What the data for this category looks like
The data sources for this category include Git repositories, CI pipelines, static scanning reports, and defect tracking repositories. Data updates trigger either real-time synchronization on each code commit, or full batch daily updates. Core documents are delivered via merge requests, including changed file lists, commit hashes, review comment threads, and branch association information. Supporting documents include code review comments, commit records, and branch strategy explanations. Fields cover review status, change impact scope, and approval node information. Common data units are items (for changed files), characters (for review comments), and times (for commit records).
Constraints on Permission and Data Isolation
The data sources for this category are scattered, and include sensitive content such as code changes and review details. Permission isolation must cover access boundaries across multiple data sources including Git repositories and CI pipelines. The high update frequency means permission configurations need to support short-cycle synchronization. This prevents unauthorized access caused by unsynchronized permissions after new commits are pushed. Documents such as merge requests and review comments are divided into access scopes by team and role. Access to unmerged sensitive code changes by unauthorized personnel must be restricted. Isolation of branch strategies and defect repository data between different R&D teams is also required to prevent cross-team information leaks.
Configuration Settings
The following configurations apply to FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
teamId | Exclusive ID bound to the corresponding R&D team | Bind code review data to the team ID to isolate cross-team code access permissions |
tmbId | Team member ID assigned to review members | Precise control over merge request view and approval permissions via member IDs |
| API call permission validity period | 7–30 days | Balance security and daily usability, avoid frequent credential updates |
| Branch isolation scope | Restricted to the current team’s development and pre-release branches | Prevent unmerged sensitive code from being viewed by unauthorized teams |
| Team member synchronization cycle | 5–15 minutes | Adapt to the high-frequency update rhythm of code commits, synchronize permission changes in a timely manner |
| Static scanning report access permission | Only open to team technical leads | Restrict access to sensitive scanning results to prevent information leaks |
Three Common Configuration Mistakes
- A 403 Forbidden error appears when calling FastGPT code review-related APIs. The request does not pass the correct
teamIdparameter. The platform cannot identify the caller’s authorized team. - Unauthorized team members can view merge requests and review data from other teams. The
teamIdbinding configuration is incorrect. Review data from multiple independent teams is associated with the same team ID. - Deleted team members can still access the team’s code review data. The team member synchronization cycle is set to over 20 minutes. Permission changes do not synchronize and take effect promptly.
How to Verify Correct Configuration
- Access the FastGPT v4.17.0 team management page. Confirm the
teamIdmatches the configuration of the associated Git repository. - Call the team-bound code review API with the correct
tmbId. Verify the returned data only contains the current team’s merge requests and review content. - Delete a test team member. Wait for the synchronization cycle to conclude. Confirm the member can no longer access the team’s code review data.
- Use an unauthorized team’s API key to call the API. Confirm a 403 Forbidden error is returned.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.