mirror of
https://github.com/langgenius/dify.git
synced 2026-05-26 20:07:46 +08:00
9b25980b09
Replace the single mutable-context Pipeline with a two-phase, condition-driven system dispatched by token type. New architecture: - TokenType(StrEnum) replaces source: str on AuthContext / TokenKind - AuthPipeline: pure prepare→auth step runner; no guard() - PipelineRoute: binds AuthPipeline to an optional required_edition gate - PipelineRouter: single guard() entry point; runs edition/license/token-type pre-gates then dispatches to the registered pipeline for the token type - Cond / When: composable predicates for conditional step dispatch - AuthData: frozen Pydantic model produced by the prepare phase; carries token_id so endpoints don't need to call get_auth_ctx() for identity fields - Edition enum + current_edition(): CE / EE / SAAS discriminator Two pipelines in composition.py: - account_pipeline — OAUTH_ACCOUNT tokens - external_sso_pipeline — OAUTH_EXTERNAL_SSO tokens (EE enforced at route level) All /openapi/v1 endpoints migrated to auth_router.guard(). Old context.py, steps.py, strategies.py, surface_gate.py deleted. WORKSPACE_READ scope added; cached_verdicts renamed to membership_cache.
54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
from collections.abc import Callable
|
|
|
|
from controllers.openapi.auth.data import AuthData, Edition, RequestContext, current_edition
|
|
from libs.oauth_bearer import TokenType
|
|
from services.enterprise.enterprise_service import WebAppAccessMode
|
|
from services.feature_service import FeatureService
|
|
|
|
CondFn = Callable[[RequestContext, AuthData | None], bool]
|
|
|
|
|
|
class Cond:
|
|
def __init__(self, fn: CondFn) -> None:
|
|
self._fn = fn
|
|
|
|
def __call__(self, ctx: RequestContext, data: AuthData | None = None) -> bool:
|
|
return self._fn(ctx, data)
|
|
|
|
def __and__(self, other: Cond) -> Cond:
|
|
return Cond(lambda ctx, data: self(ctx, data) and other(ctx, data))
|
|
|
|
def __or__(self, other: Cond) -> Cond:
|
|
return Cond(lambda ctx, data: self(ctx, data) or other(ctx, data))
|
|
|
|
def __invert__(self) -> Cond:
|
|
return Cond(lambda ctx, data: not self(ctx, data))
|
|
|
|
|
|
def request_cond(fn: Callable[[RequestContext], bool]) -> Cond:
|
|
return Cond(lambda ctx, _: fn(ctx))
|
|
|
|
|
|
def data_cond(fn: Callable[[AuthData], bool]) -> Cond:
|
|
return Cond(lambda _, data: data is not None and fn(data))
|
|
|
|
|
|
def config_cond(fn: Callable[[], bool]) -> Cond:
|
|
return Cond(lambda _, __: fn())
|
|
|
|
|
|
TOKEN_IS_OAUTH_ACCOUNT = request_cond(lambda ctx: ctx.token_type == TokenType.OAUTH_ACCOUNT)
|
|
TOKEN_IS_OAUTH_EXTERNAL_SSO = request_cond(lambda ctx: ctx.token_type == TokenType.OAUTH_EXTERNAL_SSO)
|
|
|
|
PATH_HAS_APP_ID = request_cond(lambda ctx: "app_id" in ctx.path_params)
|
|
|
|
EDITION_CE = config_cond(lambda: current_edition() == Edition.CE)
|
|
EDITION_EE = config_cond(lambda: current_edition() == Edition.EE)
|
|
EDITION_SAAS = config_cond(lambda: current_edition() == Edition.SAAS)
|
|
|
|
WEBAPP_AUTH_ENABLED = config_cond(lambda: FeatureService.get_system_features().webapp_auth.enabled)
|
|
|
|
LOADED_APP_IS_PRIVATE = data_cond(lambda data: data.app_access_mode == WebAppAccessMode.PRIVATE)
|