diff --git a/apps/application/serializers/application.py b/apps/application/serializers/application.py index 6989d7a9c66..e0989366528 100644 --- a/apps/application/serializers/application.py +++ b/apps/application/serializers/application.py @@ -1779,6 +1779,11 @@ def batch_delete(self, instance: Dict, with_valid=True): self.is_valid(raise_exception=True) id_list = instance.get("id_list") workspace_id = self.data.get("workspace_id") + id_list = list( + QuerySet(Application) + .filter(id__in=id_list, workspace_id=workspace_id) + .values_list("id", flat=True) + ) QuerySet(ApplicationVersion).filter(application_id__in=id_list).delete() QuerySet(ResourceMapping).filter(Q(target_id__in=id_list) | Q(source_id__in=id_list)).delete() diff --git a/apps/application/serializers/application_chat_record.py b/apps/application/serializers/application_chat_record.py index a2e79ccbc8f..93dfee09d60 100644 --- a/apps/application/serializers/application_chat_record.py +++ b/apps/application/serializers/application_chat_record.py @@ -11,6 +11,9 @@ from typing import Dict import uuid_utils.compat as uuid +from application.models import Application, ApplicationAccessToken, ChatRecord +from application.serializers.application_chat import ChatCountSerializer +from application.serializers.common import ChatInfo from common.auth.authentication import get_is_permissions from common.chunk import text_to_chunk from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission @@ -20,7 +23,8 @@ from django.db import transaction from django.db.models import QuerySet from django.db.models.aggregates import Max, Min -from django.utils.translation import gettext_lazy as _, gettext +from django.utils.translation import gettext +from django.utils.translation import gettext_lazy as _ from knowledge.models import Document, Knowledge, Paragraph, Problem, ProblemParagraphMapping from knowledge.serializers.common import get_embedding_model_id_by_knowledge_id, update_document_char_length from knowledge.serializers.paragraph import ParagraphSerializers @@ -28,10 +32,6 @@ from rest_framework import serializers from rest_framework.utils.formatting import lazy_format -from application.models import Application, ApplicationAccessToken, ChatRecord -from application.serializers.application_chat import ChatCountSerializer -from application.serializers.common import ChatInfo - class ChatRecordSerializerModel(serializers.ModelSerializer): class Meta: @@ -70,10 +70,9 @@ def is_valid(self, *, debug=False, raise_exception=False): query_set = query_set.filter(workspace_id=workspace_id) if not query_set.exists(): raise AppApiException(500, _("Application id does not exist")) - if ( - not ChatRecord.objects.filter(chat__application_id=self.data.get("application_id")).exists() - and ChatRecord.objects.filter(chat_id=self.data.get("chat_id")).exists() - ): + if not ChatRecord.objects.filter( + chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id") + ).exists(): raise AppApiException(500, _("Chat records for the application do not exist")) application_access_token = ( QuerySet(ApplicationAccessToken).filter(application_id=self.data.get("application_id")).first() @@ -91,7 +90,9 @@ def get_chat_record(self): ] if chat_record_list is not None and len(chat_record_list): return chat_record_list[-1] - return QuerySet(ChatRecord).filter(id=chat_record_id, chat_id=chat_id).first() + return QuerySet(ChatRecord).filter( + id=chat_record_id, chat_id=chat_id, chat__application_id=self.data.get("application_id") + ).first() def one(self, debug): self.is_valid(debug=debug, raise_exception=True) @@ -125,20 +126,20 @@ def is_valid(self, *, raise_exception=False): query_set = query_set.filter(workspace_id=workspace_id) if not query_set.exists(): raise AppApiException(500, _("Application id does not exist")) - if ( - not ChatRecord.objects.filter(chat__application_id=self.data.get("application_id")).exists() - and ChatRecord.objects.filter(chat_id=self.data.get("chat_id")).exists() - ): + if not ChatRecord.objects.filter( + chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id") + ).exists(): raise AppApiException(500, _("Chat records for the application do not