Skip to content

fix(datasource): allow advanced assistant to access host datasource APIs #1384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fit2cloud-chenyw merged 1 commit into from
Sep 20, 2026
Merged

fix(datasource): allow advanced assistant to access host datasource APIs #1384

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions backend/apps/system/schemas/permission.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,15 +41,24 @@ async def get_ws_resource(oid, type) -> list:
async def check_ws_permission(oid, type, resource) -> bool:
if not resource or (isinstance(resource, list) and len(resource) == 0):
return True

resource_id_list = await get_ws_resource(oid, type)
if not resource_id_list:
return False
if isinstance(resource, list):
return set(resource).issubset(set(resource_id_list))
return resource in resource_id_list




async def _dynamic_assistant_ds_allowed(assistant, ds_id) -> bool:
"""高级小助手（type 1/3 动态数据源）的 ds 来自宿主 API，本地 core_datasource 无记录：
仅当 ds_id 在本地不存在时才跳过归属校验；本地数据源仍按工作区 oid 校验。"""
if assistant is None or assistant.type not in (1, 3) or isinstance(ds_id, list):
return False
with Session(engine) as session:
return session.get(CoreDatasource, ds_id) is None


def require_permissions(permission: SqlbotPermission):
def decorator(func):
@wraps(func)
Expand All @@ -62,6 +71,7 @@ async def wrapper(*args, **kwargs):
status_code=401,
detail="用户未认证"
)
assistant = getattr(request.state, 'assistant', None)
current_oid = current_user.oid

trans = i18n(request)
Expand Down Expand Up @@ -90,7 +100,9 @@ async def wrapper(*args, **kwargs):
if match := re.match(r"args\[(\d+)\]", keyExpression):
index = int(match.group(1))
value = bound_args.args[index]
if await check_ws_permission(current_oid, resource_type, value):
if await check_ws_permission(current_oid, resource_type, value) or (
resource_type in ('ds', 'datasource')
and await _dynamic_assistant_ds_allowed(assistant, value)):
return await func(*args, **kwargs)
#raise Exception('no permission to execute or resource do not exist!')
raise Exception(trans('i18n_permission.permission_resource_limit'))
Expand All @@ -101,7 +113,9 @@ async def wrapper(*args, **kwargs):
value = bound_args.arguments[parts[0]]
for part in parts[1:]:
value = getattr(value, part)
if await check_ws_permission(current_oid, resource_type, value):
if await check_ws_permission(current_oid, resource_type, value) or (
resource_type in ('ds', 'datasource')
and await _dynamic_assistant_ds_allowed(assistant, value)):
return await func(*args, **kwargs)
raise Exception(trans('i18n_permission.permission_resource_limit'))

Expand Down
Loading