feat: team permission refine (#4494) (#4498)

* feat: team permission refine (#4402)

* chore: team permission extend

* feat: manage team permission

* chore: api auth

* fix: i18n

* feat: add initv493

* fix: test, org auth manager

* test: app test for refined permission

* update init sh

* fix: add/remove manage permission (#4427)

* fix: add/remove manage permission

* fix: github action fastgpt-test

* fix: mock create model

* fix: team write permission

* fix: ts

* account permission

---------

Co-authored-by: Finley Ge <32237950+FinleyGe@users.noreply.github.com>

.github/workflows/fastgpt-test.yaml

@@ -15,6 +15,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10

package.json

@@ -12,21 +12,20 @@
     "previewIcon": "node ./scripts/icon/index.js",
     "api:gen": "tsc ./scripts/openapi/index.ts && node ./scripts/openapi/index.js && npx @redocly/cli build-docs ./scripts/openapi/openapi.json -o ./projects/app/public/openapi/index.html",
     "create:i18n": "node ./scripts/i18n/index.js",
-    "test": "vitest run --exclude 'test/cases/spec'",
-    "test:all": "vitest run",
+    "test": "vitest run",
     "test:workflow": "vitest run workflow"
   },
   "devDependencies": {
     "@chakra-ui/cli": "^2.4.1",
-    "@vitest/coverage-v8": "^3.0.2",
+    "@vitest/coverage-v8": "^3.0.9",
     "husky": "^8.0.3",
     "i18next": "23.16.8",
     "lint-staged": "^13.3.0",
     "next-i18next": "15.4.2",
     "prettier": "3.2.4",
     "react-i18next": "14.1.2",
-    "vitest": "^3.0.2",
-    "vitest-mongodb": "^1.0.1",
+    "vitest": "^3.0.9",
+    "mongodb-memory-server": "^10.1.4",
     "zhlint": "^0.7.4"
   },
   "lint-staged": {

packages/global/support/permission/collaborator.d.ts

@@ -13,12 +13,15 @@ export type CollaboratorItemType = {
   orgId: string;
 }>;
 
-export type UpdateClbPermissionProps = {
+export type UpdateClbPermissionProps<addOnly = false> = {
   members?: string[];
   groups?: string[];
   orgs?: string[];
-  permission: PermissionValueType;
-};
+} & (addOnly extends true
+  ? {}
+  : {
+      permission: PermissionValueType;
+    });
 
 export type DeletePermissionQuery = RequireOnlyOne<{
   tmbId?: string;

packages/global/support/permission/controller.ts

@@ -5,15 +5,16 @@ export type PerConstructPros = {
   per?: PermissionValueType;
   isOwner?: boolean;
   permissionList?: PermissionListType;
+  childUpdatePermissionCallback?: () => void;
 };
 
 // the Permission helper class
 export class Permission {
   value: PermissionValueType;
-  isOwner: boolean;
-  hasManagePer: boolean;
-  hasWritePer: boolean;
-  hasReadPer: boolean;
+  isOwner: boolean = false;
+  hasManagePer: boolean = false;
+  hasWritePer: boolean = false;
+  hasReadPer: boolean = false;
   _permissionList: PermissionListType;
 
   constructor(props?: PerConstructPros) {
@@ -24,11 +25,8 @@ export class Permission {
       this.value = per;
     }
 
-    this.isOwner = isOwner;
     this._permissionList = permissionList;
-    this.hasManagePer = this.checkPer(this._permissionList['manage'].value);
-    this.hasWritePer = this.checkPer(this._permissionList['write'].value);
-    this.hasReadPer = this.checkPer(this._permissionList['read'].value);
+    this.updatePermissions();
   }
 
   // add permission(s)
@@ -68,10 +66,21 @@ export class Permission {
     return (this.value & perm) === perm;
   }
 
+  private updatePermissionCallback?: () => void;
+  setUpdatePermissionCallback(callback: () => void) {
+    callback();
+    this.updatePermissionCallback = callback;
+  }
+
   private updatePermissions() {
     this.isOwner = this.value === OwnerPermissionVal;
     this.hasManagePer = this.checkPer(this._permissionList['manage'].value);
     this.hasWritePer = this.checkPer(this._permissionList['write'].value);
     this.hasReadPer = this.checkPer(this._permissionList['read'].value);
+    this.updatePermissionCallback?.();
+  }
+
+  toBinary() {
+    return this.value.toString(2);
   }
 }

packages/global/support/permission/memberGroup/type.d.ts

@@ -17,23 +17,23 @@ type GroupMemberSchemaType = {
   role: `${GroupMemberRole}`;
 };
 
-type MemberGroupListItemType<T extends boolean | undefined> = MemberGroupSchemaType & {
-  members: T extends true
+type MemberGroupListItemType<WithMembers extends boolean | undefined> = MemberGroupSchemaType & {
+  members: WithMembers extends true
     ? {
         tmbId: string;
         name: string;
         avatar: string;
       }[]
     : undefined;
-  count: T extends true ? number : undefined;
-  owner?: T extends true
+  count: WithMembers extends true ? number : undefined;
+  owner?: WithMembers extends true
     ? {
         tmbId: string;
         name: string;
         avatar: string;
       }
     : undefined;
-  permission: T extends true ? Permission : undefined;
+  permission: WithMembers extends true ? Permission : undefined;
 };
 
 type GroupMemberItemType = {

packages/global/support/permission/user/constant.ts

 import { PermissionKeyEnum } from '../constant';
 import { PermissionListType } from '../type';
 import { PermissionList } from '../constant';
-export const TeamPermissionList: PermissionListType = {
+import { i18nT } from '../../../../web/i18n/utils';
+export enum TeamPermissionKeyEnum {
+  appCreate = 'appCreate',
+  datasetCreate = 'datasetCreate',
+  apikeyCreate = 'apikeyCreate'
+}
+
+export const TeamPermissionList: PermissionListType<TeamPermissionKeyEnum> = {
   [PermissionKeyEnum.read]: {
     ...PermissionList[PermissionKeyEnum.read],
-    value: 0b100
+    value: 0b000100
   },
   [PermissionKeyEnum.write]: {
     ...PermissionList[PermissionKeyEnum.write],
-    value: 0b010
+    value: 0b000010
   },
   [PermissionKeyEnum.manage]: {
     ...PermissionList[PermissionKeyEnum.manage],
-    value: 0b001
+    value: 0b000001
+  },
+  [TeamPermissionKeyEnum.appCreate]: {
+    checkBoxType: 'multiple',
+    description: '',
+    name: i18nT('account_team:permission_appCreate'),
+    value: 0b001000
+  },
+  [TeamPermissionKeyEnum.datasetCreate]: {
+    checkBoxType: 'multiple',
+    description: '',
+    name: i18nT('account_team:permission_datasetCreate'),
+    value: 0b010000
+  },
+  [TeamPermissionKeyEnum.apikeyCreate]: {
+    checkBoxType: 'multiple',
+    description: '',
+    name: i18nT('account_team:permission_apikeyCreate'),
+    value: 0b100000
   }
 };
 
 export const TeamReadPermissionVal = TeamPermissionList['read'].value;
 export const TeamWritePermissionVal = TeamPermissionList['write'].value;
 export const TeamManagePermissionVal = TeamPermissionList['manage'].value;
+export const TeamAppCreatePermissionVal = TeamPermissionList['appCreate'].value;
+export const TeamDatasetCreatePermissionVal = TeamPermissionList['datasetCreate'].value;
+export const TeamApikeyCreatePermissionVal = TeamPermissionList['apikeyCreate'].value;
 export const TeamDefaultPermissionVal = TeamReadPermissionVal;

packages/global/support/permission/user/controller.ts

 import { PerConstructPros, Permission } from '../controller';
-import { TeamDefaultPermissionVal, TeamPermissionList } from './constant';
+import {
+  TeamAppCreatePermissionVal,
+  TeamDefaultPermissionVal,
+  TeamPermissionList
+} from './constant';
 
