mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-15 00:19:14 +00:00
* feat(auth): add personal access tokens for programmatic API access (#4849) Backend-first implementation of the PAT contract from #4849: show-once dfp_ tokens bound to their owning user (AUTH_SOURCE_PAT, is_internal=false), digest-only storage (migration 0017), strict credential precedence (invalid Bearer is a 401, never cookie fallback), CSRF double-submit skipped only for Bearer requests while auth-endpoint origin checks still run, scopes intersecting the authz route permissions, session-auth-only PAT management and password changes, and throttled best-effort last_used_at stamps. * fix(auth): harden PAT scope boundary and schema parity from adversarial review Independent review of the initial draft found: (1) scopes only constrained the threads/runs permission axis while admin routes treated a PAT as its (possibly admin) owner — is_admin_user now rejects PAT callers outright since no scope grants admin capability; (2) the model declared a column UNIQUE constraint while migration 0017 created a named unique index, so downgrade failed on create_all-bootstrapped DBs — both now use the named unique index; (3) auth-disabled mode is an operator override and now stays ahead of the Bearer check so a stray Authorization header cannot 401 an E2E sandbox; plus wiring the previously-unused constants, bounding the last_used_at stamp cache, and four new tests (middleware-level expiry, expires_in_days, admin-capability rejection with session control, and the auth-disabled precedence). * docs(api): document personal access tokens for programmatic API access * fix(auth): close PAT security boundaries from review (default-deny routes, extension admin suppression) P1-1: scope intersection only constrains @require_permission routes, so undecorated mutation routes (DELETE /api/memory, POST /api/agents, Lark credential switching, channel config) accepted a PAT holding a single read scope. AuthMiddleware now enforces a default-deny route policy in auth/pat.py: PAT requests are admitted only to the thread/run lifecycle routes the v1 scopes govern; everything else answers 403 regardless of scopes. Session-cookie callers are unaffected. P1-2: the extension principal resolver projected is_admin/roles from the raw system_role, so an admin-owned PAT passed deerflow_extension_api.require_admin on contributed routes despite the documented no-admin guarantee. The projection is now PAT-aware and suppresses every admin signal for PAT callers, mirroring deps.is_admin_user. Both fixes carry regression tests (route outside policy 403 + session control; production resolver admin suppression), and API.md documents the default-deny boundary. * fix(auth): enforce PAT scopes on stateless run entry and harden decorator Follow-up hardening from an independent audit of the P1 fixes: - POST /api/runs/stream and /api/runs/wait were the only allowlisted run entrypoints without @require_permission, so a threads:read-only PAT could still start runs (same bug class as P1-1, now closed): both now carry @require_permission("runs", "create"). POST /api/threads and POST /api/threads/search gain threads:write / threads:read for the same reason. Authorization-disabled deployments see no change (the permission set resolves to all permissions). - require_permission now binds the wrapped signature to locate a positionally-passed request before injecting the test stub, fixing 'got multiple values for argument' on direct positional unit-test calls. - API.md: the intro PAT example used GET /api/models, which the new default-deny policy 403s — replaced with GET /api/threads; the default-deny route list now spells out method sets. Regression test: threads:read-only PAT is 403 on the decorated stateless entry while a runs:create PAT passes. * fix(auth): address review P2s (empty Authorization header, PAT name trimming, API example) - CSRFMiddleware treats an explicitly empty Authorization header as present (is None), so an invalid credential always reaches AuthMiddleware's uniform 401 instead of a CSRF 403 that varies by method/CSRF state. Regression: empty-header request dies at auth. - PATCreateRequest strips the name and rejects whitespace-only values before token generation; created names are stored trimmed. - API.md intro PAT example now uses the implemented POST /api/threads/search endpoint (GET /api/threads does not exist). - AGENTS.md trimmed back under the guidance soft budget after the upstream merge. * fix(auth): tighten PAT route policy to implemented methods only The allowlist admitted GET /api/threads, a method no