mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-07-29 20:19:24 +08:00
36 lines
1.0 KiB
Go
36 lines
1.0 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"ragflow/internal/dao"
|
|
"ragflow/internal/entity"
|
|
)
|
|
|
|
// CheckFileTeamPermission reports whether userID may access the given file: either
|
|
// the file's owning tenant matches userID, or userID is a team member of any
|
|
// dataset the file is linked to. It mirrors Python's check_file_team_permission
|
|
// and is shared by FileService and File2DocumentService, which previously each
|
|
// carried an identical copy of this logic.
|
|
func CheckFileTeamPermission(ctx context.Context, fileDAO *dao.FileDAO, file *entity.File, userID string) bool {
|
|
if file.TenantID == userID {
|
|
return true
|
|
}
|
|
|
|
datasetIDs, err := fileDAO.GetDatasetIDByFileID(ctx, dao.DB, file.ID)
|
|
if err != nil || len(datasetIDs) == 0 {
|
|
return false
|
|
}
|
|
|
|
kbDAO := dao.NewKnowledgebaseDAO()
|
|
for _, datasetID := range datasetIDs {
|
|
kb, err := kbDAO.GetByID(ctx, dao.DB, datasetID)
|
|
if err != nil || kb == nil {
|
|
continue
|
|
}
|
|
if HasKBTeamPermission(ctx, kb, userID, dao.NewTenantDAO()) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|