mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-08 20:30:59 +00:00
e1ac5e0fc8
* Document multi-tenant workspace architecture * Add OSS and commercial workspace boundaries * docs: redesign multi-tenant workspace architecture * feat(tenancy): implement workspace isolation * docs(tenancy): record verification evidence * docs(tenancy): revise single-instance SaaS topology * docs(tenancy): refine architecture options * docs: finalize cloud v2 multi-tenant decisions * feat(tenancy): establish cloud isolation foundations * feat(tenancy): harden shared cloud runtime boundaries * docs(tenancy): record final isolation verification * fix(tenancy): close isolation and permission gaps * docs(tenancy): record final isolation verification * feat(tenancy): connect cloud workspace control plane * fix(build): install git for pinned SDK * docs(cloud): update control plane verification * chore: update multi-tenant SDK pin * fix(cloud): skip legacy model sync during startup * test(cloud): preserve minimal model manager fixtures * fix(cloud): preserve authenticated account context * fix(cloud): reuse authenticated account for user info * feat(cloud): complete Workspace settings navigation * test(web): cover Workspace dropdown menu * feat(web): place workspace controls in sidebar * refactor(web): streamline workspace controls * style(web): format workspace layout test * fix(cloud): surface runtime and workspace plan status * fix(plugin): keep runtime identity stable across restarts * fix(ui): widen and center workspace switcher * fix(ui): hide roles from workspace switcher * fix(ui): align workspace switcher with sidebar entries * feat(workspace): add in-product collaboration and direct Cloud launch * style: format collaboration changes * fix(workspace): bind collaboration APIs to tenant UoW * fix(cloud): preserve Core-owned collaboration state * test(cloud): require Space identity for invite registration * feat(cloud): complete secure invitation experience * style(web): format invitation flows * fix(cloud): recover box runtime without unscoped skill reload * feat(oss): enforce invitation account and owner billing flows * style: format OSS account service * test(oss): cover invitation logout handoff * fix(oss): resolve workspace owner in scoped session * feat(cloud): harden multi-tenant runtime resources * fix(cloud): bound runtime restart storms * fix(cloud): eliminate periodic runtime CPU spikes * fix(cloud): enforce instance capacity ceilings * fix(cloud): scope public login capability discovery * fix(cloud): bound tenant maintenance and monitoring work * fix(runtime): bound tenant resource amplification * fix(deps): pin green multi-tenant plugin SDK * fix(cloud): handle unavailable skill capability * fix(security): require authentication for image file endpoint (H-2) - Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY - Added Permission.RESOURCE_VIEW requirement - Prevents unauthenticated cross-tenant file access via leaked keys - Fixes HIGH severity finding from multi-tenant security review docs: add comprehensive database migration guide - Complete migration steps for OSS → multi-tenant - Backup, execution, verification procedures - Rollback scenarios and recovery plans - Performance tuning recommendations * test: add comprehensive cross-tenant isolation tests Added 7 critical test scenarios for multi-tenant boundaries: - Cross-tenant bot access prevention - Viewer role read-only enforcement - Removed member immediate access revocation - Model provider credential isolation - WebSocket message isolation - Invitation token workspace scoping - Multi-workspace context validation These tests address P0-2 coverage gaps for: - workspaces.py (membership & invitation flows) - user.py (authentication & authorization) - websocket_chat.py (real-time isolation) - plugins.py (resource access control) docs: finalize database migration guide * fix(security): resolve M-1, M-2, M-3 security findings M-1: WebSocket authorization TOCTOU race (FIXED) - Changed _revalidate_websocket_authorization to return RequestContext - Ensures validated context is used immediately without race window - Prevents removed members from sending messages during revalidation gap M-2: Model Manager cache workspace isolation (VERIFIED) - Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource) - Cache is properly scoped per workspace, no cross-tenant leakage possible - No code change needed, documented as working correctly M-3: Invitation lock workspace scoping (FIXED) - Changed lock key from token_digest to workspace_uuid:token_digest - Prevents DoS where attacker locks token in Workspace A to block Workspace B - Locks now isolated per workspace All MEDIUM severity findings from security review now resolved. * fix(cloud): unblock tenant CI and enforce knowledge quotas * fix(tenancy): scope rerank model sync --------- Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>
225 lines
9.0 KiB
Python
225 lines
9.0 KiB
Python
from __future__ import annotations
|
|
|
|
from collections import OrderedDict
|
|
|
|
from langbot.pkg.utils import httpclient
|
|
import typing
|
|
import datetime
|
|
import time
|
|
import sqlalchemy
|
|
|
|
from ....core import app
|
|
from ....entity.persistence import user
|
|
from ....entity.dto.space_model import SpaceModel
|
|
|
|
|
|
_CREDITS_CACHE_TTL_SECONDS = 60
|
|
_CREDITS_CACHE_MAX_ENTRIES = 4096
|
|
|
|
|
|
class SpaceService:
|
|
"""Service for interacting with LangBot Space API"""
|
|
|
|
ap: app.Application
|
|
_credits_cache: typing.Dict[str, typing.Tuple[int, float]] # {user_email: (credits, timestamp)}
|
|
|
|
def __init__(self, ap: app.Application) -> None:
|
|
self.ap = ap
|
|
self._credits_cache = OrderedDict()
|
|
|
|
def _ordered_credits_cache(
|
|
self,
|
|
) -> OrderedDict[str, tuple[int, float]]:
|
|
if not isinstance(self._credits_cache, OrderedDict):
|
|
# Preserve compatibility with tests and callers that seed the cache.
|
|
self._credits_cache = OrderedDict(self._credits_cache)
|
|
return self._credits_cache
|
|
|
|
def _prune_credits_cache(self, now: float) -> None:
|
|
cache = self._ordered_credits_cache()
|
|
while cache:
|
|
email = next(iter(cache))
|
|
_, cached_at = cache[email]
|
|
if now - cached_at < _CREDITS_CACHE_TTL_SECONDS:
|
|
break
|
|
cache.pop(email, None)
|
|
|
|
def _get_space_config(self) -> typing.Dict[str, str]:
|
|
"""Get Space configuration from config file"""
|
|
space_config = self.ap.instance_config.data.get('space', {})
|
|
return {
|
|
'url': space_config.get('url', 'https://space.langbot.app'),
|
|
'oauth_authorize_url': space_config.get('oauth_authorize_url', 'https://space.langbot.app/auth/authorize'),
|
|
}
|
|
|
|
async def _get_user_by_email(self, user_email: str) -> user.User | None:
|
|
result = await self.ap.persistence_mgr.execute_async(
|
|
sqlalchemy.select(user.User).where(user.User.user == user_email)
|
|
)
|
|
result_list = result.all()
|
|
return result_list[0] if result_list else None
|
|
|
|
async def _ensure_valid_token(self, user_email: str) -> str | None:
|
|
"""Ensure access token is valid, refresh if expired. Returns valid access_token or None."""
|
|
user_obj = await self._get_user_by_email(user_email)
|
|
if not user_obj or user_obj.account_type != 'space':
|
|
return None
|
|
|
|
if not user_obj.space_access_token:
|
|
return None
|
|
|
|
# Check if token is expired (with 60s buffer)
|
|
if user_obj.space_access_token_expires_at:
|
|
if datetime.datetime.now() >= user_obj.space_access_token_expires_at - datetime.timedelta(seconds=60):
|
|
# Token expired, try to refresh
|
|
if user_obj.space_refresh_token:
|
|
try:
|
|
new_token = await self._refresh_and_save_token(user_obj)
|
|
return new_token
|
|
except Exception:
|
|
return None
|
|
return None
|
|
|
|
return user_obj.space_access_token
|
|
|
|
async def _refresh_and_save_token(self, user_obj: user.User) -> str:
|
|
"""Refresh token and save to database"""
|
|
token_data = await self.refresh_token(user_obj.space_refresh_token)
|
|
access_token = token_data.get('access_token')
|
|
expires_in = token_data.get('expires_in', 0)
|
|
|
|
if not access_token:
|
|
raise ValueError('Failed to refresh token')
|
|
|
|
expires_at = datetime.datetime.now() + datetime.timedelta(seconds=expires_in) if expires_in > 0 else None
|
|
|
|
await self.ap.persistence_mgr.execute_async(
|
|
sqlalchemy.update(user.User)
|
|
.where(user.User.user == user_obj.user)
|
|
.values(
|
|
space_access_token=access_token,
|
|
space_access_token_expires_at=expires_at,
|
|
)
|
|
)
|
|
|
|
return access_token
|
|
|
|
# === Raw API calls (no token validation) ===
|
|
|
|
def get_oauth_authorize_url(self, redirect_uri: str, state: str = '') -> str:
|
|
"""Get the Space OAuth authorization URL for redirect"""
|
|
from urllib.parse import urlencode
|
|
|
|
space_config = self._get_space_config()
|
|
authorize_url = space_config['oauth_authorize_url']
|
|
params = {'redirect_uri': redirect_uri}
|
|
if state:
|
|
params['state'] = state
|
|
return f'{authorize_url}?{urlencode(params)}'
|
|
|
|
async def exchange_oauth_code(self, code: str) -> typing.Dict:
|
|
"""Exchange OAuth authorization code for tokens"""
|
|
from langbot.pkg.utils import constants
|
|
|
|
space_config = self._get_space_config()
|
|
space_url = space_config['url']
|
|
|
|
session = httpclient.get_session()
|
|
async with session.post(
|
|
f'{space_url}/api/v1/accounts/oauth/token',
|
|
json={'code': code, 'instance_id': constants.instance_id},
|
|
) as response:
|
|
if response.status != 200:
|
|
error = await httpclient.read_text_limited(response)
|
|
