bc68e02711
feat(openapi): distinguish expired OAuth bearer from invalid token
...
Previously an expired OAuth bearer and an unknown/invalid one both
surfaced as an indistinguishable generic 401 (and an invalid token
actually leaked a 500), so a client could not tell "session expired,
re-authenticate" apart from "never authenticated."
The resolver now raises a distinct TokenExpiredError for expired DB
rows and records a separate `expired` negative-cache marker, so a
retry within the negative-cache TTL still reports expiry instead of
collapsing into a generic miss. The auth pipeline maps the two domain
errors to unified OpenApiError responses: SessionExpired (code
`token_expired`) and InvalidBearer (code `unauthorized`), both 401.
This also fixes the latent 500 on invalid bearers.
The `token_expired` code is synced through the contract codegen into
the generated types/zod, and the difyctl error mapper branches the
401 on it. The CLI `expired_token` taxonomy member (RFC 8628
device-flow code expiry) is merged into `token_expired`; the RFC 8628
wire value is unchanged.
Closes WTA-1062
2026-06-28 21:45:13 -07:00
fa6f4b0ea5
refactor(api): enforce enums over string literals on openapi surface ( #38009 )
2026-06-26 05:48:21 +00:00
1c5e1280cb
feat(webapp): display app description on chat and text-generation app screens ( #37345 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-26 02:03:16 +00:00
0035d90e36
fix(api): require edit access for trace config changes ( #37973 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-26 00:51:39 +00:00
2e9c0a3c7a
refactor(api): migrate response contract tooling to BaseModel ( #37950 )
2026-06-26 00:11:04 +00:00
40119fef44
feat: update monitor permission key and plugin permission key ( #37937 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-25 09:41:38 +00:00
31a50a3b20
fix: eagerly validate conversation before generator to prevent hanging ( #37224 )
...
Co-authored-by: yunlu.wen <yunlu.wen@dify.ai >
2026-06-25 02:57:33 +00:00
d87764b0f8
feat: filter dataset operator and add miss permission key ( #37867 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-24 09:56:28 +00:00
2112115962
chore: make AccountService.load_user use passed session ( #37764 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-24 07:29:12 +00:00
67a5eacf2d
refactor: pass session as parameter in knowledge_retrieval_inner_service and agent_app_feature_service ( #37639 )
...
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
2026-06-24 05:34:41 +00:00
2cde7e4a94
fix: resolve DetachedInstanceError via session management refactoring ( #37847 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-24 05:33:12 +00:00
31c08faded
refactor: inject session into audio TTS ( #37849 )
2026-06-24 04:49:48 +00:00
d0b2239c60
refactor: accept db.session explicitly in ApiKeyAuthService ( #37832 )
...
Co-authored-by: kunalj1-arch <kunal.j1@turing.com >
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-24 01:20:47 +00:00
5b453069d1
refactor: for db.session feedback service.export feedbacks ( #37763 )
...
Co-authored-by: kunalj1-arch <kunal.j1@turing.com >
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
2026-06-23 14:01:40 +00:00
26b0ff2a01
feat(agent): copy roster agent into workflow inline agent ( #37813 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 12:28:29 +00:00
725e4da29d
feat(chatflow): stream LLM reasoning to a live thinking panel ( #37460 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 09:49:01 +00:00
04d226384f
fix(agent): agent composer publish validation ( #37803 )
2026-06-23 08:48:40 +00:00
a554891bbd
fix: snippet history detail includes input fields ( #37797 )
...
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 08:08:12 +00:00
f4fdbeba76
feat(agent-v2): sync nightly updates to main (2026-06-22) ( #37651 )
...
