Only assistant created by owner can be deleted

apps/app/src/features/openai/server/routes/delete-ai-assistant.ts

@@ -35,10 +35,11 @@ export const deleteAiAssistantsFactory: DeleteAiAssistantsFactory = (crowi) => {
     accessTokenParser, loginRequiredStrictly, certifyAiService, validator, apiV3FormValidator,
     async(req: Req, res: ApiV3Response) => {
       const { id } = req.params;
+      const { user } = req;
 
       try {
         const openaiService = getOpenaiService();
-        const deletedAiAssistant = await openaiService?.deleteAiAssistant(id);
+        const deletedAiAssistant = await openaiService?.deleteAiAssistant(user._id, id);
         return res.apiv3({ deletedAiAssistant });
       }
       catch (err) {

apps/app/src/features/openai/server/services/openai.ts

@@ -69,7 +69,7 @@ export interface IOpenaiService {
   // rebuildVectorStore(page: HydratedDocument<PageDocument>): Promise<void>;
   createAiAssistant(data: Omit<AiAssistant, 'vectorStore'>): Promise<AiAssistantDocument>;
   getAccessibleAiAssistants(user: IUserHasId): Promise<AccessibleAiAssistants>
-  deleteAiAssistant(aiAssistantId: string): Promise<AiAssistantDocument>
+  deleteAiAssistant(ownerId: string, aiAssistantId: string): Promise<AiAssistantDocument>
 }
 class OpenaiService implements IOpenaiService {
 
@@ -605,8 +605,8 @@ class OpenaiService implements IOpenaiService {
     };
   }
 
-  async deleteAiAssistant(aiAssistantId: string): Promise<AiAssistantDocument> {
-    const aiAssistant = await AiAssistantModel.findOne({ _id: aiAssistantId });
+  async deleteAiAssistant(ownerId: string, aiAssistantId: string): Promise<AiAssistantDocument> {
+    const aiAssistant = await AiAssistantModel.findOne({ owner: ownerId, _id: aiAssistantId });
 
     if (aiAssistant == null) {
       throw new Error('AiAssistant document is not exists');