MercuialC · Sep 15, 2026
diff --git a/cli/cmd/kb/list.go b/cli/cmd/kb/list.go
@@ -26,6 +26,7 @@ var kbListFields = []string{
 	"embedding_model_id", "summary_model_id",
 	"knowledge_count", "chunk_count",
 	"is_processing", "processing_count",
+	"permission",
 	"created_at", "updated_at",
 }
 

diff --git a/client/knowledgebase.go b/client/knowledgebase.go
@@ -35,10 +35,11 @@ type KnowledgeBase struct {
 	CreatedAt             time.Time              `json:"created_at"`
 	UpdatedAt             time.Time              `json:"updated_at"`
 	// Computed fields (not stored in database)
-	KnowledgeCount  int64 `json:"knowledge_count"`
-	ChunkCount      int64 `json:"chunk_count"`
-	IsProcessing    bool  `json:"is_processing"`
-	ProcessingCount int64 `json:"processing_count"`
+	KnowledgeCount  int64               `json:"knowledge_count"`
+	ChunkCount      int64               `json:"chunk_count"`
+	IsProcessing    bool                `json:"is_processing"`
+	ProcessingCount int64               `json:"processing_count"`
+	Permission      KnowledgeBaseAccess `json:"permission,omitempty"`
 }
 
 // KnowledgeBaseConfig represents knowledge base configuration
@@ -90,6 +91,14 @@ type StorageConfig struct {
 	Provider   string `json:"provider"`
 }
 
+// KnowledgeBaseAccess is the caller's read / write / manage rights on one
+// knowledge base, as returned on GET /knowledge-bases.
+type KnowledgeBaseAccess struct {
+	Read   bool `json:"read"`
+	Write  bool `json:"write"`
+	Manage bool `json:"manage"`
+}
+
 // ExtractConfig represents the extract configuration for a knowledge base
 type ExtractConfig struct {
 	Enabled   bool             `json:"enabled"`

diff --git a/client/tenant.go b/client/tenant.go
@@ -78,38 +78,41 @@ const (
 
 // TenantAPIKey is the API key metadata returned by list/create APIs.
 type TenantAPIKey struct {
-	ID               uint64           `json:"id"`
-	TenantID         uint64           `json:"tenant_id"`
-	ScopeType        string           `json:"scope_type"`
-	Name             string           `json:"name"`
-	APIKey           string           `json:"api_key"`
-	Role             TenantAPIKeyRole `json:"role"`
-	FullAccess       bool             `json:"full_access"`
-	KnowledgeBaseIDs []string         `json:"knowledge_base_ids"`
-	Capabilities     []string         `json:"capabilities"`
-	LastUsedAt       *time.Time       `json:"last_used_at,omitempty"`
-	ExpiresAt        *time.Time       `json:"expires_at,omitempty"`
-	CreatedAt        time.Time        `json:"created_at"`
-	UpdatedAt        time.Time        `json:"updated_at"`
+	ID                       uint64              `json:"id"`
+	TenantID                 uint64              `json:"tenant_id"`
+	ScopeType                string              `json:"scope_type"`
+	Name                     string              `json:"name"`
+	APIKey                   string              `json:"api_key"`
+	Role                     TenantAPIKeyRole    `json:"role"`
+	FullAccess               bool                `json:"full_access"`
+	KnowledgeBaseIDs         []string            `json:"knowledge_base_ids"`
+	KnowledgeBasePermissions map[string][]string `json:"knowledge_base_permissions,omitempty"`
+	Capabilities             []string            `json:"capabilities"`
+	LastUsedAt               *time.Time          `json:"last_used_at,omitempty"`
+	ExpiresAt                *time.Time          `json:"expires_at,omitempty"`
+	CreatedAt                time.Time           `json:"created_at"`
+	UpdatedAt                time.Time           `json:"updated_at"`
 }
 
 // CreateTenantAPIKeyRequest creates a revocable tenant API key.
 type CreateTenantAPIKeyRequest struct {
-	Name             string           `json:"name"`
-	Role             TenantAPIKeyRole `json:"role,omitempty"`
-	FullAccess       bool             `json:"full_access,omitempty"`
-	KnowledgeBaseIDs []string         `json:"knowledge_base_ids,omitempty"`
-	Capabilities     []string         `json:"capabilities,omitempty"`
-	ExpiresAtUnix    *int64           `json:"expires_at_unix,omitempty"`
+	Name                     string              `json:"name"`
+	Role                     TenantAPIKeyRole    `json:"role,omitempty"`
+	FullAccess               bool                `json:"full_access,omitempty"`
+	KnowledgeBaseIDs         []string            `json:"knowledge_base_ids,omitempty"`
+	KnowledgeBasePermissions map[string][]string `json:"knowledge_base_permissions,omitempty"`
+	Capabilities             []string            `json:"capabilities,omitempty"`
+	ExpiresAtUnix            *int64              `json:"expires_at_unix,omitempty"`
 }
 
