♻️Refactoring authentication&authorization to develop the user management feature

♻️Refactoring authentication&authorization to develop the user management feature

Author: WMC001

.cursor/rules/frontend/page_layer_rules.mdc

@@ -21,6 +21,9 @@ description: Page layer rules for Next.js App Router pages and layouts
 
 - Client components: `const { t } = useTranslation('namespace')`
 - Server components: `getTranslations` from `next-intl`
+
+
+
 - Organize translation keys by feature/namespace
 
 ### Data Fetching

backend/apps/model_managment_app.py

@@ -18,6 +18,8 @@
     BatchCreateModelsRequest,
     ModelRequest,
     ProviderModelRequest,
+    AdminTenantModelRequest,
+    AdminTenantModelResponse,
 )
 
 from fastapi import APIRouter, Header, Query, HTTPException
@@ -39,6 +41,7 @@
     delete_model_for_tenant,
     list_models_for_tenant,
     list_llm_models_for_tenant,
+    list_models_for_admin,
 )
 from utils.auth_utils import get_current_user_id
 
@@ -285,6 +288,41 @@ async def get_llm_model_list(authorization: Optional[str] = Header(None)):
                             detail=str(e))
 
 
+@router.post("/admin/list", response_model=AdminTenantModelResponse)
+async def get_model_list_for_admin(request: AdminTenantModelRequest, authorization: Optional[str] = Header(None)):
+    """Get model list for a specified tenant (admin only).
+
+    This endpoint allows super admin to query models for any tenant.
+
+    Args:
+        request: Contains target tenant_id, optional model_type filter, and pagination params
+        authorization: Bearer token for authentication
+
+    Returns:
+        JSONResponse: Model list for the specified tenant with pagination info
+    """
+    try:
+        user_id, _ = get_current_user_id(authorization)
+        logger.debug(
+            f"Start to list models for admin, user_id: {user_id}, target_tenant_id: {request.tenant_id}, "
+            f"page: {request.page}, page_size: {request.page_size}")
+
+        result = await list_models_for_admin(
+            request.tenant_id,
+            request.model_type,
+            request.page,
+            request.page_size
+        )
+        return JSONResponse(status_code=HTTPStatus.OK, content={
+            "message": "Successfully retrieved model list",
+            "data": jsonable_encoder(result)
+        })
+    except Exception as e:
+        logging.error(f"Failed to list models for admin: {str(e)}")
+        raise HTTPException(status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+                            detail=str(e))
+
+
 @router.post("/healthcheck")
 async def check_model_health(
         display_name: str = Query(..., description="Display name to check"),

backend/consts/model.py

@@ -633,3 +633,44 @@ class InvitationUseResponse(BaseModel):
     code_type: str = Field(..., description="Code type")
     group_ids: Optional[List[int]] = Field(
         None, description="Associated group IDs")
+
+
+# Admin Model Management Data Models
+# ---------------------------------------------------------------------------
+class AdminModelListRequest(BaseModel):
+    """Request model for admin to list models across tenants"""
+    tenant_ids: List[str] = Field(
+        ..., min_items=1, description="List of tenant IDs to query")
+    model_type: Optional[str] = Field(
+        None, description="Filter by model type (e.g., 'llm', 'embedding')")
+    page: int = Field(1, ge=1, description="Page number for pagination")
+    page_size: int = Field(20, ge=1, le=100, description="Items per page")
+
+
+class TenantModelInfo(BaseModel):
+    """Model containing tenant info and their models"""
+    tenant_id: str = Field(..., description="Tenant identifier")
+    tenant_name: str = Field(..., description="Tenant display name")
+    models: List[Dict[str, Any]] = Field(
+        default_factory=list, description="List of models for this tenant")
+
+
+class AdminTenantModelRequest(BaseModel):
+    """Request model for admin to query models for a specific tenant"""
+    tenant_id: str = Field(..., min_length=1, description="Target tenant ID to query models for")
+    model_type: Optional[str] = Field(
+        None, description="Filter by model type (e.g., 'llm', 'embedding')")
+    page: int = Field(1, ge=1, description="Page number for pagination")
+    page_size: int = Field(20, ge=1, le=100, description="Items per page")
+
+
+class AdminTenantModelResponse(BaseModel):
+    """Response model for admin tenant model query"""
+    tenant_id: str = Field(..., description="Tenant identifier")
+    tenant_name: str = Field(..., description="Tenant display name")
+    models: List[Dict[str, Any]] = Field(
+        default_factory=list, description="List of models for this tenant")
+    total: int = Field(0, description="Total number of models")
+    page: int = Field(1, description="Current page number")
+    page_size: int = Field(20, description="Items per page")
+    total_pages: int = Field(0, description="Total number of pages")

