(feature)(chat)Support agent-level permission management.

(feature)(supersonic-fe) add permission manage in agent (#2095 )
2026-04-22 23:14:33 +08:00 · 2025-02-24 09:25:12 +08:00 · 2025-02-24 08:18:48 +08:00
13 changed files with 16108 additions and 12818 deletions
--- a/chat/server/src/main/java/com/tencent/supersonic/chat/server/agent/Agent.java
+++ b/chat/server/src/main/java/com/tencent/supersonic/chat/server/agent/Agent.java
@@ -38,6 +38,9 @@ public class Agent extends RecordInfo {
    private VisualConfig visualConfig;
    private List<String> admins = Lists.newArrayList();
    private List<String> viewers = Lists.newArrayList();
+    private List<String> adminOrgs = Lists.newArrayList();
+    private List<String> viewOrgs = Lists.newArrayList();
+    private Integer isOpen = 0;

    public List<String> getTools(AgentToolType type) {
        Map<String, Object> map = JSONObject.parseObject(toolConfig, Map.class);
@@ -115,4 +118,8 @@ public class Agent extends RecordInfo {
        return list.apply(this).contains(user.getName());
    }

+    public boolean openToAll() {
+        return isOpen != null && isOpen == 1;
+    }
+
 }
--- a/chat/server/src/main/java/com/tencent/supersonic/chat/server/persistence/dataobject/AgentDO.java
+++ b/chat/server/src/main/java/com/tencent/supersonic/chat/server/persistence/dataobject/AgentDO.java
@@ -44,4 +44,10 @@ public class AgentDO {
    private String admin;

    private String viewer;
+
+    private String adminOrg;
+
+    private String viewOrg;
+
+    private Integer isOpen;
 }
--- a/chat/server/src/main/java/com/tencent/supersonic/chat/server/service/impl/AgentServiceImpl.java
+++ b/chat/server/src/main/java/com/tencent/supersonic/chat/server/service/impl/AgentServiceImpl.java
@@ -1,6 +1,7 @@
 package com.tencent.supersonic.chat.server.service.impl;

 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
+import com.tencent.supersonic.auth.api.authentication.service.UserService;
 import com.tencent.supersonic.chat.api.pojo.request.ChatMemoryFilter;
 import com.tencent.supersonic.chat.api.pojo.request.ChatParseReq;
 import com.tencent.supersonic.chat.server.agent.Agent;
@@ -26,6 +27,7 @@ import org.springframework.util.CollectionUtils;

 import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.stream.Collectors;

@@ -42,6 +44,9 @@ public class AgentServiceImpl extends ServiceImpl<AgentDOMapper, AgentDO> implem
    @Autowired
    private ChatModelService chatModelService;

+    @Autowired
+    private UserService userService;
+
    @Autowired
    @Qualifier("chatExecutor")
    private ThreadPoolExecutor executor;
@@ -53,17 +58,19 @@ public class AgentServiceImpl extends ServiceImpl<AgentDOMapper, AgentDO> implem
    }

    private boolean filterByAuth(Agent agent, User user, AuthType authType) {
-        if (user.isSuperAdmin() || user.getName().equals(agent.getCreatedBy())) {
+        Set<String> orgIds = userService.getUserAllOrgId(user.getName());
+
+        if (user.isSuperAdmin() || agent.openToAll()
+                || user.getName().equals(agent.getCreatedBy())) {
            return true;
        }
        authType = authType == null ? AuthType.VIEWER : authType;
        switch (authType) {
            case ADMIN:
-                return agent.contains(user, Agent::getAdmins);
+                return checkAdminPermission(orgIds, user, agent);
            case VIEWER:
            default:
-                return agent.contains(user, Agent::getAdmins)
-                        || agent.contains(user, Agent::getViewers);
+                return checkViewPermission(orgIds, user, agent);
        }
    }

@@ -161,6 +168,9 @@ public class AgentServiceImpl extends ServiceImpl<AgentDOMapper, AgentDO> implem
        });
        agent.setAdmins(JsonUtil.toList(agentDO.getAdmin(), String.class));
        agent.setViewers(JsonUtil.toList(agentDO.getViewer(), String.class));
+        agent.setAdminOrgs(JsonUtil.toList(agentDO.getAdminOrg(), String.class));
+        agent.setViewOrgs(JsonUtil.toList(agentDO.getViewOrg(), String.class));
+        agent.setIsOpen(agentDO.getIsOpen());
        return agent;
    }

@@ -173,9 +183,56 @@ public class AgentServiceImpl extends ServiceImpl<AgentDOMapper, AgentDO> implem
        agentDO.setVisualConfig(JsonUtil.toString(agent.getVisualConfig()));
        agentDO.setAdmin(JsonUtil.toString(agent.getAdmins()));
        agentDO.setViewer(JsonUtil.toString(agent.getViewers()));
+        agentDO.setAdminOrg(JsonUtil.toString(agent.getAdminOrgs()));
+        agentDO.setViewOrg(JsonUtil.toString(agent.getViewOrgs()));
+        agentDO.setIsOpen(agent.getIsOpen());
        if (agentDO.getStatus() == null) {
            agentDO.setStatus(1);
        }
        return agentDO;
    }
+
+    private boolean checkAdminPermission(Set<String> orgIds, User user, Agent agent) {
+        List<String> admins = agent.getAdmins();
+        List<String> adminOrgs = agent.getAdminOrgs();
+        if (user.isSuperAdmin()) {
+            return true;
+        }
+        if (admins.contains(user.getName()) || agent.getCreatedBy().equals(user.getName())) {
+            return true;
+        }
+        if (CollectionUtils.isEmpty(adminOrgs)) {
+            return false;
+        }
+        for (String orgId : orgIds) {
+            if (adminOrgs.contains(orgId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private boolean checkViewPermission(Set<String> orgIds, User user, Agent agent) {
+        if (checkAdminPermission(orgIds, user, agent)) {
+            return true;
+        }
+        List<String> viewers = agent.getViewers();
+        List<String> viewOrgs = agent.getViewOrgs();
+        if (agent.openToAll()) {
+            return true;
+        }
+        if (viewers.contains(user.getName())) {
+            return true;
+        }
+        if (CollectionUtils.isEmpty(viewOrgs)) {
+            return false;
+        }
+        for (String orgId : orgIds) {
+            if (viewOrgs.contains(orgId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
 }
--- a/launchers/standalone/src/main/resources/config.update/sql-update-mysql.sql
+++ b/launchers/standalone/src/main/resources/config.update/sql-update-mysql.sql
@@ -405,4 +405,9 @@ ALTER TABLE s2_chat_context RENAME COLUMN `user` TO `query_user`;

 --20241226
 ALTER TABLE s2_chat_memory add column `query_id` BIGINT DEFAULT NULL;
-ALTER TABLE s2_query_stat_info RENAME COLUMN `sql` TO `query_sql`;
+ALTER TABLE s2_query_stat_info RENAME COLUMN `sql` TO `query_sql`;
+
+--20250224
+ALTER TABLE s2_agent add column `admin_org` varchar(3000) DEFAULT NULL COMMENT '管理员组织';
+ALTER TABLE s2_agent add column `view_org` varchar(3000) DEFAULT NULL COMMENT '可用组织';
+ALTER TABLE s2_agent add column `is_open` tinyint DEFAULT NULL COMMENT '是否公开';
--- a/launchers/standalone/src/main/resources/db/schema-h2.sql
+++ b/launchers/standalone/src/main/resources/db/schema-h2.sql
@@ -377,8 +377,11 @@ CREATE TABLE IF NOT EXISTS s2_agent
    updated_at  TIMESTAMP null,
    enable_search int null,
    enable_feedback int null,
-    admin varchar(1000),
-    viewer varchar(1000),
+    `admin` varchar(3000) DEFAULT NULL  , -- administrator
+    `admin_org` varchar(3000) DEFAULT NULL  , -- administrators organization
+    `is_open` TINYINT DEFAULT NULL  , -- whether the public
+    `viewer` varchar(3000) DEFAULT NULL  , -- available users
+    `view_org` varchar(3000) DEFAULT NULL  , -- available organization
    PRIMARY KEY (`id`)
 ); COMMENT ON TABLE s2_agent IS 'agent information table';

--- a/launchers/standalone/src/main/resources/db/schema-mysql.sql
+++ b/launchers/standalone/src/main/resources/db/schema-mysql.sql
@@ -15,8 +15,11 @@ CREATE TABLE IF NOT EXISTS `s2_agent` (
    `created_at` datetime DEFAULT NULL,
    `updated_by` varchar(100) COLLATE utf8_unicode_ci DEFAULT NULL,
    `updated_at` datetime DEFAULT NULL,
-    `admin` varchar(1000) COLLATE utf8_unicode_ci DEFAULT NULL,
-    `viewer` varchar(1000) COLLATE utf8_unicode_ci DEFAULT NULL,
+     `admin` varchar(3000) DEFAULT NULL COMMENT '管理员',
+     `admin_org` varchar(3000) DEFAULT NULL COMMENT '管理员组织',
+     `is_open` tinyint DEFAULT NULL COMMENT '是否公开',
+     `viewer` varchar(3000) DEFAULT NULL COMMENT '可用用户',
+     `view_org` varchar(3000) DEFAULT NULL COMMENT '可用组织',
    PRIMARY KEY (`id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

--- a/launchers/standalone/src/main/resources/db/schema-postgres.sql
+++ b/launchers/standalone/src/main/resources/db/schema-postgres.sql
@@ -15,8 +15,11 @@ CREATE TABLE IF NOT EXISTS s2_agent (
    created_at timestamp DEFAULT NULL,
    updated_by varchar(100) DEFAULT NULL,
    updated_at timestamp DEFAULT NULL,
-    admin varchar(1000) DEFAULT NULL,
-    viewer varchar(1000) DEFAULT NULL
+    admin varchar(3000) DEFAULT NULL,
+    admin_org varchar(3000) DEFAULT NULL,
+    is_open smallint DEFAULT NULL,
+    viewer varchar(3000) DEFAULT NULL,
+    view_org varchar(3000) DEFAULT NULL
 );

 CREATE TABLE IF NOT EXISTS s2_auth_groups (
--- a/webapp/packages/chat-sdk/package.json
+++ b/webapp/packages/chat-sdk/package.json
@@ -209,5 +209,6 @@
  },
  "engines": {
    "node": ">=16"
-  }
-}
+  },
+  "packageManager": "pnpm@9.12.3+sha512.cce0f9de9c5a7c95bef944169cc5dfe8741abfb145078c0d508b868056848a87c81e626246cb60967cbd7fd29a6c062ef73ff840d96b3c86c40ac92cf4a813ee"
+}
--- a/webapp/packages/supersonic-fe/src/pages/Agent/AgentForm.tsx
+++ b/webapp/packages/supersonic-fe/src/pages/Agent/AgentForm.tsx
@@ -1,6 +1,6 @@
-import { Form, Input, Button, Switch, Tabs, Select, message, Space, Tooltip, Row, Col } from 'antd';
+import { Form, Input, Button, Switch, Tabs, Select, message, Space, Tooltip } from 'antd';
 import MainTitleMark from '@/components/MainTitleMark';
-import { AgentType, ChatAppConfig, ChatAppConfigItem } from './type';
+import { AgentType, ChatAppConfig } from './type';
 import { useEffect, useState } from 'react';
 import styles from './style.less';
 import { DeleteOutlined, PlusOutlined } from '@ant-design/icons';
@@ -9,9 +9,9 @@ import ToolsSection from './ToolsSection';
 import globalStyles from '@/global.less';
 import { QuestionCircleOutlined } from '@ant-design/icons';
 import SelectTMEPerson from '@/components/SelectTMEPerson';
-import FormItemTitle from '@/components/FormHelper/FormItemTitle';
-import { getLlmModelTypeList, getLlmModelAppList, getLlmList } from '../../services/system';
+import { getLlmModelAppList, getLlmList } from '../../services/system';
 import MemorySection from './MemorySection';
+import PermissionSection from './PermissionSection';

 const FormItem = Form.Item;
 const { TextArea } = Input;
@@ -195,16 +195,6 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
          <FormItem name="enableFeedback" label="开启用户确认" valuePropName="checked" htmlFor="">
            <Switch />
          </FormItem>
-          {/* <FormItem
-            name={['multiTurnConfig', 'enableMultiTurn']}
-            label="开启多轮对话"
-            valuePropName="checked"
-          >
-            <Switch />
-          </FormItem>
-          <FormItem name="enableMemoryReview" label="开启记忆评估" valuePropName="checked">
-            <Switch />
-          </FormItem> */}
          <FormItem
            name={['toolConfig', 'simpleMode']}
            label="开启精简模式"
@@ -214,7 +204,6 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
          >
            <Switch />
          </FormItem>
-
          <FormItem
            name={['toolConfig', 'debugMode']}
            label="开启调试信息"
@@ -286,8 +275,6 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
            </Space>
          </div>
          <Space style={{ alignItems: 'start' }}>
-            {/* <Row> */}
-            {/* <Col flex="400px"> */}
            <div style={{ width: 350 }}>
              {modelTypeOptions.map((item) => {
                return (
@@ -312,8 +299,6 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
                );
              })}
            </div>
-            {/* </Col>
-            <Col flex="auto"> */}
            <div style={{ width: 900 }}>
              {modelTypeOptions.map((item) => {
                return (
@@ -358,44 +343,10 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
                );
              })}
            </div>
-            {/* </Col> */}
-            {/* </Row> */}
          </Space>
        </div>
      ),
    },
-    // {
-    //   label: '提示词配置',
-    //   key: 'promptConfig',
-    //   children: (
-    //     <div className={styles.agentFormContainer}>
-    //       <FormItem
-    //         name={['promptConfig', 'promptTemplate']}
-    //         label={
-    //           <>
-    //             <Space>
-    //               提示词模板
-    //               <Tooltip
-    //                 overlayInnerStyle={{ width: 400 }}
-    //                 title={
-    //                   <>
-    //                     {tips.map((tip) => (
-    //                       <div>{tip}</div>
-    //                     ))}
-    //                   </>
-    //                 }
-    //               >
-    //                 <QuestionCircleOutlined />
-    //               </Tooltip>
-    //             </Space>
-    //           </>
-    //         }
-    //       >
-    //         <Input.TextArea style={{ minHeight: 600 }} />
-    //       </FormItem>
-    //     </div>
-    //   ),
-    // },
    {
      label: '工具配置',
      key: 'tools',
@@ -406,6 +357,11 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
      key: 'memory',
      children: <MemorySection agentId={editAgent?.id} />,
    },
+    {
+      label: '权限管理',
+      key: 'permissonSetting',
+      children: <PermissionSection currentAgent={editAgent} onSaveAgent={onSaveAgent} />,
+    },
  ];

