fix: add authorization handling to file deletion endpoint

apps/oss/serializers/file.py

@@ -338,11 +338,12 @@ def handle_audio(self, file_size, file_bytes, content_type, encoded_filename):
                 response['Content-Disposition'] = f'inline; filename={encoded_filename}'
                 return response
 
-        def delete(self):
+        def delete(self, mk_file_auth=None):
             self.is_valid(raise_exception=True)
             file_id = self.data.get('id')
             file = QuerySet(File).filter(id=file_id).first()
             if file is not None:
+                auth(file, mk_file_auth)
                 file.delete()
             return True
 

apps/oss/views/file.py

@@ -1,17 +1,15 @@
 # coding=utf-8
-from django.utils.translation import gettext_lazy as _
-from drf_spectacular.utils import extend_schema
-from rest_framework.parsers import MultiPartParser
-from rest_framework.views import APIView
-from rest_framework.views import Request
-from common.auth import TokenAuth, AllTokenAuth
-from common.constants.permission_constants import ChatAuth
+from common.auth import AllTokenAuth, TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import RoleConstants
+from common.constants.permission_constants import ChatAuth, RoleConstants
 from common.log.log import log
 from common.result import result
-from knowledge.api.file import FileUploadAPI, FileGetAPI, GetUrlContentAPI
+from django.utils.translation import gettext_lazy as _
+from drf_spectacular.utils import extend_schema
+from knowledge.api.file import FileGetAPI, FileUploadAPI, GetUrlContentAPI
 from oss.serializers.file import FileSerializer, get_url_content
+from rest_framework.parsers import MultiPartParser
+from rest_framework.views import APIView, Request
 
 
 class FileRetrievalView(APIView):
@@ -68,7 +66,12 @@ class Operate(APIView):
         @log(menu='file', operate='Delete file')
         @has_permissions(RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER)
         def delete(self, request: Request, file_id: str):
-            return result.success(FileSerializer.Operate(data={'id': file_id}).delete())
+            return result.success(FileSerializer.Operate(
+                data={
+                    "id": file_id,
+                    "http_range": request.headers.get("Range", ""),
+                }
+            ).delete(mk_file_auth=request.COOKIES.get("mk_file_auth")))
 
 
 class GetUrlView(APIView):