 // UpdateTenantAPIKeyRequest replaces an existing tenant API key's configurable attributes.
 type UpdateTenantAPIKeyRequest struct {
-	Name             string   `json:"name"`
-	FullAccess       bool     `json:"full_access"`
-	KnowledgeBaseIDs []string `json:"knowledge_base_ids"`
-	Capabilities     []string `json:"capabilities"`
-	ExpiresAtUnix    *int64   `json:"expires_at_unix"`
+	Name                     string              `json:"name"`
+	FullAccess               bool                `json:"full_access"`
+	KnowledgeBaseIDs         []string            `json:"knowledge_base_ids"`
+	KnowledgeBasePermissions map[string][]string `json:"knowledge_base_permissions,omitempty"`
+	Capabilities             []string            `json:"capabilities"`
+	ExpiresAtUnix            *int64              `json:"expires_at_unix"`
 }
 
 // CreatedTenantAPIKey includes the created API key. Token is kept for

diff --git a/docs/api/knowledge-base.md b/docs/api/knowledge-base.md
@@ -251,7 +251,7 @@ curl --location 'http://localhost:8080/api/v1/knowledge-bases' \
 --header 'X-API-Key: sk-xxxxx'
 ```
 
-**响应**: `data` 为数组，每个元素的字段结构同 `POST /knowledge-bases` 响应，并额外携带 `knowledge_count` / `chunk_count` / `processing_count` / `share_count` / `is_pinned` / `pinned_at` 这些聚合与状态字段。
+**响应**: `data` 为数组，每个元素的字段结构同 `POST /knowledge-bases` 响应，并额外携带 `knowledge_count` / `chunk_count` / `processing_count` / `share_count` / `is_pinned` / `pinned_at` / `capabilities` / `permission`。`permission` 为当前调用方对该库的权限：`{ "read": bool, "write": bool, "manage": bool }`（可读 / 可写 / 可管理）。API Key 按该 Key 的全局能力与分库 overlay 计算；登录用户按空间角色（Contributor 仅对自己创建的库有写/管理）。
 
 > **注意（Phase 2）**：列表接口不包含 `vector_store_name` / `vector_store_source` / `vector_store_engine_type` / `vector_store_status` 这四个解析后的元数据字段（避免 N+1 查询）；仅 `vector_store_id` 来自数据库本身。需要展示存储名称时请单独调用详情接口或 `/vector-stores/:id`。
 
@@ -279,7 +279,7 @@ curl --location 'http://localhost:8080/api/v1/knowledge-bases/kb-00000001' \
 --header 'X-API-Key: sk-xxxxx'
 ```
 
-**响应**: 字段结构同 `POST /knowledge-bases` 响应（包含 Phase 2 的 `vector_store_*` 元数据字段），并附 `is_pinned` / `pinned_at` / `knowledge_count` / `chunk_count` / `processing_count` 状态字段。通过共享智能体访问时还会附加 `my_permission`；同时 `vector_store_name` / `vector_store_engine_type` 会被隐藏（`vector_store_source` 返回 `"shared"`），避免跨空间泄漏存储展示名。
+**响应**: 字段结构同 `POST /knowledge-bases` 响应（包含 Phase 2 的 `vector_store_*` 元数据字段），并附 `is_pinned` / `pinned_at` / `knowledge_count` / `chunk_count` / `processing_count` / `permission`。`permission` 同列表接口。通过共享智能体访问时还会附加 `my_permission`；同时 `vector_store_name` / `vector_store_engine_type` 会被隐藏（`vector_store_source` 返回 `"shared"`），避免跨空间泄漏存储展示名。
 
 ## PUT `/knowledge-bases/:id` - 更新知识库
 

diff --git a/frontend/src/api/tenant/index.ts b/frontend/src/api/tenant/index.ts
@@ -100,6 +100,7 @@ export interface TenantAPIKey {
   api_key: string
   full_access: boolean
   knowledge_base_ids: string[] | null
+  knowledge_base_permissions?: Record<string, string[]> | null
   capabilities?: TenantAPIKeyCapability[]
   last_used_at?: string
   expires_at?: string
@@ -114,6 +115,7 @@ export interface CreateTenantAPIKeyPayload {
   name: string
   full_access?: boolean
   knowledge_base_ids?: string[]
+  knowledge_base_permissions?: Record<string, string[]>
   capabilities?: TenantAPIKeyCapability[]
   expires_at_unix?: number
 }
@@ -122,6 +124,7 @@ export interface UpdateTenantAPIKeyPayload {
   name: string
   full_access: boolean
   knowledge_base_ids: string[]
+  knowledge_base_permissions?: Record<string, string[]>
   capabilities: TenantAPIKeyCapability[]
   expires_at_unix?: number
 }

