mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 04:40:57 +00:00
feat(tenancy): add Workspace multi-tenant foundation (#2353)
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
This commit is contained in:
RockChinQ
@@ -0,0 +1,380 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import uuid
|
||||
|
||||
import pytest
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
from sqlalchemy.ext.asyncio import create_async_engine
|
||||
|
||||
from langbot.pkg.entity import persistence
|
||||
from langbot.pkg.entity.persistence.base import Base
|
||||
from langbot.pkg.entity.persistence.user import User
|
||||
from langbot.pkg.persistence.mgr import PersistenceManager
|
||||
from langbot.pkg.persistence.alembic_runner import (
|
||||
get_alembic_head,
|
||||
get_alembic_current,
|
||||
run_alembic_downgrade,
|
||||
run_alembic_stamp,
|
||||
run_alembic_upgrade,
|
||||
)
|
||||
from langbot.pkg.utils import constants
|
||||
from langbot.pkg.utils import importutil
|
||||
from langbot.pkg.workspace.collaboration import normalize_email
|
||||
|
||||
|
||||
pytestmark = [pytest.mark.integration, pytest.mark.asyncio]
|
||||
|
||||
|
||||
async def _create_legacy_schema(
|
||||
engine,
|
||||
*,
|
||||
include_instance_uuid: bool = True,
|
||||
include_users: bool = True,
|
||||
) -> None:
|
||||
legacy_metadata = sa.MetaData()
|
||||
metadata_table = sa.Table(
|
||||
'metadata',
|
||||
legacy_metadata,
|
||||
sa.Column('key', sa.String(255), primary_key=True),
|
||||
sa.Column('value', sa.String(255)),
|
||||
)
|
||||
users = sa.Table(
|
||||
'users',
|
||||
legacy_metadata,
|
||||
sa.Column('id', sa.Integer, primary_key=True),
|
||||
sa.Column('user', sa.String(255), nullable=False),
|
||||
sa.Column('password', sa.String(255), nullable=False),
|
||||
sa.Column('account_type', sa.String(32), nullable=False, server_default='local'),
|
||||
sa.Column('space_account_uuid', sa.String(255), nullable=True),
|
||||
sa.Column('space_access_token', sa.Text, nullable=True),
|
||||
sa.Column('space_refresh_token', sa.Text, nullable=True),
|
||||
sa.Column('space_access_token_expires_at', sa.DateTime, nullable=True),
|
||||
sa.Column('space_api_key', sa.String(255), nullable=True),
|
||||
sa.Column('created_at', sa.DateTime, nullable=False, server_default=sa.func.now()),
|
||||
sa.Column('updated_at', sa.DateTime, nullable=False, server_default=sa.func.now()),
|
||||
)
|
||||
async with engine.begin() as conn:
|
||||
await conn.run_sync(legacy_metadata.create_all)
|
||||
await conn.execute(metadata_table.insert().values(key='database_version', value='25'))
|
||||
if include_instance_uuid:
|
||||
await conn.execute(metadata_table.insert().values(key='instance_uuid', value='instance_migration_test'))
|
||||
if include_users:
|
||||
await conn.execute(
|
||||
users.insert(),
|
||||
[
|
||||
{'user': 'owner@example.com', 'password': 'owner-hash'},
|
||||
{'user': 'member@example.com', 'password': 'member-hash'},
|
||||
],
|
||||
)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def legacy_engine(tmp_path):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "legacy-workspace.db"}')
|
||||
await _create_legacy_schema(engine)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
yield engine
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_legacy_instance_gets_stable_accounts_and_default_workspace(legacy_engine):
|
||||
await run_alembic_upgrade(legacy_engine, 'head')
|
||||
|
||||
async with legacy_engine.connect() as conn:
|
||||
tables = set(await conn.run_sync(lambda sync_conn: sa.inspect(sync_conn).get_table_names()))
|
||||
assert {
|
||||
'workspaces',
|
||||
'workspace_memberships',
|
||||
'workspace_invitations',
|
||||
'workspace_execution_states',
|
||||
}.issubset(tables)
|
||||
|
||||
accounts = (
|
||||
(await conn.execute(sa.text('SELECT id, uuid, status, source, projection_revision FROM users ORDER BY id')))
|
||||
.mappings()
|
||||
.all()
|
||||
)
|
||||
assert len(accounts) == 2
|
||||
assert len({account['uuid'] for account in accounts}) == 2
|
||||
for account in accounts:
|
||||
uuid.UUID(account['uuid'])
|
||||
assert account['status'] == 'active'
|
||||
assert account['source'] == 'local'
|
||||
assert account['projection_revision'] == 0
|
||||
|
||||
workspace = (
|
||||
(await conn.execute(sa.text('SELECT * FROM workspaces WHERE source = :source'), {'source': 'local'}))
|
||||
.mappings()
|
||||
.one()
|
||||
)
|
||||
assert workspace['instance_uuid'] == 'instance_migration_test'
|
||||
assert workspace['slug'] == 'default'
|
||||
assert workspace['status'] == 'active'
|
||||
assert workspace['created_by_account_uuid'] == accounts[0]['uuid']
|
||||
|
||||
membership = (await conn.execute(sa.text('SELECT * FROM workspace_memberships'))).mappings().one()
|
||||
assert membership['workspace_uuid'] == workspace['uuid']
|
||||
assert membership['account_uuid'] == accounts[0]['uuid']
|
||||
assert membership['role'] == 'owner'
|
||||
assert membership['status'] == 'active'
|
||||
|
||||
execution_state = (await conn.execute(sa.text('SELECT * FROM workspace_execution_states'))).mappings().one()
|
||||
assert execution_state['workspace_uuid'] == workspace['uuid']
|
||||
assert execution_state['instance_uuid'] == 'instance_migration_test'
|
||||
assert execution_state['active_generation'] == 1
|
||||
assert execution_state['state'] == 'active'
|
||||
assert execution_state['write_fenced'] in (False, 0)
|
||||
|
||||
assert await get_alembic_current(legacy_engine) == get_alembic_head()
|
||||
|
||||
|
||||
async def test_workspace_upgrade_is_idempotent_and_preserves_identifiers(legacy_engine):
|
||||
await run_alembic_upgrade(legacy_engine, 'head')
|
||||
async with legacy_engine.connect() as conn:
|
||||
account_uuids_before = (await conn.execute(sa.text('SELECT uuid FROM users ORDER BY id'))).scalars().all()
|
||||
workspace_uuid_before = (
|
||||
await conn.execute(sa.text("SELECT uuid FROM workspaces WHERE source = 'local'"))
|
||||
).scalar_one()
|
||||
|
||||
await run_alembic_upgrade(legacy_engine, 'head')
|
||||
|
||||
async with legacy_engine.connect() as conn:
|
||||
account_uuids_after = (await conn.execute(sa.text('SELECT uuid FROM users ORDER BY id'))).scalars().all()
|
||||
workspace_uuid_after = (
|
||||
await conn.execute(sa.text("SELECT uuid FROM workspaces WHERE source = 'local'"))
|
||||
).scalar_one()
|
||||
assert account_uuids_after == account_uuids_before
|
||||
assert workspace_uuid_after == workspace_uuid_before
|
||||
|
||||
|
||||
async def test_workspace_kernel_upgrade_downgrade_upgrade_round_trip(tmp_path):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "workspace-round-trip.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
await run_alembic_upgrade(engine, '0009_workspace_tenancy')
|
||||
assert await get_alembic_current(engine) == '0009_workspace_tenancy'
|
||||
|
||||
await run_alembic_downgrade(engine, '0008_mcp_resource_prefs')
|
||||
assert await get_alembic_current(engine) == '0008_mcp_resource_prefs'
|
||||
async with engine.connect() as conn:
|
||||
tables = set(await conn.run_sync(lambda sync_conn: sa.inspect(sync_conn).get_table_names()))
|
||||
user_columns = {
|
||||
column['name']
|
||||
for column in await conn.run_sync(lambda sync_conn: sa.inspect(sync_conn).get_columns('users'))
|
||||
}
|
||||
accounts = (await conn.execute(sa.text('SELECT user, password FROM users ORDER BY id'))).all()
|
||||
assert (
|
||||
not {
|
||||
'workspaces',
|
||||
'workspace_memberships',
|
||||
'workspace_invitations',
|
||||
'workspace_execution_states',
|
||||
}
|
||||
& tables
|
||||
)
|
||||
assert not {'uuid', 'status', 'source', 'projection_revision'} & user_columns
|
||||
assert accounts == [
|
||||
('owner@example.com', 'owner-hash'),
|
||||
('member@example.com', 'member-hash'),
|
||||
]
|
||||
|
||||
await run_alembic_upgrade(engine, '0009_workspace_tenancy')
|
||||
assert await get_alembic_current(engine) == '0009_workspace_tenancy'
|
||||
async with engine.connect() as conn:
|
||||
assert await conn.scalar(sa.text('SELECT COUNT(*) FROM workspaces')) == 1
|
||||
assert await conn.scalar(sa.text('SELECT COUNT(*) FROM workspace_memberships')) == 1
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
('raw_email', 'expected_email'),
|
||||
[
|
||||
('Straße@Example.COM', 'strasse@example.com'),
|
||||
('Ꭰ@Example.COM', 'Ꭰ@example.com'),
|
||||
],
|
||||
)
|
||||
async def test_workspace_upgrade_uses_runtime_unicode_email_normalization(
|
||||
tmp_path,
|
||||
raw_email,
|
||||
expected_email,
|
||||
):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "unicode-email.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine, include_users=False)
|
||||
async with engine.begin() as conn:
|
||||
await conn.execute(
|
||||
sa.text('INSERT INTO users (user, password, account_type) VALUES (:email, :password, :type)'),
|
||||
{'email': raw_email, 'password': 'owner-hash', 'type': 'local'},
|
||||
)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
await run_alembic_upgrade(engine, 'head')
|
||||
|
||||
async with engine.connect() as conn:
|
||||
assert await conn.scalar(sa.text('SELECT normalized_email FROM users')) == expected_email
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_fresh_sqlite_schema_accepts_application_casefold_identity(tmp_path):
|
||||
importutil.import_modules_in_pkg(persistence)
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "fresh-unicode-email.db"}')
|
||||
canonical_email = normalize_email('Ꭰ@Example.COM')
|
||||
try:
|
||||
async with engine.begin() as conn:
|
||||
await conn.run_sync(Base.metadata.create_all)
|
||||
await conn.execute(
|
||||
sa.insert(User).values(
|
||||
uuid='00000000-0000-0000-0000-000000000099',
|
||||
user=canonical_email,
|
||||
normalized_email=canonical_email,
|
||||
password='hash',
|
||||
)
|
||||
)
|
||||
async with engine.connect() as conn:
|
||||
assert await conn.scalar(sa.select(User.normalized_email)) == 'Ꭰ@example.com'
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_workspace_upgrade_rejects_unicode_casefold_duplicate_accounts(tmp_path):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "unicode-email-duplicate.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine, include_users=False)
|
||||
async with engine.begin() as conn:
|
||||
await conn.execute(
|
||||
sa.text(
|
||||
'INSERT INTO users (user, password, account_type) VALUES '
|
||||
"('Straße@Example.COM', 'first-hash', 'local'), "
|
||||
"('STRASSE@example.com', 'second-hash', 'local')"
|
||||
)
|
||||
)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
with pytest.raises(RuntimeError, match='both normalize'):
|
||||
await run_alembic_upgrade(engine, 'head')
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_uninitialized_instance_gets_ownerless_default_workspace(tmp_path):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "uninitialized-instance.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine, include_users=False)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
await run_alembic_upgrade(engine, 'head')
|
||||
|
||||
async with engine.connect() as conn:
|
||||
workspace = (await conn.execute(sa.text('SELECT * FROM workspaces'))).mappings().one()
|
||||
membership_count = await conn.scalar(sa.text('SELECT COUNT(*) FROM workspace_memberships'))
|
||||
execution_state = (await conn.execute(sa.text('SELECT * FROM workspace_execution_states'))).mappings().one()
|
||||
|
||||
assert workspace['created_by_account_uuid'] is None
|
||||
assert membership_count == 0
|
||||
assert execution_state['workspace_uuid'] == workspace['uuid']
|
||||
assert execution_state['active_generation'] == 1
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_local_workspace_unique_index_allows_cloud_projections(legacy_engine):
|
||||
await run_alembic_upgrade(legacy_engine, 'head')
|
||||
|
||||
async with legacy_engine.begin() as conn:
|
||||
await conn.execute(
|
||||
sa.text(
|
||||
'INSERT INTO workspaces '
|
||||
'(uuid, instance_uuid, name, slug, type, status, source, projection_revision) '
|
||||
'VALUES (:uuid, :instance_uuid, :name, :slug, :type, :status, :source, 0)'
|
||||
),
|
||||
{
|
||||
'uuid': str(uuid.uuid4()),
|
||||
'instance_uuid': 'instance_migration_test',
|
||||
'name': 'Cloud Projection',
|
||||
'slug': 'cloud-projection',
|
||||
'type': 'team',
|
||||
'status': 'active',
|
||||
'source': 'cloud_projection',
|
||||
},
|
||||
)
|
||||
|
||||
with pytest.raises(IntegrityError):
|
||||
async with legacy_engine.begin() as conn:
|
||||
await conn.execute(
|
||||
sa.text(
|
||||
'INSERT INTO workspaces '
|
||||
'(uuid, instance_uuid, name, slug, type, status, source, projection_revision) '
|
||||
'VALUES (:uuid, :instance_uuid, :name, :slug, :type, :status, :source, 0)'
|
||||
),
|
||||
{
|
||||
'uuid': str(uuid.uuid4()),
|
||||
'instance_uuid': 'instance_migration_test',
|
||||
'name': 'Second Local',
|
||||
'slug': 'second-local',
|
||||
'type': 'team',
|
||||
'status': 'active',
|
||||
'source': 'local',
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
async def test_legacy_instance_without_bound_instance_uuid_fails_closed(tmp_path):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "missing-instance.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine, include_instance_uuid=False)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
with pytest.raises(RuntimeError, match='instance_uuid'):
|
||||
await run_alembic_upgrade(engine, 'head')
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_persistence_startup_defers_workspace_tables_until_account_upgrade(tmp_path, monkeypatch):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "startup-order.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine)
|
||||
await run_alembic_stamp(engine, '0008_mcp_resource_prefs')
|
||||
monkeypatch.setattr(constants, 'instance_id', 'instance_migration_test')
|
||||
|
||||
database = type('Database', (), {'get_engine': lambda self: engine})()
|
||||
application = type('Application', (), {})()
|
||||
application.logger = logging.getLogger('workspace-startup-test')
|
||||
manager = PersistenceManager(application)
|
||||
manager.db = database
|
||||
|
||||
await manager.create_tables()
|
||||
async with engine.connect() as conn:
|
||||
tables_before_migration = set(
|
||||
await conn.run_sync(lambda sync_conn: sa.inspect(sync_conn).get_table_names())
|
||||
)
|
||||
assert 'workspaces' not in tables_before_migration
|
||||
|
||||
await manager._run_alembic_migrations()
|
||||
|
||||
async with engine.connect() as conn:
|
||||
workspace = (
|
||||
(await conn.execute(sa.text("SELECT * FROM workspaces WHERE source = 'local'"))).mappings().one()
|
||||
)
|
||||
assert workspace['instance_uuid'] == 'instance_migration_test'
|
||||
finally:
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def test_persistence_startup_rejects_instance_uuid_drift(tmp_path, monkeypatch):
|
||||
engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "instance-drift.db"}')
|
||||
try:
|
||||
await _create_legacy_schema(engine)
|
||||
monkeypatch.setattr(constants, 'instance_id', 'different_instance')
|
||||
|
||||
database = type('Database', (), {'get_engine': lambda self: engine})()
|
||||
application = type('Application', (), {})()
|
||||
application.logger = logging.getLogger('workspace-instance-drift-test')
|
||||
manager = PersistenceManager(application)
|
||||
manager.db = database
|
||||
|
||||
with pytest.raises(RuntimeError, match='does not match'):
|
||||
await manager.create_tables()
|
||||
finally:
|
||||
await engine.dispose()
|
||||
Reference in New Issue
Block a user