From 6c6aa20ff6e0ff6ad13bdb87de019bf88dbf7fee Mon Sep 17 00:00:00 2001
From: zhangzhanwei <zhanwei.zhang@fit2cloud.com>
Date: Fri, 27 Jun 2025 17:59:38 +0800
Subject: [PATCH] feat: New tool and model permission

---
 ui/src/permission/knowledge/workspace.ts      | 21 +---------
 ui/src/permission/model/workspace.ts          | 21 ++++------
 ui/src/permission/tool/workspace.ts           | 42 +++++++++----------
 ui/src/utils/permission/type.ts               | 17 ++++++++
 ui/src/views/model/component/ModelCard.vue    | 14 +++++--
 ui/src/views/tool/ToolFormDrawer.vue          |  8 +++-
 .../tool/component/ToolListContainer.vue      | 12 +++---
 7 files changed, 69 insertions(+), 66 deletions(-)

diff --git a/ui/src/permission/knowledge/workspace.ts b/ui/src/permission/knowledge/workspace.ts
index 0c5de5c41..c796e7b7d 100644
--- a/ui/src/permission/knowledge/workspace.ts
+++ b/ui/src/permission/knowledge/workspace.ts
@@ -5,7 +5,7 @@ const workspace = {
   is_share: () =>
     hasPermission(
       new ComplexPermission(
-        [RoleConst.ADMIN,RoleConst.USER.getWorkspaceRole,RoleConst.WORKSPACE_MANAGE.getWorkspaceRole],
+        [RoleConst.USER.getWorkspaceRole,RoleConst.WORKSPACE_MANAGE.getWorkspaceRole],
         [PermissionConst.KNOWLEDGE_READ.getWorkspacePermission,PermissionConst.KNOWLEDGE_READ.getWorkspacePermissionWorkspaceManageRole],
         [EditionConst.IS_EE],'OR'),
       'OR',
@@ -13,7 +13,6 @@ const workspace = {
   create: () =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.USER.getWorkspaceRole,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_CREATE.getWorkspacePermission,
@@ -24,7 +23,6 @@ const workspace = {
   sync: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_SYNC.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_SYNC.getWorkspacePermissionWorkspaceManageRole,
@@ -34,7 +32,6 @@ const workspace = {
   vector: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_VECTOR.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_VECTOR.getWorkspacePermissionWorkspaceManageRole,
@@ -44,7 +41,6 @@ const workspace = {
   generate: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_GENERATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_GENERATE.getWorkspacePermissionWorkspaceManageRole,
@@ -54,7 +50,6 @@ const workspace = {
   setting: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_EDIT.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_EDIT.getWorkspacePermissionWorkspaceManageRole,
@@ -64,7 +59,6 @@ const workspace = {
   export: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_EXPORT.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_EXPORT.getWorkspacePermissionWorkspaceManageRole,
@@ -74,7 +68,6 @@ const workspace = {
   delete: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DELETE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DELETE.getWorkspacePermissionWorkspaceManageRole,
@@ -84,7 +77,6 @@ const workspace = {
   doc_create: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_CREATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_CREATE.getWorkspacePermissionWorkspaceManageRole,
@@ -94,7 +86,6 @@ const workspace = {
   doc_vector: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_VECTOR.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_VECTOR.getWorkspacePermissionWorkspaceManageRole,
@@ -104,7 +95,6 @@ const workspace = {
   doc_generate: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_GENERATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_GENERATE.getWorkspacePermissionWorkspaceManageRole,
@@ -114,7 +104,6 @@ const workspace = {
   doc_migrate: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_MIGRATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_MIGRATE.getWorkspacePermissionWorkspaceManageRole,
@@ -124,7 +113,6 @@ const workspace = {
   doc_edit: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_EDIT.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_EDIT.getWorkspacePermissionWorkspaceManageRole,
@@ -134,7 +122,6 @@ const workspace = {
   doc_sync: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_SYNC.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_SYNC.getWorkspacePermissionWorkspaceManageRole,
