mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-09 04:40:57 +00:00
e1ac5e0fc8
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
212 lines
7.5 KiB
Python
212 lines
7.5 KiB
Python
import json
|
|
import asyncio
|
|
import aiohttp
|
|
import io
|
|
from typing import Dict, List, Any, AsyncGenerator
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from langbot.pkg.utils import httpclient
|
|
|
|
_MAX_COZE_RESPONSE_BYTES = 16 * 1024 * 1024
|
|
_MAX_COZE_EVENT_BYTES = 1024 * 1024
|
|
_MAX_COZE_MEDIA_BYTES = 10 * 1024 * 1024
|
|
|
|
|
|
def _read_local_media_limited(path: Path) -> bytes:
|
|
if path.stat().st_size > _MAX_COZE_MEDIA_BYTES:
|
|
raise ValueError('Coze upload exceeds the size limit')
|
|
with path.open('rb') as handle:
|
|
body = handle.read(_MAX_COZE_MEDIA_BYTES + 1)
|
|
if len(body) > _MAX_COZE_MEDIA_BYTES:
|
|
raise ValueError('Coze upload exceeds the size limit')
|
|
return body
|
|
|
|
|
|
class AsyncCozeAPIClient:
|
|
def __init__(self, api_key: str, api_base: str = 'https://api.coze.cn'):
|
|
self.api_key = api_key
|
|
self.api_base = api_base
|
|
self.session = None
|
|
|
|
async def __aenter__(self):
|
|
"""支持异步上下文管理器"""
|
|
await self.coze_session()
|
|
return self
|
|
|
|
async def __aexit__(self, exc_type, exc_val, exc_tb):
|
|
"""退出时自动关闭会话"""
|
|
await self.close()
|
|
|
|
async def coze_session(self):
|
|
"""确保HTTP session存在"""
|
|
if self.session is None:
|
|
connector = aiohttp.TCPConnector(
|
|
ssl=False if self.api_base.startswith('http://') else True,
|
|
limit=100,
|
|
limit_per_host=30,
|
|
keepalive_timeout=30,
|
|
enable_cleanup_closed=True,
|
|
)
|
|
timeout = aiohttp.ClientTimeout(
|
|
total=120, # 默认超时时间
|
|
connect=30,
|
|
sock_read=120,
|
|
)
|
|
headers = {
|
|
'Authorization': f'Bearer {self.api_key}',
|
|
'Accept': 'text/event-stream',
|
|
}
|
|
self.session = aiohttp.ClientSession(headers=headers, timeout=timeout, connector=connector)
|
|
return self.session
|
|
|
|
async def close(self):
|
|
"""显式关闭会话"""
|
|
if self.session and not self.session.closed:
|
|
await self.session.close()
|
|
self.session = None
|
|
|
|
async def upload(
|
|
self,
|
|
file,
|
|
) -> str:
|
|
# 处理 Path 对象
|
|
if isinstance(file, Path):
|
|
if not file.exists():
|
|
raise ValueError(f'File not found: {file}')
|
|
file = await asyncio.to_thread(_read_local_media_limited, file)
|
|
|
|
# 处理文件路径字符串
|
|
elif isinstance(file, str):
|
|
if not os.path.isfile(file):
|
|
raise ValueError(f'File not found: {file}')
|
|
file = await asyncio.to_thread(
|
|
_read_local_media_limited,
|
|
Path(file),
|
|
)
|
|
|
|
# 处理文件对象
|
|
elif hasattr(file, 'read'):
|
|
file = await asyncio.to_thread(file.read, _MAX_COZE_MEDIA_BYTES + 1)
|
|
if not isinstance(file, (bytes, bytearray)):
|
|
raise ValueError('Unsupported Coze upload type')
|
|
if len(file) > _MAX_COZE_MEDIA_BYTES:
|
|
raise ValueError('Coze upload exceeds the size limit')
|
|
|
|
session = await self.coze_session()
|
|
url = f'{self.api_base}/v1/files/upload'
|
|
|
|
try:
|
|
file_io = io.BytesIO(file)
|
|
async with session.post(
|
|
url,
|
|
data={
|
|
'file': file_io,
|
|
},
|
|
timeout=aiohttp.ClientTimeout(total=60),
|
|
) as response:
|
|
if response.status == 401:
|
|
raise Exception('Coze API 认证失败,请检查 API Key 是否正确')
|
|
|
|
response_text = (
|
|
await httpclient.read_limited(
|
|
response,
|
|
max_bytes=_MAX_COZE_EVENT_BYTES,
|
|
)
|
|
).decode('utf-8', errors='replace')
|
|
|
|
if response.status != 200:
|
|
raise Exception(f'文件上传失败,状态码: {response.status}, 响应: {response_text}')
|
|
try:
|
|
result = json.loads(response_text)
|
|
except (json.JSONDecodeError, TypeError):
|
|
raise Exception(f'文件上传响应解析失败: {response_text}')
|
|
|
|
if result.get('code') != 0:
|
|
raise Exception(f'文件上传失败: {result.get("msg", "未知错误")}')
|
|
|
|
file_id = result['data']['id']
|
|
return file_id
|
|
|
|
except asyncio.TimeoutError:
|
|
raise Exception('文件上传超时')
|
|
except Exception as e:
|
|
raise Exception(f'文件上传失败: {str(e)}')
|
|
|
|
async def chat_messages(
|
|
self,
|
|
bot_id: str,
|
|
user_id: str,
|
|
additional_messages: List[Dict] | None = None,
|
|
conversation_id: str | None = None,
|
|
auto_save_history: bool = True,
|
|
stream: bool = True,
|
|
timeout: float = 120,
|
|
) -> AsyncGenerator[Dict[str, Any], None]:
|
|
"""发送聊天消息并返回流式响应
|
|
|
|
Args:
|
|
bot_id: Bot ID
|
|
user_id: 用户ID
|
|
additional_messages: 额外消息列表
|
|
conversation_id: 会话ID
|
|
auto_save_history: 是否自动保存历史
|
|
stream: 是否流式响应
|
|
timeout: 超时时间
|
|
"""
|
|
session = await self.coze_session()
|
|
url = f'{self.api_base}/v3/chat'
|
|
|
|
payload = {
|
|
'bot_id': bot_id,
|
|
'user_id': user_id,
|
|
'stream': stream,
|
|
'auto_save_history': auto_save_history,
|
|
}
|
|
|
|
if additional_messages:
|
|
payload['additional_messages'] = additional_messages
|
|
|
|
params = {}
|
|
if conversation_id:
|
|
params['conversation_id'] = conversation_id
|
|
|
|
try:
|
|
async with session.post(
|
|
url,
|
|
json=payload,
|
|
params=params,
|
|
timeout=aiohttp.ClientTimeout(total=timeout),
|
|
) as response:
|
|
if response.status == 401:
|
|
raise Exception('Coze API 认证失败,请检查 API Key 是否正确')
|
|
|
|
if response.status != 200:
|
|
raise Exception(f'Coze API 流式请求失败,状态码: {response.status}')
|
|
|
|
total_bytes = 0
|
|
chunk_type = 'message'
|
|
chunk_data = ''
|
|
async for chunk in response.content:
|
|
total_bytes += len(chunk)
|
|
if total_bytes > _MAX_COZE_RESPONSE_BYTES:
|
|
raise Exception('Coze API stream exceeds the runtime limit')
|
|
if len(chunk) > _MAX_COZE_EVENT_BYTES:
|
|
raise Exception('Coze API event exceeds the runtime limit')
|
|
chunk = chunk.decode('utf-8')
|
|
if chunk != '\n':
|
|
if chunk.startswith('event:'):
|
|
chunk_type = chunk.replace('event:', '', 1).strip()
|
|
elif chunk.startswith('data:'):
|
|
chunk_data = chunk.replace('data:', '', 1).strip()
|
|
else:
|
|
yield {
|
|
'event': chunk_type,
|
|
'data': json.loads(chunk_data) if chunk_data else {},
|
|
} # 处理本地部署时,接口返回的data为空值
|
|
|
|
except asyncio.TimeoutError:
|
|
raise Exception(f'Coze API 流式请求超时 ({timeout}秒)')
|
|
except Exception as e:
|
|
raise Exception(f'Coze API 流式请求失败: {str(e)}')
|