 export class TeamPermission extends Permission {
+  hasAppCreatePer: boolean = false;
+  hasDatasetCreatePer: boolean = false;
+  hasApikeyCreatePer: boolean = false;
+
   constructor(props?: PerConstructPros) {
     if (!props) {
       props = {
@@ -12,5 +20,11 @@ export class TeamPermission extends Permission {
     }
     props.permissionList = TeamPermissionList;
     super(props);
+
+    this.setUpdatePermissionCallback(() => {
+      this.hasAppCreatePer = this.checkPer(TeamAppCreatePermissionVal);
+      this.hasDatasetCreatePer = this.checkPer(TeamAppCreatePermissionVal);
+      this.hasApikeyCreatePer = this.checkPer(TeamAppCreatePermissionVal);
+    });
   }
 }

packages/service/common/mongo/index.ts

@@ -69,7 +69,7 @@ const addCommonMiddleware = (schema: mongoose.Schema) => {
 
 export const getMongoModel = <T>(name: string, schema: mongoose.Schema) => {
   if (connectionMongo.models[name]) return connectionMongo.models[name] as Model<T>;
-  console.log('Load model======', name);
+  if (process.env.NODE_ENV !== 'test') console.log('Load model======', name);
   addCommonMiddleware(schema);
 
   const model = connectionMongo.model<T>(name, schema);

packages/service/support/permission/auth/org.ts

@@ -2,7 +2,7 @@ import { TeamPermission } from '@fastgpt/global/support/permission/user/controll
 import { AuthModeType, AuthResponseType } from '../type';
 import { TeamErrEnum } from '@fastgpt/global/common/error/code/team';
 import { authUserPer } from '../user/auth';
-import { ManagePermissionVal } from '@fastgpt/global/support/permission/constant';
+import { TeamManagePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 /*
   Team manager can control org
@@ -15,7 +15,7 @@ export const authOrgMember = async ({
 } & AuthModeType): Promise<AuthResponseType> => {
   const result = await authUserPer({
     ...props,
-    per: ManagePermissionVal
+    per: TeamManagePermissionVal
   });
   const { teamId, tmbId, isRoot, tmb } = result;
 

packages/web/i18n/en/account_team.json

@@ -61,5 +61,13 @@
   "user_team_invite_member": "Invite members",
   "user_team_leave_team": "Leave the team",
   "user_team_leave_team_failed": "Failure to leave the team",
-  "waiting": "To be accepted"
+  "waiting": "To be accepted",
+  "permission_appCreate": "Create Application",
+  "permission_datasetCreate": "Create Knowledge Base",
+  "permission_apikeyCreate": "Create API Key",
+  "permission_appCreate_tip": "Can create applications in the root directory (creation permissions in folders are controlled by the folder)",
+  "permission_datasetCreate_Tip": "Can create knowledge bases in the root directory (creation permissions in folders are controlled by the folder)",
+  "permission_apikeyCreate_Tip": "Can create global APIKeys",
+  "permission_manage": "Admin",
+  "permission_manage_tip": "Can manage members, create groups, manage all groups, and assign permissions to groups and members"
 }

packages/web/i18n/en/user.json

@@ -100,7 +100,6 @@
   "team.group.manage_tip": "Can manage members, create groups, manage all groups, assign permissions to groups and members",
   "team.group.members": "member",
   "team.group.name": "Group name",
-  "team.group.permission.manage": "administrator",
   "team.group.permission.write": "Workbench/knowledge base creation",
   "team.group.permission_tip": "Members with individually configured permissions will follow the individual permission configuration and will no longer be affected by group permissions.\n\nIf a member is in multiple permission groups, the member's permissions are combined.",
   "team.group.role.admin": "administrator",
@@ -112,5 +111,6 @@
   "team.manage_collaborators": "Manage Collaborators",
   "team.no_collaborators": "No Collaborators",
   "team.org.org": "Organization",
-  "team.write_role_member": ""
+  "team.write_role_member": "Write Permission",
+  "team.collaborator.added": "Added"
 }

packages/web/i18n/zh-CN/account_team.json

@@ -77,5 +77,13 @@
   "user_team_invite_member": "邀请成员",
   "user_team_leave_team": "离开团队",
   "user_team_leave_team_failed": "离开团队失败",
-  "waiting": "待接受"
+  "waiting": "待接受",
+  "permission_appCreate": "创建应用",
+  "permission_datasetCreate": "创建知识库",
+  "permission_apikeyCreate": "创建 API 密钥",
+  "permission_appCreate_tip": "可以在根目录创建应用，（文件夹下的创建权限由文件夹控制）",
+  "permission_datasetCreate_Tip": "可以在根目录创建知识库，（文件夹下的创建权限由文件夹控制）",
+  "permission_apikeyCreate_Tip": "可以创建全局的 APIKey",
+  "permission_manage": "管理员",
+  "permission_manage_tip": "可以管理成员、创建群组、管理所有群组、为群组和成员分配权限"
 }

packages/web/i18n/zh-CN/user.json

@@ -98,11 +98,9 @@
   "team.group.keep_admin": "保留管理员权限",
   "team.group.manage_member": "管理成员",
   "team.group.manage_tip": "可以管理成员、创建群组、管理所有群组、为群组和成员分配权限",
+  "team.group.permission_tip": "单独配置权限的成员，将遵循个人权限配置，不再受群组权限影响。\n若成员在多个权限组，则该成员的权限取并集。",
   "team.group.members": "成员",
   "team.group.name": "群组名称",
-  "team.group.permission.manage": "管理员",
-  "team.group.permission.write": "工作台/知识库创建",
-  "team.group.permission_tip": "单独配置权限的成员，将遵循个人权限配置，不再受群组权限影响。\n若成员在多个权限组，则该成员的权限取并集。",
   "team.group.role.admin": "管理员",
   "team.group.role.member": "成员",
   "team.group.role.owner": "所有者",
@@ -112,5 +110,6 @@
   "team.manage_collaborators": "管理协作者",
   "team.no_collaborators": "暂无协作者",
   "team.org.org": "部门",
-  "team.write_role_member": "可写权限"
+  "team.write_role_member": "可写权限",
+  "team.collaborator.added": "已添加"
 }

packages/web/i18n/zh-Hant/account_team.json

@@ -61,5 +61,13 @@
   "user_team_invite_member": "邀請成員",
   "user_team_leave_team": "離開團隊",
   "user_team_leave_team_failed": "離開團隊失敗",
-  "waiting": "待接受"
+  "waiting": "待接受",
+  "permission_appCreate": "建立應用",
+  "permission_datasetCreate": "建立知識庫",
+  "permission_apikeyCreate": "建立 API 密鑰",
+  "permission_appCreate_tip": "可以在根目錄建立應用，（資料夾下的建立權限由資料夾控制）",
+  "permission_datasetCreate_Tip": "可以在根目錄建立知識庫，（資料夾下的建立權限由資料夾控制）",
+  "permission_apikeyCreate_Tip": "可以建立全域的 APIKey",
+  "permission_manage": "管理員",
+  "permission_manage_tip": "可以管理成員、建立群組、管理所有群組、為群組和成員分配權限"
 }

packages/web/i18n/zh-Hant/user.json

@@ -100,7 +100,6 @@
   "team.group.manage_tip": "可以管理成員、創建群組、管理所有群組、為群組和成員分配權限",
   "team.group.members": "成員",
   "team.group.name": "群組名稱",
-  "team.group.permission.manage": "管理員",
   "team.group.permission.write": "工作臺/知識庫建立",
   "team.group.permission_tip": "單獨設定權限的成員，將依照個人權限設定，不再受群組權限影響。\n若成員屬於多個權限群組，該成員的權限將會合併。",
   "team.group.role.admin": "管理員",
@@ -112,5 +111,6 @@
   "team.manage_collaborators": "管理協作者",
   "team.no_collaborators": "目前沒有協作者",
   "team.org.org": "組織",
-  "team.write_role_member": "可寫入權限"
+  "team.write_role_member": "可寫入權限",
+  "team.collaborator.added": "已添加"
 }

projects/app/src/components/support/permission/MemberManager/MemberItemCard.tsx

 import React from 'react';
+import { useTranslation } from 'next-i18next';
 import { Box, Checkbox, HStack, VStack } from '@chakra-ui/react';
 import Avatar from '@fastgpt/web/components/common/Avatar';
 import PermissionTags from './PermissionTags';
 import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 import MyIcon from '@fastgpt/web/components/common/Icon';
 import OrgTags from '../../user/team/OrgTags';
+import Tag from '@fastgpt/web/components/common/Tag';
 
 function MemberItemCard({
   avatar,
   key,
-  onChange,
+  onChange: _onChange,
   isChecked,
   onDelete,
   name,
   permission,
-  orgs
+  orgs,
+  addOnly,
+  rightSlot
 }: {
   avatar: string;
   key: string;
@@ -23,44 +27,66 @@ function MemberItemCard({
   onDelete?: () => void;
   name: string;
   permission?: PermissionValueType;
+  addOnly?: boolean;
   orgs?: string[];
+  rightSlot?: React.ReactNode;
 }) {
+  const isAdded = addOnly && !!permission;
+  const onChange = () => {
+    if (!isAdded) _onChange();
+  };
+  const { t } = useTranslation();
   return (
-    <>
-      <HStack
-        justifyContent="space-between"
-        alignItems="center"
-        key={key}
-        px="3"
-        py="2"
-        borderRadius="sm"
-        _hover={{
-          bgColor: 'myGray.50',
-          cursor: 'pointer'
-        }}
-        onClick={onChange}
-      >
-        {isChecked !== undefined && <Checkbox isChecked={isChecked} pointerEvents="none" />}
-        <Avatar src={avatar} w="1.5rem" borderRadius={'50%'} />
+    <HStack
+      justifyContent="space-between"
+      alignItems="center"
+      key={key}
+      px="3"
+      py="2"
+      borderRadius="sm"
+      _hover={{
+        bgColor: 'myGray.50',
+        cursor: 'pointer'
+      }}
+      onClick={onChange}
+    >
+      {isChecked !== undefined && (
+        <Checkbox isChecked={isChecked} pointerEvents="none" disabled={isAdded} />
+      )}
+      <Avatar src={avatar} w="1.5rem" borderRadius={'50%'} />
 
-        <Box w="full">
-          <Box fontSize={'sm'}>{name}</Box>
-          <Box lineHeight={1}>{orgs && orgs.length > 0 && <OrgTags orgs={orgs} />}</Box>
+      <Box w="full">
+        <Box fontSize={'sm'} className="textEllipsis" maxW="300px">
+          {name}
         </Box>
-        {permission && <PermissionTags permission={permission} />}
-        {onDelete !== undefined && (
-          <MyIcon
-            name="common/closeLight"
-            w="1rem"
-            cursor={'pointer'}
-            _hover={{
-              color: 'red.600'
-            }}
-            onClick={onDelete}
-          />
-        )}
-      </HStack>
-    </>
+        <Box lineHeight={1}>{orgs && orgs.length > 0 && <OrgTags orgs={orgs} />}</Box>
+      </Box>
+      {!isAdded && permission && <PermissionTags permission={permission} />}
+      {isAdded && (
+        <Tag
+          mixBlendMode={'multiply'}
+          colorSchema="blue"
+          border="none"
+          py={2}
+          px={3}
+          fontSize={'xs'}
+        >
+          {t('user:team.collaborator.added')}
+        </Tag>
+      )}
+      {onDelete !== undefined && (
+        <MyIcon
+          name="common/closeLight"
+          w="1rem"
+          cursor={'pointer'}
+          _hover={{
+            color: 'red.600'
+          }}
+          onClick={onDelete}
+        />
+      )}
+      {rightSlot}
+    </HStack>
   );
 }
 

projects/app/src/components/support/permission/MemberManager/MemberModal.tsx

 import { useUserStore } from '@/web/support/user/useUserStore';
 import { ChevronDownIcon } from '@chakra-ui/icons';
-import {
-  Box,
-  Button,
-  Checkbox,
-  Flex,
-  Grid,
-  HStack,
-  ModalBody,
-  ModalFooter,
-  Tag,
-  Text
-} from '@chakra-ui/react';
+import { Box, Button, Flex, Grid, HStack, ModalBody, ModalFooter, Text } from '@chakra-ui/react';
 import { DefaultGroupName } from '@fastgpt/global/support/user/team/group/constant';
 import MyAvatar from '@fastgpt/web/components/common/Avatar';
 import MyIcon from '@fastgpt/web/components/common/Icon';
@@ -19,27 +8,26 @@ import SearchInput from '@fastgpt/web/components/common/Input/SearchInput';
 import MyModal from '@fastgpt/web/components/common/MyModal';
 import { useRequest2 } from '@fastgpt/web/hooks/useRequest';
 import { useTranslation } from 'next-i18next';
-import { useEffect, useMemo, useRef, useState } from 'react';
+import { useMemo, useRef, useState } from 'react';
 import PermissionSelect from './PermissionSelect';
-import PermissionTags from './PermissionTags';
 import {
   DEFAULT_ORG_AVATAR,
   DEFAULT_TEAM_AVATAR,
   DEFAULT_USER_AVATAR
 } from '@fastgpt/global/common/system/constants';
 import Path from '@/components/common/folder/Path';
-import { OrgListItemType, OrgType } from '@fastgpt/global/support/user/team/org/type';
+import { OrgListItemType } from '@fastgpt/global/support/user/team/org/type';
 import { useContextSelector } from 'use-context-selector';
 import { CollaboratorContext } from './context';
 import { getTeamMembers } from '@/web/support/user/team/api';
 import { getGroupList } from '@/web/support/user/team/group/api';
 import { useScrollPagination } from '@fastgpt/web/hooks/useScrollPagination';
 import MemberItemCard from './MemberItemCard';
-import { GetSearchUserGroupOrg } from '@/web/support/user/api';
 import useOrg from '@/web/support/user/team/org/hooks/useOrg';
 import { TeamMemberItemType } from '@fastgpt/global/support/user/team/type';
 import { MemberGroupListItemType } from '@fastgpt/global/support/permission/memberGroup/type';
-import _ from 'lodash';
+import { UpdateClbPermissionProps } from '@fastgpt/global/support/permission/collaborator';
+import { ValueOf } from 'next/dist/shared/lib/constants';
 
 const HoverBoxStyle = {
   bgColor: 'myGray.50',
@@ -131,8 +119,8 @@ function MemberModal({
         members: selectedMemberList.map((item) => item.tmbId),
         groups: selectedGroupList.map((item) => item._id),
         orgs: selectedOrgList.map((item) => item._id),
-        permission: selectedPermission!
-      }),
+        permission: addOnly ? undefined : selectedPermission!
+      } as UpdateClbPermissionProps<ValueOf<typeof addOnly>>),
     {
       successToast: t('common:common.Add Success'),
       onSuccess() {
@@ -285,6 +273,7 @@ function MemberModal({
                     const collaborator = collaboratorList?.find((v) => v.tmbId === member.tmbId);
                     return (
                       <MemberItemCard
+                        addOnly={addOnly}
                         avatar={member.avatar}
                         key={member.tmbId}
                         name={member.memberName}
@@ -321,49 +310,33 @@ function MemberModal({
                     };
                     const collaborator = collaboratorList?.find((v) => v.orgId === org._id);
                     return (
-                      <HStack
-                        justifyContent="space-between"
+                      <MemberItemCard
+                        avatar={org.avatar}
                         key={org._id}
-                        py="2"
-                        px="3"
-                        borderRadius="sm"
-                        alignItems="center"
-                        _hover={HoverBoxStyle}
-                        onClick={onChange}
-                      >
-                        <Checkbox
-                          isChecked={!!selectedOrgList.find((v) => v._id === org._id)}
-                          pointerEvents="none"
-                        />
-                        <MyAvatar src={org.avatar} w="1.5rem" borderRadius={'50%'} />
-                        <HStack w="full">
-                          <Text>{org.name}</Text>
-                          {org.total && (
-                            <>
-                              <Tag size="sm" my="auto">
-                                {org.total}
-                              </Tag>
-                            </>
-                          )}
-                        </HStack>
-                        <PermissionTags permission={collaborator?.permission.value} />
-                        {org.total && (
-                          <MyIcon
-                            name="core/chat/chevronRight"
-                            w="16px"
-                            p="4px"
-                            rounded={'6px'}
-                            _hover={{
-                              bgColor: 'myGray.200'
-                            }}
-                            onClick={(e) => {
-                              onClickOrg(org);
-                              // setPath(getOrgChildrenPath(org));
-                              e.stopPropagation();
-                            }}
-                          />
-                        )}
-                      </HStack>
+                        name={org.name}
+                        onChange={onChange}
+                        addOnly={addOnly}
+                        permission={collaborator?.permission.value}
+                        isChecked={!!selectedOrgList.find((v) => String(v._id) === String(org._id))}
+                        rightSlot={
+                          org.total && (
+                            <MyIcon
+                              name="core/chat/chevronRight"
+                              w="16px"
+                              p="4px"
+                              rounded={'6px'}
+                              _hover={{
+                                bgColor: 'myGray.200'
+                              }}
+                              onClick={(e) => {
+                                onClickOrg(org);
+                                // setPath(getOrgChildrenPath(org));
+                                e.stopPropagation();
+                              }}
+                            />
+                          )
+                        }
+                      />
                     );
                   });
                   return searchKey ? (
@@ -372,6 +345,9 @@ function MemberModal({
                     <OrgMemberScrollData>
                       {Orgs}
                       {orgMembers.map((member) => {
+                        const isChecked = !!selectedMemberList.find(
+                          (v) => v.tmbId === member.tmbId
+                        );
                         return (
                           <MemberItemCard
                             avatar={member.avatar}
@@ -385,7 +361,9 @@ function MemberModal({
                                 return [...state, member];
                               });
                             }}
-                            isChecked={!!selectedMemberList.find((v) => v.tmbId === member.tmbId)}
+                            isChecked={isChecked}
+                            permission={member.permission.value}
+                            addOnly={addOnly && !!member.permission.value}
                             orgs={member.orgs}
                           />
                         );
@@ -414,6 +392,7 @@ function MemberModal({
                       permission={collaborator?.permission.value}
                       onChange={onChange}
                       isChecked={!!selectedGroupList.find((v) => v._id === group._id)}
+                      addOnly={addOnly}
                     />
                   );
                 })}

