PR #3347 - Default User File Upload

[felixfaassen]

Pull Request Type

• ✨ feat
• 🐛 fix
• ♻️ refactor
• 💄 style
• 🔨 chore
• 📝 docs

Relevant Issues

#3347

resolves #3347

What is in this change?

This Pull Request implements a feature that allows administrators to grant document upload permissions to regular users in multi-user mode, with the ability to set upload quotas. Previously, only admin
and manager roles could upload documents to workspaces.

Feature Overview:

1. Permission-Based Document Uploads:
   - Regular users can now be granted document upload permissions by administrators
   - A quota system limits how many documents a regular user can upload
2. Database Changes:
   - Added canUploadDocuments (boolean) field to User model
   - Added documentUploadLimit (integer) field to User model
   - Added document ownership tracking (uploadedBy field in workspace_documents)
3. Middleware and Checks:
   - New canUploadDocuments middleware to enforce permissions
   - Permission check considers both permission flag and upload quota
   - All document upload endpoints now use this middleware
4. UI Components:
   - Added UI in Admin panel for enabling/disabling document upload permissions
   - Added UI for setting document upload quotas
   - Conditional rendering for upload buttons based on permissions
5. Security Considerations:
   - Regular users can only upload to workspaces they have access to
   - Quotas prevent excessive uploads
   - All uploads go through the same content validation process

Technical Implementation:

1. Schema Changes:
   - Modified Prisma schema to add new user fields
   - Created relation between users and documents
2. Middleware:
   - Implemented canUploadDocuments middleware that checks both permission flag and remaining quota
3. Endpoint Updates:
   - Updated all document upload endpoints to use the new middleware:
   • /workspace/:slug/upload-and-embed
   • /workspace/:slug/upload
   • /workspace/:slug/upload-link
   • /workspace/:slug/update-embeddings
   • /workspace/:slug/remove-and-unembed
4. Documentation:
   - Added comprehensive documentation for the feature in USER_PERMISSIONS.md
   - Updated README to mention the new granular permissions system

This PR addresses issue #3347 by expanding AnythingLLM's permission system to give administrators more control over who can upload documents while maintaining security and preventing resource abuse
through the quota system.

Additional Information

This PR introduces a significant enhancement to AnythingLLM's multi-user permission system by allowing finer-grained control over document uploads. Some additional context worth noting:

1. User Experience Benefits:
   - Organizations can now delegate document upload capabilities to trusted regular users without needing to grant them full manager privileges
   - This creates a more flexible workflow where subject matter experts can contribute documents while maintaining appropriate access control
2. Implementation Strategy:
   - We chose to extend the existing permission system rather than creating a new role type
   - This approach preserves backward compatibility and minimizes changes to the existing role system
   - The implementation builds on the established middleware pattern already used throughout the application
3. Performance Considerations:
   - The document count per user is tracked efficiently to maintain performance
   - Permission checks only cause minimal overhead during document upload operations
4. Future Extension Possibilities:
   - This permission framework could serve as a model for other granular permissions in the future
   - The quota system pattern could be adapted for other resource limitations (e.g., API usage, workspace creation)
5. Testing Notes:
   - Tested extensively in Docker environment with multi-user mode enabled
   - Verified that all document upload endpoints correctly respect the new permission system
   - Confirmed UI elements appear/disappear appropriately based on permissions
6. Design Decisions:
   - We deliberately chose to make document upload permissions administrator-controlled only
   - The decision to track document ownership allows for potential future features (such as user-specific document management)
   - Regular users are shown upload UI elements only when they have permission, providing a cleaner experience

This enhancement balances security with flexibility, giving administrators more control over how users interact with the system while maintaining AnythingLLM's robust permission model.

Developer Validations

• I ran yarn lint from the root of the repo & committed changes
• Relevant documentation has been updated
• I have tested my code functionality
• Docker build succeeds locally

[felixfaassen]

See #3347 for context and additional information