From fc2576e0883cffcc5f313afb9fd68b5a5aba39f4 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Thu, 13 Aug 2026 16:01:20 +0800 Subject: [PATCH] feat: Front end support system permissions --- ui/src/api/admin/auth/types.ts | 3 +- ui/src/main.ts | 2 + ui/src/permission/core/common.ts | 442 ++++++++++++++++++ ui/src/permission/core/data.ts | 416 +++++++++++++++++ ui/src/permission/core/index.ts | 110 +++++ ui/src/permission/index.ts | 12 + ui/src/permission/install.ts | 16 + .../permission/modules/application/index.ts | 6 + .../permission/modules/application/system.ts | 60 +++ .../modules/application/workspace.ts | 56 +++ ui/src/permission/modules/index.ts | 20 + ui/src/permission/modules/knowledge/index.ts | 7 + ui/src/permission/modules/knowledge/share.ts | 81 ++++ ui/src/permission/modules/knowledge/system.ts | 82 ++++ .../permission/modules/knowledge/workspace.ts | 85 ++++ ui/src/permission/modules/model/index.ts | 7 + ui/src/permission/modules/model/share.ts | 28 ++ ui/src/permission/modules/model/system.ts | 29 ++ ui/src/permission/modules/model/workspace.ts | 30 ++ .../permission/modules/system/appearance.ts | 9 + .../modules/system/authorization.ts | 23 + ui/src/permission/modules/system/chatAuth.ts | 8 + ui/src/permission/modules/system/chatUser.ts | 14 + .../permission/modules/system/chatUserAuth.ts | 8 + .../modules/system/chatUserGroup.ts | 14 + ui/src/permission/modules/system/email.ts | 9 + ui/src/permission/modules/system/homepage.ts | 9 + ui/src/permission/modules/system/index.ts | 34 ++ ui/src/permission/modules/system/loginAuth.ts | 9 + .../permission/modules/system/operationLog.ts | 10 + ui/src/permission/modules/system/other.ts | 12 + ui/src/permission/modules/system/portal.ts | 9 + .../modules/system/resourcePermission.ts | 15 + ui/src/permission/modules/system/role.ts | 13 + ui/src/permission/modules/system/user.ts | 13 + ui/src/permission/modules/system/userGroup.ts | 13 + ui/src/permission/modules/system/workspace.ts | 13 + ui/src/permission/modules/tool/index.ts | 7 + ui/src/permission/modules/tool/share.ts | 41 ++ ui/src/permission/modules/tool/system.ts | 43 ++ ui/src/permission/modules/tool/workspace.ts | 44 ++ ui/src/permission/policy.ts | 30 ++ ui/src/stores/user.ts | 13 + ui/src/utils/workspace-context.ts | 15 + 44 files changed, 1919 insertions(+), 1 deletion(-) create mode 100644 ui/src/permission/core/common.ts create mode 100644 ui/src/permission/core/data.ts create mode 100644 ui/src/permission/core/index.ts create mode 100644 ui/src/permission/index.ts create mode 100644 ui/src/permission/install.ts create mode 100644 ui/src/permission/modules/application/index.ts create mode 100644 ui/src/permission/modules/application/system.ts create mode 100644 ui/src/permission/modules/application/workspace.ts create mode 100644 ui/src/permission/modules/index.ts create mode 100644 ui/src/permission/modules/knowledge/index.ts create mode 100644 ui/src/permission/modules/knowledge/share.ts create mode 100644 ui/src/permission/modules/knowledge/system.ts create mode 100644 ui/src/permission/modules/knowledge/workspace.ts create mode 100644 ui/src/permission/modules/model/index.ts create mode 100644 ui/src/permission/modules/model/share.ts create mode 100644 ui/src/permission/modules/model/system.ts create mode 100644 ui/src/permission/modules/model/workspace.ts create mode 100644 ui/src/permission/modules/system/appearance.ts create mode 100644 ui/src/permission/modules/system/authorization.ts create mode 100644 ui/src/permission/modules/system/chatAuth.ts create mode 100644 ui/src/permission/modules/system/chatUser.ts create mode 100644 ui/src/permission/modules/system/chatUserAuth.ts create mode 100644 ui/src/permission/modules/system/chatUserGroup.ts create mode 100644 ui/src/permission/modules/system/email.ts create mode 100644 ui/src/permission/modules/system/homepage.ts create mode 100644 ui/src/permission/modules/system/index.ts create mode 100644 ui/src/permission/modules/system/loginAuth.ts create mode 100644 ui/src/permission/modules/system/operationLog.ts create mode 100644 ui/src/permission/modules/system/other.ts create mode 100644 ui/src/permission/modules/system/portal.ts create mode 100644 ui/src/permission/modules/system/resourcePermission.ts create mode 100644 ui/src/permission/modules/system/role.ts create mode 100644 ui/src/permission/modules/system/user.ts create mode 100644 ui/src/permission/modules/system/userGroup.ts create mode 100644 ui/src/permission/modules/system/workspace.ts create mode 100644 ui/src/permission/modules/tool/index.ts create mode 100644 ui/src/permission/modules/tool/share.ts create mode 100644 ui/src/permission/modules/tool/system.ts create mode 100644 ui/src/permission/modules/tool/workspace.ts create mode 100644 ui/src/permission/policy.ts create mode 100644 ui/src/utils/workspace-context.ts diff --git a/ui/src/api/admin/auth/types.ts b/ui/src/api/admin/auth/types.ts index 285ba2b2c53..95b7c839ad1 100644 --- a/ui/src/api/admin/auth/types.ts +++ b/ui/src/api/admin/auth/types.ts @@ -8,7 +8,8 @@ export interface CurrentUserInfo { is_edit_password?: boolean language?: string nick_name: string - permissions: string[] + /** 权限位图：key 为「组(+工作空间+资源)」，value 为该组内操作授权位的按位或。 */ + permissions: Record role: string[] role_name?: string[] source?: string diff --git a/ui/src/main.ts b/ui/src/main.ts index eea60095bb8..a6ea4bdb41a 100644 --- a/ui/src/main.ts +++ b/ui/src/main.ts @@ -5,6 +5,7 @@ import zhCn from 'element-plus/es/locale/lang/zh-cn' import App from './App.vue' import router from '@/router/admin' import { pinia } from '@/stores' +import permission from '@/permission/install' import '@/styles/tailwind.css' import '@/styles/index.scss' @@ -12,6 +13,7 @@ const app = createApp(App) app.use(pinia) app.use(router) +app.use(permission) app.use(ElementPlus, { locale: zhCn, }) diff --git a/ui/src/permission/core/common.ts b/ui/src/permission/core/common.ts new file mode 100644 index 00000000000..313359fd7b6 --- /dev/null +++ b/ui/src/permission/core/common.ts @@ -0,0 +1,442 @@ +/** + * 前端权限模型 —— 后端 `apps/common/auth` 的 TypeScript 镜像。 + * + * 对应后端： + * - Group / Operate / Role → common/auth/constants/* + * - Permission → common/auth/struct/permission.py + * - AggregatePermission → common/auth/struct/aggregate_permission.py + * + * 关键约定（必须与后端保持一致，否则前端判定与 `/user/profile` 返回的 + * `permissions` 位图对不上）： + * - 每个「组(group)」用一个整数位图存放该组内所有操作(operate)的授权位， + * 某个操作是否被授权 = `bitmap & (1 << bitIndex)`。 + * - 非资源权限的 key = Permission.toString()（如 `KNOWLEDGE_DOCUMENT_READ`）。 + * - 资源级权限的 key = `${group}:w:${workspaceId}:r:${resourceId}`。 + */ + +/** 权限组：一个组通常对应前端一个菜单。枚举值需与后端 `Group` 的 value 一致。 */ +export enum Group { + USER = 'USER_MANAGEMENT', + APPLICATION = 'APPLICATION', + KNOWLEDGE = 'KNOWLEDGE', + MODEL = 'MODEL', + TOOL = 'TOOL', + TRIGGER = 'TRIGGER', + FOLDER = 'FOLDER', + DOCUMENT = 'DOCUMENT', + WORKFLOW = 'WORKFLOW', + TAG = 'TAG', + PROBLEM = 'PROBLEM', + TERMBASE = 'TERMBASE', + HIT_TEST = 'HIT_TEST', + OVERVIEW = 'OVERVIEW', + ACCESS = 'ACCESS', + CHAT_LOG = 'CHAT_LOG', + CHAT_USER = 'CHAT_USER', + KNOWLEDGE_CHAT_USER = 'KNOWLEDGE_CHAT_USER', + ROLE = 'ROLE', + WORKSPACE = 'WORKSPACE', + USER_GROUP = 'USER_GROUP', + EMAIL_SETTING = 'EMAIL_SETTING', + LOGIN_AUTH = 'LOGIN_AUTH', + APPEARANCE_SETTINGS = 'APPEARANCE_SETTINGS', + DISPLAY_SETTINGS = 'DISPLAY_SETTINGS', + CHAT_USER_GROUP = 'CHAT_USER_GROUP', + CHAT_USER_AUTH = 'CHAT_USER_AUTH', + PORTAL = 'PORTAL', + OTHER = 'OTHER', + HOMEPAGE = 'HOMEPAGE', + OPERATION_LOG = 'OPERATION_LOG', + RESOURCE_PERMISSION = 'RESOURCE_PERMISSION', + APPLICATION_RESOURCE_PERMISSION = 'APPLICATION_RESOURCE_PERMISSION', + KNOWLEDGE_RESOURCE_PERMISSION = 'KNOWLEDGE_RESOURCE_PERMISSION', + TOOL_RESOURCE_PERMISSION = 'TOOL_RESOURCE_PERMISSION', + MODEL_RESOURCE_PERMISSION = 'MODEL_RESOURCE_PERMISSION', + WORKSPACE_ROLE = 'WORKSPACE_ROLE', + WORKSPACE_WORKSPACE = 'WORKSPACE_WORKSPACE', + WORKSPACE_USER_GROUP = 'WORKSPACE_USER_GROUP', + WORKSPACE_RESOURCE_PERMISSION = 'WORKSPACE_RESOURCE_PERMISSION', + WORKSPACE_CHAT_USER = 'WORKSPACE_CHAT_USER', + WORKSPACE_CHAT_USER_GROUP = 'WORKSPACE_CHAT_USER_GROUP', + USER_HOMEPAGE = 'USER_HOMEPAGE', + USER_APPLICATION = 'USER_APPLICATION', + USER_KNOWLEDGE = 'USER_KNOWLEDGE', + USER_MODEL = 'USER_MODEL', + USER_TOOL = 'USER_TOOL', + USER_OTHER = 'USER_OTHER', + SYSTEM_KNOWLEDGE = 'SYSTEM_KNOWLEDGE', + SYSTEM_MODEL = 'SYSTEM_MODEL', + SYSTEM_TOOL = 'SYSTEM_TOOL', + SYSTEM_RES_APPLICATION = 'SYSTEM_RESOURCE_APPLICATION', + SYSTEM_RES_KNOWLEDGE = 'SYSTEM_RESOURCE_KNOWLEDGE', + SYSTEM_RES_TOOL = 'SYSTEM_RESOURCE_TOOL', + SYSTEM_RES_MODEL = 'SYSTEM_RESOURCE_MODEL', + SYSTEM_DOCUMENT = 'SYSTEM_DOCUMENT', + SYSTEM_WORKFLOW = 'SYSTEM_WORKFLOW', + SYSTEM_TAG = 'SYSTEM_TAG', + SYSTEM_PROBLEM = 'SYSTEM_PROBLEM', + SYSTEM_TERMBASE = 'SYSTEM_TERMBASE', + SYSTEM_HIT_TEST = 'SYSTEM_HIT_TEST', + SYSTEM_CHAT_USER = 'SYSTEM_CHAT_USER', + SYSTEM_OVERVIEW = 'SYSTEM_OVERVIEW', + SYSTEM_ACCESS = 'SYSTEM_ACCESS', + SYSTEM_CHAT_LOG = 'SYSTEM_CHAT_LOG', + CHAT = 'CHAT', +} + +/** + * 操作权限。枚举值需与后端 `Operate` 的 value 完全一致 —— + * 注意后端很多操作的 value 是形如 `READ+EDIT` 的复合串，会直接进入权限 key。 + */ +export enum Operate { + SELF = '', + READ = 'READ', + EDIT = 'READ+EDIT', + CREATE = 'READ+CREATE', + DELETE = 'READ+DELETE', + USE = 'USE', + IMPORT = 'READ+IMPORT', + EXPORT = 'READ+EXPORT', + PUBLISH = 'READ+PUBLISH', + SYNC = 'READ+SYNC', + GENERATE = 'READ+GENERATE', + ADD_MEMBER = 'READ+ADD_MEMBER', + REMOVE_MEMBER = 'READ+REMOVE_MEMBER', + VECTOR = 'READ+VECTOR', + MIGRATE = 'READ+MIGRATE', + RELATE = 'READ+RELATE', + USER_GROUP = 'READ+USER_GROUP', + ANNOTATION = 'READ+ANNOTATION', + CLEAR_POLICY = 'READ+CLEAR_POLICY', + EMBED = 'READ+EMBED', + ACCESS = 'READ+ACCESS', + DISPLAY = 'READ+DISPLAY', + API_KEY = 'READ+API_KEY', + PUBLIC_ACCESS = 'READ+PUBLIC_ACCESS', + Q_WEIXIN = 'READ+Q_WEIXIN', + FEISHU = 'READ+FEISHU', + DD = 'READ+DD', + WEIXIN_PUBLIC_ACCOUNT = 'READ+WEIXIN_PUBLIC_ACCOUNT', + SLACK = 'READ+SLACK', + ADD_KNOWLEDGE = 'READ+ADD_KNOWLEDGE', + TO_CHAT = 'READ+TO_CHAT', + SETTING = 'READ+SETTING', + DOWNLOAD = 'READ+DOWNLOAD', + COPY = 'READ+COPY', + AUTH = 'READ+AUTH', + TAG = 'READ+TAG', + REPLACE = 'READ+REPLACE', + UPDATE = 'READ+UPDATE', + RELATE_VIEW = 'READ+RELATE_VIEW', + RECORD = 'READ+RECORD', + TRIGGER_READ = 'READ+TRIGGER_READ', + TRIGGER_EDIT = 'READ+TRIGGER_EDIT', + TRIGGER_CREATE = 'READ+TRIGGER_CREATE', + TRIGGER_DELETE = 'READ+TRIGGER_DELETE', + BATCH_DELETE = 'READ+BATCH_DELETE', + BATCH_MOVE = 'READ+BATCH_MOVE', + TOKEN = 'READ+TOKEN', + TO_WORKSPACE = 'READ+TO_WORKSPACE', + SET_ROLE = 'READ+SET_ROLE', + QUOTA_SETTING = 'READ+QUOTA_SETTING', + ABOUT = 'READ', + LICENSE = 'READ+UPDATE', + SWITCH_LANGUAGE = 'READ+EDIT', + CHANGE_PASSWORD = 'READ+CREATE', + SYSTEM_API_KEY = 'READ+DELETE', + PORTAL = 'READ+PORTAL', + PASSWORD = 'PASSWORD', + LOCAL = 'LOCAL', + CAS = 'CAS', + DINGTALK = 'DINGTALK', + WECOM = 'WECOM', + LARK = 'LARK', + OIDC = 'OIDC', + LDAP = 'LDAP', + OAUTH2 = 'OAUTH2', +} + +export enum Compare { + OR = 'OR', + AND = 'AND', +} + +/** 权限工厂调用时可注入的上下文（一般取自路由参数）。 */ +export interface PermissionContext { + workspaceId?: string + resourceId?: string +} + +/** 延迟到判定时刻、结合上下文生成具体 Permission 的工厂。 */ +export type PermissionFactory = (ctx?: PermissionContext) => Permission + +/** 延迟到判定时刻、结合上下文生成具体 Role 的工厂。 */ +export type RoleFactory = (ctx?: PermissionContext) => Role + +/** + * 运行时角色，支持工作空间维度限定，对应后端 + * `common/auth/struct/permission.py` 的 Role dataclass。 + */ +export class Role { + name: string + workspaceId?: string + + constructor(name: string, workspaceId?: string) { + this.name = name + this.workspaceId = workspaceId + } + + /** 对应后端 `Role.__str__`。 */ + toString(): string { + return this.workspaceId ? `${this.name}:${this.workspaceId}` : `${this.name}` + } + + /** 工作空间维度角色工厂，对应后端 `RoleConstants.get_workspace_role`。 */ + getWorkspaceRole(): RoleFactory { + return (ctx) => new Role(this.name, ctx?.workspaceId) + } +} + +/** + * 内置角色常量，成员为 Role 实例，对应后端 + * `common/auth/constants/role_constants.py` 的 RoleConstants 枚举。 + */ +export const RoleConstants = { + ADMIN: new Role('ADMIN'), + WORKSPACE_MANAGE: new Role('WORKSPACE_MANAGE'), + USER: new Role('USER'), + EXTENDS_ADMIN: new Role('EXTENDS_ADMIN'), + EXTENDS_WORKSPACE_MANAGE: new Role('EXTENDS_WORKSPACE_MANAGE'), + EXTENDS_USER: new Role('EXTENDS_USER'), +} as const + +/** 单条权限，对应后端 `common/auth/struct/permission.py` 的 Permission。 */ +export class Permission { + constructor( + public group: Group, + public subGroup: Group, + public operate: Operate, + public bitIndex: number, + public workspaceId?: string, + public resourceId?: string, + /** 特权标记，对应后端工作空间管理员特权 flag。 */ + public flag?: string, + ) {} + + /** 该权限在所属组位图中的比特位。 */ + bit(): bigint { + return 1n << BigInt(this.bitIndex) + } + + /** 非资源权限 key，对应后端 `Permission.__str__`。 */ + toString(): string { + const sub = this.subGroup !== this.group ? `_${this.subGroup}` : '' + const flag = this.flag ? `_${this.flag}` : '' + return `${this.group}${sub}_${this.operate}${flag}` + } + + /** 资源级权限 key，对应后端 `Permission.get_resource_permission_key`。 */ + getResourcePermissionKey(): string { + const workspace = this.workspaceId ? `:w:${this.workspaceId}` : '' + const resource = this.resourceId ? `:r:${this.resourceId}` : '' + return `${this.group}${workspace}${resource}` + } + + /** 判定时使用的最终 key，对应后端 `AggregatePermission._match_permission`。 */ + toPermissionKey(): string { + return this.resourceId ? this.getResourcePermissionKey() : this.toString() + } + + /** 基于上下文派生出带 workspace / resource 的权限副本。 */ + withContext(ctx?: PermissionContext): Permission { + if (!ctx?.workspaceId && !ctx?.resourceId) { + return this + } + return new Permission( + this.group, + this.subGroup, + this.operate, + this.bitIndex, + ctx?.workspaceId, + ctx?.resourceId, + this.flag, + ) + } + + /** 派生带 workspaceId 的工作空间级权限副本，对应后端 `get_workspace_permission`。 */ + newWorkspacePermission(workspaceId?: string): Permission { + return new Permission(this.group, this.subGroup, this.operate, this.bitIndex, workspaceId) + } + + /** 派生带 workspaceId + resourceId 的资源级权限副本。 */ + newResourcePermission(workspaceId?: string, resourceId?: string): Permission { + return new Permission( + this.group, + this.subGroup, + this.operate, + this.bitIndex, + workspaceId, + resourceId, + ) + } + + // —— 工厂：对应后端 PermissionConstants 上的 get_workspace_*_permission —— + + /** 仅工作空间维度（无资源 id），对应 `get_workspace_permission`。 */ + getWorkspacePermission(): PermissionFactory { + return (ctx) => + new Permission(this.group, this.subGroup, this.operate, this.bitIndex, ctx?.workspaceId) + } + + /** 工作空间 + 资源维度，对应 `get_workspace_{knowledge,application,...}_permission`。 */ + getWorkspaceResourcePermission(): PermissionFactory { + return (ctx) => + new Permission( + this.group, + this.subGroup, + this.operate, + this.bitIndex, + ctx?.workspaceId, + ctx?.resourceId, + ) + } + + /** 工作空间管理员特权，对应 `get_workspace_permission_workspace_manage_role`。 */ + getWorkspaceManageFlagPermission(): PermissionFactory { + return (ctx) => + new Permission( + this.group, + this.subGroup, + this.operate, + this.bitIndex, + ctx?.workspaceId, + undefined, + RoleConstants.WORKSPACE_MANAGE.name, + ) + } +} + +export interface AggregatePermissionOptions { + permissionCalls?: PermissionFactory[] + permissionConstants?: Permission[] + aggregatePermissions?: AggregatePermission[] + roles?: Array + compare?: Compare +} + +/** 组合权限，对应后端 `AggregatePermission`，支持 OR/AND 与嵌套、短路求值。 */ +export class AggregatePermission { + permissionCalls: PermissionFactory[] + permissionConstants: Permission[] + aggregatePermissions: AggregatePermission[] + roles: Array + compare: Compare + + constructor(options: AggregatePermissionOptions = {}) { + this.permissionCalls = options.permissionCalls ?? [] + this.permissionConstants = options.permissionConstants ?? [] + this.aggregatePermissions = options.aggregatePermissions ?? [] + this.roles = options.roles ?? [] + this.compare = options.compare ?? Compare.OR + } + + static builder(): AggregatePermissionBuilder { + return new AggregatePermissionBuilder() + } + + hasPermission( + userRoles: Set, + userPermissions: Map, + ctx?: PermissionContext, + ): boolean { + // 无任何约束 => 放行（对应后端五集合全空的判断） + if ( + this.permissionCalls.length === 0 && + this.permissionConstants.length === 0 && + this.aggregatePermissions.length === 0 && + this.roles.length === 0 + ) { + return true + } + + const isAnd = this.compare === Compare.AND + + const evaluate = (hit: boolean): boolean | undefined => { + if (hit && !isAnd) return true // OR：命中其一即通过 + if (!hit && isAnd) return false // AND：缺一即失败 + return undefined // 继续下一项 + } + + for (const call of this.permissionCalls) { + const r = evaluate(this.checkPermission(call(ctx), userPermissions)) + if (r !== undefined) return r + } + for (const permission of this.permissionConstants) { + const r = evaluate(this.checkPermission(permission.withContext(ctx), userPermissions)) + if (r !== undefined) return r + } + for (const role of this.roles) { + const resolved = typeof role === 'function' ? role(ctx) : role + const r = evaluate(this.checkRole(resolved, userRoles)) + if (r !== undefined) return r + } + for (const aggregate of this.aggregatePermissions) { + const r = evaluate(aggregate.hasPermission(userRoles, userPermissions, ctx)) + if (r !== undefined) return r + } + + // AND 全部通过 => true；OR 一个都没命中 => false + return isAnd + } + + private checkRole(role: Role, userRoles: Set): boolean { + if (userRoles.size === 0) return false + return userRoles.has(role.toString()) + } + + private checkPermission(permission: Permission, userPermissions: Map): boolean { + const key = permission.toPermissionKey() + const raw = userPermissions.get(key) + if (raw == null) return false + return (raw & permission.bit()) !== 0n + } +} + +export class AggregatePermissionBuilder { + private _permissionCalls: PermissionFactory[] = [] + private _permissionConstants: Permission[] = [] + private _aggregatePermissions: AggregatePermission[] = [] + private _roles: Array = [] + private _compare: Compare = Compare.OR + + compare(compare: Compare): this { + this._compare = compare + return this + } + + addPermission(permission: PermissionFactory | Permission | AggregatePermission): this { + if (permission instanceof AggregatePermission) { + this._aggregatePermissions.push(permission) + } else if (typeof permission === 'function') { + this._permissionCalls.push(permission) + } else { + this._permissionConstants.push(permission) + } + return this + } + + addRole(role: Role | RoleFactory): this { + this._roles.push(role) + return this + } + + build(): AggregatePermission { + return new AggregatePermission({ + permissionCalls: this._permissionCalls, + permissionConstants: this._permissionConstants, + aggregatePermissions: this._aggregatePermissions, + roles: this._roles, + compare: this._compare, + }) + } +} diff --git a/ui/src/permission/core/data.ts b/ui/src/permission/core/data.ts new file mode 100644 index 00000000000..cfda74bef00 --- /dev/null +++ b/ui/src/permission/core/data.ts @@ -0,0 +1,416 @@ +/** + * 权限常量表 —— 后端 `PermissionConstants` + * (apps/common/auth/constants/permission_constants.py) 的前端镜像。 + * + * 本文件由脚本从后端源码全量抽取生成，group / subGroup / operate / bitIndex + * 与后端逐条对齐。请勿手工增删单条；后端调整权限枚举后重新同步整表。 + */ + +import { Permission, Group, Operate } from './common' + +const p = (group: Group, subGroup: Group, operate: Operate, bitIndex: number) => + new Permission(group, subGroup, operate, bitIndex) + +export const PermissionConstants = { + // ==================== HOMEPAGE ==================== + HOMEPAGE_READ: p(Group.HOMEPAGE, Group.HOMEPAGE, Operate.READ, 0), + HOMEPAGE_EXPORT: p(Group.HOMEPAGE, Group.HOMEPAGE, Operate.EXPORT, 1), + SYSTEM_HOMEPAGE_READ: p(Group.HOMEPAGE, Group.HOMEPAGE, Operate.READ, 0), + SYSTEM_HOMEPAGE_EXPORT: p(Group.HOMEPAGE, Group.HOMEPAGE, Operate.EXPORT, 1), + + // ==================== KNOWLEDGE ==================== + KNOWLEDGE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.SELF, 0), + + // ==================== APPLICATION ==================== + APPLICATION: p(Group.APPLICATION, Group.APPLICATION, Operate.SELF, 0), + + // ==================== MODEL ==================== + MODEL: p(Group.MODEL, Group.MODEL, Operate.SELF, 0), + + // ==================== TOOL ==================== + TOOL: p(Group.TOOL, Group.TOOL, Operate.SELF, 0), + + // ==================== USER ==================== + USER_READ: p(Group.USER, Group.USER, Operate.READ, 0), + USER_CREATE: p(Group.USER, Group.USER, Operate.CREATE, 1), + USER_EDIT: p(Group.USER, Group.USER, Operate.EDIT, 2), + USER_DELETE: p(Group.USER, Group.USER, Operate.DELETE, 3), + USER_SET_ROLE: p(Group.USER, Group.USER, Operate.SET_ROLE, 4), + USER_IMPORT: p(Group.USER, Group.USER, Operate.IMPORT, 5), + + // ==================== USER_GROUP ==================== + SYSTEM_USER_GROUP_READ: p(Group.USER_GROUP, Group.USER_GROUP, Operate.READ, 0), + SYSTEM_USER_GROUP_CREATE: p(Group.USER_GROUP, Group.USER_GROUP, Operate.CREATE, 1), + SYSTEM_USER_GROUP_EDIT: p(Group.USER_GROUP, Group.USER_GROUP, Operate.EDIT, 2), + SYSTEM_USER_GROUP_DELETE: p(Group.USER_GROUP, Group.USER_GROUP, Operate.DELETE, 3), + SYSTEM_USER_GROUP_ADD_MEMBER: p(Group.USER_GROUP, Group.USER_GROUP, Operate.ADD_MEMBER, 4), + SYSTEM_USER_GROUP_REMOVE_MEMBER: p(Group.USER_GROUP, Group.USER_GROUP, Operate.REMOVE_MEMBER, 5), + + // ==================== MODEL ==================== + MODEL_READ: p(Group.MODEL, Group.MODEL, Operate.READ, 1), + MODEL_CREATE: p(Group.MODEL, Group.MODEL, Operate.CREATE, 2), + MODEL_EDIT: p(Group.MODEL, Group.MODEL, Operate.EDIT, 3), + MODEL_DELETE: p(Group.MODEL, Group.MODEL, Operate.DELETE, 4), + MODEL_RESOURCE_AUTHORIZATION: p(Group.MODEL, Group.MODEL, Operate.AUTH, 5), + MODEL_RELATE_RESOURCE_VIEW: p(Group.MODEL, Group.MODEL, Operate.RELATE_VIEW, 6), + + // ==================== TRIGGER ==================== + TRIGGER_READ: p(Group.TRIGGER, Group.TRIGGER, Operate.READ, 0), + TRIGGER_CREATE: p(Group.TRIGGER, Group.TRIGGER, Operate.CREATE, 1), + TRIGGER_EDIT: p(Group.TRIGGER, Group.TRIGGER, Operate.EDIT, 2), + TRIGGER_DELETE: p(Group.TRIGGER, Group.TRIGGER, Operate.DELETE, 3), + TRIGGER_RECORD: p(Group.TRIGGER, Group.TRIGGER, Operate.RECORD, 4), + + // ==================== TOOL ==================== + TOOL_READ: p(Group.TOOL, Group.TOOL, Operate.READ, 1), + TOOL_CREATE: p(Group.TOOL, Group.TOOL, Operate.CREATE, 2), + TOOL_BATCH_MOVE: p(Group.TOOL, Group.TOOL, Operate.BATCH_MOVE, 3), + TOOL_BATCH_DELETE: p(Group.TOOL, Group.TOOL, Operate.BATCH_DELETE, 4), + TOOL_EDIT: p(Group.TOOL, Group.TOOL, Operate.EDIT, 5), + TOOL_DELETE: p(Group.TOOL, Group.TOOL, Operate.DELETE, 6), + TOOL_IMPORT: p(Group.TOOL, Group.TOOL, Operate.IMPORT, 7), + TOOL_EXPORT: p(Group.TOOL, Group.TOOL, Operate.EXPORT, 8), + TOOL_RESOURCE_AUTHORIZATION: p(Group.TOOL, Group.TOOL, Operate.AUTH, 9), + TOOL_RELATE_RESOURCE_VIEW: p(Group.TOOL, Group.TOOL, Operate.RELATE_VIEW, 10), + TOOL_PUBLISH: p(Group.TOOL, Group.TOOL, Operate.PUBLISH, 11), + TOOL_EXECUTE_RECORD: p(Group.TOOL, Group.TOOL, Operate.RECORD, 12), + TOOL_TRIGGER_READ: p(Group.TOOL, Group.TOOL, Operate.TRIGGER_READ, 13), + TOOL_TRIGGER_CREATE: p(Group.TOOL, Group.TOOL, Operate.TRIGGER_CREATE, 14), + TOOL_TRIGGER_EDIT: p(Group.TOOL, Group.TOOL, Operate.TRIGGER_EDIT, 15), + TOOL_TRIGGER_DELETE: p(Group.TOOL, Group.TOOL, Operate.TRIGGER_DELETE, 16), + TOOL_FOLDER_READ: p(Group.TOOL, Group.FOLDER, Operate.READ, 0), + TOOL_FOLDER_CREATE: p(Group.TOOL, Group.FOLDER, Operate.CREATE, 1), + TOOL_FOLDER_EDIT: p(Group.TOOL, Group.FOLDER, Operate.EDIT, 2), + TOOL_FOLDER_DELETE: p(Group.TOOL, Group.FOLDER, Operate.DELETE, 3), + TOOL_FOLDER_AUTH: p(Group.TOOL, Group.FOLDER, Operate.AUTH, 4), + + // ==================== KNOWLEDGE ==================== + KNOWLEDGE_READ: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.READ, 1), + KNOWLEDGE_CREATE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.CREATE, 2), + KNOWLEDGE_EDIT: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.EDIT, 3), + KNOWLEDGE_DELETE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.DELETE, 4), + KNOWLEDGE_SYNC: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.SYNC, 5), + KNOWLEDGE_EXPORT: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.EXPORT, 6), + KNOWLEDGE_VECTOR: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.VECTOR, 7), + KNOWLEDGE_GENERATE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.GENERATE, 8), + KNOWLEDGE_BATCH_DELETE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.BATCH_DELETE, 9), + KNOWLEDGE_BATCH_MOVE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.BATCH_MOVE, 10), + KNOWLEDGE_RESOURCE_AUTHORIZATION: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.AUTH, 11), + KNOWLEDGE_RELATE_RESOURCE_VIEW: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.RELATE_VIEW, 12), + KNOWLEDGE_FOLDER_READ: p(Group.KNOWLEDGE, Group.FOLDER, Operate.READ, 0), + KNOWLEDGE_FOLDER_CREATE: p(Group.KNOWLEDGE, Group.FOLDER, Operate.CREATE, 1), + KNOWLEDGE_FOLDER_EDIT: p(Group.KNOWLEDGE, Group.FOLDER, Operate.EDIT, 2), + KNOWLEDGE_FOLDER_DELETE: p(Group.KNOWLEDGE, Group.FOLDER, Operate.DELETE, 3), + KNOWLEDGE_FOLDER_AUTH: p(Group.KNOWLEDGE, Group.FOLDER, Operate.AUTH, 4), + KNOWLEDGE_WORKFLOW_READ: p(Group.KNOWLEDGE, Group.WORKFLOW, Operate.READ, 0), + KNOWLEDGE_WORKFLOW_EDIT: p(Group.KNOWLEDGE, Group.WORKFLOW, Operate.EDIT, 1), + KNOWLEDGE_WORKFLOW_EXPORT: p(Group.KNOWLEDGE, Group.WORKFLOW, Operate.EXPORT, 2), + KNOWLEDGE_WORKFLOW_PUBLISH: p(Group.KNOWLEDGE, Group.WORKFLOW, Operate.PUBLISH, 3), + KNOWLEDGE_DOCUMENT_READ: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.READ, 0), + KNOWLEDGE_DOCUMENT_CREATE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.CREATE, 1), + KNOWLEDGE_DOCUMENT_EDIT: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.EDIT, 2), + KNOWLEDGE_DOCUMENT_DELETE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.DELETE, 3), + KNOWLEDGE_DOCUMENT_SYNC: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.SYNC, 4), + KNOWLEDGE_DOCUMENT_EXPORT: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.EXPORT, 5), + KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.DOWNLOAD, 6), + KNOWLEDGE_DOCUMENT_GENERATE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.GENERATE, 7), + KNOWLEDGE_DOCUMENT_VECTOR: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.VECTOR, 8), + KNOWLEDGE_DOCUMENT_MIGRATE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.MIGRATE, 9), + KNOWLEDGE_DOCUMENT_TAG: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.TAG, 10), + KNOWLEDGE_DOCUMENT_REPLACE: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.REPLACE, 11), + KNOWLEDGE_DOCUMENT_TOKEN: p(Group.KNOWLEDGE, Group.DOCUMENT, Operate.TOKEN, 12), + KNOWLEDGE_HIT_TEST: p(Group.KNOWLEDGE, Group.HIT_TEST, Operate.READ, 0), + KNOWLEDGE_PROBLEM_READ: p(Group.KNOWLEDGE, Group.PROBLEM, Operate.READ, 0), + KNOWLEDGE_PROBLEM_CREATE: p(Group.KNOWLEDGE, Group.PROBLEM, Operate.CREATE, 1), + KNOWLEDGE_PROBLEM_EDIT: p(Group.KNOWLEDGE, Group.PROBLEM, Operate.EDIT, 2), + KNOWLEDGE_PROBLEM_DELETE: p(Group.KNOWLEDGE, Group.PROBLEM, Operate.DELETE, 3), + KNOWLEDGE_PROBLEM_RELATE: p(Group.KNOWLEDGE, Group.PROBLEM, Operate.RELATE, 4), + KNOWLEDGE_TERMBASE_READ: p(Group.KNOWLEDGE, Group.TERMBASE, Operate.READ, 0), + KNOWLEDGE_TERMBASE_CREATE: p(Group.KNOWLEDGE, Group.TERMBASE, Operate.CREATE, 1), + KNOWLEDGE_TERMBASE_EDIT: p(Group.KNOWLEDGE, Group.TERMBASE, Operate.EDIT, 2), + KNOWLEDGE_TERMBASE_DELETE: p(Group.KNOWLEDGE, Group.TERMBASE, Operate.DELETE, 3), + KNOWLEDGE_TAG_READ: p(Group.KNOWLEDGE, Group.TAG, Operate.READ, 0), + KNOWLEDGE_TAG_CREATE: p(Group.KNOWLEDGE, Group.TAG, Operate.CREATE, 1), + KNOWLEDGE_TAG_EDIT: p(Group.KNOWLEDGE, Group.TAG, Operate.EDIT, 2), + KNOWLEDGE_TAG_DELETE: p(Group.KNOWLEDGE, Group.TAG, Operate.DELETE, 3), + KNOWLEDGE_CHAT_USER_READ: p(Group.KNOWLEDGE, Group.CHAT_USER, Operate.READ, 0), + KNOWLEDGE_CHAT_USER_EDIT: p(Group.KNOWLEDGE, Group.CHAT_USER, Operate.EDIT, 1), + + // ==================== RESOURCE_PERMISSION ==================== + APPLICATION_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.APPLICATION_RESOURCE_PERMISSION, Operate.READ, 0), + APPLICATION_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.APPLICATION_RESOURCE_PERMISSION, Operate.EDIT, 1), + KNOWLEDGE_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.READ, 0), + KNOWLEDGE_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.KNOWLEDGE_RESOURCE_PERMISSION, Operate.EDIT, 1), + TOOL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.READ, 0), + TOOL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.TOOL_RESOURCE_PERMISSION, Operate.EDIT, 1), + MODEL_RESOURCE_PERMISSION_READ: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.READ, 0), + MODEL_RESOURCE_PERMISSION_EDIT: p(Group.RESOURCE_PERMISSION, Group.MODEL_RESOURCE_PERMISSION, Operate.EDIT, 1), + + // ==================== EMAIL_SETTING ==================== + EMAIL_SETTING_READ: p(Group.EMAIL_SETTING, Group.EMAIL_SETTING, Operate.READ, 0), + EMAIL_SETTING_EDIT: p(Group.EMAIL_SETTING, Group.EMAIL_SETTING, Operate.EDIT, 1), + + // ==================== ROLE ==================== + ROLE_READ: p(Group.ROLE, Group.ROLE, Operate.READ, 0), + ROLE_CREATE: p(Group.ROLE, Group.ROLE, Operate.CREATE, 1), + ROLE_EDIT: p(Group.ROLE, Group.ROLE, Operate.EDIT, 2), + ROLE_DELETE: p(Group.ROLE, Group.ROLE, Operate.DELETE, 3), + ROLE_ADD_MEMBER: p(Group.ROLE, Group.ROLE, Operate.ADD_MEMBER, 4), + ROLE_REMOVE_MEMBER: p(Group.ROLE, Group.ROLE, Operate.REMOVE_MEMBER, 5), + + // ==================== WORKSPACE ==================== + WORKSPACE_READ: p(Group.WORKSPACE, Group.WORKSPACE, Operate.READ, 0), + WORKSPACE_CREATE: p(Group.WORKSPACE, Group.WORKSPACE, Operate.CREATE, 1), + WORKSPACE_EDIT: p(Group.WORKSPACE, Group.WORKSPACE, Operate.EDIT, 2), + WORKSPACE_DELETE: p(Group.WORKSPACE, Group.WORKSPACE, Operate.DELETE, 3), + WORKSPACE_ADD_MEMBER: p(Group.WORKSPACE, Group.WORKSPACE, Operate.ADD_MEMBER, 4), + WORKSPACE_REMOVE_MEMBER: p(Group.WORKSPACE, Group.WORKSPACE, Operate.REMOVE_MEMBER, 5), + + // ==================== LOGIN_AUTH ==================== + LOGIN_AUTH_READ: p(Group.LOGIN_AUTH, Group.LOGIN_AUTH, Operate.READ, 0), + LOGIN_AUTH_EDIT: p(Group.LOGIN_AUTH, Group.LOGIN_AUTH, Operate.EDIT, 1), + + // ==================== APPLICATION ==================== + APPLICATION_READ: p(Group.APPLICATION, Group.APPLICATION, Operate.READ, 1), + APPLICATION_CREATE: p(Group.APPLICATION, Group.APPLICATION, Operate.CREATE, 2), + APPLICATION_COPY: p(Group.APPLICATION, Group.APPLICATION, Operate.COPY, 3), + APPLICATION_EDIT: p(Group.APPLICATION, Group.APPLICATION, Operate.EDIT, 4), + APPLICATION_DELETE: p(Group.APPLICATION, Group.APPLICATION, Operate.DELETE, 5), + APPLICATION_IMPORT: p(Group.APPLICATION, Group.APPLICATION, Operate.IMPORT, 6), + APPLICATION_EXPORT: p(Group.APPLICATION, Group.APPLICATION, Operate.EXPORT, 7), + APPLICATION_PUBLISH: p(Group.APPLICATION, Group.APPLICATION, Operate.PUBLISH, 8), + APPLICATION_BATCH_DELETE: p(Group.APPLICATION, Group.APPLICATION, Operate.BATCH_DELETE, 9), + APPLICATION_BATCH_MOVE: p(Group.APPLICATION, Group.APPLICATION, Operate.BATCH_MOVE, 10), + APPLICATION_RESOURCE_AUTHORIZATION: p(Group.APPLICATION, Group.APPLICATION, Operate.AUTH, 11), + APPLICATION_RELATE_RESOURCE_VIEW: p(Group.APPLICATION, Group.APPLICATION, Operate.RELATE_VIEW, 12), + APPLICATION_TRIGGER_READ: p(Group.APPLICATION, Group.APPLICATION, Operate.TRIGGER_READ, 13), + APPLICATION_TRIGGER_CREATE: p(Group.APPLICATION, Group.APPLICATION, Operate.TRIGGER_CREATE, 14), + APPLICATION_TRIGGER_EDIT: p(Group.APPLICATION, Group.APPLICATION, Operate.TRIGGER_EDIT, 15), + APPLICATION_TRIGGER_DELETE: p(Group.APPLICATION, Group.APPLICATION, Operate.TRIGGER_DELETE, 16), + APPLICATION_FOLDER_READ: p(Group.APPLICATION, Group.FOLDER, Operate.READ, 0), + APPLICATION_FOLDER_CREATE: p(Group.APPLICATION, Group.FOLDER, Operate.CREATE, 1), + APPLICATION_FOLDER_EDIT: p(Group.APPLICATION, Group.FOLDER, Operate.EDIT, 2), + APPLICATION_FOLDER_DELETE: p(Group.APPLICATION, Group.FOLDER, Operate.DELETE, 3), + APPLICATION_FOLDER_AUTH: p(Group.APPLICATION, Group.FOLDER, Operate.AUTH, 4), + APPLICATION_OVERVIEW_READ: p(Group.APPLICATION, Group.OVERVIEW, Operate.READ, 0), + APPLICATION_OVERVIEW_EMBED: p(Group.APPLICATION, Group.OVERVIEW, Operate.EMBED, 1), + APPLICATION_OVERVIEW_ACCESS: p(Group.APPLICATION, Group.OVERVIEW, Operate.ACCESS, 2), + APPLICATION_OVERVIEW_DISPLAY: p(Group.APPLICATION, Group.OVERVIEW, Operate.DISPLAY, 3), + APPLICATION_OVERVIEW_API_KEY: p(Group.APPLICATION, Group.OVERVIEW, Operate.API_KEY, 4), + APPLICATION_OVERVIEW_PUBLIC: p(Group.APPLICATION, Group.OVERVIEW, Operate.PUBLIC_ACCESS, 5), + APPLICATION_ACCESS_READ: p(Group.APPLICATION, Group.ACCESS, Operate.READ, 0), + APPLICATION_ACCESS_EDIT: p(Group.APPLICATION, Group.ACCESS, Operate.EDIT, 1), + APPLICATION_CHAT_USER_READ: p(Group.APPLICATION, Group.CHAT_USER, Operate.READ, 0), + APPLICATION_CHAT_USER_EDIT: p(Group.APPLICATION, Group.CHAT_USER, Operate.EDIT, 1), + APPLICATION_CHAT_LOG_READ: p(Group.APPLICATION, Group.CHAT_LOG, Operate.READ, 0), + APPLICATION_CHAT_LOG_ANNOTATION: p(Group.APPLICATION, Group.CHAT_LOG, Operate.ANNOTATION, 1), + APPLICATION_CHAT_LOG_EXPORT: p(Group.APPLICATION, Group.CHAT_LOG, Operate.EXPORT, 2), + APPLICATION_CHAT_LOG_CLEAR_POLICY: p(Group.APPLICATION, Group.CHAT_LOG, Operate.CLEAR_POLICY, 3), + APPLICATION_CHAT_LOG_ADD_KNOWLEDGE: p(Group.APPLICATION, Group.CHAT_LOG, Operate.ADD_KNOWLEDGE, 4), + + // ==================== OTHER ==================== + ABOUT_READ: p(Group.OTHER, Group.OTHER, Operate.ABOUT, 0), + LICENSE_UPDATE: p(Group.OTHER, Group.OTHER, Operate.LICENSE, 1), + SWITCH_LANGUAGE: p(Group.OTHER, Group.OTHER, Operate.SWITCH_LANGUAGE, 2), + CHANGE_PASSWORD: p(Group.OTHER, Group.OTHER, Operate.CHANGE_PASSWORD, 3), + SYSTEM_API_KEY_EDIT: p(Group.OTHER, Group.OTHER, Operate.SYSTEM_API_KEY, 4), + PORTAL: p(Group.OTHER, Group.OTHER, Operate.PORTAL, 5), + + // ==================== APPEARANCE_SETTINGS ==================== + APPEARANCE_SETTINGS_READ: p(Group.APPEARANCE_SETTINGS, Group.APPEARANCE_SETTINGS, Operate.READ, 0), + APPEARANCE_SETTINGS_EDIT: p(Group.APPEARANCE_SETTINGS, Group.APPEARANCE_SETTINGS, Operate.EDIT, 1), + + // ==================== CHAT_USER ==================== + CHAT_USER_READ: p(Group.CHAT_USER, Group.CHAT_USER, Operate.READ, 0), + CHAT_USER_CREATE: p(Group.CHAT_USER, Group.CHAT_USER, Operate.CREATE, 1), + CHAT_USER_SYNC: p(Group.CHAT_USER, Group.CHAT_USER, Operate.SYNC, 2), + CHAT_USER_EDIT: p(Group.CHAT_USER, Group.CHAT_USER, Operate.EDIT, 3), + CHAT_USER_DELETE: p(Group.CHAT_USER, Group.CHAT_USER, Operate.DELETE, 4), + CHAT_USER_GROUP: p(Group.CHAT_USER, Group.CHAT_USER, Operate.USER_GROUP, 5), + CHAT_USER_QUOTA_SETTING: p(Group.CHAT_USER, Group.CHAT_USER, Operate.QUOTA_SETTING, 6), + + // ==================== CHAT_USER_GROUP ==================== + USER_GROUP_READ: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.READ, 0), + USER_GROUP_CREATE: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.CREATE, 1), + USER_GROUP_EDIT: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.EDIT, 2), + USER_GROUP_DELETE: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.DELETE, 3), + USER_GROUP_ADD_MEMBER: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.ADD_MEMBER, 4), + USER_GROUP_REMOVE_MEMBER: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.REMOVE_MEMBER, 5), + CHAT_USER_AUTH_READ: p(Group.CHAT_USER_GROUP, Group.CHAT_USER_GROUP, Operate.READ, 6), + + // ==================== CHAT_USER_AUTH ==================== + CHAT_USER_AUTH_EDIT: p(Group.CHAT_USER_AUTH, Group.CHAT_USER_AUTH, Operate.EDIT, 0), + + // ==================== PORTAL ==================== + PORTAL_READ: p(Group.PORTAL, Group.PORTAL, Operate.READ, 0), + PORTAL_EDIT: p(Group.PORTAL, Group.PORTAL, Operate.EDIT, 0), + + // ==================== SYSTEM_TOOL ==================== + SHARED_TOOL_READ: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.READ, 0), + SHARED_TOOL_CREATE: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.CREATE, 1), + SHARED_TOOL_EDIT: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.EDIT, 2), + SHARED_TOOL_DELETE: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.DELETE, 3), + SHARED_TOOL_IMPORT: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.IMPORT, 4), + SHARED_TOOL_EXPORT: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.EXPORT, 5), + SHARED_TOOL_PUBLISH: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.PUBLISH, 6), + SHARED_TOOL_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.RELATE_VIEW, 7), + SHARED_TOOL_EXECUTE_RECORD: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.RECORD, 8), + SHARED_TOOL_TO_WORKSPACE: p(Group.SYSTEM_TOOL, Group.SYSTEM_TOOL, Operate.TO_WORKSPACE, 9), + + // ==================== SYSTEM_KNOWLEDGE ==================== + SHARED_KNOWLEDGE_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.READ, 0), + SHARED_KNOWLEDGE_CREATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.CREATE, 1), + SHARED_KNOWLEDGE_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.EDIT, 2), + SHARED_KNOWLEDGE_SYNC: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.SYNC, 3), + SHARED_KNOWLEDGE_VECTOR: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.VECTOR, 4), + SHARED_KNOWLEDGE_EXPORT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.EXPORT, 5), + SHARED_KNOWLEDGE_GENERATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.GENERATE, 6), + SHARED_KNOWLEDGE_DELETE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.DELETE, 7), + SHARED_KNOWLEDGE_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.RELATE_VIEW, 8), + SHARED_KNOWLEDGE_TO_WORKSPACE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_KNOWLEDGE, Operate.TO_WORKSPACE, 9), + SHARED_KNOWLEDGE_WORKFLOW_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.READ, 0), + SHARED_KNOWLEDGE_WORKFLOW_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.EDIT, 1), + SHARED_KNOWLEDGE_WORKFLOW_EXPORT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.EXPORT, 2), + SHARED_KNOWLEDGE_WORKFLOW_PUBLISH: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.PUBLISH, 3), + SHARED_KNOWLEDGE_DOCUMENT_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.READ, 0), + SHARED_KNOWLEDGE_DOCUMENT_CREATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.CREATE, 1), + SHARED_KNOWLEDGE_DOCUMENT_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.EDIT, 2), + SHARED_KNOWLEDGE_DOCUMENT_DELETE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.DELETE, 3), + SHARED_KNOWLEDGE_DOCUMENT_SYNC: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.SYNC, 4), + SHARED_KNOWLEDGE_DOCUMENT_EXPORT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.EXPORT, 5), + SHARED_KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.DOWNLOAD, 6), + SHARED_KNOWLEDGE_DOCUMENT_GENERATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.GENERATE, 7), + SHARED_KNOWLEDGE_DOCUMENT_VECTOR: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.VECTOR, 8), + SHARED_KNOWLEDGE_DOCUMENT_MIGRATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.MIGRATE, 9), + SHARED_KNOWLEDGE_DOCUMENT_TAG: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.TAG, 10), + SHARED_KNOWLEDGE_DOCUMENT_REPLACE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.REPLACE, 11), + SHARED_KNOWLEDGE_DOCUMENT_TOKEN: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.TOKEN, 12), + SHARED_KNOWLEDGE_TAG_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TAG, Operate.READ, 0), + SHARED_KNOWLEDGE_TAG_CREATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TAG, Operate.CREATE, 1), + SHARED_KNOWLEDGE_TAG_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TAG, Operate.EDIT, 2), + SHARED_KNOWLEDGE_TAG_DELETE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TAG, Operate.DELETE, 3), + SHARED_KNOWLEDGE_PROBLEM_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.READ, 0), + SHARED_KNOWLEDGE_PROBLEM_CREATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.CREATE, 1), + SHARED_KNOWLEDGE_PROBLEM_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.EDIT, 2), + SHARED_KNOWLEDGE_PROBLEM_DELETE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.DELETE, 3), + SHARED_KNOWLEDGE_PROBLEM_RELATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.RELATE, 4), + SHARED_KNOWLEDGE_TERMBASE_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.READ, 0), + SHARED_KNOWLEDGE_TERMBASE_CREATE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.CREATE, 1), + SHARED_KNOWLEDGE_TERMBASE_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.EDIT, 2), + SHARED_KNOWLEDGE_TERMBASE_DELETE: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.DELETE, 3), + SHARED_KNOWLEDGE_TERMBASE_EXPORT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.EXPORT, 4), + SHARED_KNOWLEDGE_HIT_TEST: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_HIT_TEST, Operate.READ, 0), + SHARED_KNOWLEDGE_CHAT_USER_READ: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_CHAT_USER, Operate.READ, 0), + SHARED_KNOWLEDGE_CHAT_USER_EDIT: p(Group.SYSTEM_KNOWLEDGE, Group.SYSTEM_CHAT_USER, Operate.EDIT, 1), + + // ==================== SYSTEM_MODEL ==================== + SHARED_MODEL_READ: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.READ, 0), + SHARED_MODEL_CREATE: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.CREATE, 1), + SHARED_MODEL_EDIT: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.EDIT, 2), + SHARED_MODEL_DELETE: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.DELETE, 3), + SHARED_MODEL_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.RELATE_VIEW, 4), + SHARED_MODEL_TO_WORKSPACE: p(Group.SYSTEM_MODEL, Group.SYSTEM_MODEL, Operate.TO_WORKSPACE, 5), + + // ==================== SYSTEM_RES_APPLICATION ==================== + RESOURCE_APPLICATION_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.READ, 0), + RESOURCE_APPLICATION_EDIT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.EDIT, 1), + RESOURCE_APPLICATION_DELETE: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.DELETE, 2), + RESOURCE_APPLICATION_EXPORT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.EXPORT, 3), + RESOURCE_APPLICATION_COPY: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.COPY, 4), + RESOURCE_APPLICATION_AUTH: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.AUTH, 5), + RESOURCE_APPLICATION_PUBLISH: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.PUBLISH, 6), + RESOURCE_APPLICATION_TRIGGER_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.TRIGGER_READ, 7), + RESOURCE_APPLICATION_TRIGGER_CREATE: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.TRIGGER_CREATE, 8), + RESOURCE_APPLICATION_TRIGGER_EDIT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.TRIGGER_EDIT, 9), + RESOURCE_APPLICATION_TRIGGER_DELETE: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.TRIGGER_DELETE, 10), + RESOURCE_APPLICATION_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_RES_APPLICATION, Operate.RELATE_VIEW, 11), + RESOURCE_APPLICATION_OVERVIEW_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.READ, 0), + RESOURCE_APPLICATION_OVERVIEW_EMBED: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.EMBED, 1), + RESOURCE_APPLICATION_OVERVIEW_ACCESS: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.ACCESS, 2), + RESOURCE_APPLICATION_OVERVIEW_DISPLAY: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.DISPLAY, 3), + RESOURCE_APPLICATION_OVERVIEW_API_KEY: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.API_KEY, 4), + RESOURCE_APPLICATION_OVERVIEW_PUBLIC: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_OVERVIEW, Operate.PUBLIC_ACCESS, 5), + RESOURCE_APPLICATION_ACCESS_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_ACCESS, Operate.READ, 0), + RESOURCE_APPLICATION_ACCESS_EDIT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_ACCESS, Operate.EDIT, 1), + RESOURCE_APPLICATION_CHAT_USER_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_USER, Operate.READ, 0), + RESOURCE_APPLICATION_CHAT_USER_EDIT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_USER, Operate.EDIT, 1), + RESOURCE_APPLICATION_CHAT_LOG_READ: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_LOG, Operate.READ, 0), + RESOURCE_APPLICATION_CHAT_LOG_ADD_KNOWLEDGE: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_LOG, Operate.ADD_KNOWLEDGE, 1), + RESOURCE_APPLICATION_CHAT_LOG_ANNOTATION: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_LOG, Operate.ANNOTATION, 2), + RESOURCE_APPLICATION_CHAT_LOG_EXPORT: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_LOG, Operate.EXPORT, 3), + RESOURCE_APPLICATION_CHAT_LOG_CLEAR_POLICY: p(Group.SYSTEM_RES_APPLICATION, Group.SYSTEM_CHAT_LOG, Operate.CLEAR_POLICY, 4), + + // ==================== SYSTEM_RES_KNOWLEDGE ==================== + RESOURCE_KNOWLEDGE_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.READ, 0), + RESOURCE_KNOWLEDGE_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.EDIT, 1), + RESOURCE_KNOWLEDGE_DELETE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.DELETE, 2), + RESOURCE_KNOWLEDGE_SYNC: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.SYNC, 3), + RESOURCE_KNOWLEDGE_EXPORT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.EXPORT, 4), + RESOURCE_KNOWLEDGE_PUBLISH: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.PUBLISH, 5), + RESOURCE_KNOWLEDGE_VECTOR: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.VECTOR, 6), + RESOURCE_KNOWLEDGE_GENERATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.GENERATE, 7), + RESOURCE_KNOWLEDGE_AUTH: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.AUTH, 8), + RESOURCE_KNOWLEDGE_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.RELATE_VIEW, 9), + RESOURCE_KNOWLEDGE_WORKFLOW_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.READ, 0), + RESOURCE_KNOWLEDGE_WORKFLOW_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.EDIT, 1), + RESOURCE_KNOWLEDGE_WORKFLOW_EXPORT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.EXPORT, 2), + RESOURCE_KNOWLEDGE_WORKFLOW_PUBLISH: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.PUBLISH, 3), + RESOURCE_KNOWLEDGE_DOCUMENT_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.READ, 0), + RESOURCE_KNOWLEDGE_DOCUMENT_CREATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.CREATE, 1), + RESOURCE_KNOWLEDGE_DOCUMENT_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.EDIT, 2), + RESOURCE_KNOWLEDGE_DOCUMENT_DELETE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.DELETE, 3), + RESOURCE_KNOWLEDGE_DOCUMENT_SYNC: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.SYNC, 4), + RESOURCE_KNOWLEDGE_DOCUMENT_EXPORT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.EXPORT, 5), + RESOURCE_KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.DOWNLOAD, 6), + RESOURCE_KNOWLEDGE_DOCUMENT_GENERATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.GENERATE, 7), + RESOURCE_KNOWLEDGE_DOCUMENT_VECTOR: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.VECTOR, 8), + RESOURCE_KNOWLEDGE_DOCUMENT_MIGRATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.MIGRATE, 9), + RESOURCE_KNOWLEDGE_DOCUMENT_TAG: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.TAG, 10), + RESOURCE_KNOWLEDGE_DOCUMENT_REPLACE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.REPLACE, 11), + RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_DOCUMENT, Operate.TOKEN, 12), + RESOURCE_KNOWLEDGE_HIT_TEST: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_HIT_TEST, Operate.READ, 0), + RESOURCE_KNOWLEDGE_PROBLEM_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.READ, 0), + RESOURCE_KNOWLEDGE_PROBLEM_CREATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.CREATE, 1), + RESOURCE_KNOWLEDGE_PROBLEM_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.EDIT, 2), + RESOURCE_KNOWLEDGE_PROBLEM_DELETE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.DELETE, 3), + RESOURCE_KNOWLEDGE_PROBLEM_RELATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_PROBLEM, Operate.RELATE, 4), + RESOURCE_KNOWLEDGE_TERMBASE_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.READ, 