Team group (#2864)

* feat(member-group): Team (#2616)

* feat: member-group schema define

* feat(fe): create group

* feat: add group edit modal

* feat(fe): add avatar group component

* feat: edit group
fix: permission select menu style

* feat: bio-mode support for select-member component

* fix: avatar group key unique

* feat: group manage

* feat: divide member into group and clbs

* feat: finish team permission

* chore: adjust

* fix: get clbs

* perf: groups code

* pref: member group for team (#2706)

* chore: fe adjust
fix: remove the member from groups when removing from team
feat: change the groups avatar when updating the team's avatar

* chore: DefaultGroupName as a constant string ''

* fix: create default group when create team for root

* feat: comment

* feat: 4811 init

* pref: member group for team (#2732)

* chore: default group name

* feat: get default group when get by tmbid

* feat(fe): adjust

* member ui

* fix: delete group (#2736)

* perf: init4811

* pref: member group (#2818)

* fix: update clb per then refetch clb list

* fix: calculate group permission

* feat(fe): group tag

* refactor(fe): team and group manage

* feat: manage group member

* feat: add group transfer owner modal

* feat: group manage member

* chore: adjust the file structure

* pref: member group

* chore: adjust fe style

* fix: ts error

* chore: fe adjust

* chore: fe adjust

* chore: adjust

* chore: adjust the code

* perf: i18n and schema name

* pref: member-group (#2862)

* feat: group list ordered by updateTime

* fix: transfer ownership of group when deleting member

* fix: i18n fix

* feat: can not set member as admin/owner when user is not active

* fix: GroupInfoModal hover input do not change color

* fix(fe): searchinput do not scroll

* perf: team group ui

* doc

* remove enum

---------

Co-authored-by: Finley Ge <32237950+FinleyGe@users.noreply.github.com>

packages/service/support/permission/app/auth.ts

@@ -86,7 +86,7 @@ export const authAppByTmbId = async ({
           resourceId: appId,
           resourceType: PerResourceTypeEnum.app
         });
-        const Per = new AppPermission({ per: rp?.permission ?? app.defaultPermission, isOwner });
+        const Per = new AppPermission({ per: rp ?? app.defaultPermission, isOwner });
         return {
           Per,
           defaultPermission: app.defaultPermission

packages/service/support/permission/controller.ts

@@ -8,51 +8,113 @@ import { authOpenApiKey } from '../openapi/auth';
 import { FileTokenQuery } from '@fastgpt/global/common/file/type';
 import { MongoResourcePermission } from './schema';
 import { ClientSession } from 'mongoose';
-import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
-import { ResourcePermissionType } from '@fastgpt/global/support/permission/type';
+import {
+  PermissionValueType,
+  ResourcePermissionType
+} from '@fastgpt/global/support/permission/type';
 import { bucketNameMap } from '@fastgpt/global/common/file/constants';
 import { addMinutes } from 'date-fns';
+import { getGroupsByTmbId } from './memberGroup/controllers';
+import { Permission } from '@fastgpt/global/support/permission/controller';
 
+/** get resource permission for a team member
+ * If there is no permission for the team member, it will return undefined
+ * @param resourceType: PerResourceTypeEnum
+ * @param teamId
+ * @param tmbId
+ * @param resourceId
+ * @returns PermissionValueType | undefined
+ */
 export const getResourcePermission = async ({
   resourceType,
   teamId,
   tmbId,
   resourceId
 }: {
-  resourceType: PerResourceTypeEnum;
   teamId: string;
   tmbId: string;
-  resourceId?: string;
-}) => {
-  const per = await MongoResourcePermission.findOne({
-    tmbId,
-    teamId,
-    resourceType,
-    resourceId
-  });
+} & (
+  | {
+      resourceType: 'team';
+      resourceId?: undefined;
+    }
+  | {
+      resourceType: Omit<PerResourceTypeEnum, 'team'>;
+      resourceId: string;
+    }
+)): Promise<PermissionValueType | undefined> => {
+  // Personal permission has the highest priority
+  const tmbPer = (
+    await MongoResourcePermission.findOne(
+      {
+        tmbId,
+        teamId,
+        resourceType,
+        resourceId
+      },
+      'permission'
+    ).lean()
+  )?.permission;
 