projects/app/src/components/support/permission/MemberManager/context.tsx

@@ -110,7 +110,15 @@ const CollaboratorContextProvider = ({
   } = useRequest2(
     async () => {
       if (feConfigs.isPlus) {
-        return onGetCollaboratorList();
+        const data = await onGetCollaboratorList();
+        return data.map((item) => {
+          return {
+            ...item,
+            permission: new Permission({
+              per: item.permission.value
+            })
+          };
+        });
       }
       return [];
     },

projects/app/src/components/support/user/team/OrgTags/index.tsx

@@ -10,7 +10,14 @@ function OrgTags({ orgs, type = 'simple' }: { orgs?: string[]; type?: 'simple' |
       label={
         <VStack gap="1" alignItems={'start'}>
           {orgs.map((org, index) => (
-            <Box key={index} fontSize="sm" fontWeight={400} color="myGray.500">
+            <Box
+              key={index}
+              fontSize="sm"
+              fontWeight={400}
+              color="myGray.500"
+              maxW={'300px'}
+              className="textEllipsis"
+            >
               {org.slice(1)}
             </Box>
           ))}

projects/app/src/pageComponents/account/AccountContainer.tsx

@@ -91,7 +91,7 @@ const AccountContainer = ({
           }
         ]
       : []),
-    ...(userInfo?.team?.permission.hasManagePer
+    ...(userInfo?.team?.permission.hasApikeyCreatePer
       ? [
           {
             icon: 'key',

projects/app/src/pageComponents/app/list/List.tsx

@@ -36,6 +36,7 @@ import { useSystem } from '@fastgpt/web/hooks/useSystem';
 import { useChatStore } from '@/web/core/chat/context/useChatStore';
 import { RequireOnlyOne } from '@fastgpt/global/common/type/utils';
 import UserBox from '@fastgpt/web/components/common/UserBox';
+import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 const HttpEditModal = dynamic(() => import('./HttpPluginEditModal'));
 
 const ListItem = () => {
@@ -429,7 +430,7 @@ const ListItem = () => {
               members?: string[];
               groups?: string[];
               orgs?: string[];
-              permission: number;
+              permission: PermissionValueType;
             }) =>
               postUpdateAppCollaborators({
                 ...props,

projects/app/src/pages/api/core/app/copy.ts

@@ -4,6 +4,7 @@ import { authApp } from '@fastgpt/service/support/permission/app/auth';
 import { WritePermissionVal } from '@fastgpt/global/support/permission/constant';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
 import { onCreateApp } from './create';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 export type copyAppQuery = {};
 
@@ -17,19 +18,16 @@ async function handler(
   req: ApiRequestProps<copyAppBody, copyAppQuery>,
   res: ApiResponseType<any>
 ): Promise<copyAppResponse> {
-  const [{ app, tmbId }] = await Promise.all([
-    authApp({
-      req,
-      authToken: true,
-      per: WritePermissionVal,
-      appId: req.body.appId
-    }),
-    authUserPer({
-      req,
-      authToken: true,
-      per: WritePermissionVal
-    })
-  ]);
+  const { app } = await authApp({
+    req,
+    authToken: true,
+    per: WritePermissionVal,
+    appId: req.body.appId
+  });
+
+  const { tmbId } = app.parentId
+    ? await authApp({ req, appId: app.parentId, per: TeamAppCreatePermissionVal, authToken: true })
+    : await authUserPer({ req, authToken: true, per: TeamAppCreatePermissionVal });
 
   const appId = await onCreateApp({
     parentId: app.parentId,

projects/app/src/pages/api/core/app/create.ts

@@ -17,6 +17,7 @@ import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 import { MongoTeamMember } from '@fastgpt/service/support/user/team/teamMemberSchema';
 import { pushTrack } from '@fastgpt/service/common/middle/tracks/utils';
 import { refreshSourceAvatar } from '@fastgpt/service/common/file/image/controller';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 export type CreateAppBody = {
   parentId?: ParentIdType;
@@ -36,18 +37,15 @@ async function handler(req: ApiRequestProps<CreateAppBody>) {
   }
 
   // 凭证校验
-  const [{ teamId, tmbId, userId }] = await Promise.all([
-    authUserPer({ req, authToken: true, per: WritePermissionVal }),
-    ...(parentId
-      ? [authApp({ req, appId: parentId, per: WritePermissionVal, authToken: true })]
-      : [])
-  ]);
+  const { teamId, tmbId, userId } = parentId
+    ? await authApp({ req, appId: parentId, per: TeamAppCreatePermissionVal, authToken: true })
+    : await authUserPer({ req, authToken: true, per: TeamAppCreatePermissionVal });
 
   // 上限校验
   await checkTeamAppLimit(teamId);
   const tmb = await MongoTeamMember.findById({ _id: tmbId }, 'userId').populate<{
-    user: { avatar: string; username: string };
-  }>('user', 'avatar username');
+    user: { username: string };
+  }>('user', 'username');
 
   // 创建app
   const appId = await onCreateApp({
@@ -60,7 +58,7 @@ async function handler(req: ApiRequestProps<CreateAppBody>) {
     chatConfig,
     teamId,
     tmbId,
-    userAvatar: tmb?.user?.avatar,
+    userAvatar: tmb?.avatar,
     username: tmb?.user?.username
   });
 

projects/app/src/pages/api/core/app/folder/create.ts

@@ -16,7 +16,7 @@ import { mongoSessionRun } from '@fastgpt/service/common/mongo/sessionRun';
 import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 import { syncCollaborators } from '@fastgpt/service/support/permission/inheritPermission';
 import { getResourceClbsAndGroups } from '@fastgpt/service/support/permission/controller';
-import { TeamWritePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
 
 export type CreateAppFolderBody = {
@@ -33,21 +33,9 @@ async function handler(req: ApiRequestProps<CreateAppFolderBody>) {
   }
 
   // 凭证校验
-  const { teamId, tmbId } = await authUserPer({
-    req,
-    authToken: true,
-    per: TeamWritePermissionVal
-  });
-
-  if (parentId) {
-    // if it is not a root folder
-    await authApp({
-      req,
-      appId: parentId,
-      per: WritePermissionVal,
-      authToken: true
-    });
-  }
+  const { teamId, tmbId } = parentId
+    ? await authApp({ req, appId: parentId, per: TeamAppCreatePermissionVal, authToken: true })
+    : await authUserPer({ req, authToken: true, per: TeamAppCreatePermissionVal });
 
