From 06eb17387adb184be528cf124e5d7de43588cb2e Mon Sep 17 00:00:00 2001
From: DarkSky <25152247+darkskygit@users.noreply.github.com>
Date: Mon, 21 Jul 2025 18:02:51 +0800
Subject: [PATCH] chore(server): relax list session permission (#13268)

fix AI-326

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Adjusted permission checks for viewing histories and chats to require
read access instead of update access on documents.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../backend/server/src/plugins/copilot/resolver.ts    | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/packages/backend/server/src/plugins/copilot/resolver.ts b/packages/backend/server/src/plugins/copilot/resolver.ts
index d97e4f1a1..2e56e691d 100644
--- a/packages/backend/server/src/plugins/copilot/resolver.ts
+++ b/packages/backend/server/src/plugins/copilot/resolver.ts
@@ -37,7 +37,7 @@ import {
 import { CurrentUser } from '../../core/auth';
 import { Admin } from '../../core/common';
 import { DocReader } from '../../core/doc';
-import { AccessController } from '../../core/permission';
+import { AccessController, DocAction } from '../../core/permission';
 import { UserType } from '../../core/user';
 import type { ListSessionOptions, UpdateChatSession } from '../../models';
 import { CopilotCronJobs } from './cron';
@@ -420,7 +420,8 @@ export class CopilotResolver {
 
   private async assertPermission(
     user: CurrentUser,
-    options: { workspaceId?: string | null; docId?: string | null }
+    options: { workspaceId?: string | null; docId?: string | null },
+    fallbackAction?: DocAction
   ) {
     const { workspaceId, docId } = options;
     if (!workspaceId) {
@@ -431,7 +432,7 @@ export class CopilotResolver {
         .user(user.id)
         .doc({ workspaceId, docId })
         .allowLocal()
-        .assert('Doc.Update');
+        .assert(fallbackAction ?? 'Doc.Update');
     } else {
       await this.ac
         .user(user.id)
@@ -510,7 +511,7 @@ export class CopilotResolver {
     if (!workspaceId) {
       return [];
     } else {
-      await this.assertPermission(user, { workspaceId, docId });
+      await this.assertPermission(user, { workspaceId, docId }, 'Doc.Read');
     }
 
     const histories = await this.chatSession.list(
@@ -540,7 +541,7 @@ export class CopilotResolver {
     if (!workspaceId) {
       return paginate([], 'updatedAt', pagination, 0);
     } else {
-      await this.assertPermission(user, { workspaceId, docId });
+      await this.assertPermission(user, { workspaceId, docId }, 'Doc.Read');
     }
 
     const finalOptions = Object.assign(