enterprise model credential

2026-05-02 08:28:03 +08:00 · 2025-08-20 15:12:20 +08:00
parent ca0d04b841
commit b3e5a4ecb7
21 changed files with 298 additions and 113 deletions
--- a/web/app/components/plugins/plugin-auth/authorize/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/index.tsx
@ -8,6 +8,8 @@ import type { AddOAuthButtonProps } from './add-oauth-button'
 import AddApiKeyButton from './add-api-key-button'
 import type { AddApiKeyButtonProps } from './add-api-key-button'
 import type { PluginPayload } from '../types'
+import cn from '@/utils/classnames'
+import Tooltip from '@/app/components/base/tooltip'

 type AuthorizeProps = {
  pluginPayload: PluginPayload
@ -17,6 +19,7 @@ type AuthorizeProps = {
  canApiKey?: boolean
  disabled?: boolean
  onUpdate?: () => void
+  notAllowCustomCredential?: boolean
 }
 const Authorize = ({
  pluginPayload,
@ -26,6 +29,7 @@ const Authorize = ({
  canApiKey,
  disabled,
  onUpdate,
+  notAllowCustomCredential,
 }: AuthorizeProps) => {
  const { t } = useTranslation()
  const oAuthButtonProps: AddOAuthButtonProps = useMemo(() => {
@ -62,18 +66,54 @@ const Authorize = ({
    }
  }, [canOAuth, theme, pluginPayload, t])

+  const OAuthButton = useMemo(() => {
+    const Item = (
+      <div className={cn('min-w-0 flex-[1]', notAllowCustomCredential && 'opacity-50')}>
+        <AddOAuthButton
+          {...oAuthButtonProps}
+          disabled={disabled || notAllowCustomCredential}
+          onUpdate={onUpdate}
+        />
+      </div>
+    )
+
+    if (notAllowCustomCredential) {
+      return (
+        <Tooltip popupContent={t('plugin.auth.credentialUnavailable')}>
+          {Item}
+        </Tooltip>
+      )
+    }
+    return Item
+  }, [notAllowCustomCredential, oAuthButtonProps, disabled, onUpdate, t])
+
+  const ApiKeyButton = useMemo(() => {
+    const Item = (
+      <div className={cn('min-w-0 flex-[1]', notAllowCustomCredential && 'opacity-50')}>
+        <AddApiKeyButton
+          {...apiKeyButtonProps}
+          disabled={disabled || notAllowCustomCredential}
+          onUpdate={onUpdate}
+        />
+      </div>
+    )
+
+    if (notAllowCustomCredential) {
+      return (
+        <Tooltip popupContent={t('plugin.auth.credentialUnavailable')}>
+          {Item}
+        </Tooltip>
+      )
+    }
+    return Item
+  }, [notAllowCustomCredential, apiKeyButtonProps, disabled, onUpdate, t])
+
  return (
    <>
      <div className='flex items-center space-x-1.5'>
        {
          canOAuth && (
-            <div className='min-w-0 flex-[1]'>
-              <AddOAuthButton
-                {...oAuthButtonProps}
-                disabled={disabled}
-                onUpdate={onUpdate}
-              />
-            </div>
+            OAuthButton
          )
        }
        {
@ -87,13 +127,7 @@ const Authorize = ({
        }
        {
          canApiKey && (
-            <div className='min-w-0 flex-[1]'>
-              <AddApiKeyButton
-                {...apiKeyButtonProps}
-                disabled={disabled}
-                onUpdate={onUpdate}
-              />
-            </div>
+            ApiKeyButton
          )
        }
      </div>
--- a/web/app/components/plugins/plugin-auth/authorized-in-node.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized-in-node.tsx
@ -35,10 +35,12 @@ const AuthorizedInNode = ({
    credentials,
    disabled,
    invalidPluginCredentialInfo,
+    notAllowCustomCredential,
  } = usePluginAuth(pluginPayload, isOpen || !!credentialId)
  const renderTrigger = useCallback((open?: boolean) => {
    let label = ''
    let removed = false
+    let unavailable = false
    if (!credentialId) {
      label = t('plugin.auth.workspaceDefault')
    }
@ -46,6 +48,7 @@ const AuthorizedInNode = ({
      const credential = credentials.find(c => c.id === credentialId)
      label = credential ? credential.name : t('plugin.auth.authRemoved')
      removed = !credential
+      unavailable = !!credential?.not_allowed_to_use
    }
    return (
      <Button
@ -60,6 +63,9 @@ const AuthorizedInNode = ({
          color={removed ? 'red' : 'green'}
        />
        {label}
+        {
+          !unavailable && t('plugin.auth.unavailable')
+        }
        <RiArrowDownSLine
          className={cn(
            'h-3.5 w-3.5 text-components-button-ghost-text',
@ -106,6 +112,7 @@ const AuthorizedInNode = ({
      showItemSelectedIcon
      selectedCredentialId={credentialId || '__workspace_default__'}
      onUpdate={invalidPluginCredentialInfo}
+      notAllowCustomCredential={notAllowCustomCredential}
    />
  )
 }
--- a/web/app/components/plugins/plugin-auth/authorized/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/index.tsx
@ -52,6 +52,7 @@ type AuthorizedProps = {
  showItemSelectedIcon?: boolean
  selectedCredentialId?: string
  onUpdate?: () => void
+  notAllowCustomCredential?: boolean
 }
 const Authorized = ({
  pluginPayload,
@ -72,6 +73,7 @@ const Authorized = ({
  showItemSelectedIcon,
  selectedCredentialId,
  onUpdate,
+  notAllowCustomCredential,
 }: AuthorizedProps) => {
  const { t } = useTranslation()
  const { notify } = useToastContext()
@ -171,6 +173,7 @@ const Authorized = ({
      handleSetDoingAction(false)
    }
  }, [updatePluginCredential, notify, t, handleSetDoingAction, onUpdate])
+  const unavailableCredentials = credentials.filter(credential => credential.not_allowed_to_use)

