mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 12:40:59 +00:00
e1ac5e0fc8
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
269 lines
8.9 KiB
TypeScript
269 lines
8.9 KiB
TypeScript
import { Button } from '@/components/ui/button';
|
|
import { Input } from '@/components/ui/input';
|
|
import {
|
|
Card,
|
|
CardContent,
|
|
CardHeader,
|
|
CardTitle,
|
|
CardDescription,
|
|
} from '@/components/ui/card';
|
|
import { LanguageSelector } from '@/components/ui/language-selector';
|
|
import { useForm } from 'react-hook-form';
|
|
import { zodResolver } from '@hookform/resolvers/zod';
|
|
import * as z from 'zod';
|
|
import {
|
|
Form,
|
|
FormControl,
|
|
FormField,
|
|
FormItem,
|
|
FormLabel,
|
|
FormMessage,
|
|
} from '@/components/ui/form';
|
|
import { useEffect, useState } from 'react';
|
|
import { httpClient } from '@/app/infra/http/HttpClient';
|
|
import { useNavigate } from 'react-router-dom';
|
|
import { Mail, Lock, Loader2, Info, Layers } from 'lucide-react';
|
|
import {
|
|
Popover,
|
|
PopoverContent,
|
|
PopoverTrigger,
|
|
} from '@/components/ui/popover';
|
|
import langbotIcon from '@/app/assets/langbot-logo.webp';
|
|
import { toast } from 'sonner';
|
|
import { useTranslation } from 'react-i18next';
|
|
import { ThemeToggle } from '@/components/ui/theme-toggle';
|
|
import { CustomApiError } from '@/app/infra/entities/common';
|
|
|
|
const formSchema = (t: (key: string) => string) =>
|
|
z.object({
|
|
email: z.string().email(t('common.invalidEmail')),
|
|
password: z.string().min(1, t('common.emptyPassword')),
|
|
});
|
|
|
|
export default function Register() {
|
|
const navigate = useNavigate();
|
|
const { t } = useTranslation();
|
|
const [spaceLoading, setSpaceLoading] = useState(false);
|
|
const [passwordRegistrationEnabled, setPasswordRegistrationEnabled] =
|
|
useState(true);
|
|
|
|
const form = useForm<z.infer<ReturnType<typeof formSchema>>>({
|
|
resolver: zodResolver(formSchema(t)),
|
|
defaultValues: {
|
|
email: '',
|
|
password: '',
|
|
},
|
|
});
|
|
|
|
useEffect(() => {
|
|
getIsInitialized();
|
|
httpClient
|
|
.getAccountInfo()
|
|
.then((info) =>
|
|
setPasswordRegistrationEnabled(info.password_login_enabled !== false),
|
|
)
|
|
.catch(() => setPasswordRegistrationEnabled(true));
|
|
}, []);
|
|
|
|
function getIsInitialized() {
|
|
httpClient
|
|
.checkIfInited()
|
|
.then((res) => {
|
|
if (res.initialized) {
|
|
navigate('/login');
|
|
}
|
|
})
|
|
.catch(() => {});
|
|
}
|
|
|
|
function onSubmit(values: z.infer<ReturnType<typeof formSchema>>) {
|
|
handleRegister(values.email, values.password);
|
|
}
|
|
|
|
function handleRegister(username: string, password: string) {
|
|
httpClient
|
|
.initUser(username, password)
|
|
.then(() => {
|
|
toast.success(t('register.initSuccess'));
|
|
navigate('/login');
|
|
})
|
|
.catch((err: Error) => {
|
|
toast.error(t('register.initFailed') + (err as CustomApiError).msg);
|
|
});
|
|
}
|
|
|
|
// Space OAuth redirect handler
|
|
const handleSpaceLoginClick = async () => {
|
|
setSpaceLoading(true);
|
|
|
|
try {
|
|
// Build the redirect URI to the OAuth callback page
|
|
const currentOrigin = window.location.origin;
|
|
const redirectUri = `${currentOrigin}/auth/space/callback`;
|
|
|
|
// Get the authorization URL from backend
|
|
const response = await httpClient.getSpaceAuthorizeUrl(redirectUri);
|
|
|
|
// Redirect to Space authorization page
|
|
window.location.href = response.authorize_url;
|
|
} catch {
|
|
toast.error(t('common.spaceLoginFailed'));
|
|
setSpaceLoading(false);
|
|
}
|
|
};
|
|
|
|
return (
|
|
<div className="min-h-screen flex items-center justify-center bg-gray-50 dark:bg-neutral-900">
|
|
<Card className="w-[375px] shadow-lg dark:shadow-white/10">
|
|
<CardHeader>
|
|
