mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 04:40:57 +00:00
e1ac5e0fc8
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
377 lines
15 KiB
Python
377 lines
15 KiB
Python
from __future__ import annotations
|
|
|
|
import uuid
|
|
import traceback
|
|
|
|
import sqlalchemy
|
|
|
|
from ....core import app
|
|
from ....entity.persistence import model as persistence_model
|
|
from ....workspace.errors import WorkspaceNotFoundError
|
|
from .secrets import contains_secret_placeholder, redact_secrets, restore_secret_placeholders
|
|
from .tenant import TenantContext, require_workspace_uuid, scope_statement
|
|
|
|
|
|
class ModelProviderService:
|
|
"""Service for managing model providers"""
|
|
|
|
ap: app.Application
|
|
|
|
def __init__(self, ap: app.Application) -> None:
|
|
self.ap = ap
|
|
|
|
@staticmethod
|
|
def _normalize_api_keys(api_keys: str | list[str] | tuple[str, ...] | None) -> list[str]:
|
|
if api_keys is None:
|
|
return []
|
|
|
|
raw_keys = [api_keys] if isinstance(api_keys, str) else list(api_keys)
|
|
normalized_keys = []
|
|
seen_keys = set()
|
|
|
|
for raw_key in raw_keys:
|
|
normalized_key = raw_key.strip() if isinstance(raw_key, str) else ''
|
|
if not normalized_key or normalized_key in seen_keys:
|
|
continue
|
|
normalized_keys.append(normalized_key)
|
|
seen_keys.add(normalized_key)
|
|
|
|
return normalized_keys
|
|
|
|
async def get_providers(self, context: TenantContext, include_secret: bool = False) -> list[dict]:
|
|
"""Get all providers"""
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.ModelProvider),
|
|
persistence_model.ModelProvider,
|
|
context,
|
|
)
|
|
)
|
|
providers = result.all()
|
|
providers_list = []
|
|
for p in providers:
|
|
provider_dict = self.ap.persistence_mgr.serialize_model(persistence_model.ModelProvider, p)
|
|
# Parse api_keys if it's a JSON string
|
|
if isinstance(provider_dict.get('api_keys'), str):
|
|
import json
|
|
|
|
try:
|
|
provider_dict['api_keys'] = json.loads(provider_dict['api_keys'])
|
|
except Exception:
|
|
provider_dict['api_keys'] = []
|
|
if not include_secret:
|
|
provider_dict = redact_secrets(provider_dict)
|
|
providers_list.append(provider_dict)
|
|
return providers_list
|
|
|
|
async def get_provider(
|
|
self,
|
|
context: TenantContext,
|
|
provider_uuid: str,
|
|
include_secret: bool = False,
|
|
) -> dict | None:
|
|
"""Get a single provider by UUID"""
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.ModelProvider).where(
|
|
persistence_model.ModelProvider.uuid == provider_uuid
|
|
),
|
|
persistence_model.ModelProvider,
|
|
context,
|
|
)
|
|
)
|
|
provider = result.first()
|
|
if provider is None:
|
|
return None
|
|
provider_dict = self.ap.persistence_mgr.serialize_model(persistence_model.ModelProvider, provider)
|
|
# Parse api_keys if it's a JSON string
|
|
if isinstance(provider_dict.get('api_keys'), str):
|
|
import json
|
|
|
|
try:
|
|
provider_dict['api_keys'] = json.loads(provider_dict['api_keys'])
|
|
except Exception:
|
|
provider_dict['api_keys'] = []
|
|
if not include_secret:
|
|
provider_dict = redact_secrets(provider_dict)
|
|
return provider_dict
|
|
|
|
async def create_provider(self, context: TenantContext, provider_data: dict) -> str:
|
|
"""Create a new provider"""
|
|
provider_data = provider_data.copy()
|
|
provider_data['uuid'] = str(uuid.uuid4())
|
|
provider_data['workspace_uuid'] = require_workspace_uuid(context)
|
|
provider_data['api_keys'] = self._normalize_api_keys(
|
|
restore_secret_placeholders(provider_data.get('api_keys'), sensitive=True)
|
|
)
|
|
await self.ap.persistence_mgr.execute_async(
|
|
sqlalchemy.insert(persistence_model.ModelProvider).values(**provider_data)
|
|
)
|
|
|
|
# load to runtime
|
|
runtime_provider = await self.ap.model_mgr.load_provider(context, provider_data)
|
|
await self.ap.model_mgr.cache_provider(context, runtime_provider)
|
|
return provider_data['uuid']
|
|
|
|
async def update_provider(self, context: TenantContext, provider_uuid: str, provider_data: dict) -> None:
|
|
"""Update an existing provider"""
|
|
provider_data = provider_data.copy()
|
|
provider_data.pop('uuid', None)
|
|
provider_data.pop('workspace_uuid', None)
|
|
if 'api_keys' in provider_data:
|
|
submitted_keys = provider_data.get('api_keys')
|
|
if contains_secret_placeholder(submitted_keys, sensitive=True):
|
|
current_provider = await self.get_provider(context, provider_uuid, include_secret=True)
|
|
if current_provider is None:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
submitted_keys = restore_secret_placeholders(
|
|
submitted_keys,
|
|
current_provider.get('api_keys', []),
|
|
sensitive=True,
|
|
)
|
|
provider_data['api_keys'] = self._normalize_api_keys(submitted_keys)
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.update(persistence_model.ModelProvider)
|
|
.where(persistence_model.ModelProvider.uuid == provider_uuid)
|
|
.values(**provider_data),
|
|
persistence_model.ModelProvider,
|
|
context,
|
|
)
|
|
)
|
|
if getattr(result, 'rowcount', None) == 0:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
await self.ap.model_mgr.reload_provider(context, provider_uuid)
|
|
|
|
async def delete_provider(self, context: TenantContext, provider_uuid: str) -> None:
|
|
"""Delete a provider (only if no models reference it)"""
|
|
workspace_uuid = require_workspace_uuid(context)
|
|
# Check if any models use this provider
|
|
llm_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.LLMModel).where(
|
|
persistence_model.LLMModel.provider_uuid == provider_uuid
|
|
),
|
|
persistence_model.LLMModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
if llm_result.first() is not None:
|
|
raise ValueError('Cannot delete provider: LLM models still reference it')
|
|
|
|
embedding_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.EmbeddingModel).where(
|
|
persistence_model.EmbeddingModel.provider_uuid == provider_uuid
|
|
),
|
|
persistence_model.EmbeddingModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
if embedding_result.first() is not None:
|
|
raise ValueError('Cannot delete provider: Embedding models still reference it')
|
|
|
|
rerank_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.RerankModel).where(
|
|
persistence_model.RerankModel.provider_uuid == provider_uuid
|
|
),
|
|
persistence_model.RerankModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
if rerank_result.first() is not None:
|
|
raise ValueError('Cannot delete provider: Rerank models still reference it')
|
|
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.delete(persistence_model.ModelProvider).where(
|
|
persistence_model.ModelProvider.uuid == provider_uuid
|
|
),
|
|
persistence_model.ModelProvider,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
if getattr(result, 'rowcount', None) == 0:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
|
|
await self.ap.model_mgr.remove_provider(context, provider_uuid)
|
|
|
|
async def get_provider_model_counts(self, context: TenantContext, provider_uuid: str) -> dict:
|
|
"""Get count of models using this provider"""
|
|
workspace_uuid = require_workspace_uuid(context)
|
|
if await self.get_provider(context, provider_uuid) is None:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
llm_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(sqlalchemy.func.count())
|
|
.select_from(persistence_model.LLMModel)
|
|
.where(persistence_model.LLMModel.provider_uuid == provider_uuid),
|
|
persistence_model.LLMModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
llm_count = llm_result.scalar() or 0
|
|
|
|
embedding_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(sqlalchemy.func.count())
|
|
.select_from(persistence_model.EmbeddingModel)
|
|
.where(persistence_model.EmbeddingModel.provider_uuid == provider_uuid),
|
|
persistence_model.EmbeddingModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
embedding_count = embedding_result.scalar() or 0
|
|
|
|
rerank_result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(sqlalchemy.func.count())
|
|
.select_from(persistence_model.RerankModel)
|
|
.where(persistence_model.RerankModel.provider_uuid == provider_uuid),
|
|
persistence_model.RerankModel,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
rerank_count = rerank_result.scalar() or 0
|
|
|
|
return {'llm_count': llm_count, 'embedding_count': embedding_count, 'rerank_count': rerank_count}
|
|
|
|
async def find_or_create_provider(
|
|
self,
|
|
context: TenantContext,
|
|
requester: str,
|
|
base_url: str,
|
|
api_keys: list,
|
|
) -> str:
|
|
"""Find existing provider or create new one"""
|
|
workspace_uuid = require_workspace_uuid(context)
|
|
api_keys = self._normalize_api_keys(restore_secret_placeholders(api_keys, sensitive=True))