raise ValueError(f'Failed to exchange OAuth code: {error}')
|
|
data = await httpclient.read_json_limited(response)
|
|
if data.get('code') != 0:
|
|
raise ValueError(f'Failed to exchange OAuth code: {data.get("msg")}')
|
|
return data.get('data', {})
|
|
|
|
async def refresh_token(self, refresh_token: str) -> typing.Dict:
|
|
"""Refresh Space access token"""
|
|
space_config = self._get_space_config()
|
|
space_url = space_config['url']
|
|
|
|
session = httpclient.get_session()
|
|
async with session.post(
|
|
f'{space_url}/api/v1/accounts/token/refresh', json={'refresh_token': refresh_token}
|
|
) as response:
|
|
if response.status != 200:
|
|
error = await httpclient.read_text_limited(response)
|
|
raise ValueError(f'Failed to refresh token: {error}')
|
|
data = await httpclient.read_json_limited(response)
|
|
if data.get('code') != 0:
|
|
raise ValueError(f'Failed to refresh token: {data.get("msg")}')
|
|
return data.get('data', {})
|
|
|
|
async def get_user_info_raw(self, access_token: str) -> typing.Dict:
|
|
"""Get user info from Space using access token (no validation)"""
|
|
space_config = self._get_space_config()
|
|
space_url = space_config['url']
|
|
|
|
session = httpclient.get_session()
|
|
async with session.get(
|
|
f'{space_url}/api/v1/accounts/me', headers={'Authorization': f'Bearer {access_token}'}
|
|
) as response:
|
|
if response.status != 200:
|
|
error = await httpclient.read_text_limited(response)
|
|
raise ValueError(f'Failed to get user info: {error}')
|
|
data = await httpclient.read_json_limited(response)
|
|
if data.get('code') != 0:
|
|
raise ValueError(f'Failed to get user info: {data.get("msg")}')
|
|
return data.get('data', {})
|
|
|
|
# === API calls with token validation ===
|
|
|
|
async def get_user_info(self, user_email: str) -> typing.Dict | None:
|
|
"""Get user info from Space (with token validation)"""
|
|
access_token = await self._ensure_valid_token(user_email)
|
|
if not access_token:
|
|
return None
|
|
return await self.get_user_info_raw(access_token)
|
|
|
|
async def get_credits(self, user_email: str, force_refresh: bool = False) -> int | None:
|
|
"""Get Space credits for user with caching (60s TTL)"""
|
|
now = time.time()
|
|
cached_fallback = self._credits_cache.get(user_email)
|
|
self._prune_credits_cache(now)
|
|
|
|
if not force_refresh and user_email in self._credits_cache:
|
|
credits, ts = self._credits_cache[user_email]
|
|
if now - ts < _CREDITS_CACHE_TTL_SECONDS:
|
|
return credits
|
|
|
|
try:
|
|
info = await self.get_user_info(user_email)
|
|
if info is None:
|
|
return None
|
|
credits = info.get('credits')
|
|
if credits is not None:
|
|
cache = self._ordered_credits_cache()
|
|
cache.pop(user_email, None)
|
|
if len(cache) >= _CREDITS_CACHE_MAX_ENTRIES:
|
|
cache.popitem(last=False)
|
|
cache[user_email] = (credits, time.time())
|
|
return credits
|
|
except Exception:
|
|
return cached_fallback[0] if cached_fallback is not None else None
|
|
|
|
async def get_models(self) -> typing.List[SpaceModel]:
|
|
"""Get models from Space"""
|
|
|
|
space_config = self._get_space_config()
|
|
space_url = space_config['url']
|
|
|
|
session = httpclient.get_session()
|
|
async with session.get(f'{space_url}/api/v1/models', params={'page_size': 100}) as response:
|
|
if response.status != 200:
|
|
error = await httpclient.read_text_limited(response)
|
|
raise ValueError(f'Failed to get models: {error}')
|
|
data = await httpclient.read_json_limited(response)
|
|
if data.get('code') != 0:
|
|
raise ValueError(f'Failed to get models: {data.get("msg")}')
|
|
models_data = data.get('data', {}).get('models', [])
|
|
return [SpaceModel.model_validate(model_dict) for model_dict in models_data]
|