-  if (!per) {
-    return null;
+  // could be 0
+  if (tmbPer !== undefined) {
+    return tmbPer;
   }
-  return per;
+
+  // If there is no personal permission, get the group permission
+  const groupIdList = (await getGroupsByTmbId({ tmbId, teamId })).map((item) => item._id);
+
+  if (groupIdList.length === 0) {
+    return undefined;
+  }
+
+  // get the maximum permission of the group
+  const pers = (
+    await MongoResourcePermission.find(
+      {
+        teamId,
+        resourceType,
+        groupId: {
+          $in: groupIdList
+        },
+        resourceId
+      },
+      'permission'
+    ).lean()
+  ).map((item) => item.permission);
+
+  const groupPer = getGroupPer(pers);
+
+  return groupPer;
 };
+
+/* 仅取 members 不取 groups */
 export async function getResourceAllClbs({
   resourceId,
   teamId,
   resourceType,
   session
 }: {
-  resourceId: ParentIdType;
   teamId: string;
-  resourceType: PerResourceTypeEnum;
   session?: ClientSession;
-}): Promise<ResourcePermissionType[]> {
-  if (!resourceId) return [];
+} & (
+  | {
+      resourceType: 'team';
+      resourceId?: undefined;
+    }
+  | {
+      resourceType: Omit<PerResourceTypeEnum, 'team'>;
+      resourceId?: string | null;
+    }
+)): Promise<ResourcePermissionType[]> {
   return MongoResourcePermission.find(
     {
       resourceId,
       resourceType: resourceType,
-      teamId: teamId
+      teamId: teamId,
+      groupId: {
+        $exists: false
+      }
     },
     null,
     {
@@ -60,6 +122,7 @@ export async function getResourceAllClbs({
     }
   ).lean();
 }
+
 export const delResourcePermissionById = (id: string) => {
   return MongoResourcePermission.findByIdAndRemove(id);
 };
@@ -301,3 +364,11 @@ export const authFileToken = (token?: string) =>
       });
     });
   });
+
+export const getGroupPer = (groups: PermissionValueType[] = []) => {
+  if (groups.length === 0) {
+    return undefined;
+  }
+
+  return new Permission().addPer(...groups).value;
+};

packages/service/support/permission/dataset/auth.ts

@@ -78,7 +78,7 @@ export const authDatasetByTmbId = async ({
           resourceType: PerResourceTypeEnum.dataset
         });
         const Per = new DatasetPermission({
-          per: rp?.permission ?? dataset.defaultPermission,
+          per: rp ?? dataset.defaultPermission,
           isOwner
         });
         return {

packages/service/support/permission/inheritPermission.ts

@@ -3,8 +3,9 @@ import { MongoResourcePermission } from './schema';
 import { ClientSession, Model } from 'mongoose';
 import { NullPermission, PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
 import { PermissionValueType } from '@fastgpt/global/support/permission/type';
-import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
 import { getResourceAllClbs } from './controller';
+import { RequireOnlyOne } from '@fastgpt/global/common/type/utils';
+import { ParentIdType } from '@fastgpt/global/common/parentFolder/type';
 
 export type SyncChildrenPermissionResourceType = {
   _id: string;
@@ -14,8 +15,10 @@ export type SyncChildrenPermissionResourceType = {
 };
 export type UpdateCollaboratorItem = {
   permission: PermissionValueType;
+} & RequireOnlyOne<{
   tmbId: string;
-};
+  groupId: string;
+}>;
 
 // sync the permission to all children folders.
 export async function syncChildrenPermission({

