vertoryao/dify-proxy-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): 调整权限控制逻辑

Browse Source 
- 修改了多个控制器中的 @PreAuthorize 注解，更新了权限检查逻辑
- 在 V1ChatController 中，将单一权限检查改为多个权限的并集检查
- 在 V1WorkflowController 中，增加了与 PPT 和 Spider 相关的权限检查
- 修正了 WordController 中的权限注解，与其他控制器保持一致
This commit is contained in:
zhuangtianxiang 2025-05-22 16:50:25 +08:00
parent 0632d2b242
commit 241aeeeffb
5 changed files with 30 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/zsc/edu/dify/modules/dify/controller/PPTController.java
View File

@ -24,7 +24,7 @@ public class PPTController {
* @return
*/
@PostMapping("/run")
@PreAuthorize("hasAuthority('dify:workflow:ppt')")
@PreAuthorize("hasAuthority('dify:ppt:run')")
@OperationLogAnnotation(content = "'dify工作流'", operationType = "运行")
public WorkflowRunResponse runWorkflow(@RequestBody WorkflowRunRequest request) {
request.setUserId(SecurityUtil.getUserInfo().id.toString());

15
src/main/java/com/zsc/edu/dify/modules/dify/controller/V1ChatController.java
View File

@ -22,7 +22,6 @@ import org.springframework.web.bind.annotation.*;
import reactor.core.publisher.Flux;
import java.util.List;
import java.util.function.Supplier;
/**
* @author yanghq
@ -46,7 +45,7 @@ public class V1ChatController {
* apikey 建议在数据库进行存储，前端调用时传智能体 id，从数据库查询
*/
@PostMapping("/completions/{appId}")
@PreAuthorize("hasAuthority('dify:chat:send')")
@PreAuthorize("hasAnyAuthority('dify:chat:send','dify:word:send')")
@OperationLogAnnotation(content = "'dify对话'", operationType = "发送")
public ChatMessageSendResponse sendChatMessage(
@RequestBody ChatMessageSendRequest sendRequest,
@ -82,7 +81,7 @@ public class V1ChatController {
* @return 会话列表
*/
@PostMapping("/conversations/{appId}")
@PreAuthorize("hasAuthority('dify:chat:query')")
@PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
public DifyPageResult<MessageConversationsResponse> conversations(
@RequestBody MessageConversationsRequest request,
@PathVariable String appId
@ -99,7 +98,7 @@ public class V1ChatController {
* @return 消息列表
*/
@PostMapping("/messages/{appid}")
@PreAuthorize("hasAuthority('dify:chat:query')")
@PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
public DifyPageResult<MessagesResponseVO> messages(
@RequestBody MessagesRequest request,
@PathVariable String appid
@ -116,7 +115,7 @@ public class V1ChatController {
* @param taskId 任务id
*/
@PatchMapping("/stream/stop")
@PreAuthorize("hasAuthority('dify:chat:stop')")
@PreAuthorize("hasAnyAuthority('dify:chat:stop','dify:word:stop')")
public void stopMessagesStream(@RequestParam String taskId, @RequestParam String appId) {
String apiKey = appEntityService.getApikey(appId);
String userId = SecurityUtil.getUserInfo().id.toString();
@ -129,7 +128,7 @@ public class V1ChatController {
* @param conversationId 会话id
*/
@DeleteMapping("/conversation")
@PreAuthorize("hasAuthority('dify:chat:delete')")
@PreAuthorize("hasAnyAuthority('dify:chat:delete','dify:word:delete')")
@OperationLogAnnotation(content = "'dify对话'", operationType = "删除")
public void deleteConversation(@RequestParam String conversationId, @RequestParam String appId) {
String apiKey = appEntityService.getApikey(appId);
@ -148,7 +147,7 @@ public class V1ChatController {
* @return
*/
@GetMapping("/messages/suggested")
@PreAuthorize("hasAuthority('dify:chat:query')")
@PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
public List<String> messagesSuggested(String messageId,String appId){
String apiKey = appEntityService.getApikey(appId);
String userId = SecurityUtil.getUserInfo().id.toString();
@ -161,7 +160,7 @@ public class V1ChatController {
* @return
*/
@GetMapping("/parameters/{appid}")
@PreAuthorize("hasAuthority('dify:chat:query')")
@PreAuthorize("hasAnyAuthority('dify:chat:query','dify:word:query')")
public AppParametersResponseVO parameters(@PathVariable String appid){
String apiKey = appEntityService.getApikey(appid);
return ExceptionUtil.difyException(()->difyChat.parameters(apiKey));

