mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-25 14:06:18 +00:00
1b2898c367
* fix(authz): cover create/run/memory/agent routes with permission checks; scope USER.md per user
Route permissions: the AuthorizationProvider model only applied to routes
carrying @require_permission, so POST /api/threads, /api/threads/search,
POST /api/runs/stream and /api/runs/wait (runs:create), every /api/memory
route and the custom-agent routes ran with authentication only — a
provider configured to deny threads:write/runs:create/... could not
enforce those decisions. Add the missing decorators (threads:write,
threads:read, runs:create, memory:read/write, agents:read/write) and
register the new permission names in authz.Permissions. No owner checks
are added: per-user data scoping stays in the repository layer.
User profile: GET/PUT /api/user-profile read and wrote a single global
{base_dir}/USER.md, so in a multi-user deployment any authenticated user
could overwrite the prompt context injected for everyone else (and read
it). Scope the file to the caller's bucket
({base_dir}/users/{user_id}/USER.md) like user-scoped skills; no other
consumer of the old global path exists in the tree (verified by grep and
the updated tests). test_put_user_profile asserted the wrong effective
user under the autouse conftest user fixture; fixed to test-user-autouse.
* fix(authz): bind positional args in require_permission; migrate legacy USER.md
Review follow-up on #4989 (willem-bd):
- require_permission's wrapper only looked for request in keyword
arguments, so direct positional calls like
create_thread(body, request) made the injected keyword stub collide
with the positional request (TypeError: multiple values). The wrapper
now binds the wrapped signature via inspect.signature().bind() and
honors a positionally-passed request (and thread_id) instead of
assuming kwargs; the test-stub injection only fires when request is
absent everywhere. The two positional callers in
tests/test_threads_router.py pass again (8/8 channel tests).
- migrate_user_isolation.py now claims the legacy global USER.md for
--user-id (default 'default') like the other unowned legacy
artifacts; without it, upgrading installs with an existing profile
would read content: null and later strand the old file beside the
new per-user one. Conflict handling mirrors migrate_memory (rename to
USER.legacy.md).
* style(scripts): keep migrate_user_isolation help within the line budget
* test(authz): give internal-request stubs realistic auth fields
The create_thread permission wrapper added in this PR authenticates
the direct calls in the internal-owner tests; their SimpleNamespace
requests had state.user but no auth_source and no cookies, so
get_current_user_from_request fell through to request.cookies.get and
raised AttributeError (verified introduced by this branch: both tests
pass on the base commit).
The stubs now carry cookies={} and
state.auth_source=AUTH_SOURCE_INTERNAL, which is exactly what
AuthMiddleware stamps on real internal requests, so state.user is
honored without the JWT path. All 80 tests in the file pass.
* fix(pat): keep memory/agent permissions out of PAT scopes by design
The route permissions exist (they guard the memory/agent routers) but PATs
govern the thread/run lifecycle only: _PAT_ROUTE_RULES default-denies those
routers for PAT callers regardless of scopes. The alignment invariant
becomes a subset check plus a pinned exclusion, and pat.py documents that
opening these scopes is a product decision requiring three synchronized
changes.
* test/docs: cover migrate_user_profile; drop the unclaimed USER.md injection wording
Five-scenario test class mirroring the sibling migration steps (move,
conflict-rename, noop, both under dry-run). The GET/PUT descriptions no
longer say USER.md is 'injected into agents' — nothing at this head consumes
it for prompts; the routes are storage/retrieval only. The memory AGENTS.md
migration pointer now enumerates skills/ and the global USER.md.
* docs(paths): align the USER.md layout comment with the injection disclaimer
* test(authz): align effective permission contracts
---------
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
41 lines
1.1 KiB
TypeScript
41 lines
1.1 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
import { AUTH_DISABLED_USER } from "../../src/core/auth/auth-disabled-user";
|
|
|
|
const APP =
|
|
process.env.E2E_APP_URL ??
|
|
`http://localhost:${process.env.E2E_FRONTEND_PORT ?? "3000"}`;
|
|
|
|
// /me also returns the caller's effective route permissions (RFC #4063
|
|
// Phase 4). Auth-disabled mode grants the full registered set, in the order
|
|
// of backend _ALL_PERMISSIONS (backend/app/gateway/authz.py).
|
|
const AUTH_DISABLED_PERMISSIONS = [
|
|
"threads:read",
|
|
"threads:write",
|
|
"threads:delete",
|
|
"runs:create",
|
|
"runs:read",
|
|
"runs:cancel",
|
|
"memory:read",
|
|
"memory:write",
|
|
"agents:read",
|
|
"agents:write",
|
|
"projects:read",
|
|
"projects:write",
|
|
"projects:delete",
|
|
];
|
|
|
|
test.describe("auth-disabled contract (real backend)", () => {
|
|
test("gateway /auth/me returns the frontend synthetic user without a cookie", async ({
|
|
context,
|
|
}) => {
|
|
const resp = await context.request.get(`${APP}/api/v1/auth/me`);
|
|
|
|
expect(resp.status(), await resp.text()).toBe(200);
|
|
await expect(resp.json()).resolves.toEqual({
|
|
...AUTH_DISABLED_USER,
|
|
permissions: AUTH_DISABLED_PERMISSIONS,
|
|
});
|
|
});
|
|
});
|