|
|
|
|
# Try to find existing provider with same config
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.select(persistence_model.ModelProvider).where(
|
|
persistence_model.ModelProvider.requester == requester,
|
|
persistence_model.ModelProvider.base_url == base_url,
|
|
),
|
|
persistence_model.ModelProvider,
|
|
workspace_uuid,
|
|
)
|
|
)
|
|
for provider in result.all():
|
|
if sorted(provider.api_keys or []) == sorted(api_keys or []):
|
|
return provider.uuid
|
|
|
|
# Create new provider
|
|
provider_name = requester
|
|
if base_url:
|
|
try:
|
|
from urllib.parse import urlparse
|
|
|
|
parsed = urlparse(base_url)
|
|
provider_name = parsed.netloc or requester
|
|
except Exception:
|
|
pass
|
|
|
|
return await self.create_provider(
|
|
context,
|
|
{
|
|
'name': provider_name,
|
|
'requester': requester,
|
|
'base_url': base_url,
|
|
'api_keys': api_keys,
|
|
},
|
|
)
|
|
|
|
async def update_space_model_provider_api_keys(self, context: TenantContext, api_key: str) -> None:
|
|
"""Update Space model provider API keys"""
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
scope_statement(
|
|
sqlalchemy.update(persistence_model.ModelProvider)
|
|
.where(persistence_model.ModelProvider.uuid == '00000000-0000-0000-0000-000000000000')
|
|
.values(api_keys=self._normalize_api_keys(api_key)),
|
|
persistence_model.ModelProvider,
|
|
context,
|
|
)
|
|
)
|
|
if getattr(result, 'rowcount', None) == 0:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
await self.ap.model_mgr.reload_provider(context, '00000000-0000-0000-0000-000000000000')
|
|
|
|
async def scan_provider_models(
|
|
self, context: TenantContext, provider_uuid: str, model_type: str | None = None
|
|
) -> dict:
|
|
provider = await self.get_provider(context, provider_uuid, include_secret=True)
|
|
if provider is None:
|
|
raise WorkspaceNotFoundError('Provider not found')
|
|
|
|
runtime_provider = await self.ap.model_mgr.load_provider(context, provider)
|
|
|
|
try:
|
|
scan_result = await runtime_provider.requester.scan_models(
|
|
runtime_provider.token_mgr.get_token() if runtime_provider.token_mgr.tokens else None
|
|
)
|
|
except NotImplementedError:
|
|
raise ValueError('current provider does not support model scanning')
|
|
except Exception as exc:
|
|
self.ap.logger.warning(
|
|
f'Failed to scan models for provider {provider_uuid}: {exc}\n{traceback.format_exc()}'
|
|
)
|
|
raise ValueError(str(exc)) from exc
|
|
|
|
if isinstance(scan_result, dict):
|
|
scanned_models = scan_result.get('models', [])
|
|
debug_info = scan_result.get('debug')
|
|
else:
|
|
scanned_models = scan_result
|
|
debug_info = None
|
|
|
|
llm_models = await self.ap.llm_model_service.get_llm_models_by_provider(context, provider_uuid)
|
|
embedding_models = await self.ap.embedding_models_service.get_embedding_models_by_provider(
|
|
context, provider_uuid
|
|
)
|
|
rerank_service = getattr(self.ap, 'rerank_models_service', None)
|
|
rerank_models = (
|
|
await rerank_service.get_rerank_models_by_provider(context, provider_uuid)
|
|
if rerank_service is not None
|
|
else []
|
|
)
|
|
existing_llm_names = {model['name'] for model in llm_models}
|
|
existing_embedding_names = {model['name'] for model in embedding_models}
|
|
existing_rerank_names = {model['name'] for model in rerank_models}
|
|
|
|
filtered_models = []
|
|
for model in scanned_models:
|
|
scanned_type = model.get('type', 'llm')
|
|
if model_type and scanned_type != model_type:
|
|
continue
|
|
|
|
model_name = model.get('name') or model.get('id')
|
|
if not model_name:
|
|
continue
|
|
|
|
filtered_models.append(
|
|
{
|
|
'id': model.get('id', model_name),
|
|
'name': model_name,
|
|
'type': scanned_type,
|
|
'abilities': model.get('abilities', []),
|
|
'display_name': model.get('display_name'),
|
|
'description': model.get('description'),
|
|
'context_length': model.get('context_length'),
|
|
'owned_by': model.get('owned_by'),
|
|
'input_modalities': model.get('input_modalities', []),
|
|
'output_modalities': model.get('output_modalities', []),
|
|
'already_added': (
|
|
model_name in existing_embedding_names
|
|
if scanned_type == 'embedding'
|
|
else model_name in existing_rerank_names
|
|
if scanned_type == 'rerank'
|
|
else model_name in existing_llm_names
|
|
),
|
|
}
|
|
)
|
|
|
|
return {'models': filtered_models, 'debug': debug_info}
|