router implements. Pre-authorizing a dead method weakens the default-deny boundary: a future GET collection route added without a permission decorator would become PAT-reachable without an explicit policy change. Restrict the rule to POST, fix the stale GET description in API.md's PAT constraints, and document the default-deny boundary accurately in the gateway AGENTS.md guidance (only the threads/runs allowlist is PAT-reachable; every other authenticated route 403s PAT callers). Audited every remaining rule against the mounted routers: all other method+path entries map to real routes. Regression: test_pat_policy_does_not_pre_authorize_unimplemented_methods. * test(auth): guarantee the negative digest test mutates the token token[:-1] + "X" is identical to the original whenever the generated token already ends in X (1/62), making the negative digest assertion fail intermittently. Choose the replacement character based on the existing tail so the mutated token always differs. * fix(auth): require runs:cancel for cancel-then-stream requests stream_existing_run is gated at runs:read so action-less stream joins work with read-only credentials, but its ?action=interrupt|rollback branch cancels the run — a separate permission. A runs:read-only PAT passed both the PAT route policy and the route decorator and could interrupt or roll back an active run, bypassing the runs:cancel scope. Decorators cannot express query-parameter-conditional permissions, so the check lives in require_cancel_permission_when_action(), applied at the top of the handler. Regression drives the real helper through the production middleware: runs:read-only PAT + action is 403, the same token joins action-less, runs:read+cancel passes, session control unaffected. * docs(changelog): add the PAT feature entry * docs(readme): add personal access tokens section Repo documentation-update policy requires user-facing features to update README.md in the same changeset; the PAT feature previously touched only backend/docs/API.md and the gateway AGENTS.md. * fix(auth): require runs:cancel for mutating multitask strategies All five run-creation entrypoints were gated only by runs:create, but RunCreateRequest.multitask_strategy accepts interrupt/rollback and start_run forwards it to create_or_reject, which terminates an already-active run. A runs:create-only PAT could therefore kill an existing run through a create request, bypassing runs:cancel. Decorators cannot express body-parameter-conditional permissions, and per-route checks leave the same hole for the next entrypoint, so the gate lives in start_run itself — the single choke point every run-creation path (HTTP routes and internal launchers) flows through. Regenerate launches pass multitask_strategy="reject" and are unaffected; requests without a stamped auth context (internal/test compositions) skip the gate. The check is the shared authz.require_cancel_permission_if primitive; require_cancel_permission_when_action now delegates to it, so every request dimension that carries cancel capability (query action, body strategy) flows through one gate. Regression drives the real middleware stack: runs:create-only PAT + interrupt/rollback is 403 with the exact detail, reject (explicit and default) stays available, runs:create+cancel passes, session control unaffected; a source anchor pins the gate inside start_run. * fix(runs): keep observer joins from applying creator cancel-on-disconnect sse_consumer's finally block applied the record's on_disconnect=cancel policy on ANY consumer's disconnect. The join surfaces (GET /join and the action-less GET/POST stream join) feed it the existing RunRecord, so anyone with thread read access — including a runs:read-only PAT — could cancel a locally-owned running run simply by closing the SSE connection, without runs:cancel. The policy expresses the creator's intent for their own connection; an observer's disconnect must never be read as that intent. sse_consumer gains apply_on_disconnect (default True). The two join surfaces pass False; the creating endpoints (thread-scoped and stateless create-and-stream) keep the creator semantics unchanged. wait_for_run_completion needs no change: its callers are creator-side or post-explicit-cancel paths only. Regression exercises a real generator close — the same machinery Starlette drives on client disconnect — against the production sse_consumer: creator stream disconnect cancels, observer join disconnect does not; a wiring anchor pins both join call sites and the creator defaults. API.md documents the cancel-capability constraint (this fix plus the action/strategy