diff --git a/frontend/src/i18n/locales/en-US.ts b/frontend/src/i18n/locales/en-US.ts
@@ -6679,6 +6679,11 @@ export default {
       capabilityManageTenantSettingsHint: 'Read and update workspace-level integration settings such as API end-user identity mode, request header configuration, and workspace KV settings. Does not include API key management, member management, workspace deletion, or ownership transfer.',
       apiKeyKnowledgeScope: 'Knowledge bases',
       apiKeyKnowledgeScopePlaceholder: 'Leave empty to allow all knowledge bases',
+      apiKeyKnowledgePermissionsHint: 'Defaults follow the Read / Edit / Manage capabilities checked above. Uncheck per knowledge base to narrow them; unchecking Read removes that knowledge base from the list.',
+      kbPermissionRead: 'Read',
+      kbPermissionEdit: 'Edit',
+      kbPermissionManage: 'Manage',
+      apiKeyKnowledgeScopeSummary: '{total} ({editable} editable / {manageable} manageable)',
       allKnowledgeBases: 'All knowledge bases',
       editApiKeyScope: 'Edit API key',
       editApiKeyScopeDesc: 'Change the name and authorization scope of API key "{name}".',

diff --git a/frontend/src/i18n/locales/ko-KR.ts b/frontend/src/i18n/locales/ko-KR.ts
@@ -591,6 +591,11 @@ export default {
       capabilityManageTenantSettingsHint: 'API 최종 사용자 식별 모드, 요청 헤더 설정, 워크스페이스 KV 설정 등 워크스페이스 수준 통합 설정을 읽고 업데이트합니다. API Key 관리, 멤버 관리, 워크스페이스 삭제 또는 소유권 이전은 포함하지 않습니다.',
       apiKeyKnowledgeScope: '지식베이스 범위',
       apiKeyKnowledgeScopePlaceholder: '비워 두면 모든 지식베이스 접근 허용',
+      apiKeyKnowledgePermissionsHint: '기본값은 위에서 선택한 읽기 / 편집 / 관리 권한을 따릅니다. 지식베이스별로 선택을 해제할 수 있으며, 읽기를 해제하면 목록에서 제거됩니다.',
+      kbPermissionRead: '읽기',
+      kbPermissionEdit: '편집',
+      kbPermissionManage: '관리',
+      apiKeyKnowledgeScopeSummary: '{total}개 (편집 {editable} / 관리 {manageable})',
       allKnowledgeBases: '모든 지식베이스',
       editApiKeyScope: 'API Key 편집',
       editApiKeyScopeDesc: 'API Key "{name}"의 이름과 권한 범위를 변경합니다.',

diff --git a/frontend/src/i18n/locales/ru-RU.ts b/frontend/src/i18n/locales/ru-RU.ts
@@ -591,6 +591,11 @@ export default {
       capabilityManageTenantSettingsHint: 'Чтение и обновление интеграционных настроек пространства: режим идентификации конечного пользователя API, настройки заголовков запросов и KV пространства. Не включает управление API Key, участниками, удаление пространства или передачу владения.',
       apiKeyKnowledgeScope: 'Базы знаний',
       apiKeyKnowledgeScopePlaceholder: 'Оставьте пустым, чтобы разрешить доступ ко всем базам знаний',
+      apiKeyKnowledgePermissionsHint: 'По умолчанию следуют отмеченным выше правам чтения / правки / управления. Можно снять флажок у отдельной базы; снятие «Чтение» удаляет базу из списка.',
+      kbPermissionRead: 'Чтение',
+      kbPermissionEdit: 'Правка',
+      kbPermissionManage: 'Управление',
+      apiKeyKnowledgeScopeSummary: '{total} (правка {editable} / управление {manageable})',
       allKnowledgeBases: 'Все базы знаний',
       editApiKeyScope: 'Изменить API key',
       editApiKeyScopeDesc: 'Изменить имя и область авторизации API key «{name}».',

diff --git a/frontend/src/i18n/locales/zh-CN.ts b/frontend/src/i18n/locales/zh-CN.ts
@@ -591,6 +591,11 @@ export default {
       capabilityManageTenantSettingsHint: '允许读取和更新空间级集成设置，例如 API 终端用户身份模式、请求头配置、空间 KV 配置等；不包含 API Key 管理、成员管理、空间删除或所有权转移。',
       apiKeyKnowledgeScope: '知识库范围',
       apiKeyKnowledgeScopePlaceholder: '留空表示允许访问全部知识库',
+      apiKeyKnowledgePermissionsHint: '默认跟随上方已勾选的可读 / 可编辑 / 可管理能力。可按知识库去掉勾选；取消可读会从名单中移除该库。',
+      kbPermissionRead: '可读',
+      kbPermissionEdit: '可编辑',
+      kbPermissionManage: '可管理',
+      apiKeyKnowledgeScopeSummary: '{total} 个（可编辑 {editable} / 可管理 {manageable}）',
       allKnowledgeBases: '全部知识库',
       editApiKeyScope: '编辑 API Key',
       editApiKeyScopeDesc: '修改 API Key「{name}」的名称和授权范围。',