From 542890eb88684fc1fad3d495a9319b484aa4a785 Mon Sep 17 00:00:00 2001 From: actiontech-zihan Date: Wed, 8 Jul 2026 06:40:28 +0000 Subject: [PATCH] fix(sql_workbench): enforce business write permission for auto workflow exec --- internal/dms/biz/cloudbeaver.go | 6 +++++- internal/sql_workbench/service/workflow_exec.go | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/internal/dms/biz/cloudbeaver.go b/internal/dms/biz/cloudbeaver.go index 3ee84446..38fb1889 100644 --- a/internal/dms/biz/cloudbeaver.go +++ b/internal/dms/biz/cloudbeaver.go @@ -2060,7 +2060,11 @@ func (cu *CloudbeaverUsecase) getContextSchema(c echo.Context, connectionId, con // checkWorkflowPermission 校验用户是否有数据源上的"创建、审批、上线工单"的权限 // 权限可以是项目级别的（项目管理员）或数据源级别的（直接针对数据源的工单权限） func (cu *CloudbeaverUsecase) checkWorkflowPermission(ctx context.Context, userUid string, dbService *DBService) (bool, error) { - if userUid == constant.UIDOfUserAdmin { + canOpGlobal, err := cu.opPermissionVerifyUsecase.CanOpGlobal(ctx, userUid, true) + if err != nil { + return false, fmt.Errorf("check global op permission err: %v", err) + } + if canOpGlobal { return true, nil } opPermissions, err := cu.opPermissionVerifyUsecase.GetUserOpPermissionInProject(ctx, userUid, dbService.ProjectUID) diff --git a/internal/sql_workbench/service/workflow_exec.go b/internal/sql_workbench/service/workflow_exec.go index 5527f503..569a8845 100644 --- a/internal/sql_workbench/service/workflow_exec.go +++ b/internal/sql_workbench/service/workflow_exec.go @@ -81,7 +81,11 @@ func (sqlWorkbenchService *SqlWorkbenchService) shouldExecuteByWorkflow(dbServic } func (sqlWorkbenchService *SqlWorkbenchService) checkWorkflowPermission(ctx context.Context, userUID string, dbService *biz.DBService) (bool, error) { - if userUID == constant.UIDOfUserAdmin { + canOpGlobal, err := sqlWorkbenchService.opPermissionVerifyUsecase.CanOpGlobal(ctx, userUID, true) + if err != nil { + return false, fmt.Errorf("check global op permission err: %v", err) + } + if canOpGlobal { return true, nil } opPermissions, err := sqlWorkbenchService.opPermissionVerifyUsecase.GetUserOpPermissionInProject(ctx, userUID, dbService.ProjectUID)