   // Create app
   await mongoSessionRun(async (session) => {

projects/app/src/pages/api/core/app/httpPlugin/create.ts

@@ -9,6 +9,8 @@ import { onCreateApp, type CreateAppBody } from '../create';
 import { AppSchema } from '@fastgpt/global/core/app/type';
 import { AppTypeEnum } from '@fastgpt/global/core/app/constants';
 import { pushTrack } from '@fastgpt/service/common/middle/tracks/utils';
+import { authApp } from '@fastgpt/service/support/permission/app/auth';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 export type createHttpPluginQuery = {};
 
@@ -29,11 +31,9 @@ async function handler(
     return Promise.reject('缺少参数');
   }
 
-  const { teamId, tmbId, userId } = await authUserPer({
-    req,
-    authToken: true,
-    per: WritePermissionVal
-  });
+  const { teamId, tmbId, userId } = parentId
+    ? await authApp({ req, appId: parentId, per: TeamAppCreatePermissionVal, authToken: true })
+    : await authUserPer({ req, authToken: true, per: TeamAppCreatePermissionVal });
 
   await mongoSessionRun(async (session) => {
     // create http plugin folder

projects/app/src/pages/api/core/app/update.ts

@@ -20,7 +20,7 @@ import { ClientSession } from 'mongoose';
 import { mongoSessionRun } from '@fastgpt/service/common/mongo/sessionRun';
 import { getResourceClbsAndGroups } from '@fastgpt/service/support/permission/controller';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
-import { TeamWritePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 import { AppErrEnum } from '@fastgpt/global/common/error/code/app';
 import { refreshSourceAvatar } from '@fastgpt/service/common/file/image/controller';
 import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
@@ -79,7 +79,7 @@ async function handler(req: ApiRequestProps<AppUpdateBody, AppUpdateQuery>) {
       await authUserPer({
         req,
         authToken: true,
-        per: TeamWritePermissionVal
+        per: TeamAppCreatePermissionVal
       });
     }
   } else {

projects/app/src/pages/api/core/dataset/create.ts

@@ -6,11 +6,9 @@ import {
   getLLMModel,
   getEmbeddingModel,
   getDatasetModel,
-  getDefaultEmbeddingModel,
-  getVlmModel
+  getDefaultEmbeddingModel
 } from '@fastgpt/service/core/ai/model';
 import { checkTeamDatasetLimit } from '@fastgpt/service/support/permission/teamLimit';
-import { WritePermissionVal } from '@fastgpt/global/support/permission/constant';
 import { NextAPI } from '@/service/middleware/entry';
 import type { ApiRequestProps } from '@fastgpt/service/type/next';
 import { parseParentIdInMongo } from '@fastgpt/global/common/parentFolder/utils';
@@ -18,6 +16,7 @@ import { authDataset } from '@fastgpt/service/support/permission/dataset/auth';
 import { pushTrack } from '@fastgpt/service/common/middle/tracks/utils';
 import { mongoSessionRun } from '@fastgpt/service/common/mongo/sessionRun';
 import { refreshSourceAvatar } from '@fastgpt/service/common/file/image/controller';
+import { TeamDatasetCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 export type DatasetCreateQuery = {};
 export type DatasetCreateBody = CreateDatasetParams;
@@ -41,25 +40,20 @@ async function handler(
   } = req.body;
 
   // auth
-  const [{ teamId, tmbId, userId }] = await Promise.all([
-    authUserPer({
-      req,
-      authToken: true,
-      authApiKey: true,
-      per: WritePermissionVal
-    }),
-    ...(parentId
-      ? [
-          authDataset({
-            req,
-            datasetId: parentId,
-            authToken: true,
-            authApiKey: true,
-            per: WritePermissionVal
-          })
-        ]
-      : [])
-  ]);
+  const { teamId, tmbId, userId } = parentId
+    ? await authDataset({
+        req,
+        datasetId: parentId,
+        authToken: true,
+        authApiKey: true,
+        per: TeamDatasetCreatePermissionVal
+      })
+    : await authUserPer({
+        req,
+        authToken: true,
+        authApiKey: true,
+        per: TeamDatasetCreatePermissionVal
+      });
 
   // check model valid
   const vectorModelStore = getEmbeddingModel(vectorModel);

projects/app/src/pages/api/core/dataset/folder/create.ts

@@ -5,8 +5,7 @@ import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
 import {
   OwnerPermissionVal,
-  PerResourceTypeEnum,
-  WritePermissionVal
+  PerResourceTypeEnum
 } from '@fastgpt/global/support/permission/constant';
 import { authDataset } from '@fastgpt/service/support/permission/dataset/auth';
 import { mongoSessionRun } from '@fastgpt/service/common/mongo/sessionRun';
@@ -16,6 +15,7 @@ import { DatasetTypeEnum } from '@fastgpt/global/core/dataset/constants';
 import { getResourceClbsAndGroups } from '@fastgpt/service/support/permission/controller';
 import { syncCollaborators } from '@fastgpt/service/support/permission/inheritPermission';
 import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
+import { TeamDatasetCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 export type DatasetFolderCreateQuery = {};
 export type DatasetFolderCreateBody = {
   parentId?: string;
@@ -33,20 +33,20 @@ async function handler(
     return Promise.reject(CommonErrEnum.missingParams);
   }
 
-  const { tmbId, teamId } = await authUserPer({
-    req,
-    per: WritePermissionVal,
-    authToken: true
-  });
-
-  if (parentId) {
-    await authDataset({
-      datasetId: parentId,
-      per: WritePermissionVal,
-      req,
-      authToken: true
-    });
-  }
+  const { teamId, tmbId } = parentId
+    ? await authDataset({
+        req,
+        datasetId: parentId,
+        authToken: true,
+        authApiKey: true,
+        per: TeamDatasetCreatePermissionVal
+      })
+    : await authUserPer({
+        req,
+        authToken: true,
+        authApiKey: true,
+        per: TeamDatasetCreatePermissionVal
+      });
 
   await mongoSessionRun(async (session) => {
     const dataset = await MongoDataset.create({

projects/app/src/pages/api/core/dataset/update.ts

@@ -23,7 +23,7 @@ import {
   syncCollaborators
 } from '@fastgpt/service/support/permission/inheritPermission';
 import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
-import { TeamWritePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { TeamDatasetCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 import { DatasetErrEnum } from '@fastgpt/global/common/error/code/dataset';
 import { MongoDatasetTraining } from '@fastgpt/service/core/dataset/training/schema';
 import { MongoDatasetCollection } from '@fastgpt/service/core/dataset/collection/schema';
@@ -104,7 +104,7 @@ async function handler(
       await authUserPer({
         req,
         authToken: true,
-        per: TeamWritePermissionVal
+        per: TeamDatasetCreatePermissionVal
       });
     }
   } else {

projects/app/src/pages/api/support/openapi/create.ts

@@ -4,12 +4,10 @@ import { authUserPer } from '@fastgpt/service/support/permission/user/auth';
 import { getNanoid } from '@fastgpt/global/common/string/tools';
 import type { ApiRequestProps } from '@fastgpt/service/type/next';
 import { NextAPI } from '@/service/middleware/entry';
-import {
-  ManagePermissionVal,
-  WritePermissionVal
-} from '@fastgpt/global/support/permission/constant';
+import { ManagePermissionVal } from '@fastgpt/global/support/permission/constant';
 import { authApp } from '@fastgpt/service/support/permission/app/auth';
 import { OpenApiErrEnum } from '@fastgpt/global/common/error/code/openapi';
+import { TeamApikeyCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
 
 async function handler(req: ApiRequestProps<EditApiKeyProps>): Promise<string> {
   const { appId, name, limit } = req.body;
@@ -19,7 +17,7 @@ async function handler(req: ApiRequestProps<EditApiKeyProps>): Promise<string> {
       const { teamId, tmbId } = await authUserPer({
         req,
         authToken: true,
-        per: WritePermissionVal
+        per: TeamApikeyCreatePermissionVal
       });
       return { teamId, tmbId };
     } else {

projects/app/src/pages/app/list/index.tsx

@@ -31,6 +31,7 @@ import MyIcon from '@fastgpt/web/components/common/Icon';
 import TemplateMarketModal from '@/pageComponents/app/list/TemplateMarketModal';
 import MyImage from '@fastgpt/web/components/common/Image/MyImage';
 import JsonImportModal from '@/pageComponents/app/list/JsonImportModal';
+import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 
 const CreateModal = dynamic(() => import('@/pageComponents/app/list/CreateModal'));
 const EditFolderModal = dynamic(
@@ -213,7 +214,7 @@ const MyApps = () => {
 
