fix: harden WeKnora knowledge permissions and details

frontend-web/src/components/workspace/skill-display-sources.tsx

@@ -240,7 +240,18 @@ type WeKnoraSourceContext = {
   knowledge_base_name?: string;
   document_title?: string;
   document_file_name?: string;
+  display_mode?: "wiki" | "chunks";
   focus_chunk_id: string;
+  wiki_page?: {
+    id?: string;
+    slug?: string;
+    title?: string;
+    page_type?: string;
+    status?: string;
+    summary?: string;
+    content?: string;
+    source_refs?: string[];
+  } | null;
   chunks: Array<{
     id: string;
     chunk_index?: number;
@@ -312,6 +323,33 @@ function WeKnoraSourceContextPanel({
   if (!context) {
     return null;
   }
+  const wikiPage = context.wiki_page;
+  const wikiContent = cleanReferenceText(
+    [wikiPage?.summary, wikiPage?.content].filter(Boolean).join("\n\n"),
+    [],
+  );
+  if (wikiPage && wikiContent) {
+    return (
+      <div className="max-h-[55vh] space-y-3 overflow-y-auto pr-1">
+        <div className="bg-muted/60 text-muted-foreground rounded-lg px-3 py-2 text-xs">
+          <span>{context.knowledge_base_name || "WeKnora 知识库"}</span>
+          <span> · LLMWiki</span>
+          {wikiPage.page_type && <span> · {wikiPage.page_type}</span>}
+        </div>
+        <section className="border-primary/40 bg-primary/5 rounded-lg border p-3 text-sm leading-relaxed shadow-sm">
+          <div className="mb-2 flex flex-wrap items-center gap-2">
+            <span className="text-foreground text-sm font-medium">
+              {wikiPage.title || wikiPage.slug || "LLMWiki 页面"}
+            </span>
+            <span className="bg-primary text-primary-foreground rounded px-1.5 py-0.5 text-xs font-medium">
+              清洗页
+            </span>
+          </div>
+          <div className="space-y-3 whitespace-pre-wrap">{wikiContent}</div>
+        </section>
+      </div>
+    );
+  }
   return (
     <div className="max-h-[55vh] space-y-3 overflow-y-auto pr-1">
       <div className="bg-muted/60 text-muted-foreground rounded-lg px-3 py-2 text-xs">

frontend-web/src/core/config/index.ts

@@ -13,19 +13,33 @@ export function buildIntranetSourceUrl(recUuid?: string | null): string {
   return `${INTRANET_SOURCE_URL_BASE}${encodeURIComponent(recUuid)}`;
 }
 
-function getBaseOrigin() {
+function getBaseOrigin() {
   if (typeof window !== "undefined") {
     return window.location.origin;
   }
   // Fallback for SSR
-  return "http://localhost:2026";
-}
-
-export function getBackendBaseURL() {
-  if (env.NEXT_PUBLIC_BACKEND_BASE_URL) {
-    return new URL(env.NEXT_PUBLIC_BACKEND_BASE_URL, getBaseOrigin())
-      .toString()
-      .replace(/\/+$/, "");
+  return "http://localhost:2026";
+}
+
+function alignLoopbackHostname(url: URL): URL {
+  if (typeof window === "undefined") return url;
+  const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+  if (
+    loopbackHosts.has(url.hostname) &&
+    loopbackHosts.has(window.location.hostname)
+  ) {
+    url.hostname = window.location.hostname;
+  }
+  return url;
+}
+
+export function getBackendBaseURL() {
+  if (env.NEXT_PUBLIC_BACKEND_BASE_URL) {
+    return alignLoopbackHostname(
+      new URL(env.NEXT_PUBLIC_BACKEND_BASE_URL, getBaseOrigin()),
+    )
+      .toString()
+      .replace(/\/+$/, "");
   } else {
     return "";
   }

