feat(trigger): add plugin trigger workflow support and refactor trigger system

- Add new workflow plugin trigger service for managing plugin-based triggers
- Implement trigger provider encryption utilities for secure credential storage
- Add custom trigger errors module for better error handling
- Refactor trigger provider and manager classes for improved plugin integration
- Update API endpoints to support plugin trigger workflows
- Add database migration for plugin trigger workflow support

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

api/core/trigger/entities/api_entities.py

@@ -43,4 +43,15 @@ class TriggerApiEntity(BaseModel):
     output_schema: Optional[Mapping[str, Any]] = Field(description="The output schema of the trigger")
 
 
+class SubscriptionBuilderApiEntity(BaseModel):
+    id: str = Field(description="The id of the subscription builder")
+    name: str = Field(description="The name of the subscription builder")
+    provider: str = Field(description="The provider id of the subscription builder")
+    endpoint: str = Field(description="The endpoint id of the subscription builder")
+    parameters: Mapping[str, Any] = Field(description="The parameters of the subscription builder")
+    properties: Mapping[str, Any] = Field(description="The properties of the subscription builder")
+    credentials: Mapping[str, str] = Field(description="The credentials of the subscription builder")
+    credential_type: CredentialType = Field(description="The credential type of the subscription builder")
+
+
 __all__ = ["TriggerApiEntity", "TriggerProviderApiEntity", "TriggerProviderSubscriptionApiEntity"]

api/core/trigger/errors.py

@@ -0,0 +1,2 @@
+class TriggerProviderCredentialValidationError(ValueError):
+    pass

api/core/trigger/provider.py

@@ -14,7 +14,6 @@ from core.plugin.entities.plugin_daemon import CredentialType
 from core.plugin.entities.request import (
     TriggerDispatchResponse,
     TriggerInvokeResponse,
-    TriggerValidateProviderCredentialsResponse,
 )
 from core.plugin.impl.trigger import PluginTriggerManager
 from core.trigger.entities.api_entities import TriggerProviderApiEntity
@@ -27,6 +26,7 @@ from core.trigger.entities.entities import (
     TriggerProviderIdentity,
     Unsubscription,
 )
+from core.trigger.errors import TriggerProviderCredentialValidationError
 
 logger = logging.getLogger(__name__)
 
@@ -41,6 +41,7 @@ class PluginTriggerProviderController:
         entity: TriggerProviderEntity,
         plugin_id: str,
         plugin_unique_identifier: str,
+        provider_id: TriggerProviderID,
         tenant_id: str,
     ):
         """
@@ -49,18 +50,20 @@ class PluginTriggerProviderController:
         :param entity: Trigger provider entity
         :param plugin_id: Plugin ID
         :param plugin_unique_identifier: Plugin unique identifier
+        :param provider_id: Provider ID
         :param tenant_id: Tenant ID
         """
         self.entity = entity
         self.tenant_id = tenant_id
         self.plugin_id = plugin_id
+        self.provider_id = provider_id
         self.plugin_unique_identifier = plugin_unique_identifier
 
     def get_provider_id(self) -> TriggerProviderID:
         """
         Get provider ID
         """
-        return TriggerProviderID(f"{self.plugin_id}/{self.entity.identity.name}")
+        return self.provider_id
 
     def to_api_entity(self) -> TriggerProviderApiEntity:
         """
@@ -101,9 +104,7 @@ class PluginTriggerProviderController:
         """
         return self.entity.subscription_schema
 
-    def validate_credentials(
-        self, user_id: str, credentials: Mapping[str, str]
-    ) -> TriggerValidateProviderCredentialsResponse:
+    def validate_credentials(self, user_id: str, credentials: Mapping[str, str]) -> None:
         """
         Validate credentials against schema
 
@@ -113,21 +114,21 @@ class PluginTriggerProviderController:
         # First validate against schema
         for config in self.entity.credentials_schema:
             if config.required and config.name not in credentials:
-                return TriggerValidateProviderCredentialsResponse(
-                    valid=False,
-                    message=f"Missing required credential field: {config.name}",
-                    error=f"Missing required credential field: {config.name}",
-                )
+                raise TriggerProviderCredentialValidationError(f"Missing required credential field: {config.name}")
 