<div className="flex justify-between items-center mb-6">
|
|
<ThemeToggle />
|
|
<LanguageSelector />
|
|
</div>
|
|
<img
|
|
src={langbotIcon}
|
|
alt="LangBot"
|
|
className="w-16 h-16 mb-4 mx-auto"
|
|
/>
|
|
<CardTitle className="text-2xl text-center">
|
|
{t('register.title')}
|
|
</CardTitle>
|
|
<CardDescription className="text-center">
|
|
{t('register.description')}
|
|
<br />
|
|
{t('register.adminAccountNote')}
|
|
</CardDescription>
|
|
</CardHeader>
|
|
<CardContent className="space-y-6">
|
|
{/* Space Login - Recommended */}
|
|
<div className="space-y-3">
|
|
<Button
|
|
type="button"
|
|
className="w-full cursor-pointer"
|
|
onClick={handleSpaceLoginClick}
|
|
disabled={spaceLoading}
|
|
>
|
|
{spaceLoading ? (
|
|
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
|
|
) : (
|
|
<Layers className="mr-2 h-4 w-4" />
|
|
)}
|
|
{t('register.initWithSpace')}
|
|
</Button>
|
|
<p className="text-xs text-center text-muted-foreground flex items-center justify-center gap-1">
|
|
{t('register.spaceRecommended')}
|
|
<Popover>
|
|
<PopoverTrigger asChild>
|
|
<Info className="h-3.5 w-3.5 cursor-pointer hover:text-foreground transition-colors" />
|
|
</PopoverTrigger>
|
|
<PopoverContent side="right" className="w-80 text-sm">
|
|
<ul className="space-y-2 list-disc list-inside text-muted-foreground">
|
|
<li>{t('register.spaceInfoTip1')}</li>
|
|
<li>{t('register.spaceInfoTip2')}</li>
|
|
<li>{t('register.spaceInfoTip3')}</li>
|
|
</ul>
|
|
</PopoverContent>
|
|
</Popover>
|
|
</p>
|
|
</div>
|
|
|
|
{passwordRegistrationEnabled && (
|
|
<>
|
|
<div className="relative">
|
|
<div className="absolute inset-0 flex items-center">
|
|
<span className="w-full border-t" />
|
|
</div>
|
|
<div className="relative flex justify-center text-xs uppercase">
|
|
<span className="bg-white dark:bg-card px-2 text-muted-foreground">
|
|
{t('common.or')}
|
|
</span>
|
|
</div>
|
|
</div>
|
|
|
|
{/* Local Account Registration */}
|
|
<Form {...form}>
|
|
<form
|
|
onSubmit={form.handleSubmit(onSubmit)}
|
|
className="space-y-6"
|
|
>
|
|
<FormField
|
|
control={form.control}
|
|
name="email"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>{t('common.email')}</FormLabel>
|
|
<FormControl>
|
|
<div className="relative">
|
|
<Mail className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
|
|
<Input
|
|
placeholder={t('common.enterEmail')}
|
|
className="pl-10"
|
|
{...field}
|
|
/>
|
|
</div>
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
|
|
<FormField
|
|
control={form.control}
|
|
name="password"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>{t('common.password')}</FormLabel>
|
|
<FormControl>
|
|
<div className="relative">
|
|
<Lock className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
|
|
<Input
|
|
type="password"
|
|
placeholder={t('common.enterPassword')}
|
|
className="pl-10"
|
|
{...field}
|
|
/>
|
|
</div>
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
|
|
<Button
|
|
type="submit"
|
|
variant="outline"
|
|
className="w-full cursor-pointer"
|
|
>
|
|
{t('register.registerWithPassword')}
|
|
</Button>
|
|
</form>
|
|
</Form>
|
|
</>
|
|
)}
|
|
|
|
<p className="text-xs text-center text-muted-foreground">
|
|
{t('common.agreementNotice')}{' '}
|
|
<a
|
|
href="https://langbot.app/privacy"
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
className="underline hover:text-foreground transition-colors"
|
|
>
|
|
{t('common.privacyPolicy')}
|
|
</a>{' '}
|
|
{t('common.and')}{' '}
|
|
<a
|
|
href={t('common.dataCollectionPolicyUrl')}
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
className="underline hover:text-foreground transition-colors"
|
|
>
|
|
{t('common.dataCollectionPolicy')}
|
|
</a>
|
|
</p>
|
|
</CardContent>
|
|
</Card>
|
|
</div>
|
|
);
|
|
}
|