feat: add shared tool read permission functionality

Author: liuruibin

apps/common/utils/shared_resource_auth.py

@@ -13,7 +13,7 @@
 from common.exception.app_exception import AppApiException, AppUnauthorizedFailed
 from knowledge.models import Knowledge
 from system_manage.models import AuthTargetType, WorkspaceUserResourcePermission
-from tools.models import Tool
+from tools.models import Tool, ToolScope
 from users.serializers.user import is_workspace_manage
 
 
@@ -33,6 +33,8 @@ def _filter_user_authorized_tool_ids(ids: List[str], workspace_id: str, user_id=
         target__in=ids,
     )
     authorized_ids = {str(permission.target) for permission in permission_list if permission.permission_list}
+    shared_tool_ids = QuerySet(Tool).filter(id__in=ids, scope=ToolScope.SHARED).values_list('id', flat=True)
+    authorized_ids.update(str(tool_id) for tool_id in shared_tool_ids)
     return [str(i) for i in ids if str(i) in authorized_ids]
 
 
@@ -93,4 +95,4 @@ def validate_authorized_tool_ids(tool_ids: List[str], workspace_id: str, user_id
     authorized_ids.update(extra_authorized_set)
     if any(tool_id not in authorized_ids for tool_id in normalized_tool_ids):
         raise AppUnauthorizedFailed(403, "No permission to access")
-    return normalized_tool_ids
+    return normalized_tool_ids

apps/tools/views/tool.py

@@ -2,6 +2,7 @@
 from common.auth import TokenAuth
 from common.auth.authentication import check_batch_permissions, has_permissions
 from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.log.log import log
 from django.db.models import QuerySet
 from django.utils.translation import gettext_lazy as _
@@ -29,6 +30,20 @@
 from tools.serializers.tool import ToolBatchOperateSerializer, ToolSerializer, ToolTreeSerializer
 
 
+def get_shared_tool_read_permission(request, kwargs):
+    get_authorized_tool = DatabaseModelManage.get_model("get_authorized_tool")
+    if get_authorized_tool is None:
+        return None
+    shared_tool_query_set = QuerySet(Tool).filter(id=kwargs.get("tool_id"), scope=ToolScope.SHARED)
+    if get_authorized_tool(shared_tool_query_set, kwargs.get("workspace_id")).exists():
+        return ViewPermission(
+            [RoleConstants.USER.get_workspace_role(), RoleConstants.WORKSPACE_MANAGE.get_workspace_role()],
+            [PermissionConstants.TOOL_READ.get_workspace_permission()],
+            CompareConstants.OR,
+        )
+    return None
+
+
 def get_tool_operation_object(tool_id):
     tool_model = QuerySet(model=Tool).filter(id=tool_id).first()
     if tool_model is not None:
@@ -176,6 +191,7 @@ def put(self, request: Request, workspace_id: str, tool_id: str):
             tags=[_("Tool")],  # type: ignore
         )
         @has_permissions(
+            get_shared_tool_read_permission,
             PermissionConstants.TOOL_READ.get_workspace_tool_permission(),
             PermissionConstants.TOOL_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),