@@ -144,7 +131,6 @@ const workspace = {
   doc_delete: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_DELETE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_DELETE.getWorkspacePermissionWorkspaceManageRole,
@@ -154,7 +140,6 @@ const workspace = {
   doc_export: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_EXPORT.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_EXPORT.getWorkspacePermissionWorkspaceManageRole,
@@ -164,7 +149,6 @@ const workspace = {
   doc_download: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE.getWorkspacePermissionWorkspaceManageRole,
@@ -174,7 +158,6 @@ const workspace = {
   problem_create: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_PROBLEM_CREATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_PROBLEM_CREATE.getWorkspacePermissionWorkspaceManageRole,
@@ -184,7 +167,6 @@ const workspace = {
   problem_relate: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_PROBLEM_RELATE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_PROBLEM_RELATE.getWorkspacePermissionWorkspaceManageRole,
@@ -194,7 +176,6 @@ const workspace = {
   problem_delete: (source_id:string) =>
     hasPermission(
       [
-        RoleConst.ADMIN,
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.KNOWLEDGE_PROBLEM_DELETE.getKnowledgeWorkspaceResourcePermission(source_id),
         PermissionConst.KNOWLEDGE_PROBLEM_DELETE.getWorkspacePermissionWorkspaceManageRole,
diff --git a/ui/src/permission/model/workspace.ts b/ui/src/permission/model/workspace.ts
index 4cab08857..2910ff709 100644
--- a/ui/src/permission/model/workspace.ts
+++ b/ui/src/permission/model/workspace.ts
@@ -5,47 +5,44 @@ const workspace = {
   is_share: () =>
     hasPermission(
       new ComplexPermission(
-        [RoleConst.ADMIN,RoleConst.USER.getWorkspaceRole,RoleConst.WORKSPACE_MANAGE.getWorkspaceRole],
+        [RoleConst.USER.getWorkspaceRole,RoleConst.WORKSPACE_MANAGE.getWorkspaceRole],
         [PermissionConst.MODEL_READ.getWorkspacePermission,PermissionConst.MODEL_READ.getWorkspacePermissionWorkspaceManageRole],
         [EditionConst.IS_EE],'OR'),
       'OR',
     ),
-  addModel: () =>
+  addModel: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         RoleConst.USER.getWorkspaceRole,
-        PermissionConst.MODEL_CREATE.getWorkspacePermission,
+        PermissionConst.MODEL_CREATE.getModelWorkspaceResourcePermission(source_id),
         PermissionConst.MODEL_CREATE.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  modify: () =>
+  modify: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.MODEL_EDIT.getWorkspacePermission,
+        PermissionConst.MODEL_EDIT.getModelWorkspaceResourcePermission(source_id),
         PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  paramSetting: () =>
+  paramSetting: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.MODEL_EDIT.getWorkspacePermission,
+        PermissionConst.MODEL_EDIT.getModelWorkspaceResourcePermission(source_id),
         PermissionConst.MODEL_EDIT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  delete: () =>
+  delete: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.MODEL_DELETE.getWorkspacePermission,
+        PermissionConst.MODEL_DELETE.getModelWorkspaceResourcePermission(source_id),
         PermissionConst.MODEL_DELETE.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
diff --git a/ui/src/permission/tool/workspace.ts b/ui/src/permission/tool/workspace.ts
index f1a321b26..3b58c0aea 100644
--- a/ui/src/permission/tool/workspace.ts
+++ b/ui/src/permission/tool/workspace.ts
@@ -10,16 +10,7 @@ const workspace = {
         [EditionConst.IS_EE],'OR'),
       'OR',
     ),
-  delete: () =>
-    hasPermission(
-      [
-        RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_DELETE.getWorkspacePermission,
-        PermissionConst.TOOL_DELETE.getWorkspacePermissionWorkspaceManageRole
-      ],
-      'OR',
-    ),
+
   create: () =>
     hasPermission(
       [
@@ -30,52 +21,59 @@ const workspace = {
       ],
       'OR'
     ),
-  switch: () =>
+  delete: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_EDIT.getWorkspacePermission,
