mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 12:40:59 +00:00
feat(tenancy): add Workspace multi-tenant foundation (#2353)
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
This commit is contained in:
RockChinQ
@@ -0,0 +1,285 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import contextlib
|
||||
import errno
|
||||
import os
|
||||
import stat
|
||||
from collections.abc import Iterable
|
||||
|
||||
|
||||
class UnsafeWorkspacePathError(OSError):
|
||||
"""A tenant-controlled path could not be opened without following links."""
|
||||
|
||||
|
||||
_DIRECTORY_FLAGS = (
|
||||
os.O_RDONLY | getattr(os, 'O_DIRECTORY', 0) | getattr(os, 'O_NOFOLLOW', 0) | getattr(os, 'O_CLOEXEC', 0)
|
||||
)
|
||||
_FILE_READ_FLAGS = os.O_RDONLY | getattr(os, 'O_NOFOLLOW', 0) | getattr(os, 'O_CLOEXEC', 0)
|
||||
_FILE_WRITE_FLAGS = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, 'O_NOFOLLOW', 0) | getattr(os, 'O_CLOEXEC', 0)
|
||||
_MAX_REMOVAL_ENTRIES = 4096
|
||||
_MAX_REMOVAL_DEPTH = 16
|
||||
|
||||
|
||||
def _component(value: str) -> str:
|
||||
normalized = str(value or '').strip()
|
||||
if (
|
||||
not normalized
|
||||
or normalized in {'.', '..'}
|
||||
or '/' in normalized
|
||||
or '\\' in normalized
|
||||
or '\x00' in normalized
|
||||
or len(os.fsencode(normalized)) > 240
|
||||
):
|
||||
raise UnsafeWorkspacePathError('Unsafe Workspace path component')
|
||||
return normalized
|
||||
|
||||
|
||||
def _unsafe(path: str, exc: BaseException | None = None) -> UnsafeWorkspacePathError:
|
||||
error = UnsafeWorkspacePathError(f'Workspace path is not a link-free directory: {path}')
|
||||
if exc is not None:
|
||||
error.__cause__ = exc
|
||||
return error
|
||||
|
||||
|
||||
@contextlib.contextmanager
|
||||
def _root_fd(root: str):
|
||||
try:
|
||||
fd = os.open(root, _DIRECTORY_FLAGS)
|
||||
except OSError as exc:
|
||||
raise _unsafe(root, exc)
|
||||
try:
|
||||
if not stat.S_ISDIR(os.fstat(fd).st_mode):
|
||||
raise _unsafe(root)
|
||||
yield fd
|
||||
finally:
|
||||
os.close(fd)
|
||||
|
||||
|
||||
def _open_dir_at(parent_fd: int, name: str, *, create: bool) -> int:
|
||||
name = _component(name)
|
||||
if create:
|
||||
try:
|
||||
os.mkdir(name, mode=0o700, dir_fd=parent_fd)
|
||||
except FileExistsError:
|
||||
pass
|
||||
try:
|
||||
fd = os.open(name, _DIRECTORY_FLAGS, dir_fd=parent_fd)
|
||||
except OSError as exc:
|
||||
raise _unsafe(name, exc)
|
||||
if not stat.S_ISDIR(os.fstat(fd).st_mode):
|
||||
os.close(fd)
|
||||
raise _unsafe(name)
|
||||
return fd
|
||||
|
||||
|
||||
def _remove_entry(
|
||||
parent_fd: int,
|
||||
name: str,
|
||||
*,
|
||||
budget: list[int] | None = None,
|
||||
depth: int = 0,
|
||||
) -> None:
|
||||
"""Remove an entry recursively without following a symlink at any depth."""
