From 321e816d2a40c9dd8a1e45989f85aaec2feff1e0 Mon Sep 17 00:00:00 2001
From: wxg0103 <727495428@qq.com>
Date: Wed, 28 Oct 2026 10:04:43 +0800
Subject: [PATCH] fix: enhance resource authorization by updating permission
 checks to include WORKSPACE_MANAGE role

---
 .../modules/system/authorization.ts           | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/ui/src/permission/modules/system/authorization.ts b/ui/src/permission/modules/system/authorization.ts
index 4b586fcb52a..f30b3f09906 100644
--- a/ui/src/permission/modules/system/authorization.ts
+++ b/ui/src/permission/modules/system/authorization.ts
@@ -1,7 +1,6 @@
 /** 系统「资源授权」按钮权限（按资源类型分组）。$perm.authorization.application.read() ... */
 
-import { canSys } from '../../policy'
-import { PermissionConstants as P } from '../../core'
+import { PermissionConstants as P, hasPermission, RoleConstants, Compare } from '../../core'
 
 export default {
   /**
@@ -11,7 +10,9 @@ export default {
     /**
      * 系统「资源授权」智能体只读权限
      * */
-    read: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_READ), edit: () => canSys(P.APPLICATION_RESOURCE_PERMISSION_EDIT) },
+    read: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.APPLICATION_RESOURCE_PERMISSION_READ], Compare.OR),
+    edit: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.APPLICATION_RESOURCE_PERMISSION_EDIT], Compare.OR),
+  },
   /**
    * 系统「资源授权」知识库权限
    * */
@@ -19,7 +20,9 @@ export default {
     /**
      * 系统「资源授权」知识库只读权限
      * */
-    read: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_READ), edit: () => canSys(P.KNOWLEDGE_RESOURCE_PERMISSION_EDIT) },
+    read: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.KNOWLEDGE_RESOURCE_PERMISSION_READ], Compare.OR),
+    edit: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.KNOWLEDGE_RESOURCE_PERMISSION_EDIT], Compare.OR),
+  },
   /**
    * 系统「资源授权」工具权限
    * */
@@ -27,7 +30,9 @@ export default {
     /**
      * 系统「资源授权」工具只读权限
      * */
-    read: () => canSys(P.TOOL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.TOOL_RESOURCE_PERMISSION_EDIT) },
+    read: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.TOOL_RESOURCE_PERMISSION_READ], Compare.OR),
+    edit: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.TOOL_RESOURCE_PERMISSION_EDIT], Compare.OR),
+  },
   /**
    * 系统「资源授权」模型权限
    * */
@@ -35,5 +40,7 @@ export default {
     /**
      * 系统「资源授权」模型只读权限
      * */
-    read: () => canSys(P.MODEL_RESOURCE_PERMISSION_READ), edit: () => canSys(P.MODEL_RESOURCE_PERMISSION_EDIT) },
+    read: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.MODEL_RESOURCE_PERMISSION_READ], Compare.OR),
+    edit: () => hasPermission([RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, P.MODEL_RESOURCE_PERMISSION_EDIT], Compare.OR),
+  },
 }