Superuser to delete any document

SciPhi-AI · Dec 21, 2024 · 4d5c922 · 4d5c922
1 parent b66a0eb
commit 4d5c922
Show file tree

Hide file tree

Showing 3 changed files with 54 additions and 7 deletions.
diff --git a/js/sdk/__tests__/DocumentsAndCollectionsIntegrationUser.test.ts b/js/sdk/__tests__/DocumentsAndCollectionsIntegrationUser.test.ts
@@ -17,6 +17,8 @@ describe("r2rClient V3 System Integration Tests User", () => {
   let user2Id: string;
   let user1DocumentId: string;
   let user2DocumentId: string;
+  let user1Document2Id: string;
+  let user2Document2Id: string;
   let user1CollectionId: string;
   let user2CollectionId: string;
 
@@ -146,6 +148,30 @@ describe("r2rClient V3 System Integration Tests User", () => {
     expect(response.results.id).toBe(user2DocumentId);
   });
 
+  test("Create document as user 1 from raw text", async () => {
+    const response = await user1Client.documents.create({
+      raw_text: "Hello, world!",
+      metadata: { title: "hello.txt" },
+    });
+
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+
+    expect(response.results.document_id).toBeDefined();
+    user1Document2Id = response.results.document_id;
+  }, 15000);
+
+  test("Create document as user 2 from raw text", async () => {
+    const response = await user2Client.documents.create({
+      raw_text: "Hello, world!",
+      metadata: { title: "hello.txt" },
+    });
+
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+
+    expect(response.results.document_id).toBeDefined();
+    user2Document2Id = response.results.document_id;
+  }, 15000);
+
   test("List documents with no parameters as user 1", async () => {
     const response = await user1Client.documents.list();
 
@@ -187,9 +213,29 @@ describe("r2rClient V3 System Integration Tests User", () => {
   test("User 1 should not be able to list user 2's document chunks", async () => {
     await expect(
       user1Client.documents.listChunks({ id: user2DocumentId }),
+    ).rejects.toThrow(/Status 404/);
+  });
+
+  test("User 1 should not be able to delete user 2's document", async () => {
+    await expect(
+      user1Client.documents.delete({ id: user2Document2Id }),
+    ).rejects.toThrow(/Status 404/);
+  });
+
+  test("User 2 should not be able to delete user 1's document", async () => {
+    await expect(
+      user2Client.documents.delete({ id: user1Document2Id }),
     ).rejects.toThrow(/Status 403/);
   });
 
+  test("A superuser should be able to delete any document", async () => {
+    const response = await client.documents.delete({ id: user1Document2Id });
+    expect(response.results).toBeDefined();
+
+    const response2 = await client.documents.delete({ id: user2Document2Id });
+    expect(response2.results).toBeDefined();
+  });
+
   test("Delete document as user 1", async () => {
     const response = await user1Client.documents.delete({
       id: user1DocumentId,

diff --git a/js/sdk/__tests__/GraphsIntegrationSuperUser.test.ts b/js/sdk/__tests__/GraphsIntegrationSuperUser.test.ts
@@ -151,7 +151,7 @@ describe("r2rClient V3 Graphs Integration Tests", () => {
     await new Promise((resolve) => setTimeout(resolve, 15000));
 
     expect(response.results).toBeDefined();
-  }, 45000);
+  }, 60000);
 
   test("Check that there are communities in the graph", async () => {
     const response = await client.graphs.listCommunities({

diff --git a/py/core/main/api/v3/documents_router.py b/py/core/main/api/v3/documents_router.py
@@ -1162,12 +1162,13 @@ async def delete_document_by_id(
 
             NOTE - Deletions do not yet impact the knowledge graph or other derived data. This feature is planned for a future release.
             """
-            filters = {
-                "$and": [
-                    {"owner_id": {"$eq": str(auth_user.id)}},
-                    {"document_id": {"$eq": str(id)}},
-                ]
-            }
+
+            filters = {"document_id": {"$eq": str(id)}}
+            if not auth_user.is_superuser:
+                filters = {
+                    "$and": [{"owner_id": {"$eq": str(auth_user.id)}}, filters]
+                }
+
             await self.services.management.delete_documents_and_chunks_by_filter(
                 filters=filters
             )