purge old permission

packages/global/support/user/team/constant.ts

@@ -3,22 +3,13 @@ export const TeamMemberCollectionName = 'team_members';
 export const TeamTagsCollectionName = 'team_tags';
 
 export enum TeamMemberRoleEnum {
-  owner = 'owner',
-  admin = 'admin',
-  visitor = 'visitor'
+  owner = 'owner'
 }
+
 export const TeamMemberRoleMap = {
   [TeamMemberRoleEnum.owner]: {
     value: TeamMemberRoleEnum.owner,
     label: 'user.team.role.Owner'
-  },
-  [TeamMemberRoleEnum.admin]: {
-    value: TeamMemberRoleEnum.admin,
-    label: 'user.team.role.Admin'
-  },
-  [TeamMemberRoleEnum.visitor]: {
-    value: TeamMemberRoleEnum.visitor,
-    label: 'user.team.role.Visitor'
   }
 };
 
@@ -28,6 +19,7 @@ export enum TeamMemberStatusEnum {
   reject = 'reject',
   leave = 'leave'
 }
+
 export const TeamMemberStatusMap = {
   [TeamMemberStatusEnum.waiting]: {
     label: 'user.team.member.waiting',
@@ -46,4 +38,5 @@ export const TeamMemberStatusMap = {
     color: 'red.600'
   }
 };
+
 export const notLeaveStatus = { $ne: TeamMemberStatusEnum.leave };

packages/service/support/permission/app/auth.ts

@@ -1,19 +1,18 @@
 /* Auth app permission */
 import { MongoApp } from '../../../core/app/schema';
 import { AppDetailType } from '@fastgpt/global/core/app/type.d';
-import { AuthPropsType } from '../type/auth.d';
 import { parseHeaderCert } from '../controller';
 import { PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
 import { AppErrEnum } from '@fastgpt/global/common/error/code/app';
 import { getTmbInfoByTmbId } from '../../user/team/controller';
 import { getResourcePermission } from '../controller';
 import { AppPermission } from '@fastgpt/global/support/permission/app/controller';
-import { AuthResponseType } from '../type/auth.d';
 import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 import { AppFolderTypeList } from '@fastgpt/global/core/app/constants';
 import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
 import { splitCombinePluginId } from '../../../core/app/plugin/controller';
 import { PluginSourceEnum } from '@fastgpt/global/core/plugin/constants';
+import { AuthModeType, AuthResponseType } from '../type';
 
 export const authPluginByTmbId = async ({
   tmbId,
@@ -112,8 +111,9 @@ export const authApp = async ({
   appId,
   per,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   appId: ParentIdType;
+  per: PermissionValueType;
 }): Promise<
   AuthResponseType & {
     app: AppDetailType;

packages/service/support/permission/auth/common.ts

@@ -1,6 +1,7 @@
 import { parseHeaderCert } from '../controller';
 import { AuthModeType } from '../type';
 import { SERVICE_LOCAL_HOST } from '../../../common/system/tools';
+import { ApiRequestProps } from '../../../type/next';
 
 export const authCert = async (props: AuthModeType) => {
   const result = await parseHeaderCert(props);
@@ -13,7 +14,7 @@ export const authCert = async (props: AuthModeType) => {
 };
 
 /* auth the request from local service */
-export const authRequestFromLocal = ({ req }: AuthModeType) => {
+export const authRequestFromLocal = ({ req }: { req: ApiRequestProps }) => {
   if (req.headers.host !== SERVICE_LOCAL_HOST) {
     return Promise.reject('Invalid request');
   }

packages/service/support/permission/auth/file.ts

@@ -1,18 +1,17 @@
-import { AuthModeType } from '../type';
+import { AuthModeType, AuthResponseType } from '../type';
 import { DatasetFileSchema } from '@fastgpt/global/core/dataset/type';
 import { parseHeaderCert } from '../controller';
 import { getFileById } from '../../../common/file/gridfs/controller';
 import { BucketNameEnum } from '@fastgpt/global/common/file/constants';
 import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 import { OwnerPermissionVal, ReadPermissionVal } from '@fastgpt/global/support/permission/constant';
-import { AuthPropsType, AuthResponseType } from '../type/auth';
 import { Permission } from '@fastgpt/global/support/permission/controller';
 
 export async function authFile({
   fileId,
   per = OwnerPermissionVal,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   fileId: string;
 }): Promise<
   AuthResponseType & {

packages/service/support/permission/auth/openapi.ts

@@ -6,10 +6,15 @@ import { getTmbInfoByTmbId } from '../../user/team/controller';
 import { MongoOpenApi } from '../../openapi/schema';
 import { OpenApiErrEnum } from '@fastgpt/global/common/error/code/openapi';
 import { TeamMemberRoleEnum } from '@fastgpt/global/support/user/team/constant';
+import {
+  OwnerPermissionVal,
+  ReadPermissionVal,
+  WritePermissionVal
+} from '@fastgpt/global/support/permission/constant';
 
 export async function authOpenApiKeyCrud({
   id,
-  per = 'owner',
+  per = OwnerPermissionVal,
   ...props
 }: AuthModeType & {
   id: string;
@@ -21,7 +26,7 @@ export async function authOpenApiKeyCrud({
   const result = await parseHeaderCert(props);
   const { tmbId, teamId } = result;
 
