mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 04:40:57 +00:00
feat(tenancy): add Workspace multi-tenant foundation (#2353)
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
This commit is contained in:
RockChinQ
@@ -0,0 +1,30 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import contextvars
|
||||
|
||||
from ..http.context import RequestContext
|
||||
|
||||
|
||||
_request_context: contextvars.ContextVar[RequestContext | None] = contextvars.ContextVar(
|
||||
'langbot_mcp_request_context',
|
||||
default=None,
|
||||
)
|
||||
|
||||
|
||||
def bind_request_context(context: RequestContext) -> contextvars.Token[RequestContext | None]:
|
||||
"""Bind the authenticated MCP request while its ASGI request is executing."""
|
||||
|
||||
return _request_context.set(context)
|
||||
|
||||
|
||||
def reset_request_context(token: contextvars.Token[RequestContext | None]) -> None:
|
||||
_request_context.reset(token)
|
||||
|
||||
|
||||
def get_request_context() -> RequestContext:
|
||||
"""Return the current trusted MCP context or fail closed."""
|
||||
|
||||
context = _request_context.get()
|
||||
if context is None:
|
||||
raise RuntimeError('MCP Workspace context is unavailable')
|
||||
return context
|
||||
@@ -19,7 +19,10 @@ from __future__ import annotations
|
||||
|
||||
import contextlib
|
||||
import typing
|
||||
import uuid
|
||||
|
||||
from ..http.context import PrincipalContext, PrincipalType, RequestContext, WorkspaceContext
|
||||
from .context import bind_request_context, reset_request_context
|
||||
from .server import LangBotMCPServer
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
@@ -28,6 +31,9 @@ if typing.TYPE_CHECKING:
|
||||
|
||||
# JSON-RPC-ish 401 body returned before the MCP app is reached.
|
||||
_UNAUTHORIZED_BODY = b'{"error":"unauthorized","message":"A valid LangBot API key is required for MCP access."}'
|
||||
_ENTITLEMENT_UNAVAILABLE_BODY = (
|
||||
b'{"error":"entitlement_unavailable","message":"Workspace entitlement is unavailable for MCP access."}'
|
||||
)
|
||||
|
||||
|
||||
def _extract_api_key(headers: list[tuple[bytes, bytes]]) -> str:
|
||||
@@ -76,7 +82,7 @@ class MCPMount:
|
||||
def wrap(self, quart_asgi: typing.Callable) -> typing.Callable:
|
||||
"""Return a dispatcher ASGI app fronting ``quart_asgi``."""
|
||||
mcp_asgi = self._mcp_asgi
|
||||
verify_api_key = self.ap.apikey_service.verify_api_key
|
||||
authenticate_api_key = self.ap.apikey_service.authenticate_api_key
|
||||
is_mcp_path = self._is_mcp_path
|
||||
|
||||
async def dispatcher(scope, receive, send): # type: ignore[no-untyped-def]
|
||||
@@ -88,12 +94,12 @@ class MCPMount:
|
||||
|
||||
# Authenticate MCP HTTP requests with a LangBot API key.
|
||||
api_key = _extract_api_key(scope.get('headers', []))
|
||||
authorized = False
|
||||
identity = None
|
||||
if api_key:
|
||||
with contextlib.suppress(Exception):
|
||||
authorized = await verify_api_key(api_key)
|
||||
identity = await authenticate_api_key(api_key)
|
||||
|
||||
if not authorized:
|
||||
if identity is None:
|
||||
await send(
|
||||
{
|
||||
'type': 'http.response.start',
|
||||
@@ -107,6 +113,56 @@ class MCPMount:
|
||||
await send({'type': 'http.response.body', 'body': _UNAUTHORIZED_BODY})
|
||||
return
|
||||
|
||||
await mcp_asgi(scope, receive, send)
|
||||
deployment_admission = getattr(self.ap, 'deployment_admission', None)
|
||||
try:
|
||||
if deployment_admission is not None:
|
||||
deployment_admission.require_active()
|
||||
entitlement_revision = 0
|
||||
deployment = getattr(self.ap, 'deployment', None)
|
||||
if deployment is not None and getattr(deployment, 'multi_workspace_enabled', False):
|
||||
resolver = getattr(self.ap, 'entitlement_resolver', None)
|
||||
if resolver is None or identity.instance_uuid != resolver.instance_uuid:
|
||||
raise RuntimeError('Workspace entitlement resolver is unavailable')
|
||||
entitlement = await resolver.resolve(identity.workspace_uuid)
|
||||
entitlement_revision = entitlement.entitlement_revision
|
||||
except Exception:
|
||||
await send(
|
||||
{
|
||||
'type': 'http.response.start',
|
||||
'status': 403,
|
||||
'headers': [(b'content-type', b'application/json')],
|
||||
}
|
||||
)
|
||||
await send({'type': 'http.response.body', 'body': _ENTITLEMENT_UNAVAILABLE_BODY})
|
||||
return
|
||||
|
||||
request_context = RequestContext(
|
||||
instance_uuid=identity.instance_uuid,
|
||||
placement_generation=identity.placement_generation,
|
||||
request_id=str(uuid.uuid4()),
|
||||
auth_type='api-key',
|
||||
principal=PrincipalContext(
|
||||
principal_type=PrincipalType.API_KEY,
|
||||
api_key_uuid=identity.api_key_uuid,
|
||||
),
|
||||
workspace=WorkspaceContext(
|
||||
workspace_uuid=identity.workspace_uuid,
|
||||
membership_uuid=None,
|
||||
role=None,
|
||||
permissions=identity.permissions,
|
||||
),
|
||||
entitlement_revision=entitlement_revision,
|
||||
)
|
||||
tenant_scope = getattr(self.ap.persistence_mgr, 'tenant_scope', None)
|
||||
if not callable(tenant_scope):
|
||||
raise RuntimeError('MCP request persistence scope is unavailable')
|
||||
async with tenant_scope(identity.workspace_uuid):
|
||||
token = bind_request_context(request_context)
|
||||
try:
|
||||
await mcp_asgi(scope, receive, send)
|
||||
if deployment_admission is not None:
|
||||
deployment_admission.require_active()
|
||||
finally:
|
||||
reset_request_context(token)
|
||||
|
||||
return dispatcher
|
||||
|
||||
@@ -22,6 +22,9 @@ import typing
|
||||
|
||||
from mcp.server.fastmcp import FastMCP
|
||||
|
||||
from ..http.authz import Permission, require_permission
|
||||
from .context import get_request_context
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from ...core import app as app_module
|
||||
|
||||
@@ -46,6 +49,12 @@ def _dump(value: typing.Any) -> str:
|
||||
return json.dumps(value, ensure_ascii=False, default=str)
|
||||
|
||||
|
||||
def _authorized(permission: Permission):
|
||||
context = get_request_context()
|
||||
require_permission(context, permission)
|
||||
return context
|
||||
|
||||
|
||||
class LangBotMCPServer:
|
||||
"""Builds and owns the FastMCP instance for LangBot."""
|
||||
|
||||
@@ -72,6 +81,7 @@ class LangBotMCPServer:
|
||||
# ----- System (read-only) -------------------------------------- #
|
||||
@mcp.tool(description='Get basic LangBot system/runtime information (version, edition).')
|
||||
async def get_system_info() -> str:
|
||||
_authorized(Permission.WORKSPACE_VIEW)
|
||||
version = None
|
||||
try:
|
||||
version = ap.ver_mgr.get_current_version()
|
||||
@@ -87,11 +97,13 @@ class LangBotMCPServer:
|
||||
# ----- Bots ---------------------------------------------------- #
|
||||
@mcp.tool(description='List all messaging-platform bots. Secrets are redacted.')
|
||||
async def list_bots() -> str:
|
||||
return _dump(await ap.bot_service.get_bots(include_secret=False))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.bot_service.get_bots(context, include_secret=False))
|
||||
|
||||
@mcp.tool(description='Get a single bot by its UUID. Secrets are redacted.')
|
||||
async def get_bot(bot_uuid: str) -> str:
|
||||
return _dump(await ap.bot_service.get_bot(bot_uuid, include_secret=False))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.bot_service.get_bot(context, bot_uuid, include_secret=False))
|
||||
|
||||
@mcp.tool(
|
||||
description=(
|
||||
@@ -101,26 +113,31 @@ class LangBotMCPServer:
|
||||
)
|
||||
)
|
||||
async def create_bot(bot_data: dict) -> str:
|
||||
return _dump({'uuid': await ap.bot_service.create_bot(bot_data)})
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
return _dump({'uuid': await ap.bot_service.create_bot(context, bot_data)})
|
||||
|
||||
@mcp.tool(description='Update a bot by UUID. `bot_data` matches the PUT bot body.')
|
||||
async def update_bot(bot_uuid: str, bot_data: dict) -> str:
|
||||
await ap.bot_service.update_bot(bot_uuid, bot_data)
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
await ap.bot_service.update_bot(context, bot_uuid, bot_data)
|
||||
return _dump({'ok': True})
|
||||
|
||||
@mcp.tool(description='Delete a bot by UUID.')
|
||||
async def delete_bot(bot_uuid: str) -> str:
|
||||
await ap.bot_service.delete_bot(bot_uuid)
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
await ap.bot_service.delete_bot(context, bot_uuid)
|
||||
return _dump({'ok': True})
|
||||
|
||||
# ----- Pipelines ----------------------------------------------- #
|
||||
@mcp.tool(description='List all pipelines.')
|
||||
async def list_pipelines() -> str:
|
||||
return _dump(await ap.pipeline_service.get_pipelines())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.pipeline_service.get_pipelines(context))
|
||||
|
||||
@mcp.tool(description='Get a single pipeline by UUID.')
