mirror of
https://github.com/langgenius/dify.git
synced 2026-05-20 08:46:57 +08:00
fe8510ad1a
Adds a CLI-friendly authorization flow so difyctl (and future
non-browser clients) can obtain user-scoped tokens without copy-
pasting cookies or raw API keys. Two grant paths share one device
flow surface:
1. Account branch — user signs in via the existing /signin
methods, /device page calls console-authed approve, mints a
dfoa_ token tied to (account_id, tenant).
2. External-SSO branch (EE) — /v1/oauth/device/sso-initiate signs
an SSOState envelope, hands off to Enterprise's external ACS,
receives a signed external-subject assertion, mints a dfoe_
token tied to (subject_email, subject_issuer).
API surface (all under /v1, EE-only endpoints 404 on CE):
POST /v1/oauth/device/code — RFC 8628 start
POST /v1/oauth/device/token — RFC 8628 poll
GET /v1/oauth/device/lookup — pre-validate user_code
GET /v1/oauth/device/sso-initiate — SSO branch entry
GET /v1/device/sso-complete — SSO callback sink
GET /v1/oauth/device/approval-context — /device cookie probe
POST /v1/oauth/device/approve-external — SSO approve
GET /v1/me — bearer subject lookup
DELETE /v1/oauth/authorizations/self — self-revoke
POST /console/api/oauth/device/approve — account approve
POST /console/api/oauth/device/deny — account deny
Core primitives:
- libs/oauth_bearer.py: prefix-keyed TokenKindRegistry +
BearerAuthenticator + validate_bearer decorator. Two-tier scope
(full vs apps:run) stamped from the registry, never from the DB.
- libs/jws.py: HS256 compact JWS keyed on the shared Dify
SECRET_KEY — same key-set verifies the SSOState envelope, the
external-subject assertion (minted by Enterprise), and the
approval-grant cookie.
- libs/device_flow_security.py: enterprise_only gate, approval-
grant cookie mint/verify/consume (Path=/v1/oauth/device,
HttpOnly, SameSite=Lax, Secure follows is_secure()), anti-
framing headers.
- libs/rate_limit.py: typed RateLimit / RateLimitScope dispatch
with composite-key buckets; both decorator + imperative form.
- services/oauth_device_flow.py: Redis state machine (PENDING ->
APPROVED|DENIED with atomic consume-on-poll), token mint via
partial unique index uq_oauth_active_per_device (rotates in
place), env-driven TTL policy.
Storage: oauth_access_tokens table with partial unique index on
(subject_email, subject_issuer, client_id, device_label) WHERE
revoked_at IS NULL. account_id NULL distinguishes external-SSO
rows. Hard-expire is CAS UPDATE (revoked_at + nullify token_hash)
so audit events keep their token_id. Retention pruner DELETEs
revoked + zombie-expired rows past OAUTH_ACCESS_TOKEN_RETENTION_DAYS.
Frontend: /device page with code-entry, chooser (account vs SSO),
authorize-account, authorize-sso views. SSO branch detaches from
the URL user_code and reads everything from the cookie via
/approval-context. Anti-framing headers on all responses.
Wiring: ENABLE_OAUTH_BEARER feature flag; ext_oauth_bearer binds
the authenticator at startup; clean_oauth_access_tokens_task
scheduled in ext_celery.
Spec: docs/specs/v1.0/server/{device-flow,tokens,middleware,security}.md
231 lines
5.1 KiB
Python
231 lines
5.1 KiB
Python
from .account import (
|
|
Account,
|
|
AccountIntegrate,
|
|
AccountStatus,
|
|
InvitationCode,
|
|
Tenant,
|
|
TenantAccountJoin,
|
|
TenantAccountRole,
|
|
TenantStatus,
|
|
)
|
|
from .api_based_extension import APIBasedExtension, APIBasedExtensionPoint
|
|
from .comment import (
|
|
WorkflowComment,
|
|
WorkflowCommentMention,
|
|
WorkflowCommentReply,
|
|
)
|
|
from .dataset import (
|
|
AppDatasetJoin,
|
|
Dataset,
|
|
DatasetCollectionBinding,
|
|
DatasetKeywordTable,
|
|
DatasetPermission,
|
|
DatasetPermissionEnum,
|
|
DatasetProcessRule,
|
|
DatasetQuery,
|
|
Document,
|
|
DocumentSegment,
|
|
Embedding,
|
|
ExternalKnowledgeApis,
|
|
ExternalKnowledgeBindings,
|
|
TidbAuthBinding,
|
|
Whitelist,
|
|
)
|
|
from .enums import (
|
|
AppTriggerStatus,
|
|
AppTriggerType,
|
|
CreatorUserRole,
|
|
WorkflowRunTriggeredFrom,
|
|
WorkflowTriggerStatus,
|
|
)
|
|
from .execution_extra_content import ExecutionExtraContent, HumanInputContent
|
|
from .human_input import HumanInputForm
|
|
from .model import (
|
|
AccountTrialAppRecord,
|
|
ApiRequest,
|
|
ApiToken,
|
|
App,
|
|
AppAnnotationHitHistory,
|
|
AppAnnotationSetting,
|
|
AppMCPServer,
|
|
AppMode,
|
|
AppModelConfig,
|
|
Conversation,
|
|
DatasetRetrieverResource,
|
|
DifySetup,
|
|
EndUser,
|
|
ExporleBanner,
|
|
IconType,
|
|
InstalledApp,
|
|
Message,
|
|
MessageAgentThought,
|
|
MessageAnnotation,
|
|
MessageChain,
|
|
MessageFeedback,
|
|
MessageFile,
|
|
OperationLog,
|
|
RecommendedApp,
|
|
Site,
|
|
Tag,
|
|
TagBinding,
|
|
TenantCreditPool,
|
|
TraceAppConfig,
|
|
TrialApp,
|
|
UploadFile,
|
|
)
|
|
from .oauth import DatasourceOauthParamConfig, DatasourceProvider, OAuthAccessToken
|
|
from .provider import (
|
|
LoadBalancingModelConfig,
|
|
Provider,
|
|
ProviderModel,
|
|
ProviderModelSetting,
|
|
ProviderOrder,
|
|
ProviderQuotaType,
|
|
ProviderType,
|
|
TenantDefaultModel,
|
|
TenantPreferredModelProvider,
|
|
)
|
|
from .source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
|
|
from .task import CeleryTask, CeleryTaskSet
|
|
from .tools import (
|
|
ApiToolProvider,
|
|
BuiltinToolProvider,
|
|
ToolConversationVariables,
|
|
ToolFile,
|
|
ToolLabelBinding,
|
|
ToolModelInvoke,
|
|
WorkflowToolProvider,
|
|
)
|
|
from .trigger import (
|
|
AppTrigger,
|
|
TriggerOAuthSystemClient,
|
|
TriggerOAuthTenantClient,
|
|
TriggerSubscription,
|
|
WorkflowSchedulePlan,
|
|
)
|
|
from .web import PinnedConversation, SavedMessage
|
|
from .workflow import (
|
|
ConversationVariable,
|
|
Workflow,
|
|
WorkflowAppLog,
|
|
WorkflowAppLogCreatedFrom,
|
|
WorkflowArchiveLog,
|
|
