refactor(auth): 调整权限控制逻辑

- 修改了多个控制器中的 @PreAuthorize 注解，更新了权限检查逻辑
- 在 V1ChatController 中，将单一权限检查改为多个权限的并集检查
- 在 V1WorkflowController 中，增加了与 PPT 和 Spider 相关的权限检查
- 修正了 WordController 中的权限注解，与其他控制器保持一致

src/main/java/com/zsc/edu/dify/modules/dify/controller/PPTController.java

@@ -24,7 +24,7 @@ public class PPTController {
      * @return
      */
     @PostMapping("/run")
-    @PreAuthorize("hasAuthority('dify:workflow:ppt')")
+    @PreAuthorize("hasAuthority('dify:ppt:run')")
     @OperationLogAnnotation(content = "'dify工作流'", operationType = "运行")
     public WorkflowRunResponse runWorkflow(@RequestBody WorkflowRunRequest request) {
         request.setUserId(SecurityUtil.getUserInfo().id.toString());

src/main/java/com/zsc/edu/dify/modules/dify/controller/V1ChatController.java

@@ -22,7 +22,6 @@ import org.springframework.web.bind.annotation.*;
 import reactor.core.publisher.Flux;
 
 import java.util.List;
-import java.util.function.Supplier;
 
 /**
  * @author yanghq
@@ -46,7 +45,7 @@ public class V1ChatController {
      *                    apikey 建议在数据库进行存储，前端调用时传智能体 id，从数据库查询
      */
     @PostMapping("/completions/{appId}")
-    @PreAuthorize("hasAuthority('dify:chat:send')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:send','dify:word:send')")
     @OperationLogAnnotation(content = "'dify对话'", operationType = "发送")
     public ChatMessageSendResponse sendChatMessage(
             @RequestBody ChatMessageSendRequest sendRequest,
@@ -82,7 +81,7 @@ public class V1ChatController {
      * @return 会话列表
      */
     @PostMapping("/conversations/{appId}")
-    @PreAuthorize("hasAuthority('dify:chat:query')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
     public DifyPageResult<MessageConversationsResponse> conversations(
             @RequestBody MessageConversationsRequest request,
             @PathVariable String appId
@@ -99,7 +98,7 @@ public class V1ChatController {
      * @return 消息列表
      */
     @PostMapping("/messages/{appid}")
-    @PreAuthorize("hasAuthority('dify:chat:query')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
     public DifyPageResult<MessagesResponseVO> messages(
             @RequestBody MessagesRequest request,
             @PathVariable String appid
@@ -116,7 +115,7 @@ public class V1ChatController {
      * @param taskId  任务id
      */
     @PatchMapping("/stream/stop")
-    @PreAuthorize("hasAuthority('dify:chat:stop')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:stop','dify:word:stop')")
     public void stopMessagesStream(@RequestParam String taskId, @RequestParam String appId) {
         String apiKey = appEntityService.getApikey(appId);
         String userId = SecurityUtil.getUserInfo().id.toString();
@@ -129,7 +128,7 @@ public class V1ChatController {
      * @param conversationId 会话id
      */
     @DeleteMapping("/conversation")
-    @PreAuthorize("hasAuthority('dify:chat:delete')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:delete','dify:word:delete')")
     @OperationLogAnnotation(content = "'dify对话'", operationType = "删除")
     public void deleteConversation(@RequestParam String conversationId, @RequestParam String appId) {
         String apiKey = appEntityService.getApikey(appId);
@@ -148,7 +147,7 @@ public class V1ChatController {
      * @return
      */
     @GetMapping("/messages/suggested")
-    @PreAuthorize("hasAuthority('dify:chat:query')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
     public List<String> messagesSuggested(String messageId,String appId){
         String apiKey = appEntityService.getApikey(appId);
         String userId = SecurityUtil.getUserInfo().id.toString();
@@ -161,7 +160,7 @@ public class V1ChatController {
      * @return
      */
     @GetMapping("/parameters/{appid}")
-    @PreAuthorize("hasAuthority('dify:chat:query')")
+    @PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
     public AppParametersResponseVO parameters(@PathVariable String appid){
         String apiKey = appEntityService.getApikey(appid);
         return ExceptionUtil.difyException(()->difyChat.parameters(apiKey));

