fix: 只读用户权限设置

backend/src/main/java/io/metersphere/api/controller/ApiDefinitionController.java

@@ -39,26 +39,31 @@ public class ApiDefinitionController {
     }
 
     @PostMapping(value = "/create", consumes = {"multipart/form-data"})
+    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
     public void create(@RequestPart("request") SaveApiDefinitionRequest request, @RequestPart(value = "files") List<MultipartFile> bodyFiles) {
         apiDefinitionService.create(request, bodyFiles);
     }
 
     @PostMapping(value = "/update", consumes = {"multipart/form-data"})
+    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
     public void update(@RequestPart("request") SaveApiDefinitionRequest request, @RequestPart(value = "files") List<MultipartFile> bodyFiles) {
         apiDefinitionService.update(request, bodyFiles);
     }
 
     @GetMapping("/delete/{id}")
+    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
     public void delete(@PathVariable String id) {
         apiDefinitionService.delete(id);
     }
 
     @PostMapping("/deleteBatch")
+    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
     public void deleteBatch(@RequestBody List<String> ids) {
         apiDefinitionService.deleteBatch(ids);
     }
 
     @PostMapping("/removeToGc")
+    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
     public void removeToGc(@RequestBody List<String> ids) {
         apiDefinitionService.removeToGc(ids);
     }

backend/src/main/java/io/metersphere/xpack

@@ -1 +1 @@
-Subproject commit bb494fc68a2367359c9048fa7250c7618de4afb6
+Subproject commit 9f4a9bbf46fc1333dbcccea21f83e27e3ec10b1f

frontend/src/business/components/xpack

@@ -1 +1 @@
-Subproject commit a22a3005d9bd254793fcf634d72539cbdf31be3a
+Subproject commit 010ad7a5f072a5e9d368c756a2473bbd20781433