From 5c2f323e64d0979621574adc7541035e0d11af95 Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Wed, 5 Nov 2025 10:01:07 +0800
Subject: [PATCH] Add permission checks for collection removal

- Implemented authorization checks in the RemoveCollection function to ensure users have the necessary permissions before removing a collection.
- Introduced error handling for unauthorized access attempts, returning appropriate responses for permission denials.
- Enhanced security by validating user access based on their authorization information.
---
 openapi/kb/collection.go | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/openapi/kb/collection.go b/openapi/kb/collection.go
index c33b1118..088d4e5e 100644
--- a/openapi/kb/collection.go
+++ b/openapi/kb/collection.go
@@ -148,6 +148,9 @@ func CreateCollection(c *gin.Context) {
 
 // RemoveCollection removes an existing collection
 func RemoveCollection(c *gin.Context) {
+
+	authInfo := authorized.GetInfo(c)
+
 	// Get collection ID from URL parameter
 	collectionID := c.Param("collectionID")
 	if collectionID == "" {
@@ -169,6 +172,27 @@ func RemoveCollection(c *gin.Context) {
 		return
 	}
 
+	// Check remove permission
+	hasPermission, err := checkCollectionPermission(authInfo, collectionID)
+	if err != nil {
+		errorResp := &response.ErrorResponse{
+			Code:             response.ErrServerError.Code,
+			ErrorDescription: err.Error(),
+		}
+		response.RespondWithError(c, response.StatusForbidden, errorResp)
+		return
+	}
+
+	// 403 Forbidden
+	if !hasPermission {
+		errorResp := &response.ErrorResponse{
+			Code:             response.ErrAccessDenied.Code,
+			ErrorDescription: "Forbidden: No permission to remove collection",
+		}
+		response.RespondWithError(c, response.StatusForbidden, errorResp)
+		return
+	}
+
 	// Call the actual RemoveCollection method
 	removed, err := kb.Instance.RemoveCollection(c.Request.Context(), collectionID)
 	if err != nil {