|
||||
|
||||
name = _component(name)
|
||||
budget = budget if budget is not None else [_MAX_REMOVAL_ENTRIES]
|
||||
if depth > _MAX_REMOVAL_DEPTH or budget[0] <= 0:
|
||||
raise UnsafeWorkspacePathError('Workspace cleanup exceeded its inode budget')
|
||||
budget[0] -= 1
|
||||
for _ in range(4):
|
||||
try:
|
||||
child_fd = os.open(name, _DIRECTORY_FLAGS, dir_fd=parent_fd)
|
||||
except FileNotFoundError:
|
||||
return
|
||||
except OSError as exc:
|
||||
if exc.errno not in {errno.ELOOP, errno.ENOTDIR, errno.EACCES}:
|
||||
raise
|
||||
try:
|
||||
os.unlink(name, dir_fd=parent_fd)
|
||||
return
|
||||
except FileNotFoundError:
|
||||
return
|
||||
except IsADirectoryError:
|
||||
continue
|
||||
else:
|
||||
try:
|
||||
_clear_dir(child_fd, budget=budget, depth=depth + 1)
|
||||
finally:
|
||||
os.close(child_fd)
|
||||
try:
|
||||
os.rmdir(name, dir_fd=parent_fd)
|
||||
return
|
||||
except FileNotFoundError:
|
||||
return
|
||||
except NotADirectoryError:
|
||||
continue
|
||||
raise UnsafeWorkspacePathError('Workspace entry changed while it was being removed')
|
||||
|
||||
|
||||
def _clear_dir(directory_fd: int, *, budget: list[int], depth: int) -> None:
|
||||
# ``scandir(fd)`` enumerates the already-open directory. Names are then
|
||||
# resolved relative to the same fd, so a tenant cannot redirect the walk by
|
||||
# swapping an ancestor symlink between validation and use.
|
||||
# Do not materialize the whole directory: an attacker-controlled outbox
|
||||
# may contain an inode bomb even when its byte size is tiny. Removal is
|
||||
# deliberately budgeted and fails closed once the per-operation cap is
|
||||
# reached; hard filesystem/inode quota remains a Cloud readiness gate.
|
||||
with os.scandir(directory_fd) as iterator:
|
||||
for entry in iterator:
|
||||
_remove_entry(directory_fd, entry.name, budget=budget, depth=depth)
|
||||
|
||||
|
||||
@contextlib.contextmanager
|
||||
def _query_fd(root: str, subdir: str, query_key: str, *, create: bool, reset: bool = False):
|
||||
subdir = _component(subdir)
|
||||
query_key = _component(query_key)
|
||||
with _root_fd(root) as root_fd:
|
||||
subdir_fd = _open_dir_at(root_fd, subdir, create=create)
|
||||
try:
|
||||
if reset:
|
||||
_remove_entry(subdir_fd, query_key)
|
||||
query_fd = _open_dir_at(subdir_fd, query_key, create=create)
|
||||
try:
|
||||
yield query_fd
|
||||
finally:
|
||||
os.close(query_fd)
|
||||
finally:
|
||||
os.close(subdir_fd)
|
||||
|
||||
|
||||
def write_files(
|
||||
root: str,
|
||||
subdir: str,
|
||||
query_key: str,
|
||||
files: Iterable[tuple[str, bytes]],
|
||||
) -> None:
|
||||
"""Atomically recreate one query directory and write regular files only."""
|
||||
|
||||
with _query_fd(root, subdir, query_key, create=True, reset=True) as query_fd:
|
||||
for raw_name, data in files:
|
||||
name = _component(raw_name)
|
||||
try:
|
||||
file_fd = os.open(name, _FILE_WRITE_FLAGS, 0o600, dir_fd=query_fd)
|
||||
except OSError as exc:
|
||||
raise UnsafeWorkspacePathError(f'Could not create a link-free Workspace file: {name}') from exc
|
||||
with os.fdopen(file_fd, 'wb') as file_obj:
|
||||
file_obj.write(data)
|
||||
|
||||
|
||||
def _read_directory(
|
||||
directory_fd: int,
|
||||
*,
|
||||
prefix: str,
|
||||
max_file_bytes: int,
|
||||
max_files: int,
|
||||
max_total_bytes: int,
|
||||
output: list[tuple[str, bytes]],
|
||||
total: list[int],
|
||||
remaining_entries: list[int],
|
||||
remaining_directories: list[int],
|
||||
depth: int,
|
||||
) -> None:
