserManageSerializer(serializers.Serializer):
         else:
             user_ids = User.objects.values_list('id', flat=True)
 
-        users = User.objects.filter(id__in=user_ids).values('id', 'username')
+        users = User.objects.filter(id__in=user_ids).values('id', 'nick_name')
         return list(users)