0), + RESOURCE_KNOWLEDGE_TERMBASE_CREATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.CREATE, 1), + RESOURCE_KNOWLEDGE_TERMBASE_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.EDIT, 2), + RESOURCE_KNOWLEDGE_TERMBASE_DELETE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.DELETE, 3), + RESOURCE_KNOWLEDGE_TERMBASE_EXPORT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TERMBASE, Operate.EXPORT, 4), + RESOURCE_KNOWLEDGE_TAG_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TAG, Operate.READ, 0), + RESOURCE_KNOWLEDGE_TAG_CREATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TAG, Operate.CREATE, 1), + RESOURCE_KNOWLEDGE_TAG_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TAG, Operate.EDIT, 2), + RESOURCE_KNOWLEDGE_TAG_DELETE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_TAG, Operate.DELETE, 3), + RESOURCE_KNOWLEDGE_CHAT_USER_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_CHAT_USER, Operate.READ, 0), + RESOURCE_KNOWLEDGE_CHAT_USER_EDIT: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_CHAT_USER, Operate.EDIT, 1), + + // ==================== SYSTEM_RES_TOOL ==================== + RESOURCE_TOOL_READ: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.READ, 0), + RESOURCE_TOOL_EDIT: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.EDIT, 1), + RESOURCE_TOOL_DELETE: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.DELETE, 2), + RESOURCE_TOOL_EXPORT: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.EXPORT, 3), + RESOURCE_TOOL_PUBLISH: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.PUBLISH, 4), + RESOURCE_TOOL_AUTH: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.AUTH, 5), + RESOURCE_TOOL_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.RELATE_VIEW, 6), + RESOURCE_TOOL_EXECUTE_RECORD: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.RECORD, 7), + RESOURCE_TOOL_TRIGGER_READ: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.TRIGGER_READ, 8), + RESOURCE_TOOL_TRIGGER_CREATE: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.TRIGGER_CREATE, 9), + RESOURCE_TOOL_TRIGGER_EDIT: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.TRIGGER_EDIT, 10), + RESOURCE_TOOL_TRIGGER_DELETE: p(Group.SYSTEM_RES_TOOL, Group.SYSTEM_RES_TOOL, Operate.TRIGGER_DELETE, 11), + + // ==================== SYSTEM_RES_MODEL ==================== + RESOURCE_MODEL_READ: p(Group.SYSTEM_RES_MODEL, Group.SYSTEM_RES_MODEL, Operate.READ, 0), + RESOURCE_MODEL_EDIT: p(Group.SYSTEM_RES_MODEL, Group.SYSTEM_RES_MODEL, Operate.EDIT, 1), + RESOURCE_MODEL_DELETE: p(Group.SYSTEM_RES_MODEL, Group.SYSTEM_RES_MODEL, Operate.DELETE, 2), + RESOURCE_MODEL_AUTH: p(Group.SYSTEM_RES_MODEL, Group.SYSTEM_RES_MODEL, Operate.AUTH, 3), + RESOURCE_MODEL_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_RES_MODEL, Group.SYSTEM_RES_MODEL, Operate.RELATE_VIEW, 4), + + // ==================== OPERATION_LOG ==================== + OPERATION_LOG_READ: p(Group.OPERATION_LOG, Group.OPERATION_LOG, Operate.READ, 0), + OPERATION_LOG_EXPORT: p(Group.OPERATION_LOG, Group.OPERATION_LOG, Operate.EXPORT, 1), + OPERATION_LOG_CLEAR_POLICY: p(Group.OPERATION_LOG, Group.OPERATION_LOG, Operate.CLEAR_POLICY, 2), +} as const + +export type PermissionConstantKey = keyof typeof PermissionConstants diff --git a/ui/src/permission/core/index.ts b/ui/src/permission/core/index.ts new file mode 100644 index 00000000000..8b60b8afcb9 --- /dev/null +++ b/ui/src/permission/core/index.ts @@ -0,0 +1,110 @@ +import { + Role, + RoleConstants, + Compare, + Permission, + AggregatePermission, + type PermissionContext, + type PermissionFactory, + type RoleFactory, +} from './common' +import { useStore } from '@/stores' +import { getWorkspaceId } from '@/utils/workspace-context' + +export type PermissionInput = + | Role + | string + | Permission + | PermissionFactory + | RoleFactory + | AggregatePermission + +/** 判断单个权限项，对应 run 的 hasPermissionChild。 */ +const hasPermissionChild = (permission: PermissionInput, ctx?: PermissionContext): boolean => { + const { user } = useStore() + const roles = user.roleSet + const permissions = user.permissionMap + + if (!permission) { + return true + } + // 工厂：先结合上下文求值出具体 Permission / Role + if (typeof permission === 'function') { + permission = permission(ctx) + } + // 角色 + if (permission instanceof Role) { + return roles.has(permission.toString()) + } + // 组合权限 + if (permission instanceof AggregatePermission) { + return permission.hasPermission(roles, permissions, ctx) + } + // 单条权限 + if (permission instanceof Permission) { + const p = permission.withContext(ctx) + const raw = permissions.get(p.toPermissionKey()) + return raw != null && (raw & p.bit()) !== 0n + } + // 兜底：直接把字符串当作已就绪的权限/角色 key 命中判断 + if (typeof permission === 'string') { + return roles.has(permission) || permissions.has(permission) + } + return false +} + +/** + * 判断当前用户是否具备给定权限。 + * @param permission 单项或数组（数组时按 compare 组合） + * @param compare 数组语义：OR = 命中其一即可，AND = 需全部命中，默认 OR + * @param ctx 资源级/工作空间级权限所需上下文（workspaceId / resourceId） + */ +export const hasPermission = ( + permission: PermissionInput | PermissionInput[], + compare: Compare = Compare.OR, + ctx?: PermissionContext, +): boolean => { + if (Array.isArray(permission)) { + return compare === Compare.OR + ? permission.some((item) => hasPermissionChild(item, ctx)) + : permission.every((item) => hasPermissionChild(item, ctx)) + } + return hasPermissionChild(permission, ctx) +} + +/** + * 工作空间维度基础权限：命中权限位 / 系统管理员 / 该空间管理员 即可。 + * @param workspaceId 默认取当前路由的 workspaceId。 + */ +export const buildBasePermission = ( + permission: Permission, + workspaceId: string | undefined = getWorkspaceId(), +): AggregatePermission => + AggregatePermission.builder() + .addPermission(permission.newWorkspacePermission(workspaceId)) + .addRole(RoleConstants.ADMIN) + .addRole(new Role(RoleConstants.WORKSPACE_MANAGE.name, workspaceId)) + .compare(Compare.OR) + .build() + +/** + * 资源级基础权限：命中资源权限位 / 系统管理员 / 该空间管理员 即可。 + * resourceId 为 'root' 时退化为工作空间维度。 + * @param workspaceId 默认取当前路由的 workspaceId。 + */ +export const buildBaseResourcePermission = ( + permission: Permission, + resourceId: string, + workspaceId: string | undefined = getWorkspaceId(), +): AggregatePermission => + resourceId === 'root' + ? buildBasePermission(permission, workspaceId) + : AggregatePermission.builder() + .addPermission(permission.newResourcePermission(workspaceId, resourceId)) + .addRole(RoleConstants.ADMIN) + .addRole(new Role(RoleConstants.WORKSPACE_MANAGE.name, workspaceId)) + .compare(Compare.OR) + .build() + +export { Role, RoleConstants, Compare } from './common' +export { PermissionConstants } from './data' diff --git a/ui/src/permission/index.ts b/ui/src/permission/index.ts new file mode 100644 index 00000000000..208c7462855 --- /dev/null +++ b/ui/src/permission/index.ts @@ -0,0 +1,12 @@ +/** + * 按钮权限对外入口。 + * - 模板中免 import 用全局 `$perm`（见 install.ts） + * -