  return (
@@ -421,7 +377,7 @@ const AgentForm: React.FC<Props> = ({ editAgent, onSaveAgent, onCreateToolBtnCli
      <Tabs
        tabBarExtraContent={
          <Space>
-            {activeKey !== 'memory' && (
+            {activeKey !== 'memory' && activeKey !== 'permissonSetting' && (
              <Button
                type="primary"
                loading={saveLoading}
--- a/webapp/packages/supersonic-fe/src/pages/Agent/PermissionSection.tsx
+++ b/webapp/packages/supersonic-fe/src/pages/Agent/PermissionSection.tsx
@@ -0,0 +1,92 @@
+import React, { useEffect, useState } from 'react';
+import { Form, Switch } from 'antd';
+import SelectPartner from '@/components/SelectPartner';
+import SelectTMEPerson from '@/components/SelectTMEPerson';
+import FormItemTitle from '@/components/FormHelper/FormItemTitle';
+import styles from './style.less';
+import { AgentType } from './type';
+
+type Props = {
+  currentAgent?: AgentType;
+  onSaveAgent: (agent: AgentType, noTip?: boolean) => Promise<void>;
+};
+
+const FormItem = Form.Item;
+
+const PermissionSection: React.FC<Props> = ({ currentAgent, onSaveAgent }) => {
+  const [isOpenState, setIsOpenState] = useState(true);
+  const [form] = Form.useForm();
+
+  useEffect(() => {
+    form.setFieldsValue({
+      ...currentAgent,
+    });
+    setIsOpenState(currentAgent?.isOpen === 1);
+  }, []);
+
+  const saveAuth = async () => {
+    const values = await form.validateFields();
+    const { admins, adminOrgs, isOpen, viewOrgs = [], viewers = [] } = values;
+    const agent = {
+      ...(currentAgent || {}),
+      admins,
+      adminOrgs,
+      viewOrgs,
+      viewers,
+      isOpen: isOpen ? 1 : 0,
+    };
+    onSaveAgent(agent as any);
+  };
+
+  return (
+    <Form
+      form={form}
+      layout="vertical"
+      onValuesChange={(value) => {
+        const { isOpen } = value;
+        if (isOpen !== undefined) {
+          setIsOpenState(isOpen);
+        }
+        saveAuth();
+      }}
+      className={styles.permissionSection}
+    >
+      <FormItem
+        name="admins"
+        label={
+          <FormItemTitle title={'管理员'} subTitle={'管理员将拥有主题域下所有编辑及访问权限'} />
+        }
+      >
+        <SelectTMEPerson placeholder="请邀请团队成员" />
+      </FormItem>
+      <FormItem name="adminOrgs" label="按组织">
+        <SelectPartner
+          type="selectedDepartment"
+          treeSelectProps={{
+            placeholder: '请选择需要授权的部门',
+          }}
+        />
+      </FormItem>
+      <Form.Item label={<FormItemTitle title={'设为公开'} />} name="isOpen" valuePropName="checked">
+        <Switch />
+      </Form.Item>
+      {!isOpenState && (
+        <>
+          <FormItem name="viewOrgs" label="按组织">
+            <SelectPartner
+              type="selectedDepartment"
+              treeSelectProps={{
+                placeholder: '请选择需要授权的部门',
+              }}
+            />
+          </FormItem>
+          <FormItem name="viewers" label="按个人">
+            <SelectTMEPerson placeholder="请选择需要授权的个人" />
+          </FormItem>
+        </>
+      )}
+    </Form>
+  );
+};
+
+export default PermissionSection;
--- a/webapp/packages/supersonic-fe/src/pages/Agent/style.less
+++ b/webapp/packages/supersonic-fe/src/pages/Agent/style.less
@@ -19,7 +19,7 @@
  margin: 0 auto;
 }

-.agentFormTitle{
+.agentFormTitle {
  font-size: 16px;
  margin-bottom: 20px;
  font-weight: 500;
@@ -381,7 +381,6 @@
  margin-bottom: 20px;
 }

-
 .agentChatModelCell {
  cursor: pointer;
  &:hover {
@@ -391,4 +390,15 @@

 .agentChatModelCellActive {
  background-color: #f0f5ff;
-}
+}
+
+.permissionSection {
+  width: 1000px;
+  height: calc(100vh - 250px);
+  margin: 0 auto;
+  padding: 20px;
+  display: flex;
+  flex-direction: column;
+  row-gap: 40px;
+  overflow-y: auto;
+}
--- a/webapp/packages/supersonic-fe/src/pages/Agent/type.ts
+++ b/webapp/packages/supersonic-fe/src/pages/Agent/type.ts
@@ -95,10 +95,14 @@ export type AgentType = {
  enableSearch?: 0 | 1;
  enableFeedback?: 0 | 1;
  toolConfig?: string;
-  // modelConfig?: LlmConfigType;
  chatAppConfig: ChatAppConfig;
  multiTurnConfig?: MultiTurnConfig;
  visualConfig?: VisualConfig;
+  admins?: string[];
+  adminOrgs?: string[];
+  viewers?: string[];
+  viewOrgs?: string[];
+  isOpen: number;
 };

 export type ModelType = {
--- a/webapp/pnpm-lock.yaml
+++ b/webapp/pnpm-lock.yaml
Author	SHA1	Message	Date
jerryjzhang	b5aa6e046e	(feature)(chat)Support agent-level permission management. Some checks failed supersonic CentOS CI / build (21) (push) Has been cancelled Details supersonic mac CI / build (21) (push) Has been cancelled Details supersonic ubuntu CI / build (21) (push) Has been cancelled Details supersonic windows CI / build (21) (push) Has been cancelled Details	2025-02-24 09:25:12 +08:00
williamhliu	29271f7278	(feature)(supersonic-fe) add permission manage in agent (#2095 )	2025-02-24 08:18:48 +08:00