             {(folderDetail
               ? folderDetail.permission.hasWritePer && folderDetail?.type !== AppTypeEnum.httpPlugin
-              : userInfo?.team.permission.hasWritePer) && (
+              : userInfo?.team.permission.hasAppCreatePer) && (
               <MyMenu
                 size="md"
                 Button={
@@ -327,7 +328,7 @@ const MyApps = () => {
                 }: {
                   members?: string[];
                   groups?: string[];
-                  permission: number;
+                  permission: PermissionValueType;
                 }) => {
                   return postUpdateAppCollaborators({
                     members,

projects/app/src/pages/dataset/list/index.tsx

@@ -29,6 +29,7 @@ import { DatasetTypeEnum } from '@fastgpt/global/core/dataset/constants';
 import { useToast } from '@fastgpt/web/hooks/useToast';
 import MyBox from '@fastgpt/web/components/common/MyBox';
 import { useSystemStore } from '@/web/common/system/useSystemStore';
+import { PermissionValueType } from '@fastgpt/global/support/permission/type';
 
 const EditFolderModal = dynamic(
   () => import('@fastgpt/web/components/common/MyModal/EditFolderModal')
@@ -138,7 +139,7 @@ const Dataset = () => {
 
             {(folderDetail
               ? folderDetail.permission.hasWritePer
-              : userInfo?.team?.permission.hasWritePer) && (
+              : userInfo?.team?.permission.hasDatasetCreatePer) && (
               <Box pl={[0, 4]}>
                 <MyMenu
                   size="md"
@@ -248,7 +249,7 @@ const Dataset = () => {
                 }: {
                   members?: string[];
                   groups?: string[];
-                  permission: number;
+                  permission: PermissionValueType;
                 }) =>
                   postUpdateDatasetCollaborators({
                     members,

projects/app/test/api/core/app/create.test.ts

+import * as createapi from '@/pages/api/core/app/create';
+import { AppErrEnum } from '@fastgpt/global/common/error/code/app';
+import { AppTypeEnum } from '@fastgpt/global/core/app/constants';
+import { TeamAppCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
+import { getFakeUsers } from '@test/datas/users';
+import { Call } from '@test/utils/request';
+import { expect, it, describe } from 'vitest';
+
+describe('create api', () => {
+  it('should return 200 when create app success', async () => {
+    const users = await getFakeUsers(2);
+    await MongoResourcePermission.create({
+      resourceType: 'team',
+      teamId: users.members[0].teamId,
+      resourceId: null,
+      tmbId: users.members[0].tmbId,
+      permission: TeamAppCreatePermissionVal
+    });
+    const res = await Call<createapi.CreateAppBody, {}, {}>(createapi.default, {
+      auth: users.members[0],
+      body: {
+        modules: [],
+        name: 'testfolder',
+        type: AppTypeEnum.folder
+      }
+    });
+    expect(res.error).toBeUndefined();
+    expect(res.code).toBe(200);
+    const folderId = res.data as string;
+
+    const res2 = await Call<createapi.CreateAppBody, {}, {}>(createapi.default, {
+      auth: users.members[0],
+      body: {
+        modules: [],
+        name: 'testapp',
+        type: AppTypeEnum.simple,
+        parentId: String(folderId)
+      }
+    });
+    expect(res2.error).toBeUndefined();
+    expect(res2.code).toBe(200);
+    expect(res2.data).toBeDefined();
+
+    const res3 = await Call<createapi.CreateAppBody, {}, {}>(createapi.default, {
+      auth: users.members[1],
+      body: {
+        modules: [],
+        name: 'testapp',
+        type: AppTypeEnum.simple,
+        parentId: String(folderId)
+      }
+    });
+    expect(res3.error).toBe(AppErrEnum.unAuthApp);
+    expect(res3.code).toBe(500);
+  });
+});

projects/app/test/api/core/dataset/create.test.ts

+import * as createapi from '@/pages/api/core/dataset/create';
+import { DatasetTypeEnum } from '@fastgpt/global/core/dataset/constants';
+import { TeamDatasetCreatePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
+import { getFakeUsers } from '@test/datas/users';
+import { Call } from '@test/utils/request';
+import { vi, describe, it, expect } from 'vitest';
+
+describe('create dataset', () => {
+  it('should return 200 when create dataset success', async () => {
+    const users = await getFakeUsers(2);
+    await MongoResourcePermission.create({
+      resourceType: 'team',
+      teamId: users.members[0].teamId,
+      resourceId: null,
+      tmbId: users.members[0].tmbId,
+      permission: TeamDatasetCreatePermissionVal
+    });
+    const res = await Call<
+      createapi.DatasetCreateBody,
+      createapi.DatasetCreateQuery,
+      createapi.DatasetCreateResponse
+    >(createapi.default, {
+      auth: users.members[0],
+      body: {
+        name: 'folder',
+        intro: 'intro',
+        avatar: 'avatar',
+        type: DatasetTypeEnum.folder
+      }
+    });
+    expect(res.error).toBeUndefined();
+    expect(res.code).toBe(200);
+    const folderId = res.data as string;
+
+    const res2 = await Call<
+      createapi.DatasetCreateBody,
+      createapi.DatasetCreateQuery,
+      createapi.DatasetCreateResponse
+    >(createapi.default, {
+      auth: users.members[0],
+      body: {
+        name: 'test',
+        intro: 'intro',
+        avatar: 'avatar',
+        type: DatasetTypeEnum.dataset,
+        parentId: folderId
+      }
+    });
+
+    expect(res2.error).toBeUndefined();
+    expect(res2.code).toBe(200);
+  });
+});

projects/app/test/api/support/openapi/create.test.ts

+import { EditApiKeyProps } from '@/global/support/openapi/api';
+import * as createapi from '@/pages/api/support/openapi/create';
+import { DatasetTypeEnum } from '@fastgpt/global/core/dataset/constants';
+import { ManagePermissionVal } from '@fastgpt/global/support/permission/constant';
+import {
+  TeamApikeyCreatePermissionVal,
+  TeamDatasetCreatePermissionVal
+} from '@fastgpt/global/support/permission/user/constant';
+import { MongoApp } from '@fastgpt/service/core/app/schema';
+import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
+import { getFakeUsers } from '@test/datas/users';
+import { Call } from '@test/utils/request';
+import { describe, it, expect } from 'vitest';
+
+describe('create dataset', () => {
+  it('should return 200 when create dataset success', async () => {
+    const users = await getFakeUsers(2);
+    await MongoResourcePermission.create({
+      resourceType: 'team',
+      teamId: users.members[0].teamId,
+      resourceId: null,
+      tmbId: users.members[0].tmbId,
+      permission: TeamApikeyCreatePermissionVal
+    });
+    const res = await Call<EditApiKeyProps>(createapi.default, {
+      auth: users.members[0],
+      body: {
+        name: 'test',
+        limit: {
+          maxUsagePoints: 1000
+        }
+      }
+    });
+    expect(res.error).toBeUndefined();
+    expect(res.code).toBe(200);
+
+    await MongoResourcePermission.create({
+      resourceType: 'app',
+      teamId: users.members[1].teamId,
+      resourceId: null,
+      tmbId: users.members[1].tmbId,
+      permission: ManagePermissionVal
+    });
+
+    const app = await MongoApp.create({
+      name: 'a',
+      type: 'simple',
+      tmbId: users.members[1].tmbId,
+      teamId: users.members[1].teamId
+    });
+    const res2 = await Call<EditApiKeyProps>(createapi.default, {
+      auth: users.members[1],
+      body: {
+        appId: app._id,
+        name: 'test',
+        limit: {
+          maxUsagePoints: 1000
+        }
+      }
+    });
+    expect(res2.error).toBeUndefined();
+    expect(res2.code).toBe(200);
+  });
+});

projects/app/test/tsconfig.json

+{
+  "compilerOptions": {
+    "target": "es2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["../src/*"],
+      "@fastgpt/*": ["../../../packages/*"],
+      "@test/*": ["../../../test/*"]
+    }
+  },
+  "include": ["**/*.test.ts"],
+  "exclude": ["**/node_modules"]
+}

