Feat collection permissions - #7652
Open
SteelHe wants to merge 14 commits into
Open
Conversation
…hitecture Co-Authored-By: Claude <noreply@anthropic.com>
…design - Remove permissionVersion CAS concurrency control (N4/S-4 lifted); rely on transaction serialization + idempotent full replacement, last-write-wins (NFR-6) - Add POST /api/proApi/core/dataset/collection/collaborator/list API - Mark dataset-permission APIs (update/collaborator update/resume) with syncDatasetRootCollections logic changes in design §4.1 - Collapse adapter layer to exactly 4 files: auth/controller/collaborator/datasetFlag - Move flatten (F016) out of iteration to a separate requirement - Add initCollectionPermission API for collection permission migration Co-Authored-By: Claude <noreply@anthropic.com>
…ntics, NFR-2 3s - 列表/RAG 过滤改用候选集合限定的 getReadableCollectionIds（单次 distinct，$in 候选 + $bitsAnySet），弃用 findResourceKeysByCollaboratorsPermission team 全量扫描 - 列表过滤指向 listV2；新增 listV2 鉴权行（parentId read / dataset read） - 移除当前路径限定搜索（F018/§7.4） - move 以资源自身继承态为策略：独立态保持独立、继承态保持继承（dataset 与 collection 一致） - dataset changeOwner 级联转移其下 collection owner - initCollectionPermission 移到 projects/app/src/pages/api/admin/initCollectionPermission.ts（POST /api/admin/initCollectionPermission） - syncDatasetRootCollections 改名 syncDatasetToCollections（同步受影响 dataset 下全部 collection） - NFR-2 批量物化预算 30s → 3s，全局传播（含异步阈值/超时/告警） Co-Authored-By: Claude <noreply@anthropic.com>
…lized ACL - materialize dataset ACL onto collection snapshots: syncRootCollections / syncDatasetToCollections wired into dataset write paths (collaborator update, resumeInheritPermission, changeOwner) - collection read path resolveReadableCollectionIds; workflow dataset search gates it on datasetParams.authTmbId - create/listV2/update/delete use collection auth; listV2 skips parent-dir auth when searchText filters across dirs; deleteCollectionPermissions folded into delCollection - changeOwner supports collection type; dataset owner change cascades to its collections via transferTmbPermissions - admin init migration (root-only): idempotent owner upsert + snapshot rebuild, dryRun validates first and rejects orphan parentId / folder cycles
permission:0 无合法含义（移除协作者通过从列表省略实现），改用 positive 拒绝该输入。 Co-Authored-By: Claude <noreply@anthropic.com>
delDatasetRelevantData 直接删除 collection 文档但遗漏 permission 快照清理， 与单独删除 collection 的 delCollection 行为对齐，同一事务内调用 deleteCollectionPermissions。 Co-Authored-By: Claude <noreply@anthropic.com>
… collection migrate & auth - dataset create/createWithFiles/folder: accept inheritPermission; false = independent dataset (owner-only ACL snapshot, no parent merge, subtree stops propagating), with tests - collection migrate: drop transaction for idempotent convergence, preserve independent collections, rebuild ACL from scratch, add datasetIds targeting + dryRun default - dataset auth: collection owner priority in pure-inherit short-circuit - design doc: dataset create inheritPermission semantics (§4.1), migrate/init §12 updates Co-Authored-By: Claude <noreply@anthropic.com>
… only syncRootCollections now diffs old/new dataset effective clbs, restricts ACL loads and snapshot calculation to changed collaborators, reuses a single merged calculator across all root collections, and only recurses folders whose own snapshot changed. No-op path does zero DB reads. Bump pro submodule to 79e012c4 (collection-level admin panel perms). Co-Authored-By: Claude <noreply@anthropic.com>
Add getCollectionPermissionMap in collection auth: batch-resolve each candidate collection's effective role from one $in ACL read, taking the personal row when present (including 0) and otherwise bitwise-merging group/org roles. listV2 resolves permissions only for the current page, parallelized with count/tags/stat lookups, and no longer echoes the dataset permission onto every item. Co-Authored-By: Claude <noreply@anthropic.com>
Pass inheritPermission through CreateImageCollectionFormSchema so an image collection created under a folder keeps the intended inheritance state instead of defaulting to dataset-scoped permissions. Co-Authored-By: Claude <noreply@anthropic.com>
…ctions Intersect datasetIds with the distinct dataset ids actually present in dataset_collections before querying, instead of letting MongoDataset find intersect the two $in clauses itself. Keeps the objectId-vs-string filter out of the query and makes the requested-scope semantics explicit. Co-Authored-By: Claude <noreply@anthropic.com>
…collection role resolution Document that collection list/detail resolve the returned role per page via getCollectionPermissionMap, and that getReadableCollectionIds stays a candidate-scoped distinct for visibility only. Note the collaborator update contract (full list must include the derived owner, no empty array) and that initCollectionPermission is system-root only. Co-Authored-By: Claude <noreply@anthropic.com>
…drafts Move doc/design/collection-permission-design.md unchanged to .agents/design/ and remove the doc/ directory (requirement draft files superseded by the design doc and the implemented v2 behavior). Co-Authored-By: Claude <noreply@anthropic.com>
Resolve openapi/api.ts and create/createWithFiles handler conflicts by keeping main's modelId refactor (vectorModelId/agentModelId/vlmModelId resolution, deprecated legacy name fields) together with the branch's inheritPermission passthrough. No other conflicts. Co-Authored-By: Claude <noreply@anthropic.com>
SteelHe
marked this pull request as draft
September 3, 2026 12:03
SteelHe
marked this pull request as ready for review
September 3, 2026 12:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
summary
文件级别权限管理、知识库检索文件权限过滤
不包含：
validate
单测及集成测试
升级collection权限
curl -X POST http://$fastgpt_ip:3000/api/admin/initCollectionPermission -H "rootkey: $ROOT_KEY" -H 'Content-Type: application/json' -d '{"dryRun":true}'性能测试
1）dataset 下 1w个文件
插入2个ACL，~3s
更新2个ACL，~3s
删除2个ACL，~10s
瓶颈在mongoose和数据库，代码好像没什么可优化的了
2）collection/listV2 1w文件
短路情况下，首页 ~ 100ms
非短路，有1000/9000文件权限 ~ 500ms