gates) in PAT Constraints. * test(auth): pin the multitask gate behaviorally; state wait invariant Independent adversarial review of the round-5 fixes found the P1-a regression only mirror-pinned: the source anchor could be satisfied by a comment, and deleting the gate from start_run would not fail the suite. This drives the production start_run directly — a create-only auth context gets 403 with the exact detail for interrupt, and a reject request with no cancel permission at all proceeds past the gate (never a permission 403). Also documents wait_for_run_completion's creator-side invariant (every caller is the creating endpoint or post-explicit-cancel) so a future observer wiring thinks twice before reusing it — the one-caller- away variant of the observer-disconnect P1. * docs(changelog): correct the PAT entry's digest and route-policy description The entry said HMAC digests (the implementation stores SHA-256 digests, as documented in API.md and pinned by the repository tests) and claimed the route policy admits 'implemented stateless endpoints' (it admits the thread/run lifecycle routes, narrowing further by scopes). Also notes the cancel-capability gate now covering action and multitask strategies. * fix(auth): enumerate the PAT runs route policy per implemented subroute The runs subtree rule was a GET|POST /runs(/.*)? wildcard — it pre-authorized every current and future subroute under /runs, including methods the router never implemented (e.g. GET /runs/stream), which is the same latent default-deny weakening the threads collection rule was tightened for: a future route added under /runs would become PAT-reachable without an explicit policy change. The wildcard is replaced with six segment-precise rules covering exactly the 14 implemented method+path combinations; the {run_id} slot necessarily matches any single segment, so the POST-only collection names (stream, wait, regenerate, edit-regenerate) are excluded from the GET run-id rule via negative lookahead — no dead method stays pre-authorized. Behavior for implemented routes is unchanged. test_pat_runs_policy_admits_exactly_the_mounted_routes derives the expected set from the mounted thread_runs router instead of a hand-maintained list: every implemented GET/POST route under /runs must be admitted, routes in this router outside the subtree stay denied, and representative unimplemented neighbors are denied — so adding a route under /runs now fails CI until it is explicitly allowlisted, and a removed route leaves a dead rule visible. API.md's PAT constraints list the enumerated routes and drops a feedback mention that belonged to the stateless /api/runs axis. * docs(migration): add the 0017 renumbering coordination note to 0017 The PR's migration-coordination comment states each migration file carries the note; the file did not. Adds it: numbering was generated against main head 0016 alongside #5078 and #4843; whoever merges first keeps the slot, the others renumber on rebase (revision/down_revision plus the bootstrap head assertions). * fix(auth): pad base62 tokens to a fixed 43-char width int.from_bytes discards leading zero bytes, so the unpadded encoder returned a variable-length body — empty for all-zero input, and shorter than 40 characters for any draw below 62**39 (~1 in 14.5M), leaving test_generate_pat_token_format probabilistically flaky and the token body without stable width (review round 6, P3). _base62 now left-pads with "0" to _base62_width(len(data)) — the exact integer digit count (62^43 > 2^256 > 62^42, so 43 for 32 bytes). The format test asserts the exact fixed width instead of a probabilistic floor, and a new unit test pins the all-zero, leading-zero-byte, and max-value edges deterministically.
185 lines
8.2 KiB
Python
185 lines
8.2 KiB
Python
"""Regression test for migration ``0007_scheduled_run_active_index`` dedupe pass.
|
|
|
|
End-to-end shape (mirrors ``test_migration_0004_run_ownership_dedupe``):
|
|
|
|
1. Hand-build a SQLite DB that mirrors a real pre-0007 deployment that ran the
|
|
racy ``dispatch_task`` check-then-insert and accumulated duplicate active
|
|
rows per ``task_id`` (the exact dirty state the partial unique index
|
|
targets).
|
|
2. Stamp it at ``0006_agents`` so ``bootstrap_schema`` takes the
|
|
versioned branch and runs ``alembic upgrade head``.
|
|
3. Insert two+ queued/running rows for the same ``task_id`` (only possible
|
|
because the partial unique index does not exist yet).
|
|
4. Run ``init_engine`` (the FastAPI lifespan entry point), which routes through
|
|
``bootstrap_schema`` -> ``upgrade head`` -> ``0007.upgrade()``.