test/cases/spec/workflow/workflow.test.ts → test/cases/service/core/app/workflow/workflowDispatch.test.ts

 import { readFileSync } from 'fs';
 import { resolve } from 'path';
-import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { it, expect, vi } from 'vitest';
 import { dispatchWorkFlow } from '@fastgpt/service/core/workflow/dispatch';
 import {
   getWorkflowEntryNodeIds,
@@ -29,8 +29,9 @@ vi.mock(import('@fastgpt/service/support/wallet/usage/utils'), async (importOrig
 });
 
 const testWorkflow = async (path: string) => {
-  const workflowStr = readFileSync(resolve(path), 'utf-8');
-  const workflow = JSON.parse(workflowStr);
+  const fileContent = readFileSync(resolve(process.cwd(), path), 'utf-8');
+  const workflow = JSON.parse(fileContent);
+  console.log(workflow, 111);
   const { nodes, edges, chatConfig } = workflow;
   let runtimeNodes = storeNodes2RuntimeNodes(nodes, getWorkflowEntryNodeIds(nodes));
   const variables = {};
@@ -74,9 +75,9 @@ const testWorkflow = async (path: string) => {
 
 it('Workflow test: simple workflow', async () => {
   // create a simple app
-  await testWorkflow('test/cases/workflow/simple.json');
+  // await testWorkflow('test/cases/service/core/app/workflow/loopTest.json');
 });
 
 it('Workflow test: output test', async () => {
-  console.log(await testWorkflow('test/cases/workflow/loopTest.json'));
+  // console.log(await testWorkflow('@/test/cases/workflow/loopTest.json'));
 });

test/datas/users.ts

-import { AuthUserTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { AuthUserTypeEnum, PerResourceTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { MemberGroupSchemaType } from '@fastgpt/global/support/permission/memberGroup/type';
+import { PermissionValueType } from '@fastgpt/global/support/permission/type';
+import { TeamManagePermissionVal } from '@fastgpt/global/support/permission/user/constant';
+import { DefaultGroupName } from '@fastgpt/global/support/user/team/group/constant';
+import { OrgSchemaType, OrgType } from '@fastgpt/global/support/user/team/org/type';
+import { MongoMemberGroupModel } from '@fastgpt/service/support/permission/memberGroup/memberGroupSchema';
+import { MongoOrgModel } from '@fastgpt/service/support/permission/org/orgSchema';
+import { MongoResourcePermission } from '@fastgpt/service/support/permission/schema';
 import { MongoUser } from '@fastgpt/service/support/user/schema';
 import { MongoTeamMember } from '@fastgpt/service/support/user/team/teamMemberSchema';
 import { MongoTeam } from '@fastgpt/service/support/user/team/teamSchema';
@@ -33,22 +41,40 @@ export async function getRootUser(): Promise<parseHeaderCertRet> {
   };
 }
 
-export async function getUser(username: string): Promise<parseHeaderCertRet> {
+export async function getUser(username: string, teamId?: string): Promise<parseHeaderCertRet> {
   const user = await MongoUser.create({
     username,
     password: '123456'
   });
 
-  const team = await MongoTeam.create({
-    name: 'test team',
-    ownerId: user._id
-  });
+  const tmb = await (async () => {
+    if (!teamId) {
+      const team = await MongoTeam.create({
+        name: username,
+        ownerId: user._id
+      });
+      const tmb = await MongoTeamMember.create({
+        name: username,
+        teamId: team._id,
+        userId: user._id,
+        status: 'active',
+        role: 'owner'
+      });
 
-  const tmb = await MongoTeamMember.create({
-    teamId: team._id,
-    userId: user._id,
-    status: 'active'
-  });
+      await MongoMemberGroupModel.create({
+        teamId: team._id,
+        name: DefaultGroupName,
+        avatar: team.avatar
+      });
+
+      return tmb;
+    }
+    return MongoTeamMember.create({
+      teamId,
+      userId: user._id,
+      status: 'active'
+    });
+  })();
 
   return {
     userId: user._id,
@@ -61,3 +87,90 @@ export async function getUser(username: string): Promise<parseHeaderCertRet> {
     tmbId: tmb?._id
   };
 }
+
+let fakeUsers: Record<string, parseHeaderCertRet> = {};
+
+async function getFakeUser(username: string) {
+  if (username === 'Owner') {
+    if (!fakeUsers[username]) {
+      fakeUsers[username] = await getUser(username);
+    }
+    return fakeUsers[username];
+  }
+  const owner = await getFakeUser('Owner');
+  const ownerTeamId = owner.teamId;
+  if (!fakeUsers[username]) {
+    fakeUsers[username] = await getUser(username, ownerTeamId);
+  }
+  return fakeUsers[username];
+}
+
+async function addPermission({
+  user,
+  permission
+}: {
+  user: parseHeaderCertRet;
+  permission: PermissionValueType;
+}) {
+  const { teamId, tmbId } = user;
+  await MongoResourcePermission.updateOne({
+    resourceType: PerResourceTypeEnum.team,
+    teamId,
+    resourceId: null,
+    tmbId,
+    permission
+  });
+}
+
+export async function getFakeUsers(num: number = 10) {
+  const owner = await getFakeUser('Owner');
+  const manager = await getFakeUser('Manager');
+  await MongoResourcePermission.create({
+    resourceType: PerResourceTypeEnum.team,
+    teamId: owner.teamId,
+    resourceId: null,
+    tmbId: manager.tmbId,
+    permission: TeamManagePermissionVal
+  });
+  const members = (await Promise.all(
+    Array.from({ length: num }, (_, i) => `member${i + 1}`) // 团队 member1, member2, ..., member10
+      .map((username) => getFakeUser(username))
+  )) as parseHeaderCertRet[];
+  return {
+    owner,
+    manager,
+    members
+  };
+}
+
+export async function getFakeGroups(num: number = 5) {
+  // create 5 groups
+  const teamId = (await getFakeUser('Owner')).teamId;
+  return MongoMemberGroupModel.create([
+    ...Array(num)
+      .keys()
+      .map((i) => ({
+        name: `group${i + 1}`,
+        teamId
+      }))
+  ]) as Promise<MemberGroupSchemaType[]>;
+}
+
+export async function getFakeOrgs() {
+  // create 5 orgs
+  const pathIds = ['root', 'org1', 'org2', 'org3', 'org4', 'org5'];
+  const paths = ['', '/root', '/root', '/root', '/root/org1', '/root/org1/org4'];
+  const teamId = (await getFakeUser('Owner')).teamId;
+  return MongoOrgModel.create(
+    pathIds.map((pathId, i) => ({
+      pathId,
+      name: pathId,
+      path: paths[i],
+      teamId
+    }))
+  ) as Promise<OrgSchemaType[]>;
+}
+
+export async function clean() {
+  fakeUsers = {};
+}

test/globalSetup.ts

+import { MongoMemoryReplSet } from 'mongodb-memory-server';
+import type { TestProject } from 'vitest/node';
+
+export default async function setup(project: TestProject) {
+  const replset = await MongoMemoryReplSet.create({ replSet: { count: 1 } });
+  const uri = replset.getUri();
+  project.provide('MONGODB_URI', uri);
+
+  return async () => {
+    await replset.stop();
+  };
+}
+
+declare module 'vitest' {
+  export interface ProvidedContext {
+    MONGODB_URI: string;
+  }
+}

test/mocks/request.ts

+import { TeamErrEnum } from '@fastgpt/global/common/error/code/team';
 import { AuthUserTypeEnum } from '@fastgpt/global/support/permission/constant';
+import { TeamPermission } from '@fastgpt/global/support/permission/user/controller';
+import { MongoGroupMemberModel } from '@fastgpt/service/support/permission/memberGroup/groupMemberSchema';
+import { getTmbInfoByTmbId } from '@fastgpt/service/support/user/team/controller';
 import { vi } from 'vitest';
 