-  const { role } = await getTmbInfoByTmbId({ tmbId });
+  const { role, permission: tmbPer } = await getTmbInfoByTmbId({ tmbId });
 
   const { openapi, isOwner, canWrite } = await (async () => {
     const openapi = await MongoOpenApi.findOne({ _id: id, teamId });
@@ -31,16 +36,15 @@ export async function authOpenApiKeyCrud({
     }
 
     const isOwner = String(openapi.tmbId) === tmbId || role === TeamMemberRoleEnum.owner;
-    const canWrite =
-      isOwner || (String(openapi.tmbId) === tmbId && role !== TeamMemberRoleEnum.visitor);
+    const canWrite = isOwner || (String(openapi.tmbId) === tmbId && tmbPer.hasWritePer);
 
-    if (per === 'r' && !canWrite) {
+    if (per === ReadPermissionVal && !canWrite) {
       return Promise.reject(OpenApiErrEnum.unAuth);
     }
-    if (per === 'w' && !canWrite) {
+    if (per === WritePermissionVal && !canWrite) {
       return Promise.reject(OpenApiErrEnum.unAuth);
     }
-    if (per === 'owner' && !isOwner) {
+    if (per === OwnerPermissionVal && !isOwner) {
       return Promise.reject(OpenApiErrEnum.unAuth);
     }
 

packages/service/support/permission/dataset/auth.ts

@@ -1,6 +1,5 @@
 import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 import { getResourcePermission, parseHeaderCert } from '../controller';
-import { AuthPropsType, AuthResponseType } from '../type/auth';
 import {
   CollectionWithDatasetType,
   DatasetDataItemType,
@@ -9,7 +8,7 @@ import {
 } from '@fastgpt/global/core/dataset/type';
 import { getTmbInfoByTmbId } from '../../user/team/controller';
 import { MongoDataset } from '../../../core/dataset/schema';
-import { PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { NullPermission, PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
 import { DatasetErrEnum } from '@fastgpt/global/common/error/code/dataset';
 import { DatasetPermission } from '@fastgpt/global/support/permission/dataset/controller';
 import { getCollectionWithDataset } from '../../../core/dataset/controller';
@@ -19,6 +18,7 @@ import { BucketNameEnum } from '@fastgpt/global/common/file/constants';
 import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 import { MongoDatasetData } from '../../../core/dataset/data/schema';
 import { DatasetDefaultPermissionVal } from '@fastgpt/global/support/permission/dataset/constant';
+import { AuthModeType, AuthResponseType } from '../type';
 
 export async function authDatasetByTmbId({
   tmbId,
@@ -70,9 +70,9 @@ export async function authDatasetByTmbId({
 // Auth Dataset
 export async function authDataset({
   datasetId,
-  per,
+  per = NullPermission,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   datasetId: string;
 }): Promise<
   AuthResponseType<DatasetPermission> & {
@@ -98,9 +98,9 @@ export async function authDataset({
 // the temporary solution for authDatasetCollection is getting the
 export async function authDatasetCollection({
   collectionId,
-  per,
+  per = NullPermission,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   collectionId: string;
 }): Promise<
   AuthResponseType<DatasetPermission> & {
@@ -132,7 +132,7 @@ export async function authDatasetFile({
   fileId,
   per,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   fileId: string;
 }): Promise<
   AuthResponseType<DatasetPermission> & {
@@ -178,7 +178,7 @@ export async function authDatasetFile({
 export async function authDatasetData({
   dataId,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   dataId: string;
 }) {
   // get mongo dataset.data

packages/service/support/permission/publish/authLink.ts

@@ -4,16 +4,15 @@ import { parseHeaderCert } from '../controller';
 import { MongoOutLink } from '../../outLink/schema';
 import { OutLinkErrEnum } from '@fastgpt/global/common/error/code/outLink';
 import { ManagePermissionVal } from '@fastgpt/global/support/permission/constant';
-import { AuthPropsType } from '../type/auth';
-import { AuthResponseType } from '../type/auth';
 import { authAppByTmbId } from '../app/auth';
+import { AuthModeType, AuthResponseType } from '../type';
 
 /* crud outlink permission */
 export async function authOutLinkCrud({
   outLinkId,
   per,
   ...props
-}: AuthPropsType & {
+}: AuthModeType & {
   outLinkId: string;
 }): Promise<
   AuthResponseType & {

packages/service/support/permission/type.d.ts

@@ -1,3 +1,4 @@
+import { Permission } from '@fastgpt/global/support/permission/controller';
 import { ApiRequestProps } from '../../type/next';
 import type { PermissionValueType } from '@fastgpt/global/support/permission/type';
 
@@ -10,10 +11,26 @@ export type ReqHeaderAuthType = {
   authorization?: string;
 };
 
