From 12c66ae13524f323c20a8147b31e25b647569e36 Mon Sep 17 00:00:00 2001
From: wxg0103 <727495428@qq.com>
Date: Wed, 24 Dec 2025 17:33:51 +0800
Subject: [PATCH] feat: add permission selection for user roles and update
 related UI components

---
 apps/locales/en_US/LC_MESSAGES/django.po      |  3 -
 apps/locales/zh_CN/LC_MESSAGES/django.po      |  3 -
 apps/locales/zh_Hant/LC_MESSAGES/django.po    |  3 -
 .../authentication/component/Setting.vue      | 75 ++++++++++++++++---
 4 files changed, 66 insertions(+), 18 deletions(-)

diff --git a/apps/locales/en_US/LC_MESSAGES/django.po b/apps/locales/en_US/LC_MESSAGES/django.po
index 17cd40510..11347aacc 100644
--- a/apps/locales/en_US/LC_MESSAGES/django.po
+++ b/apps/locales/en_US/LC_MESSAGES/django.po
@@ -8885,8 +8885,5 @@ msgstr ""
 msgid "Role IDs cannot be empty"
 msgstr ""
 
-msgid "Role IDs"
-msgstr ""
-
 msgid "Some roles do not exist"
 msgstr ""
\ No newline at end of file
diff --git a/apps/locales/zh_CN/LC_MESSAGES/django.po b/apps/locales/zh_CN/LC_MESSAGES/django.po
index 2f02e1897..1f4e563e9 100644
--- a/apps/locales/zh_CN/LC_MESSAGES/django.po
+++ b/apps/locales/zh_CN/LC_MESSAGES/django.po
@@ -9011,8 +9011,5 @@ msgstr "导出知识工作流"
 msgid "Role IDs cannot be empty"
 msgstr "角色 ID 不能为空"
 
-msgid "Role IDs"
-msgstr "角色 ID"
-
 msgid "Some roles do not exist"
 msgstr "部分角色不存在"
diff --git a/apps/locales/zh_Hant/LC_MESSAGES/django.po b/apps/locales/zh_Hant/LC_MESSAGES/django.po
index 017cca66a..fa0eb9148 100644
--- a/apps/locales/zh_Hant/LC_MESSAGES/django.po
+++ b/apps/locales/zh_Hant/LC_MESSAGES/django.po
@@ -9011,8 +9011,5 @@ msgstr "匯出知識工作流"
 msgid "Role IDs cannot be empty"
 msgstr "角色 ID 不能为空"
 
-msgid "Role IDs"
-msgstr "角色 ID"
-
 msgid "Some roles do not exist"
 msgstr "部分角色不存在"
diff --git a/ui/src/views/system-setting/authentication/component/Setting.vue b/ui/src/views/system-setting/authentication/component/Setting.vue
index c917150ff..0b7f34f6c 100644
--- a/ui/src/views/system-setting/authentication/component/Setting.vue
+++ b/ui/src/views/system-setting/authentication/component/Setting.vue
@@ -111,16 +111,17 @@
             ]"
           >
             <el-row :gutter="16" style="margin-left: 10px">
-              <el-col :span="12">
-                <div style="display: flex; align-items: center; gap: 8px; min-width: 0">
-                  <span style="font-size: 13px; white-space: nowrap">
+              <el-col :span="24">
+                <div class="flex">
+                  <span style="font-size: 13px; white-space: nowrap;width: 50px"
+                        class="text-right mr-8">
                     {{ $t('views.role.member.role') }}
                   </span>
                   <el-select
                     v-model="form.role_id"
                     :placeholder="`${$t('common.selectPlaceholder')}${$t('views.role.member.role')}`"
-                    style="flex: 1; min-width: 180px"
                     @change="handleRoleChange"
+                    class="w-240"
                   >
                     <el-option
                       v-for="role in roleOptions"
@@ -131,15 +132,16 @@
                   </el-select>
                 </div>
               </el-col>
-              <el-col :span="12" v-if="user.isEE() && showWorkspaceSelector">
-                <div style="display: flex; align-items: center; gap: 8px; min-width: 0">
-                  <span style="font-size: 13px; white-space: nowrap">
+              <el-col :span="24" v-if="user.isEE() && showWorkspaceSelector" class="mt-16">
+                <div class="flex">
+                  <span style="font-size: 13px; white-space: nowrap;width: 50px"
+                        class="text-right mr-8">
                     {{ $t('views.role.member.workspace') }}
                   </span>
                   <el-select
                     v-model="form.workspace_id"
                     :placeholder="`${$t('common.selectPlaceholder')}${$t('views.role.member.workspace')}`"
-                    style="flex: 1; min-width: 180px"
+                    class="w-240"
                   >
                     <el-option
                       v-for="workspace in workspaceOptions"
@@ -150,6 +152,27 @@
                   </el-select>
                 </div>
               </el-col>
+              <el-col :span="24" v-if="(user.isEE() || user.isPE()) && showPermissionSelector"
+                      class="mt-16">
+                <div class="flex">
+                  <span style="font-size: 13px; white-space: nowrap;width: 50px"
+                        class="text-right mr-8">
+                    {{ $t('views.system.resourceAuthorization.title') }}
+                  </span>
+                  <el-select
+                    v-model="form.permission"
+                    :placeholder="`${$t('common.selectPlaceholder')}${$t('views.system.resourceAuthorization.title')}`"
+                    class="w-240"
+                  >
+                    <el-option
+                      v-for="permission in permissionOptions"
+                      :key="permission.value"
+                      :label="permission.label"
+                      :value="permission.value"
+                    />
+                  </el-select>
+                </div>
+              </el-col>
             </el-row>
           </el-form-item>
         </el-form>
@@ -174,13 +197,15 @@
 <script setup lang="ts">
 import {ref, onMounted, computed} from 'vue'
 import {ComplexPermission} from '@/utils/permission/type'
-import {PermissionConst, RoleConst} from '@/utils/permission/data'
+import {EditionConst, PermissionConst, RoleConst} from '@/utils/permission/data'
 import type {FormInstance} from 'element-plus'
 import {t} from '@/locales'
 import authApi from '@/api/system-settings/auth-setting.ts'
 import {MsgSuccess} from '@/utils/message.ts'
 import WorkspaceApi from '@/api/workspace/workspace.ts'
 import useStore from '@/stores'
+import {AuthorizationEnum} from "@/enums/system.ts";
+import {hasPermission} from "@/utils/permission";
 
 const loginMethods = ref<Array<{ label: string; value: string }>>([])
 const loading = ref(false)
@@ -194,6 +219,7 @@ const form = ref<any>({
   lock_time: 10,
   role_id: 'USER',
   workspace_id: 'default',
+  permission: 'NOT_AUTH',
 })
 
 const normalizeInputValue = (val: number | null): number => {
@@ -234,6 +260,7 @@ const submit = async () => {
       lock_time: form.value.lock_time,
       role_id: form.value.role_id,
       workspace_id: form.value.workspace_id,
+      permission: form.value.permission,
     }
     await authApi.putLoginSetting(params)
     MsgSuccess(t('common.saveSuccess'))
@@ -250,7 +277,36 @@ const workspaceOptions = ref<Array<{ id: string; name: string }>>([])
 const {user} = useStore()
 const selectedRoleType = ref<string>('') // 存储选中角色类型，用于控制 workspace 显示
 const showWorkspaceSelector = computed(() => selectedRoleType.value !== 'ADMIN')
+const showPermissionSelector = computed(() => selectedRoleType.value === 'USER')
+const permissionOptions = computed(() => {
+  const baseOptions = [
+    {
+      label: t('views.system.resourceAuthorization.setting.check'),
+      value: AuthorizationEnum.VIEW,
+      desc: t('views.system.resourceAuthorization.setting.checkDesc'),
+    },
+    {
+      label: t('views.system.resourceAuthorization.setting.management'),
+      value: AuthorizationEnum.MANAGE,
+      desc: t('views.system.resourceAuthorization.setting.managementDesc'),
+    },
+    {
+      label: t('views.system.resourceAuthorization.setting.notAuthorized'),
+      value: AuthorizationEnum.NOT_AUTH,
+      desc: '',
+    }
+  ];
 
+  if (hasPermission([EditionConst.IS_EE, EditionConst.IS_PE], 'OR')) {
+    baseOptions.splice(2, 0, {
+      label: t('views.system.resourceAuthorization.setting.role'),
+      value: AuthorizationEnum.ROLE,
+      desc: t('views.system.resourceAuthorization.setting.roleDesc'),
+    });
+  }
+
+  return baseOptions;
+});
 // 当角色变更时更新 selectedRoleType
 const handleRoleChange = (roleId: string) => {
   const selectedRole = roleOptions.value.find((role) => role.id === roleId)
@@ -304,6 +360,7 @@ onMounted(async () => {
       lock_time: data.lock_time ?? form.value.lock_time ?? 10,
       role_id: data.role_id ?? form.value.role_id ?? 'USER',
       workspace_id: data.workspace_id ?? form.value.workspace_id ?? 'default',
+      permission: data.permission ?? form.value.permission ?? 'NOT_AUTH',
     }
     loginMethods.value = Array.isArray(data.auth_types) ? data.auth_types : []