refactor: implement portal up and down functionality for applications

Author: wxg0103

apps/application/serializers/application.py

@@ -719,7 +719,6 @@ class ApplicationImportRequest(serializers.Serializer):
 
 class ApplicationEditSerializer(serializers.Serializer):
     name = serializers.CharField(required=False, max_length=64, min_length=1, label=_("Application Name"))
-    is_portal = serializers.BooleanField(required=False, label=_("Whether to publish on portal"))
     desc = serializers.CharField(
         required=False,
         max_length=256,
@@ -1349,6 +1348,38 @@ def publish(self, instance, with_valid=True):
         )
         return self.one(with_valid=False)
 
+    @transaction.atomic
+    def portal_up(self, with_valid=True):
+        """上架到门户：仅已发布的应用可上架，调用方需具备门户上架权限。"""
+        if with_valid:
+            self.is_valid()
+        workspace_id = self.data.get("workspace_id")
+        application = (
+            QuerySet(Application).filter(id=self.data.get("application_id"), workspace_id=workspace_id).first()
+        )
+        if not application:
+            raise AppApiException(500, _("Application id does not exist"))
+        if not application.is_publish:
+            raise AppApiException(500, _("Only published applications can be published to Portal"))
+        application.is_portal = True
+        application.save()
+        return self.one(with_valid=False)
+
+    @transaction.atomic
+    def portal_down(self, with_valid=True):
+        """从门户下架，调用方需具备门户下架权限。"""
+        if with_valid:
+            self.is_valid()
+        workspace_id = self.data.get("workspace_id")
+        application = (
+            QuerySet(Application).filter(id=self.data.get("application_id"), workspace_id=workspace_id).first()
+        )
+        if not application:
+            raise AppApiException(500, _("Application id does not exist"))
+        application.is_portal = False
+        application.save()
+        return self.one(with_valid=False)
+
     @staticmethod
     def update_work_flow_model(instance):
         if "nodes" not in instance.get("work_flow"):
@@ -1465,7 +1496,6 @@ def edit(self, instance: Dict, with_valid=True):
             ToolExecutor().validate_mcp_transport(json.dumps(instance.get("mcp_servers")))
         update_keys = [
             "name",
-            "is_portal",
             "desc",
             "model_id",
             "multiple_rounds_dialogue",

apps/application/urls.py

@@ -15,6 +15,8 @@
     path('workspace/<str:workspace_id>/application/batch_clean_time', views.ApplicationAPI.BatchCleanTime.as_view()),
     path('workspace/<str:workspace_id>/application/<str:application_id>', views.ApplicationAPI.Operate.as_view()),
     path('workspace/<str:workspace_id>/application/<str:application_id>/publish', views.ApplicationAPI.Publish.as_view()),
+    path('workspace/<str:workspace_id>/application/<str:application_id>/portal_up', views.ApplicationAPI.PortalUp.as_view()),
+    path('workspace/<str:workspace_id>/application/<str:application_id>/portal_down', views.ApplicationAPI.PortalDown.as_view()),
     path('workspace/<str:workspace_id>/application/<str:application_id>/move/<str:folder_id>', views.ApplicationAPI.Move.as_view()),
     path('workspace/<str:workspace_id>/application/<str:application_id>/application_key', views.ApplicationKey.as_view()),
     path('workspace/<str:workspace_id>/application/<str:application_id>/application_stats', views.ApplicationStats.as_view()),

apps/application/views/application.py

@@ -294,6 +294,60 @@ def put(self, request: Request, workspace_id: str, application_id: str):
                     data={'application_id': application_id, 'user_id': request.user.id,
                           'workspace_id': workspace_id, }).publish(request.data))
 
