Skip to content

Wegent/kb entity permission - #1114

Closed
cocowh wants to merge 3 commits into
wecode-ai:mainfrom
cocowh:wegent/kb-entity-permission
Closed

cocowh wants to merge 3 commits into
wecode-ai:mainfrom
cocowh:wegent/kb-entity-permission

Conversation

@cocowh

@cocowh cocowh commented May 14, 2026 •

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • New Features

    • Added group search functionality for easier discovery and management.
    • Enabled adding members when creating knowledge bases.
    • Added group/namespace-level permission management alongside user-level access.
    • Introduced permission source tracking to show where access originates.
    • Enhanced permission management UI with support for multiple sharing mechanisms and role merging.
  • Documentation

    • Added developer guide for entity permission extension architecture.
    • Added user guide for knowledge base permission management.

Review Change Stack

cocowh and others added 3 commits May 14, 2026 00:51
…sions

- Add entity-based permission system via ResourceMember with entity_type + entity_id
- Implement knowledge share service with batch_add_members, add_member, remove_member,
  update_member_role, and list_members
- Refactor _add_initial_kb_members to use batch_add_members for single-transaction safety
- Relax InitialMemberCreate.entity_type from Literal[\"user\", \"namespace\"] to str
  to support custom entity types (e.g., org_department) via registerAuthSection
- Fix summary counts: deduplicate total_count and include shared_into_group_kbs in group_count
- Frontend: use backend summary data for sidebar counts (total, personal, group, organization)
- Frontend: hide \"from\" column in all/groups list views, show only in specific group view
- Fix hidden invalid character (U+00B7) in PermissionManagementTab.tsx import
- Add comprehensive tests for batch_add_members and initial KB member creation

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…ternal DB specs

- Make entity_id and entity_display_name NOT NULL with empty default
- Keep user_id as NOT NULL DEFAULT 0 instead of nullable
- Rename unique constraints to uniq_ prefix
- Sync _sync_user_id_from_entity to use 0 for non-user entities
- Update related test assertions

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented May 14, 2026 •

Copy link
Copy Markdown
Contributor

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: abd1e30e-507d-4612-a421-a75802331804

📥 Commits

Reviewing files that changed from the base of the PR and between 8f7195e and df41752.