+        PermissionConst.TOOL_DELETE.getToolWorkspaceResourcePermission(source_id),
+        PermissionConst.TOOL_DELETE.getWorkspacePermissionWorkspaceManageRole
+      ],
+      'OR',
+    ),
+  switch: (source_id:string) =>
+    hasPermission(
+      [
+        RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+        PermissionConst.TOOL_EDIT.getToolWorkspaceResourcePermission(source_id),
         PermissionConst.TOOL_EDIT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  edit: () =>
+  edit: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_EDIT.getWorkspacePermission,
+        PermissionConst.TOOL_EDIT.getToolWorkspaceResourcePermission(source_id),
         PermissionConst.TOOL_EDIT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  copy: () =>
+  copy: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_EXPORT.getWorkspacePermission,
+        PermissionConst.TOOL_EXPORT.getToolWorkspaceResourcePermission(source_id),
         PermissionConst.TOOL_EXPORT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ),
-  export: () =>
+  export: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_EXPORT.getWorkspacePermission,
+        PermissionConst.TOOL_EXPORT.getToolWorkspaceResourcePermission(source_id),
         PermissionConst.TOOL_EXPORT.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
     ), 
-  debug: () =>
+  debug: (source_id:string) =>
     hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         RoleConst.USER.getWorkspaceRole,
-        PermissionConst.TOOL_DEBUG.getWorkspacePermission,
+        PermissionConst.TOOL_DEBUG.getToolWorkspaceResourcePermission(source_id),
         PermissionConst.TOOL_DEBUG.getWorkspacePermissionWorkspaceManageRole
       ],
       'OR'
diff --git a/ui/src/utils/permission/type.ts b/ui/src/utils/permission/type.ts
index 141d68653..124dcdde3 100644
--- a/ui/src/utils/permission/type.ts
+++ b/ui/src/utils/permission/type.ts
@@ -84,6 +84,23 @@ export class Permission {
   getApplicationWorkspaceResourcePermission = (resource_id: string) => {
     return this.getWorkspaceResourcePermission('APPLICATION', resource_id)
   }
+  /**
+   * 
+   * @param resource_id 资源id
+   * @returns 工作空间下模型资源权限
+   */
+  getModelWorkspaceResourcePermission = (resource_id: string) => {
+    return this.getWorkspaceResourcePermission('MODEL', resource_id)
+  }
+  /**
+   * 
+   * @param resource_id 
+   * @returns 工作空间下工具资源权限
+   */
+  getToolWorkspaceResourcePermission = (resource_id: string) => {
+    return this.getWorkspaceResourcePermission('TOOL', resource_id)
+  }
+
   toString() {
     return this.permission
   }
diff --git a/ui/src/views/model/component/ModelCard.vue b/ui/src/views/model/component/ModelCard.vue
index 132b0d91f..6f6d33486 100644
--- a/ui/src/views/model/component/ModelCard.vue
+++ b/ui/src/views/model/component/ModelCard.vue
@@ -71,7 +71,7 @@
         <template #dropdown>
           <el-dropdown-menu>
             <el-dropdown-item
-              v-if="permissionPrecise.modify()"
+              v-if="permissionPrecise.modify(id)"
               icon="EditPen"
               text
               @click.stop="openEditModel"
@@ -92,7 +92,7 @@
                 currentModel.model_type === 'LLM' ||
                 currentModel.model_type === 'IMAGE' ||
                 currentModel.model_type === 'TTI' ||
-                permissionPrecise.paramSetting()
+                permissionPrecise.paramSetting(id)
               "
               icon="Setting"
               @click.stop="openParamSetting"
@@ -104,7 +104,7 @@
               icon="Delete"
               text
               @click.stop="deleteModel"
-              v-if="permissionPrecise.delete()"
+              v-if="permissionPrecise.delete(id)"
             >
               {{ $t('common.delete') }}
             </el-dropdown-item>
@@ -131,7 +131,13 @@ import ParamSettingDialog from './ParamSettingDialog.vue'
 import AuthorizedWorkspace from '@/views/system-shared/AuthorizedWorkspaceDialog.vue'
 import {t} from '@/locales'
 import permissionMap from '@/permission'
-import {loadSharedApi} from '@/utils/dynamics-api/shared-api'
+import { useRoute } from 'vue-router'
+import { loadSharedApi } from '@/utils/dynamics-api/shared-api'
