From fd2a52a1a5e31799e416586b6633621d9142823e Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Wed, 2 Sep 2026 14:58:43 +0800
Subject: [PATCH] =?UTF-8?q?fix(rag-perm):=20file=5Flist/file=5Fserve=20?=
 =?UTF-8?q?=E7=BB=B4=E6=8A=A4=E8=80=85=E4=B9=9F=E9=9C=80=E8=A6=81=E7=9C=8B?=
 =?UTF-8?q?=E6=96=87=E4=BB=B6=E5=88=97=E8=A1=A8=E5=92=8C=E4=B8=8B=E8=BD=BD?=
 =?UTF-8?q?=E2=80=94=E2=80=94maintain=E6=88=96search=E4=BB=BB=E4=B8=80?=
 =?UTF-8?q?=E9=80=9A=E8=BF=87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 rag/init.py                                 | 5 ++++-
 wwwroot/knowledge_bases_list/file_list.dspy | 7 +++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/rag/init.py b/rag/init.py
index 63955c5..2345c9c 100644
--- a/rag/init.py
+++ b/rag/init.py
@@ -584,7 +584,10 @@ async def file_serve_handler(request, params_kw, *args, **kwargs):
             doc = recs[0]
             ok, kb, msg = await check_kb_perm(env, sor, doc.kb_id, 'search')
             if not ok:
-                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
+                # 维护者也需要下载文件（管理职责）
+                ok2, _, _ = await check_kb_perm(env, sor, doc.kb_id, 'maintain')
+                if not ok2:
+                    return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
             fp = doc.file_path or ''
             if fp.startswith('/rags/'):
                 parts = [p for p in fp.split('/') if p]
diff --git a/wwwroot/knowledge_bases_list/file_list.dspy b/wwwroot/knowledge_bases_list/file_list.dspy
index e4c0aef..d1d4813 100644
--- a/wwwroot/knowledge_bases_list/file_list.dspy
+++ b/wwwroot/knowledge_bases_list/file_list.dspy
@@ -14,8 +14,11 @@ from rag.init import check_kb_perm
 env = request._run_ns
 async with db.sqlorContext(dbname) as sor:
     _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'search')
-if not _ok:
-    return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center", "marginTop": "40px"}}
+    if not _ok:
+        # 维护者也需要看到文件列表/下载文件（管理职责）
+        _ok2, _kb, _msg2 = await check_kb_perm(env, sor, kb_id, 'maintain')
+        if not _ok2:
+            return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center", "marginTop": "40px"}}
 
 rows = []
 try: