mirror of
https://github.com/Tencent/WeKnora.git
synced 2026-10-31 03:47:56 +08:00
wizardchen
928f5abe3f
Before this change, the `organization_members` table keyed on user_id — joining an org as a Viewer in tenant T meant only that one user got visibility on shared KBs/agents, while the rest of T (including its Owner) saw nothing. The mismatch surfaced as confusing UX bugs: "my colleague shared this with us, why can't I see it?" This change replaces `organization_members` with `organization_tenant_members`. Membership and Org-RBAC role now key on (org_id, tenant_id); `representative_user_id` stays as a display-only label of the user who first brought the tenant in. Permission resolution gains a 3-D cap so tenant-RBAC stays honest under cross-tenant sharing: effective = min(share.Permission, tenant_org_role, tenant_role_cap) where tenant_role_cap pins tenant Viewers to OrgRoleViewer regardless of the org-level grant. A Viewer in their own tenant cannot edit a shared KB even if the org granted Editor — preserves the "Viewer = read-only everywhere" promise. Migration 000045 backfills `organization_tenant_members` from the old table by collapsing each (org, tenant) group to its max role, then renames the old table to `organization_members_pre_plan3` for safe rollback. Sqlite mirror (Lite mode) is fresh-bootstrap: the init schema replaces the old table directly. Routes: member-management URLs change from `:user_id` to `:tenant_id`. Org create / join / leave now require Admin+ in the caller's tenant — joining an Org affects everyone in T, so the decision can't sit with a Viewer. Frontend: OrganizationSettingsModal + store update to address members by tenant_id.
22 lines
756 B
SQL
22 lines
756 B
SQL
DROP TABLE IF EXISTS tenant_disabled_shared_agents;
|
|
DROP TABLE IF EXISTS agent_shares;
|
|
DROP TABLE IF EXISTS organization_join_requests;
|
|
DROP TABLE IF EXISTS kb_shares;
|
|
DROP TABLE IF EXISTS organization_tenant_members;
|
|
DROP TABLE IF EXISTS organizations;
|
|
DROP TABLE IF EXISTS custom_agents;
|
|
DROP TABLE IF EXISTS mcp_tool_approvals;
|
|
DROP TABLE IF EXISTS mcp_services;
|
|
DROP TABLE IF EXISTS knowledge_tags;
|
|
DROP TABLE IF EXISTS auth_tokens;
|
|
DROP TABLE IF EXISTS audit_logs;
|
|
DROP TABLE IF EXISTS tenant_members;
|
|
DROP TABLE IF EXISTS users;
|
|
DROP TABLE IF EXISTS chunks;
|
|
DROP TABLE IF EXISTS messages;
|
|
DROP TABLE IF EXISTS sessions;
|
|
DROP TABLE IF EXISTS knowledges;
|
|
DROP TABLE IF EXISTS knowledge_bases;
|
|
DROP TABLE IF EXISTS models;
|
|
DROP TABLE IF EXISTS tenants;
|