 // vi.mock(import('@/service/middleware/entry'), async () => {
@@ -87,3 +91,62 @@ vi.mock(import('@fastgpt/service/support/permission/controller'), async (importO
     parseHeaderCert
   };
 });
+
+vi.mock(
+  import('@fastgpt/service/support/permission/memberGroup/controllers'),
+  async (importOriginal) => {
+    const mod = await importOriginal();
+    const parseHeaderCert = vi.fn(
+      ({
+        req,
+        authToken = false,
+        authRoot = false,
+        authApiKey = false
+      }: {
+        req: MockReqType;
+        authToken?: boolean;
+        authRoot?: boolean;
+        authApiKey?: boolean;
+      }) => {
+        const { auth } = req;
+        if (!auth) {
+          return Promise.reject(Error('unAuthorization(mock)'));
+        }
+        return Promise.resolve(auth);
+      }
+    );
+    const authGroupMemberRole = vi.fn(async ({ groupId, role, ...props }: any) => {
+      const result = await parseHeaderCert(props);
+      const { teamId, tmbId, isRoot } = result;
+      if (isRoot) {
+        return {
+          ...result,
+          permission: new TeamPermission({
+            isOwner: true
+          }),
+          teamId,
+          tmbId
+        };
+      }
+      const [groupMember, tmb] = await Promise.all([
+        MongoGroupMemberModel.findOne({ groupId, tmbId }),
+        getTmbInfoByTmbId({ tmbId })
+      ]);
+
+      // Team admin or role check
+      if (tmb.permission.hasManagePer || (groupMember && role.includes(groupMember.role))) {
+        return {
+          ...result,
+          permission: tmb.permission,
+          teamId,
+          tmbId
+        };
+      }
+      return Promise.reject(TeamErrEnum.unAuthTeam);
+    });
+    return {
+      ...mod,
+      authGroupMemberRole
+    };
+  }
+);

test/setup.ts

+import './mocks';
 import { existsSync, readFileSync } from 'fs';
-import mongoose from '@fastgpt/service/common/mongo';
 import { connectMongo } from '@fastgpt/service/common/mongo/init';
-import {
-  connectionMongo,
-  connectionLogMongo,
-  MONGO_URL,
-  MONGO_LOG_URL
-} from '@fastgpt/service/common/mongo';
 import { initGlobalVariables } from '@/service/common/system';
-import { afterAll, beforeAll, vi } from 'vitest';
-import { setup, teardown } from 'vitest-mongodb';
+import { afterAll, beforeAll, beforeEach, inject, vi } from 'vitest';
 import setupModels from './setupModels';
-import './mocks';
+import { clean } from './datas/users';
+import { connectionLogMongo, connectionMongo, Mongoose } from '@fastgpt/service/common/mongo';
+import { randomUUID } from 'crypto';
 
 vi.stubEnv('NODE_ENV', 'test');
-vi.mock(import('@fastgpt/service/common/mongo'), async (importOriginal) => {
+
+vi.mock(import('@fastgpt/service/common/mongo/init'), async (importOriginal: any) => {
   const mod = await importOriginal();
   return {
     ...mod,
-    connectionMongo: await (async () => {
-      if (!global.mongodb) {
-        global.mongodb = mongoose;
-        await global.mongodb.connect((globalThis as any).__MONGO_URI__ as string);
-      }
-
-      return global.mongodb;
-    })()
+    connectMongo: async (db: Mongoose, url: string) => {
+      (await db.connect(url)).connection.useDb(randomUUID());
+    }
   };
 });
 
@@ -59,18 +50,12 @@ vi.mock(import('@/service/common/system'), async (importOriginal) => {
 });
 
 beforeAll(async () => {
-  await setup({
-    type: 'replSet',
-    serverOptions: {
-      replSet: {
-        count: 1
-      }
-    }
-  });
-  vi.stubEnv('MONGODB_URI', (globalThis as any).__MONGO_URI__);
+  vi.stubEnv('MONGODB_URI', inject('MONGODB_URI'));
+  await connectMongo(connectionMongo, inject('MONGODB_URI'));
+  await connectMongo(connectionLogMongo, inject('MONGODB_URI'));
+
   initGlobalVariables();
-  await connectMongo(connectionMongo, MONGO_URL);
-  await connectMongo(connectionLogMongo, MONGO_LOG_URL);
+  global.systemEnv = {} as any;
 
   // await getInitConfig();
   if (existsSync('projects/app/.env.local')) {
@@ -83,13 +68,27 @@ beforeAll(async () => {
         systemEnv[key] = value;
       }
     }
-    global.systemEnv = {} as any;
     global.systemEnv.oneapiUrl = systemEnv['OPENAI_BASE_URL'];
     global.systemEnv.chatApiKey = systemEnv['CHAT_API_KEY'];
-    await setupModels();
   }
+  global.feConfigs = {
+    isPlus: false
+  } as any;
+  await setupModels();
 });
 
 afterAll(async () => {
-  await teardown();
+  if (connectionMongo?.connection) connectionMongo?.connection.close();
+  if (connectionLogMongo?.connection) connectionLogMongo?.connection.close();
+});
+
+beforeEach(async () => {
+  await connectMongo(connectionMongo, inject('MONGODB_URI'));
+  await connectMongo(connectionLogMongo, inject('MONGODB_URI'));
+
+  return async () => {
+    clean();
+    await connectionMongo?.connection.db?.dropDatabase();
+    await connectionLogMongo?.connection.db?.dropDatabase();
+  };
 });

test/setupModels.ts

@@ -3,6 +3,7 @@ import { ModelProviderIdType } from 'packages/global/core/ai/provider';
 
 export default async function setupModels() {
   global.llmModelMap = new Map<string, any>();
+  global.embeddingModelMap = new Map<string, any>();
   global.llmModelMap.set('gpt-4o-mini', {
     type: ModelTypeEnum.llm,
     model: 'gpt-4o-mini',
@@ -47,6 +48,22 @@ export default async function setupModels() {
       maxContext: 4096,
       maxResponse: 4096,
       quoteMaxToken: 2048
+    },
+    embedding: {
+      type: ModelTypeEnum.embedding,
+      model: 'text-embedding-ada-002',
+      name: 'text-embedding-ada-002',
+      avatar: 'text-embedding-ada-002',
+      isActive: true,
+      isDefault: true,
+      isCustom: false,
+      requestUrl: undefined,
+      requestAuth: undefined,
+      defaultConfig: undefined,
+      defaultToken: 1,
+      maxToken: 100,
+      provider: 'OpenAI',
+      weight: 1
     }
   };
 }

test/utils/request.ts

 import { NextApiHandler } from '@fastgpt/service/common/middle/entry';
 import { MockReqType } from '../mocks/request';
+import { vi } from 'vitest';
 
 export async function Call<B = any, Q = any, R = any>(
   handler: NextApiHandler<R>,
   props?: MockReqType<B, Q>
 ) {
   const { body = {}, query = {}, ...rest } = props || {};
-  return (await handler(
+  let raw;
+  const res: any = {
+    setHeader: vi.fn(),
+    write: vi.fn((data: any) => {
+      raw = data;
+    }),
+    end: vi.fn()
+  };
+  const response = (await handler(
     {
-      body: body,
-      query: query,
+      body: JSON.parse(JSON.stringify(body)),
+      query: JSON.parse(JSON.stringify(query)),
       ...(rest as any)
     },
-    {} as any
-  )) as Promise<{
+    res
+  )) as any;
+  return {
+    ...response,
+    raw
+  } as {
     code: number;
     data: R;
     error?: any;
-  }>;
+    raw?: any;
+  };
 }

vitest.config.mts

@@ -5,13 +5,18 @@ export default defineConfig({
     coverage: {
       enabled: true,
       reporter: ['html', 'json-summary', 'json'],
-      all: false,
-      reportOnFailure: true
+      reportOnFailure: true,
+      include: ['projects/**/*.ts', 'packages/**/*.ts'],
+      cleanOnRerun: false
     },
     outputFile: 'test-results.json',
-    setupFiles: ['./test/setup.ts'],
-    include: ['./test/test.ts', './test/cases/**/*.test.ts'],
-    testTimeout: 5000
+    setupFiles: 'test/setup.ts',
+    globalSetup: 'test/globalSetup.ts',
+    fileParallelism: false,
+    pool: 'threads',
+    include: ['test/test.ts', 'test/cases/**/*.test.ts', 'projects/app/test/**/*.test.ts'],
+    testTimeout: 5000,
+    reporters: ['github-actions', 'default']
   },
   resolve: {
     alias: {