diff --git a/frontend/src/components/search/ai-search.js b/frontend/src/components/search/ai-search.js
index a36a80a2f7..4b78af022a 100644
--- a/frontend/src/components/search/ai-search.js
+++ b/frontend/src/components/search/ai-search.js
@@ -344,6 +344,7 @@ export default class AISearch extends Component {
       items[i]['repo_id'] = data[i].repo_id;
       items[i]['repo_name'] = data[i].repo_name;
       items[i]['is_dir'] = data[i].is_dir;
+      items[i]['content'] = data[i].content;
       items[i]['link_content'] = decodeURI(data[i].fullpath).substring(1);
     }
     return items;
diff --git a/seahub/ai/apis.py b/seahub/ai/apis.py
index 1bf2139c8a..cb9bbb6748 100644
--- a/seahub/ai/apis.py
+++ b/seahub/ai/apis.py
@@ -20,6 +20,7 @@ from seahub.ai.utils import create_library_sdoc_index, search, update_library_sd
     get_file_download_token, get_search_repos, RELATED_REPOS_PREFIX, RELATED_REPOS_CACHE_TIMEOUT, SEARCH_REPOS_LIMIT, \
     format_repos
 from seahub.utils import is_org_context, normalize_cache_key
+from seahub.views import check_folder_permission
 
 from seaserv import seafile_api
 
@@ -104,6 +105,11 @@ class Search(APIView):
                 error_msg = 'Library %s not found.' % search_repo
                 return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
 
+            # permission check
+            if not check_folder_permission(request, search_repo, '/'):
+                error_msg = 'Permission denied.'
+                return api_error(status.HTTP_403_FORBIDDEN, error_msg)
+
             repos = [(repo.id, repo.origin_repo_id, repo.origin_path, repo.name)]
             is_all_repo = False
 
@@ -175,6 +181,11 @@ class QuestionAnsweringSearchInLibrary(APIView):
             error_msg = 'Library %s not found.' % repo_id
             return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
 
+        # permission check
+        if not check_folder_permission(request, repo_id, '/'):
+            error_msg = 'Permission denied.'
+            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
+
         repo = (repo.id, repo.origin_repo_id, repo.origin_path, repo.name)
 
         params = {