WorkflowNodeExecutionModel,
|
|
WorkflowNodeExecutionOffload,
|
|
WorkflowNodeExecutionTriggeredFrom,
|
|
WorkflowPause,
|
|
WorkflowRun,
|
|
WorkflowType,
|
|
)
|
|
|
|
__all__ = [
|
|
"APIBasedExtension",
|
|
"APIBasedExtensionPoint",
|
|
"Account",
|
|
"AccountIntegrate",
|
|
"AccountStatus",
|
|
"AccountTrialAppRecord",
|
|
"ApiRequest",
|
|
"ApiToken",
|
|
"ApiToolProvider",
|
|
"App",
|
|
"AppAnnotationHitHistory",
|
|
"AppAnnotationSetting",
|
|
"AppDatasetJoin",
|
|
"AppMCPServer",
|
|
"AppMode",
|
|
"AppModelConfig",
|
|
"AppTrigger",
|
|
"AppTriggerStatus",
|
|
"AppTriggerType",
|
|
"BuiltinToolProvider",
|
|
"CeleryTask",
|
|
"CeleryTaskSet",
|
|
"Conversation",
|
|
"ConversationVariable",
|
|
"CreatorUserRole",
|
|
"DataSourceApiKeyAuthBinding",
|
|
"DataSourceOauthBinding",
|
|
"Dataset",
|
|
"DatasetCollectionBinding",
|
|
"DatasetKeywordTable",
|
|
"DatasetPermission",
|
|
"DatasetPermissionEnum",
|
|
"DatasetProcessRule",
|
|
"DatasetQuery",
|
|
"DatasetRetrieverResource",
|
|
"DatasourceOauthParamConfig",
|
|
"DatasourceProvider",
|
|
"DifySetup",
|
|
"Document",
|
|
"DocumentSegment",
|
|
"Embedding",
|
|
"EndUser",
|
|
"ExecutionExtraContent",
|
|
"ExporleBanner",
|
|
"ExternalKnowledgeApis",
|
|
"ExternalKnowledgeBindings",
|
|
"HumanInputContent",
|
|
"HumanInputForm",
|
|
"IconType",
|
|
"InstalledApp",
|
|
"InvitationCode",
|
|
"LoadBalancingModelConfig",
|
|
"Message",
|
|
"MessageAgentThought",
|
|
"MessageAnnotation",
|
|
"MessageChain",
|
|
"MessageFeedback",
|
|
"MessageFile",
|
|
"OAuthAccessToken",
|
|
"OperationLog",
|
|
"PinnedConversation",
|
|
"Provider",
|
|
"ProviderModel",
|
|
"ProviderModelSetting",
|
|
"ProviderOrder",
|
|
"ProviderQuotaType",
|
|
"ProviderType",
|
|
"RecommendedApp",
|
|
"SavedMessage",
|
|
"Site",
|
|
"Tag",
|
|
"TagBinding",
|
|
"Tenant",
|
|
"TenantAccountJoin",
|
|
"TenantAccountRole",
|
|
"TenantCreditPool",
|
|
"TenantDefaultModel",
|
|
"TenantPreferredModelProvider",
|
|
"TenantStatus",
|
|
"TidbAuthBinding",
|
|
"ToolConversationVariables",
|
|
"ToolFile",
|
|
"ToolLabelBinding",
|
|
"ToolModelInvoke",
|
|
"TraceAppConfig",
|
|
"TrialApp",
|
|
"TriggerOAuthSystemClient",
|
|
"TriggerOAuthTenantClient",
|
|
"TriggerSubscription",
|
|
"UploadFile",
|
|
"Whitelist",
|
|
"Workflow",
|
|
"WorkflowAppLog",
|
|
"WorkflowAppLogCreatedFrom",
|
|
"WorkflowArchiveLog",
|
|
"WorkflowComment",
|
|
"WorkflowCommentMention",
|
|
"WorkflowCommentReply",
|
|
"WorkflowNodeExecutionModel",
|
|
"WorkflowNodeExecutionOffload",
|
|
"WorkflowNodeExecutionTriggeredFrom",
|
|
"WorkflowPause",
|
|
"WorkflowRun",
|
|
"WorkflowRunTriggeredFrom",
|
|
"WorkflowSchedulePlan",
|
|
"WorkflowToolProvider",
|
|
"WorkflowTriggerStatus",
|
|
"WorkflowType",
|
|
]
|