feat: Permission gating for system menus

ui/src/permission/core/data.ts

@@ -138,12 +138,12 @@ export const PermissionConstants = {
   // ==================== RESOURCE_PERMISSION ====================
   APPLICATION_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.APPLICATION_RESOURCE_PERMISSION, Operate.READ, 0),
   APPLICATION_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.APPLICATION_RESOURCE_PERMISSION, Operate.EDIT, 1),
-  KNOWLEDGE_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.READ, 0),
-  KNOWLEDGE_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.EDIT, 1),
-  TOOL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.READ, 0),
-  TOOL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.EDIT, 1),
-  MODEL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.READ, 0),
-  MODEL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.EDIT, 1),
+  KNOWLEDGE_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.READ, 2),
+  KNOWLEDGE_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.EDIT, 3),
+  TOOL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.READ, 4),
+  TOOL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.EDIT, 5),
+  MODEL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.READ, 6),
+  MODEL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.EDIT, 7),
 
   // ==================== EMAIL_SETTING ====================
   EMAIL_SETTING_READ: p(Group.EMAIL_SETTING, Group.EMAIL_SETTING, Operate.READ, 0),

ui/src/permission/modules/application/index.ts

@@ -3,4 +3,8 @@
 import workspace from './workspace'
 import system from './system'
 
-export default { workspace, system }
+export default { workspace,
+  /**
+   * 系统「应用」权限
+   * */
+  system }

ui/src/permission/modules/application/system.ts

@@ -4,7 +4,8 @@
  */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
 const system = {
   // —— 系统页不提供的操作 ——
@@ -53,7 +54,10 @@ const system = {
   chatLogAddKnowledge: () => canSys(P.RESOURCE_APPLICATION_CHAT_LOG_ADD_KNOWLEDGE),
 
   // —— 组合：跳转/进入应用 ——
-  jumpRead: () => canSys(P.RESOURCE_APPLICATION_OVERVIEW_READ) || canSys(P.RESOURCE_APPLICATION_READ),
+  /**
+   * 系统「应用资源管理」（系统 > 资源管理 > 应用）进入权限
+   * */
+  jumpRead: () => canSys(P.RESOURCE_APPLICATION_READ) && hasEdition(Edition.PE),
 }
 
 export default system

ui/src/permission/modules/index.ts

@@ -12,4 +12,25 @@ import model from './model'
 import system from './system'
 import trigger from './trigger'
 
-export default { application, knowledge, tool, model, trigger, system }
+export default {
+  /**
+   *「应用」在各场景下的按钮权限
+   * */
+  application,
+  /**
+   * 「知识库」各场景按钮权限
+   * */
+  knowledge,
+  /**
+   * 「工具」各场景按钮权限
+   *  */
+  tool,
+  /**
+   * 「模型」各场景按钮权限
+   * */
+  model,
+  trigger,
+  /**
+   * 「系统全局」按钮权限
+   * */
+  system }

ui/src/permission/modules/knowledge/index.ts

@@ -4,4 +4,12 @@ import workspace from './workspace'
 import system from './system'
 import share from './share'
 
-export default { workspace, system, share }
+export default { workspace,
+  /**
+   * 系统「知识库」权限
+   * */
+  system,
+  /**
+   * 系统「共享知识库」权限
+   * */
+  share }

ui/src/permission/modules/knowledge/share.ts

@@ -1,7 +1,8 @@
 /** 系统「共享知识库」按钮权限（系统 > 共享 > 知识库）。全局判定，无 id。 */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
 const share = {
   // —— 共享页不提供 ——
@@ -74,7 +75,10 @@ const share = {
   knowledgeChatUserEdit: () => canSys(P.SHARED_KNOWLEDGE_CHAT_USER_EDIT),
 
   // —— 组合：进入知识库 ——
-  jumpRead: () => canSys(P.SHARED_KNOWLEDGE_DOCUMENT_READ) || canSys(P.SHARED_KNOWLEDGE_WORKFLOW_READ),
+  /**
+   * 系统「共享知识库」（系统 > 共享 > 知识库）进入权限
+   * */
+  jumpRead: () => canSys(P.SHARED_KNOWLEDGE_WORKFLOW_READ) && hasEdition(Edition.PE),
 }
 
 export default share

ui/src/permission/modules/knowledge/system.ts

@@ -1,7 +1,8 @@
 /** 系统「知识库资源管理」按钮权限（系统 > 资源管理 > 知识库）。全局判定，无 id。 */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
 const system = {
   // —— 系统页不提供 ——
@@ -75,7 +76,10 @@ const system = {
   knowledgeChatUserEdit: () => canSys(P.RESOURCE_KNOWLEDGE_CHAT_USER_EDIT),
 
   // —— 组合：进入知识库 ——
-  jumpRead: () => canSys(P.RESOURCE_KNOWLEDGE_DOCUMENT_READ),
+  /**
+   * 系统「知识库资源管理」（系统 > 资源管理 > 知识库）进入权限
+   * */
+  jumpRead: () => canSys(P.RESOURCE_KNOWLEDGE_DOCUMENT_READ) && hasEdition(Edition.PE),
 }
 
 export default system

ui/src/permission/modules/model/index.ts

@@ -4,4 +4,14 @@ import workspace from './workspace'
 import system from './system'
 import share from './share'
 
-export default { workspace, system, share }
+export default {
+  workspace,
+  /**
+   * 系统「模型」权限
+   * */
+  system,
+  /**
+   * 系统「共享模型」权限
+   * */
+  share,
+}

ui/src/permission/modules/model/share.ts

@@ -1,7 +1,8 @@
 /** 系统「共享模型」按钮权限（系统 > 共享 > 模型）。全局判定，无 id。 */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
 const share = {
   // —— 共享页不提供 ——
@@ -16,6 +17,11 @@ const share = {
   folderAuth: () => false,
   folderManage: () => false,
 
+  /**
+   * 系统「共享模型」（系统 > 共享 > 模型）只读权限
+   */
+  read: () => canSys(P.SHARED_MODEL_READ) && hasEdition(Edition.PE),
+
   // —— 模型资源 ——
   create: () => canSys(P.SHARED_MODEL_CREATE),
   modify: () => canSys(P.SHARED_MODEL_EDIT),

ui/src/permission/modules/model/system.ts

@@ -1,7 +1,8 @@
 /** 系统「模型资源管理」按钮权限（系统 > 资源管理 > 模型）。全局判定，无 id。 */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
 const system = {
   // —— 系统页不提供 ——
@@ -16,6 +17,10 @@ const system = {
   folderAuth: () => false,
   folderManage: () => false,
 
+  /**
+   * 系统「模型资源管理」（系统 > 资源管理 > 模型）只读权限
+   * */
+  read: () => canSys(P.RESOURCE_MODEL_READ) && hasEdition(Edition.PE),
   isShare: () => canSys(P.MODEL_READ),
 
   // —— 模型资源 ——

ui/src/permission/modules/system/appearance.ts

@@ -1,6 +1,13 @@
 /** 系统「外观设置」按钮权限。$perm.appearance.* */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
-export default { read: () => canSys(P.APPEARANCE_SETTINGS_READ), edit: () => canSys(P.APPEARANCE_SETTINGS_EDIT) }
+export default {
+  /**
+   * 系统「外观设置」只读权限
+   */
+  read: () => canSys(P.APPEARANCE_SETTINGS_READ) && hasEdition(Edition.PE),
+  edit: () => canSys(P.APPEARANCE_SETTINGS_EDIT)
+ }

ui/src/permission/modules/system/authorization.ts

@@ -4,8 +4,36 @@ import { canSys } from '../../policy'
 import { PermissionConstants as P } from '../../core'
 
 export default {
-  application: { read: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_READ), edit: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_EDIT) },
-  knowledge: { read: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_READ), edit: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_EDIT) },
-  tool: { read: () => canSys(P.TOOL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.TOOL_RESOURCE_PERMISSION_EDIT) },
-  model: { read: () => canSys(P.MODEL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.MODEL_RESOURCE_PERMISSION_EDIT) },
+  /**
+   * 系统「资源授权」智能体权限
+   * */
+  application: {
+    /**
+     * 系统「资源授权」智能体只读权限
+     * */
+    read: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_READ), edit: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_EDIT) },
+  /**
+   * 系统「资源授权」知识库权限
+   * */
+  knowledge: {
+    /**
+     * 系统「资源授权」知识库只读权限
+     * */
+    read: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_READ), edit: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_EDIT) },
+  /**
+   * 系统「资源授权」工具权限
+   * */
+  tool: {
+    /**
+     * 系统「资源授权」工具只读权限
+     * */
+    read: () => canSys(P.TOOL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.TOOL_RESOURCE_PERMISSION_EDIT) },
+  /**
+   * 系统「资源授权」模型权限
+   * */
+  model: {
+    /**
+     * 系统「资源授权」模型只读权限
+     * */
+    read: () => canSys(P.MODEL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.MODEL_RESOURCE_PERMISSION_EDIT) },
 }

ui/src/permission/modules/system/chatAuth.ts

@@ -1,6 +1,12 @@
 /** 系统「对话用户认证」按钮权限。$perm.chatAuth.* */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P,hasEdition} from '../../core'
+import { Edition } from '@/permission/core/common'
 
-export default { edit: () => canSys(P.CHAT_USER_AUTH_EDIT) }
+export default {
+  /**
+   * 系统「对话用户认证」编辑权限
+   */
+  edit: () => canSys(P.CHAT_USER_AUTH_EDIT) && hasEdition(Edition.PE)
+ }

ui/src/permission/modules/system/chatUser.ts

@@ -1,14 +1,17 @@
 /** 系统「对话用户」按钮权限。$perm.chatUser.* */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P, hasPermission, RoleConstants, Compare} from '../../core'
 
 export default {
-  read: () => canSys(P.CHAT_USER_READ),
-  create: () => canSys(P.CHAT_USER_CREATE),
+  /**
+   * 系统「对话用户」只读权限
+   */
+  read: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.CHAT_USER_READ],Compare.OR),
+  create: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.CHAT_USER_CREATE],Compare.OR),
   sync: () => canSys(P.CHAT_USER_SYNC),
-  edit: () => canSys(P.CHAT_USER_EDIT),
-  delete: () => canSys(P.CHAT_USER_DELETE),
-  userGroup: () => canSys(P.CHAT_USER_GROUP),
+  edit: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.CHAT_USER_EDIT],Compare.OR),
+  delete: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.CHAT_USER_DELETE],Compare.OR),
+  userGroup: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.CHAT_USER_GROUP],Compare.OR),
   quotaSetting: () => canSys(P.CHAT_USER_QUOTA_SETTING),
 }

ui/src/permission/modules/system/chatUserGroup.ts

@@ -1,14 +1,17 @@
 /** 系统「对话用户组」按钮权限。$perm.chatUserGroup.* */
 
 import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P, hasPermission, RoleConstants, Compare} from '../../core'
 
 export default {
-  read: () => canSys(P.USER_GROUP_READ),
-  create: () => canSys(P.USER_GROUP_CREATE),
-  edit: () => canSys(P.USER_GROUP_EDIT),
-  delete: () => canSys(P.USER_GROUP_DELETE),
-  addMember: () => canSys(P.USER_GROUP_ADD_MEMBER),
-  removeMember: () => canSys(P.USER_GROUP_REMOVE_MEMBER),
+  /**
+   * 系统「对话用户组」只读权限
+   */
+  read: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_READ],Compare.OR),
+  create: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_CREATE],Compare.OR),
+  edit: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_EDIT],Compare.OR),
+  delete: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_DELETE],Compare.OR),
+  addMember: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_ADD_MEMBER],Compare.OR),
+  removeMember: () => hasPermission([RoleConstants.ADMIN,RoleConstants.WORKSPACE_MANAGE,P.USER_GROUP_REMOVE_MEMBER],Compare.OR),
   authRead: () => canSys(P.CHAT_USER_AUTH_READ),
 }

ui/src/permission/modules/system/email.ts

@@ -3,4 +3,8 @@
 import { canSys } from '../../policy'
 import { PermissionConstants as P } from '../../core'
 
-export default { read: () => canSys(P.EMAIL_SETTING_READ), edit: () => canSys(P.EMAIL_SETTING_EDIT) }
+export default {
+  /**
+   * 系统「邮箱设置」只读权限
+   */
+  read: () => canSys(P.EMAIL_SETTING_READ), edit: () => canSys(P.EMAIL_SETTING_EDIT) }

ui/src/permission/modules/system/homepage.ts

@@ -1,6 +1,11 @@
 /** 系统「首页」按钮权限 → $perm.homepage.* */
 
-import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P, hasPermission, RoleConstants, Compare} from '../../core'
 
-export default { read: () => canSys(P.HOMEPAGE_READ), export: () => canSys(P.HOMEPAGE_EXPORT) }
+export default {
+  /**
+   * 系统「首页」只读权限
+   */
+  read: () => hasPermission([RoleConstants.ADMIN,P.HOMEPAGE_READ],Compare.OR),
+  export: () => hasPermission([RoleConstants.ADMIN,P.HOMEPAGE_EXPORT],Compare.OR)
+}