fix: enhance query filtering by including workspace_id in various model lookups

apps/application/serializers/application.py

@@ -1779,6 +1779,11 @@ def batch_delete(self, instance: Dict, with_valid=True):
             self.is_valid(raise_exception=True)
         id_list = instance.get("id_list")
         workspace_id = self.data.get("workspace_id")
+        id_list = list(
+            QuerySet(Application)
+            .filter(id__in=id_list, workspace_id=workspace_id)
+            .values_list("id", flat=True)
+        )
 
         QuerySet(ApplicationVersion).filter(application_id__in=id_list).delete()
         QuerySet(ResourceMapping).filter(Q(target_id__in=id_list) | Q(source_id__in=id_list)).delete()

apps/application/serializers/application_chat_record.py

@@ -11,6 +11,9 @@
 from typing import Dict
 
 import uuid_utils.compat as uuid
+from application.models import Application, ApplicationAccessToken, ChatRecord
+from application.serializers.application_chat import ChatCountSerializer
+from application.serializers.common import ChatInfo
 from common.auth.authentication import get_is_permissions
 from common.chunk import text_to_chunk
 from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
@@ -20,18 +23,15 @@
 from django.db import transaction
 from django.db.models import QuerySet
 from django.db.models.aggregates import Max, Min
-from django.utils.translation import gettext_lazy as _, gettext
+from django.utils.translation import gettext
+from django.utils.translation import gettext_lazy as _
 from knowledge.models import Document, Knowledge, Paragraph, Problem, ProblemParagraphMapping
 from knowledge.serializers.common import get_embedding_model_id_by_knowledge_id, update_document_char_length
 from knowledge.serializers.paragraph import ParagraphSerializers
 from knowledge.task.embedding import embedding_by_paragraph, embedding_by_paragraph_list
 from rest_framework import serializers
 from rest_framework.utils.formatting import lazy_format
 
-from application.models import Application, ApplicationAccessToken, ChatRecord
-from application.serializers.application_chat import ChatCountSerializer
-from application.serializers.common import ChatInfo
-
 
 class ChatRecordSerializerModel(serializers.ModelSerializer):
     class Meta:
@@ -70,10 +70,9 @@ def is_valid(self, *, debug=False, raise_exception=False):
             query_set = query_set.filter(workspace_id=workspace_id)
         if not query_set.exists():
             raise AppApiException(500, _("Application id does not exist"))
-        if (
-            not ChatRecord.objects.filter(chat__application_id=self.data.get("application_id")).exists()
-            and ChatRecord.objects.filter(chat_id=self.data.get("chat_id")).exists()
-        ):
+        if not ChatRecord.objects.filter(
+            chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id")
+        ).exists():
             raise AppApiException(500, _("Chat records for the application do not exist"))
         application_access_token = (
             QuerySet(ApplicationAccessToken).filter(application_id=self.data.get("application_id")).first()
@@ -91,7 +90,9 @@ def get_chat_record(self):
             ]
             if chat_record_list is not None and len(chat_record_list):
                 return chat_record_list[-1]
-        return QuerySet(ChatRecord).filter(id=chat_record_id, chat_id=chat_id).first()
+        return QuerySet(ChatRecord).filter(
+            id=chat_record_id, chat_id=chat_id, chat__application_id=self.data.get("application_id")
+        ).first()
 
     def one(self, debug):
         self.is_valid(debug=debug, raise_exception=True)
@@ -125,20 +126,20 @@ def is_valid(self, *, raise_exception=False):
             query_set = query_set.filter(workspace_id=workspace_id)
         if not query_set.exists():
             raise AppApiException(500, _("Application id does not exist"))
-        if (
-            not ChatRecord.objects.filter(chat__application_id=self.data.get("application_id")).exists()
-            and ChatRecord.objects.filter(chat_id=self.data.get("chat_id")).exists()
-        ):
+        if not ChatRecord.objects.filter(
+            chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id")
+        ).exists():
             raise AppApiException(500, _("Chat records for the application do not exist"))
 
     def list(self, with_valid=True):
         if with_valid:
             self.is_valid(raise_exception=True)
-        QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id"))
         order_by = "create_time" if self.data.get("order_asc") is None or self.data.get("order_asc") else "-create_time"
         return [
             ChatRecordSerializerModel(chat_record).data
-            for chat_record in QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id")).order_by(order_by)
+            for chat_record in QuerySet(ChatRecord).filter(
+                chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id")
+            ).order_by(order_by)
         ]
 
     @staticmethod
@@ -233,7 +234,9 @@ def page(self, current_page: int, page_size: int, with_valid=True, show_source=N
         page = page_search(
             current_page,
             page_size,
-            QuerySet(ChatRecord).filter(chat_id=self.data.get("chat_id")).order_by(order_by),
+            QuerySet(ChatRecord).filter(
+                chat_id=self.data.get("chat_id"), chat__application_id=self.data.get("application_id")
+            ).order_by(order_by),
             post_records_handler=lambda chat_record: self.reset_chat_record(chat_record, show_source, show_exec),
         )
         return page

apps/chat/serializers/chat_record.py

@@ -42,6 +42,7 @@ class Meta:
 
 
 class VoteSerializer(serializers.Serializer):
+    application_id = serializers.UUIDField(required=True, label=_("Application ID"))
     chat_id = serializers.UUIDField(required=True, label=_("Conversation ID"))
 
     chat_record_id = serializers.UUIDField(required=True,
@@ -59,7 +60,8 @@ def vote(self, instance: Dict, with_valid=True):
                                       "Voting on the current session minutes, please do not send repeated requests"))
         try:
             chat_record_details_model = QuerySet(ChatRecord).get(id=self.data.get('chat_record_id'),
-                                                                 chat_id=self.data.get('chat_id'))
+                                                                 chat_id=self.data.get('chat_id'),
+                                                                 chat__application_id=self.data.get('application_id'))
             if chat_record_details_model is None:
                 raise AppApiException(500, gettext("Non-existent conversation chat_record_id"))
             vote_status = instance.get("vote_status")

apps/chat/views/chat_record.py

@@ -36,7 +36,8 @@ class VoteView(APIView):
     )
     def put(self, request: Request, chat_id: str, chat_record_id: str):
         return result.success(VoteSerializer(
-            data={'chat_id': chat_id,
+            data={'application_id': request.auth.application_id,
+                  'chat_id': chat_id,
                   'chat_record_id': chat_record_id
                   }).vote(request.data))
 

apps/folders/serializers/folder.py

@@ -178,12 +178,20 @@ class Operate(serializers.Serializer):
         source = serializers.CharField(required=True, label=_('source'))
         user_id = serializers.UUIDField(required=True, label=_('user id'))
 
+        def is_valid(self, *, raise_exception=False):
+            super().is_valid(raise_exception=True)
+            Folder = get_folder_type(self.data.get('source'))  # noqa
+            if Folder is None or not QuerySet(Folder).filter(
+                    id=self.data.get('id'), workspace_id=self.data.get('workspace_id')
+            ).exists():
+                raise serializers.ValidationError(_('Folder does not exist'))
+
         @transaction.atomic
         def edit(self, instance):
             self.is_valid(raise_exception=True)
             Folder = get_folder_type(self.data.get('source'))  # noqa
             current_id = self.data.get('id')
-            current_node = Folder.objects.get(id=current_id)
+            current_node = Folder.objects.get(id=current_id, workspace_id=self.data.get('workspace_id'))
             if current_node is None:
                 raise serializers.ValidationError(_('Folder does not exist'))
             # 模块间的移动
@@ -232,15 +240,15 @@ def edit(self, instance):
         def one(self):
             self.is_valid(raise_exception=True)
             Folder = get_folder_type(self.data.get('source'))  # noqa
-            folder = QuerySet(Folder).filter(id=self.data.get('id')).first()
+            folder = QuerySet(Folder).filter(id=self.data.get('id'), workspace_id=self.data.get('workspace_id')).first()
             return FolderSerializer(folder).data
 
         @transaction.atomic
         def delete(self):
             self.is_valid(raise_exception=True)
             Folder = get_folder_type(self.data.get('source'))  # noqa
             Source = get_source_type(self.data.get('source'))  # noqa
-            folder = Folder.objects.filter(id=self.data.get('id')).first()
+            folder = Folder.objects.filter(id=self.data.get('id'), workspace_id=self.data.get('workspace_id')).first()
             if not folder:
                 raise serializers.ValidationError(_('Folder does not exist'))
             if folder.id == folder.workspace_id:

apps/knowledge/serializers/knowledge_workflow.py

@@ -113,6 +113,15 @@ class KnowledgeWorkflowActionSerializer(serializers.Serializer):
     workspace_id = serializers.CharField(required=True, label=_("workspace id"))
     knowledge_id = serializers.UUIDField(required=True, label=_("knowledge id"))
 
+    def is_valid(self, *, raise_exception=False):
+        super().is_valid(raise_exception=True)
+        workspace_id = self.data.get("workspace_id")
+        query_set = QuerySet(Knowledge).filter(id=self.data.get("knowledge_id"))
+        if workspace_id:
+            query_set = query_set.filter(workspace_id=workspace_id)
+        if not query_set.exists():
+            raise AppApiException(500, _("Knowledge id does not exist"))
+
     def get_query_set(self, instance: Dict):
         query_set = (
             QuerySet(KnowledgeAction)
@@ -266,11 +275,26 @@ class Operate(serializers.Serializer):
         knowledge_id = serializers.UUIDField(required=True, label=_("knowledge id"))
         id = serializers.UUIDField(required=True, label=_("knowledge action id"))
 
+        def is_valid(self, *, raise_exception=False):
+            super().is_valid(raise_exception=True)
+            workspace_id = self.data.get("workspace_id")
+            query_set = QuerySet(Knowledge).filter(id=self.data.get("knowledge_id"))
+            if workspace_id:
+                query_set = query_set.filter(workspace_id=workspace_id)
+            if not query_set.exists():
+                raise AppApiException(500, _("Knowledge id does not exist"))
+            if not QuerySet(KnowledgeAction).filter(
+                id=self.data.get("id"), knowledge_id=self.data.get("knowledge_id")
+            ).exists():
+                raise AppApiException(500, _("Knowledge action does not exist"))
+
         def one(self, is_valid=True):
             if is_valid:
                 self.is_valid(raise_exception=True)
             knowledge_action_id = self.data.get("id")
-            knowledge_action = QuerySet(KnowledgeAction).filter(id=knowledge_action_id).first()
+            knowledge_action = QuerySet(KnowledgeAction).filter(
+                id=knowledge_action_id, knowledge_id=self.data.get("knowledge_id")
+            ).first()
             return {
                 "id": knowledge_action_id,
                 "knowledge_id": knowledge_action.knowledge_id,
@@ -288,9 +312,11 @@ def cancel(self, is_valid=True):
                 True,
                 version=Cache_Version.KNOWLEDGE_WORKFLOW_INTERRUPTED.get_version(),
             )
-            QuerySet(KnowledgeAction).filter(id=knowledge_action_id, state__in=[State.STARTED, State.PENDING]).update(
-                state=State.REVOKE
-            )
+            QuerySet(KnowledgeAction).filter(
+                id=knowledge_action_id,
+                knowledge_id=self.data.get("knowledge_id"),
+                state__in=[State.STARTED, State.PENDING],
+            ).update(state=State.REVOKE)
             return True
 
 

apps/knowledge/serializers/problem.py

@@ -81,7 +81,7 @@ def delete(self, problem_id_list: List, with_valid=True):
                 problem_id__in=problem_id_list)
             source_ids = [row.id for row in problem_paragraph_mapping_list]
             problem_paragraph_mapping_list.delete()
-            QuerySet(Problem).filter(id__in=problem_id_list).delete()
+            QuerySet(Problem).filter(id__in=problem_id_list, knowledge_id=knowledge_id).delete()
             delete_embedding_by_source_ids(source_ids)
             return True
 
@@ -164,7 +164,8 @@ def list_paragraph(self, with_valid=True):
         def one(self, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
-            return ProblemInstanceSerializer(QuerySet(Problem).get(**{'id': self.data.get('problem_id')})).data
+            return ProblemInstanceSerializer(QuerySet(Problem).get(
+                id=self.data.get('problem_id'), knowledge_id=self.data.get('knowledge_id'))).data
 
         @transaction.atomic
         def delete(self, with_valid=True):
@@ -175,7 +176,9 @@ def delete(self, with_valid=True):
                 problem_id=self.data.get('problem_id'))
             source_ids = [row.id for row in problem_paragraph_mapping_list]
             problem_paragraph_mapping_list.delete()
-            QuerySet(Problem).filter(id=self.data.get('problem_id')).delete()
+            QuerySet(Problem).filter(
+                id=self.data.get('problem_id'), knowledge_id=self.data.get('knowledge_id')
+            ).delete()
             delete_embedding_by_source_ids(source_ids)
             return True
 

apps/knowledge/serializers/tag.py

@@ -106,7 +106,7 @@ def is_valid(self, *, raise_exception=False):
         @transaction.atomic
         def edit(self, instance: Dict):
             self.is_valid(raise_exception=True)
-            tag = QuerySet(Tag).get(id=self.data.get('tag_id'))
+            tag = QuerySet(Tag).filter(id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id')).first()
             if tag is None:
                 raise AppApiException(500, _('Tag id does not exist'))
 
@@ -150,7 +150,9 @@ def delete(self, delete_type: str):
             self.is_valid(raise_exception=True)
             if delete_type == 'key':
                 # 删除同一knowledge_id下相同key的所有标签
-                tag = QuerySet(Tag).get(id=self.data.get('tag_id'))
+                tag = QuerySet(Tag).filter(
+                    id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id')
+                ).first()
                 if tag is None:
                     raise AppApiException(500, _('Tag id does not exist'))
                 QuerySet(Tag).filter(
@@ -160,7 +162,7 @@ def delete(self, delete_type: str):
                 QuerySet(DocumentTag).filter(tag_id=tag.id).delete()
             else:
                 # 仅删除当前标签
-                QuerySet(Tag).filter(id=self.data.get('tag_id')).delete()
+                QuerySet(Tag).filter(id=self.data.get('tag_id'), knowledge_id=self.data.get('knowledge_id')).delete()
                 QuerySet(DocumentTag).filter(tag_id=self.data.get('tag_id')).delete()
 
     class BatchDelete(serializers.Serializer):
@@ -185,7 +187,7 @@ def batch_delete(self):
                 return
 
             # 获取要删除的标签的key
-            tags_to_delete = QuerySet(Tag).filter(id__in=tag_ids)
+            tags_to_delete = QuerySet(Tag).filter(id__in=tag_ids, knowledge_id=self.data.get('knowledge_id'))
             keys_to_delete = set(tags_to_delete.values_list('key', flat=True))
 
             # 删除具有相同key的所有标签

apps/knowledge/serializers/termbase.py

@@ -47,15 +47,15 @@ def is_valid(self, *, raise_exception=False):
         def delete(self, problem_id_list: List, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
-            QuerySet(Termbase).filter(id__in=problem_id_list).delete()
+            QuerySet(Termbase).filter(id__in=problem_id_list, knowledge_id=self.data.get("knowledge_id")).delete()
             return True
 
         def export(self, problem_id_list: List, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
             terms = (
                 QuerySet(Termbase)
-                .filter(id__in=problem_id_list)
+                .filter(id__in=problem_id_list, knowledge_id=self.data.get("knowledge_id"))
                 .order_by("-create_time")
                 .values_list("content", flat=True)
             )
@@ -78,13 +78,16 @@ def is_valid(self, *, raise_exception=False):
         def one(self, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
-            return TermbaseInstanceSerializer(QuerySet(Termbase).get(**{"id": self.data.get("termbase_id")})).data
+            return TermbaseInstanceSerializer(QuerySet(Termbase).get(
+                id=self.data.get("termbase_id"), knowledge_id=self.data.get("knowledge_id"))).data
 
         @transaction.atomic
         def delete(self, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
-            QuerySet(Termbase).filter(id=self.data.get("termbase_id")).delete()
+            QuerySet(Termbase).filter(
+                id=self.data.get("termbase_id"), knowledge_id=self.data.get("knowledge_id")
+            ).delete()
             return True
 
         @transaction.atomic

apps/models_provider/serializers/model_serializer.py

@@ -172,15 +172,17 @@ def one_meta(self, with_valid=False):
         def pause_download(self, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
-            QuerySet(Model).filter(id=self.data.get("id")).update(status=Status.PAUSE_DOWNLOAD)
+            QuerySet(Model).filter(
+                id=self.data.get("id"), workspace_id=self.data.get("workspace_id")
+            ).update(status=Status.PAUSE_DOWNLOAD)
             return True
 
         @transaction.atomic
         def delete(self, with_valid=True):
             if with_valid:
-                super().is_valid(raise_exception=True)
+                self.is_valid(raise_exception=True)
             model_id = self.data.get("id")
-            model = Model.objects.filter(id=model_id).first()
+            model = Model.objects.filter(id=model_id, workspace_id=self.data.get("workspace_id")).first()
             if model is None:
                 return True
             QuerySet(WorkspaceUserResourcePermission).filter(target=model_id).delete()
@@ -207,8 +209,10 @@ def delete(self, with_valid=True):
 
         def edit(self, instance: Dict, user_id: str, with_valid=True):
             if with_valid:
-                super().is_valid(raise_exception=True)
-            model = QuerySet(Model).filter(id=self.data.get("id")).first()
+                self.is_valid(raise_exception=True)
+            model = QuerySet(Model).filter(
+                id=self.data.get("id"), workspace_id=self.data.get("workspace_id")
+            ).first()
 
             credential, model_credential, provider_handler = ModelSerializer.Edit(data={**instance}).is_valid(
                 model=model

apps/oss/views/file.py

@@ -6,6 +6,8 @@
 from rest_framework.views import Request
 from common.auth import TokenAuth, AllTokenAuth
 from common.constants.permission_constants import ChatAuth
+from common.auth.authentication import has_permissions
+from common.constants.permission_constants import RoleConstants
 from common.log.log import log
 from common.result import result
 from knowledge.api.file import FileUploadAPI, FileGetAPI, GetUrlContentAPI
@@ -64,6 +66,7 @@ class Operate(APIView):
             tags=[_('File')]  # type: ignore
         )
         @log(menu='file', operate='Delete file')
+        @has_permissions(RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER)
         def delete(self, request: Request, file_id: str):
             return result.success(FileSerializer.Operate(data={'id': file_id}).delete())