mirror of
https://github.com/langgenius/dify.git
synced 2026-05-24 10:57:52 +08:00
fe8510ad1a
Adds a CLI-friendly authorization flow so difyctl (and future
non-browser clients) can obtain user-scoped tokens without copy-
pasting cookies or raw API keys. Two grant paths share one device
flow surface:
1. Account branch — user signs in via the existing /signin
methods, /device page calls console-authed approve, mints a
dfoa_ token tied to (account_id, tenant).
2. External-SSO branch (EE) — /v1/oauth/device/sso-initiate signs
an SSOState envelope, hands off to Enterprise's external ACS,
receives a signed external-subject assertion, mints a dfoe_
token tied to (subject_email, subject_issuer).
API surface (all under /v1, EE-only endpoints 404 on CE):
POST /v1/oauth/device/code — RFC 8628 start
POST /v1/oauth/device/token — RFC 8628 poll
GET /v1/oauth/device/lookup — pre-validate user_code
GET /v1/oauth/device/sso-initiate — SSO branch entry
GET /v1/device/sso-complete — SSO callback sink
GET /v1/oauth/device/approval-context — /device cookie probe
POST /v1/oauth/device/approve-external — SSO approve
GET /v1/me — bearer subject lookup
DELETE /v1/oauth/authorizations/self — self-revoke
POST /console/api/oauth/device/approve — account approve
POST /console/api/oauth/device/deny — account deny
Core primitives:
- libs/oauth_bearer.py: prefix-keyed TokenKindRegistry +
BearerAuthenticator + validate_bearer decorator. Two-tier scope
(full vs apps:run) stamped from the registry, never from the DB.
- libs/jws.py: HS256 compact JWS keyed on the shared Dify
SECRET_KEY — same key-set verifies the SSOState envelope, the
external-subject assertion (minted by Enterprise), and the
approval-grant cookie.
- libs/device_flow_security.py: enterprise_only gate, approval-
grant cookie mint/verify/consume (Path=/v1/oauth/device,
HttpOnly, SameSite=Lax, Secure follows is_secure()), anti-
framing headers.
- libs/rate_limit.py: typed RateLimit / RateLimitScope dispatch
with composite-key buckets; both decorator + imperative form.
- services/oauth_device_flow.py: Redis state machine (PENDING ->
APPROVED|DENIED with atomic consume-on-poll), token mint via
partial unique index uq_oauth_active_per_device (rotates in
place), env-driven TTL policy.
Storage: oauth_access_tokens table with partial unique index on
(subject_email, subject_issuer, client_id, device_label) WHERE
revoked_at IS NULL. account_id NULL distinguishes external-SSO
rows. Hard-expire is CAS UPDATE (revoked_at + nullify token_hash)
so audit events keep their token_id. Retention pruner DELETEs
revoked + zombie-expired rows past OAUTH_ACCESS_TOKEN_RETENTION_DAYS.
Frontend: /device page with code-entry, chooser (account vs SSO),
authorize-account, authorize-sso views. SSO branch detaches from
the URL user_code and reads everything from the cookie via
/approval-context. Anti-framing headers on all responses.
Wiring: ENABLE_OAUTH_BEARER feature flag; ext_oauth_bearer binds
the authenticator at startup; clean_oauth_access_tokens_task
scheduled in ext_celery.
Spec: docs/specs/v1.0/server/{device-flow,tokens,middleware,security}.md
110 lines
4.2 KiB
Python
110 lines
4.2 KiB
Python
from configs import dify_config
|
|
from constants import HEADER_NAME_APP_CODE, HEADER_NAME_CSRF_TOKEN, HEADER_NAME_PASSPORT
|
|
from dify_app import DifyApp
|
|
|
|
BASE_CORS_HEADERS: tuple[str, ...] = ("Content-Type", HEADER_NAME_APP_CODE, HEADER_NAME_PASSPORT)
|
|
SERVICE_API_HEADERS: tuple[str, ...] = (*BASE_CORS_HEADERS, "Authorization")
|
|
AUTHENTICATED_HEADERS: tuple[str, ...] = (*SERVICE_API_HEADERS, HEADER_NAME_CSRF_TOKEN)
|
|
FILES_HEADERS: tuple[str, ...] = (*BASE_CORS_HEADERS, HEADER_NAME_CSRF_TOKEN)
|
|
EMBED_HEADERS: tuple[str, ...] = ("Content-Type", HEADER_NAME_APP_CODE)
|
|
EXPOSED_HEADERS: tuple[str, ...] = ("X-Version", "X-Env", "X-Trace-Id")
|
|
|
|
|
|
def _apply_cors_once(bp, /, **cors_kwargs):
|
|
"""Make CORS idempotent so blueprints can be reused across multiple app instances."""
