[Lycorius03]

Knowledge-base endpoints require the kb scope, but API keys could neither be granted that scope nor select it in the dashboard. Register kb, add the localized scope option, and use the existing scope dependency so all 16 knowledge-base operations expose their runtime OpenAPI permissions correctly. Regenerate the public specification and English/Chinese scope references.

The change is limited to knowledge-base access. Existing explicitly scoped keys keep their stored permissions; keys must include kb to access these endpoints. Administrative scope behavior is unchanged.

Related work: #10801 already addresses the backend registry. This patch also covers the dashboard picker, runtime OpenAPI metadata, public documentation, and request-level regressions.

Validation:

• Full Windows suite: 4,862 passed, 87 skipped (369.54 seconds). The first isolated run exposed a plugin import-path issue also reproduced on clean HEAD; rerunning with the temporary runtime root on the test process import path passed without production changes. Skipped tests remain unverified.
• Reproduced the original failure: creating a kb-scoped API key returned HTTP 400 before the fix.
• 224 focused tests passed across API-key access, dashboard routes, scope documentation, and knowledge-base service contracts.
• Exercised all 16 knowledge-base routes under seven authentication/scope modes, including rejection before business operations.
• Persisted SQLite key tests cover creation, three authorization headers, missing/invalid credentials, unrelated scope isolation, revocation, and expiration.
• Four locale browser checks passed against the production bundle, verifying the localized option and submitted scopes: ["kb"] payload with mocked API responses.
• Dashboard typecheck, i18n check, production build, and API client regeneration passed. The regenerated client has no semantic changes.
• Repository-wide Ruff formatting and lint checks passed with the pinned version.

Closes #10322.

Summary by Sourcery

Restore API-key access to knowledge-base endpoints by registering and exposing the kb scope across authorization, dashboard, OpenAPI metadata, and documentation.

New Features:

• Add the kb API-key scope for knowledge-base access and expose it in the dashboard scope picker.
• Publish knowledge-base scope metadata for all 16 operations in the OpenAPI specification and localized documentation.

Bug Fixes:

• Restore scoped API-key authorization for knowledge-base endpoints while preserving existing explicit permissions and administrative isolation.

Enhancements:

• Align knowledge-base routes with the standard scope dependency and add localized scope descriptions.

Documentation:

• Document the kb permission and its access semantics in English and Chinese developer references.

Tests:

• Add coverage for knowledge-base route authorization, API-key lifecycle behavior, scope isolation, and OpenAPI/dashboard scope consistency.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-27T09:44:46.798720Z We couldn’t complete this review. Comment @codex review to try again.	166b0ee	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. An API key explicitly granted kb can now read, import, modify, and delete knowledge bases and their documents or chunks. Reverting removes that access for future requests, but it cannot undo data already exposed or deleted.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[Lycorius03]

@RC-CHN This PR is ready for review. Could you please review the knowledge-base scope fix, or route it to the appropriate maintainer?

The current head is 166b0eea322fd4b60157c7c60dead50d99840a8c. Validation passed on Windows: 4,862 tests passed and 87 were skipped; all 224 focused regression tests passed. Dashboard typecheck, localization checks, production build, and four-locale browser checks also passed. The PR description records the test coverage and limitations, and references the related work in #10801.

I cannot add a formal reviewer request with my repository permissions, so I am requesting review here.