From 0dedc45dc75a74b91666638466097eff96fa7f8c Mon Sep 17 00:00:00 2001
From: leaderwm <2733485211@qq.com>
Date: Thu, 3 Sep 2026 04:04:31 +0800
Subject: [PATCH] =?UTF-8?q?fix(qa):=20WS=20=E9=97=AE=E7=AD=94=E8=B7=AF?=
 =?UTF-8?q?=E5=BE=84=E8=A1=A5=E4=BC=A0=20user=5Fdept/user=5Frole=EF=BC=8C?=
 =?UTF-8?q?=E5=AF=B9=E9=BD=90=20SSE=EF=BC=88=E8=A1=A5=E5=AE=8C=202eb0e46?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

2eb0e46 只给 SSE 与 system/agent/run 补了用户上下文，WS 漏传导致：
- agent 工具角色门禁（create_ticket/submit_ticket/draft_ticket）在 WS agent 模式因 ctx.role 为空恒被拒
- user_dept/user_role 为 None 时 _acl_ok 直接放行，WS 路径文档级 ACL 不生效
---
 backend/app/routers/qa.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/backend/app/routers/qa.py b/backend/app/routers/qa.py
index c1a9934..ae537a6 100644
--- a/backend/app/routers/qa.py
+++ b/backend/app/routers/qa.py
@@ -676,6 +676,8 @@ async def answer_ws(ws: WebSocket):
                 db, query, req.get("modelType"),
                 conversation_id=req.get("conversationId"),
                 username=user.username, tenant=user.tenant_id,
+                # 与 SSE 端点对齐：agent 工具角色门禁与文档级 dept/role ACL 依赖这两个字段
+                user_dept=user.dept, user_role=user.role,
                 agent_mode=bool(req.get("agentMode")),
                 memory_read=bool(req.get("memoryRead")),
                 memory_write=bool(req.get("memoryWrite")),