类class io.agentscope.builder.web.share 2.x

AgentAclService

@Service public class AgentAclService

源码Source io/agentscope/builder/web/share/AgentAclService.java:46–145

智能体 Acl 服务，承载智能体的部署、调度与服务化运行。位于 io.agentscope.builder.web.share 包。核心成员包括 tierFor、can、filterVisible。

Single source of truth for per-agent permissions.

Tiers are ordered: EDIT > RUN > CLONE. Rules:

Owner of a SCOPE_USER agent → EDIT.
Any logged-in user on a SCOPE_GLOBAL agent → EDIT. The shared agentscope.json base is admin-managed and never touched by ACL-gated writes; per-user edits land in the caller's per-(user, agent) overlay via HarnessAgent.workspaceFor(userId, null), so each user gets a private overlay on top of the shared global agent.
A grant on (USER, userId) applies immediately to that user.
A grant on (WORKSPACE, "*") applies to every logged-in user.
Highest matching tier wins.
The admin role grants user-management only — it does not grant agent-level access automatically.

This service is intentionally stateless; the per-request snapshot of an AgentDefinition is the only input. Catalog/store layers must surface the agent's shares list verbatim — gating happens here, not in catalog or controller code paths.

嵌套类摘要Nested Class Summary

类Class	类型Kind	说明Description
`Tier`	枚举enum	定义Tier相关取值的枚举。 A enum in io.agentscope.builder.web.share that defines enum values used when components deploys, schedules and serves agents.

方法摘要Method Summary

方法Method	说明Description
`public` `Tier tierFor(String userId, AgentDefinition def)`	执行 `tierFor` 方法。 Returns the highest tier `userId` holds on `def`, or `null` if none.
`public boolean can(String userId,` `AgentDefinition def, Tier required)`	执行可以相关操作。 `true` iff `userId` holds at least `required` on `def`.
`public List<AgentDefinition> filterVisible(String userId, List<AgentDefinition> all, Tier min)`	过滤可见。 Filter a candidate list down to agents on which `userId` holds at least `min`.

方法详情Method Detail

tierFor

public Tier tierFor(String userId, AgentDefinition def)

执行 tierFor 方法。

Returns the highest tier userId holds on def, or null if none.

参数Parameters

名称Name	类型Type	说明Description
`userId`	String	用户标识（类型 `String`）。The user id.
`def`	AgentDefinition	def（类型 `AgentDefinition`）。The def.

返回Returns Tier

返回Tier。Returns tier.

源码Source io/agentscope/builder/web/share/AgentAclService.java:66–80

can

public boolean can(String userId, AgentDefinition def, Tier required)

执行可以相关操作。

true iff userId holds at least required on def.

参数Parameters

名称Name	类型Type	说明Description
`userId`	String	用户标识（类型 `String`）。The user id.
`def`	AgentDefinition	def（类型 `AgentDefinition`）。The def.
`required`	Tier	必填（类型 `Tier`）。The required.

返回Returns boolean

返回布尔值，表示判断结果。Returns a boolean result.

源码Source io/agentscope/builder/web/share/AgentAclService.java:83–86

filterVisible

public List<AgentDefinition> filterVisible(String userId, List<AgentDefinition> all, Tier min)

过滤可见。

Filter a candidate list down to agents on which userId holds at least min.

参数Parameters

名称Name	类型Type	说明Description
`userId`	String	用户标识（类型 `String`）。The user id.
`all`	List<AgentDefinition>	所有（类型 `List`）。The all.
`min`	Tier	最小（类型 `Tier`）。The min.

返回Returns List<AgentDefinition>

返回列出。Returns list.

源码Source io/agentscope/builder/web/share/AgentAclService.java:89–97

嵌套类详情Nested Class Detail

Tier

public enum Tier

定义Tier相关取值的枚举。位于 io.agentscope.builder.web.share 包。核心成员包括 implies、CLONE、RUN、EDIT。

A enum in io.agentscope.builder.web.share that defines enum values used when components deploys, schedules and serves agents. Declared in io.agentscope.builder.web.share.