exist")) def list(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id")) order_by = "create_time" if self.data.get("order_asc") is None or self.data.get("order_asc") else "-create_time" return [ ChatRecordSerializerModel(chat_record).data - for chat_record in QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id")).order_by(order_by) + for chat_record in QuerySet(ChatRecord).filter( + chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id") + ).order_by(order_by) ] @staticmethod @@ -233,7 +234,9 @@ def page(self, current_page: int, page_size: int, with_valid=True, show_source=N page = page_search( current_page, page_size, - QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id")).order_by(order_by), + QuerySet(ChatRecord).filter( + chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id") + ).order_by(order_by), post_records_handler=lambda chat_record: self.reset_chat_record(chat_record, show_source, show_exec), ) return page diff --git a/apps/chat/serializers/chat_record.py b/apps/chat/serializers/chat_record.py index ee6d446dd57..f64d06e6a71 100644 --- a/apps/chat/serializers/chat_record.py +++ b/apps/chat/serializers/chat_record.py @@ -42,6 +42,7 @@ class Meta: class VoteSerializer(serializers.Serializer): + application_id = serializers.UUIDField(required=True, label=_("Application ID")) chat_id = serializers.UUIDField(required=True, label=_("Conversation ID")) chat_record_id = serializers.UUIDField(required=True, @@ -59,7 +60,8 @@ def vote(self, instance: Dict, with_valid=True): "Voting on the current session minutes, please do not send repeated requests")) try: chat_record_details_model = QuerySet(ChatRecord).get(id=self.data.get('chat_record_id'), - chat_id=self.data.get('chat_id')) + chat_id=self.data.get('chat_id'), + chat__application_id=self.data.get('application_id')) if chat_record_details_model is None: raise AppApiException(500, gettext("Non-existent conversation chat_record_id")) vote_status = instance.get("vote_status") diff --git a/apps/chat/views/chat_record.py b/apps/chat/views/chat_record.py index c50d95b6437..0731f3dfc02 100644 --- a/apps/chat/views/chat_record.py +++ b/apps/chat/views/chat_record.py @@ -36,7 +36,8 @@ class VoteView(APIView): ) def put(self, request: Request, chat_id: str, chat_record_id: str): return result.success(VoteSerializer( - data={'chat_id': chat_id, + data={'application_id': request.auth.application_id, + 'chat_id': chat_id, 'chat_record_id': chat_record_id }).vote(request.data)) diff --git a/apps/folders/serializers/folder.py b/apps/folders/serializers/folder.py index b95ce53d7b2..1f68cbcba14 100644 --- a/apps/folders/serializers/folder.py +++ b/apps/folders/serializers/folder.py @@ -178,12 +178,20 @@ class Operate(serializers.Serializer): source = serializers.CharField(required=True, label=_('source')) user_id = serializers.UUIDField(required=True, label=_('user id')) + def is_valid(self, *, raise_exception=False): + super().is_valid(raise_exception=True) + Folder = get_folder_type(self.data.get('source')) # noqa + if Folder is None or not QuerySet(Folder).filter( + id=self.data.get('id'), workspace_id=self.data.get('workspace_id') + ).exists(): + raise serializers.ValidationError(_('Folder does not exist')) + @transaction.atomic def edit(self, instance): self.is_valid(raise_exception=True) Folder = get_folder_type(self.data.get('source')) # noqa current_id = self.data.get('id') - current_node = Folder.objects.get(id=current_id) + current_node = Folder.objects.get(id=current_id, workspace_id=self.data.get('workspace_id')) if current_node is None: raise serializers.ValidationError(_('Folder does not exist')) # 模块间的移动 @@ -232,7 +240,7 @@ def edit(self, instance): def one(self): self.is_valid(raise_exception=True) Folder = get_folder_type(self.data.get('source')) # noqa - folder = QuerySet(Folder).filter(id=self.data.get('id')).first() + folder = QuerySet(Folder).filter(id=self.data.get('id'), workspace_id=self.data.get('workspace_id')).first() return FolderSerializer(folder).data @transaction.atomic @@ -240,7 +248,7 @@ def delete(self): self.is_valid(raise_exception=True) Folder = get_folder_type(self.data.get('source')) # noqa Source = get_source_type(self.data.get('source')) # noqa - folder = Folder.objects.filter(id=self.data.get('id')).first() + folder = Folder.objects.filter(id=self.data.get('id'), workspace_id=self.data.get('workspace_id')).first() if not folder: raise serializers.ValidationError(_('Folder does not exist')) if folder.id == folder.workspace_id: diff --git a/apps/knowledge/serializers/knowledge_workflow.py b/apps/knowledge/serializers/knowledge_workflow.py index 6c71a0a7f05..54181983265 100644 --- a/apps/knowledge/serializers/knowledge_workflow.py +++ b/apps/knowledge/serializers/knowledge_workflow.py @@ -113,6 +113,15 @@ class KnowledgeWorkflowActionSerializer(serializers.Serializer): workspace_id = serializers.CharField(required=True, label=_("workspace id")) knowledge_id = serializers.UUIDField(required=True, label=_("knowledge id")) + def is_valid(self, *, raise_exception=False): + super().is_valid(raise_exception=True) + workspace_id = self.data.get("workspace_id") + query_set = QuerySet(Knowledge).filter(id=self.data.get("knowledge_id")) + if workspace_id: + query_set = query_set.filter(workspace_id=workspace_id) + if not query_set.exists(): + raise AppApiException(500, _("Knowledge id does not exist")) + def get_query_set(self, instance: Dict): query_set = ( QuerySet(KnowledgeAction) @@ -266,11 +275,26 @@ class Operate(serializers.Serializer): knowledge_id = serializers.UUIDField(required=True, label=_("knowledge id")) id = serializers.UUIDField(required=True, label=_("knowledge action id")) + def is_valid(self, *, raise_exception=False): + super().is_valid(raise_exception=True) + workspace_id = self.data.get("workspace_id") + query_set = QuerySet(Knowledge).filter(id=self.data.get("knowledge_id")) + if workspace_id: + query_set = query_set.filter(workspace_id=workspace_id) + if not query_set.exists(): + raise AppApiException(500, _("Knowledge id does not exist")) + if not QuerySet(KnowledgeAction).filter( + id=self.data.get("id"), knowledge_id=self.data.get("knowledge_id") + ).exists(): + raise AppApiException(500, _("Knowledge action does not exist")) + def one(self, is_valid=True): if is_valid: self.is_valid(raise_exception=True) knowledge_action_id = self.data.get("id") - knowledge_action = QuerySet(KnowledgeAction).filter(id=knowledge_action_id).first() + knowledge_action = QuerySet(KnowledgeAction).filter( + id=knowledge_action_id, knowledge_id=self.data.get("knowledge_id") + ).first() return { "id": knowledge_action_id, "knowledge_id": knowledge_action.knowledge_id, @@ -288,9 +312,11 @@ def cancel(self, is_valid=True): True, version=Cache_Version.KNOWLEDGE_WORKFLOW_INTERRUPTED.get_version(), ) - QuerySet(KnowledgeAction).filter(id=knowledge_action_id, state__in=[State.STARTED, State.PENDING]).update( - state=State.REVOKE - ) + QuerySet(KnowledgeAction).filter( + id=knowledge_action_id, + knowledge_id=self.data.get("knowledge_id"), + state__in=[State.STARTED, State.PENDING], + ).update(state=State.REVOKE) return True diff --git a/apps/knowledge/serializers/problem.py b/apps/knowledge/serializers/problem.py index 533258fca06..323b161c146 100644 --- a/apps/knowledge/serializers/problem.py +++ b/apps/knowledge/serializers/problem.py @@ -81,7 +81,7 @@ def delete(self, problem_id_list: List, with_valid=True): problem_id__in=problem_id_list) source_ids = [row.id for row in problem_paragraph_mapping_list] problem_paragraph_mapping_list.delete() - QuerySet(Problem).filter(id__in=problem_id_list).delete() + QuerySet(Problem).filter(id__in=problem_id_list, knowledge_id=knowledge_id).delete() delete_embedding_by_source_ids(source_ids) return True @@ -164,7 +164,8 @@ def list_paragraph(self, with_valid=True): def one(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - return ProblemInstanceSerializer(QuerySet(Problem).get(**{'id': self.data.get('problem_id')})).data + return ProblemInstanceSerializer(QuerySet(Problem).get( + id=self.data.get('problem_id'), knowledge_id=self.data.get('knowledge_id'))).data @transaction.atomic def delete(self, with_valid=True): @@ -175,7 +176,9 @@ def delete(self, with_valid=True): problem_id=self.data.get('problem_id')) source_ids = [row.id for row in