feat: qa知识库的一些操作加上权限校验

src/backend/bisheng/api/services/knowledge_imp.py

@@ -1046,17 +1046,14 @@ def add_qa(db_knowledge: Knowledge, data: QAKnowledgeUpsert) -> QAKnowledge:
         raise e
 
 
-def qa_status_change(qa_id: int, target_status: int):
+def qa_status_change(qa_db: QAKnowledge, target_status: int, db_knowledge: Knowledge):
     """QA 状态切换"""
-    qa_db = QAKnoweldgeDao.get_qa_knowledge_by_primary_id(qa_id)
 
     if qa_db.status == target_status:
         logger.info("qa status is same, skip")
         return
-
-    db_knowledge = KnowledgeDao.query_by_id(qa_db.knowledge_id)
     if target_status == QAStatus.DISABLED.value:
-        delete_vector_data(db_knowledge, [qa_id])
+        delete_vector_data(db_knowledge, [qa_db.id])
         qa_db.status = target_status
         QAKnoweldgeDao.update(qa_db)
     else:

src/backend/bisheng/api/v1/knowledge.py

@@ -354,6 +354,10 @@ async def qa_add(*, QACreate: QAKnowledgeUpsert,
     db_knowledge = KnowledgeDao.query_by_id(QACreate.knowledge_id)
     if db_knowledge.type != KnowledgeTypeEnum.QA.value:
         raise HTTPException(status_code=404, detail='知识库类型错误')
+    if not login_user.access_check(
+            db_knowledge.user_id, str(db_knowledge.id), AccessType.KNOWLEDGE_WRITE
+    ):
+        raise UnAuthorizedError.http_exception()
 
     db_q = QAKnoweldgeDao.get_qa_knowledge_by_name(QACreate.questions, QACreate.knowledge_id, exclude_id=QACreate.id)
     # create repeat question or update
@@ -370,7 +374,16 @@ def qa_status_switch(*,
                      id: int = Body(embed=True),
                      login_user: UserPayload = Depends(get_login_user)):
     """ 修改知识库信息. """
-    new_qa_db = knowledge_imp.qa_status_change(id, status)
+    qa_db = QAKnoweldgeDao.get_qa_knowledge_by_primary_id(id)
+    if qa_db.status == status:
+        return resp_200()
+    db_knowledge = KnowledgeDao.query_by_id(qa_db.knowledge_id)
+    if not login_user.access_check(
+            db_knowledge.user_id, str(db_knowledge.id), AccessType.KNOWLEDGE_WRITE
+    ):
+        raise UnAuthorizedError.http_exception()
+
+    new_qa_db = knowledge_imp.qa_status_change(qa_db, status, db_knowledge)
     if not new_qa_db:
         return resp_200()
     if new_qa_db.status != status:
@@ -397,6 +410,12 @@ def qa_append(
     """ 增加知识库信息. """
     QA_list = QAKnoweldgeDao.select_list(ids)
     knowledge = KnowledgeDao.query_by_id(QA_list[0].knowledge_id)
+    # check knowledge access
+    if not login_user.access_check(
+            knowledge.user_id, str(knowledge.id), AccessType.KNOWLEDGE_WRITE
+    ):
+        raise UnAuthorizedError.http_exception()
+
     for q in QA_list:
         if question in q.questions:
             raise KnowledgeQAError.http_exception()
@@ -706,6 +725,11 @@ def update_knowledge_model(*,
         if not knowledge:
             return resp_501(message="指定的知识库不存在")
 
+        if not login_user.access_check(
+                knowledge.user_id, str(knowledge.id), AccessType.KNOWLEDGE_WRITE
+        ):
+            raise UnAuthorizedError.http_exception()
+
         old_model_id = knowledge.model
 
         # 更新知识库状态和模型