|
|
|
|
if getattr(bp, "_dify_cors_applied", False):
|
|
return
|
|
|
|
from flask_cors import CORS
|
|
|
|
CORS(bp, **cors_kwargs)
|
|
bp._dify_cors_applied = True
|
|
|
|
|
|
def init_app(app: DifyApp):
|
|
# register blueprint routers
|
|
|
|
from controllers.console import bp as console_app_bp
|
|
from controllers.files import bp as files_bp
|
|
from controllers.inner_api import bp as inner_api_bp
|
|
from controllers.mcp import bp as mcp_bp
|
|
from controllers.service_api import bp as service_api_bp
|
|
from controllers.trigger import bp as trigger_bp
|
|
from controllers.web import bp as web_bp
|
|
|
|
_apply_cors_once(
|
|
service_api_bp,
|
|
allow_headers=list(SERVICE_API_HEADERS),
|
|
methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
|
|
expose_headers=list(EXPOSED_HEADERS),
|
|
)
|
|
app.register_blueprint(service_api_bp)
|
|
|
|
_apply_cors_once(
|
|
web_bp,
|
|
resources={
|
|
# Embedded bot endpoints (unauthenticated, cross-origin safe)
|
|
r"^/chat-messages$": {
|
|
"origins": dify_config.WEB_API_CORS_ALLOW_ORIGINS,
|
|
"supports_credentials": False,
|
|
"allow_headers": list(EMBED_HEADERS),
|
|
"methods": ["GET", "POST", "OPTIONS"],
|
|
},
|
|
r"^/chat-messages/.*": {
|
|
"origins": dify_config.WEB_API_CORS_ALLOW_ORIGINS,
|
|
"supports_credentials": False,
|
|
"allow_headers": list(EMBED_HEADERS),
|
|
"methods": ["GET", "POST", "OPTIONS"],
|
|
},
|
|
# Default web application endpoints (authenticated)
|
|
r"/*": {
|
|
"origins": dify_config.WEB_API_CORS_ALLOW_ORIGINS,
|
|
"supports_credentials": True,
|
|
"allow_headers": list(AUTHENTICATED_HEADERS),
|
|
"methods": ["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
|
|
},
|
|
},
|
|
expose_headers=list(EXPOSED_HEADERS),
|
|
)
|
|
app.register_blueprint(web_bp)
|
|
|
|
_apply_cors_once(
|
|
console_app_bp,
|
|
resources={r"/*": {"origins": dify_config.CONSOLE_CORS_ALLOW_ORIGINS}},
|
|
supports_credentials=True,
|
|
allow_headers=list(AUTHENTICATED_HEADERS),
|
|
methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
|
|
expose_headers=list(EXPOSED_HEADERS),
|
|
)
|
|
app.register_blueprint(console_app_bp)
|
|
|
|
_apply_cors_once(
|
|
files_bp,
|
|
allow_headers=list(FILES_HEADERS),
|
|
methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
|
|
expose_headers=list(EXPOSED_HEADERS),
|
|
)
|
|
app.register_blueprint(files_bp)
|
|
|
|
app.register_blueprint(inner_api_bp)
|
|
app.register_blueprint(mcp_bp)
|
|
|
|
# SSO-branch device-flow routes. No CORS config — these endpoints are
|
|
# user-interactive (same-origin browser traffic) and cookie-authed;
|
|
# allowing cross-origin would defeat the SameSite=Lax cookie's purpose.
|
|
# Gated on ENABLE_OAUTH_BEARER: without the bearer authenticator, tokens
|
|
# minted here cannot be validated, so skip the blueprint entirely.
|
|
if dify_config.ENABLE_OAUTH_BEARER:
|
|
from controllers.oauth_device_sso import bp as oauth_device_sso_bp
|
|
app.register_blueprint(oauth_device_sso_bp)
|
|
|
|
# Register trigger blueprint with CORS for webhook calls
|
|
_apply_cors_once(
|
|
trigger_bp,
|
|
allow_headers=["Content-Type", "Authorization", "X-App-Code"],
|
|
methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH", "HEAD"],
|
|
expose_headers=list(EXPOSED_HEADERS),
|
|
)
|
|
app.register_blueprint(trigger_bp)
|