姚章浩
693cd952cd
仓库首次入库（此前仅存在于本地工作区与测试服构建产物中，未上传）。 改动（src/knowledge_adapter/asset_content_processor.py）： - 新增 _TRUNCATED_TRAILING_MARKDOWN_RESOURCE_IMAGE 规则，清除 chunk 末尾被截断的 .resolve().parents[1]
|
|
GRANT_SQL = PROJECT_ROOT / "deploy" / "sql" / "weknora_readonly_grants.sql"
|
|
|
|
|
|
def test_weknora_role_grants_only_required_resource_columns() -> None:
|
|
assert GRANT_SQL.exists(), "WeKnora readonly grant SQL is missing"
|
|
|
|
sql = " ".join(GRANT_SQL.read_text(encoding="utf-8").lower().split())
|
|
required_columns = (
|
|
"handle, tenant_id, storage_backend_id, provider, physical_path, "
|
|
"mime_type, state, deleted_at"
|
|
)
|
|
assert "grant usage on schema public" in sql
|
|
assert f"grant select ({required_columns}) on table public.resources" in sql
|
|
assert "grant select on table" not in sql
|
|
assert "grant select on all tables" not in sql
|
|
|
|
for forbidden_operation in ("insert", "update", "delete", "truncate", "create", "alter"):
|
|
assert f"grant {forbidden_operation}" not in sql
|
|
for forbidden_table in (
|
|
"users",
|
|
"api_keys",
|
|
"models",
|
|
"knowledge_chunks",
|
|
"knowledges",
|
|
"knowledge_bases",
|
|
"storage_backends",
|
|
):
|
|
assert f"public.{forbidden_table}" not in sql
|