problem_paragraph_mapping_list] problem_paragraph_mapping_list.delete() - QuerySet(Problem).filter(id=self.data.get('problem_id')).delete() + QuerySet(Problem).filter( + id=self.data.get('problem_id'), knowledge_id=self.data.get('knowledge_id') + ).delete() delete_embedding_by_source_ids(source_ids) return True diff --git a/apps/knowledge/serializers/tag.py b/apps/knowledge/serializers/tag.py index 562e539f4fb..72f5d38ea63 100644 --- a/apps/knowledge/serializers/tag.py +++ b/apps/knowledge/serializers/tag.py @@ -106,7 +106,7 @@ def is_valid(self, *, raise_exception=False): @transaction.atomic def edit(self, instance: Dict): self.is_valid(raise_exception=True) - tag = QuerySet(Tag).get(id=self.data.get('tag_id')) + tag = QuerySet(Tag).filter(id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id')).first() if tag is None: raise AppApiException(500, _('Tag id does not exist')) @@ -150,7 +150,9 @@ def delete(self, delete_type: str): self.is_valid(raise_exception=True) if delete_type == 'key': # 删除同一knowledge_id下相同key的所有标签 - tag = QuerySet(Tag).get(id=self.data.get('tag_id')) + tag = QuerySet(Tag).filter( + id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id') + ).first() if tag is None: raise AppApiException(500, _('Tag id does not exist')) QuerySet(Tag).filter( @@ -160,7 +162,7 @@ def delete(self, delete_type: str): QuerySet(DocumentTag).filter(tag_id=tag.id).delete() else: # 仅删除当前标签 - QuerySet(Tag).filter(id=self.data.get('tag_id')).delete() + QuerySet(Tag).filter(id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id')).delete() QuerySet(DocumentTag).filter(tag_id=self.data.get('tag_id')).delete() class BatchDelete(serializers.Serializer): @@ -185,7 +187,7 @@ def batch_delete(self): return # 获取要删除的标签的key - tags_to_delete = QuerySet(Tag).filter(id__in=tag_ids) + tags_to_delete = QuerySet(Tag).filter(id__in=tag_ids, knowledge_id=self.data.get('knowledge_id')) keys_to_delete = set(tags_to_delete.values_list('key', flat=True)) # 删除具有相同key的所有标签 diff --git a/apps/knowledge/serializers/termbase.py b/apps/knowledge/serializers/termbase.py index 7f994539541..d955ea0b560 100644 --- a/apps/knowledge/serializers/termbase.py +++ b/apps/knowledge/serializers/termbase.py @@ -47,7 +47,7 @@ def is_valid(self, *, raise_exception=False): def delete(self, problem_id_list: List, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - QuerySet(Termbase).filter(id__in=problem_id_list).delete() + QuerySet(Termbase).filter(id__in=problem_id_list, knowledge_id=self.data.get("knowledge_id")).delete() return True def export(self, problem_id_list: List, with_valid=True): @@ -55,7 +55,7 @@ def export(self, problem_id_list: List, with_valid=True): self.is_valid(raise_exception=True) terms = ( QuerySet(Termbase) - .filter(id__in=problem_id_list) + .filter(id__in=problem_id_list, knowledge_id=self.data.get("knowledge_id")) .order_by("-create_time") .values_list("content", flat=True) ) @@ -78,13 +78,16 @@ def is_valid(self, *, raise_exception=False): def one(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - return TermbaseInstanceSerializer(QuerySet(Termbase).get(**{"id": self.data.get("termbase_id")})).data + return TermbaseInstanceSerializer(QuerySet(Termbase).get( + id=self.data.get("termbase_id"), knowledge_id=self.data.get("knowledge_id"))).data @transaction.atomic def delete(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - QuerySet(Termbase).filter(id=self.data.get("termbase_id")).delete() + QuerySet(Termbase).filter( + id=self.data.get("termbase_id"), knowledge_id=self.data.get("knowledge_id") + ).delete() return True @transaction.atomic diff --git a/apps/models_provider/serializers/model_serializer.py b/apps/models_provider/serializers/model_serializer.py index 0c60472da10..6c2e03aa1e1 100644 --- a/apps/models_provider/serializers/model_serializer.py +++ b/apps/models_provider/serializers/model_serializer.py @@ -172,15 +172,17 @@ def one_meta(self, with_valid=False): def pause_download(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - QuerySet(Model).filter(id=self.data.get("id")).update(status=Status.PAUSE_DOWNLOAD) + QuerySet(Model).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).update(status=Status.PAUSE_DOWNLOAD) return True @transaction.atomic def delete(self, with_valid=True): if with_valid: - super().is_valid(raise_exception=True) + self.is_valid(raise_exception=True) model_id = self.data.get("id") - model = Model.objects.filter(id=model_id).first() + model = Model.objects.filter(id=model_id, workspace_id=self.data.get("workspace_id")).first() if model is None: return True QuerySet(WorkspaceUserResourcePermission).filter(target=model_id).delete() @@ -207,8 +209,10 @@ def delete(self, with_valid=True): def edit(self, instance: Dict, user_id: str, with_valid=True): if with_valid: - super().is_valid(raise_exception=True) - model = QuerySet(Model).filter(id=self.data.get("id")).first() + self.is_valid(raise_exception=True) + model = QuerySet(Model).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).first() credential, model_credential, provider_handler = ModelSerializer.Edit(data={**instance}).is_valid( model=model diff --git a/apps/oss/views/file.py b/apps/oss/views/file.py index 48412424fcb..3a4664a4f05 100644 --- a/apps/oss/views/file.py +++ b/apps/oss/views/file.py @@ -6,6 +6,8 @@ from rest_framework.views import Request from common.auth import TokenAuth, AllTokenAuth from common.constants.permission_constants import ChatAuth +from common.auth.authentication import has_permissions +from common.constants.permission_constants import RoleConstants from common.log.log import log from common.result import result from knowledge.api.file import FileUploadAPI, FileGetAPI, GetUrlContentAPI @@ -64,6 +66,7 @@ class Operate(APIView): tags=[_('File')] # type: ignore ) @log(menu='file', operate='Delete file') + @has_permissions(RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER) def delete(self, request: Request, file_id: str): return result.success(FileSerializer.Operate(data={'id': file_id}).delete()) diff --git a/apps/tools/serializers/tool.py b/apps/tools/serializers/tool.py index 0cd8f94b112..727cb7cd4f3 100644 --- a/apps/tools/serializers/tool.py +++ b/apps/tools/serializers/tool.py @@ -43,11 +43,10 @@ from system_manage.models.resource_mapping import ResourceMapping from system_manage.serializers.resource_mapping_serializers import ResourceMappingSerializer from system_manage.serializers.user_resource_permission import UserResourcePermissionSerializer -from trigger.models import Trigger, TriggerTask -from users.serializers.user import is_workspace_manage, is_workspace_manage_permission_read - from tools.models import Tool, ToolFolder, ToolRecord, ToolScope, ToolType from tools.models.tool_workflow import ToolWorkflow +from trigger.models import Trigger, TriggerTask +from users.serializers.user import is_workspace_manage, is_workspace_manage_permission_read tool_executor = ToolExecutor() @@ -649,7 +648,9 @@ def edit(self, instance, with_valid=True): if instance.get("tool_type") == ToolType.MCP: ToolExecutor().validate_mcp_transport(instance.get("code", "")) - if not QuerySet(Tool).filter(id=self.data.get("id")).exists(): + if not QuerySet(Tool).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).exists(): raise serializers.ValidationError(_("Tool not found")) edit_field_list = [ @@ -669,7 +670,9 @@ def edit(self, instance, with_valid=True): if (field in instance and instance.get(field) is not None) } - tool = QuerySet(Tool).filter(id=self.data.get("id")).first() + tool = QuerySet(Tool).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).first() if "init_params" in edit_dict: if edit_dict["init_field_list"] is not None: rm_key = [] @@ -686,7 +689,9 @@ def edit(self, instance, with_valid=True): edit_dict["init_params"] = rsa_long_encrypt(json.dumps(edit_dict["init_params"])) edit_dict["update_time"] = timezone.now() - QuerySet(Tool).filter(id=self.data.get("id")).update(**edit_dict) + QuerySet(Tool).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).update(**edit_dict) if "is_active" in instance: QuerySet(TriggerTask).filter(source_type="TOOL", source_id=self.data.get("id")).update( is_active=instance.get("is_active") @@ -708,13 +713,19 @@ def delete(self): from trigger.serializers.trigger import TriggerModelSerializer self.is_valid(raise_exception=True) - tool = QuerySet(Tool).filter(id=self.data.get("id")).first() + tool = QuerySet(Tool).