mirror of
https://github.com/langgenius/dify.git
synced 2026-05-21 09:17:27 +08:00
cf5ebe9430
Ports service_api/app/{completion,workflow}.py to bearer-authed
/openapi/v1/apps/<app_id>/{info,chat-messages,completion-messages,workflows/run}.
Architecture:
- New controllers/openapi/auth/ package: Pipeline + Step protocol over
one mutable Context. Endpoints attach via @APP_PIPELINE.guard(scope=...)
— single attachment point; forgetting auth is structurally impossible.
- Pipeline order: BearerCheck -> ScopeCheck -> AppResolver -> AppAuthzCheck
-> CallerMount.
- Strategies vary along independent axes: AclStrategy (EE webapp-auth inner
API) vs MembershipStrategy (CE TenantAccountJoin); AccountMounter vs
EndUserMounter dispatched by SubjectType.
- App is in URL path (not header). Each non-GET has typed Pydantic Request;
each non-SSE response has typed Pydantic Response. Bearer-as-identity:
body 'user' field stripped, ignored if present.
Adds InvokeFrom.OPENAPI enum variant. Emits app.run.openapi audit log
on successful invocation via standard logger extra={"audit": True, ...}
convention.
90 lines
3.0 KiB
Python
90 lines
3.0 KiB
Python
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
|
|
from flask import Flask
|
|
from flask_restx import Api
|
|
|
|
|
|
def _client():
|
|
from controllers.openapi import chat_messages # noqa: F401
|
|
from controllers.openapi import openapi_ns
|
|
|
|
app = Flask(__name__)
|
|
api = Api(app)
|
|
api.add_namespace(openapi_ns, path="/openapi/v1")
|
|
return app.test_client()
|
|
|
|
|
|
@patch("controllers.openapi.chat_messages.AppGenerateService")
|
|
def test_chat_dispatches_and_returns_response_model(svc, bypass_pipeline):
|
|
svc.generate.return_value = (
|
|
{
|
|
"event": "message",
|
|
"task_id": "tk1",
|
|
"id": "m1",
|
|
"message_id": "m1",
|
|
"conversation_id": "c1",
|
|
"mode": "chat",
|
|
"answer": "hi",
|
|
"metadata": {},
|
|
"created_at": 1700000000,
|
|
},
|
|
200,
|
|
)
|
|
fake = SimpleNamespace(mode="chat", id="app1", tenant_id="t1")
|
|
with patch("controllers.openapi.chat_messages._unpack_app", return_value=fake), patch(
|
|
"controllers.openapi.chat_messages._unpack_caller", return_value=SimpleNamespace()
|
|
):
|
|
r = _client().post(
|
|
"/openapi/v1/apps/app1/chat-messages", json={"query": "hi", "inputs": {}}
|
|
)
|
|
assert r.status_code == 200
|
|
body = r.get_json()
|
|
assert body["conversation_id"] == "c1"
|
|
assert body["answer"] == "hi"
|
|
assert svc.generate.call_args.kwargs["invoke_from"].value == "openapi"
|
|
|
|
|
|
@patch("controllers.openapi.chat_messages.AppGenerateService")
|
|
def test_chat_strips_user_field_from_body(svc, bypass_pipeline):
|
|
svc.generate.return_value = (
|
|
{
|
|
"event": "message",
|
|
"task_id": "tk1",
|
|
"id": "m1",
|
|
"message_id": "m1",
|
|
"conversation_id": "c1",
|
|
"mode": "chat",
|
|
"answer": "hi",
|
|
"metadata": {},
|
|
"created_at": 1700000000,
|
|
},
|
|
200,
|
|
)
|
|
fake = SimpleNamespace(mode="chat", id="app1", tenant_id="t1")
|
|
with patch("controllers.openapi.chat_messages._unpack_app", return_value=fake), patch(
|
|
"controllers.openapi.chat_messages._unpack_caller", return_value=SimpleNamespace()
|
|
):
|
|
_client().post(
|
|
"/openapi/v1/apps/app1/chat-messages",
|
|
json={"query": "hi", "inputs": {}, "user": "spoof@x.com"},
|
|
)
|
|
args = svc.generate.call_args.kwargs["args"]
|
|
assert "user" not in args
|
|
|
|
|
|
def test_chat_rejects_non_chat_mode(bypass_pipeline):
|
|
fake = SimpleNamespace(mode="completion")
|
|
with patch("controllers.openapi.chat_messages._unpack_app", return_value=fake):
|
|
r = _client().post(
|
|
"/openapi/v1/apps/app1/chat-messages", json={"query": "hi", "inputs": {}}
|
|
)
|
|
assert r.status_code in (400, 403)
|
|
|
|
|
|
def test_chat_rejects_invalid_body(bypass_pipeline):
|
|
fake = SimpleNamespace(mode="chat", id="app1", tenant_id="t1")
|
|
with patch("controllers.openapi.chat_messages._unpack_app", return_value=fake):
|
|
r = _client().post("/openapi/v1/apps/app1/chat-messages", json={"query": "hi"})
|
|
assert r.status_code in (400, 422)
|