|
||||
async def get_pipeline(pipeline_uuid: str) -> str:
|
||||
return _dump(await ap.pipeline_service.get_pipeline(pipeline_uuid))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.pipeline_service.get_pipeline(context, pipeline_uuid))
|
||||
|
||||
@mcp.tool(
|
||||
description=(
|
||||
@@ -129,49 +146,59 @@ class LangBotMCPServer:
|
||||
)
|
||||
)
|
||||
async def create_pipeline(pipeline_data: dict) -> str:
|
||||
return _dump({'uuid': await ap.pipeline_service.create_pipeline(pipeline_data)})
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
return _dump({'uuid': await ap.pipeline_service.create_pipeline(context, pipeline_data)})
|
||||
|
||||
@mcp.tool(description='Update a pipeline by UUID. `pipeline_data` matches the PUT body.')
|
||||
async def update_pipeline(pipeline_uuid: str, pipeline_data: dict) -> str:
|
||||
await ap.pipeline_service.update_pipeline(pipeline_uuid, pipeline_data)
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
await ap.pipeline_service.update_pipeline(context, pipeline_uuid, pipeline_data)
|
||||
return _dump({'ok': True})
|
||||
|
||||
@mcp.tool(description='Delete a pipeline by UUID.')
|
||||
async def delete_pipeline(pipeline_uuid: str) -> str:
|
||||
await ap.pipeline_service.delete_pipeline(pipeline_uuid)
|
||||
context = _authorized(Permission.RESOURCE_MANAGE)
|
||||
await ap.pipeline_service.delete_pipeline(context, pipeline_uuid)
|
||||
return _dump({'ok': True})
|
||||
|
||||
# ----- Models -------------------------------------------------- #
|
||||
@mcp.tool(description='List all configured LLM models. Secrets are redacted.')
|
||||
async def list_llm_models() -> str:
|
||||
return _dump(await ap.llm_model_service.get_llm_models(include_secret=False))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.llm_model_service.get_llm_models(context, include_secret=False))
|
||||
|
||||
@mcp.tool(description='Get a single LLM model by UUID.')
|
||||
async def get_llm_model(model_uuid: str) -> str:
|
||||
return _dump(await ap.llm_model_service.get_llm_model(model_uuid))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.llm_model_service.get_llm_model(context, model_uuid, include_secret=False))
|
||||
|
||||
@mcp.tool(description='List all configured embedding models.')
|
||||
async def list_embedding_models() -> str:
|
||||
return _dump(await ap.embedding_models_service.get_embedding_models())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.embedding_models_service.get_embedding_models(context, include_secret=False))
|
||||
|
||||
@mcp.tool(description='List all model providers (OpenAI-compatible, Anthropic, etc.).')
|
||||
async def list_model_providers() -> str:
|
||||
return _dump(await ap.provider_service.get_providers())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.provider_service.get_providers(context, include_secret=False))
|
||||
|
||||
# ----- Knowledge bases ----------------------------------------- #
|
||||
@mcp.tool(description='List all knowledge bases (RAG).')
|
||||
async def list_knowledge_bases() -> str:
|
||||
return _dump(await ap.knowledge_service.get_knowledge_bases())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.knowledge_service.get_knowledge_bases(context))
|
||||
|
||||
@mcp.tool(description='Get a single knowledge base by UUID.')
|
||||
async def get_knowledge_base(kb_uuid: str) -> str:
|
||||
return _dump(await ap.knowledge_service.get_knowledge_base(kb_uuid))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.knowledge_service.get_knowledge_base(context, kb_uuid))
|
||||
|
||||
@mcp.tool(
|
||||
description=('Retrieve (semantic search) from a knowledge base. Returns the matched chunks for `query`.')
|
||||
)
|
||||
async def retrieve_knowledge_base(kb_uuid: str, query: str) -> str:
|
||||
return _dump(await ap.knowledge_service.retrieve_knowledge_base(kb_uuid, query))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.knowledge_service.retrieve_knowledge_base(context, kb_uuid, query))
|
||||
|
||||
# ----- MCP servers (LangBot as MCP client) --------------------- #
|
||||
@mcp.tool(
|
||||
@@ -180,16 +207,19 @@ class LangBotMCPServer:
|
||||
)
|
||||
)
|
||||
async def list_mcp_servers() -> str:
|
||||
return _dump(await ap.mcp_service.get_mcp_servers())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.mcp_service.get_mcp_servers(context))
|
||||
|
||||
# ----- Skills -------------------------------------------------- #
|
||||
@mcp.tool(description='List installed skills.')
|
||||
async def list_skills() -> str:
|
||||
return _dump(await ap.skill_service.list_skills())
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.skill_service.list_skills(context))
|
||||
|
||||
@mcp.tool(description='Get a single skill by name.')
|
||||
async def get_skill(skill_name: str) -> str:
|
||||
return _dump(await ap.skill_service.get_skill(skill_name))
|
||||
context = _authorized(Permission.RESOURCE_VIEW)
|
||||
return _dump(await ap.skill_service.get_skill(context, skill_name))
|
||||
|
||||
# ------------------------------------------------------------------ #
|
||||
# ASGI app
|
||||
|
||||
Reference in New Issue
Block a user