feat: add independent LLMConfig permissions for AI profile management

Add new privilege definitions:
- LLMConfig.Audit - View LLM model configurations
- LLMConfig.Modify - Update LLM model configurations
- LLMConfig.Allocate - Create/delete LLM model configurations

Add LLMConfig.Audit and LLMConfig.Modify to default User role so that
regular users can manage their own AI profiles without needing the
User.Manager role.

User-scoped LLM config endpoints now use LLMConfig.* permissions.
Group-scoped LLM config endpoints retain Group.* permissions.
This commit is contained in:
YueGuobin committed 2026-05-26 14:24:41 +08:00
1 parent 7e33772983
commit 9fca2181a8
2 files changed
+29 -15

No files matched your search

+15 -1
View File
@@ -226,6 +226,18 @@ def create_default_roles(target, connection, **kw):
{
"description": "View an appliance",
"name": "Appliance.Audit"
},
{
"description": "Create or delete an LLM model configuration",
"name": "LLMConfig.Allocate"
},
{
"description": "View an LLM model configuration",
"name": "LLMConfig.Audit"
},
{
"description": "Update an LLM model configuration",
"name": "LLMConfig.Modify"
}
]
@@ -295,7 +307,9 @@ def add_privileges_to_default_roles(target, connection, **kw):
"Image.Audit",
"Compute.Audit",
"Appliance.Allocate",
"Appliance.Audit"
"Appliance.Audit",
"LLMConfig.Audit",
"LLMConfig.Modify"
)
add_privileges_to_role(target, connection, "User", user_privileges)