feat: Knowledge permission constants#3759
Conversation
|
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| ) | ||
| RESOURCE_MODEL_READ = Permission( | ||
| group=Group.SYSTEM_RES_MODEL, operate=Operate.READ, role_list=[RoleConstants.ADMIN], | ||
| parent_group=[SystemGroup.RESOURCE_MODEL] |
There was a problem hiding this comment.
There are several issues and improvements that can be made in the provided code:
Issues:
- Duplicate Entries: There are duplicate entries for
OPERATE READunder different groups likeGroup.SYSTEM_KNOWLEDGE,Group.SYSTEM_RES_APPLICATION, etc. - Incorrect Permissions: Some permissions (like
RESOURCE_TOOL_DEBUG) are listed twice without a difference between their names or operation types.
Improvements:
-
Consistent Permissions:
- Remove duplicates and ensure each permission is unique with proper roles and operations.
- For example, if a user needs to read from knowledge documents, they should have access through either
RESOURCE_KNOWLEDGE_DOCUMENT_READorRESOURCE_KNOWLEDGE_DOCUMENT_DOWNLOAD.
-
Detailed Operations:
- Clearly define what each operation does. For instance, clarify what "VECTOR" means in terms of knowledge resources.
-
User-Centric Roles:
- Ensure roles align with user-specific responsibilities rather than blanket administration rights across all systems.
-
Parent Groups Clarification:
- If a particular feature spans multiple resource categories (like system tools and models), specify which category it belongs too.
Here’s an updated version considering these points:
from enum import Enum
# Define the main group structure
class Group(Enum):
SYSTEM_RES_KNOWLEDGE = "SYSTEM_RESOURCE_KNOWLEDGE"
SYSTEM_KNOWLEDGE_HIT_TEST = "SYSTEM_KNOWLEDGE_HIT_TEST"
SYSTEM_RES_KNOWLEDGE_CHAT_USER = "SYSTEM_RESOURCE_KNOWLEDGE_CHAT_USER"
MODEL = "MODEL"
SYSTEM_MODEL = "SYSTEM_MODEL"
# Documentation-related constants
class PermissionConstants(Enum):
RESOURCE_DOC_READ = Permission(
group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
parent_group=[SystemGroup.RESOURCE_KNOWLEDGE]
)
RESOURCE_DOC_DOWNLOAD = Permission(
group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.DOWNLOAD, role_list=[RoleConstants.ADMIN],
parent_group=[SystemGroup.RESOURCE_KNOWLEDGE]
)
# Other related document actions...
SYSTEM_APP_OVERVIEW = Permission(
group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ, role_list=[RoleConstants.USER],
parent_group=[SystemGroup.APPLICATIONS_OVERVIEW]
)
SYSTEM_APP_ACCESS = Permission(
group=Group.SYSTEM_RES_APPLICATION, operate=Operate.WRITE, role_list=[RoleConstants.ADMIN],
parent_group=[SystemGroup.APPLICATIONS_ACCESS]
)
SYSTEM_APP_CHAT_USER = Permission(
group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ_WRITE,
role_list=[RoleConstants.CHAT_USER],
parent_group=[SystemGroup.APPLICATIONS_CHATS]
SYSTEM_APP_CHAT_LOG = Permission(
group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ_ONLY,
role_list=[RoleConstants.UTILITY_USER],
parent_group=[SystemGroup.APPLICATIONS_CHATS]
)
# Tools management
class ToolPermissions(Enum):
TOOL_READ = Permission(
group=Group.SYSTEM_RES_TOOL, operate=Operate.READ, role_list=[RoleConstants.MANAGER],
parent_group=[]
)
TOOLS_DELETE = Permission(
group=Group.SYSTEM_RES_SYSTEM, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN],
parent_group=[SystemGroup.TOOLS]
)
TOOL_DEBUG = Permission(
group=Group.SYSTEM_RES_TOOL, operate=Operate.DEBUG, role_list=[RoleConstants.ADMIN],
parent_group []
)This revised code ensures consistency across permissions, clearly defined user roles, and categorization of features based on functionality.
feat: Knowledge permission constants