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: Joel <iamjoel007@gmail.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-06-23 08:05:16 +00:00
a3309cd857
fix: support agent duplicate role and skill file preview ( #37788 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 06:35:26 +00:00
7fc8eed716
refactor: pass session into hit testing service ( #37785 )
2026-06-23 06:21:38 +00:00
b3e5f29421
fix(app): derive get-app --mode whitelist from listable app types ( #37761 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 04:40:05 +00:00
26639e0923
feat: add agent debug conversation refresh API ( #37784 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 04:34:13 +00:00
ef54229d6f
chore: add ENTERPRISE_RBAC_API_URL check and update permission key ( #37777 )
2026-06-23 03:26:06 +00:00
b67a04aa22
fix: isolate agent debug conversations by account ( #37766 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-23 02:04:23 +00:00
7d2f25df8e
feat(agent): add roster service api access ( #37759 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 12:37:27 +00:00
82d08851be
feat: guard openapi with rbac ( #37752 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-22 09:35:33 +00:00
4065f63dce
fix(agent): add stable debug conversation ( #37744 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 09:21:09 +00:00
084f122814
refactor(openapi/cli): split app usage-face from studio-app build-face ( #37641 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 07:46:59 +00:00
c83dcce1f7
chore: remove duplicate code ( #37724 )
2026-06-22 06:57:56 +00:00
c1ab6226a2
fix(agent): support restoring roster versions ( #37734 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 06:31:50 +00:00
908c148667
fix(hitl): stop confusing 404 when resuming forms via CLI ( #37556 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 06:11:27 +00:00
34c1bf1062
feat(agent): add skill inspect API ( #37726 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-22 05:22:10 +00:00
d5cdb2e6f1
chore: clean some isinstance ( #37602 )
...
Co-authored-by: WH-2099 <wh2099@pm.me >
2026-06-22 03:51:21 +00:00
9b4dd9d4e8
refactor: accept db.session explicitly in APIBasedExtensionService ( #37693 )
2026-06-21 00:53:36 +00:00
75d50455d6
refactor: accept db.session explicitly in FeedbackService ( #37694 )
2026-06-21 00:52:36 +00:00
dcff1870d5
refactor: accept db.session explicitly in SavedMessageService ( #37682 )
2026-06-20 12:35:06 +00:00
a7b53b33ee
chore: move one db.session ( #37656 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-19 19:52:59 +00:00
8052c93133
refactor(api): type end user records with enum ( #36945 )
...
Co-authored-by: WH-2099 <wh2099@pm.me >
2026-06-19 01:02:01 +00:00
33edf97f81
feat: RBAC ( #37107 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: fatelei <fatelei@gmail.com >
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: 盐粒 Yanli <yanli@dify.ai >
Co-authored-by: Charles Yao <chongbinyao33@gmail.com >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
Co-authored-by: yunlu.wen <yunlu.wen@dify.ai >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
Co-authored-by: Jingyi <jingyi.qi@dify.ai >
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: Joel <iamjoel007@gmail.com >
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xiyuan Chen <52963600+GareArc@users.noreply.github.com >
Co-authored-by: gigglewang <gigglewang@dify.ai >
Co-authored-by: chariri <w@chariri.moe >
Co-authored-by: Evan <2869018789@qq.com >
Co-authored-by: zyssyz123 <916125788@qq.com >
2026-06-18 16:35:29 +00:00
0df30dd269
fix(agent): resolve roster file downloads versions and log filters ( #37626 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-18 12:06:27 +00:00
933df2f490
fix(agent): decouple roster from app quota ( #37625 )
2026-06-18 08:48:18 +00:00
c52eafe2ca
docs: enrich generated service API descriptions ( #37615 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-18 08:43:39 +00:00
26b0137c83
chore: improve invite member flow ( #37479 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jingyi <jingyi.qi@dify.ai >
2026-06-18 06:30:01 +00:00
3f2d22ec0f
feat(agent-v2): sync nightly updates to main ( #37599 )
...
Co-authored-by: Jingyi-Dify <jingyi.qi@dify.ai >
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: Joel <iamjoel007@gmail.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: Bond Zhu <783504079@qq.com >
Co-authored-by: Yansong Zhang <916125788@qq.com >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-06-18 05:03:34 +00:00
4304044905
chore: example of make db.session pass from parameter. ( #37561 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-18 02:16:09 +00:00
43192036fa
fix: require Agent App role ( #37601 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-18 01:23:45 +00:00
af99414fc1
chore: port isinstance to match case ( #37271 )
...
Co-authored-by: WH-2099 <wh2099@pm.me >
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-18 00:18:03 +00:00
19838972dc
fix: add service api openapi descriptions ( #37595 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-17 16:02:43 +00:00
59f8f2e7b3
fix(agent): align roster observability logs contract ( #37578 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-06-17 14:34:14 +00:00