packages/service/support/permission/memberGroup/controllers.ts

@@ -0,0 +1,183 @@
+import { MemberGroupSchemaType } from '@fastgpt/global/support/permission/memberGroup/type';
+import { MongoGroupMemberModel } from './groupMemberSchema';
+import { TeamMemberSchema } from '@fastgpt/global/support/user/team/type';
+import { PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { MongoResourcePermission } from '../schema';
+import { getGroupPer, parseHeaderCert } from '../controller';
+import { MongoMemberGroupModel } from './memberGroupSchema';
+import { DefaultGroupName } from '@fastgpt/global/support/user/team/group/constant';
+import { ClientSession } from 'mongoose';
+import { GroupMemberRole } from '@fastgpt/global/support/permission/memberGroup/constant';
+import { AuthModeType, AuthResponseType } from '../type';
+import { TeamErrEnum } from '@fastgpt/global/common/error/code/team';
+import { TeamPermission } from '@fastgpt/global/support/permission/user/controller';
+import { getTmbInfoByTmbId } from '../../user/team/controller';
+
+/**
+ * Get the default group of a team
+ * @param{Object} obj
+ * @param{string} obj.teamId
+ * @param{ClientSession} obj.session
+ */
+export const getTeamDefaultGroup = async ({
+  teamId,
+  session
+}: {
+  teamId: string;
+  session?: ClientSession;
+}) => {
+  const group = await MongoMemberGroupModel.findOne({ teamId, name: DefaultGroupName }, undefined, {
+    session
+  }).lean();
+
+  // Create the default group if it does not exist
+  if (!group) {
+    const [group] = await MongoMemberGroupModel.create(
+      [
+        {
+          teamId,
+          name: DefaultGroupName
+        }
+      ],
+      { session }
+    );
+
+    return group;
+  }
+  return group;
+};
+
+export const getGroupsByTmbId = async ({
+  tmbId,
+  teamId,
+  role
+}: {
+  tmbId: string;
+  teamId: string;
+  role?: `${GroupMemberRole}`[];
+}) =>
+  (
+    await Promise.all([
+      (
+        await MongoGroupMemberModel.find({
+          tmbId,
+          groupId: {
+            $exists: true
+          },
+          role: role ? { $in: role } : undefined
+        })
+          .populate('groupId')
+          .lean()
+      ).map((item) => {
+        return {
+          ...(item.groupId as any as MemberGroupSchemaType)
+        };
+      }),
+
+      role ? [] : getTeamDefaultGroup({ teamId })
+    ])
+  ).flat();
+
+export const getTmbByGroupId = async (groupId: string) => {
+  return (
+    await MongoGroupMemberModel.find({
+      groupId
+    })
+      .populate('tmbId')
+      .lean()
+  ).map((item) => {
+    return {
+      ...(item.tmbId as any as MemberGroupSchemaType)
+    };
+  });
+};
+
+export const getGroupMembersByGroupId = async (groupId: string) => {
+  return await MongoGroupMemberModel.find({
+    groupId
+  }).lean();
+};
+
+export const getGroupMembersWithInfoByGroupId = async (groupId: string) => {
+  return (
+    await MongoGroupMemberModel.find({
+      groupId
+    })
+      .populate('tmbId')
+      .lean()
+  ).map((item) => item.tmbId) as any as TeamMemberSchema[]; // HACK: type casting
+};
+
+/**
+ * Get tmb's group permission: the maximum permission of the group
+ * @param tmbId
+ * @param resourceId
+ * @param resourceType
+ * @returns the maximum permission of the group
+ */
+export const getGroupPermission = async ({
+  tmbId,
+  resourceId,
+  teamId,
+  resourceType
+}: {
+  tmbId: string;
+  teamId: string;
+} & (
+  | {
+      resourceId?: undefined;
+      resourceType: 'team';
+    }
+  | {
+      resourceId: string;
+      resourceType: Omit<PerResourceTypeEnum, 'team'>;
+    }
+)) => {
+  const groupIds = (await getGroupsByTmbId({ tmbId, teamId })).map((item) => item._id);
+  const groupPermissions = (
+    await MongoResourcePermission.find({
+      groupId: {
+        $in: groupIds
+      },
+      resourceType,
+      resourceId,
+      teamId
+    })
+  ).map((item) => item.permission);
+
+  return getGroupPer(groupPermissions);
+};
+
+// auth group member role
+export const authGroupMemberRole = async ({
+  groupId,
+  role,
+  ...props
+}: {
+  groupId: string;
+  role: `${GroupMemberRole}`[];
+} & AuthModeType): Promise<AuthResponseType> => {
+  const result = await parseHeaderCert(props);
+  const { teamId, tmbId, isRoot } = result;
+  if (isRoot) {
+    return {
+      ...result,
+      permission: new TeamPermission({
+        isOwner: true
+      }),
+      teamId,
+      tmbId
+    };
+  }
+  const groupMember = await MongoGroupMemberModel.findOne({ groupId, tmbId });
+  const tmb = await getTmbInfoByTmbId({ tmbId });
+  if (tmb.permission.hasManagePer || (groupMember && role.includes(groupMember.role))) {
+    return {
+      ...result,
+      permission: tmb.permission,
+      teamId,
+      tmbId
+    };
+  }
+  return Promise.reject(TeamErrEnum.unAuthTeam);
+};