  return (
    <>
@ -201,6 +204,11 @@ const Authorized = ({
                      ? t('plugin.auth.authorizations')
                      : t('plugin.auth.authorization')
                  }
+                  {
+                    !!unavailableCredentials.length && (
+                      ` (${unavailableCredentials.length} ${t('plugin.auth.unavailable')})`
+                    )
+                  }
                  <RiArrowDownSLine className='ml-0.5 h-4 w-4' />
                </Button>
              )
@ -294,18 +302,24 @@ const Authorized = ({
                )
              }
            </div>
-            <div className='h-[1px] bg-divider-subtle'></div>
-            <div className='p-2'>
-              <Authorize
-                pluginPayload={pluginPayload}
-                theme='secondary'
-                showDivider={false}
-                canOAuth={canOAuth}
-                canApiKey={canApiKey}
-                disabled={disabled}
-                onUpdate={onUpdate}
-              />
-            </div>
+            {
+              !notAllowCustomCredential && (
+                <>
+                  <div className='h-[1px] bg-divider-subtle'></div>
+                    <div className='p-2'>
+                      <Authorize
+                        pluginPayload={pluginPayload}
+                        theme='secondary'
+                        showDivider={false}
+                        canOAuth={canOAuth}
+                        canApiKey={canApiKey}
+                        disabled={disabled}
+                        onUpdate={onUpdate}
+                      />
+                    </div>
+                </>
+              )
+            }
          </div>
        </PortalToFollowElemContent>
      </PortalToFollowElem>
--- a/web/app/components/plugins/plugin-auth/authorized/item.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/item.tsx
@ -61,14 +61,19 @@ const Item = ({
    return !(disableRename && disableEdit && disableDelete && disableSetDefault)
  }, [disableRename, disableEdit, disableDelete, disableSetDefault])

-  return (
+  const CredentialItem = (
    <div
      key={credential.id}
      className={cn(
        'group flex h-8 items-center rounded-lg p-1 hover:bg-state-base-hover',
        renaming && 'bg-state-base-hover',
+        (disabled || credential.not_allowed_to_use) && 'cursor-not-allowed opacity-50',
      )}
-      onClick={() => onItemClick?.(credential.id === '__workspace_default__' ? '' : credential.id)}
+      onClick={() => {
+        if (credential.not_allowed_to_use || disabled)
+          return
+        onItemClick?.(credential.id === '__workspace_default__' ? '' : credential.id)
+      }}
    >
      {
        renaming && (
@ -121,35 +126,31 @@ const Item = ({
                </div>
              )
            }
-            <Indicator className='ml-2 mr-1.5 shrink-0' />
+            <Indicator
+              className='ml-2 mr-1.5 shrink-0'
+              color={credential.not_allowed_to_use ? 'gray' : 'green'}
+            />
            <div
              className='system-md-regular truncate text-text-secondary'
              title={credential.name}
            >
              {credential.name}
            </div>
-            {
-              credential.is_default && (
-                <Badge className='shrink-0'>
-                  {t('plugin.auth.default')}
-                </Badge>
-              )
-            }
-            {
-              credential.from_enterprise && (
-                <Badge className='shrink-0'>
-                  Enterprise
-                </Badge>
-              )
-            }
          </div>
        )
      }
+      {
+        credential.from_enterprise && (
+          <Badge className='shrink-0'>
+            Enterprise
+          </Badge>
+        )
+      }
      {
        showAction && !renaming && (
          <div className='ml-2 hidden shrink-0 items-center group-hover:flex'>
            {
-              !credential.is_default && !disableSetDefault && (
+              !credential.is_default && !disableSetDefault && !credential.not_allowed_to_use && (
                <Button
                  size='small'
                  disabled={disabled}
@ -163,7 +164,7 @@ const Item = ({
              )
            }
            {
-              !disableRename && (
+              !disableRename && !credential.from_enterprise && !credential.not_allowed_to_use && (
                <Tooltip popupContent={t('common.operation.rename')}>
                  <ActionButton
                    disabled={disabled}
@ -179,7 +180,7 @@ const Item = ({
              )
            }
            {
-              !isOAuth && !disableEdit && !credential.from_enterprise && (
+              !isOAuth && !disableEdit && !credential.from_enterprise && !credential.not_allowed_to_use && (
                <Tooltip popupContent={t('common.operation.edit')}>
                  <ActionButton
                    disabled={disabled}
@ -221,6 +222,18 @@ const Item = ({
      }
    </div>
  )
+
+  if (credential.not_allowed_to_use) {
+    return (
+      <Tooltip popupContent={t('plugin.auth.customCredentialUnavailable')}>
+        {CredentialItem}
+      </Tooltip>
+    )
+  }
+
+  return (
+    CredentialItem
+  )
 }

