Skip to content

feat: Knowledge permission constants#3759

Merged
zhanweizhang7 merged 1 commit intov2from
pr@v2@feat_knowledge_permission_constants
Jul 29, 2025
Merged

feat: Knowledge permission constants#3759
zhanweizhang7 merged 1 commit intov2from
pr@v2@feat_knowledge_permission_constants

Conversation

@shaohuzhang1
Copy link
Copy Markdown
Contributor

feat: Knowledge permission constants

@f2c-ci-robot
Copy link
Copy Markdown

f2c-ci-robot bot commented Jul 29, 2025

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@f2c-ci-robot
Copy link
Copy Markdown

f2c-ci-robot bot commented Jul 29, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@zhanweizhang7 zhanweizhang7 merged commit 9cc051d into v2 Jul 29, 2025
3 of 5 checks passed
)
RESOURCE_MODEL_READ = Permission(
group=Group.SYSTEM_RES_MODEL, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
parent_group=[SystemGroup.RESOURCE_MODEL]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are several issues and improvements that can be made in the provided code:

Issues:

  1. Duplicate Entries: There are duplicate entries for OPERATE READ under different groups like Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_RES_APPLICATION, etc.
  2. Incorrect Permissions: Some permissions (like RESOURCE_TOOL_DEBUG) are listed twice without a difference between their names or operation types.

Improvements:

  1. Consistent Permissions:

    • Remove duplicates and ensure each permission is unique with proper roles and operations.
    • For example, if a user needs to read from knowledge documents, they should have access through either RESOURCE_KNOWLEDGE_DOCUMENT_READ or RESOURCE_KNOWLEDGE_DOCUMENT_DOWNLOAD.
  2. Detailed Operations:

    • Clearly define what each operation does. For instance, clarify what "VECTOR" means in terms of knowledge resources.
  3. User-Centric Roles:

    • Ensure roles align with user-specific responsibilities rather than blanket administration rights across all systems.
  4. Parent Groups Clarification:

    • If a particular feature spans multiple resource categories (like system tools and models), specify which category it belongs too.

Here’s an updated version considering these points:

from enum import Enum

# Define the main group structure
class Group(Enum):
    SYSTEM_RES_KNOWLEDGE = "SYSTEM_RESOURCE_KNOWLEDGE"
    
    SYSTEM_KNOWLEDGE_HIT_TEST = "SYSTEM_KNOWLEDGE_HIT_TEST"
    SYSTEM_RES_KNOWLEDGE_CHAT_USER = "SYSTEM_RESOURCE_KNOWLEDGE_CHAT_USER"
    

    MODEL = "MODEL"
    SYSTEM_MODEL = "SYSTEM_MODEL"


# Documentation-related constants
class PermissionConstants(Enum):
    RESOURCE_DOC_READ = Permission(
        group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.READ, role_list=[RoleConstants.ADMIN],
        parent_group=[SystemGroup.RESOURCE_KNOWLEDGE]
    )

    RESOURCE_DOC_DOWNLOAD = Permission(
        group=Group.SYSTEM_RES_KNOWLEDGE_DOCUMENT, operate=Operate.DOWNLOAD, role_list=[RoleConstants.ADMIN],
        parent_group=[SystemGroup.RESOURCE_KNOWLEDGE]
    )

    # Other related document actions...

    SYSTEM_APP_OVERVIEW = Permission(
        group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ, role_list=[RoleConstants.USER],
        parent_group=[SystemGroup.APPLICATIONS_OVERVIEW]
    )

    SYSTEM_APP_ACCESS = Permission(
        group=Group.SYSTEM_RES_APPLICATION, operate=Operate.WRITE, role_list=[RoleConstants.ADMIN],
        parent_group=[SystemGroup.APPLICATIONS_ACCESS]
    )

    SYSTEM_APP_CHAT_USER = Permission(
        group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ_WRITE,
        role_list=[RoleConstants.CHAT_USER],
        parent_group=[SystemGroup.APPLICATIONS_CHATS]

    SYSTEM_APP_CHAT_LOG = Permission(
        group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ_ONLY,
        role_list=[RoleConstants.UTILITY_USER],
        parent_group=[SystemGroup.APPLICATIONS_CHATS]
    )


# Tools management
class ToolPermissions(Enum):
    TOOL_READ = Permission(
        group=Group.SYSTEM_RES_TOOL, operate=Operate.READ, role_list=[RoleConstants.MANAGER],
        parent_group=[]
    )
    TOOLS_DELETE = Permission(
        group=Group.SYSTEM_RES_SYSTEM, operate=Operate.DELETE, role_list=[RoleConstants.ADMIN],
        parent_group=[SystemGroup.TOOLS]
    )    
    TOOL_DEBUG = Permission(
        group=Group.SYSTEM_RES_TOOL, operate=Operate.DEBUG, role_list=[RoleConstants.ADMIN],
        parent_group []
    )

This revised code ensures consistency across permissions, clearly defined user roles, and categorization of features based on functionality.

@zhanweizhang7 zhanweizhang7 deleted the pr@v2@feat_knowledge_permission_constants branch July 29, 2025 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants