fix: auto 分组令牌请求返回 403#4719
Conversation
1. middleware/auth.go: TokenAuth 中间件对 "auto" 伪分组跳过 UserUsableGroups 校验，修复 auto 分组令牌请求返回 403 的问题。 auto 分组的实际权限控制由下游 GetUserAutoGroup 保证。 2. web/default: 当 DefaultUseAutoGroup 为 false 时，新建 API 密钥 的分组默认值使用接口返回的第一个可用分组，而非空字符串。 Closes QuantumNous#3189 Related QuantumNous#4653 QuantumNous#4160
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
WalkthroughThe PR enables "auto" group support for API key creation. The backend now exempts "auto" tokens from usable-group membership checks, while the frontend drawer derives the first available group from fetched groups and uses it as the default form value when not in auto mode. ChangesAuto Group Support for API Keys
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
web/default/src/features/keys/components/api-keys-mutate-drawer.tsx (1)
168-184:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPrevent form reset when groups load during create-mode input.
The
firstGroupdependency in the useEffect (line 184) causes the form to reset whenever groups are fetched or refetched, wiping any input the user has entered in create mode. On slow networks, opening the create drawer, typing a name, and waiting for the groups query to complete will lose that input.Guard the reset in create mode with a dirty check:
Suggested fix
} else if (open && !isUpdate) { // For create, reset to defaults - form.reset(getApiKeyFormDefaultValues(defaultUseAutoGroup, firstGroup)) + if (!form.formState.isDirty) { + form.reset(getApiKeyFormDefaultValues(defaultUseAutoGroup, firstGroup)) + } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@web/default/src/features/keys/components/api-keys-mutate-drawer.tsx` around lines 168 - 184, The useEffect currently resets the create-mode form whenever firstGroup (groups) changes, wiping user input; update the create branch so it only calls form.reset(getApiKeyFormDefaultValues(defaultUseAutoGroup, firstGroup)) when the form is not dirty (use form.formState.isDirty or form.getState().isDirty depending on your form API) — keep the existing fetch/update logic (getApiKey and transformApiKeyToFormDefaults) for isUpdate, and leave the effect dependencies (open, isUpdate, currentRow, form, defaultUseAutoGroup, firstGroup) intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@web/default/src/features/keys/components/api-keys-mutate-drawer.tsx`:
- Around line 168-184: The useEffect currently resets the create-mode form
whenever firstGroup (groups) changes, wiping user input; update the create
branch so it only calls
form.reset(getApiKeyFormDefaultValues(defaultUseAutoGroup, firstGroup)) when the
form is not dirty (use form.formState.isDirty or form.getState().isDirty
depending on your form API) — keep the existing fetch/update logic (getApiKey
and transformApiKeyToFormDefaults) for isUpdate, and leave the effect
dependencies (open, isUpdate, currentRow, form, defaultUseAutoGroup, firstGroup)
intact.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: af37624e-9f02-4a4f-af90-d4f2ca67a22a
📒 Files selected for processing (3)
middleware/auth.goweb/default/src/features/keys/components/api-keys-mutate-drawer.tsxweb/default/src/features/keys/lib/api-key-form.ts
Prevent groups async load from wiping user input when firstGroup changes after the user has started filling the form.
When defaultUseAutoGroup=false, the group field should remain empty (showing placeholder) so users explicitly choose a group, rather than auto-selecting the first available group from the API response.
Take main's backendHasAuto check for defaultUseAutoGroup, which correctly guards auto group default based on backend state.
1 participant
📝 变更描述 / Description
问题：auto 分组令牌请求返回 403
middleware/auth.go的TokenAuth中间件在校验令牌分组时，会检查tokenGroup是否在用户可用分组列表（UserUsableGroups）中。但"auto"是一个伪分组（pseudo-group），不会出现在可用分组列表里，导致所有 auto 分组的令牌请求直接被 403 拦截。后面第 392 行已经有对
"auto"的特殊处理（跳过"已弃用"检查），但代码在第 386 行就提前返回了，根本执行不到。修复： 对
"auto"跳过UserUsableGroups校验。这是安全的，因为下游GetUserAutoGroup()会根据用户实际可用分组过滤 auto 能解析到的真实分组，权限控制由下游保证。与 #4653 是同一类问题（该 PR 修复的是
distributor.go中的相同逻辑）。🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
后端编译通过：
修复前（auto 分组令牌请求 /v1/models）：
{ "error": { "code": "", "message": "无权访问 auto 分组", "type": "new_api_error" } }修复后： 正常返回模型列表。
Summary by CodeRabbit
Release Notes