[autofix.ci] apply automated fixes

Merge remote-tracking branch 'origin/main' into yanli/docx-image-render
# Conflicts: # api/tests/unit_tests/core/rag/extractor/test_word_extractor.py
2026-03-10 10:14:46 +00:00 · 2026-03-10 18:10:16 +08:00 · 2026-03-10 18:17:11 +09:00 · 2026-03-10 18:16:01 +09:00 · 2026-03-10 17:02:37 +08:00 · 2026-03-10 15:46:17 +08:00
467 changed files with 54886 additions and 6684 deletions
@@ -0,0 +1,33 @@
+name: Setup Web Environment
+description: Setup pnpm, Node.js, and install web dependencies.
+
+inputs:
+  node-version:
+    description: Node.js version to use
+    required: false
+    default: "22"
+  install-dependencies:
+    description: Whether to install web dependencies after setting up Node.js
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Install pnpm
+      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      with:
+        package_json_file: web/package.json
+        run_install: false
+
+    - name: Setup Node.js
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+        cache-dependency-path: ./web/pnpm-lock.yaml
+
+    - name: Install dependencies
+      if: ${{ inputs.install-dependencies == 'true' }}
+      shell: bash
+      run: pnpm --dir web install --frozen-lockfile
@@ -24,6 +24,16 @@ updates:
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 2
+    ignore:
+      - dependency-name: "ky"
+      - dependency-name: "tailwind-merge"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "tailwindcss"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-syntax-highlighter"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-window"
+        update-types: ["version-update:semver-major"]
    groups:
      lexical:
        patterns:
@@ -33,6 +43,9 @@ updates:
        patterns:
          - "storybook"
          - "@storybook/*"
+      eslint-group:
+        patterns:
+          - "*eslint*"
      npm-dependencies:
        patterns:
          - "*"
@@ -41,3 +54,4 @@ updates:
          - "@lexical/*"
          - "storybook"
          - "@storybook/*"
+          - "*eslint*"
@@ -0,0 +1,17 @@
+name: Anti-Slop PR Check
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  anti-slop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: peakoss/anti-slop@v0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -22,12 +22,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}
@@ -51,7 +51,7 @@ jobs:
        run: sh .github/workflows/expose_service_ports.sh

      - name: Set up Sandbox
-        uses: hoverkraft-tech/compose-action@v2
+        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -12,22 +12,22 @@ jobs:
    if: github.repository == 'langgenius/dify'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check Docker Compose inputs
        id: docker-compose-changes
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            docker/generate_docker_compose
            docker/.env.example
            docker/docker-compose-template.yaml
            docker/docker-compose.yaml
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"

-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1

      - name: Generate Docker Compose
        if: steps.docker-compose-changes.outputs.any_changed == 'true'
@@ -84,4 +84,14 @@ jobs:
        run: |
          uvx --python 3.13 mdformat . --exclude ".agents/skills/**"

-      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
+      - name: Setup web environment
+        uses: ./.github/actions/setup-web
+        with:
+          node-version: "24"
+
+      - name: ESLint autofix
+        run: |
+          cd web
+          pnpm eslint --concurrency=2 --prune-suppressions
+
+      - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8 # v1.3.3
@@ -53,26 +53,26 @@ jobs:
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          username: ${{ env.DOCKERHUB_USER }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Extract metadata for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env[matrix.image_name_env] }}

      - name: Build Docker image
        id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: "{{defaultContext}}:${{ matrix.context }}"
          platforms: ${{ matrix.platform }}
@@ -91,7 +91,7 @@ jobs:
          touch "/tmp/digests/${sanitized_digest}"

      - name: Upload digest
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: digests-${{ matrix.context }}-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
@@ -113,21 +113,21 @@ jobs:
            context: "web"
    steps:
      - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          path: /tmp/digests
          pattern: digests-${{ matrix.context }}-*
          merge-multiple: true

      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          username: ${{ env.DOCKERHUB_USER }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env[matrix.image_name_env] }}
          tags: |
@@ -13,13 +13,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: true
          python-version: "3.12"
@@ -40,7 +40,7 @@ jobs:
          cp middleware.env.example middleware.env

      - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@v2.0.2
+        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -63,13 +63,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: true
          python-version: "3.12"
@@ -94,7 +94,7 @@ jobs:
          sed -i 's/DB_USERNAME=postgres/DB_USERNAME=mysql/' middleware.env

      - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@v2.0.2
+        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -19,7 +19,7 @@ jobs:
      github.event.workflow_run.head_branch == 'deploy/agent-dev'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.AGENT_DEV_SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -16,7 +16,7 @@ jobs:
      github.event.workflow_run.head_branch == 'deploy/dev'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -16,7 +16,7 @@ jobs:
      github.event.workflow_run.head_branch == 'build/feat/hitl'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.HITL_SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -32,13 +32,13 @@ jobs:
            context: "web"
    steps:
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Build Docker Image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          push: false
          context: "{{defaultContext}}:${{ matrix.context }}"
@@ -9,6 +9,6 @@ jobs:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          sync-labels: true
@@ -27,8 +27,8 @@ jobs:
      vdb-changed: ${{ steps.changes.outputs.vdb }}
      migration-changed: ${{ steps.changes.outputs.migration }}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
@@ -39,6 +39,7 @@ jobs:
            web:
              - 'web/**'
              - '.github/workflows/web-tests.yml'
+              - '.github/actions/setup-web/**'
            vdb:
              - 'api/core/rag/datasource/**'
              - 'docker/**'
@@ -21,7 +21,7 @@ jobs:
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.pull_requests[0].head.repo.full_name != github.repository }}
    steps:
      - name: Download pyrefly diff artifact
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -49,7 +49,7 @@ jobs:
        run: unzip -o pyrefly_diff.zip

      - name: Post comment
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout PR branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup Python & UV
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: true

@@ -55,7 +55,7 @@ jobs:
          echo ${{ github.event.pull_request.number }} > pr_number.txt