10
src/main/java/com/zsc/edu/dify/modules/dify/controller/V1WorkflowController.java
View File

@ -41,7 +41,7 @@ public class V1WorkflowController {
* @return
*/
@PostMapping("/run/{appId}")
@PreAuthorize("hasAuthority('dify:workflow:run')")
@PreAuthorize("hasAnyAuthority('dify:workflow:run','dify:ppt:run','dify:spider2:run')")
@OperationLogAnnotation(content = "'dify工作流'", operationType = "运行")
public WorkflowRunResponse runWorkflow(@RequestBody WorkflowRunRequest request, @PathVariable String appId) {
request.setUserId(SecurityUtil.getUserInfo().id.toString());
@ -79,7 +79,7 @@ public class V1WorkflowController {
* @return
*/
@GetMapping("/info/{appId}")
@PreAuthorize("hasAuthority('dify:workflow:info')")
@PreAuthorize("hasAnyAuthority('dify:workflow:info','dify:ppt:info','dify:spider2:info')")
public WorkflowInfoResponse info(String workflowRunId, @PathVariable String appId) {
String apiKey =appEntityService.getApikey(appId);
return ExceptionUtil.difyException(() -> difyWorkflow.info(workflowRunId, apiKey));
@ -92,7 +92,7 @@ public class V1WorkflowController {
* @return
*/
@PostMapping("/logs/{appId}")
@PreAuthorize("hasAuthority('dify:workflow:log')")
@PreAuthorize("hasAnyAuthority('dify:workflow:log','dify:ppt:log','dify:spider2:log')")
public DifyPageResult<WorkflowLogs> logs(@RequestBody WorkflowLogsRequest request, @PathVariable String appId) {
String apiKey = appEntityService.getApikey(appId);
request.setApiKey(apiKey);
@ -107,7 +107,7 @@ public class V1WorkflowController {
* @return
*/
@GetMapping("/list/{appId}")
@PreAuthorize("hasAuthority('dify:workflow:query')")
@PreAuthorize("hasAnyAuthority('dify:workflow:query','dify:ppt:query','dify:spider2:query')")
@DataPermission
public List<WorkflowData> list(@PathVariable String appId){
return difyWorkflowService.list(new QueryWrapper<WorkflowData>().eq("app_id",appId));
@ -120,7 +120,7 @@ public class V1WorkflowController {
* @return
*/
@GetMapping("/detail/{id}")
@PreAuthorize("hasAuthority('dify:workflow:query')")
@PreAuthorize("hasAnyAuthority('dify:workflow:query','dify:ppt:query','dify:spider2:query')")
@DataPermission
public WorkflowData detail(@PathVariable Long id){
return difyWorkflowService.detail(id);

2
src/main/java/com/zsc/edu/dify/modules/dify/controller/WordController.java
View File

@ -28,7 +28,7 @@ public class WordController {
* apikey 建议在数据库进行存储，前端调用时传智能体 id，从数据库查询
*/
@PostMapping("/completions")
@PreAuthorize("hasAuthority('dify:chat:word')")
@PreAuthorize("hasAuthority('dify:word:send')")
@OperationLogAnnotation(content = "'dify对话'", operationType = "发送")
public ChatMessageSendResponse sendChatMessage(@RequestBody ChatMessageSendRequest sendRequest){
sendRequest.setApiKey(appEntityService.getApikey("baca08c1-e92b-4dc9-a445-3584803f54d4"));

20
src/test/java/com/zsc/edu/dify/modules/system/service/impl/MenuServiceImplTest.java
View File

@ -96,13 +96,24 @@ class MenuServiceImplTest {
Menu difyWorkFlowLog = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowLog", null, "difyWorkFlow日志", null, true, false, 1, "dify:workflow:log", "");
Menu difyWorkFlowRun = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowRun", null, "difyWorkFlow运行", null, true, false, 1, "dify:workflow:run", "");
Menu difyWorkFlowDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowDelete", null, "difyWorkFlow删除", null, true, false, 1, "dify:workflow:delete", "");
Menu difyWorkFlowPPT = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWorkFlowPpt", null, "difyWorkFlowPPT", null, true, false, 1, "dify:workflow:ppt", "");
Menu difyChatWord = new Menu(ai.getId(), Menu.Type.OPERATION, "difyChatWord", null, "difyChatWord", null, true, false, 1, "dify:chat:word", "");
Menu difyPPTRun = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPptRun", null, "difyPptRun", null, true, false, 1, "dify:ppt:run", "");
Menu difyWordSend = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordSend", null, "difyWordSend", null, true, false, 1, "dify:word:send", "");
Menu difySpiderRun = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderRun", null, "difySpiderRun", null, true, false, 1, "dify:spider:run", "");
Menu difySpiderStop = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderStop", null, "difySpiderStop", null, true, false, 1, "dify:spider:stop", "");
Menu difySpider2Run = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Run", null, "difySpider2Run", null, true, false, 1, "dify:spider2:run", "");
Menu difySpiderStatus = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderStatus", null, "difySpiderStatus", null, true, false, 1, "dify:spider:status", "");
Menu difySpiderLog = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpiderLog", null, "difySpiderLog", null, true, false, 1, "dify:spider:log", "");
Menu difyWordQuery = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordQuery", null, "difyWordQuery", null, true, false, 1, "dify:word:query", "");
Menu difyWordDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordDelete", null, "difyWordDelete", null, true, false, 1, "dify:word:delete", "");
Menu difyWordStop = new Menu(ai.getId(), Menu.Type.OPERATION, "difyWordStop", null, "difyWordStop", null, true, false, 1, "dify:word:stop", "");
Menu difyPPTQuery = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTQuery", null, "difyPpTQuery", null, true, false, 1, "dify:ppt:query", "");
Menu difyPPTDelete = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTDelete", null, "difyPpTDelete", null, true, false, 1, "dify:ppt:delete", "");
Menu difyPPTLog = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTLog", null, "difyPpTLog", null, true, false, 1, "dify:ppt:log", "");
Menu difyPPTInfo = new Menu(ai.getId(), Menu.Type.OPERATION, "difyPpTInfo", null, "difyPpTInfo", null, true, false, 1, "dify:ppt:info", "");
Menu difySpider2Query = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Query", null, "difySpider2Query", null, true, false, 1, "dify:spider2:query", "");
Menu difySpider2Log = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Log", null, "difySpider2Log", null, true, false, 1, "dify:spider2:log", "");
Menu difySpider2Delete = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Delete", null, "difySpider2Delete", null, true, false, 1, "dify:spider2:delete", "");
Menu difySpider2Info = new Menu(ai.getId(), Menu.Type.OPERATION, "difySpider2Info", null, "difySpider2Info", null, true, false, 1, "dify:spider2:info", "");
menuService.saveBatch(List.of(roleCreate, roleDelete, roleUpdate, roleQuery,
deptSave, deptUpdate, deptQuery, deptDelete,
userSave, userUpdate, userQuery, userDelete,
@ -114,8 +125,9 @@ class MenuServiceImplTest {
difyServerQuery, difyServerCreate, difyServerUpdate, difyServerDelete,difyServerInit,
difyDataSetQuery, difyDataSetCreate, difyDataSetUpdate, difyDataSetDelete,difyDataSetRetrieve,
difyWorkFlowQuery, difyWorkFlowCreate, difyWorkFlowUpdate, difyWorkFlowDelete, difyWorkFlowInfo,difyWorkFlowLog,difyWorkFlowRun,
difyWorkFlowPPT, difyChatWord,
difySpiderRun, difySpiderStop, difySpider2Run, difySpiderStatus, difySpiderLog
difyPPTRun, difyWordSend, difySpiderRun, difySpiderStop, difySpider2Run, difySpiderStatus, difySpiderLog,
difyWordQuery, difyWordDelete, difyWordStop, difyPPTQuery, difyPPTDelete, difyPPTLog, difyPPTInfo,
difySpider2Query, difySpider2Log, difySpider2Delete, difySpider2Info
));
}