mirror of
https://github.com/langgenius/dify.git
synced 2026-05-26 11:57:40 +08:00
a728e0ac69
Co-authored-by: GareArc <garethcxy@dify.ai> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: L1nSn0w <l1nsn0w@qq.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: gigglewang <gigglewang@dify.ai> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Xiyuan Chen <52963600+GareArc@users.noreply.github.com>
47 lines
1.3 KiB
Python
47 lines
1.3 KiB
Python
"""`OAUTH_BEARER_PIPELINE` — the auth scheme for openapi `/run` endpoints.
|
|
|
|
Endpoints attach via `@OAUTH_BEARER_PIPELINE.guard(scope=…)`. No alternative
|
|
paths. Read endpoints (`/apps`, `/info`, `/parameters`, `/describe`) skip
|
|
the pipeline and use `validate_bearer + require_scope + require_workspace_member`
|
|
inline — they don't need `AppAuthzCheck`/`CallerMount`.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from controllers.openapi.auth.pipeline import Pipeline
|
|
from controllers.openapi.auth.steps import (
|
|
AppAuthzCheck,
|
|
AppResolver,
|
|
BearerCheck,
|
|
CallerMount,
|
|
ScopeCheck,
|
|
SurfaceCheck,
|
|
WorkspaceMembershipCheck,
|
|
)
|
|
from controllers.openapi.auth.strategies import (
|
|
AccountMounter,
|
|
AclStrategy,
|
|
AppAuthzStrategy,
|
|
EndUserMounter,
|
|
MembershipStrategy,
|
|
)
|
|
from libs.oauth_bearer import SubjectType
|
|
from services.feature_service import FeatureService
|
|
|
|
|
|
def _resolve_app_authz_strategy() -> AppAuthzStrategy:
|
|
if FeatureService.get_system_features().webapp_auth.enabled:
|
|
return AclStrategy()
|
|
return MembershipStrategy()
|
|
|
|
|
|
OAUTH_BEARER_PIPELINE = Pipeline(
|
|
BearerCheck(),
|
|
SurfaceCheck(accepted=frozenset({SubjectType.ACCOUNT})),
|
|
ScopeCheck(),
|
|
AppResolver(),
|
|
WorkspaceMembershipCheck(),
|
|
AppAuthzCheck(_resolve_app_authz_strategy),
|
|
CallerMount(AccountMounter(), EndUserMounter()),
|
|
)
|