      - name: Upload pyrefly diff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: pyrefly_diff
          path: |
@@ -64,7 +64,7 @@ jobs:

      - name: Comment PR with pyrefly diff
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -16,6 +16,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check title
-        uses: amannn/action-semantic-pull-request@v6.1.1
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -18,7 +18,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          days-before-issue-stale: 15
          days-before-issue-close: 3
@@ -19,13 +19,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            api/**
@@ -33,7 +33,7 @@ jobs:

      - name: Setup UV and Python
        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: false
          python-version: "3.12"
@@ -67,36 +67,22 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            web/**
            .github/workflows/style.yml
+            .github/actions/setup-web/**

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          package_json_file: web/package.json
-          run_install: false
-
-      - name: Setup NodeJS
-        uses: actions/setup-node@v6
+      - name: Setup web environment
        if: steps.changed-files.outputs.any_changed == 'true'
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: ./web/pnpm-lock.yaml
-
-      - name: Web dependencies
-        if: steps.changed-files.outputs.any_changed == 'true'
-        working-directory: ./web
-        run: pnpm install --frozen-lockfile
+        uses: ./.github/actions/setup-web

      - name: Web style check
        if: steps.changed-files.outputs.any_changed == 'true'
@@ -134,14 +120,14 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            **.sh
@@ -152,7 +138,7 @@ jobs:
            .editorconfig

      - name: Super-linter
-        uses: super-linter/super-linter/slim@v8
+        uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
        if: steps.changed-files.outputs.any_changed == 'true'
        env:
          BASH_SEVERITY: warning
@@ -21,12 +21,12 @@ jobs:
        working-directory: sdks/nodejs-client

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Use Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 22
          cache: ''
@@ -38,7 +38,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
@@ -48,18 +48,10 @@ jobs:
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup web environment
+        uses: ./.github/actions/setup-web
        with:
-          package_json_file: web/package.json
-          run_install: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: ./web/pnpm-lock.yaml
+          install-dependencies: "false"

      - name: Detect changed files and generate diff
        id: detect_changes
@@ -130,7 +122,7 @@ jobs:

      - name: Run Claude Code for Translation Sync
        if: steps.detect_changes.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1.0.70
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

@@ -59,7 +59,7 @@ jobs:

      - name: Trigger i18n sync workflow
        if: steps.detect.outputs.has_changes == 'true'
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          event-type: i18n-sync
@@ -19,19 +19,19 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Free Disk Space
-        uses: endersonmenezes/free-disk-space@v3
+        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3.2.2
        with:
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}
@@ -60,7 +60,7 @@ jobs:
 #            tiflash

      - name: Set up Vector Stores (Weaviate, Qdrant, PGVector, Milvus, PgVecto-RS, Chroma, MyScale, ElasticSearch, Couchbase, OceanBase)
-        uses: hoverkraft-tech/compose-action@v2.0.2
+        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
        with:
          compose-file: |
            docker/docker-compose.yaml
@@ -26,32 +26,19 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          package_json_file: web/package.json
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: ./web/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup web environment
+        uses: ./.github/actions/setup-web

      - name: Run tests
        run: pnpm vitest run --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --coverage

      - name: Upload blob report
        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: blob-report-${{ matrix.shardIndex }}
          path: web/.vitest-reports/*
@@ -70,28 +57,15 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          package_json_file: web/package.json
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: ./web/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup web environment
+        uses: ./.github/actions/setup-web

      - name: Download blob reports
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          path: web/.vitest-reports
          pattern: blob-report-*
@@ -419,7 +393,7 @@ jobs:

      - name: Upload Coverage Artifact
        if: steps.coverage-summary.outputs.has_coverage == 'true'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: web-coverage-report
          path: web/coverage
@@ -435,36 +409,22 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            web/**
            .github/workflows/web-tests.yml
+            .github/actions/setup-web/**

-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          package_json_file: web/package.json
-          run_install: false
-
-      - name: Setup NodeJS
-        uses: actions/setup-node@v6
+      - name: Setup web environment
        if: steps.changed-files.outputs.any_changed == 'true'
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: ./web/pnpm-lock.yaml
-
-      - name: Web dependencies
-        if: steps.changed-files.outputs.any_changed == 'true'
-        working-directory: ./web
-        run: pnpm install --frozen-lockfile
+        uses: ./.github/actions/setup-web

      - name: Web build check
        if: steps.changed-files.outputs.any_changed == 'true'
@@ -56,7 +56,7 @@
  <a href="./docs/bn-BD/README.md"><img alt="README in বাংলা" src="https://img.shields.io/badge/বাংলা-d9d9d9"></a>
 </p>

-Dify is an open-source platform for developing LLM applications. Its intuitive interface combines agentic AI workflows, RAG pipelines, agent capabilities, model management, observability features, and more—allowing you to quickly move from prototype to production.
+Dify is an open-source LLM app development platform. Its intuitive interface combines AI workflow, RAG pipeline, agent capabilities, model management, observability features (including [Opik](https://www.comet.com/docs/opik/integrations/dify), [Langfuse](https://docs.langfuse.com), and [Arize Phoenix](https://docs.arize.com/phoenix)) and more, letting you quickly go from prototype to production. Here's a list of the core features:

 ## Quick start

@@ -133,7 +133,7 @@ Star Dify on GitHub and be instantly notified of new releases.

 ### Custom configurations

-If you need to customize the configuration, please refer to the comments in our [.env.example](docker/.env.example) file and update the corresponding values in your `.env` file. Additionally, you might need to make adjustments to the `docker-compose.yaml` file itself, such as changing image versions, port mappings, or volume mounts, based on your specific deployment environment and requirements. After making any changes, please re-run `docker-compose up -d`. You can find the full list of available environment variables [here](https://docs.dify.ai/getting-started/install-self-hosted/environments).
+If you need to customize the configuration, please refer to the comments in our [.env.example](docker/.env.example) file and update the corresponding values in your `.env` file. Additionally, you might need to make adjustments to the `docker-compose.yaml` file itself, such as changing image versions, port mappings, or volume mounts, based on your specific deployment environment and requirements. After making any changes, please re-run `docker compose up -d`. You can find the full list of available environment variables [here](https://docs.dify.ai/getting-started/install-self-hosted/environments).

 #### Customizing Suggested Questions

@@ -44,9 +44,7 @@ forbidden_modules =
 allow_indirect_imports = True
 ignore_imports =
    dify_graph.nodes.agent.agent_node -> extensions.ext_database
-    dify_graph.nodes.llm.file_saver -> extensions.ext_database
    dify_graph.nodes.llm.node -> extensions.ext_database
-    dify_graph.nodes.tool.tool_node -> extensions.ext_database
    dify_graph.model_runtime.model_providers.__base.ai_model -> extensions.ext_redis
    dify_graph.model_runtime.model_providers.model_provider_factory -> extensions.ext_redis

@@ -112,9 +110,7 @@ ignore_imports =
    dify_graph.nodes.parameter_extractor.parameter_extractor_node -> core.model_manager
    dify_graph.nodes.question_classifier.question_classifier_node -> core.model_manager
    dify_graph.nodes.tool.tool_node -> core.tools.utils.message_transformer
-    dify_graph.nodes.tool.tool_node -> models
    dify_graph.nodes.agent.agent_node -> models.model
-    dify_graph.nodes.llm.file_saver -> core.helper.ssrf_proxy
    dify_graph.nodes.llm.node -> core.helper.code_executor
    dify_graph.nodes.llm.node -> core.llm_generator.output_parser.errors
    dify_graph.nodes.llm.node -> core.llm_generator.output_parser.structured_output
@@ -135,9 +131,7 @@ ignore_imports =
    dify_graph.nodes.llm.file_saver -> core.tools.tool_file_manager
    dify_graph.nodes.tool.tool_node -> core.tools.errors
    dify_graph.nodes.agent.agent_node -> extensions.ext_database
-    dify_graph.nodes.llm.file_saver -> extensions.ext_database
    dify_graph.nodes.llm.node -> extensions.ext_database
-    dify_graph.nodes.tool.tool_node -> extensions.ext_database
    dify_graph.nodes.agent.agent_node -> models
    dify_graph.nodes.llm.node -> models.model
    dify_graph.nodes.agent.agent_node -> services
@@ -18,3 +18,7 @@ class EnterpriseFeatureConfig(BaseSettings):
        description="Allow customization of the enterprise logo.",
        default=False,
    )
+
+    ENTERPRISE_REQUEST_TIMEOUT: int = Field(
+        ge=1, description="Maximum timeout in seconds for enterprise requests", default=5
+    )
@@ -807,7 +807,7 @@ class DatasetApiKeyApi(Resource):
            console_ns.abort(
                400,
                message=f"Cannot create more than {self.max_keys} API keys for this resource type.",
-                code="max_keys_exceeded",
+                custom="max_keys_exceeded",
            )

        key = ApiToken.generate_api_key(self.token_prefix, 24)
@@ -10,7 +10,6 @@ from controllers.common.file_response import enforce_download_for_html
 from controllers.files import files_ns
 from core.tools.signature import verify_tool_file_signature
 from core.tools.tool_file_manager import ToolFileManager
-from extensions.ext_database import db as global_db

 DEFAULT_REF_TEMPLATE_SWAGGER_2_0 = "#/definitions/{model}"

@@ -57,7 +56,7 @@ class ToolFileApi(Resource):
            raise Forbidden("Invalid request.")

        try:
-            tool_file_manager = ToolFileManager(engine=global_db.engine)
+            tool_file_manager = ToolFileManager()
            stream, tool_file = tool_file_manager.get_file_generator_by_tool_file_id(
                file_id,
            )
@@ -1,8 +1,9 @@
 import json
+from contextlib import ExitStack
 from typing import Self
 from uuid import UUID

-from flask import request
+from flask import request, send_file
 from flask_restx import marshal
 from pydantic import BaseModel, Field, field_validator, model_validator
 from sqlalchemy import desc, select
@@ -100,6 +101,15 @@ class DocumentListQuery(BaseModel):
    status: str | None = Field(default=None, description="Document status filter")


+DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS = 100
+
+
+class DocumentBatchDownloadZipPayload(BaseModel):
+    """Request payload for bulk downloading uploaded documents as a ZIP archive."""
+
+    document_ids: list[UUID] = Field(..., min_length=1, max_length=DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS)
+
+
 register_enum_models(service_api_ns, RetrievalMethod)

 register_schema_models(
@@ -109,6 +119,7 @@ register_schema_models(
    DocumentTextCreatePayload,
    DocumentTextUpdate,
    DocumentListQuery,
+    DocumentBatchDownloadZipPayload,
    Rule,
    PreProcessingRule,
    Segmentation,
@@ -540,6 +551,46 @@ class DocumentListApi(DatasetApiResource):
        return response


+@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/download-zip")
+class DocumentBatchDownloadZipApi(DatasetApiResource):
+    """Download multiple uploaded-file documents as a single ZIP archive."""
+
+    @service_api_ns.expect(service_api_ns.models[DocumentBatchDownloadZipPayload.__name__])
+    @service_api_ns.doc("download_documents_as_zip")
+    @service_api_ns.doc(description="Download selected uploaded documents as a single ZIP archive")
+    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(
+        responses={
+            200: "ZIP archive generated successfully",
+            401: "Unauthorized - invalid API token",
+            403: "Forbidden - insufficient permissions",
+            404: "Document or dataset not found",
+        }
+    )
+    @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
+    def post(self, tenant_id, dataset_id):
+        payload = DocumentBatchDownloadZipPayload.model_validate(service_api_ns.payload or {})
+
+        upload_files, download_name = DocumentService.prepare_document_batch_download_zip(
+            dataset_id=str(dataset_id),
+            document_ids=[str(document_id) for document_id in payload.document_ids],
+            tenant_id=str(tenant_id),
+            current_user=current_user,
+        )
+
+        with ExitStack() as stack:
+            zip_path = stack.enter_context(FileService.build_upload_files_zip_tempfile(upload_files=upload_files))
+            response = send_file(
+                zip_path,
+                mimetype="application/zip",
+                as_attachment=True,
+                download_name=download_name,
+            )
+            cleanup = stack.pop_all()
+            response.call_on_close(cleanup.close)
+        return response
+
+
@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<string:batch>/indexing-status")
 class DocumentIndexingStatusApi(DatasetApiResource):
    @service_api_ns.doc("get_document_indexing_status")
@@ -600,6 +651,35 @@ class DocumentIndexingStatusApi(DatasetApiResource):
        return data


