0e30b32889
fix(security): resolve M-1, M-2, M-3 security findings
...
M-1: WebSocket authorization TOCTOU race (FIXED)
- Changed _revalidate_websocket_authorization to return RequestContext
- Ensures validated context is used immediately without race window
- Prevents removed members from sending messages during revalidation gap
M-2: Model Manager cache workspace isolation (VERIFIED)
- Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource)
- Cache is properly scoped per workspace, no cross-tenant leakage possible
- No code change needed, documented as working correctly
M-3: Invitation lock workspace scoping (FIXED)
- Changed lock key from token_digest to workspace_uuid:token_digest
- Prevents DoS where attacker locks token in Workspace A to block Workspace B
- Locks now isolated per workspace
All MEDIUM severity findings from security review now resolved.
2026-07-30 04:46:31 +00:00
6b8838a308
test: add comprehensive cross-tenant isolation tests
...
Added 7 critical test scenarios for multi-tenant boundaries:
- Cross-tenant bot access prevention
- Viewer role read-only enforcement
- Removed member immediate access revocation
- Model provider credential isolation
- WebSocket message isolation
- Invitation token workspace scoping
- Multi-workspace context validation
These tests address P0-2 coverage gaps for:
- workspaces.py (membership & invitation flows)
- user.py (authentication & authorization)
- websocket_chat.py (real-time isolation)
- plugins.py (resource access control)
docs: finalize database migration guide
2026-07-30 04:40:37 +00:00
5ba5e60002
fix(security): require authentication for image file endpoint (H-2)
...
- Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY
- Added Permission.RESOURCE_VIEW requirement
- Prevents unauthenticated cross-tenant file access via leaked keys
- Fixes HIGH severity finding from multi-tenant security review
docs: add comprehensive database migration guide
- Complete migration steps for OSS → multi-tenant
- Backup, execution, verification procedures
- Rollback scenarios and recovery plans
- Performance tuning recommendations
2026-07-30 04:31:49 +00:00
7b03e3395f
chore: merge master into feat/multi-tenants
...
- Resolved conflict in provider.py: merged rerank model support with tenant context
- Resolved conflict in telegram.py: kept async.to_thread optimization and added url parameter
- Resolved conflict in test_model_manager.py: kept both cloud runtime and rerank tests
2026-07-30 04:23:43 +00:00
d3c443a2c8
fix(cloud): handle unavailable skill capability
2026-07-29 18:55:44 +00:00
4b2a628db6
fix(deps): pin green multi-tenant plugin SDK
2026-07-29 11:15:18 +00:00
610915b9c5
fix(runtime): bound tenant resource amplification
2026-07-29 18:27:44 +08:00
e8d90c4259
fix(cloud): bound tenant maintenance and monitoring work
2026-07-29 16:02:44 +08:00
2dfbe78271
fix(cloud): scope public login capability discovery
2026-07-29 05:58:30 +00:00
c89e6f3bd2
fix(cloud): enforce instance capacity ceilings
2026-07-29 13:45:58 +08:00
e52d6880f5
fix(cloud): eliminate periodic runtime CPU spikes
2026-07-29 12:47:53 +08:00
aa342d9347
fix(cloud): bound runtime restart storms
2026-07-29 12:14:08 +08:00
ae85ac2b16
feat(cloud): harden multi-tenant runtime resources
2026-07-29 11:32:26 +08:00
463b120923
feat(platform): pass original image URL to Image component in 6 adapters ( #2362 )
...
Preserve the platform CDN URL in Image.url alongside base64 data,
enabling plugins to use ContentElement.from_image_url() for direct
vision API access without redundant local download.
- aiocqhttp: use msg_data["data"]["url"] and msg.data["url"]
- discord: use attachment.url
- telegram: use file.file_path
- slack: use pic_url
- wecom: use picurl
- qqofficial: use pic_url
Satori adapter already follows this pattern (satori.py:168).
The change is purely additive — base64 is preserved for backward
compatibility, and get_bytes() priority (url → base64 → path)
ensures plugins can choose the optimal path.
Closes #2355
Co-authored-by: douxt <8429023+douxt@users.noreply.github.com >
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-28 23:57:00 +08:00
3ca724d18e
fix: use per-bot admins for command events ( #2359 )
...
* fix: use per-bot admins for command events
* style: format rerank provider changes
---------
Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com >
2026-07-26 17:02:51 +08:00
dd8d1007a1
feat: support Space rerank models ( #2358 )
...
Co-authored-by: chan <dadachann@users.noreply.github.com >
2026-07-26 16:37:34 +08:00
32abbb636f
fix(oss): resolve workspace owner in scoped session
2026-07-26 16:30:15 +08:00
f247a9d183
test(oss): cover invitation logout handoff
2026-07-26 16:12:03 +08:00
624a197655
style: format OSS account service
2026-07-26 16:09:50 +08:00
712f79ed77
feat(oss): enforce invitation account and owner billing flows
2026-07-26 16:04:33 +08:00
602e10649b
fix(cloud): recover box runtime without unscoped skill reload
2026-07-26 14:25:49 +08:00
d71bd571b1
style(web): format invitation flows
2026-07-26 14:01:20 +08:00
e90a1546de
feat(cloud): complete secure invitation experience
2026-07-26 13:54:42 +08:00
ff068564ab
test(cloud): require Space identity for invite registration
2026-07-26 12:32:02 +08:00
94ff4fcd2d
fix(cloud): preserve Core-owned collaboration state
2026-07-26 12:27:47 +08:00
97b3e58884
fix(workspace): bind collaboration APIs to tenant UoW
2026-07-26 11:28:46 +08:00
66a1ceac25
style: format collaboration changes
2026-07-26 10:54:21 +08:00
8a445bfb22
feat(workspace): add in-product collaboration and direct Cloud launch
2026-07-26 10:40:36 +08:00
276791e7af
fix(ui): align workspace switcher with sidebar entries
2026-07-26 00:23:17 +08:00
baf7e86335
fix(ui): hide roles from workspace switcher
2026-07-26 00:07:44 +08:00
741c20af07
fix(ui): widen and center workspace switcher
2026-07-25 23:44:49 +08:00
5ac1ab3eac
fix(plugin): keep runtime identity stable across restarts
2026-07-25 21:56:14 +08:00
f96116a050
fix(cloud): surface runtime and workspace plan status
2026-07-25 21:42:05 +08:00
40abb03928
style(web): format workspace layout test
2026-07-25 21:04:23 +08:00
59f68b8fb4
refactor(web): streamline workspace controls
2026-07-25 20:59:05 +08:00
7c64cd9d51
feat(web): place workspace controls in sidebar
2026-07-25 16:26:13 +08:00
9ea1a81048
test(web): cover Workspace dropdown menu
2026-07-25 14:11:28 +08:00
d3f08a90b1
feat(cloud): complete Workspace settings navigation
2026-07-25 13:51:37 +08:00
64e772e32d
fix(cloud): reuse authenticated account for user info
2026-07-25 02:41:31 +08:00
84440df47f
fix(cloud): preserve authenticated account context
2026-07-25 02:05:17 +08:00
c860159446
test(cloud): preserve minimal model manager fixtures
2026-07-25 00:45:42 +08:00
f977629a90
fix(cloud): skip legacy model sync during startup
2026-07-25 00:26:56 +08:00
ff13d52602
chore: update multi-tenant SDK pin
2026-07-24 23:31:08 +08:00
5beab49577
docs(cloud): update control plane verification
2026-07-24 22:58:56 +08:00
e8a09b7537
fix(build): install git for pinned SDK
2026-07-24 19:29:14 +08:00
98f45aa88e
feat(tenancy): connect cloud workspace control plane
2026-07-24 19:11:33 +08:00
d7cdd206c2
docs(tenancy): record final isolation verification
2026-07-24 16:22:45 +08:00
ac72563664
fix(tenancy): close isolation and permission gaps
2026-07-24 16:22:45 +08:00
64dc887b20
docs(tenancy): record final isolation verification
2026-07-24 16:22:45 +08:00
627eb6b8ef
feat(tenancy): harden shared cloud runtime boundaries
2026-07-24 16:22:45 +08:00
dadachann