         # Then validate with the plugin daemon
         manager = PluginTriggerManager()
         provider_id = self.get_provider_id()
-        return manager.validate_provider_credentials(
+        response = manager.validate_provider_credentials(
             tenant_id=self.tenant_id,
             user_id=user_id,
             provider=str(provider_id),
             credentials=credentials,
         )
+        if not response:
+            raise TriggerProviderCredentialValidationError(
+                "Invalid credentials",
+            )
 
     def get_supported_credential_types(self) -> list[CredentialType]:
         """
@@ -154,6 +155,8 @@ class PluginTriggerProviderController:
             return self.entity.oauth_schema.credentials_schema.copy() if self.entity.oauth_schema else []
         if credential_type == CredentialType.API_KEY:
             return self.entity.credentials_schema.copy() if self.entity.credentials_schema else []
+        if credential_type == CredentialType.UNAUTHORIZED:
+            return []
         raise ValueError(f"Invalid credential type: {credential_type}")
 
     def get_credential_schema_config(self, credential_type: CredentialType | str) -> list[BasicProviderConfig]:

api/core/trigger/trigger_manager.py

@@ -46,6 +46,7 @@ class TriggerManager:
                     entity=provider.declaration,
                     plugin_id=provider.plugin_id,
                     plugin_unique_identifier=provider.plugin_unique_identifier,
+                    provider_id=TriggerProviderID(provider.provider),
                     tenant_id=tenant_id,
                 )
                 controllers.append(controller)
@@ -75,6 +76,7 @@ class TriggerManager:
                 entity=provider.declaration,
                 plugin_id=provider.plugin_id,
                 plugin_unique_identifier=provider.plugin_unique_identifier,
+                provider_id=provider_id,
                 tenant_id=tenant_id,
             )
         except Exception as e:
@@ -115,26 +117,6 @@ class TriggerManager:
         """
         return cls.get_trigger_provider(tenant_id, provider_id).get_trigger(trigger_name)
 
-    @classmethod
-    def validate_trigger_credentials(
-        cls, tenant_id: str, provider_id: TriggerProviderID, user_id: str, credentials: Mapping[str, str]
-    ) -> tuple[bool, str]:
-        """
-        Validate trigger provider credentials
-
-        :param tenant_id: Tenant ID
-        :param provider_id: Provider ID
-        :param user_id: User ID
-        :param credentials: Credentials to validate
-        :return: Tuple of (is_valid, error_message)
-        """
-        try:
-            provider = cls.get_trigger_provider(tenant_id, provider_id)
-            validation_result = provider.validate_credentials(user_id, credentials)
-            return validation_result.valid, validation_result.message if not validation_result.valid else ""
-        except Exception as e:
-            return False, str(e)
-
     @classmethod
     def invoke_trigger(
         cls,

api/core/trigger/utils/encryption.py

@@ -1,5 +1,7 @@
+from collections.abc import Mapping
 from typing import Union
 
+from core.entities.provider_entities import BasicProviderConfig, ProviderConfig
 from core.helper.provider_cache import TriggerProviderCredentialsCache, TriggerProviderOAuthClientParamsCache
 from core.helper.provider_encryption import ProviderConfigCache, ProviderConfigEncrypter, create_provider_encrypter
 from core.plugin.entities.plugin_daemon import CredentialType
@@ -55,3 +57,24 @@ def create_trigger_provider_oauth_encrypter(
         cache=cache,
     )
     return encrypter, cache
+
+
+def masked_credentials(
+    schemas: list[ProviderConfig],
+    credentials: Mapping[str, str],
+) -> Mapping[str, str]:
+    masked_credentials = {}
+    configs = {x.name: x.to_basic_provider_config() for x in schemas}
+    for key, value in credentials.items():
+        config = configs.get(key)
+        if not config:
+            masked_credentials[key] = value
+            continue
+        if config.type == BasicProviderConfig.Type.SECRET_INPUT:
+            if len(value) <= 4:
+                masked_credentials[key] = "*" * len(value)
+            else:
+                masked_credentials[key] = value[:2] + "*" * (len(value) - 4) + value[-2:]
+        else:
+            masked_credentials[key] = value
+    return masked_credentials

api/core/trigger/utils/endpoint.py

@@ -2,4 +2,4 @@ from configs import dify_config
 
 
 def parse_endpoint_id(endpoint_id: str) -> str:
-    return f"{dify_config.CONSOLE_API_URL}/console/api/trigger/endpoint/{endpoint_id}"
+    return f"{dify_config.CONSOLE_API_URL}/triggers/plugin/{endpoint_id}"