+@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<uuid:document_id>/download")
+class DocumentDownloadApi(DatasetApiResource):
+    """Return a signed download URL for a document's original uploaded file."""
+
+    @service_api_ns.doc("get_document_download_url")
+    @service_api_ns.doc(description="Get a signed download URL for a document's original uploaded file")
+    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(
+        responses={
+            200: "Download URL generated successfully",
+            401: "Unauthorized - invalid API token",
+            403: "Forbidden - insufficient permissions",
+            404: "Document or upload file not found",
+        }
+    )
+    @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
+    def get(self, tenant_id, dataset_id, document_id):
+        dataset = self.get_dataset(str(dataset_id), str(tenant_id))
+        document = DocumentService.get_document(dataset.id, str(document_id))
+
+        if not document:
+            raise NotFound("Document not found.")
+
+        if document.tenant_id != str(tenant_id):
+            raise Forbidden("No permission.")
+
+        return {"url": DocumentService.get_document_download_url(document)}
+
+
@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<uuid:document_id>")
 class DocumentApi(DatasetApiResource):
    METADATA_CHOICES = {"all", "only", "without"}
@@ -239,7 +239,7 @@ class MessageSuggestedQuestionApi(WebApiResource):
    def get(self, app_model, end_user, message_id):
        app_mode = AppMode.value_of(app_model.mode)
        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
-            raise NotCompletionAppError()
+            raise NotChatAppError()

        message_id = str(message_id)

@@ -1,3 +1,4 @@
+import hashlib
 import logging
 import os
 import uuid
@@ -46,6 +47,22 @@ def wrap_metadata(metadata, **kwargs):
    return metadata


+def _seed_to_uuid4(seed: str) -> str:
+    """Derive a deterministic UUID4-formatted string from an arbitrary seed.
+
+    uuid4_to_uuid7 requires a valid UUID v4 string, but some Dify identifiers
+    are not UUIDs (e.g. a workflow_run_id with a "-root" suffix appended to
+    distinguish the root span from the trace).  This helper hashes the seed
+    with MD5 and patches the version/variant bits so the result satisfies the
+    UUID v4 contract.
+    """
+    raw = hashlib.md5(seed.encode()).digest()
+    ba = bytearray(raw)
+    ba[6] = (ba[6] & 0x0F) | 0x40  # version 4
+    ba[8] = (ba[8] & 0x3F) | 0x80  # variant 1
+    return str(uuid.UUID(bytes=bytes(ba)))
+
+
 def prepare_opik_uuid(user_datetime: datetime | None, user_uuid: str | None):
    """Opik needs UUIDv7 while Dify uses UUIDv4 for identifier of most
    messages and objects. The type-hints of BaseTraceInfo indicates that
@@ -95,60 +112,52 @@ class OpikDataTrace(BaseTraceInstance):
            self.generate_name_trace(trace_info)

    def workflow_trace(self, trace_info: WorkflowTraceInfo):
-        dify_trace_id = trace_info.trace_id or trace_info.workflow_run_id
-        opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
        workflow_metadata = wrap_metadata(
            trace_info.metadata, message_id=trace_info.message_id, workflow_app_log_id=trace_info.workflow_app_log_id
        )
-        root_span_id = None

        if trace_info.message_id:
            dify_trace_id = trace_info.trace_id or trace_info.message_id
-            opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
-
-            trace_data = {
-                "id": opik_trace_id,
-                "name": TraceTaskName.MESSAGE_TRACE,
-                "start_time": trace_info.start_time,
-                "end_time": trace_info.end_time,
-                "metadata": workflow_metadata,
-                "input": wrap_dict("input", trace_info.workflow_run_inputs),
-                "output": wrap_dict("output", trace_info.workflow_run_outputs),
-                "thread_id": trace_info.conversation_id,
-                "tags": ["message", "workflow"],
-                "project_name": self.project,
-            }
-            self.add_trace(trace_data)
-
-            root_span_id = prepare_opik_uuid(trace_info.start_time, trace_info.workflow_run_id)
-            span_data = {
-                "id": root_span_id,
-                "parent_span_id": None,
-                "trace_id": opik_trace_id,
-                "name": TraceTaskName.WORKFLOW_TRACE,
-                "input": wrap_dict("input", trace_info.workflow_run_inputs),
-                "output": wrap_dict("output", trace_info.workflow_run_outputs),
-                "start_time": trace_info.start_time,
-                "end_time": trace_info.end_time,
-                "metadata": workflow_metadata,
-                "tags": ["workflow"],
-                "project_name": self.project,
-            }
-            self.add_span(span_data)
+            trace_name = TraceTaskName.MESSAGE_TRACE
+            trace_tags = ["message", "workflow"]
+            root_span_seed = trace_info.workflow_run_id
        else:
-            trace_data = {
-                "id": opik_trace_id,
-                "name": TraceTaskName.MESSAGE_TRACE,
-                "start_time": trace_info.start_time,
-                "end_time": trace_info.end_time,
-                "metadata": workflow_metadata,
-                "input": wrap_dict("input", trace_info.workflow_run_inputs),
-                "output": wrap_dict("output", trace_info.workflow_run_outputs),
-                "thread_id": trace_info.conversation_id,
-                "tags": ["workflow"],
-                "project_name": self.project,
-            }
-            self.add_trace(trace_data)
+            dify_trace_id = trace_info.trace_id or trace_info.workflow_run_id
+            trace_name = TraceTaskName.WORKFLOW_TRACE
+            trace_tags = ["workflow"]
+            root_span_seed = _seed_to_uuid4(trace_info.workflow_run_id + "-root")
+
+        opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
+
+        trace_data = {
+            "id": opik_trace_id,
+            "name": trace_name,
+            "start_time": trace_info.start_time,
+            "end_time": trace_info.end_time,
+            "metadata": workflow_metadata,
+            "input": wrap_dict("input", trace_info.workflow_run_inputs),
+            "output": wrap_dict("output", trace_info.workflow_run_outputs),
+            "thread_id": trace_info.conversation_id,
+            "tags": trace_tags,
+            "project_name": self.project,
+        }
+        self.add_trace(trace_data)
+
+        root_span_id = prepare_opik_uuid(trace_info.start_time, root_span_seed)
+        span_data = {
+            "id": root_span_id,
+            "parent_span_id": None,
+            "trace_id": opik_trace_id,
+            "name": TraceTaskName.WORKFLOW_TRACE,
+            "input": wrap_dict("input", trace_info.workflow_run_inputs),
+            "output": wrap_dict("output", trace_info.workflow_run_outputs),
+            "start_time": trace_info.start_time,
+            "end_time": trace_info.end_time,
+            "metadata": workflow_metadata,
+            "tags": ["workflow"],
+            "project_name": self.project,
+        }
+        self.add_span(span_data)