📒 Files selected for processing (81)
  • AGENTS.md
  • backend/alembic/versions/20260506_d1e2f3a4b5c6_extend_resource_members_for_entity.py
  • backend/app/api/endpoints/adapter/attachments.py
  • backend/app/api/endpoints/adapter/chat.py
  • backend/app/api/endpoints/groups.py
  • backend/app/api/endpoints/knowledge.py
  • backend/app/api/endpoints/share.py
  • backend/app/core/cache.py
  • backend/app/models/resource_member.py
  • backend/app/models/user.py
  • backend/app/schemas/base_role.py
  • backend/app/schemas/knowledge.py
  • backend/app/schemas/share.py
  • backend/app/services/adapters/task_kinds/operations.py
  • backend/app/services/adapters/task_kinds/query_utils.py
  • backend/app/services/adapters/task_kinds/running_tasks.py
  • backend/app/services/adapters/team_kinds.py
  • backend/app/services/chat/access/permissions.py
  • backend/app/services/chat/storage/task_manager.py
  • backend/app/services/group_member_helper.py
  • backend/app/services/group_service.py
  • backend/app/services/knowledge/knowledge_service.py
  • backend/app/services/knowledge/task_knowledge_base_service.py
  • backend/app/services/readers/group_members.py
  • backend/app/services/readers/shared_teams.py
  • backend/app/services/share/__init__.py
  • backend/app/services/share/base_service.py
  • backend/app/services/share/external_entity_resolver.py
  • backend/app/services/share/knowledge_share_service.py
  • backend/app/services/share/namespace_entity_resolver.py
  • backend/app/services/share/team_share_service.py
  • backend/app/services/shared_task.py
  • backend/app/services/shared_team.py
  • backend/app/services/task_member_service.py
  • backend/tests/api/endpoints/test_group_namespace_permissions.py
  • backend/tests/api/endpoints/test_groups_api.py
  • backend/tests/api/test_batch_add_members.py
  • backend/tests/api/test_knowledge_base_initial_members.py
  • backend/tests/api/test_skills_api.py
  • backend/tests/services/adapters/test_team_kinds_copy.py
  • backend/tests/services/knowledge/test_external_entity_permissions.py
  • backend/tests/services/knowledge/test_namespace_knowledge_permissions.py
  • backend/tests/services/knowledge/test_permission_policy.py
  • backend/tests/services/share/test_check_entity_permission.py
  • backend/tests/services/share/test_namespace_entity_resolver.py
  • backend/tests/services/test_task_member_service_group_chat.py
  • docs/en/developer-guide/entity-permission-extension.md
  • docs/en/user-guide/knowledge/knowledge-base-guide.md
  • docs/zh/developer-guide/entity-permission-extension.md
  • docs/zh/user-guide/knowledge/knowledge-base-guide.md
  • frontend/src/__tests__/features/knowledge/document/document-detail-dialog.test.tsx
  • frontend/src/apis/groups.ts
  • frontend/src/apis/knowledge-permission.ts
  • frontend/src/features/knowledge/document/auth-section-registry.ts
  • frontend/src/features/knowledge/document/components/CommandPalette.tsx
  • frontend/src/features/knowledge/document/components/CreateKnowledgeBaseDialog.tsx
  • frontend/src/features/knowledge/document/components/DeleteFolderDialog.tsx
  • frontend/src/features/knowledge/document/components/DocumentPanel.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeBaseAuthSection.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeBaseForm.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeDetailPanel.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeDocumentPageDesktop.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeDocumentPageMobile.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeGroupListPage.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeSidebar/NavigationSection.tsx
  • frontend/src/features/knowledge/document/components/KnowledgeSidebar/index.tsx
  • frontend/src/features/knowledge/document/extension-loader.ts
  • frontend/src/features/knowledge/document/hooks/useFolders.ts
  • frontend/src/features/knowledge/document/hooks/useGroupKbs.ts
  • frontend/src/features/knowledge/document/hooks/useKnowledgeBaseDialogs.ts
  • frontend/src/features/knowledge/document/hooks/useKnowledgeSidebar.ts
  • frontend/src/features/knowledge/document/hooks/useKnowledgeUrlSync.ts
  • frontend/src/features/knowledge/document/pages/KnowledgeBaseClassicPageDesktop.tsx
  • frontend/src/features/knowledge/document/pages/KnowledgeBaseClassicPageMobile.tsx
  • frontend/src/features/knowledge/permission/components/PermissionManagementTab.tsx
  • frontend/src/features/knowledge/permission/components/add-namespace-dialog.tsx
  • frontend/src/features/knowledge/permission/permission-tab-registry.ts
  • frontend/src/features/knowledge/utils/share-source.ts
  • frontend/src/i18n/locales/en/knowledge.json
  • frontend/src/i18n/locales/zh-CN/knowledge.json
  • frontend/src/types/knowledge.ts

📝 Walkthrough

Walkthrough

Introduces polymorphic entity-based permissions across backend and frontend: database/schema migration, resolver framework, refactored share/knowledge services, group search, permission-source reporting, initial KB members, and comprehensive UI for managing user/namespace permissions, alongside extensive test and documentation updates.

Changes

Backend polymorphic membership and share infrastructure

Layer / File(s) Summary
DB migration to polymorphic ResourceMember
backend/alembic/...extend_resource_members_for_entity.py
Adds entity columns, migrates data, updates uniqueness, and indexes.
ResourceMember model + base-role utility + share schemas
backend/app/models/resource_member.py, backend/app/models/user.py, backend/app/schemas/base_role.py, backend/app/schemas/share.py
Entity fields, factory/listeners, highest-role helper, and entity-aware request/response schemas with permission sources.
External resolver framework + Namespace resolver
backend/app/services/share/external_entity_resolver.py, .../namespace_entity_resolver.py
Pluggable resolver API and built-in namespace resolver.
UnifiedShareService entity-aware refactor
backend/app/services/share/base_service.py
Entity-keyed member ops, dedupe, display-name resolution, stronger removal guards, and permission checks including entity bindings.
KnowledgeShareService permission aggregation and entity access
backend/app/services/share/knowledge_share_service.py
Aggregates multiple access sources, reports permission sources, and guards own-group sharing.

Knowledge service/group search and KB initial members

Layer / File(s) Summary
Schemas and endpoint for KB initial members
backend/app/schemas/knowledge.py, backend/app/api/endpoints/knowledge.py
Adds InitialMemberCreate, optional members on KB create, and batch-add handler.
Share API forwards entity fields and exposes permission sources
backend/app/api/endpoints/share.py
Forwards entity fields in add/batch and adds my-permission-sources endpoint.
Group search service and endpoint
backend/app/services/group_service.py, backend/app/api/endpoints/groups.py
Implements group search with pagination and membership scoping.
KnowledgeService entity-authorized KBs and grouping
backend/app/services/knowledge/knowledge_service.py
Unifies entity-authorized KB inclusion, dedupe, metadata batching, and summary recomputation.

