From 745d67989b6a2e466870521542b1f47a75fff9f9 Mon Sep 17 00:00:00 2001
From: NFish <douxc512@gmail.com>
Date: Mon, 30 Jun 2025 17:34:13 +0800
Subject: [PATCH] fix: check user permission to show 'open in explore' menu
 item at app list popover

---
 web/app/(commonLayout)/apps/AppCard.tsx   | 14 ++++++++++----
 web/app/components/base/popover/index.tsx |  4 +++-
 web/service/access-control.ts             |  3 +++
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/web/app/(commonLayout)/apps/AppCard.tsx b/web/app/(commonLayout)/apps/AppCard.tsx
index 31b9ed87c2..b7c9a2eee4 100644
--- a/web/app/(commonLayout)/apps/AppCard.tsx
+++ b/web/app/(commonLayout)/apps/AppCard.tsx
@@ -36,6 +36,7 @@ import AccessControl from '@/app/components/app/app-access-control'
 import { AccessMode } from '@/models/access-control'
 import { useGlobalPublicStore } from '@/context/global-public-context'
 import { formatTime } from '@/utils/time'
+import { useGetUserCanAccessApp } from '@/service/access-control'
 
 export type AppCardProps = {
   app: App
@@ -190,6 +191,7 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
   }, [onRefresh, mutateApps, setShowAccessControl])
 
   const Operations = (props: HtmlContentProps) => {
+    const { data: userCanAccessApp, isLoading: isGettingUserCanAccessApp } = useGetUserCanAccessApp({ appId: app?.id, enabled: (!!props?.open && systemFeatures.webapp_auth.enabled) })
     const onMouseLeave = async () => {
       props.onClose?.()
     }
@@ -267,10 +269,14 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
             </button>
           </>
         )}
-        <Divider className="my-1" />
-        <button className='mx-1 flex h-8 cursor-pointer items-center gap-2 rounded-lg px-3 hover:bg-state-base-hover' onClick={onClickInstalledApp}>
-          <span className='system-sm-regular text-text-secondary'>{t('app.openInExplore')}</span>
-        </button>
+        {
+          (isGettingUserCanAccessApp || !userCanAccessApp?.result) ? null : <>
+            <Divider className="my-1" />
+            <button className='mx-1 flex h-8 cursor-pointer items-center gap-2 rounded-lg px-3 hover:bg-state-base-hover' onClick={onClickInstalledApp}>
+              <span className='system-sm-regular text-text-secondary'>{t('app.openInExplore')}</span>
+            </button>
+          </>
+        }
         <Divider className="my-1" />
         {
           systemFeatures.webapp_auth.enabled && isCurrentWorkspaceEditor && <>
diff --git a/web/app/components/base/popover/index.tsx b/web/app/components/base/popover/index.tsx
index 2a831e0c24..0e7c384564 100644
--- a/web/app/components/base/popover/index.tsx
+++ b/web/app/components/base/popover/index.tsx
@@ -3,6 +3,7 @@ import { Fragment, cloneElement, useRef } from 'react'
 import cn from '@/utils/classnames'
 
 export type HtmlContentProps = {
+  open?: boolean
   onClose?: () => void
   onClick?: () => void
 }
@@ -100,7 +101,8 @@ export default function CustomPopover({
                       }
                     >
                       {cloneElement(htmlContent as React.ReactElement, {
-                        onClose: () => onMouseLeave(open),
+                        open,
+                        onClose: close,
                         ...(manualClose
                           ? {
                             onClick: close,
diff --git a/web/service/access-control.ts b/web/service/access-control.ts
index 865909d2f9..36999bf8f3 100644
--- a/web/service/access-control.ts
+++ b/web/service/access-control.ts
@@ -86,5 +86,8 @@ export const useGetUserCanAccessApp = ({ appId, isInstalledApp = true, enabled }
     enabled: !!appId && enabled,
     staleTime: 0,
     gcTime: 0,
+    initialData: {
+      result: !enabled,
+    },
   })
 }