src/main/java/com/zsc/edu/dify/modules/dify/controller/V1WorkflowController.java

@@ -41,7 +41,7 @@ public class V1WorkflowController {
      * @return
      */
     @PostMapping("/run/{appId}")
-    @PreAuthorize("hasAuthority('dify:workflow:run')")
+    @PreAuthorize("hasAnyAuthority('dify:workflow:run','dify:ppt:run','dify:spider2:run')")
     @OperationLogAnnotation(content = "'dify工作流'", operationType = "运行")
     public WorkflowRunResponse runWorkflow(@RequestBody WorkflowRunRequest request, @PathVariable String appId) {
         request.setUserId(SecurityUtil.getUserInfo().id.toString());
@@ -79,7 +79,7 @@ public class V1WorkflowController {
      * @return
      */
     @GetMapping("/info/{appId}")
-    @PreAuthorize("hasAuthority('dify:workflow:info')")
+    @PreAuthorize("hasAnyAuthority('dify:workflow:info','dify:ppt:info','dify:spider2:info')")
     public WorkflowInfoResponse info(String workflowRunId, @PathVariable String appId) {
         String apiKey =appEntityService.getApikey(appId);
         return ExceptionUtil.difyException(() -> difyWorkflow.info(workflowRunId, apiKey));
@@ -92,7 +92,7 @@ public class V1WorkflowController {
      * @return
      */
     @PostMapping("/logs/{appId}")
-    @PreAuthorize("hasAuthority('dify:workflow:log')")
+    @PreAuthorize("hasAnyAuthority('dify:workflow:log','dify:ppt:log','dify:spider2:log')")
     public DifyPageResult<WorkflowLogs> logs(@RequestBody WorkflowLogsRequest request, @PathVariable String appId) {
         String apiKey = appEntityService.getApikey(appId);
         request.setApiKey(apiKey);
@@ -107,7 +107,7 @@ public class V1WorkflowController {
      * @return
      */
     @GetMapping("/list/{appId}")
-    @PreAuthorize("hasAuthority('dify:workflow:query')")
+    @PreAuthorize("hasAnyAuthority('dify:workflow:query','dify:ppt:query','dify:spider2:query')")
     @DataPermission
     public List<WorkflowData> list(@PathVariable String appId){
         return difyWorkflowService.list(new QueryWrapper<WorkflowData>().eq("app_id",appId));
@@ -120,7 +120,7 @@ public class V1WorkflowController {
      * @return
      */
     @GetMapping("/detail/{id}")
-    @PreAuthorize("hasAuthority('dify:workflow:query')")
+    @PreAuthorize("hasAnyAuthority('dify:workflow:query','dify:ppt:query','dify:spider2:query')")
     @DataPermission
     public WorkflowData detail(@PathVariable Long id){
         return difyWorkflowService.detail(id);

src/main/java/com/zsc/edu/dify/modules/dify/controller/WordController.java

@@ -28,7 +28,7 @@ public class WordController {
      *                    apikey 建议在数据库进行存储，前端调用时传智能体 id，从数据库查询
      */
     @PostMapping("/completions")
-    @PreAuthorize("hasAuthority('dify:chat:word')")
+    @PreAuthorize("hasAuthority('dify:word:send')")
     @OperationLogAnnotation(content = "'dify对话'", operationType = "发送")
     public ChatMessageSendResponse sendChatMessage(@RequestBody ChatMessageSendRequest sendRequest){
         sendRequest.setApiKey(appEntityService.getApikey("baca08c1-e92b-4dc9-a445-3584803f54d4"));

src/test/java/com/zsc/edu/dify/modules/system/service/impl/MenuServiceImplTest.java

@@ -96,13 +96,24 @@ class MenuServiceImplTest {
         Menu difyWorkFlowLog = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowLog", null, "difyWorkFlow日志", null, true, false, 1, "dify:workflow:log", "");
         Menu difyWorkFlowRun = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowRun", null, "difyWorkFlow运行", null, true, false, 1, "dify:workflow:run", "");
         Menu difyWorkFlowDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowDelete", null, "difyWorkFlow删除", null, true, false, 1, "dify:workflow:delete", "");
-        Menu difyWorkFlowPPT  = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowPpt", null, "difyWorkFlowPPT", null, true, false, 1, "dify:workflow:ppt", "");
+        Menu difyPPTRun  = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPptRun", null, "difyPptRun", null, true, false, 1, "dify:ppt:run", "");
-        Menu difyChatWord  = new Menu(ai.getId(), Menu.Type.OPERATION, "difyChatWord", null, "difyChatWord", null, true, false, 1, "dify:chat:word", "");
+        Menu difyWordSend  = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordSend", null, "difyWordSend", null, true, false, 1, "dify:word:send", "");
         Menu difySpiderRun = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderRun", null, "difySpiderRun", null, true, false, 1, "dify:spider:run", "");
         Menu difySpiderStop = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderStop", null, "difySpiderStop", null, true, false, 1, "dify:spider:stop", "");
         Menu difySpider2Run = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Run", null, "difySpider2Run", null, true, false, 1, "dify:spider2:run", "");
         Menu difySpiderStatus = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderStatus", null, "difySpiderStatus", null, true, false, 1, "dify:spider:status", "");
         Menu difySpiderLog = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderLog", null, "difySpiderLog", null, true, false, 1, "dify:spider:log", "");
+        Menu difyWordQuery = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordQuery", null, "difyWordQuery", null, true, false, 1, "dify:word:query", "");
+        Menu difyWordDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordDelete", null, "difyWordDelete", null, true, false, 1, "dify:word:delete", "");
+        Menu difyWordStop = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordStop", null, "difyWordStop", null, true, false, 1, "dify:word:stop", "");
+        Menu difyPPTQuery = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTQuery", null, "difyPpTQuery", null, true, false, 1, "dify:ppt:query", "");
+        Menu difyPPTDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTDelete", null, "difyPpTDelete", null, true, false, 1, "dify:ppt:delete", "");
+        Menu difyPPTLog  = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTLog", null, "difyPpTLog", null, true, false, 1, "dify:ppt:log", "");
+        Menu difyPPTInfo = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTInfo", null, "difyPpTInfo", null, true, false, 1, "dify:ppt:info", "");
+        Menu difySpider2Query  = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Query", null, "difySpider2Query", null, true, false, 1, "dify:spider2:query", "");
+        Menu difySpider2Log  = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Log", null, "difySpider2Log", null, true, false, 1, "dify:spider2:log", "");
+        Menu difySpider2Delete  = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Delete", null, "difySpider2Delete", null, true, false, 1, "dify:spider2:delete", "");
+        Menu difySpider2Info  = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Info", null, "difySpider2Info", null, true, false, 1, "dify:spider2:info", "");
         menuService.saveBatch(List.of(roleCreate, roleDelete, roleUpdate, roleQuery,
                 deptSave, deptUpdate, deptQuery, deptDelete,
                 userSave, userUpdate, userQuery, userDelete,
@@ -114,8 +125,9 @@ class MenuServiceImplTest {
                 difyServerQuery, difyServerCreate, difyServerUpdate, difyServerDelete,difyServerInit,
                 difyDataSetQuery, difyDataSetCreate, difyDataSetUpdate, difyDataSetDelete,difyDataSetRetrieve,
                 difyWorkFlowQuery, difyWorkFlowCreate, difyWorkFlowUpdate, difyWorkFlowDelete, difyWorkFlowInfo,difyWorkFlowLog,difyWorkFlowRun,
-                difyWorkFlowPPT, difyChatWord,
+                difyPPTRun, difyWordSend, difySpiderRun, difySpiderStop, difySpider2Run, difySpiderStatus, difySpiderLog,
-                difySpiderRun, difySpiderStop, difySpider2Run, difySpiderStatus, difySpiderLog
+                difyWordQuery, difyWordDelete, difyWordStop, difyPPTQuery, difyPPTDelete, difyPPTLog, difyPPTInfo,
+                difySpider2Query, difySpider2Log, difySpider2Delete, difySpider2Info
         ));
     }