update: filter by owner / visibility

backend/src/backend/resources.py

@@ -63,9 +63,13 @@ def resource_payload(
 
 
 def can_view(resource: DataResources, context: RequestContext) -> bool:
+    # 2026-08-11: 临时取消"用户间目录互相不可见"约束
+    # 同一 workspace 内的成员现在可以查看彼此的 private 资源。
+    # 还原: 取消下方注释,恢复 owner_user_id 检查。
     return (
-        resource.owner_user_id == context.user.user_id
+        # resource.owner_user_id == context.user.user_id
-        or resource.visibility in {"workspace", "public"}
+        # or
+        resource.visibility in {"workspace", "public"}
         or context.is_admin
     )
 
@@ -215,13 +219,16 @@ async def list_resources(
         )
         .order_by(DataResources.updated_at.desc())
     )
-    if not context.is_admin:
+    # 2026-08-11: 临时取消"用户间目录互相不可见"约束
-        statement = statement.where(
+    # 列表接口现在返回 workspace 内全部 active 资源(不再按 owner / visibility 过滤)。
-            or_(
+    # 还原: 删除下面这段注释,恢复原来的 if not context.is_admin: ... 块。
-                DataResources.owner_user_id == context.user.user_id,
+    # if not context.is_admin:
-                DataResources.visibility.in_(["workspace", "public"]),
+    #     statement = statement.where(
-            )
+    #         or_(
-        )
+    #             DataResources.owner_user_id == context.user.user_id,
+    #             DataResources.visibility.in_(["workspace", "public"]),
+    #         )
+    #     )
     if visibility:
         if visibility not in {"private", "workspace", "public"}:
             raise HTTPException(