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).first() + if tool is None: + raise serializers.ValidationError(_("Tool not found")) if tool.template_id is None and tool.icon != "": QuerySet(File).filter(id=tool.icon.split("/")[-1]).delete() if tool.tool_type == ToolType.SKILL: QuerySet(File).filter(id=tool.code).delete() QuerySet(WorkspaceUserResourcePermission).filter(target=tool.id).delete() - QuerySet(Tool).filter(id=self.data.get("id")).delete() + QuerySet(Tool).filter( + id=self.data.get("id"), workspace_id=self.data.get("workspace_id") + ).delete() ResourceMapping.objects.filter(Q(target_id=self.data.get("id")) | Q(source_id=self.data.get("id"))).delete() QuerySet(ToolRecord).filter(tool_id=self.data.get("id")).delete() trigger_ids = list( @@ -723,7 +734,9 @@ def delete(self): .values("trigger_id") .distinct() ) - QuerySet(TriggerTask).filter(source_type="TOOL", source_id=self.data.get("id")).delete() + QuerySet(TriggerTask).filter( + source_type="TOOL", source_id=self.data.get("id") + ).delete() for trigger_id in trigger_ids: trigger = Trigger.objects.filter(id=trigger_id["trigger_id"]).first() if trigger and trigger.is_active: @@ -1215,7 +1228,9 @@ def add(self, instance, with_valid=True): self.is_valid(raise_exception=True) AddInternalToolRequest(data=instance).is_valid(raise_exception=True) - internal_tool = QuerySet(Tool).filter(id=self.data.get("tool_id")).first() + internal_tool = QuerySet(Tool).filter( + id=self.data.get("tool_id"), scope=ToolScope.INTERNAL + ).first() if internal_tool is None: raise AppApiException(500, _("Tool does not exist")) @@ -1385,7 +1400,11 @@ class UpdateStoreTool(serializers.Serializer): def update_tool(self, with_valid=True): if with_valid: self.is_valid(raise_exception=True) - tool = QuerySet(Tool).filter(id=self.data.get("tool_id")).first() + if not self.data.get("download_url").startswith("https://apps-assets.fit2cloud.com/"): + raise AppApiException(500, _("Illegal download url")) + tool = QuerySet(Tool).filter( + id=self.data.get("tool_id"), workspace_id=self.data.get("workspace_id") + ).first() if tool is None: raise AppApiException(500, _("Tool does not exist")) # 查找匹配的版本名称 diff --git a/apps/trigger/serializers/trigger.py b/apps/trigger/serializers/trigger.py index 94673ad3154..f5494934036 100644 --- a/apps/trigger/serializers/trigger.py +++ b/apps/trigger/serializers/trigger.py @@ -463,6 +463,11 @@ def batch_delete(self, instance: Dict, with_valid=True): self.is_valid(raise_exception=True) workspace_id = self.data.get("workspace_id") trigger_id_list = instance.get("id_list") + trigger_id_list = list( + QuerySet(Trigger) + .filter(id__in=trigger_id_list, workspace_id=workspace_id) + .values_list("id", flat=True) + ) for trigger_id in trigger_id_list: trigger = QuerySet(Trigger).filter(id=trigger_id).first() undeploy(TriggerModelSerializer(trigger).data, **{}) diff --git a/apps/users/views/user.py b/apps/users/views/user.py index b5c8afe898a..1088bcd2d2d 100644 --- a/apps/users/views/user.py +++ b/apps/users/views/user.py @@ -149,6 +149,8 @@ class WorkspaceUserListView(APIView): tags=[_("User Management")], # type: ignore parameters=WorkspaceUserAPI.get_parameters(), responses=WorkspaceUserAPI.get_response()) + @has_permissions(RoleConstants.WORKSPACE_MANAGE, RoleConstants.ADMIN, RoleConstants.EXTENDS_ADMIN, + RoleConstants.EXTENDS_WORKSPACE_MANAGE, RoleConstants.USER, RoleConstants.EXTENDS_USER) def get(self, request: Request, workspace_id): nick_name = request.query_params.get('nick_name', None) return result.success(UserManageSerializer().get_user_list(workspace_id, nick_name)) @@ -164,6 +166,8 @@ class WorkspaceUserMemberView(APIView): tags=[_("User Management")], # type: ignore parameters=WorkspaceUserAPI.get_parameters(), responses=WorkspaceUserAPI.get_response()) + @has_permissions(RoleConstants.WORKSPACE_MANAGE, RoleConstants.ADMIN, RoleConstants.EXTENDS_ADMIN, + RoleConstants.EXTENDS_WORKSPACE_MANAGE, RoleConstants.USER, RoleConstants.EXTENDS_USER) def get(self, request: Request, workspace_id): return result.success(UserManageSerializer().get_user_members(workspace_id))