|
|
5. Verify the migration superseded the older duplicates (set them to
|
|
``interrupted`` with an explanatory message + ``finished_at``), successfully
|
|
built the ``uq_scheduled_task_run_active`` partial unique index, and let the
|
|
later scheduler-enqueue migration normalize the surviving legacy ``queued``
|
|
row before durable queue semantics become active.
|
|
|
|
Pre-fix codepath would have raised ``UNIQUE constraint failed`` (SQLite) /
|
|
``could not create unique index`` (Postgres) on step 5, aborting the alembic
|
|
upgrade and blocking gateway startup.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sqlite3
|
|
from datetime import UTC, datetime, timedelta
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import sqlalchemy as sa
|
|
from sqlalchemy.orm import Session
|
|
|
|
import deerflow.persistence.models # noqa: F401 -- registers ORM models
|
|
from deerflow.persistence.base import Base
|
|
from deerflow.persistence.engine import close_engine, init_engine
|
|
from deerflow.persistence.scheduled_task_runs.model import ScheduledTaskRunRow
|
|
|
|
pytestmark = pytest.mark.asyncio
|
|
|
|
|
|
def _seed_pre_0007_with_duplicates(db_path: Path) -> None:
|
|
"""Build a DB at revision 0006 with duplicate active rows per task_id.
|
|
|
|
``Base.metadata.create_all`` produces the full current schema (including
|
|
the partial unique index), so we drop just that index to land in the dirty
|
|
state the migration's dedupe pass targets, then stamp at 0005 and insert
|
|
the duplicates via the ORM so Python-side defaults populate.
|
|
"""
|
|
db_path.parent.mkdir(parents=True, exist_ok=True)
|
|
sync_engine = sa.create_engine(f"sqlite:///{db_path.as_posix()}")
|
|
try:
|
|
Base.metadata.create_all(sync_engine)
|
|
with sync_engine.begin() as conn:
|
|
# Drop only the partial unique index — its absence is what permits
|
|
# duplicate active rows to exist in the first place.
|
|
conn.execute(sa.text("DROP INDEX IF EXISTS uq_scheduled_task_run_active"))
|
|
# Stamp at 0006 so bootstrap takes the versioned branch and runs
|
|
# ``alembic upgrade head`` (which is what executes 0007.upgrade()).
|
|
conn.execute(sa.text("CREATE TABLE IF NOT EXISTS alembic_version (version_num VARCHAR(32) NOT NULL)"))
|
|
conn.execute(sa.text("DELETE FROM alembic_version"))
|
|
conn.execute(sa.text("INSERT INTO alembic_version (version_num) VALUES ('0006_agents')"))
|
|
|
|
base = datetime.now(UTC)
|
|
with Session(sync_engine) as session:
