GareArc
f729bc87a2
feat(inner_api): add endpoint to invalidate plugin model providers cache
...
Enterprise installs plugins into a workspace by talking to the plugin
daemon directly, so Dify never learns that a tenant's cached model
provider list is stale and serves it for the full 24h TTL.
Expose the existing PluginService.invalidate_plugin_model_providers_cache
over the inner API so enterprise can drop the cache for the tenants it
just changed. Batching is left to the caller.
2026-07-23 20:51:52 -07:00
Xiyuan Chen and GitHub
9e74520b50
Merge branch 'main' into gareth/esq1-170-rbac-for-agent
2026-07-22 22:01:46 -07:00
GareArc
d16d2d1efa
Merge remote-tracking branch 'origin/gareth/esq1-170-rbac-for-agent' into gareth/esq1-170-rbac-for-agent
2026-07-22 21:32:30 -07:00
GareArc
91126a5fda
fix(agent): stack agent.manage onto agent app management and import paths
...
Roster composer writes keep their app_edit / snippets gate and require
workspace agent.manage in addition, instead of replacing it. Generic app
management routes (update/delete/copy/export/name/icon/site/site-enable/
api-enable/api-keys) enforce agent.manage when the target is a roster
Agent App and reject hidden workflow-only backing apps outright, which
stay usable only through the Agent runtime surfaces. Importing an Agent
DSL requires agent.manage and the denial surfaces as 403 instead of a
generic failed import.
2026-07-22 21:31:56 -07:00
GareArc
8482167f1c
fix(agent): authorize workflow-only agents against their parent workflow app
...
The RBAC resource resolver returned the hidden runtime backing app for
workflow-only agents, which never receives a resource access policy, so
per-resource overrides on the parent workflow app were ignored. Resolve
agent_id to the policy-owning agent.app_id instead and keep
backing_app_id strictly runtime-only.
2026-07-22 21:31:43 -07:00
yyh and GitHub
6cd10f5e04
Merge branch 'main' into gareth/esq1-170-rbac-for-agent
2026-07-23 12:07:51 +08:00
2b8e40af32
fix(auth): validate account before accepting invitations ( #39438 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 03:56:32 +00:00
45711eb6dd
chore(api): cloud use presigned download url on api site ( #39436 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 03:34:49 +00:00
Asuka Minato and GitHub
82c8741c73
test: use sqlite3 session in test_hitl_service_api ( #38685 )
2026-07-23 03:33:01 +00:00
Asuka Minato and GitHub
78023bf50d
test: use sqlite3 session in test_conversation ( #38684 )
2026-07-23 03:32:17 +00:00
GareArc
1b5fbb2142
Merge remote-tracking branch 'origin/main' into gareth/esq1-170-rbac-for-agent
2026-07-22 20:24:53 -07:00
0ad985515b
test: move password reset coverage to unit tests ( #38936 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 03:16:06 +00:00
bd8f0104d6
feat(dataset): expose New RAG KnowledgeFS contracts ( #39314 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-23 01:48:36 +00:00
34a5ca191b
feat(dataset): add New Knowledge list and empty state ( #39300 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 12:00:50 +00:00
Asuka Minato and GitHub
1271cfcf3f
test: use sqlite3 session in test_workflow_events_openapi ( #38683 )
2026-07-22 11:25:14 +00:00
Asuka Minato and GitHub
2a0b1a8a63
test: use sqlite3 session in test_runtime_credentials ( #38682 )
2026-07-22 09:50:31 +00:00
Asuka Minato and GitHub
4a2e92f43f
test: use sqlite3 session in test_plugin_wraps ( #38681 )
2026-07-22 09:49:54 +00:00
Asuka Minato and GitHub
84889b88ec
test: use sqlite3 session in test_init_validate ( #38680 )
2026-07-22 09:44:29 +00:00
Asuka Minato and GitHub
6f034d2c93
test: use sqlite3 session in test_tags ( #38679 )
2026-07-22 09:43:41 +00:00
f91ea49414
test: use sqlite3 session in test_app_import_api ( #38674 )
...
Co-authored-by: Byron Wang <byron@dify.ai >
2026-07-22 09:43:30 +00:00
Asuka Minato and GitHub
de07730548
test: use sqlite3 session in test_snippet_workflow_draft_variable ( #38678 )
2026-07-22 09:20:51 +00:00
Asuka Minato and GitHub
9b2aa8b216
test: use sqlite3 session in test_snippet_workflow ( #38677 )
2026-07-22 09:20:21 +00:00
Asuka Minato and GitHub
8ee3a7eabc
test: use sqlite3 session in test_rag_pipeline_workflow ( #38676 )
2026-07-22 09:19:25 +00:00
0f9fffb7a2
fix(agent): isolate build and preview chat conversations ( #39405 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 09:17:55 +00:00
林玮 (Jade Lin) and GitHub
a3654d6a7d
fix(oauth): reauth after accepting invitation ( #39366 )
2026-07-22 05:59:04 +00:00
Asuka Minato and GitHub
c5d471dbdd
test: use sqlite3 session in test_model_config_api ( #38675 )
2026-07-22 04:53:13 +00:00
Asuka Minato and GitHub
7b95e2a75f
test: use sqlite3 session in test_generator_api_missing ( #38719 )
2026-07-22 04:52:06 +00:00
01efc6eecb
test: use SQLite sessions in service API fixtures ( #38784 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-22 04:51:49 +00:00
Asuka Minato and GitHub
a4c7261bf9
test: use sqlite3 session in test_workflow ( #38686 )
2026-07-22 04:51:33 +00:00
Asuka Minato and GitHub
79a5b31bc6
test: move console OAuth coverage to unit tests ( #38923 )
2026-07-22 02:27:55 +00:00
Asuka Minato and GitHub
e9bd8741f4
test: use sqlite3 session in test_auth_wraps ( #38760 )
2026-07-22 02:23:37 +00:00
GareArc
ac87341d69
Merge remote-tracking branch 'origin/main' into gareth/esq1-170-rbac-for-agent
...
# Conflicts:
# api/services/enterprise/rbac_service.py
2026-07-21 03:02:11 -07:00
GareArc
75cb8ea408
refactor(api): reuse the roster service's agent resolution for RBAC checks
...
The app-scoped RBAC gate hand-rolled a query to turn an agent_id into the id
of the App backing it, duplicating AgentRosterService.runtime_backing_app_id.
Worse, it filtered on id and tenant only, so the auth check accepted archived
Agents and sources the runtime resolver rejects -- a weaker notion of a valid
Agent than the layer it guards.
Add peek_runtime_backing_app_id, a read-only counterpart to
get_agent_runtime_app_model that never materializes the hidden backing App,
and share the eligibility filter between the two so they cannot drift.
The tenant filter was also untested: deleting it left all 50 tests passing,
since the specs stubbed the db module wholesale. Assert the resolver is called
with the caller's tenant instead, and cover the precedence and read-only
guarantees against the service directly.
2026-07-21 01:34:16 -07:00
Asuka Minato and GitHub
145b0e622e
test: use sqlite3 session in test_workspace_account ( #38757 )
2026-07-21 08:07:57 +00:00
Asuka Minato and GitHub
4bab62d458
test: use sqlite3 session in test_agent_app_parameters ( #38759 )
2026-07-21 07:59:00 +00:00
Asuka Minato and GitHub
32d2594877
test: move app import API coverage to unit tests ( #38920 )
2026-07-21 07:54:32 +00:00
Asuka Minato and GitHub
7b188287da
test: use sqlite3 session in test_accounts ( #38752 )
2026-07-21 07:50:05 +00:00
Asuka Minato and GitHub
852169d99c
test: use SQLite sessions in unit misc ( #39118 )
2026-07-21 07:27:13 +00:00
GareArc
edbaaeae23
fix(api): resolve agent routes to their backing app for app-scoped RBAC
2026-07-21 00:22:24 -07:00
aa718add24
fix(api): return 400 instead of 500 when 'file' is missing from trial-app audio-to-text ( #39305 )
...
Co-authored-by: Harsh Kashyap <Harsh23Kashyap@users.noreply.github.com >
2026-07-21 05:59:48 +00:00
yyh and GitHub
861831f176
fix(api): keep workflow log archives owner-admin only ( #39338 )
2026-07-21 04:31:14 +00:00
cbd7872520
test: use SQLite sessions in unit misc ( #39121 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 10:38:52 +00:00
23882a704e
test: use SQLite sessions in unit misc ( #39122 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 10:38:49 +00:00
1bd5254ea7
test: use SQLite sessions in unit misc ( #39123 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 10:38:46 +00:00
cb64446fa3
feat(web): add step-by-step tour shell ( #38785 )
...
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-07-20 09:23:25 +00:00
43d725a1ce
feat(dataset): proxy KnowledgeFS Console requests ( #39158 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 08:10:06 +00:00
f93a5b95c6
fix(api, web): scope trial app file uploads to the app tenant ( #39149 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-20 07:00:45 +00:00
6022939bf0
fix: prevent hidden-tab collaboration leader from saving stale drafts ( #38997 )
...
Co-authored-by: hjlarry <hjlarry@163.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com >
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com >
2026-07-20 06:58:01 +00:00
33fe0dfd60
test: use sqlite3 session in test_human_input_form ( #38780 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-07-16 13:17:50 +00:00
Asuka Minato and GitHub
14ac8dfbf6
test: use sqlite3 session in test_passport ( #38763 )
2026-07-16 12:59:52 +00:00
GareArc