frontend-web/src/strategy-components/api/llmwiki.ts

@@ -1,6 +1,7 @@
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 
 import { apiFetch } from "@/core/api/fetch-client";
+import { useLiveAccount } from "@/core/auth/use-live-account";
 import { getBackendBaseURL } from "@/core/config";
 
 const API = () => `${getBackendBaseURL()}/api/llmwiki`;
@@ -52,6 +53,7 @@ export interface LlmWikiKnowledgeBase {
   created_at?: string | null;
   updated_at?: string | null;
   published_at?: string | null;
+  is_conversation_deposit?: boolean;
 }
 
 export interface LlmWikiDocument {
@@ -152,6 +154,11 @@ export interface LlmWikiSearchResult {
   url: string;
 }
 
+export interface LlmWikiWeKnoraEmbedSession {
+  frame_path: string;
+  expires_in: number;
+}
+
 async function readJson<T>(response: Response, context: string): Promise<T> {
   if (!response.ok) {
     const payload = await response.json().catch(() => null as unknown);
@@ -206,6 +213,19 @@ export async function getLlmWikiKnowledgeBase(
   );
 }
 
+export async function createLlmWikiWeKnoraEmbedSession(
+  id: string,
+  tab: "documents" | "wiki" | "graph",
+): Promise<LlmWikiWeKnoraEmbedSession> {
+  return readJson(
+    await apiFetch(
+      `${API()}/knowledge-bases/${encodeURIComponent(id)}/weknora/session?tab=${encodeURIComponent(tab)}`,
+      { method: "POST" },
+    ),
+    "创建 WeKnora 详情会话",
+  );
+}
+
 export async function createLlmWikiKnowledgeBase(input: {
   name: string;
   description: string;
@@ -497,8 +517,8 @@ export async function testLlmWikiConnection(
 
 const runtimeKey = ["llmwiki", "runtime"] as const;
 const settingsKey = ["llmwiki", "settings"] as const;
-const knowledgeBasesKey = (scope: LlmWikiScope) =>
-  ["llmwiki", "knowledge-bases", scope] as const;
+const knowledgeBasesKey = (userId: string | null, scope: LlmWikiScope) =>
+  ["llmwiki", "knowledge-bases", userId ?? "anonymous", scope] as const;
 
 export function useLlmWikiRuntime() {
   return useQuery({
@@ -513,8 +533,9 @@ export function useLlmWikiKnowledgeBases(
   scope: LlmWikiScope,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: knowledgeBasesKey(scope),
+    queryKey: knowledgeBasesKey(userId, scope),
     queryFn: () => listLlmWikiKnowledgeBases(scope),
     enabled,
     refetchInterval: 15_000,
@@ -525,8 +546,9 @@ export function useAgentLlmWikiKnowledgeBases(
   agentId: string | null | undefined,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "agents", agentId, "knowledge-bases"],
+    queryKey: ["llmwiki", "agents", agentId, "knowledge-bases", userId ?? "anonymous"],
     queryFn: () => listAgentLlmWikiKnowledgeBases(agentId!),
     enabled: enabled && !!agentId,
   });
@@ -536,8 +558,9 @@ export function useLlmWikiKnowledgeBase(
   knowledgeBaseId: string | null,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "knowledge-base", knowledgeBaseId],
+    queryKey: ["llmwiki", "knowledge-base", knowledgeBaseId, userId ?? "anonymous"],
     queryFn: () => getLlmWikiKnowledgeBase(knowledgeBaseId!),
     enabled: enabled && !!knowledgeBaseId,
     refetchInterval: 8_000,
@@ -548,8 +571,9 @@ export function useLlmWikiDocuments(
   knowledgeBaseId: string | null,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "documents", knowledgeBaseId],
+    queryKey: ["llmwiki", "documents", knowledgeBaseId, userId ?? "anonymous"],
     queryFn: () => listLlmWikiDocuments(knowledgeBaseId!),
     enabled: enabled && !!knowledgeBaseId,
     refetchInterval: 8_000,
@@ -561,8 +585,9 @@ export function useLlmWikiDocument(
   documentId: string | null,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "document", knowledgeBaseId, documentId],
+    queryKey: ["llmwiki", "document", knowledgeBaseId, documentId, userId ?? "anonymous"],
     queryFn: () => getLlmWikiDocument(knowledgeBaseId!, documentId!),
     enabled: enabled && !!knowledgeBaseId && !!documentId,
   });
@@ -575,16 +600,18 @@ export function useLlmWikiDocumentChunks(
   pageSize = 20,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "document-chunks", knowledgeBaseId, documentId, page, pageSize],
+    queryKey: ["llmwiki", "document-chunks", knowledgeBaseId, documentId, page, pageSize, userId ?? "anonymous"],
     queryFn: () => listLlmWikiDocumentChunks(knowledgeBaseId!, documentId!, page, pageSize),
     enabled: enabled && !!knowledgeBaseId && !!documentId,
   });
 }
 
 export function useLlmWikiGraph(knowledgeBaseId: string | null, enabled = true) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "graph", knowledgeBaseId],
+    queryKey: ["llmwiki", "graph", knowledgeBaseId, userId ?? "anonymous"],
     queryFn: () => getLlmWikiGraph(knowledgeBaseId!),
     enabled: enabled && !!knowledgeBaseId,
   });
@@ -597,8 +624,9 @@ export function useLlmWikiWikiPages(
   query = "",
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "wiki-pages", knowledgeBaseId, page, pageSize, query],
+    queryKey: ["llmwiki", "wiki-pages", knowledgeBaseId, page, pageSize, query, userId ?? "anonymous"],
     queryFn: () => listLlmWikiWikiPages(knowledgeBaseId!, page, pageSize, query),
     enabled: enabled && !!knowledgeBaseId,
     refetchInterval: 10_000,
@@ -610,16 +638,18 @@ export function useLlmWikiWikiPage(
   slug: string | null,
   enabled = true,
 ) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: ["llmwiki", "wiki-page", knowledgeBaseId, slug],
+    queryKey: ["llmwiki", "wiki-page", knowledgeBaseId, slug, userId ?? "anonymous"],
     queryFn: () => getLlmWikiWikiPage(knowledgeBaseId!, slug!),
     enabled: enabled && !!knowledgeBaseId && !!slug,
   });
 }
 
 export function useLlmWikiSettings(enabled = true) {
+  const { userId } = useLiveAccount();
   return useQuery({
-    queryKey: settingsKey,
+    queryKey: [...settingsKey, userId ?? "anonymous"],
     queryFn: getLlmWikiSettings,
     enabled,
   });

frontend-web/src/strategy-components/components/resource-management/llmwiki/WeKnoraKnowledgeDetailPage.tsx

@@ -1,10 +1,13 @@
-import { AlertCircle, Loader2, RefreshCw } from "lucide-react";
-import { useEffect, useMemo, useRef } from "react";
+import { AlertCircle, Loader2, RefreshCw, Upload } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
 import { Navigate, useNavigate, useParams } from "react-router-dom";
+import { toast } from "sonner";
 
 import { Button } from "@/components/ui/button";
 import { getBackendBaseURL } from "@/core/config";
 import {
+  createLlmWikiWeKnoraEmbedSession,
+  useLlmWikiActions,
   useLlmWikiKnowledgeBase,
   useLlmWikiRuntime,
 } from "@/strategy-components/api/llmwiki";
@@ -60,18 +63,46 @@ export function WeKnoraKnowledgeDetailPage() {
   const knowledgeBaseId = strategyKnowledgeBaseId ?? workspaceKnowledgeBaseId ?? "";
   const navigate = useNavigate();
   const frameRef = useRef<HTMLIFrameElement>(null);
+  const fileInputRef = useRef<HTMLInputElement>(null);
+  const [frameSrc, setFrameSrc] = useState("");
+  const [frameError, setFrameError] = useState<string | null>(null);
+  const [uploading, setUploading] = useState(false);
   const runtime = useLlmWikiRuntime();
   const details = useLlmWikiKnowledgeBase(knowledgeBaseId || null, !!knowledgeBaseId);
+  const actions = useLlmWikiActions();
 