 export default memo(Item)
--- a/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts
+++ b/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts
@ -20,6 +20,7 @@ export const usePluginAuth = (pluginPayload: PluginPayload, enable?: boolean) =>
    canApiKey,
    credentials: data?.credentials || [],
    disabled: !isCurrentWorkspaceManager,
+    notAllowCustomCredential: data?.allow_custom_token === false,
    invalidPluginCredentialInfo,
  }
 }
--- a/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx
+++ b/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx
@ -35,6 +35,7 @@ const PluginAuthInAgent = ({
    credentials,
    disabled,
    invalidPluginCredentialInfo,
+    notAllowCustomCredential,
  } = usePluginAuth(pluginPayload, true)

  const extraAuthorizationItems: Credential[] = [
@ -58,6 +59,7 @@ const PluginAuthInAgent = ({
  const renderTrigger = useCallback((isOpen?: boolean) => {
    let label = ''
    let removed = false
+    let unavailable = false
    if (!credentialId) {
      label = t('plugin.auth.workspaceDefault')
    }
@ -65,6 +67,7 @@ const PluginAuthInAgent = ({
      const credential = credentials.find(c => c.id === credentialId)
      label = credential ? credential.name : t('plugin.auth.authRemoved')
      removed = !credential
+      unavailable = !!credential?.not_allowed_to_use
    }
    return (
      <Button
@ -78,6 +81,9 @@ const PluginAuthInAgent = ({
          color={removed ? 'red' : 'green'}
        />
        {label}
+        {
+          !unavailable && t('plugin.auth.unavailable')
+        }
        <RiArrowDownSLine className='ml-0.5 h-4 w-4' />
      </Button>
    )
@ -93,6 +99,7 @@ const PluginAuthInAgent = ({
            canApiKey={canApiKey}
            disabled={disabled}
            onUpdate={invalidPluginCredentialInfo}
+            notAllowCustomCredential={notAllowCustomCredential}
          />
        )
      }
@ -113,6 +120,7 @@ const PluginAuthInAgent = ({
            onOpenChange={setIsOpen}
            selectedCredentialId={credentialId || '__workspace_default__'}
            onUpdate={invalidPluginCredentialInfo}
+            notAllowCustomCredential={notAllowCustomCredential}
          />
        )
      }
--- a/web/app/components/plugins/plugin-auth/plugin-auth.tsx
+++ b/web/app/components/plugins/plugin-auth/plugin-auth.tsx
@ -22,6 +22,7 @@ const PluginAuth = ({
    credentials,
    disabled,
    invalidPluginCredentialInfo,
+    notAllowCustomCredential,
  } = usePluginAuth(pluginPayload, !!pluginPayload.provider)

  return (
@ -34,6 +35,7 @@ const PluginAuth = ({
            canApiKey={canApiKey}
            disabled={disabled}
            onUpdate={invalidPluginCredentialInfo}
+            notAllowCustomCredential={notAllowCustomCredential}
          />
        )
      }
@ -46,6 +48,7 @@ const PluginAuth = ({
            canApiKey={canApiKey}
            disabled={disabled}
            onUpdate={invalidPluginCredentialInfo}
+            notAllowCustomCredential={notAllowCustomCredential}
          />
        )
      }
--- a/web/app/components/plugins/plugin-auth/types.ts
+++ b/web/app/components/plugins/plugin-auth/types.ts
@ -23,5 +23,5 @@ export type Credential = {
  credentials?: Record<string, any>
  isWorkspaceDefault?: boolean
  from_enterprise?: boolean
-  allowed_to_use?: boolean
+  not_allowed_to_use?: boolean
 }