|
||||
if depth > 8:
|
||||
return
|
||||
with os.scandir(directory_fd) as iterator:
|
||||
for entry in iterator:
|
||||
if len(output) >= max_files or total[0] >= max_total_bytes:
|
||||
return
|
||||
if remaining_entries[0] <= 0:
|
||||
raise UnsafeWorkspacePathError('Sandbox outbox exceeds the directory-entry limit')
|
||||
remaining_entries[0] -= 1
|
||||
name = _component(entry.name)
|
||||
relative = f'{prefix}/{name}' if prefix else name
|
||||
if entry.is_symlink():
|
||||
continue
|
||||
if entry.is_dir(follow_symlinks=False):
|
||||
if remaining_directories[0] <= 0:
|
||||
raise UnsafeWorkspacePathError('Sandbox outbox exceeds the directory limit')
|
||||
remaining_directories[0] -= 1
|
||||
try:
|
||||
child_fd = os.open(name, _DIRECTORY_FLAGS, dir_fd=directory_fd)
|
||||
except OSError:
|
||||
continue
|
||||
try:
|
||||
_read_directory(
|
||||
child_fd,
|
||||
prefix=relative,
|
||||
max_file_bytes=max_file_bytes,
|
||||
max_files=max_files,
|
||||
max_total_bytes=max_total_bytes,
|
||||
output=output,
|
||||
total=total,
|
||||
remaining_entries=remaining_entries,
|
||||
remaining_directories=remaining_directories,
|
||||
depth=depth + 1,
|
||||
)
|
||||
finally:
|
||||
os.close(child_fd)
|
||||
continue
|
||||
try:
|
||||
file_fd = os.open(name, _FILE_READ_FLAGS, dir_fd=directory_fd)
|
||||
except OSError:
|
||||
continue
|
||||
try:
|
||||
metadata = os.fstat(file_fd)
|
||||
if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > max_file_bytes:
|
||||
continue
|
||||
remaining = max_total_bytes - total[0]
|
||||
if metadata.st_size > remaining:
|
||||
continue
|
||||
with os.fdopen(file_fd, 'rb', closefd=False) as file_obj:
|
||||
data = file_obj.read(max_file_bytes + 1)
|
||||
if len(data) > max_file_bytes or len(data) > remaining:
|
||||
continue
|
||||
output.append((relative, data))
|
||||
total[0] += len(data)
|
||||
finally:
|
||||
os.close(file_fd)
|
||||
|
||||
|
||||
def read_regular_files(
|
||||
root: str,
|
||||
subdir: str,
|
||||
query_key: str,
|
||||
*,
|
||||
max_file_bytes: int,
|
||||
max_files: int,
|
||||
max_total_bytes: int,
|
||||
max_entries: int = 512,
|
||||
max_directories: int = 64,
|
||||
) -> list[tuple[str, bytes]]:
|
||||
"""Read bounded regular files without following tenant-created links."""
|
||||
|
||||
output: list[tuple[str, bytes]] = []
|
||||
try:
|
||||
with _query_fd(root, subdir, query_key, create=False) as query_fd:
|
||||
_read_directory(
|
||||
query_fd,
|
||||
prefix='',
|
||||
max_file_bytes=max_file_bytes,
|
||||
max_files=max_files,
|
||||
max_total_bytes=max_total_bytes,
|
||||
output=output,
|
||||
total=[0],
|
||||
remaining_entries=[max_entries],
|
||||
remaining_directories=[max_directories],
|
||||
depth=0,
|
||||
)
|
||||
except (FileNotFoundError, UnsafeWorkspacePathError):
|
||||
# A missing directory is an empty outbox. An unsafe existing path is
|
||||
# deliberately surfaced to the caller rather than followed.
|
||||
if os.path.lexists(os.path.join(root, subdir, query_key)):
|
||||
raise
|
||||
return output
|
||||
|
||||
|
||||
def reset_directory(root: str, subdir: str, query_key: str) -> None:
|
||||
with _query_fd(root, subdir, query_key, create=True, reset=True):
|
||||
return
|
||||
|
||||
|
||||
def purge_subdirectory(root: str, subdir: str) -> None:
|
||||
"""Remove one known subtree without following a hostile replacement link."""
|
||||
|
||||
with _root_fd(root) as root_fd:
|
||||
_remove_entry(root_fd, _component(subdir))
|
||||
Reference in New Issue
Block a user