feat: add governed public knowledge retrieval

2026-09-10 18:42:44 +08:00
parent ba22a2220f
commit 511a8ca18f
20 changed files with 729 additions and 7 deletions
@@ -92,6 +92,7 @@ class JwtAuthenticator:
        if claims.get("visitor") is True:
            return RequestContext(
                user_id=str(subject), trace_id=str(uuid4()), roles=("visitor",),
-                permissions=("agent:run",), data_scope="public",
+                # 访客仅可运行 Agent 与读取已发布的公共知识，绝不含个人数据权限。
+                permissions=("agent:run", "knowledge:query"), data_scope="public",
            )
        return RequestContext(user_id=str(claims["sub"]), trace_id=str(uuid4()))