From 93fa277bdd87b830993bd2d30daba221d6d40015 Mon Sep 17 00:00:00 2001
From: gitlawr <lawrleegle@gmail.com>
Date: Mon, 11 May 2026 17:19:32 +0800
Subject: [PATCH] fix: Access Control Modal user picker uses /user-directory

The form populated its candidate list via the admin-only
`GET /v2/users`, so opening Route Access Settings as a non-admin
caller (e.g. an org owner managing their own route in the
enterprise plugin) returned 403. Add a `queryUserDirectory` client
wrapper around the slim `/v2/user-directory` endpoint (gated to
platform admin OR org owner) and switch `getUserList` over. Response
shape is the same so the rest of the form is unchanged.
---
 .../components/access-control-modal/form.tsx         |  4 ++--
 src/pages/users/apis/index.ts                        | 12 ++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/pages/llmodels/components/access-control-modal/form.tsx b/src/pages/llmodels/components/access-control-modal/form.tsx
index a585c1a4..85ee9a2e 100644
--- a/src/pages/llmodels/components/access-control-modal/form.tsx
+++ b/src/pages/llmodels/components/access-control-modal/form.tsx
@@ -1,7 +1,7 @@
 import { PageAction } from '@/config';
 import { PageActionType } from '@/config/types';
 import { RouteItem } from '@/pages/model-routes/config/types';
-import { queryUsersList } from '@/pages/users/apis';
+import { queryUserDirectory } from '@/pages/users/apis';
 import { DownOutlined, QuestionCircleOutlined } from '@ant-design/icons';
 import {
   AlertBlockInfo,
@@ -112,7 +112,7 @@ const AccessControlForm = forwardRef((props: AccessControlFormProps, ref) => {
 
   const getUserList = async (query: Global.SearchParams) => {
     try {
-      const res = await queryUsersList(query);
+      const res = await queryUserDirectory(query);
       const options = res.items.map((item) => ({
         title: item.username,
         key: item.id,
diff --git a/src/pages/users/apis/index.ts b/src/pages/users/apis/index.ts
index 65030d05..cb5f80c3 100644
--- a/src/pages/users/apis/index.ts
+++ b/src/pages/users/apis/index.ts
@@ -2,6 +2,7 @@ import { request } from '@umijs/max';
 import { FormData, ListItem } from '../config/types';
 
 export const USERS_API = '/users';
+export const USER_DIRECTORY_API = '/user-directory';
 
 export async function queryUsersList(params: Global.SearchParams) {
   return request<Global.PageResponse<ListItem>>(`${USERS_API}`, {
@@ -10,6 +11,17 @@ export async function queryUsersList(params: Global.SearchParams) {
   });
 }
 
+// Slim user-list endpoint open to platform admin OR an org owner.
+// Use this from picker UIs (Route Access Settings, Add Member, ...)
+// where the caller may not be an admin; the admin-only `queryUsersList`
+// would 403 for org owners.
+export async function queryUserDirectory(params: Global.SearchParams) {
+  return request<Global.PageResponse<ListItem>>(USER_DIRECTORY_API, {
+    method: 'GET',
+    params
+  });
+}
+
 export async function createUser(params: { data: FormData }) {
   return request(`${USERS_API}`, {
     method: 'POST',