packages/service/support/permission/memberGroup/groupMemberSchema.ts

@@ -0,0 +1,44 @@
+import { TeamMemberCollectionName } from '@fastgpt/global/support/user/team/constant';
+import { connectionMongo, getMongoModel } from '../../../common/mongo';
+import { MemberGroupCollectionName } from './memberGroupSchema';
+import { GroupMemberSchemaType } from '@fastgpt/global/support/permission/memberGroup/type';
+import { GroupMemberRole } from '@fastgpt/global/support/permission/memberGroup/constant';
+const { Schema } = connectionMongo;
+
+export const GroupMemberCollectionName = 'team_group_members';
+
+export const GroupMemberSchema = new Schema({
+  groupId: {
+    type: Schema.Types.ObjectId,
+    ref: MemberGroupCollectionName,
+    required: true
+  },
+  tmbId: {
+    type: Schema.Types.ObjectId,
+    ref: TeamMemberCollectionName,
+    required: true
+  },
+  role: {
+    type: String,
+    enum: Object.values(GroupMemberRole),
+    required: true,
+    default: GroupMemberRole.member
+  }
+});
+
+try {
+  GroupMemberSchema.index({
+    groupId: 1
+  });
+
+  GroupMemberSchema.index({
+    tmbId: 1
+  });
+} catch (error) {
+  console.log(error);
+}
+
+export const MongoGroupMemberModel = getMongoModel<GroupMemberSchemaType>(
+  GroupMemberCollectionName,
+  GroupMemberSchema
+);

packages/service/support/permission/memberGroup/memberGroupSchema.ts

@@ -0,0 +1,51 @@
+import { TeamCollectionName } from '@fastgpt/global/support/user/team/constant';
+import { connectionMongo, getMongoModel } from '../../../common/mongo';
+import { MemberGroupSchemaType } from '@fastgpt/global/support/permission/memberGroup/type';
+const { Schema } = connectionMongo;
+
+export const MemberGroupCollectionName = 'team_member_groups';
+
+export const MemberGroupSchema = new Schema(
+  {
+    teamId: {
+      type: Schema.Types.ObjectId,
+      ref: TeamCollectionName,
+      required: true
+    },
+    name: {
+      type: String,
+      required: true
+    },
+    avatar: {
+      type: String
+    },
+    updateTime: {
+      type: Date,
+      default: () => new Date()
+    }
+  },
+  {
+    timestamps: {
+      updatedAt: 'updateTime'
+    }
+  }
+);
+
+try {
+  MemberGroupSchema.index(
+    {
+      teamId: 1,
+      name: 1
+    },
+    {
+      unique: true
+    }
+  );
+} catch (error) {
+  console.log(error);
+}
+
+export const MongoMemberGroupModel = getMongoModel<MemberGroupSchemaType>(
+  MemberGroupCollectionName,
+  MemberGroupSchema
+);

packages/service/support/permission/schema.ts

@@ -5,9 +5,10 @@ import {
 import { connectionMongo, getMongoModel } from '../../common/mongo';
 import type { ResourcePermissionType } from '@fastgpt/global/support/permission/type';
 import { PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { MemberGroupCollectionName } from './memberGroup/memberGroupSchema';
 const { Schema } = connectionMongo;
 
-export const ResourcePermissionCollectionName = 'resource_permission';
+export const ResourcePermissionCollectionName = 'resource_permissions';
 
 export const ResourcePermissionSchema = new Schema({
   teamId: {
@@ -18,6 +19,10 @@ export const ResourcePermissionSchema = new Schema({
     type: Schema.Types.ObjectId,
     ref: TeamMemberCollectionName
   },
+  groupId: {
+    type: Schema.Types.ObjectId,
+    ref: MemberGroupCollectionName
+  },
   resourceType: {
     type: String,
     enum: Object.values(PerResourceTypeEnum),
@@ -40,12 +45,14 @@ try {
       resourceType: 1,
       teamId: 1,
       tmbId: 1,
-      resourceId: 1
+      resourceId: 1,
+      groupId: 1
     },
     {
       unique: true
     }
   );
+
   ResourcePermissionSchema.index({
     resourceType: 1,
     teamId: 1,

packages/service/support/permission/type.d.ts

@@ -1,6 +1,7 @@
 import { Permission } from '@fastgpt/global/support/permission/controller';
 import { ApiRequestProps } from '../../type/next';
 import type { PermissionValueType } from '@fastgpt/global/support/permission/type';
+import { RequireAtLeastOne } from '@fastgpt/global/common/type/utils';
 
 export type ReqHeaderAuthType = {
   cookie?: string;
@@ -11,11 +12,6 @@ export type ReqHeaderAuthType = {
   authorization?: string;
 };
 