+    class PortalUp(APIView):
+        authentication_classes = [TokenAuth]
+
+        @extend_schema(
+            methods=['PUT'],
+            description=_("Publishing an application to Portal"),
+            summary=_("Publishing an application to Portal"),
+            operation_id=_("Publishing an application to Portal"),  # type: ignore
+            parameters=ApplicationOperateAPI.get_parameters(),
+            request=None,
+            responses=result.DefaultResultSerializer,
+            tags=[_('Application')]  # type: ignore
+        )
+        @has_permissions(PermissionConstants.APPLICATION_PORTAL_UP.get_workspace_application_permission(),
+                         PermissionConstants.APPLICATION_PORTAL_UP.get_workspace_permission_workspace_manage_role(),
+                         ViewPermission([RoleConstants.USER.get_workspace_role()],
+                                        [PermissionConstants.APPLICATION.get_workspace_application_permission()],
+                                        compare=CompareConstants.AND),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
+        @log(menu='Application', operate='Publishing an application to Portal',
+             get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
+        def put(self, request: Request, workspace_id: str, application_id: str):
+            return result.success(
+                ApplicationOperateSerializer(
+                    data={'application_id': application_id, 'user_id': request.user.id,
+                          'workspace_id': workspace_id, }).portal_up())
+
+    class PortalDown(APIView):
+        authentication_classes = [TokenAuth]
+
+        @extend_schema(
+            methods=['PUT'],
+            description=_("Unpublishing an application from Portal"),
+            summary=_("Unpublishing an application from Portal"),
+            operation_id=_("Unpublishing an application from Portal"),  # type: ignore
+            parameters=ApplicationOperateAPI.get_parameters(),
+            request=None,
+            responses=result.DefaultResultSerializer,
+            tags=[_('Application')]  # type: ignore
+        )
+        @has_permissions(PermissionConstants.APPLICATION_PORTAL_DOWN.get_workspace_application_permission(),
+                         PermissionConstants.APPLICATION_PORTAL_DOWN.get_workspace_permission_workspace_manage_role(),
+                         ViewPermission([RoleConstants.USER.get_workspace_role()],
+                                        [PermissionConstants.APPLICATION.get_workspace_application_permission()],
+                                        compare=CompareConstants.AND),
+                         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
+        @log(menu='Application', operate='Unpublishing an application from Portal',
+             get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
+        def put(self, request: Request, workspace_id: str, application_id: str):
+            return result.success(
+                ApplicationOperateSerializer(
+                    data={'application_id': application_id, 'user_id': request.user.id,
+                          'workspace_id': workspace_id, }).portal_down())
+
     class StoreApplication(APIView):
         authentication_classes = [TokenAuth]
 

apps/common/auth/constants/operate_constants.py

@@ -76,6 +76,8 @@ class Operate(Enum):
     CHANGE_PASSWORD = ("READ+CREATE", _("Change Password"))
     SYSTEM_API_KEY = ("READ+DELETE", _("System API Key"))
     PORTAL = ("READ+PORTAL", _("Portal"))
+    PORTAL_UP = ("READ+PORTAL_UP", _("Publish to Portal"))
+    PORTAL_DOWN = ("READ+PORTAL_DOWN", _("Unpublish from Portal"))
 
     ANNOTATION_AUTH = ('ANNOTATION', _("Annotation"))
     PASSWORD = ("PASSWORD", _("Password verification"))

apps/common/auth/constants/permission_constants.py

@@ -1441,6 +1441,26 @@ class PermissionConstants(Enum):
         ),
     )
 
+    APPLICATION_PORTAL_UP = (
+        Permission(group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.PORTAL_UP, bit_index=17),
+        PermissionMeta(
+            role_list=[RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER],
+            category=Category.WORKSPACE,
+            scope=[PermissionScopeConstants.WORKSPACE_RESOURCE],
+            resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE],
+        ),
+    )
+
+    APPLICATION_PORTAL_DOWN = (
+        Permission(group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.PORTAL_DOWN, bit_index=18),
+        PermissionMeta(
+            role_list=[RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER],
+            category=Category.WORKSPACE,
+            scope=[PermissionScopeConstants.WORKSPACE_RESOURCE],
+            resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE],
+        ),
+    )
+
     # ==================== 应用文件夹 ====================
     APPLICATION_FOLDER_READ = (
         Permission(group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.READ, bit_index=0),
@@ -2696,6 +2716,36 @@ class PermissionConstants(Enum):
         ),
     )
 
