mirror of
https://github.com/langgenius/dify.git
synced 2026-05-21 01:07:03 +08:00
cf5ebe9430
Ports service_api/app/{completion,workflow}.py to bearer-authed
/openapi/v1/apps/<app_id>/{info,chat-messages,completion-messages,workflows/run}.
Architecture:
- New controllers/openapi/auth/ package: Pipeline + Step protocol over
one mutable Context. Endpoints attach via @APP_PIPELINE.guard(scope=...)
— single attachment point; forgetting auth is structurally impossible.
- Pipeline order: BearerCheck -> ScopeCheck -> AppResolver -> AppAuthzCheck
-> CallerMount.
- Strategies vary along independent axes: AclStrategy (EE webapp-auth inner
API) vs MembershipStrategy (CE TenantAccountJoin); AccountMounter vs
EndUserMounter dispatched by SubjectType.
- App is in URL path (not header). Each non-GET has typed Pydantic Request;
each non-SSE response has typed Pydantic Response. Bearer-as-identity:
body 'user' field stripped, ignored if present.
Adds InvokeFrom.OPENAPI enum variant. Emits app.run.openapi audit log
on successful invocation via standard logger extra={"audit": True, ...}
convention.
50 lines
1.5 KiB
Python
50 lines
1.5 KiB
Python
from unittest.mock import patch
|
|
|
|
from controllers.openapi.auth.composition import APP_PIPELINE, _resolve_app_authz_strategy
|
|
from controllers.openapi.auth.pipeline import Pipeline
|
|
from controllers.openapi.auth.steps import (
|
|
AppAuthzCheck,
|
|
AppResolver,
|
|
BearerCheck,
|
|
CallerMount,
|
|
ScopeCheck,
|
|
)
|
|
from controllers.openapi.auth.strategies import (
|
|
AccountMounter,
|
|
AclStrategy,
|
|
EndUserMounter,
|
|
MembershipStrategy,
|
|
)
|
|
|
|
|
|
def test_app_pipeline_is_composed():
|
|
assert isinstance(APP_PIPELINE, Pipeline)
|
|
|
|
|
|
def test_app_pipeline_step_order():
|
|
steps = APP_PIPELINE._steps
|
|
assert isinstance(steps[0], BearerCheck)
|
|
assert isinstance(steps[1], ScopeCheck)
|
|
assert isinstance(steps[2], AppResolver)
|
|
assert isinstance(steps[3], AppAuthzCheck)
|
|
assert isinstance(steps[4], CallerMount)
|
|
|
|
|
|
def test_caller_mount_has_both_mounters():
|
|
cm = APP_PIPELINE._steps[4]
|
|
kinds = {type(m) for m in cm._mounters}
|
|
assert AccountMounter in kinds
|
|
assert EndUserMounter in kinds
|
|
|
|
|
|
@patch("controllers.openapi.auth.composition.FeatureService")
|
|
def test_strategy_resolver_picks_acl_when_enabled(fs):
|
|
fs.get_system_features.return_value.webapp_auth.enabled = True
|
|
assert isinstance(_resolve_app_authz_strategy(), AclStrategy)
|
|
|
|
|
|
@patch("controllers.openapi.auth.composition.FeatureService")
|
|
def test_strategy_resolver_picks_membership_when_disabled(fs):
|
|
fs.get_system_features.return_value.webapp_auth.enabled = False
|
|
assert isinstance(_resolve_app_authz_strategy(), MembershipStrategy)
|