mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-05-13 04:03:41 +00:00
c3bc6c7cd5
* fix(nginx): defer cors to gateway allowlist Remove proxy-level wildcard CORS handling so browser origins are controlled by the Gateway allowlist and stay aligned with CSRF origin checks. * docs: document gateway cors allowlist Clarify that same-origin nginx access needs no CORS headers while split-origin or port-forwarded browser clients must opt in with GATEWAY_CORS_ORIGINS. * docs(gateway): record cors source of truth Document that Gateway CORSMiddleware and CSRFMiddleware share GATEWAY_CORS_ORIGINS as the split-origin source of truth. * fix(gateway): align cors origin normalization * docs: clarify gateway langgraph routing * docs(gateway): update runtime routing note
86 lines
3.3 KiB
Python
86 lines
3.3 KiB
Python
"""Regression coverage for the Gateway-owned LangGraph API runtime."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def _read(path: str) -> str:
|
|
return (REPO_ROOT / path).read_text(encoding="utf-8")
|
|
|
|
|
|
def test_root_makefile_no_longer_exposes_transition_gateway_targets():
|
|
makefile = _read("Makefile")
|
|
|
|
assert "dev-pro" not in makefile
|
|
assert "start-pro" not in makefile
|
|
assert "dev-daemon-pro" not in makefile
|
|
assert "start-daemon-pro" not in makefile
|
|
assert "docker-start-pro" not in makefile
|
|
assert "up-pro" not in makefile
|
|
assert not re.search(r"serve\.sh .*--gateway", makefile)
|
|
assert "docker.sh start --gateway" not in makefile
|
|
assert "deploy.sh --gateway" not in makefile
|
|
|
|
|
|
def test_service_launchers_always_use_gateway_runtime():
|
|
operational_files = {
|
|
"scripts/serve.sh": _read("scripts/serve.sh"),
|
|
"scripts/docker.sh": _read("scripts/docker.sh"),
|
|
"scripts/deploy.sh": _read("scripts/deploy.sh"),
|
|
"docker/docker-compose-dev.yaml": _read("docker/docker-compose-dev.yaml"),
|
|
"docker/docker-compose.yaml": _read("docker/docker-compose.yaml"),
|
|
}
|
|
|
|
for path, content in operational_files.items():
|
|
assert "start --gateway" not in content, path
|
|
assert "deploy.sh --gateway" not in content, path
|
|
assert "langgraph dev" not in content, path
|
|
assert "LANGGRAPH_UPSTREAM" not in content, path
|
|
assert "LANGGRAPH_REWRITE" not in content, path
|
|
|
|
|
|
def test_nginx_routes_official_langgraph_prefix_to_gateway_api():
|
|
for path in ("docker/nginx/nginx.local.conf", "docker/nginx/nginx.conf"):
|
|
content = _read(path)
|
|
|
|
assert "/api/langgraph-compat" not in content
|
|
assert "proxy_pass http://langgraph" not in content
|
|
assert "rewrite ^/api/langgraph/(.*) /api/$1 break;" in content
|
|
assert "proxy_pass http://gateway" in content or "proxy_pass http://$gateway_upstream" in content
|
|
|
|
|
|
def test_nginx_defers_cors_to_gateway_allowlist():
|
|
for path in ("docker/nginx/nginx.local.conf", "docker/nginx/nginx.conf"):
|
|
content = _read(path)
|
|
|
|
assert "Access-Control-Allow-Origin" not in content
|
|
assert "Access-Control-Allow-Methods" not in content
|
|
assert "Access-Control-Allow-Headers" not in content
|
|
assert "Access-Control-Allow-Credentials" not in content
|
|
assert "proxy_hide_header 'Access-Control-Allow-" not in content
|
|
assert "if ($request_method = 'OPTIONS')" not in content
|
|
|
|
|
|
def test_gateway_cors_configuration_uses_gateway_allowlist():
|
|
gateway_config = _read("backend/app/gateway/config.py")
|
|
gateway_app = _read("backend/app/gateway/app.py")
|
|
csrf_middleware = _read("backend/app/gateway/csrf_middleware.py")
|
|
|
|
assert not re.search(r"(?<!GATEWAY_)[\"']CORS_ORIGINS[\"']", gateway_config)
|
|
assert "cors_origins" not in gateway_config
|
|
assert "get_configured_cors_origins" in gateway_app
|
|
assert "GATEWAY_CORS_ORIGINS" in csrf_middleware
|
|
|
|
|
|
def test_frontend_rewrites_langgraph_prefix_to_gateway():
|
|
next_config = _read("frontend/next.config.js")
|
|
api_client = _read("frontend/src/core/api/api-client.ts")
|
|
|
|
assert "DEER_FLOW_INTERNAL_LANGGRAPH_BASE_URL" not in next_config
|
|
assert "http://127.0.0.1:2024" not in next_config
|
|
assert "langgraph-compat" not in api_client
|