feat(outlink): add login protection for share links - #7793
Merged
Merged
Conversation
|
✅ Build and publish successful - Preview fastgpt Image: 🕒 Time: 2026-09-23 14:46:34 (UTC+8) |
sxf-xiongtao
force-pushed
the
feat-share-login-auth
branch
2 times, most recently
from
September 21, 2026 03:15
ad6f22c to
66da3dc
Compare
ctlaltlaltc
previously approved these changes
Sep 21, 2026
Include the locale header required by the app logs list test.
sxf-xiongtao
force-pushed
the
feat-share-login-auth
branch
from
September 22, 2026 11:10
66da3dc to
9cafcec
Compare
DigHuang
approved these changes
Sep 23, 2026
c121914yu
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
两个需求：
1.分享链接变成一个"需要登录才能进的入口"，而不是人人可用的公开窗口
2.公开分享时访客是匿名的，日志里只能看到一串
shareChat-xxx；一旦要求登录，日志应当能还原到具体团队成员（姓名/头像）。实现效果：
1.分享链接新增
allowAnonymous配置项，可开可关，开=保持历史公开行为，关=必须登录2.关闭免登录后，访客打开链接被引导登录，登录后校验其对本应用是否有读权限，有权可聊、无权拒绝
3.关闭免登录后，对话身份改用登录成员的 tmbId，而非前端自定义
outLinkUid，防止伪造身份4.对话日志（
app_chat_logs）能正确归因：登录访客显示成员姓名，匿名访客显示外链 UID5.存量分享链接（无
allowAnonymous字段）行为不变，仍为公开