        # through workflow_run_id get all_nodes_execution using repository
        session_factory = sessionmaker(bind=db.engine)
@@ -231,15 +240,13 @@ class OpikDataTrace(BaseTraceInstance):
            else:
                run_type = "tool"

-            parent_span_id = trace_info.workflow_app_log_id or trace_info.workflow_run_id
-
            if not total_tokens:
                total_tokens = execution_metadata.get(WorkflowNodeExecutionMetadataKey.TOTAL_TOKENS) or 0

            span_data = {
                "trace_id": opik_trace_id,
                "id": prepare_opik_uuid(created_at, node_execution_id),
-                "parent_span_id": prepare_opik_uuid(trace_info.start_time, parent_span_id),
+                "parent_span_id": root_span_id,
                "name": node_name,
                "type": run_type,
                "start_time": created_at,
@@ -114,7 +114,6 @@ class PdfExtractor(BaseExtractor):
        """
        image_content = []
        upload_files = []
-        base_url = dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL

        try:
            image_objects = page.get_objects(filter=(pdfium_c.FPDF_PAGEOBJ_IMAGE,))
@@ -164,7 +163,7 @@ class PdfExtractor(BaseExtractor):
                        used_at=naive_utc_now(),
                    )
                    upload_files.append(upload_file)
-                    image_content.append(f"![image]({base_url}/files/{upload_file.id}/file-preview)")
+                    image_content.append(f"![image](/files/{upload_file.id}/file-preview)")
                except Exception as e:
                    logger.warning("Failed to extract image from PDF: %s", e)
                    continue
@@ -87,7 +87,6 @@ class WordExtractor(BaseExtractor):
    def _extract_images_from_docx(self, doc):
        image_count = 0
        image_map = {}
-        base_url = dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL

        for r_id, rel in doc.part.rels.items():
            if "image" in rel.target_ref:
@@ -126,7 +125,7 @@ class WordExtractor(BaseExtractor):
                            used_at=naive_utc_now(),
                        )
                        db.session.add(upload_file)
-                        image_map[r_id] = f"![image]({base_url}/files/{upload_file.id}/file-preview)"
+                        image_map[r_id] = f"![image](/files/{upload_file.id}/file-preview)"
                else:
                    image_ext = rel.target_ref.split(".")[-1]
                    if image_ext is None:
@@ -154,7 +153,7 @@ class WordExtractor(BaseExtractor):
                        used_at=naive_utc_now(),
                    )
                    db.session.add(upload_file)
-                    image_map[rel.target_part] = f"![image]({base_url}/files/{upload_file.id}/file-preview)"
+                    image_map[rel.target_part] = f"![image](/files/{upload_file.id}/file-preview)"
        db.session.commit()
        return image_map

@@ -57,7 +57,7 @@ from core.rag.retrieval.template_prompts import (
 from core.tools.signature import sign_upload_file
 from core.tools.utils.dataset_retriever.dataset_retriever_base_tool import DatasetRetrieverBaseTool
 from dify_graph.file import File, FileTransferMethod, FileType
-from dify_graph.model_runtime.entities.llm_entities import LLMResult, LLMUsage
+from dify_graph.model_runtime.entities.llm_entities import LLMMode, LLMResult, LLMUsage
 from dify_graph.model_runtime.entities.message_entities import PromptMessage, PromptMessageRole, PromptMessageTool
 from dify_graph.model_runtime.entities.model_entities import ModelFeature, ModelType
 from dify_graph.model_runtime.model_providers.__base.large_language_model import LargeLanguageModel
@@ -127,11 +127,12 @@ class DatasetRetrieval:
        metadata_filter_document_ids, metadata_condition = None, None

        if request.metadata_filtering_mode != "disabled":
-            # Convert workflow layer types to app_config layer types
-            if not request.metadata_model_config:
-                raise ValueError("metadata_model_config is required for this method")
+            app_metadata_model_config = ModelConfig(provider="", name="", mode=LLMMode.CHAT, completion_params={})
+            if request.metadata_filtering_mode == "automatic":
+                if not request.metadata_model_config:
+                    raise ValueError("metadata_model_config is required for this method")

-            app_metadata_model_config = ModelConfig.model_validate(request.metadata_model_config.model_dump())
+                app_metadata_model_config = ModelConfig.model_validate(request.metadata_model_config.model_dump())

            app_metadata_filtering_conditions = None
            if request.metadata_filtering_conditions is not None:
@@ -10,28 +10,19 @@ from typing import Union
 from uuid import uuid4

 import httpx
-from sqlalchemy.orm import Session

 from configs import dify_config
+from core.db.session_factory import session_factory
 from core.helper import ssrf_proxy
-from extensions.ext_database import db as global_db
+from dify_graph.file.models import ToolFile as ToolFilePydanticModel
 from extensions.ext_storage import storage
 from models.model import MessageFile
 from models.tools import ToolFile

 logger = logging.getLogger(__name__)

-from sqlalchemy.engine import Engine
-

 class ToolFileManager:
-    _engine: Engine
-
-    def __init__(self, engine: Engine | None = None):
-        if engine is None:
-            engine = global_db.engine
-        self._engine = engine
-
    @staticmethod
    def sign_file(tool_file_id: str, extension: str) -> str:
        """
@@ -89,7 +80,7 @@ class ToolFileManager:
        filepath = f"tools/{tenant_id}/{unique_filename}"
        storage.save(filepath, file_binary)

-        with Session(self._engine, expire_on_commit=False) as session:
+        with session_factory.create_session() as session:
            tool_file = ToolFile(
                user_id=user_id,
                tenant_id=tenant_id,
@@ -132,7 +123,7 @@ class ToolFileManager:
        filename = f"{unique_name}{extension}"
        filepath = f"tools/{tenant_id}/{filename}"
        storage.save(filepath, blob)
-        with Session(self._engine, expire_on_commit=False) as session:
+        with session_factory.create_session() as session:
            tool_file = ToolFile(
                user_id=user_id,
                tenant_id=tenant_id,
@@ -157,7 +148,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with Session(self._engine, expire_on_commit=False) as session:
+        with session_factory.create_session() as session:
            tool_file: ToolFile | None = (
                session.query(ToolFile)
                .where(
@@ -181,7 +172,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with Session(self._engine, expire_on_commit=False) as session:
+        with session_factory.create_session() as session:
            message_file: MessageFile | None = (
                session.query(MessageFile)
                .where(
@@ -217,7 +208,9 @@ class ToolFileManager:

        return blob, tool_file.mimetype

-    def get_file_generator_by_tool_file_id(self, tool_file_id: str) -> tuple[Generator | None, ToolFile | None]:
+    def get_file_generator_by_tool_file_id(
+        self, tool_file_id: str
+    ) -> tuple[Generator | None, ToolFilePydanticModel | None]:
        """
        get file binary

@@ -225,7 +218,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with Session(self._engine, expire_on_commit=False) as session:
+        with session_factory.create_session() as session:
            tool_file: ToolFile | None = (
                session.query(ToolFile)
                .where(
@@ -239,7 +232,7 @@ class ToolFileManager:

        stream = storage.load_stream(tool_file.file_key)

-        return stream, tool_file
+        return stream, ToolFilePydanticModel.model_validate(tool_file)


 # init tool_file_parser
@@ -50,6 +50,7 @@ from dify_graph.nodes.template_transform.template_renderer import (
    CodeExecutorJinja2TemplateRenderer,
 )
 from dify_graph.nodes.template_transform.template_transform_node import TemplateTransformNode
+from dify_graph.nodes.tool.tool_node import ToolNode
 from dify_graph.variables.segments import StringSegment
 from extensions.ext_database import db
 from models.model import Conversation
@@ -250,6 +251,7 @@ class DifyNodeFactory(NodeFactory):
                model_factory=self._llm_model_factory,
                model_instance=model_instance,
                memory=memory,
+                http_client=self._http_request_http_client,
            )

        if node_type == NodeType.DATASOURCE:
@@ -292,6 +294,7 @@ class DifyNodeFactory(NodeFactory):
                model_factory=self._llm_model_factory,
                model_instance=model_instance,
                memory=memory,
+                http_client=self._http_request_http_client,
            )

        if node_type == NodeType.PARAMETER_EXTRACTOR:
@@ -308,6 +311,15 @@ class DifyNodeFactory(NodeFactory):
                memory=memory,
            )

+        if node_type == NodeType.TOOL:
+            return ToolNode(
+                id=node_id,
+                config=node_config,
+                graph_init_params=self.graph_init_params,
+                graph_runtime_state=self.graph_runtime_state,
+                tool_file_manager_factory=self._http_request_tool_file_manager_factory(),
+            )
+
        return node_class(
            id=node_id,
            config=node_config,
@@ -2,6 +2,7 @@ from __future__ import annotations

 from collections.abc import Mapping, Sequence
 from typing import Any
+from uuid import UUID, uuid4

 from pydantic import BaseModel, Field, model_validator

@@ -43,6 +44,24 @@ class FileUploadConfig(BaseModel):
    number_limits: int = 0


+class ToolFile(BaseModel):
+    id: UUID = Field(default_factory=uuid4, description="Unique identifier for the file")
+    user_id: UUID = Field(..., description="ID of the user who owns this file")
+    tenant_id: UUID = Field(..., description="ID of the tenant/organization")
+    conversation_id: UUID | None = Field(None, description="ID of the associated conversation")
+    file_key: str = Field(..., max_length=255, description="Storage key for the file")
+    mimetype: str = Field(..., max_length=255, description="MIME type of the file")
+    original_url: str | None = Field(
+        None, max_length=2048, description="Original URL if file was fetched from external source"
+    )
+    name: str = Field(default="", max_length=255, description="Display name of the file")
+    size: int = Field(default=-1, ge=-1, description="File size in bytes (-1 if unknown)")
+
+    class Config:
+        from_attributes = True  # Enable ORM mode for SQLAlchemy compatibility
+        populate_by_name = True
+
+
 class File(BaseModel):
    # NOTE: dify_model_identity is a special identifier used to distinguish between
    # new and old data formats during serialization and deserialization.
@@ -14,7 +14,6 @@ from dify_graph.model_runtime.utils.encoders import jsonable_encoder
 from dify_graph.node_events import NodeRunResult
 from dify_graph.nodes.base import LLMUsageTrackingMixin
 from dify_graph.nodes.base.node import Node
-from dify_graph.nodes.llm.file_saver import FileSaverImpl, LLMFileSaver
 from dify_graph.repositories.rag_retrieval_protocol import KnowledgeRetrievalRequest, RAGRetrievalProtocol, Source
 from dify_graph.variables import (
    ArrayFileSegment,
@@ -47,8 +46,6 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
    # Output variable for file
    _file_outputs: list["File"]

