feat: 支持 ONLYOFFICE 持久化配置管理

- 添加 SettingsRenderForm schema 和 renderForm 字段 - 实现数据库 schema 自动迁移（onlyoffice_enabled, onlyoffice_public_url, onlyoffice_jwt_secret_encrypted） - 新增 resolve_onlyoffice_settings() 函数支持运行时配置解析 - 知识库服务改用数据库配置替代运行时配置 - 前端添加文件渲染配置页面，支持 JWT 密钥管理 - 完善相关测试覆盖
2026-05-09 08:02:01 +00:00
parent 94122fd34b
commit 4fbd313f35
14 changed files with 735 additions and 314 deletions
--- a/server/tests/test_knowledge_onlyoffice_config.py
+++ b/server/tests/test_knowledge_onlyoffice_config.py
@@ -1,8 +1,31 @@
 from __future__ import annotations

+from pathlib import Path
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
 from app.api.deps import CurrentUserContext
 from app.core.config import Settings, get_settings
+from app.core import secret_box
+from app.db.base import Base
+from app.models.system_model_setting import SystemModelSetting
+from app.models.system_setting import SystemSetting
+from app.models.system_setting_secret import SystemSettingSecret
+from app.schemas.settings import SettingsWrite
 from app.services.knowledge import KnowledgeService
+from app.services.settings import SettingsService
+
+
+def build_session_factory(db_file: Path):
+    engine = create_engine(
+        f"sqlite+pysqlite:///{db_file.as_posix()}",
+        connect_args={"check_same_thread": False},
+    )
+    SystemSetting.__table__.create(bind=engine)
+    SystemSettingSecret.__table__.create(bind=engine)
+    SystemModelSetting.__table__.create(bind=engine)
+    return sessionmaker(bind=engine, autoflush=False, autocommit=False)


 def test_onlyoffice_config_is_read_only_for_admin_users(tmp_path, monkeypatch) -> None:
@@ -53,3 +76,61 @@ def test_onlyoffice_config_is_read_only_for_admin_users(tmp_path, monkeypatch) -
    finally:
        monkeypatch.setitem(Settings.model_config, "env_file", original_env_file)
        get_settings.cache_clear()
+
+
+def test_onlyoffice_config_prefers_saved_settings_snapshot(tmp_path, monkeypatch) -> None:
+    env_file = tmp_path / ".env"
+    env_file.write_text(
+        "\n".join(
+            [
+                "ADMIN_EMAIL=admin@example.com",
+                "ONLYOFFICE_ENABLED=false",
+                "ONLYOFFICE_BACKEND_URL=http://main:8000",
+            ]
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    original_env_file = Settings.model_config.get("env_file")
+    monkeypatch.setitem(Settings.model_config, "env_file", (env_file,))
+    monkeypatch.setattr(secret_box, "SECRET_KEY_FILE", tmp_path / "settings.key")
+    monkeypatch.setattr(Base.metadata, "create_all", lambda *args, **kwargs: None)
+    get_settings.cache_clear()
+
+    session_factory = build_session_factory(tmp_path / "settings.db")
+    monkeypatch.setattr("app.services.settings.get_session_factory", lambda: session_factory)
+
+    try:
+        with session_factory() as db:
+            service = SettingsService(db)
+            payload = service.get_settings_snapshot().model_dump()
+            payload["renderForm"]["enabled"] = True
+            payload["renderForm"]["publicUrl"] = "http://10.10.10.122:8082"
+            payload["renderForm"]["jwtSecret"] = "change-me-onlyoffice"
+            service.save_settings_snapshot(SettingsWrite(**payload))
+
+        service = KnowledgeService(storage_root=tmp_path)
+        service.ensure_library_ready()
+
+        document_id = "db-backed-docx"
+        folder = "制度政策"
+        stored_name = f"{document_id}__制度预览.docx"
+        target_path = tmp_path / "knowledge" / folder / stored_name
+        target_path.write_bytes(b"fake-docx-content")
+
+        current_user = CurrentUserContext(
+            username="admin",
+            name="管理员",
+            role_codes=["manager"],
+            is_admin=True,
+        )
+
+        config = service.build_onlyoffice_config(document_id, current_user)
+
+        assert config.documentServerUrl == "http://10.10.10.122:8082"
+        assert config.config["document"]["url"].startswith(
+            "http://main:8000/api/v1/knowledge/documents/db-backed-docx/onlyoffice/content?access_token="
+        )
+    finally:
+        monkeypatch.setitem(Settings.model_config, "env_file", original_env_file)
+        get_settings.cache_clear()
--- a/server/tests/test_settings_persistence.py
+++ b/server/tests/test_settings_persistence.py
@@ -35,7 +35,7 @@ def build_temp_secret_dir() -> Path:
    return Path(tempfile.mkdtemp(prefix="xf-settings-test-"))


