From daa8823ae124fbc6dfc3cbe03bbf8c2bae0c9fe7 Mon Sep 17 00:00:00 2001
From: zhangzhanwei <zhanwei.zhang@fit2cloud.com>
Date: Thu, 29 Jan 2026 13:59:37 +0800
Subject: [PATCH] feat: Task source trigger permission

---
 .../serializers/task_source_trigger.py        |  4 +-
 ui/src/api/trigger/trigger.ts                 |  2 +-
 .../layout/layout-header/top-about/index.vue  | 18 +++-
 .../permission/application/system-manage.ts   | 32 +++++++
 ui/src/permission/application/workspace.ts    | 40 ++++++++
 ui/src/permission/tool/system-manage.ts       | 32 +++++++
 ui/src/permission/tool/workspace.ts           | 40 ++++++++
 ui/src/router/modules/trigger.ts              |  4 +-
 ui/src/views/application/index.vue            |  6 +-
 .../views/trigger/ResourceTriggerDrawer.vue   | 29 ++++--
 ui/src/views/trigger/TriggerDrawer.vue        | 95 +++++++++++++------
 11 files changed, 257 insertions(+), 45 deletions(-)

diff --git a/apps/trigger/serializers/task_source_trigger.py b/apps/trigger/serializers/task_source_trigger.py
index 44a012eeb9c..965a71e92dd 100644
--- a/apps/trigger/serializers/task_source_trigger.py
+++ b/apps/trigger/serializers/task_source_trigger.py
@@ -107,7 +107,7 @@ def one(self, with_valid=True):
             return {
                 **TriggerModelSerializer(trigger).data,
                 'trigger_task': trigger_task,
-                'application_task': tool_task,
+                'tool_task': tool_task,
             }
 
     @transaction.atomic
@@ -137,7 +137,7 @@ def edit(self, instance: Dict, with_valid=True):
 
         if need_redeploy:
             if trigger.is_active:
-                deploy(ToolModelSerializer(trigger).data, **{})
+                deploy(TriggerModelSerializer(trigger).data, **{})
             else:
                 undeploy(TriggerModelSerializer(trigger).data, **{})
 
diff --git a/ui/src/api/trigger/trigger.ts b/ui/src/api/trigger/trigger.ts
index 32d1572bbaf..a64211cad4b 100644
--- a/ui/src/api/trigger/trigger.ts
+++ b/ui/src/api/trigger/trigger.ts
@@ -263,7 +263,7 @@ const putResourceTrigger: (
   data: TriggerData,
   loading?: Ref<boolean>,
 ) => Promise<Result<any>> = (source_type, source_id, trigger_id, data, loading) => {
-  return post(
+  return put(
     `${prefixWorkspace.value}/${source_type}/${source_id}/trigger/${trigger_id}`,
     data,
     undefined,
diff --git a/ui/src/layout/layout-header/top-about/index.vue b/ui/src/layout/layout-header/top-about/index.vue
index 0c0db2658da..c16407bc7ba 100644
--- a/ui/src/layout/layout-header/top-about/index.vue
+++ b/ui/src/layout/layout-header/top-about/index.vue
@@ -9,7 +9,20 @@
       <AppIcon iconName="app-pricing" class="mr-8"></AppIcon>
       {{ $t('common.upgrade') }}
     </el-button>
-    <el-tooltip effect="dark" :content="$t('views.trigger.title')" placement="top">
+    <el-tooltip
+      v-if="
+        hasPermission(
+          [
+            RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+            PermissionConst.TRIGGER_READ.getWorkspacePermissionWorkspaceManageRole,
+          ],
+          'OR',
+        )
+      "
+      effect="dark"
+      :content="$t('views.trigger.title')"
+      placement="top"
+    >
       <el-button
         text
         @click="router.push({ name: 'trigger' })"
@@ -68,7 +81,8 @@
 </template>
 <script setup lang="ts">
 import useStore from '@/stores'
-import { EditionConst, RoleConst } from '@/utils/permission/data'
+import { hasPermission } from '@/utils/permission'
+import { EditionConst, PermissionConst, RoleConst } from '@/utils/permission/data'
 import { useRoute, useRouter } from 'vue-router'
 const route = useRoute()
 const router = useRouter()
diff --git a/ui/src/permission/application/system-manage.ts b/ui/src/permission/application/system-manage.ts
index c4701521ab0..2e2058e06ab 100644
--- a/ui/src/permission/application/system-manage.ts
+++ b/ui/src/permission/application/system-manage.ts
@@ -32,6 +32,38 @@ const systemManage = {
             ],
             'OR'
     ),
+    trigger_read: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_APPLICATION_TRIGGER_READ
+            ],
+            'OR'
+    ),
+    trigger_create: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_APPLICATION_TRIGGER_CREATE
+            ],
+            'OR'
+    ),
+    trigger_edit: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_APPLICATION_TRIGGER_EDIT
+            ],
+            'OR'
+    ),
+    trigger_delete: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_APPLICATION_TRIGGER_DELETE
+            ],
+            'OR'
+    ),
     debug: () =>
         hasPermission(
             [
diff --git a/ui/src/permission/application/workspace.ts b/ui/src/permission/application/workspace.ts
index 7121729a932..c06eb599c80 100644
--- a/ui/src/permission/application/workspace.ts
+++ b/ui/src/permission/application/workspace.ts
@@ -93,6 +93,46 @@ const workspace = {
             ],
             'OR'
     ),
+    trigger_read: (source_id:string) => 
+        hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.APPLICATION_TRIGGER_READ.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.APPLICATION_TRIGGER_READ.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+        trigger_create: (source_id:string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.APPLICATION_TRIGGER_CREATE.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.APPLICATION_TRIGGER_CREATE.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+            trigger_edit: (source_id:string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.APPLICATION_TRIGGER_EDIT.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.APPLICATION_TRIGGER_EDIT.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+                trigger_delete: (source_id:string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.APPLICATION_TRIGGER_DELETE.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.APPLICATION_TRIGGER_DELETE.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
     auth: (source_id:string) => 
         hasPermission(
             [
diff --git a/ui/src/permission/tool/system-manage.ts b/ui/src/permission/tool/system-manage.ts
index ebc51d45bce..8db4ac6eabe 100644
--- a/ui/src/permission/tool/system-manage.ts
+++ b/ui/src/permission/tool/system-manage.ts
@@ -30,6 +30,38 @@ const systemManage = {
       ],
       'OR',
     ),
+  trigger_read: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_TOOL_TRIGGER_READ
+            ],
+            'OR'
+    ),
+  trigger_create: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_TOOL_TRIGGER_CREATE
+            ],
+            'OR'
+    ),
+  trigger_edit: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_TOOL_TRIGGER_EDIT
+            ],
+            'OR'
+    ),
+  trigger_delete: () =>
+        hasPermission(
+            [
+              RoleConst.ADMIN,
+              PermissionConst.RESOURCE_TOOL_TRIGGER_DELETE
+            ],
+            'OR'
+    ),
   create: () => false,
   import: () => false,
   switch: () =>
diff --git a/ui/src/permission/tool/workspace.ts b/ui/src/permission/tool/workspace.ts
index f0f82ea3a37..9a228f251f3 100644
--- a/ui/src/permission/tool/workspace.ts
+++ b/ui/src/permission/tool/workspace.ts
@@ -102,6 +102,46 @@ const workspace = {
       ],
       'OR',
     ),
+  trigger_read: (source_id:string) => 
+        hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.TOOL_TRIGGER_READ.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.TOOL_TRIGGER_READ.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+  trigger_create: (source_id:string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.TOOL_TRIGGER_CREATE.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.TOOL_TRIGGER_CREATE.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+  trigger_edit: (source_id: string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.TOOL_TRIGGER_EDIT.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.TOOL_TRIGGER_EDIT.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
+  trigger_delete: (source_id:string) => 
+    hasPermission(
+            [
+              new ComplexPermission([RoleConst.USER],[PermissionConst.APPLICATION.getApplicationWorkspaceResourcePermission(source_id)],[],'AND'),
+              RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
+              PermissionConst.TOOL_TRIGGER_DELETE.getWorkspacePermissionWorkspaceManageRole,
+              PermissionConst.TOOL_TRIGGER_DELETE.getApplicationWorkspaceResourcePermission(source_id)  
+            ],
+            'OR'
+    ),
   switch: (source_id:string) =>
     hasPermission(
       [
diff --git a/ui/src/router/modules/trigger.ts b/ui/src/router/modules/trigger.ts
index a7efa283fc3..c89d5964e80 100644
--- a/ui/src/router/modules/trigger.ts
+++ b/ui/src/router/modules/trigger.ts
@@ -5,10 +5,8 @@ const ModelRouter = {
   meta: {
     title: 'views.trigger.title',
     permission: [
-      RoleConst.USER.getWorkspaceRole,
       RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-      PermissionConst.TOOL_READ.getWorkspacePermission,
-      PermissionConst.TOOL_READ.getWorkspacePermissionWorkspaceManageRole,
+      PermissionConst.TRIGGER_READ.getWorkspacePermissionWorkspaceManageRole,
     ],
     group: 'workspace',
     order: 5,
diff --git a/ui/src/views/application/index.vue b/ui/src/views/application/index.vue
index b4778970e3d..931307f3dd3 100644
--- a/ui/src/views/application/index.vue
+++ b/ui/src/views/application/index.vue
@@ -247,7 +247,11 @@
                             </el-dropdown-item>
                             <el-dropdown-item
                               @click.stop="openTriggerDrawer(item)"
-                              v-if="apiType === 'workspace'"
+                              v-if="
+                                apiType === 'workspace' &&
+                                item.is_publish &&
+                                permissionPrecise.trigger_read(item.id)
+                              "
                             >
                               <AppIcon iconName="app-trigger" class="color-secondary"></AppIcon>
                               {{ $t('views.trigger.title') }}
diff --git a/ui/src/views/trigger/ResourceTriggerDrawer.vue b/ui/src/views/trigger/ResourceTriggerDrawer.vue
index ede1cb25d43..6c2126bfecd 100644
--- a/ui/src/views/trigger/ResourceTriggerDrawer.vue
+++ b/ui/src/views/trigger/ResourceTriggerDrawer.vue
@@ -7,7 +7,12 @@
       <h4 class="title-decoration-1 mb-16 mt-16">
         {{ $t('views.trigger.title') }}
       </h4>
-      <el-button link type="primary" @click="openCreateTriggerDrawer()">
+      <el-button
+        v-if="permissionPrecise.trigger_create(toolId)"
+        link
+        type="primary"
+        @click="openCreateTriggerDrawer()"
+      >
         <AppIcon iconName="app-add-outlined" class="mr-4"></AppIcon>
         {{ $t('common.add') }}
       </el-button>
@@ -30,7 +35,11 @@
               </el-button>
             </span>
 
-            <el-button text @click="removeTrigger(item)">
+            <el-button
+              v-if="permissionPrecise.trigger_delete(toolId)"
+              text
+              @click="removeTrigger(item)"
+            >
               <el-icon><Close /></el-icon>
             </el-button>
           </div>
@@ -54,23 +63,29 @@ import { ref, computed } from 'vue'
 import { useRoute } from 'vue-router'
 import { loadSharedApi } from '@/utils/dynamics-api/shared-api'
 import TriggerDrawer from '@/views/trigger/TriggerDrawer.vue'
+import permissionMap from '@/permission'
 import triggerAPI from '@/api/trigger/trigger'
 import { getTriggerCycleLabel } from '@/utils/trigger'
-const route = useRoute()
 
 const props = defineProps<{
   source: string
 }>()
+
+const route = useRoute()
 const apiType = computed(() => {
-  if (route.path.includes('shared')) {
-    return 'systemShare'
-  } else if (route.path.includes('resource-management')) {
+  if (route.path.includes('resource-management')) {
     return 'systemManage'
   } else {
     return 'workspace'
   }
 })
 
+const permissionPrecise = computed(() => {
+  return permissionMap[props.source.toLowerCase() as 'application' | 'tool'][
+    apiType.value as 'workspace' | 'systemManage'
+  ]
+})
+
 const toolId = ref<string>('')
 const visible = ref<boolean>(false)
 const loading = ref<boolean>(false)
@@ -97,7 +112,7 @@ const openCreateTriggerDrawer = () => {
   triggerDrawerRef.value?.open(undefined, props.source, toolId.value)
 }
 const openEditTriggerDrawer = (trigger: any) => {
-  triggerDrawerRef.value?.open(trigger.id)
+  triggerDrawerRef.value?.open(trigger.id, props.source, toolId.value)
 }
 
 function getTriggerList() {
diff --git a/ui/src/views/trigger/TriggerDrawer.vue b/ui/src/views/trigger/TriggerDrawer.vue
index affb6fbb1a5..03644fd408d 100644
--- a/ui/src/views/trigger/TriggerDrawer.vue
+++ b/ui/src/views/trigger/TriggerDrawer.vue
@@ -460,7 +460,7 @@
     <ToolDialog @refresh="toolRefresh" ref="toolDialogRef"></ToolDialog>
     <template #footer>
       <el-button @click="close">{{ $t('common.cancel') }}</el-button>
-      <el-button v-if="submitPermission" type="primary" @click="submit">{{
+      <el-button v-if="editPermission" type="primary" @click="submit">{{
         is_edit ? $t('common.save') : $t('common.create')
       }}</el-button>
     </template>
@@ -474,6 +474,7 @@ import ApplicationDialog from '@/views/application/component/ApplicationDialog.v
 import ToolDialog from '@/views/application/component/ToolDialog.vue'
 import applicationAPI from '@/api/application/application'
 import triggerAPI from '@/api/trigger/trigger'
+import systemManageTriggerAPI from '@/api/system-resource-management/trigger'
 import toolAPI from '@/api/tool/tool'
 import ToolParameter from '@/views/trigger/component/ToolParameter.vue'
 import ApplicationParameter from '@/views/trigger/component/ApplicationParameter.vue'
@@ -481,8 +482,10 @@ import { resetUrl } from '@/utils/common.ts'
 import { triggerCycleOptions } from '@/utils/trigger.ts'
 import { t } from '@/locales'
 import { type FormInstance } from 'element-plus'
+import { useRoute } from 'vue-router'
 import Result from '@/request/Result'
 import { hasPermission } from '@/utils/permission'
+import permissionMap from '@/permission'
 import { PermissionConst, RoleConst } from '@/utils/permission/data'
 
 const emit = defineEmits(['refresh'])
@@ -505,28 +508,34 @@ const collapseData = reactive({
 })
 const showTast = ref<string>('')
 
-const submitPermission = computed(() => {
-  return is_edit.value ? triggerPermissionMap.edit() : triggerPermissionMap.create()
+const route = useRoute()
+const apiType = computed(() => {
+  if (route.path.includes('resource-management')) {
+    return 'systemManage'
+  } else {
+    return 'workspace'
+  }
+})
+
+const permissionPrecise = computed(() => {
+  return permissionMap[current_source_type.value?.toLocaleLowerCase() as 'application' | 'tool'][
+    apiType.value as 'workspace' | 'systemManage'
+  ]
 })
 
