mirror of
https://github.com/langgenius/dify.git
synced 2026-05-20 16:57:01 +08:00
591048d7c2
Bearer auth surface for /openapi/v1/* run-routes:
- OAUTH_BEARER_PIPELINE (renamed from APP_PIPELINE for clarity outside this
module) composes BearerCheck → ScopeCheck → AppResolver →
WorkspaceMembershipCheck → AppAuthzCheck → CallerMount.
- BearerAuthenticator.authenticate() is the single source of identity +
rate-limit. Both pipeline (BearerCheck) and decorator (validate_bearer)
delegate to it, so per-token rate limit fires exactly once per request.
- Layer 0 (workspace membership) is CE-only; on EE the gateway owns
tenant isolation. Verdicts are cached on the AuthContext entry as
verified_tenants: dict[str, bool] (legacy "ok"/"denied" strings tolerated
by from_cache for one TTL cycle, then removed).
- check_workspace_membership(...) is the shared core; the pipeline step
and the inline require_workspace_member helper both delegate to it.
- Per-token rate limit: 60/min sliding window, RFC-7231-compliant 429
with Retry-After header + JSON body { error, retry_after_ms }. Bucket
key is sha256(token) so all replicas share state via Redis.
API hygiene:
- Scope StrEnum (FULL, APPS_READ, APPS_RUN) replaces bare string literals.
- /openapi/v1/apps/<id>/info: scope flipped from apps:run to apps:read.
- /info migrates off the pipeline to validate_bearer + require_scope +
require_workspace_member (no AppAuthzCheck/CallerMount needed for reads).
- ResolvedRow gains to_cache() / from_cache() classmethods.
- AuthContext gains token_hash + verified_tenants, dropping the per-route
re-hash and per-request Redis read on the cache hit path.
OPENAPI_RATE_LIMIT_PER_TOKEN config (default 60).
44 lines
1.2 KiB
Python
44 lines
1.2 KiB
Python
"""`OAUTH_BEARER_PIPELINE` — the auth scheme for openapi `/run` endpoints.
|
|
|
|
Endpoints attach via `@OAUTH_BEARER_PIPELINE.guard(scope=…)`. No alternative
|
|
paths. Read endpoints (`/apps`, `/info`, `/parameters`, `/describe`) skip
|
|
the pipeline and use `validate_bearer + require_scope + require_workspace_member`
|
|
inline — they don't need `AppAuthzCheck`/`CallerMount`.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from controllers.openapi.auth.pipeline import Pipeline
|
|
from controllers.openapi.auth.steps import (
|
|
AppAuthzCheck,
|
|
AppResolver,
|
|
BearerCheck,
|
|
CallerMount,
|
|
ScopeCheck,
|
|
WorkspaceMembershipCheck,
|
|
)
|
|
from controllers.openapi.auth.strategies import (
|
|
AccountMounter,
|
|
AclStrategy,
|
|
AppAuthzStrategy,
|
|
EndUserMounter,
|
|
MembershipStrategy,
|
|
)
|
|
from services.feature_service import FeatureService
|
|
|
|
|
|
def _resolve_app_authz_strategy() -> AppAuthzStrategy:
|
|
if FeatureService.get_system_features().webapp_auth.enabled:
|
|
return AclStrategy()
|
|
return MembershipStrategy()
|
|
|
|
|
|
OAUTH_BEARER_PIPELINE = Pipeline(
|
|
BearerCheck(),
|
|
ScopeCheck(),
|
|
AppResolver(),
|
|
WorkspaceMembershipCheck(),
|
|
AppAuthzCheck(_resolve_app_authz_strategy),
|
|
CallerMount(AccountMounter(), EndUserMounter()),
|
|
)
|