+    RESOURCE_APPLICATION_PORTAL_UP = (
+        Permission(
+            group=Group.SYSTEM_RES_APPLICATION,
+            sub_group=Group.SYSTEM_RES_APPLICATION,
+            operate=Operate.PORTAL_UP,
+            bit_index=12,
+        ),
+        PermissionMeta(
+            role_list=[RoleConstants.ADMIN],
+            category=Category.RESOURCE,
+            is_ee=is_ee,
+            scope=[PermissionScopeConstants.SYSTEM],
+        ),
+    )
+
+    RESOURCE_APPLICATION_PORTAL_DOWN = (
+        Permission(
+            group=Group.SYSTEM_RES_APPLICATION,
+            sub_group=Group.SYSTEM_RES_APPLICATION,
+            operate=Operate.PORTAL_DOWN,
+            bit_index=13,
+        ),
+        PermissionMeta(
+            role_list=[RoleConstants.ADMIN],
+            category=Category.RESOURCE,
+            is_ee=is_ee,
+            scope=[PermissionScopeConstants.SYSTEM],
+        ),
+    )
+
     # 资源管理 - 应用概览
     RESOURCE_APPLICATION_OVERVIEW_READ = (
         Permission(

apps/common/tests/test_portal_permissions.py

@@ -0,0 +1,51 @@
+# coding=utf-8
+
+from django.test import SimpleTestCase
+
+from common.auth.constants.category_constants import Category
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+
+
+class ApplicationPortalPermissionTests(SimpleTestCase):
+    """智能体门户上下架权限已注册且分组/操作位与前端一致。"""
+
+    def test_application_portal_up_permission(self):
+        perm = PermissionConstants.APPLICATION_PORTAL_UP.value
+        meta = PermissionConstants.APPLICATION_PORTAL_UP.meta
+        self.assertEqual(perm.group.value, "APPLICATION")
+        self.assertEqual(perm.operate, Operate.PORTAL_UP)
+        self.assertEqual(perm.bit_index, 17)
+        self.assertIn(RoleConstants.WORKSPACE_MANAGE, meta.role_list)
+        self.assertIn(RoleConstants.USER, meta.role_list)
+        self.assertEqual(meta.category, Category.WORKSPACE)
+
+    def test_application_portal_down_permission(self):
+        perm = PermissionConstants.APPLICATION_PORTAL_DOWN.value
+        meta = PermissionConstants.APPLICATION_PORTAL_DOWN.meta
+        self.assertEqual(perm.group.value, "APPLICATION")
+        self.assertEqual(perm.operate, Operate.PORTAL_DOWN)
+        self.assertEqual(perm.bit_index, 18)
+        self.assertEqual(meta.category, Category.WORKSPACE)
+
+    def test_resource_application_portal_up_permission(self):
+        perm = PermissionConstants.RESOURCE_APPLICATION_PORTAL_UP.value
+        meta = PermissionConstants.RESOURCE_APPLICATION_PORTAL_UP.meta
+        self.assertEqual(perm.group.value, "SYSTEM_RESOURCE_APPLICATION")
+        self.assertEqual(perm.operate, Operate.PORTAL_UP)
+        self.assertEqual(perm.bit_index, 12)
+        self.assertIn(RoleConstants.ADMIN, meta.role_list)
+        self.assertEqual(meta.category, Category.RESOURCE)
+
+    def test_resource_application_portal_down_permission(self):
+        perm = PermissionConstants.RESOURCE_APPLICATION_PORTAL_DOWN.value
+        meta = PermissionConstants.RESOURCE_APPLICATION_PORTAL_DOWN.meta
+        self.assertEqual(perm.group.value, "SYSTEM_RESOURCE_APPLICATION")
+        self.assertEqual(perm.operate, Operate.PORTAL_DOWN)
+        self.assertEqual(perm.bit_index, 13)
+        self.assertEqual(meta.category, Category.RESOURCE)
+
+    def test_operate_values_match_frontend(self):
+        self.assertEqual(Operate.PORTAL_UP.value, "READ+PORTAL_UP")
+        self.assertEqual(Operate.PORTAL_DOWN.value, "READ+PORTAL_DOWN")

apps/locales/en_US/LC_MESSAGES/django.po

@@ -9306,6 +9306,21 @@ msgstr ""
 msgid "Publish"
 msgstr ""
 
+msgid "Publish to Portal"
+msgstr ""
+
+msgid "Unpublish from Portal"
+msgstr ""
+
+msgid "Only published applications can be published to Portal"
+msgstr ""
+
+msgid "Publishing an application to Portal"
+msgstr ""
+
+msgid "Unpublishing an application from Portal"
+msgstr ""
+
 msgid "token is required for EVENT triggers"
 msgstr ""
 

apps/locales/zh_CN/LC_MESSAGES/django.po

@@ -9431,6 +9431,21 @@ msgstr "model_params_form 中的第 {index} 项的 label 字段是必填项"
 msgid "Publish"
 msgstr "发布"
 
+msgid "Publish to Portal"
+msgstr "上架到门户"
+
+msgid "Unpublish from Portal"
+msgstr "从门户下架"
+
+msgid "Only published applications can be published to Portal"
+msgstr "仅已发布的应用可以上架到门户"
+
+msgid "Publishing an application to Portal"
+msgstr "将应用上架到门户"
+
+msgid "Unpublishing an application from Portal"
+msgstr "将应用从门户下架"
+
 msgid "token is required for EVENT triggers"
 msgstr "事件触发器必须设置 token"
 

apps/locales/zh_Hant/LC_MESSAGES/django.po

@@ -9431,6 +9431,21 @@ msgstr "model_params_form 中的第 {index} 项的 label 字段是必填项"
 msgid "Publish"
 msgstr "發布"
 
+msgid "Publish to Portal"
+msgstr "上架到門戶"
+
+msgid "Unpublish from Portal"
+msgstr "從門戶下架"
+
+msgid "Only published applications can be published to Portal"
+msgstr "僅已發布的應用可以上架到門戶"
+
+msgid "Publishing an application to Portal"
+msgstr "將應用上架到門戶"
+
+msgid "Unpublishing an application from Portal"
+msgstr "將應用從門戶下架"
+
 msgid "token is required for EVENT triggers"
 msgstr "事件觸發器必須設定 token"
 

ui/src/api/API_README.md

@@ -390,8 +390,10 @@ API 对象和工作空间上下文，作为该抽屉的范围选择例外。Syst
 - 知识库 Workflow API 记录为 `/<id>/action/<page>/<size>`，筛选 user_name、state；
   详情和取消为 GET action/<actionId>、POST action/<actionId>/cancel。
 - 智能体复制查询完整 ApplicationDetail，model 映射 model_id 后创建，不使用卡片摘要。
-- Workspace 与 System 资源管理的 Application API 通过 `putApplicationPortal(applicationId, isPortal)`
-  向各自范围的 `application/<applicationId>` 发送 PUT 请求，仅提交 `{ is_portal }`，返回 `ApplicationDetail`。
+- Workspace 与 System 资源管理的 Application API 通过 `putApplicationPortalUp(applicationId)` 与
+  `putApplicationPortalDown(applicationId)` 分别向各自范围的 `application/<applicationId>/portal_up`、
+  `application/<applicationId>/portal_down` 发送 PUT 请求（上下架接口与通用编辑接口分离），返回 `ApplicationDetail`。
+  上架仅允许已发布（`is_publish`）的智能体；上下架分别受门户上架/下架权限控制。
   `exportApplicationSkills(applicationId, applicationName)` 仍为本地 mock，返回 `{ application_id, name }`，
   不发送请求或生成 Skills 文件，真实下载接口待接入。