+  const detailsReady = !!details.data;
   const preferredTab = details.data?.indexing_strategy?.wiki_enabled ? "wiki" : "documents";
-  const frameSrc = useMemo(() => {
-    if (!knowledgeBaseId || runtime.data?.provider !== "weknora") return "";
-    const base = getBackendBaseURL().replace(/\/+$/, "");
-    const params = new URLSearchParams({ tab: preferredTab });
-    return `${base}/api/llmwiki/knowledge-bases/${encodeURIComponent(
-      knowledgeBaseId,
-    )}/weknora/frame?${params.toString()}`;
-  }, [knowledgeBaseId, preferredTab, runtime.data?.provider]);
+
+  useEffect(() => {
+    let cancelled = false;
+    setFrameSrc("");
+    setFrameError(null);
+    if (!knowledgeBaseId || runtime.data?.provider !== "weknora" || !detailsReady) {
+      return () => {
+        cancelled = true;
+      };
+    }
+
+    void createLlmWikiWeKnoraEmbedSession(knowledgeBaseId, preferredTab)
+      .then((session) => {
+        if (cancelled) return;
+        const base = getBackendBaseURL().replace(/\/+$/, "");
+        const path = session.frame_path.startsWith("/")
+          ? session.frame_path
+          : `/${session.frame_path}`;
+        setFrameSrc(`${base}${path}`);
+      })
+      .catch((error: unknown) => {
+        if (cancelled) return;
+        const message = error instanceof Error ? error.message : "创建 WeKnora 详情会话失败";
+        setFrameError(message);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [detailsReady, knowledgeBaseId, preferredTab, runtime.data?.provider]);
 
   useEffect(() => {
     if (!frameSrc) return;
@@ -95,13 +126,30 @@ export function WeKnoraKnowledgeDetailPage() {
     return (
       <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
         <Loader2 className="mr-2 size-5 animate-spin" />
-        正在打开 WeKnora 详情页
+        加载中
       </div>
     );
   }
 
   if (runtime.data?.provider !== "weknora") return <Navigate to={LIST_PATH} replace />;
 
+  if (frameError) {
+    return (
+      <div className="flex h-full flex-col items-center justify-center gap-4 bg-background px-6 text-center">
+        <div className="flex size-12 items-center justify-center rounded-full bg-destructive/10 text-destructive">
+          <AlertCircle className="size-6" />
+        </div>
+        <div>
+          <div className="text-base font-semibold text-foreground">无法打开 WeKnora 详情</div>
+          <p className="mt-2 text-sm text-muted-foreground">{frameError}</p>
+        </div>
+        <Button variant="outline" onClick={() => navigate(LIST_PATH)}>
+          返回知识库
+        </Button>
+      </div>
+    );
+  }
+
   if (details.error || !details.data) {
     return (
       <div className="flex h-full flex-col items-center justify-center gap-4 bg-background px-6 text-center">
@@ -121,22 +169,80 @@ export function WeKnoraKnowledgeDetailPage() {
     );
   }
 
+  const canUpload = details.data.can_write && !details.data.is_conversation_deposit;
+
   return (
     <div className="flex h-full min-h-0 flex-col bg-background">
-      <iframe
-        key={frameSrc}
-        ref={frameRef}
-        title={`${details.data.name || "WeKnora"} 详情`}
-        src={frameSrc}
-        className="h-full min-h-0 w-full flex-1 border-0 bg-background"
-        sandbox="allow-same-origin allow-scripts allow-forms allow-downloads allow-popups"
-        referrerPolicy="no-referrer"
-        onLoad={() => postThemeToFrame(frameRef.current)}
-      />
+      {canUpload && (
+        <div className="flex h-12 shrink-0 items-center justify-end border-b px-4">
+          <input
+            ref={fileInputRef}
+            type="file"
+            multiple
+            className="hidden"
+            onChange={(event) => {
+              const files = Array.from(event.currentTarget.files ?? []);
+              event.currentTarget.value = "";
+              if (files.length === 0) return;
+              void (async () => {
+                setUploading(true);
+                const failed: string[] = [];
+                try {
+                  for (const file of files) {
+                    try {
+                      await actions.upload.mutateAsync({ id: knowledgeBaseId, file });
+                    } catch {
+                      failed.push(file.name);
+                    }
+                  }
+                  const succeeded = files.length - failed.length;
+                  if (succeeded > 0) {
+                    await details.refetch();
+                    if (frameRef.current) frameRef.current.src = frameSrc;
+                  }
+                  if (failed.length === 0) {
+                    toast.success(`已上传 ${succeeded} 个文件，正在处理`);
+                  } else if (succeeded > 0) {
+                    toast.warning(`上传完成：成功 ${succeeded} 个，失败 ${failed.length} 个`);
+                  } else {
+                    toast.error("文件上传失败");
+                  }
+                } finally {
+                  setUploading(false);
+                }
+              })();
+            }}
+          />
+          <Button
+            size="sm"
+            onClick={() => fileInputRef.current?.click()}
+            disabled={uploading}
+          >
+            {uploading ? (
+              <Loader2 className="mr-2 size-4 animate-spin" />
+            ) : (
+              <Upload className="mr-2 size-4" />
+            )}
+            上传文件
+          </Button>
+        </div>
+      )}
+      {frameSrc && (
+        <iframe
+          key={frameSrc}
+          ref={frameRef}
+          title={`${details.data.name || "WeKnora"} 详情`}
+          src={frameSrc}
+          className="h-full min-h-0 w-full flex-1 border-0 bg-background"
+          sandbox="allow-same-origin allow-scripts allow-forms allow-downloads allow-popups"
+          referrerPolicy="no-referrer"
+          onLoad={() => postThemeToFrame(frameRef.current)}
+        />
+      )}
       {!frameSrc && (
-        <div className="absolute inset-0 flex items-center justify-center bg-background text-sm text-muted-foreground">
+        <div className="flex min-h-0 flex-1 items-center justify-center bg-background text-sm text-muted-foreground">
           <Loader2 className="mr-2 size-5 animate-spin" />
-          正在准备 iframe
+          加载中
         </div>
       )}
       {details.isFetching && (

frontend-web/src/strategy-components/components/resource-management/llmwiki/WeKnoraKnowledgeWorkspace.tsx