backend/services/model_management_service.py

@@ -1,5 +1,5 @@
 import logging
-from typing import List, Dict, Any
+from typing import List, Dict, Any, Optional
 
 from consts.const import LOCALHOST_IP, LOCALHOST_NAME, DOCKER_INTERNAL_HOST
 from consts.model import ModelConnectStatusEnum
@@ -398,5 +398,84 @@ async def list_llm_models_for_tenant(tenant_id: str):
         raise Exception(f"Failed to retrieve model list: {str(e)}")
 
 
+async def list_models_for_admin(
+    tenant_id: str,
+    model_type: Optional[str] = None,
+    page: int = 1,
+    page_size: int = 20
+) -> Dict[str, Any]:
+    """Get models for a specified tenant (admin operation) with pagination.
+
+    Args:
+        tenant_id: Target tenant ID to query models for
+        model_type: Optional model type filter (e.g., 'llm', 'embedding')
+        page: Page number for pagination (1-indexed)
+        page_size: Number of items per page
+
+    Returns:
+        Dict containing tenant_id, tenant_name, paginated models list, and pagination info
+    """
+    try:
+        # Build filters
+        filters = None
+        if model_type:
+            filters = {"model_type": model_type}
+
+        # Get model records for the specified tenant
+        records = get_model_records(filters, tenant_id)
+
+        # Type mapping for backwards compatibility
+        type_map = {
+            "chat": "llm",
+        }
+
+        # Normalize model records
+        normalized_models: List[Dict[str, Any]] = []
+        for record in records:
+            record["model_name"] = add_repo_to_name(
+                model_repo=record["model_repo"],
+                model_name=record["model_name"],
+            )
+            record["connect_status"] = ModelConnectStatusEnum.get_value(
+                record.get("connect_status"))
+
+            # Map model_type if necessary
+            if record.get("model_type") in type_map:
+                record["model_type"] = type_map[record["model_type"]]
+
+            normalized_models.append(record)
+
+        # Calculate pagination
+        total = len(normalized_models)
+        total_pages = (total + page_size - 1) // page_size if page_size > 0 else 0
+        start_index = (page - 1) * page_size
+        end_index = start_index + page_size
+        paginated_models = normalized_models[start_index:end_index]
+
+        # Get tenant name
+        from services.tenant_service import get_tenant_info
+        try:
+            tenant_info = get_tenant_info(tenant_id)
+            tenant_name = tenant_info.get("tenant_name", "")
+        except Exception:
+            tenant_name = ""
+
+        result = {
+            "tenant_id": tenant_id,
+            "tenant_name": tenant_name,
+            "models": paginated_models,
+            "total": total,
+            "page": page,
+            "page_size": page_size,
+            "total_pages": total_pages
+        }
+
+        logging.debug(f"Successfully retrieved admin model list for tenant: {tenant_id}, page: {page}, page_size: {page_size}")
+        return result
+    except Exception as e:
+        logging.error(f"Failed to retrieve admin model list: {str(e)}")
+        raise Exception(f"Failed to retrieve admin model list: {str(e)}")
+
+
 
 

backend/services/tenant_service.py

@@ -23,19 +23,22 @@ def get_tenant_info(tenant_id: str) -> Dict[str, Any]:
     """
     Get tenant information by tenant ID
 
+    If TENANT_NAME config is missing, automatically create one with default name.
+
     Args:
         tenant_id (str): Tenant ID
 
     Returns:
         Dict[str, Any]: Tenant information
-
-    Raises:
-        NotFoundException: When tenant not found
     """
     # Get tenant name
     name_config = get_single_config_info(tenant_id, TENANT_NAME)
     if not name_config:
-        logging.warning(f"The name of tenant {tenant_id} not found.")
+        logger.warning(f"The name of tenant {tenant_id} not found, creating default config.")
+        # Auto-create TENANT_NAME config with default name
+        _ensure_tenant_name_config(tenant_id)
+        # Re-fetch after creation
+        name_config = get_single_config_info(tenant_id, TENANT_NAME)
 
     group_config = get_single_config_info(tenant_id, DEFAULT_GROUP_ID)
 
