mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 04:40:57 +00:00
feat(tenancy): add Workspace multi-tenant foundation (#2353)
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
This commit is contained in:
RockChinQ
@@ -27,9 +27,25 @@ if typing.TYPE_CHECKING:
|
||||
HEARTBEAT_INTERVAL_SECONDS = 24 * 3600
|
||||
|
||||
|
||||
async def _count(ap: core_app.Application, table) -> int:
|
||||
async def _count(
|
||||
ap: core_app.Application,
|
||||
table,
|
||||
*,
|
||||
cloud_counter: typing.Callable[[], int] | None = None,
|
||||
) -> int:
|
||||
"""Count rows in a persistence table; -1 when unavailable."""
|
||||
try:
|
||||
persistence_mgr = ap.persistence_mgr
|
||||
cloud_runtime = getattr(getattr(persistence_mgr, 'mode', None), 'value', None) == 'cloud_runtime'
|
||||
if cloud_runtime:
|
||||
# The Cloud runtime role deliberately cannot bypass RLS. Counting
|
||||
# every tenant by opening one UoW per Workspace turns a best-effort
|
||||
# daily heartbeat into thousands of serial SQL statements. The
|
||||
# already-loaded runtime registries are authoritative for this
|
||||
# process and provide an O(1), connection-free operational count.
|
||||
if cloud_counter is None:
|
||||
return -1
|
||||
return max(int(cloud_counter()), 0)
|
||||
result = await ap.persistence_mgr.execute_async(sqlalchemy.select(sqlalchemy.func.count()).select_from(table))
|
||||
return int(result.scalar() or 0)
|
||||
except Exception:
|
||||
@@ -81,11 +97,27 @@ async def build_heartbeat_payload(ap: core_app.Application) -> dict:
|
||||
pass
|
||||
|
||||
# Resource counts
|
||||
features['pipeline_count'] = await _count(ap, persistence_pipeline.LegacyPipeline)
|
||||
features['mcp_server_count'] = await _count(ap, persistence_mcp.MCPServer)
|
||||
features['knowledge_base_count'] = await _count(ap, persistence_rag.KnowledgeBase)
|
||||
features['pipeline_count'] = await _count(
|
||||
ap,
|
||||
persistence_pipeline.LegacyPipeline,
|
||||
cloud_counter=lambda: len(ap.pipeline_mgr._pipelines_by_key),
|
||||
)
|
||||
features['mcp_server_count'] = await _count(
|
||||
ap,
|
||||
persistence_mcp.MCPServer,
|
||||
cloud_counter=lambda: len(ap.tool_mgr.mcp_tool_loader._sessions),
|
||||
)
|
||||
features['knowledge_base_count'] = await _count(
|
||||
ap,
|
||||
persistence_rag.KnowledgeBase,
|
||||
cloud_counter=lambda: len(ap.rag_mgr.knowledge_bases),
|
||||
)
|
||||
if 'bot_count' not in features:
|
||||
features['bot_count'] = await _count(ap, persistence_bot.Bot)
|
||||
features['bot_count'] = await _count(
|
||||
ap,
|
||||
persistence_bot.Bot,
|
||||
cloud_counter=lambda: len(ap.platform_mgr._bots_by_key),
|
||||
)
|
||||
|
||||
# Plugin count (from plugin runtime)
|
||||
try:
|
||||
@@ -99,8 +131,8 @@ async def build_heartbeat_payload(ap: core_app.Application) -> dict:
|
||||
# Skill count (from Box runtime via skill manager)
|
||||
try:
|
||||
skill_mgr = getattr(ap, 'skill_mgr', None)
|
||||
if skill_mgr is not None and getattr(skill_mgr, 'skills', None) is not None:
|
||||
features['skill_count'] = len(skill_mgr.skills)
|
||||
if skill_mgr is not None:
|
||||
features['skill_count'] = skill_mgr.total_cached_skill_count()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
@@ -1,8 +1,13 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
import contextlib
|
||||
import httpx
|
||||
from ..core import app as core_app
|
||||
from ..utils import httpclient
|
||||
|
||||
|
||||
_MAX_INFLIGHT_TELEMETRY_TASKS = 8
|
||||
|
||||
|
||||
class TelemetryManager:
|
||||
@@ -18,13 +23,45 @@ class TelemetryManager:
|
||||
|
||||
self.telemetry_config = {}
|
||||
self.send_tasks: list[asyncio.Task] = []
|
||||
self._client: httpx.AsyncClient | None = None
|
||||
|
||||
async def initialize(self):
|
||||
self.telemetry_config = self.ap.instance_config.data.get('space', {})
|
||||
|
||||
async def start_send_task(self, payload: dict):
|
||||
self.send_tasks = [task for task in self.send_tasks if not task.done()]
|
||||
if len(self.send_tasks) >= _MAX_INFLIGHT_TELEMETRY_TASKS:
|
||||
self.ap.logger.debug('Telemetry queue is full; dropping best-effort event')
|
||||
return
|
||||
task = asyncio.create_task(self.send(payload))
|
||||
self.send_tasks.append(task)
|
||||
task.add_done_callback(self._send_task_done)
|
||||
|
||||
def _send_task_done(self, task: asyncio.Task) -> None:
|
||||
try:
|
||||
self.send_tasks.remove(task)
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
async def shutdown(self) -> None:
|
||||
tasks = list(self.send_tasks)
|
||||
for task in tasks:
|
||||
task.cancel()
|
||||
if tasks:
|
||||
await asyncio.gather(*tasks, return_exceptions=True)
|
||||
self.send_tasks.clear()
|
||||
if self._client is not None:
|
||||
await self._client.aclose()
|
||||
self._client = None
|
||||
|
||||
@contextlib.asynccontextmanager
|
||||
async def _client_context(self):
|
||||
if self._client is None or self._client.is_closed:
|
||||
self._client = httpx.AsyncClient(
|
||||
timeout=httpx.Timeout(10),
|
||||
event_hooks=httpclient.httpx_response_limit_hooks(),
|
||||
)
|
||||
yield self._client
|
||||
|
||||
async def send(self, payload: dict):
|
||||
"""Send telemetry payload to configured telemetry server (non-blocking).
|
||||
@@ -91,20 +128,21 @@ class TelemetryManager:
|
||||
except Exception:
|
||||
sanitized['duration_ms'] = 0
|
||||
|
||||
async with httpx.AsyncClient(timeout=httpx.Timeout(10)) as client:
|
||||
async with self._client_context() as client:
|
||||
try:
|
||||
# Use asyncio.wait_for to ensure we always bound the total time
|
||||
resp = await asyncio.wait_for(client.post(url, json=sanitized), timeout=10 + 1)
|
||||
|
||||
if resp.status_code >= 400:
|
||||
body = await httpclient.response_text(resp, max_chars=200)
|
||||
self.ap.logger.warning(
|
||||
f'Telemetry post to {url} returned status {resp.status_code} - {resp.text}'
|
||||
f'Telemetry post to {url} returned status {resp.status_code} - {body}'
|
||||
)
|
||||
else:
|
||||
# Detect application-level errors inside HTTP 200 responses
|
||||
app_err = False
|
||||
try:
|
||||
j = resp.json()
|
||||
j = await httpclient.parse_json_response(resp)
|
||||
if isinstance(j, dict) and j.get('code') is not None and int(j.get('code')) >= 400:
|
||||
app_err = True
|
||||
self.ap.logger.warning(
|
||||
@@ -114,12 +152,14 @@ class TelemetryManager:
|
||||
pass
|
||||
|
||||
if app_err:
|
||||
body = await httpclient.response_text(resp, max_chars=200)
|
||||
self.ap.logger.warning(
|
||||
f'Telemetry post to {url} returned app-level error - response: {resp.text[:200]}'
|
||||
f'Telemetry post to {url} returned app-level error - response: {body}'
|
||||
)
|
||||
else:
|
||||
body = await httpclient.response_text(resp, max_chars=200)
|
||||
self.ap.logger.debug(
|
||||
f'Telemetry posted to {url}, status {resp.status_code} - response: {resp.text[:200]}'
|
||||
f'Telemetry posted to {url}, status {resp.status_code} - response: {body}'
|
||||
)
|
||||
except asyncio.TimeoutError:
|
||||
self.ap.logger.warning(f'Telemetry post to {url} timed out')
|
||||
|
||||
Reference in New Issue
Block a user