Backend adapters/readers/services switch to entity fields

Layer / File(s) Summary
Entity-based membership across services
backend/app/api/endpoints/adapter/*, .../team_kinds.py, .../task_kinds/*, .../readers/*, .../shared_*, .../group_member_helper.py, .../team_share_service.py, .../task_member_service.py, .../knowledge/task_knowledge_base_service.py
Replaces user_id predicates with entity_type/entity_id for membership and access checks.

Frontend APIs, types, i18n, and share-source utils

Layer / File(s) Summary
Groups and permission APIs
frontend/src/apis/groups.ts, frontend/src/apis/knowledge-permission.ts
Adds group search; extends permission APIs for entity members and namespace adds.
Types, locales, and share-source helpers
frontend/src/types/knowledge.ts, frontend/src/i18n/locales/*/knowledge.json, frontend/src/features/knowledge/utils/share-source.ts
Extends types for members/folders/share metadata; updates translations; adds share-source formatting.

Permissions UI: registries, tabs, and AddNamespace dialog

Layer / File(s) Summary
Registries and extension loader
.../permission/permission-tab-registry.ts, .../document/auth-section-registry.ts, .../document/extension-loader.ts
Adds registries and dynamic extension loader.
PermissionManagementTab revamp + AddNamespaceDialog
.../permission/components/PermissionManagementTab.tsx, .../permission/components/add-namespace-dialog.tsx
Tabbed UI with user/namespace/external tabs and group-binding dialog.
KnowledgeBaseAuthSection and creation wiring
.../document/components/KnowledgeBaseAuthSection.tsx, CreateKnowledgeBaseDialog.tsx, KnowledgeBaseForm.tsx
Auth section for selecting initial members and wiring into KB creation.

Knowledge pages, sidebar, URL sync, and lists

Layer / File(s) Summary
Hooks, sidebar summary, and URL sync
.../hooks/*, .../KnowledgeSidebar/*
Adds/extends hooks, sidebar summary counts, and URL synchronization.
Desktop/Mobile pages, panels, and command palette
.../pages/*, .../components/*
Refactors pages to hooks/dialogs, passes kbNamespace, adds mobile permissions tab, and improves CommandPalette a11y.
Group list page grouped sections and from column
.../components/KnowledgeGroupListPage.tsx
Adds native/shared sections with an optional “from” column.

Test updates and new suites for entity permissions

Layer / File(s) Summary
All test changes
backend/tests/**/*, frontend/src/__tests__/*
Updates to entity fields and adds extensive tests for resolvers, KB initial members, and permission flows.

Docs and references for entity permission extension

Layer / File(s) Summary
Developer and user guides + AGENTS link
docs/**, AGENTS.md
Comprehensive design/usage docs in EN/ZH and reference link.

Miscellaneous fixes and utilities

Layer / File(s) Summary
Redis sync set and minor refactors
backend/app/core/cache.py
Adds RedisCache.set_from_sync; other minor refactors covered above.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Client
  participant ShareAPI
  participant UnifiedShareService
  participant Resolver as ExternalResolver
  participant DB

  Client->>ShareAPI: POST /share/members {entity_type, entity_id, role}
  ShareAPI->>UnifiedShareService: add_member(resource_id, entity_type, entity_id, role)
  UnifiedShareService->>DB: upsert ResourceMember by (entity_type, entity_id)
  alt entity_type != "user"
    UnifiedShareService->>Resolver: get_display_name/batch names
    Resolver-->>UnifiedShareService: display names (optional)
  end
  UnifiedShareService-->>Client: ResourceMemberResponse {display_name, source_type}

  Client->>ShareAPI: GET /KnowledgeBase/{id}/my-permission-sources
  ShareAPI->>UnifiedShareService: get_my_permission_sources(id, user_id)
  UnifiedShareService->>DB: fetch direct user and entity members
  UnifiedShareService->>Resolver: match_entity_bindings(user_id, entity_ids)
  Resolver-->>UnifiedShareService: matched entity_ids
  UnifiedShareService-->>Client: {role, sources[]}
Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

  • wecode-ai/Wegent#1092: Earlier iteration touching the same ResourceMember migration and entity-based permission refactors across share/knowledge services.

Suggested reviewers

  • qdaxb

Poem

I hop through tables, keys anew,
From user_id to entities true.
Namespaces nod, resolvers chime,
Sharing flows in perfect time.
In gardens of knowledge I grant a role—
A carrot for Maintainers, for Reporters a bowl.
Thump-thump! Access control.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
⚔️ Resolve merge conflicts
  • Resolve merge conflict in branch wegent/kb-entity-permission

@cocowh cocowh closed this May 14, 2026
@cocowh
cocowh deleted the wegent/kb-entity-permission branch May 19, 2026 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant