feat: app collaborator with group, remove default permission

packages/global/core/app/collaborator.d.ts

@@ -1,4 +1,8 @@
-import { UpdateClbPermissionProps } from '../../support/permission/collaborator';
+import { RequireOnlyOne } from '../../common/type/utils';
+import {
+  UpdateClbPermissionProps,
+  UpdatePermissionBody
+} from '../../support/permission/collaborator';
 import { PermissionValueType } from '../../support/permission/type';
 
 export type UpdateAppCollaboratorBody = UpdateClbPermissionProps & {
@@ -7,5 +11,7 @@ export type UpdateAppCollaboratorBody = UpdateClbPermissionProps & {
 
 export type AppCollaboratorDeleteParams = {
   appId: string;
+} & RequireOnlyOne<{
   tmbId: string;
-};
+  groupId: string;
+}>;

packages/global/core/app/type.d.ts

@@ -10,7 +10,6 @@ import { SelectedDatasetType } from '../workflow/api';
 import { DatasetSearchModeEnum } from '../dataset/constants';
 import { TeamTagSchema as TeamTagsSchemaType } from '@fastgpt/global/support/user/team/type.d';
 import { StoreEdgeItemType } from '../workflow/type/edge';
-import { PermissionSchemaType, PermissionValueType } from '../../support/permission/type';
 import { AppPermission } from '../../support/permission/app/controller';
 import { ParentIdType } from '../../common/parentFolder/type';
 import { FlowNodeInputTypeEnum } from 'core/workflow/node/constant';
@@ -45,7 +44,8 @@ export type AppSchema = {
 
   inited?: boolean;
   teamTags: string[];
-} & PermissionSchemaType;
+  inheritPermission?: boolean;
+};
 
 export type AppListItemType = {
   _id: string;
@@ -57,7 +57,9 @@ export type AppListItemType = {
   updateTime: Date;
   pluginData?: AppSchema['pluginData'];
   permission: AppPermission;
-} & PermissionSchemaType;
+  inheritPermission?: boolean;
+  private?: boolean;
+};
 
 export type AppDetailType = AppSchema & {
   permission: AppPermission;

packages/global/core/dataset/collaborator.d.ts

@@ -1,11 +1,14 @@
 import { UpdateClbPermissionProps } from '../../support/permission/collaborator';
 import { PermissionValueType } from '../../support/permission/type';
+import { RequireOnlyOne } from '../../common/type/utils';
 
 export type UpdateDatasetCollaboratorBody = UpdateClbPermissionProps & {
   datasetId: string;
 };
 
 export type DatasetCollaboratorDeleteParams = {
   datasetId: string;
+} & RequireOnlyOne<{
   tmbId: string;
-};
+  groupId: string;
+}>;

packages/global/support/permission/collaborator.d.ts

@@ -4,11 +4,13 @@ import { PermissionValueType } from './type';
 
 export type CollaboratorItemType = {
   teamId: string;
-  tmbId: string;
   permission: Permission;
   name: string;
   avatar: string;
-};
+} & RequireOnlyOne<{
+  tmbId: string;
+  groupId: string;
+}>;
 
 export type UpdateClbPermissionProps = {
   members?: string[];

packages/global/support/permission/constant.ts

@@ -1,4 +1,3 @@
-import { Permission } from './controller';
 import { PermissionListType } from './type';
 import { i18nT } from '../../../web/i18n/utils';
 export enum AuthUserTypeEnum {

packages/global/support/permission/type.d.ts

@@ -1,6 +1,7 @@
 import { RequireOnlyOne } from '../../common/type/utils';
 import { TeamMemberWithUserSchema } from '../user/team/type';
 import { AuthUserTypeEnum, PermissionKeyEnum, PerResourceTypeEnum } from './constant';
+import { MemberGroupSchemaType } from './memberGroup/type';
 
 // PermissionValueType, the type of permission's value is a number, which is a bit field actually.
 // It is spired by the permission system in Linux.
@@ -33,6 +34,10 @@ export type ResourcePerWithTmbWithUser = Omit<ResourcePermissionType, 'tmbId'> &
   tmbId: TeamMemberWithUserSchema;
 };
 
+export type ResourcePerWithGroup = Omit<ResourcePermissionType, 'groupId'> & {
+  groupId: MemberGroupSchemaType;
+};
+
 export type PermissionSchemaType = {
   defaultPermission: PermissionValueType;
   inheritPermission: boolean;

packages/service/core/app/schema.ts

@@ -5,8 +5,6 @@ import {
   TeamCollectionName,
   TeamMemberCollectionName
 } from '@fastgpt/global/support/user/team/constant';
-import { AppDefaultPermissionVal } from '@fastgpt/global/support/permission/app/constant';
-import { getPermissionSchema } from '@fastgpt/global/support/permission/utils';
 
 export const AppCollectionName = 'apps';
 
@@ -111,8 +109,10 @@ const AppSchema = new Schema({
   inited: {
     type: Boolean
   },
-
-  ...getPermissionSchema(AppDefaultPermissionVal)
+  inheritPermission: {
+    type: Boolean,
+    default: true
+  }
 });
 
 AppSchema.index({ teamId: 1, updateTime: -1 });

packages/service/support/permission/app/auth.ts

@@ -13,6 +13,7 @@ import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
 import { splitCombinePluginId } from '../../../core/app/plugin/controller';
 import { PluginSourceEnum } from '@fastgpt/global/core/plugin/constants';
 import { AuthModeType, AuthResponseType } from '../type';
+import { AppDefaultPermissionVal } from '@fastgpt/global/support/permission/app/constant';
 
 export const authPluginByTmbId = async ({
   tmbId,
@@ -60,7 +61,6 @@ export const authAppByTmbId = async ({
     if (isRoot) {
       return {
         ...app,
-        defaultPermission: app.defaultPermission,
         permission: new AppPermission({ isOwner: true })
       };
     }
@@ -71,7 +71,7 @@ export const authAppByTmbId = async ({
 
     const isOwner = tmbPer.isOwner || String(app.tmbId) === String(tmbId);
 
-    const { Per, defaultPermission } = await (async () => {
+    const { Per } = await (async () => {
       if (
         AppFolderTypeList.includes(app.type) ||
         app.inheritPermission === false ||
@@ -86,10 +86,9 @@ export const authAppByTmbId = async ({
           resourceId: appId,
           resourceType: PerResourceTypeEnum.app
         });
-        const Per = new AppPermission({ per: rp ?? app.defaultPermission, isOwner });
+        const Per = new AppPermission({ per: rp ?? AppDefaultPermissionVal, isOwner });
         return {
-          Per,
-          defaultPermission: app.defaultPermission
+          Per
         };
       } else {
         // is not folder and inheritPermission is true and is not root folder.
@@ -104,8 +103,7 @@ export const authAppByTmbId = async ({
           isOwner
         });
         return {
-          Per,
-          defaultPermission: parent.defaultPermission
+          Per
         };
       }
     })();
@@ -116,7 +114,6 @@ export const authAppByTmbId = async ({
 
     return {
       ...app,
-      defaultPermission,
       permission: Per
     };
   })();

packages/service/support/permission/controller.ts

@@ -10,12 +10,16 @@ import { MongoResourcePermission } from './schema';
 import { ClientSession } from 'mongoose';
 import {
   PermissionValueType,
-  ResourcePermissionType
+  ResourcePermissionType,
+  ResourcePerWithGroup,
+  ResourcePerWithTmbWithUser
 } from '@fastgpt/global/support/permission/type';
 import { bucketNameMap } from '@fastgpt/global/common/file/constants';
 import { addMinutes } from 'date-fns';
 import { getGroupsByTmbId } from './memberGroup/controllers';
 import { Permission } from '@fastgpt/global/support/permission/controller';
+import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
+import { RequireOnlyOne } from '@fastgpt/global/common/type/utils';
 
 /** get resource permission for a team member
  * If there is no permission for the team member, it will return undefined
@@ -123,6 +127,66 @@ export async function getResourceAllClbs({
   ).lean();
 }
 
+export async function getResourceClbsAndGroups({
+  resourceId,
+  resourceType,
+  teamId,
+  session
+}: {
+  resourceId: ParentIdType;
+  resourceType: Omit<`${PerResourceTypeEnum}`, 'team'>;
+  teamId: string;
+  session: ClientSession;
+}) {
+  return MongoResourcePermission.find(
+    {
+      resourceId,
+      resourceType,
+      teamId
+    },
+    undefined,
+    { session }
+  ).lean();
+}
+
+export const getClbsAndGroupsWithInfo = async ({
+  resourceId,
+  resourceType,
+  teamId
+}: {
+  resourceId: ParentIdType;
+  resourceType: Omit<`${PerResourceTypeEnum}`, 'team'>;
+  teamId: string;
+}) =>
+  Promise.all([
+    (await MongoResourcePermission.find({
+      teamId,
+      resourceId,
+      resourceType,
+      tmbId: {
+        $exists: true
+      }
+    }).populate({
+      path: 'tmbId',
+      select: 'name userId',
+      populate: {
+        path: 'userId',
+        select: 'avatar'
+      }
+    })) as ResourcePerWithTmbWithUser[],
+    (await MongoResourcePermission.find({
+      teamId,
+      resourceId,
+      resourceType,
+      groupId: {
+        $exists: true
+      }
+    }).populate({
+      path: 'groupId',
+      select: 'name avatar'
+    })) as ResourcePerWithGroup[]
+  ]);
+
 export const delResourcePermissionById = (id: string) => {
   return MongoResourcePermission.findByIdAndRemove(id);
 };
@@ -135,7 +199,10 @@ export const delResourcePermission = ({
   resourceId: string;
   tmbId: string;
   session?: ClientSession;
-}) => {
+} & RequireOnlyOne<{
+  tmbId: string;
+  groupId: string;
+}>) => {
   return MongoResourcePermission.deleteOne(props, { session });
 };
 

packages/service/support/permission/dataset/auth.ts

@@ -186,7 +186,8 @@ export async function authDatasetCollection({
     teamId,
     tmbId,
     collection,
-    permission: dataset.permission
+    permission: dataset.permission,
+    isRoot: isRootFromHeader || isRoot
   };
 }
 
@@ -231,7 +232,8 @@ export async function authDatasetFile({
       teamId,
       tmbId,
       file,
-      permission
+      permission,
+      isRoot
     };
   } catch (error) {
     return Promise.reject(DatasetErrEnum.unAuthDatasetFile);