-export type AuthModeType = {
+type RequireAtLeastOne<T, Keys extends keyof T = keyof T> = Pick<T, Exclude<keyof T, Keys>> &
+  {
+    [K in Keys]-?: Required<Pick<T, K>> & Partial<Pick<T, Exclude<Keys, K>>>;
+  }[Keys];
+
+type authModeType = {
   req: ApiRequestProps;
   authToken?: boolean;
   authRoot?: boolean;
   authApiKey?: boolean;
-  per?: PermissionValueType | 'r' | 'w' | 'owner'; // this is for compatibility
+  per?: PermissionValueType;
+};
+
+export type AuthModeType = RequireAtLeastOne<authModeType, 'authApiKey' | 'authRoot' | 'authToken'>;
+
+export type AuthResponseType<T extends Permission = Permission> = {
+  teamId: string;
+  tmbId: string;
+  authType?: `${AuthUserTypeEnum}`;
+  appId?: string;
+  apikey?: string;
+  permission: T;
 };

packages/service/support/permission/user/auth.ts

@@ -1,20 +1,20 @@
-import { AuthResponseType } from '../type/auth.d';
-import { AuthPropsType } from '../type/auth.d';
 import { TeamTmbItemType } from '@fastgpt/global/support/user/team/type';
 import { parseHeaderCert } from '../controller';
 import { getTmbInfoByTmbId } from '../../user/team/controller';
 import { TeamErrEnum } from '@fastgpt/global/common/error/code/team';
+import { AuthModeType, AuthResponseType } from '../type';
+import { NullPermission } from '@fastgpt/global/support/permission/constant';
 
 /* auth user role  */
-export async function authUserPer(props: AuthPropsType): Promise<
+export async function authUserPer(props: AuthModeType): Promise<
   AuthResponseType & {
     tmb: TeamTmbItemType;
   }
 > {
   const result = await parseHeaderCert(props);
   const tmb = await getTmbInfoByTmbId({ tmbId: result.tmbId });
 
-  if (!tmb.permission.checkPer(props.per)) {
+  if (!tmb.permission.checkPer(props.per ?? NullPermission)) {
     return Promise.reject(TeamErrEnum.unAuthTeam);
   }
 

packages/service/support/user/team/teamMemberSchema.ts

@@ -1,5 +1,5 @@
-import { connectionMongo, getMongoModel, type Model } from '../../../common/mongo';
-const { Schema, model, models } = connectionMongo;
+import { connectionMongo, getMongoModel } from '../../../common/mongo';
+const { Schema } = connectionMongo;
 import { TeamMemberSchema as TeamMemberType } from '@fastgpt/global/support/user/team/type.d';
 import { userCollectionName } from '../../user/schema';
 import {

projects/app/src/pages/api/core/chat/delHistory.ts

@@ -3,20 +3,21 @@ import { jsonRes } from '@fastgpt/service/common/response';
 import { MongoChat } from '@fastgpt/service/core/chat/chatSchema';
 import { MongoChatItem } from '@fastgpt/service/core/chat/chatItemSchema';
 import { DelHistoryProps } from '@/global/core/chat/api';
-import { autChatCrud } from '@/service/support/permission/auth/chat';
+import { authChatCrud } from '@/service/support/permission/auth/chat';
 import { mongoSessionRun } from '@fastgpt/service/common/mongo/sessionRun';
 import { NextAPI } from '@/service/middleware/entry';
 import { ApiRequestProps } from '@fastgpt/service/type/next';
+import { WritePermissionVal } from '@fastgpt/global/support/permission/constant';
 
 /* clear chat history */
 async function handler(req: ApiRequestProps<{}, DelHistoryProps>, res: NextApiResponse) {
   const { appId, chatId } = req.query;
 
-  await autChatCrud({
+  await authChatCrud({
     req,
     authToken: true,
     ...req.query,
-    per: 'w'
+    per: WritePermissionVal
   });
 
   await mongoSessionRun(async (session) => {

projects/app/src/pages/api/core/chat/feedback/adminUpdate.ts

@@ -1,10 +1,10 @@
 import type { NextApiRequest, NextApiResponse } from 'next';
 import { jsonRes } from '@fastgpt/service/common/response';
 import { connectToDatabase } from '@/service/mongo';
-import { authCert } from '@fastgpt/service/support/permission/auth/common';
 import type { AdminUpdateFeedbackParams } from '@/global/core/chat/api.d';
 import { MongoChatItem } from '@fastgpt/service/core/chat/chatItemSchema';
-import { autChatCrud } from '@/service/support/permission/auth/chat';
+import { authChatCrud } from '@/service/support/permission/auth/chat';
+import { ReadPermissionVal } from '@fastgpt/global/support/permission/constant';
 
 /* 初始化我的聊天框，需要身份验证 */
 export default async function handler(req: NextApiRequest, res: NextApiResponse) {
@@ -17,12 +17,12 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
       throw new Error('missing parameter');
     }
 
-    await autChatCrud({
+    await authChatCrud({
       req,
       authToken: true,
       appId,
       chatId,
-      per: 'r'
+      per: ReadPermissionVal
     });
 
     await MongoChatItem.findOneAndUpdate(