apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-04 22:02:16 +02:00
Code Issues Projects Releases Packages Wiki Activity

feat: enforce API access for knowledge resources

Browse source
This commit is contained in:
Anish Sarkar 2026-06-19 20:27:47 +05:30
parent 7e8d26fa81
commit 493e8d5a64
8 changed files with 206 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

11
surfsense_backend/app/file_storage/api.py
View file

@ -9,6 +9,7 @@ from fastapi.responses import StreamingResponse
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from app.auth.context import AuthContext
from app.db import Document, Permission, User, get_async_session
from app.file_storage.persistence.enums import DocumentFileKind
from app.file_storage.schemas import DocumentFileRead
@ -17,7 +18,7 @@ from app.file_storage.service import (
list_document_files,
open_document_file_stream,
)
from app.users import current_active_user
from app.users import get_auth_context
from app.utils.rbac import check_permission
router = APIRouter()
@ -35,7 +36,7 @@ async def _load_readable_document(
await check_permission(
session,
user,
auth,
document.search_space_id,
Permission.DOCUMENTS_READ.value,
"You don't have permission to read documents in this search space",
@ -57,8 +58,9 @@ def _content_disposition(filename: str) -> str:
async def read_document_files(
document_id: int,
session: AsyncSession = Depends(get_async_session),
user: User = Depends(current_active_user),
auth: AuthContext = Depends(get_auth_context),
) -> list[DocumentFileRead]:
user = auth.user
"""Return metadata for every stored file of a document (gates the UI)."""
await _load_readable_document(document_id=document_id, session=session, user=user)
records = await list_document_files(session, document_id=document_id)
@ -69,8 +71,9 @@ async def read_document_files(
async def download_original_document_file(
document_id: int,
session: AsyncSession = Depends(get_async_session),
user: User = Depends(current_active_user),
auth: AuthContext = Depends(get_auth_context),
) -> StreamingResponse:
user = auth.user
"""Stream the document's original uploaded file."""
await _load_readable_document(document_id=document_id, session=session, user=user)