[Bug] 知识库 API 全部返回 403：路由要求的 scope `kb` 不在 ALL_OPEN_API_SCOPES 白名单内
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- api, authorization
Research direction
Start with astrbot/dashboard/api/knowledge_bases.py at require_kb_scope, then compare the scope definitions in astrbot/dashboard/services/auth_service.py with the validation in astrbot/dashboard/api/auth.py. Reproduce the request using an API key with kb or * scopes, align the route and permitted scopes, and verify that knowledge-base API calls no longer return 403.
Written by the indexing model from the issue text.
Description
问题描述
知识库相关接口（/api/v1/knowledge-bases/*）无法通过任何 API Key 调用，必然返回 403。
原因有两处互相矛盾：
- 知识库路由要求 scope 为
"kb"； - 但
"kb"并不在ALL_OPEN_API_SCOPES白名单里，而校验函数在 scope 不在白名单时直接抛 403。
即：这个 scope 值在框架内无法被授予，因此该组接口对 API Key 永久不可达。仅通过 Dashboard 登录态（JWT）可访问，因为 JWT 分支直接授予 scopes=["*"]。
如何复现
- 创建一个 API Key，scopes 设为
["kb"]（或["*"]）：
INSERT INTO api_keys (created_at, updated_at, key_id, name, key_hash, key_prefix, scopes, created_by, expires_at)
VALUES (..., '["kb"]', ...);
- 调用知识库接口：
curl -H "X-API-Key: $KEY" http://127.0.0.1:6185/api/v1/knowledge-bases
- 实际结果：
{"status":"error","message":"Insufficient API key scope"}
HTTP 403。即使把 scopes 设为 ["*"] 也一样 —— 因为在检查 scopes 内容之前，scope 本身先被白名单拦下了。
代码定位
- 路由要求 scope 为
kb：dashboard/api/knowledge_bases.py:39async def require_kb_scope(request: Request) -> AuthContext: return await require_scope(request, "kb") - 白名单不含
kb：dashboard/services/auth_service.py:58 - 校验直接 403：dashboard/api/auth.py:137
if scope not in ALL_OPEN_API_SCOPES: raise ApiError("Insufficient API key scope", status_code=403)
期望行为
三选一即可：
- 在
DEFAULT_OPEN_API_SCOPES中补上"kb"（最小改动，与file/data等数据类 scope 一致）； - 或让知识库路由改用已有的某个 scope；
- 或让 Dashboard API Key 创建界面里可授予的 scope 与路由实际使用的 scope 对齐（当前界面无法覆盖
kb）。
影响
所有依赖知识库接口的自动化场景不可用：批量导入文档、从 URL 导入、检索、文档与分块增删查。
目前只能绕过 HTTP 层，在插件内部直接调用 context.kb_manager 完成同样操作，但这要求使用者自己写插件，普通用户无路可走。
环境
- AstrBot 版本：4.28.2
- 部署方式：Linux / systemd
- 可稳定复现：100%
如判断有误（该 scope 存在其它授予途径而我未找到），欢迎指出。
- Dominant language
- Python
- Stars
- 41.4k
- Forks
- 3k
- Avg merge
- 1d 14m
- Merged PRs (30d)
- 135
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AstrBotDevs/AstrBot
-
Text-to-image rendering suppresses asyncio task cancellationPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
AstrBotDevs/AstrBot#10389 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AstrBotDevs/AstrBot#10388 · 1 comment ·
Maintainers usually reply within 1 day
-
Boxlite boot treats any HTTP response as a healthy sandboxPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
AstrBotDevs/AstrBot#10385 · 2 comments ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
AstrBotDevs/AstrBot#10378 · 1 comment ·
Maintainers usually reply within 1 day
-
[Feature] 移除「切换到旧版知识库」入口Possibly taken @silvaling claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AstrBotDevs/AstrBot#10340 ·
Maintainers usually reply within 1 day
All issues in AstrBotDevs/AstrBot
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 3 days
-
Negation with "not" and "no" is ignored during sentiment analysisPossibly taken @vivek-3728 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
techcsispit/mess-mood#11 · 1 comment ·
-
changelog investigate
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ramnes/notion-sdk-py#408 ·
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
btclib-org/btclib-wallet#267 ·
Maintainers usually reply within 1 day
-
good first issue tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
knnmelprop/YAADO#111 ·