@@ -97,7 +97,7 @@ export function WeKnoraKnowledgeWorkspace() {
 
   const removeKnowledgeBase = async (item: LlmWikiKnowledgeBase) => {
     const warning = item.remote_status === "missing"
-      ? `知识库“${item.name}”已不在 WeKnora 中。确定清理 DeerFlow 中的这条失效记录吗？`
+      ? `知识库“${item.name}”已不在 WeKnora 中。确定清理 cmzs 中的这条失效记录吗？`
       : `确定删除知识库“${item.name}”吗？WeKnora 中的文档和索引也会删除。`;
     if (!window.confirm(warning)) return;
     try {
@@ -128,7 +128,7 @@ export function WeKnoraKnowledgeWorkspace() {
               <h1 className="text-xl font-semibold">问答梳理</h1>
               <Badge variant="secondary">WeKnora</Badge>
             </div>
-            <p className="mt-1 text-sm text-muted-foreground">由 WeKnora 负责解析与检索，用户、权限和发布范围由 DeerFlow 管理。</p>
+            <p className="mt-1 text-sm text-muted-foreground">由 WeKnora 负责解析与检索，用户、权限和发布范围由 cmzs 管理。</p>
           </div>
           <div className="flex items-center gap-2 rounded-full border bg-background/80 p-1 shadow-sm backdrop-blur">
             {tab !== "settings" && (
@@ -236,9 +236,9 @@ function KnowledgeGrid({
             <div className="flex items-center justify-between gap-3">
               <div className="flex min-w-0 flex-wrap items-center gap-2">
                 {item.remote_status === "missing" ? <span className="text-xs text-muted-foreground">WeKnora 资源不存在，可清理本地记录</span> : <Button size="sm" variant="outline" className="rounded-full" onClick={() => onOpen(item)}><FileText className="mr-2 size-4" />查看详情</Button>}
-                {item.remote_status !== "missing" && item.is_owner && <Button size="sm" variant="secondary" className="rounded-full" disabled={busy} onClick={() => void onPublish(item)}>{item.publication_status === "published" ? "取消公开" : "发布公共库"}</Button>}
+                {item.remote_status !== "missing" && item.is_owner && !item.is_conversation_deposit && <Button size="sm" variant="secondary" className="rounded-full" disabled={busy} onClick={() => void onPublish(item)}>{item.publication_status === "published" ? "取消公开" : "发布公共库"}</Button>}
               </div>
-              {item.can_write && <Button size="icon" variant="ghost" className="size-8 shrink-0 rounded-full text-destructive hover:bg-destructive/10 hover:text-destructive" aria-label={item.remote_status === "missing" ? `清理失效记录 ${item.name}` : `删除知识库 ${item.name}`} title={item.remote_status === "missing" ? "清理失效记录" : "删除知识库"} disabled={busy} onClick={() => void onDelete(item)}><Trash2 className="size-4" /></Button>}
+              {item.can_write && !item.is_conversation_deposit && <Button size="icon" variant="ghost" className="size-8 shrink-0 rounded-full text-destructive hover:bg-destructive/10 hover:text-destructive" aria-label={item.remote_status === "missing" ? `清理失效记录 ${item.name}` : `删除知识库 ${item.name}`} title={item.remote_status === "missing" ? "清理失效记录" : "删除知识库"} disabled={busy} onClick={() => void onDelete(item)}><Trash2 className="size-4" /></Button>}
             </div>
           </CardContent>
         </Card>
@@ -299,7 +299,7 @@ export function ConnectionSettings() {
   if (settings.error) return <div className="rounded-lg border border-destructive/30 p-5 text-sm text-destructive">{messageOf(settings.error)}</div>;
   return (
     <Card className="max-w-3xl">
-      <CardHeader><CardTitle className="flex items-center gap-2 text-base"><Settings2 className="size-5" />WeKnora 连接</CardTitle><CardDescription>这里只管理 DeerFlow 到 WeKnora 的连接地址。数据库、Redis、模型、存储和解析器仍在 WeKnora 自己的配置中维护。</CardDescription></CardHeader>
+      <CardHeader><CardTitle className="flex items-center gap-2 text-base"><Settings2 className="size-5" />WeKnora 连接</CardTitle><CardDescription>这里只管理 cmzs 到 WeKnora 的连接地址。数据库、Redis、模型、存储和解析器仍在 WeKnora 自己的配置中维护。</CardDescription></CardHeader>
       <CardContent className="space-y-5">
         <div className="flex flex-wrap gap-2 text-sm"><Badge>{status}</Badge><Badge variant="secondary">服务端代理鉴权</Badge>{settings.data?.override_enabled && <Badge variant="outline">页面配置覆盖中</Badge>}</div>
         <div className="space-y-2"><label className="text-sm font-medium" htmlFor="weknora-api-url">WeKnora API 地址</label><Input id="weknora-api-url" value={apiUrl} onChange={(event) => setApiUrl(event.target.value)} placeholder="http://weknora-app:8080" /><p className="text-xs text-muted-foreground">非空启用 WeKnora；保存为空会切回原 LLMWiki。</p></div>