-type RequireAtLeastOne<T, Keys extends keyof T = keyof T> = Omit<T, Keys> &
-  {
-    [K in Keys]-?: Required<Pick<T, K>> & Partial<Omit<T, K>>;
-  }[Keys];
-
 type authModeType = {
   req: ApiRequestProps;
   authToken?: boolean;

packages/service/support/user/team/controller.ts

@@ -11,6 +11,10 @@ import { UpdateTeamProps } from '@fastgpt/global/support/user/team/controller';
 import { getResourcePermission } from '../../permission/controller';
 import { PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
 import { TeamPermission } from '@fastgpt/global/support/permission/user/controller';
+import { TeamDefaultPermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { MongoMemberGroupModel } from '../../permission/memberGroup/memberGroupSchema';
+import { mongoSessionRun } from '../../../common/mongo/sessionRun';
+import { DefaultGroupName } from '@fastgpt/global/support/user/team/group/constant';
 
 async function getTeamMember(match: Record<string, any>): Promise<TeamTmbItemType> {
   const tmb = (await MongoTeamMember.findOne(match).populate('teamId')) as TeamMemberWithTeamSchema;
@@ -18,7 +22,7 @@ async function getTeamMember(match: Record<string, any>): Promise<TeamTmbItemTyp
     return Promise.reject('member not exist');
   }
 
-  const tmbPer = await getResourcePermission({
+  const Per = await getResourcePermission({
     resourceType: PerResourceTypeEnum.team,
     teamId: tmb.teamId._id,
     tmbId: tmb._id
@@ -38,7 +42,7 @@ async function getTeamMember(match: Record<string, any>): Promise<TeamTmbItemTyp
     defaultTeam: tmb.defaultTeam,
     lafAccount: tmb.teamId.lafAccount,
     permission: new TeamPermission({
-      per: tmbPer?.permission ?? tmb.teamId.defaultPermission,
+      per: Per ?? TeamDefaultPermissionVal,
       isOwner: tmb.role === TeamMemberRoleEnum.owner
     }),
     notificationAccount: tmb.teamId.notificationAccount
@@ -64,6 +68,7 @@ export async function getUserDefaultTeam({ userId }: { userId: string }) {
     defaultTeam: true
   });
 }
+
 export async function createDefaultTeam({
   userId,
   teamName = 'My Team',
@@ -84,7 +89,7 @@ export async function createDefaultTeam({
   });
 
   if (!tmb) {
-    // create
+    // create team
     const [{ _id: insertedId }] = await MongoTeam.create(
       [
         {
@@ -97,7 +102,8 @@ export async function createDefaultTeam({
       ],
       { session }
     );
-    await MongoTeamMember.create(
+    // create team member
+    const [tmb] = await MongoTeamMember.create(
       [
         {
           teamId: insertedId,
@@ -111,7 +117,19 @@ export async function createDefaultTeam({
       ],
       { session }
     );
-    console.log('create default team', userId);
+    // create default group
+    await MongoMemberGroupModel.create(
+      [
+        {
+          teamId: tmb.teamId,
+          name: DefaultGroupName,
+          avatar
+        }
+      ],
+      { session }
+    );
+    console.log('create default team and group', userId);
+    return tmb;
   } else {
     console.log('default team exist', userId);
     await MongoTeam.findByIdAndUpdate(tmb.teamId, {
@@ -129,10 +147,30 @@ export async function updateTeam({
   teamDomain,
   lafAccount
 }: UpdateTeamProps & { teamId: string }) {
-  await MongoTeam.findByIdAndUpdate(teamId, {
-    name,
-    avatar,
-    teamDomain,
-    lafAccount
+  return mongoSessionRun(async (session) => {
+    await MongoTeam.findByIdAndUpdate(
+      teamId,
+      {
+        name,
+        avatar,
+        teamDomain,
+        lafAccount
+      },
+      { session }
+    );
+
+    // update default group
+    if (avatar) {
+      await MongoMemberGroupModel.updateOne(
+        {
+          teamId: teamId,
+          name: DefaultGroupName
+        },
+        {
+          avatar
+        },
+        { session }
+      );
+    }
   });
 }

packages/service/support/user/team/teamSchema.ts

@@ -3,7 +3,6 @@ const { Schema } = connectionMongo;
 import { TeamSchema as TeamType } from '@fastgpt/global/support/user/team/type.d';
 import { userCollectionName } from '../../user/schema';
 import { TeamCollectionName } from '@fastgpt/global/support/user/team/constant';
-import { TeamDefaultPermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 const TeamSchema = new Schema({
   name: {
@@ -14,10 +13,6 @@ const TeamSchema = new Schema({
     type: Schema.Types.ObjectId,
     ref: userCollectionName
   },
-  defaultPermission: {
-    type: Number,
-    default: TeamDefaultPermissionVal
-  },
   avatar: {
     type: String,
     default: '/icon/logo.svg'