|
|
session.add_all(
|
|
[
|
|
# Task with three active rows: two older duplicates + newest.
|
|
ScheduledTaskRunRow(
|
|
id="run-old-a",
|
|
task_id="task-dup",
|
|
thread_id="thread-a",
|
|
scheduled_for=base,
|
|
trigger="scheduled",
|
|
status="queued",
|
|
created_at=base,
|
|
),
|
|
ScheduledTaskRunRow(
|
|
id="run-old-b",
|
|
task_id="task-dup",
|
|
thread_id="thread-b",
|
|
scheduled_for=base,
|
|
trigger="manual",
|
|
status="running",
|
|
created_at=base + timedelta(seconds=10),
|
|
),
|
|
ScheduledTaskRunRow(
|
|
id="run-newest",
|
|
task_id="task-dup",
|
|
thread_id="thread-c",
|
|
scheduled_for=base,
|
|
trigger="scheduled",
|
|
status="queued",
|
|
created_at=base + timedelta(seconds=60),
|
|
),
|
|
# A single-active-row task: must be left untouched.
|
|
ScheduledTaskRunRow(
|
|
id="run-solo",
|
|
task_id="task-solo",
|
|
thread_id="thread-solo",
|
|
scheduled_for=base,
|
|
trigger="scheduled",
|
|
status="running",
|
|
created_at=base,
|
|
),
|
|
# A terminal row: must stay terminal.
|
|
ScheduledTaskRunRow(
|
|
id="run-done",
|
|
task_id="task-done",
|
|
thread_id="thread-done",
|
|
scheduled_for=base,
|
|
trigger="scheduled",
|
|
status="success",
|
|
created_at=base,
|
|
),
|
|
]
|
|
)
|
|
session.commit()
|
|
finally:
|
|
sync_engine.dispose()
|
|
|
|
|
|
def _fetch_runs(db_path: Path) -> dict[str, tuple[str, str | None, str | None]]:
|
|
"""Map id -> (status, error, finished_at) for assertions."""
|
|
with sqlite3.connect(db_path) as raw:
|
|
rows = raw.execute("SELECT id, status, error, finished_at FROM scheduled_task_runs").fetchall()
|
|
return {run_id: (status, error, finished_at) for run_id, status, error, finished_at in rows}
|
|
|
|
|
|
def _index_exists(db_path: Path, index_name: str) -> bool:
|
|
with sqlite3.connect(db_path) as raw:
|
|
row = raw.execute(
|
|
"SELECT 1 FROM sqlite_master WHERE type='index' AND name=?",
|
|
(index_name,),
|
|
).fetchone()
|
|
return row is not None
|
|
|
|
|
|
async def test_migration_supersedes_duplicate_active_runs_before_unique_index(tmp_path: Path) -> None:
|
|
db_path = tmp_path / "dirty.db"
|
|
_seed_pre_0007_with_duplicates(db_path)
|
|
|
|
url = f"sqlite+aiosqlite:///{db_path.as_posix()}"
|
|
await init_engine(backend="sqlite", url=url, sqlite_dir=str(tmp_path))
|
|
|
|
try:
|
|
runs = _fetch_runs(db_path)
|
|
|
|
# 0007 keeps the newest duplicate, then 0015 deliberately interrupts
|
|
# that pre-existing queued row before durable queue semantics begin.
|
|
newest_status, newest_error, newest_finished_at = runs["run-newest"]
|
|
assert newest_status == "interrupted"
|
|
assert "gateway upgraded" in (newest_error or "")
|
|
assert newest_finished_at is not None
|
|
|
|
# Older duplicate active rows are superseded with an explanatory error
|
|
# and a finished_at timestamp (mark_stale_active_runs orphan semantics).
|
|
for run_id in ("run-old-a", "run-old-b"):
|
|
status, error, finished_at = runs[run_id]
|
|
assert status == "interrupted", (run_id, status)
|
|
assert "uq_scheduled_task_run_active" in (error or ""), (run_id, error)
|
|
assert finished_at is not None, run_id
|
|
|
|
# Untouched tasks: single active row stays active, terminal stays terminal.
|
|
assert runs["run-solo"][0] == "running"
|
|
assert runs["run-done"][0] == "success"
|
|
|
|
# The partial unique index was successfully created — the upgrade did
|
|
# not abort with ``UNIQUE constraint failed``.
|
|
assert _index_exists(db_path, "uq_scheduled_task_run_active")
|
|
|
|
with sqlite3.connect(db_path) as raw:
|
|
version_row = raw.execute("SELECT version_num FROM alembic_version").fetchone()
|
|
assert version_row[0] == "0017_personal_access_tokens"
|
|
|
|
# Sanity: the invariant the index enforces now holds — at most one
|
|
# active row per task_id.
|
|
with sqlite3.connect(db_path) as raw:
|
|
dupes = raw.execute("SELECT task_id, COUNT(*) FROM scheduled_task_runs WHERE status IN ('queued', 'running') GROUP BY task_id HAVING COUNT(*) > 1").fetchall()
|
|
assert dupes == []
|
|
finally:
|
|
await close_engine()
|