feat(server): improve subscription sync stability (#14703)

packages/backend/server/src/plugins/copilot/context/resolver.ts

@@ -37,7 +37,10 @@ import {
   UserFriendlyError,
 } from '../../../base';
 import { CurrentUser } from '../../../core/auth';
-import { AccessController } from '../../../core/permission';
+import {
+  AccessController,
+  WorkspacePolicyService,
+} from '../../../core/permission';
 import {
   ContextBlob,
   ContextCategories,
@@ -408,6 +411,7 @@ export class CopilotContextRootResolver {
 export class CopilotContextResolver {
   constructor(
     private readonly ac: AccessController,
+    private readonly policy: WorkspacePolicyService,
     private readonly models: Models,
     private readonly mutex: RequestMutex,
     private readonly context: CopilotContextService,
@@ -667,6 +671,12 @@ export class CopilotContextResolver {
       const blobId = createHash('sha256').update(buffer).digest('base64url');
       const { filename, mimetype } = content;
 
+      await this.ac
+        .user(user.id)
+        .workspace(session.workspaceId)
+        .allowLocal()
+        .assert('Workspace.Copilot');
+      await this.policy.assertCanUploadBlob(user.id, session.workspaceId);
       await this.storage.put(user.id, session.workspaceId, blobId, buffer);
       const file = await session.addFile(
         blobId,

packages/backend/server/src/plugins/copilot/resolver.ts

@@ -37,7 +37,11 @@ import {
 import { CurrentUser } from '../../core/auth';
 import { Admin } from '../../core/common';
 import { DocReader } from '../../core/doc';
-import { AccessController, DocAction } from '../../core/permission';
+import {
+  AccessController,
+  DocAction,
+  WorkspacePolicyService,
+} from '../../core/permission';
 import { UserType } from '../../core/user';
 import type { ListSessionOptions, UpdateChatSession } from '../../models';
 import { processImage } from '../../native';
@@ -378,6 +382,7 @@ export class CopilotResolver {
   constructor(
     private readonly ac: AccessController,
     private readonly mutex: RequestMutex,
+    private readonly policy: WorkspacePolicyService,
     private readonly prompt: PromptService,
     private readonly chatSession: ChatSessionService,
     private readonly storage: CopilotStorage,
@@ -778,6 +783,10 @@ export class CopilotResolver {
       delete options.blob;
       delete options.blobs;
 
+      if (blobs.length) {
+        await this.policy.assertCanUploadBlob(user.id, workspaceId);
+      }
+
       for (const blob of blobs) {
         const uploaded = await this.storage.handleUpload(user.id, blob);
         const detectedMime =

packages/backend/server/src/plugins/copilot/workspace/resolver.ts

@@ -24,7 +24,10 @@ import {
   UserFriendlyError,
 } from '../../../base';
 import { CurrentUser } from '../../../core/auth';
-import { AccessController } from '../../../core/permission';
+import {
+  AccessController,
+  WorkspacePolicyService,
+} from '../../../core/permission';
 import { WorkspaceType } from '../../../core/workspaces';
 import { COPILOT_LOCKER } from '../resolver';
 import { MAX_EMBEDDABLE_SIZE } from '../utils';
@@ -72,6 +75,7 @@ export class CopilotWorkspaceEmbeddingConfigResolver {
   constructor(
     private readonly ac: AccessController,
     private readonly mutex: Mutex,
+    private readonly policy: WorkspacePolicyService,
     private readonly copilotWorkspace: CopilotWorkspaceService
   ) {}
 
@@ -215,10 +219,11 @@ export class CopilotWorkspaceEmbeddingConfigResolver {
     @Args('fileId', { type: () => String })
     fileId: string
   ): Promise<boolean> {
-    await this.ac
-      .user(user.id)
-      .workspace(workspaceId)
-      .assert('Workspace.Settings.Update');
+    await this.policy.assertWorkspaceRoleAction(
+      user.id,
+      workspaceId,
+      'Workspace.Settings.Update'
+    );
 
     return await this.copilotWorkspace.removeFile(workspaceId, fileId);
   }