-    _llm_file_saver: LLMFileSaver
-
    def __init__(
        self,
        id: str,
@@ -56,8 +53,6 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        graph_init_params: "GraphInitParams",
        graph_runtime_state: "GraphRuntimeState",
        rag_retrieval: RAGRetrievalProtocol,
-        *,
-        llm_file_saver: LLMFileSaver | None = None,
    ):
        super().__init__(
            id=id,
@@ -69,14 +64,6 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        self._file_outputs = []
        self._rag_retrieval = rag_retrieval

-        if llm_file_saver is None:
-            dify_ctx = self.require_dify_context()
-            llm_file_saver = FileSaverImpl(
-                user_id=dify_ctx.user_id,
-                tenant_id=dify_ctx.tenant_id,
-            )
-        self._llm_file_saver = llm_file_saver
-
    @classmethod
    def version(cls):
        return "1"
@@ -1,14 +1,11 @@
 import mimetypes
 import typing as tp

-from sqlalchemy import Engine
-
 from constants.mimetypes import DEFAULT_EXTENSION, DEFAULT_MIME_TYPE
-from core.helper import ssrf_proxy
 from core.tools.signature import sign_tool_file
 from core.tools.tool_file_manager import ToolFileManager
 from dify_graph.file import File, FileTransferMethod, FileType
-from extensions.ext_database import db as global_db
+from dify_graph.nodes.protocols import HttpClientProtocol


 class LLMFileSaver(tp.Protocol):
@@ -59,30 +56,20 @@ class LLMFileSaver(tp.Protocol):
        raise NotImplementedError()


-EngineFactory: tp.TypeAlias = tp.Callable[[], Engine]
-
-
 class FileSaverImpl(LLMFileSaver):
-    _engine_factory: EngineFactory
    _tenant_id: str
    _user_id: str

-    def __init__(self, user_id: str, tenant_id: str, engine_factory: EngineFactory | None = None):
-        if engine_factory is None:
-
-            def _factory():
-                return global_db.engine
-
-            engine_factory = _factory
-        self._engine_factory = engine_factory
+    def __init__(self, user_id: str, tenant_id: str, http_client: HttpClientProtocol):
        self._user_id = user_id
        self._tenant_id = tenant_id
+        self._http_client = http_client

    def _get_tool_file_manager(self):
-        return ToolFileManager(engine=self._engine_factory())
+        return ToolFileManager()

    def save_remote_url(self, url: str, file_type: FileType) -> File:
-        http_response = ssrf_proxy.get(url)
+        http_response = self._http_client.get(url)
        http_response.raise_for_status()
        data = http_response.content
        mime_type_from_header = http_response.headers.get("Content-Type")
@@ -64,6 +64,7 @@ from dify_graph.nodes.base.entities import VariableSelector
 from dify_graph.nodes.base.node import Node
 from dify_graph.nodes.base.variable_template_parser import VariableTemplateParser
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
+from dify_graph.nodes.protocols import HttpClientProtocol
 from dify_graph.runtime import VariablePool
 from dify_graph.variables import (
    ArrayFileSegment,
@@ -127,6 +128,7 @@ class LLMNode(Node[LLMNodeData]):
        credentials_provider: CredentialsProvider,
        model_factory: ModelFactory,
        model_instance: ModelInstance,
+        http_client: HttpClientProtocol,
        memory: PromptMessageMemory | None = None,
        llm_file_saver: LLMFileSaver | None = None,
    ):
@@ -149,6 +151,7 @@ class LLMNode(Node[LLMNodeData]):
            llm_file_saver = FileSaverImpl(
                user_id=dify_ctx.user_id,
                tenant_id=dify_ctx.tenant_id,
+                http_client=http_client,
            )
        self._llm_file_saver = llm_file_saver

@@ -1,8 +1,10 @@
+from collections.abc import Generator
 from typing import Any, Protocol

 import httpx

 from dify_graph.file import File
+from dify_graph.file.models import ToolFile


 class HttpClientProtocol(Protocol):
@@ -40,3 +42,5 @@ class ToolFileManagerProtocol(Protocol):
        mimetype: str,
        filename: str | None = None,
    ) -> Any: ...
+
+    def get_file_generator_by_tool_file_id(self, tool_file_id: str) -> tuple[Generator | None, ToolFile | None]: ...
@@ -28,6 +28,7 @@ from dify_graph.nodes.llm import (
 )
 from dify_graph.nodes.llm.file_saver import FileSaverImpl, LLMFileSaver
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
+from dify_graph.nodes.protocols import HttpClientProtocol
 from libs.json_in_md_parser import parse_and_check_json_markdown

 from .entities import QuestionClassifierNodeData
@@ -68,6 +69,7 @@ class QuestionClassifierNode(Node[QuestionClassifierNodeData]):
        credentials_provider: "CredentialsProvider",
        model_factory: "ModelFactory",
        model_instance: ModelInstance,
+        http_client: HttpClientProtocol,
        memory: PromptMessageMemory | None = None,
        llm_file_saver: LLMFileSaver | None = None,
    ):
@@ -90,6 +92,7 @@ class QuestionClassifierNode(Node[QuestionClassifierNodeData]):
            llm_file_saver = FileSaverImpl(
                user_id=dify_ctx.user_id,
                tenant_id=dify_ctx.tenant_id,
+                http_client=http_client,
            )
        self._llm_file_saver = llm_file_saver

@@ -1,9 +1,6 @@
 from collections.abc import Generator, Mapping, Sequence
 from typing import TYPE_CHECKING, Any

