mirror of
https://github.com/langgenius/dify.git
synced 2026-05-20 16:57:01 +08:00
cf5ebe9430
Ports service_api/app/{completion,workflow}.py to bearer-authed
/openapi/v1/apps/<app_id>/{info,chat-messages,completion-messages,workflows/run}.
Architecture:
- New controllers/openapi/auth/ package: Pipeline + Step protocol over
one mutable Context. Endpoints attach via @APP_PIPELINE.guard(scope=...)
— single attachment point; forgetting auth is structurally impossible.
- Pipeline order: BearerCheck -> ScopeCheck -> AppResolver -> AppAuthzCheck
-> CallerMount.
- Strategies vary along independent axes: AclStrategy (EE webapp-auth inner
API) vs MembershipStrategy (CE TenantAccountJoin); AccountMounter vs
EndUserMounter dispatched by SubjectType.
- App is in URL path (not header). Each non-GET has typed Pydantic Request;
each non-SSE response has typed Pydantic Response. Bearer-as-identity:
body 'user' field stripped, ignored if present.
Adds InvokeFrom.OPENAPI enum variant. Emits app.run.openapi audit log
on successful invocation via standard logger extra={"audit": True, ...}
convention.
44 lines
860 B
Python
44 lines
860 B
Python
from flask import Blueprint
|
|
from flask_restx import Namespace
|
|
|
|
from libs.device_flow_security import attach_anti_framing
|
|
from libs.external_api import ExternalApi
|
|
|
|
bp = Blueprint("openapi", __name__, url_prefix="/openapi/v1")
|
|
attach_anti_framing(bp)
|
|
|
|
api = ExternalApi(
|
|
bp,
|
|
version="1.0",
|
|
title="OpenAPI",
|
|
description="User-scoped programmatic API (bearer auth)",
|
|
)
|
|
|
|
openapi_ns = Namespace("openapi", description="User-scoped operations", path="/")
|
|
|
|
from . import (
|
|
account,
|
|
app_info,
|
|
chat_messages,
|
|
completion_messages,
|
|
index,
|
|
oauth_device,
|
|
oauth_device_sso,
|
|
workflow_run,
|
|
workspaces,
|
|
)
|
|
|
|
__all__ = [
|
|
"account",
|
|
"app_info",
|
|
"chat_messages",
|
|
"completion_messages",
|
|
"index",
|
|
"oauth_device",
|
|
"oauth_device_sso",
|
|
"workflow_run",
|
|
"workspaces",
|
|
]
|
|
|
|
api.add_namespace(openapi_ns)
|