+
+const route = useRoute()
+const {
+  params: {id, folderId},  //id is ModelID
+} = route as any
 
 const props = defineProps<{
   model: Model
diff --git a/ui/src/views/tool/ToolFormDrawer.vue b/ui/src/views/tool/ToolFormDrawer.vue
index 5cbd8e67b..67ec313b2 100644
--- a/ui/src/views/tool/ToolFormDrawer.vue
+++ b/ui/src/views/tool/ToolFormDrawer.vue
@@ -231,7 +231,7 @@
     <template #footer>
       <div>
         <el-button :loading="loading" @click="visible = false">{{ $t('common.cancel') }}</el-button>
-        <el-button :loading="loading" @click="openDebug" v-if="permissionPrecise.debug()">{{
+        <el-button :loading="loading" @click="openDebug" v-if="permissionPrecise.debug(id)">{{
           $t('common.debug')
         }}</el-button>
         <el-button type="primary" @click="submit(FormRef)" :loading="loading">
@@ -264,10 +264,14 @@ import useStore from '@/stores'
 import permissionMap from '@/permission'
 import { loadSharedApi } from '@/utils/dynamics-api/shared-api'
 
+const route = useRoute()
+const {
+  params: { id, folderId }, // id为knowledgeID
+} = route as any
+
 const props = defineProps({
   title: String,
 })
-const route = useRoute()
 const { folder, user } = useStore()
 
 const apiType = computed(() => {
diff --git a/ui/src/views/tool/component/ToolListContainer.vue b/ui/src/views/tool/component/ToolListContainer.vue
index 3b0a0c396..d182998fd 100644
--- a/ui/src/views/tool/component/ToolListContainer.vue
+++ b/ui/src/views/tool/component/ToolListContainer.vue
@@ -150,7 +150,7 @@
                 :description="item.desc"
                 class="cursor"
                 @click.stop="openCreateDialog(item)"
-                :disabled="permissionPrecise.edit()"
+                :disabled="permissionPrecise.edit(item.id)"
               >
                 <template #icon>
                   <el-avatar
@@ -200,7 +200,7 @@
                       :before-change="() => changeState(item)"
                       size="small"
                       class="mr-4"
-                      v-if="permissionPrecise.switch()"
+                      v-if="permissionPrecise.switch(item.id)"
                     />
                     <el-divider direction="vertical" />
                     <el-dropdown trigger="click">
@@ -221,7 +221,7 @@
                             {{ $t('common.edit') }}
                           </el-dropdown-item>
                           <el-dropdown-item
-                            v-if="!item.template_id && permissionPrecise.edit()"
+                            v-if="!item.template_id && permissionPrecise.edit(item.id)"
                             @click.stop="openCreateDialog(item)"
                           >
                             <el-icon>
@@ -230,7 +230,7 @@
                             {{ $t('common.edit') }}
                           </el-dropdown-item>
                           <el-dropdown-item
-                            v-if="!item.template_id && permissionPrecise.copy()"
+                            v-if="!item.template_id && permissionPrecise.copy(item.id)"
                             @click.stop="copyTool(item)"
                           >
                             <AppIcon iconName="app-copy"></AppIcon>
@@ -250,14 +250,14 @@
                             >{{ $t('views.shared.authorized_workspace') }}</el-dropdown-item
                           >
                           <el-dropdown-item
-                            v-if="!item.template_id && permissionPrecise.export()"
+                            v-if="!item.template_id && permissionPrecise.export(item.id)"
                             @click.stop="exportTool(item)"
                           >
                             <AppIcon iconName="app-export"></AppIcon>
                             {{ $t('common.export') }}
                           </el-dropdown-item>
                           <el-dropdown-item
-                            v-if="permissionPrecise.delete()"
+                            v-if="permissionPrecise.delete(item.id)"
                             divided
                             @click.stop="deleteTool(item)"
                           >