@@ -48,6 +51,38 @@ def get_tenant_info(tenant_id: str) -> Dict[str, Any]:
     return tenant_info
 
 
+def _ensure_tenant_name_config(tenant_id: str) -> bool:
+    """
+    Ensure TENANT_NAME config exists for the tenant.
+    Creates a default name config if it doesn't exist.
+
+    Args:
+        tenant_id: Tenant ID
+
+    Returns:
+        bool: True if config exists or was created successfully, False otherwise
+    """
+    # Check if already exists (double-check in case of race condition)
+    existing = get_single_config_info(tenant_id, TENANT_NAME)
+    if existing:
+        return True
+
+    # Create default TENANT_NAME config
+    tenant_name_data = {
+        "tenant_id": tenant_id,
+        "config_key": TENANT_NAME,
+        "config_value": "Unnamed Tenant",
+        "created_by": "system_auto_create",
+        "updated_by": "system_auto_create"
+    }
+    success = insert_config(tenant_name_data)
+    if success:
+        logger.info(f"Auto-created TENANT_NAME config for tenant {tenant_id}")
+    else:
+        logger.error(f"Failed to auto-create TENANT_NAME config for tenant {tenant_id}")
+    return success
+
+
 def get_all_tenants() -> List[Dict[str, Any]]:
     """
     Get all tenants
@@ -163,6 +198,8 @@ def update_tenant_info(tenant_id: str, tenant_name: str, updated_by: Optional[st
     """
     Update tenant information
 
+    If TENANT_NAME config doesn't exist, creates it with the provided name.
+
     Args:
         tenant_id (str): Tenant ID
         tenant_name (str): New tenant name
@@ -172,25 +209,35 @@ def update_tenant_info(tenant_id: str, tenant_name: str, updated_by: Optional[st
         Dict[str, Any]: Updated tenant information
 
     Raises:
-        NotFoundException: When tenant not found
-        ValidationError: When tenant name is invalid
+        ValidationError: When tenant name is invalid or update fails
     """
-    # Check if tenant exists and get current name config
-    name_config = get_single_config_info(tenant_id, TENANT_NAME)
-    if not name_config:
-        raise NotFoundException(f"Tenant {tenant_id} not found")
-
     # Validate tenant name
     if not tenant_name or not tenant_name.strip():
         raise ValidationError("Tenant name cannot be empty")
 
-    # Update tenant name
-    success = update_config_by_tenant_config_id(
-        name_config["tenant_config_id"],
-        tenant_name.strip()
-    )
-    if not success:
-        raise ValidationError("Failed to update tenant name")
+    # Check if tenant name config exists
+    name_config = get_single_config_info(tenant_id, TENANT_NAME)
+    if not name_config:
+        # Tenant config doesn't exist, create it with the provided name
+        logger.info(f"TENANT_NAME config not found for {tenant_id}, creating new config.")
+        tenant_name_data = {
+            "tenant_id": tenant_id,
+            "config_key": TENANT_NAME,
+            "config_value": tenant_name.strip(),
+            "created_by": updated_by,
+            "updated_by": updated_by
+        }
+        success = insert_config(tenant_name_data)
+        if not success:
+            raise ValidationError("Failed to create tenant name configuration")
+    else:
+        # Update existing config
+        success = update_config_by_tenant_config_id(
+            name_config["tenant_config_id"],
+            tenant_name.strip()
+        )
+        if not success:
+            raise ValidationError("Failed to update tenant name")
 
     # Return updated tenant information
     updated_tenant = get_tenant_info(tenant_id)

docker/init.sql

@@ -820,6 +820,7 @@ INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_
 (6, 'SU', 'VISIBILITY', 'LEFT_NAV_MENU', '/models'),
 (7, 'SU', 'VISIBILITY', 'LEFT_NAV_MENU', '/memory'),
 (8, 'SU', 'VISIBILITY', 'LEFT_NAV_MENU', '/users'),
+(211, 'SU', 'VISIBILITY', 'LEFT_NAV_MENU', '/tenant-resources'),
 (9, 'SU', 'RESOURCE', 'AGENT', 'READ'),
 (10, 'SU', 'RESOURCE', 'AGENT', 'DELETE'),
 (11, 'SU', 'RESOURCE', 'KB', 'READ'),
@@ -846,6 +847,7 @@ INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_
 (32, 'SU', 'RESOURCE', 'TENANT', 'READ'),
 (33, 'SU', 'RESOURCE', 'TENANT', 'UPDATE'),
 (34, 'SU', 'RESOURCE', 'TENANT', 'DELETE'),
+(213, 'SU', 'RESOURCE', 'TENANT.LIST', 'READ'),
 (35, 'SU', 'RESOURCE', 'TENANT.INFO', 'READ'),
 (36, 'SU', 'RESOURCE', 'TENANT.INFO', 'UPDATE'),
 (37, 'SU', 'RESOURCE', 'TENANT.INVITE', 'CREATE'),
@@ -868,6 +870,7 @@ INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_
 (54, 'ADMIN', 'VISIBILITY', 'LEFT_NAV_MENU', '/models'),
 (55, 'ADMIN', 'VISIBILITY', 'LEFT_NAV_MENU', '/memory'),
 (56, 'ADMIN', 'VISIBILITY', 'LEFT_NAV_MENU', '/users'),
+(212, 'ADMIN', 'VISIBILITY', 'LEFT_NAV_MENU', '/tenant-resources'),
 (57, 'ADMIN', 'RESOURCE', 'AGENT', 'CREATE'),
 (58, 'ADMIN', 'RESOURCE', 'AGENT', 'READ'),
 (59, 'ADMIN', 'RESOURCE', 'AGENT', 'UPDATE'),

docker/sql/v1.8.0_0202_role_permission_update.sql

@@ -0,0 +1,21 @@
+-- =============================================================================
+-- File: v1.8.0_0202_role_permission_update.sql
+-- Description: Add /tenant-resources route permission and tenant list visibility for SU role
+-- Version: 1.8.0
+-- Date: 2026-02-02
+-- =============================================================================
+
+-- Add /tenant-resources LEFT_NAV_MENU permission for SU (Super Admin) role
+INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_category, permission_type, permission_subtype)
+VALUES (211, 'SU', 'VISIBILITY', 'LEFT_NAV_MENU', '/tenant-resources')
+ON CONFLICT (role_permission_id) DO NOTHING;
+
+-- Add /tenant-resources LEFT_NAV_MENU permission for ADMIN (Tenant Admin) role
+INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_category, permission_type, permission_subtype)
+VALUES (212, 'ADMIN', 'VISIBILITY', 'LEFT_NAV_MENU', '/tenant-resources')
+ON CONFLICT (role_permission_id) DO NOTHING;
+
+-- Add tenant list visibility permission for SU (Super Admin) role - controls tenant list display in resource page
+INSERT INTO nexent.role_permission_t (role_permission_id, user_role, permission_category, permission_type, permission_subtype)
+VALUES (213, 'SU', 'RESOURCE', 'TENANT.LIST', 'READ')
+ON CONFLICT (role_permission_id) DO NOTHING;

frontend/app/[locale]/agents/components/agentInfo/AgentGenerateDetail.tsx

@@ -32,7 +32,8 @@ import {
   GENERATE_PROMPT_STREAM_TYPES,
 } from "@/const/agentConfig";
 import { generatePromptStream } from "@/services/promptService";
-import { useAuth } from "@/hooks/useAuth";
+import { useAuthorizationContext } from "@/components/providers/AuthorizationProvider";
+import { useDeployment } from "@/components/providers/deploymentProvider";
 import { useModelList } from "@/hooks/model/useModelList";
 import ExpandEditModal from "./ExpandEditModal";
 
@@ -59,7 +60,8 @@ export default function AgentGenerateDetail({
 }: AgentGenerateDetailProps) {
   const { t } = useTranslation("common");
   const { message } = App.useApp();
-  const { user, isSpeedMode } = useAuth();
+  const { user } = useAuthorizationContext();
+  const { isSpeedMode } = useDeployment();
   const [form] = Form.useForm();
 
   // Model data from React Query