mirror of
https://github.com/langgenius/dify.git
synced 2026-05-21 09:17:27 +08:00
cf5ebe9430
Ports service_api/app/{completion,workflow}.py to bearer-authed
/openapi/v1/apps/<app_id>/{info,chat-messages,completion-messages,workflows/run}.
Architecture:
- New controllers/openapi/auth/ package: Pipeline + Step protocol over
one mutable Context. Endpoints attach via @APP_PIPELINE.guard(scope=...)
— single attachment point; forgetting auth is structurally impossible.
- Pipeline order: BearerCheck -> ScopeCheck -> AppResolver -> AppAuthzCheck
-> CallerMount.
- Strategies vary along independent axes: AclStrategy (EE webapp-auth inner
API) vs MembershipStrategy (CE TenantAccountJoin); AccountMounter vs
EndUserMounter dispatched by SubjectType.
- App is in URL path (not header). Each non-GET has typed Pydantic Request;
each non-SSE response has typed Pydantic Response. Bearer-as-identity:
body 'user' field stripped, ignored if present.
Adds InvokeFrom.OPENAPI enum variant. Emits app.run.openapi audit log
on successful invocation via standard logger extra={"audit": True, ...}
convention.
55 lines
1.8 KiB
Python
55 lines
1.8 KiB
Python
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
|
|
from flask import Flask
|
|
from flask_restx import Api
|
|
|
|
|
|
def _client():
|
|
from controllers.openapi import completion_messages # noqa: F401
|
|
from controllers.openapi import openapi_ns
|
|
|
|
app = Flask(__name__)
|
|
api = Api(app)
|
|
api.add_namespace(openapi_ns, path="/openapi/v1")
|
|
return app.test_client()
|
|
|
|
|
|
@patch("controllers.openapi.completion_messages.AppGenerateService")
|
|
def test_completion_returns_response_model(svc, bypass_pipeline):
|
|
svc.generate.return_value = (
|
|
{
|
|
"event": "message",
|
|
"task_id": "tk",
|
|
"id": "m1",
|
|
"message_id": "m1",
|
|
"mode": "completion",
|
|
"answer": "ok",
|
|
"metadata": {},
|
|
"created_at": 1700000000,
|
|
},
|
|
200,
|
|
)
|
|
fake = SimpleNamespace(mode="completion", id="app1", tenant_id="t1")
|
|
with patch("controllers.openapi.completion_messages._unpack_app", return_value=fake), patch(
|
|
"controllers.openapi.completion_messages._unpack_caller", return_value=SimpleNamespace()
|
|
):
|
|
r = _client().post(
|
|
"/openapi/v1/apps/app1/completion-messages",
|
|
json={"inputs": {"x": 1}, "query": "hi"},
|
|
)
|
|
assert r.status_code == 200
|
|
body = r.get_json()
|
|
assert body["answer"] == "ok"
|
|
assert svc.generate.call_args.kwargs["invoke_from"].value == "openapi"
|
|
|
|
|
|
def test_completion_rejects_chat_mode(bypass_pipeline):
|
|
fake = SimpleNamespace(mode="chat")
|
|
with patch("controllers.openapi.completion_messages._unpack_app", return_value=fake):
|
|
r = _client().post(
|
|
"/openapi/v1/apps/app1/completion-messages",
|
|
json={"inputs": {}, "query": "hi"},
|
|
)
|
|
assert r.status_code in (400, 403)
|