feat: org auth for app & dataset (#3498)

* feat: auth org resource permission

* feat: org auth support for app & dataset

packages/service/support/permission/controller.ts

@@ -22,6 +22,7 @@ import { MemberGroupSchemaType } from '@fastgpt/global/support/permission/member
 import { TeamMemberSchema } from '@fastgpt/global/support/user/team/type';
 import { UserModelSchema } from '@fastgpt/global/support/user/type';
 import { OrgSchemaType } from '@fastgpt/global/support/user/team/org/type';
+import { getOrgsWithParentByTmbId } from './org/controllers';
 
 /** get resource permission for a team member
  * If there is no permission for the team member, it will return undefined
@@ -40,15 +41,15 @@ export const getResourcePermission = async ({
   teamId: string;
   tmbId: string;
 } & (
-  | {
+    | {
       resourceType: 'team';
       resourceId?: undefined;
     }
-  | {
+    | {
       resourceType: Omit<PerResourceTypeEnum, 'team'>;
       resourceId: string;
     }
-)): Promise<PermissionValueType | undefined> => {
+  )): Promise<PermissionValueType | undefined> => {
   // Personal permission has the highest priority
   const tmbPer = (
     await MongoResourcePermission.findOne(
@@ -68,20 +69,45 @@ export const getResourcePermission = async ({
   }
 
   // If there is no personal permission, get the group permission
-  const groupIdList = (await getGroupsByTmbId({ tmbId, teamId })).map((item) => item._id);
+  const groupPer = await (async () => {
+    const groupIdList = (await getGroupsByTmbId({ tmbId, teamId })).map((item) => item._id);
 
-  if (groupIdList.length === 0) {
-    return undefined;
+    if (groupIdList.length === 0) {
+      return undefined;
+    }
+
+    // get the maximum permission of the group
+    const pers = (
+      await MongoResourcePermission.find(
+        {
+          teamId,
+          resourceType,
+          groupId: {
+            $in: groupIdList
+          },
+          resourceId
+        },
+        'permission'
+      ).lean()
+    ).map((item) => item.permission);
+
+    return getGroupPer(pers);
+  })();
+
+  const orgIds = await getOrgsWithParentByTmbId({ tmbId, teamId }).then((item) => Array.from(item));
+
+  if (orgIds.length === 0) {
+    return groupPer;
   }
 
-  // get the maximum permission of the group
-  const pers = (
+  // get the maximum permission of the org
+  const orgPers = (
     await MongoResourcePermission.find(
       {
         teamId,
         resourceType,
-        groupId: {
-          $in: groupIdList
+        orgId: {
+          $in: Array.from(orgIds)
         },
         resourceId
       },
@@ -89,9 +115,15 @@ export const getResourcePermission = async ({
     ).lean()
   ).map((item) => item.permission);
 
-  const groupPer = getGroupPer(pers);
+  const orgPer = getGroupPer(orgPers);
 
-  return groupPer;
+  if (groupPer === undefined) {
+    return orgPer;
+  } else if (orgPer === undefined) {
+    return groupPer;
+  }
+
+  return new Permission().addPer(groupPer, orgPer).value;
 };
 
 /* 仅取 members 不取 groups */
@@ -104,15 +136,15 @@ export async function getResourceAllClbs({
   teamId: string;
   session?: ClientSession;
 } & (
-  | {
+    | {
       resourceType: 'team';
       resourceId?: undefined;
     }
-  | {
+    | {
       resourceType: Omit<PerResourceTypeEnum, 'team'>;
       resourceId?: string | null;
     }
-)): Promise<ResourcePermissionType[]> {
+  )): Promise<ResourcePermissionType[]> {
   return MongoResourcePermission.find(
     {
       resourceType: resourceType,

packages/service/support/permission/org/controllers.ts

@@ -36,6 +36,19 @@ import { MongoOrgMemberModel } from './orgMemberSchema';
 export const getOrgsByTmbId = async ({ teamId, tmbId }: { teamId: string; tmbId: string }) =>
   MongoOrgMemberModel.find({ teamId, tmbId }, 'orgId').lean();
 
+export const getOrgsWithParentByTmbId = async ({ teamId, tmbId }: { teamId: string; tmbId: string }) =>
+  MongoOrgMemberModel.find({ teamId, tmbId }, 'orgId').lean().then((orgs) => {
+    const orgIds = new Set<string>();
+    for (const org of orgs) {
+      const orgId = String(org.orgId);
+      const parentIds = orgId.split('/').filter((id) => id);
+      for (const parentId of parentIds) {
+        orgIds.add(parentId);
+      }
+    }
+    return orgIds;
+  });
+
 export const getChildrenByOrg = async ({
   org,
   teamId,