mirror of
https://github.com/langgenius/dify.git
synced 2026-05-19 00:16:37 +08:00
e0f4e98a2f
- docker-compose.yaml: revert api/web from build: back to image tags (1.14.1); fix api_websocket/worker/worker_beat downgraded to 1.14.0 - Remove verbose internal design comments from openapi controllers - web/next.config.ts: trim anti-framing comment to one line - cli/tsconfig.json: drop lib:ES2015 override (broke Error.cause typing) - eslint.config.mjs: ignore cli/context/** and cli/docs/** (local caches) - pnpm-lock.yaml: regenerate after fresh install
47 lines
1.3 KiB
Python
47 lines
1.3 KiB
Python
"""`OAUTH_BEARER_PIPELINE` — the auth scheme for openapi `/run` endpoints.
|
|
|
|
Endpoints attach via `@OAUTH_BEARER_PIPELINE.guard(scope=…)`. No alternative
|
|
paths. Read endpoints (`/apps`, `/info`, `/parameters`, `/describe`) skip
|
|
the pipeline and use `validate_bearer + require_scope + require_workspace_member`
|
|
inline — they don't need `AppAuthzCheck`/`CallerMount`.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from controllers.openapi.auth.pipeline import Pipeline
|
|
from controllers.openapi.auth.steps import (
|
|
AppAuthzCheck,
|
|
AppResolver,
|
|
BearerCheck,
|
|
CallerMount,
|
|
ScopeCheck,
|
|
SurfaceCheck,
|
|
WorkspaceMembershipCheck,
|
|
)
|
|
from controllers.openapi.auth.strategies import (
|
|
AccountMounter,
|
|
AclStrategy,
|
|
AppAuthzStrategy,
|
|
EndUserMounter,
|
|
MembershipStrategy,
|
|
)
|
|
from libs.oauth_bearer import SubjectType
|
|
from services.feature_service import FeatureService
|
|
|
|
|
|
def _resolve_app_authz_strategy() -> AppAuthzStrategy:
|
|
if FeatureService.get_system_features().webapp_auth.enabled:
|
|
return AclStrategy()
|
|
return MembershipStrategy()
|
|
|
|
|
|
OAUTH_BEARER_PIPELINE = Pipeline(
|
|
BearerCheck(),
|
|
SurfaceCheck(accepted=frozenset({SubjectType.ACCOUNT})),
|
|
ScopeCheck(),
|
|
AppResolver(),
|
|
WorkspaceMembershipCheck(),
|
|
AppAuthzCheck(_resolve_app_authz_strategy),
|
|
CallerMount(AccountMounter(), EndUserMounter()),
|
|
)
|