-def test_settings_service_persists_non_secret_and_secret_fields(monkeypatch) -> None:
+def test_settings_service_persists_non_secret_and_secret_fields(monkeypatch) -> None:
    temp_dir = build_temp_secret_dir()
    monkeypatch.setattr(secret_box, "SECRET_KEY_FILE", temp_dir / "settings.key")
    monkeypatch.setattr(Base.metadata, "create_all", lambda *args, **kwargs: None)
@@ -51,30 +51,44 @@ def test_settings_service_persists_non_secret_and_secret_fields(monkeypatch) ->
        payload["adminForm"]["adminEmail"] = "admin@example.com"
        payload["adminForm"]["newPassword"] = "54321"
        payload["adminForm"]["confirmPassword"] = "54321"
-        payload["llmForm"]["mainModel"] = "glm-4.5"
-        payload["llmForm"]["mainApiKey"] = "main-secret"
-        payload["mailForm"]["password"] = "smtp-secret"
-
-        saved_snapshot = service.save_settings_snapshot(SettingsWrite(**payload))
+        payload["llmForm"]["mainModel"] = "glm-4.5"
+        payload["llmForm"]["mainApiKey"] = "main-secret"
+        payload["renderForm"]["enabled"] = True
+        payload["renderForm"]["publicUrl"] = "http://10.10.10.122:8082"
+        payload["renderForm"]["jwtSecret"] = "change-me-onlyoffice"
+        payload["mailForm"]["password"] = "smtp-secret"
+
+        saved_snapshot = service.save_settings_snapshot(SettingsWrite(**payload))

        assert saved_snapshot.companyForm.companyName == "YGSOFT"
        assert saved_snapshot.companyForm.displayName == "云广软件"
-        assert saved_snapshot.llmForm.mainModel == "glm-4.5"
-        assert saved_snapshot.llmForm.mainApiKey == ""
-        assert saved_snapshot.llmForm.mainApiKeyConfigured is True
-        assert saved_snapshot.mailForm.password == ""
-        assert saved_snapshot.mailForm.passwordConfigured is True
-        assert saved_snapshot.adminForm.newPassword == ""
+        assert saved_snapshot.llmForm.mainModel == "glm-4.5"
+        assert saved_snapshot.llmForm.mainApiKey == ""
+        assert saved_snapshot.llmForm.mainApiKeyConfigured is True
+        assert saved_snapshot.renderForm.enabled is True
+        assert saved_snapshot.renderForm.publicUrl == "http://10.10.10.122:8082"
+        assert saved_snapshot.renderForm.jwtSecret == ""
+        assert saved_snapshot.renderForm.jwtSecretConfigured is True
+        assert saved_snapshot.mailForm.password == ""
+        assert saved_snapshot.mailForm.passwordConfigured is True
+        assert saved_snapshot.adminForm.newPassword == ""
        assert saved_snapshot.adminForm.adminPasswordConfigured is True
-
-        model_row = db.get(SystemModelSetting, "main")
-        assert model_row is not None
-        assert model_row.model_name == "glm-4.5"
-        assert model_row.api_key_encrypted
-
-        assert service.load_saved_model_api_key("main") == "main-secret"
-        assert service.verify_admin_login("admin-root", "54321") is not None
-        assert service.verify_admin_login("admin@example.com", "54321") is not None
+
+        model_row = db.get(SystemModelSetting, "main")
+        settings_row = db.get(SystemSetting, "default")
+        secrets_row = db.get(SystemSettingSecret, "default")
+        assert model_row is not None
+        assert model_row.model_name == "glm-4.5"
+        assert model_row.api_key_encrypted
+        assert settings_row is not None
+        assert settings_row.onlyoffice_enabled is True
+        assert settings_row.onlyoffice_public_url == "http://10.10.10.122:8082"
+        assert secrets_row is not None
+        assert secrets_row.onlyoffice_jwt_secret_encrypted
+
+        assert service.load_saved_model_api_key("main") == "main-secret"
+        assert service.verify_admin_login("admin-root", "54321") is not None
+        assert service.verify_admin_login("admin@example.com", "54321") is not None


 def test_blank_secret_input_does_not_clear_saved_secret(monkeypatch) -> None: