mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-11-15 07:41:20 +00:00
085b52b5f3
* fix(gateway): match conversation reference URLs on the addressed host A conversation URL reference was accepted only when its (scheme, netloc) equalled Gateway's request.url. Behind TLS that URL is often http: Docker Compose and Helm run uvicorn without FORWARDED_ALLOW_IPS, so nginx's X-Forwarded-Proto from another container is ignored, and nginx.local.conf resends its own $scheme. The browser's https chat link then got a 422, and so did an explicit :443 or a differently cased host. Resolve the run request's origin with _request_origin(), as the CSRF check does (Forwarded / X-Forwarded-Host / Host), normalize the reference's origin the same way, and compare host and port only. The scheme cannot tell two deployments on the same host apart, and URLs remain owner-bound local selectors that are never fetched. * test(gateway): cover forwarded port, IPv6 and fragment for conversation URLs Name X-Forwarded-Port in the API.md reference contract: it is appended when the forwarded host has no port, so a stray value causes a 422. * test(runtime): synchronize PostgreSQL lease expiration with row lock --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>