-const triggerPermissionMap = {
-  edit: () =>
-    hasPermission(
+const editPermission = computed(() => {
+  if (current_source_id.value && current_source_type.value) {
+    return permissionPrecise.value.trigger_edit(current_source_id.value)
+  } else {
+    return hasPermission(
       [
         RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
         PermissionConst.TRIGGER_EDIT.getWorkspacePermissionWorkspaceManageRole,
       ],
       'OR',
-    ),
-  create: () =>
-    hasPermission(
-      [
-        RoleConst.WORKSPACE_MANAGE.getWorkspaceRole,
-        PermissionConst.TRIGGER_CREATE.getWorkspacePermissionWorkspaceManageRole,
-      ],
-      'OR',
-    ),
-}
+    )
+  }
+})
 
 const triggerFormRef = ref<FormInstance>()
 const copy = () => {
@@ -685,26 +694,49 @@ const event_url = computed(() => {
 })
 
 const init = (trigger_id: string) => {
-  triggerAPI.getTriggerDetail(trigger_id).then((ok) => {
-    form.value = ok.data
-
-    applicationDetailsDict.value = ok.data.application_task_list
-      .map((item: any) => ({ [item.id]: item }))
-      .reduce((x: any, y: any) => ({ ...x, ...y }), {})
-    toolDetailsDict.value = ok.data.tool_task_list
-      .map((item: any) => ({ [item.id]: item }))
-      .reduce((x: any, y: any) => ({ ...x, ...y }), {})
-  })
+  if (current_source_id.value && current_source_type.value) {
+    let api
+    if (apiType.value === 'workspace') {
+      api = triggerAPI.getResourceTriggerDetail(
+        current_source_type.value,
+        current_source_id.value,
+        trigger_id,
+      )
+    } else {
+      api = systemManageTriggerAPI.getResourceTriggerDetail(
+        current_source_type.value,
+        current_source_id.value,
+        trigger_id,
+      )
+    }
+    api.then((ok) => {
+      form.value = { ...ok.data, trigger_task: [ok.data.trigger_task] }
+      applicationDetailsDict.value = { [ok.data.application_task.id]: ok.data.application_task }
+      toolDetailsDict.value = { [ok.data.tool_task.id]: ok.data.tool_task }
+    })
+  } else {
+    triggerAPI.getTriggerDetail(trigger_id).then((ok) => {
+      form.value = ok.data
+      applicationDetailsDict.value = (ok.data.application_task_list || [])
+        .map((item: any) => ({ [item.id]: item }))
+        .reduce((x: any, y: any) => ({ ...x, ...y }), {})
+      toolDetailsDict.value = (ok.data.tool_task_list || [])
+        .map((item: any) => ({ [item.id]: item }))
+        .reduce((x: any, y: any) => ({ ...x, ...y }), {})
+    })
+  }
 }
 const current_trigger_id = ref<string>()
+const current_source_id = ref<string>()
+const current_source_type = ref<string>()
+
 const open = (trigger_id?: string, source_type?: string, source_id?: string) => {
   is_edit.value = trigger_id ? true : false
   current_trigger_id.value = trigger_id
   drawer.value = true
-  if (trigger_id) {
-    init(trigger_id)
-  }
   if (source_type && source_id) {
+    current_source_type.value = source_type
+    current_source_id.value = source_id
     if (source_type == 'APPLICATION') {
       applicationRefresh({ application_ids: [source_id] })
     }
@@ -712,9 +744,14 @@ const open = (trigger_id?: string, source_type?: string, source_id?: string) =>
       toolRefresh({ tool_ids: [source_id] })
     }
   }
+  if (trigger_id) {
+    init(trigger_id)
+  }
 }
 
 const close = () => {
+  current_source_id.value = undefined
+  current_source_type.value = undefined
   drawer.value = false
   form.value = getDefaultValue()
 }