-from sqlalchemy import select
-from sqlalchemy.orm import Session
-
 from core.callback_handler.workflow_tool_callback_handler import DifyWorkflowCallbackHandler
 from core.tools.__base.tool import Tool
 from core.tools.entities.tool_entities import ToolInvokeMessage, ToolParameter
@@ -21,11 +18,10 @@ from dify_graph.model_runtime.entities.llm_entities import LLMUsage
 from dify_graph.node_events import NodeEventBase, NodeRunResult, StreamChunkEvent, StreamCompletedEvent
 from dify_graph.nodes.base.node import Node
 from dify_graph.nodes.base.variable_template_parser import VariableTemplateParser
+from dify_graph.nodes.protocols import ToolFileManagerProtocol
 from dify_graph.variables.segments import ArrayAnySegment, ArrayFileSegment
 from dify_graph.variables.variables import ArrayAnyVariable
-from extensions.ext_database import db
 from factories import file_factory
-from models import ToolFile
 from services.tools.builtin_tools_manage_service import BuiltinToolManageService

 from .entities import ToolNodeData
@@ -36,7 +32,8 @@ from .exc import (
 )

 if TYPE_CHECKING:
-    from dify_graph.runtime import VariablePool
+    from dify_graph.entities import GraphInitParams
+    from dify_graph.runtime import GraphRuntimeState, VariablePool


 class ToolNode(Node[ToolNodeData]):
@@ -46,6 +43,23 @@ class ToolNode(Node[ToolNodeData]):

    node_type = NodeType.TOOL

+    def __init__(
+        self,
+        id: str,
+        config: Mapping[str, Any],
+        graph_init_params: "GraphInitParams",
+        graph_runtime_state: "GraphRuntimeState",
+        *,
+        tool_file_manager_factory: ToolFileManagerProtocol,
+    ):
+        super().__init__(
+            id=id,
+            config=config,
+            graph_init_params=graph_init_params,
+            graph_runtime_state=graph_runtime_state,
+        )
+        self._tool_file_manager_factory = tool_file_manager_factory
+
    @classmethod
    def version(cls) -> str:
        return "1"
@@ -271,11 +285,9 @@ class ToolNode(Node[ToolNodeData]):

                tool_file_id = str(url).split("/")[-1].split(".")[0]

-                with Session(db.engine) as session:
-                    stmt = select(ToolFile).where(ToolFile.id == tool_file_id)
-                    tool_file = session.scalar(stmt)
-                    if tool_file is None:
-                        raise ToolFileError(f"Tool file {tool_file_id} does not exist")
+                _, tool_file = self._tool_file_manager_factory.get_file_generator_by_tool_file_id(tool_file_id)
+                if not tool_file:
+                    raise ToolFileError(f"tool file {tool_file_id} not found")

                mapping = {
                    "tool_file_id": tool_file_id,
@@ -294,11 +306,9 @@ class ToolNode(Node[ToolNodeData]):
                assert message.meta

                tool_file_id = message.message.text.split("/")[-1].split(".")[0]
-                with Session(db.engine) as session:
-                    stmt = select(ToolFile).where(ToolFile.id == tool_file_id)
-                    tool_file = session.scalar(stmt)
-                    if tool_file is None:
-                        raise ToolFileError(f"tool file {tool_file_id} not exists")
+                _, tool_file = self._tool_file_manager_factory.get_file_generator_by_tool_file_id(tool_file_id)
+                if not tool_file:
+                    raise ToolFileError(f"tool file {tool_file_id} not exists")

                mapping = {
                    "tool_file_id": tool_file_id,
@@ -0,0 +1,114 @@
+"""
+Celery SQL comment context for OpenTelemetry SQLCommenter.
+
+Injects Celery-specific metadata (framework, task_name, traceparent, celery_retries,
+routing_key) into SQL comments for queries executed by Celery workers. This improves
+trace-to-SQL correlation and debugging in production.
+
+Uses the OpenTelemetry context key SQLCOMMENTER_ORM_TAGS_AND_VALUES, which is read
+by opentelemetry.instrumentation.sqlcommenter_utils._add_framework_tags() when the
+SQLAlchemy instrumentor appends comments to SQL statements.
+"""
+
+import logging
+from typing import Any
+
+from celery.signals import task_postrun, task_prerun
+from opentelemetry import context
+from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
+
+logger = logging.getLogger(__name__)
+_TRACE_PROPAGATOR = TraceContextTextMapPropagator()
+
+_SQLCOMMENTER_CONTEXT_KEY = "SQLCOMMENTER_ORM_TAGS_AND_VALUES"
+_TOKEN_ATTR = "_dify_sqlcommenter_context_token"
+
+
+def _build_celery_sqlcommenter_tags(task: Any) -> dict[str, str | int]:
+    """Build SQL commenter tags from the current Celery task and OpenTelemetry context."""
+    tags: dict[str, str | int] = {}
+
+    try:
+        tags["framework"] = f"celery:{_get_celery_version()}"
+    except Exception:
+        tags["framework"] = "celery:unknown"
+
+    if task and getattr(task, "name", None):
+        tags["task_name"] = str(task.name)
+
+    traceparent = _get_traceparent()
+    if traceparent:
+        tags["traceparent"] = traceparent
+
+    if task and hasattr(task, "request"):
+        request = task.request
+        retries = getattr(request, "retries", None)
+        if retries is not None and retries > 0:
+            tags["celery_retries"] = int(retries)
+
+        delivery_info = getattr(request, "delivery_info", None) or {}
+        if isinstance(delivery_info, dict):
+            routing_key = delivery_info.get("routing_key")
+            if routing_key:
+                tags["routing_key"] = str(routing_key)
+
+    return tags
+
+
+def _get_celery_version() -> str:
+    import celery
+
+    return getattr(celery, "__version__", "unknown")
+
+
+def _get_traceparent() -> str | None:
+    """Extract traceparent from the current OpenTelemetry context."""
+    carrier: dict[str, str] = {}
+    _TRACE_PROPAGATOR.inject(carrier)
+    return carrier.get("traceparent")
+
+
+def _on_task_prerun(*args: object, **kwargs: object) -> None:
+    task = kwargs.get("task")
+    if not task:
+        return
+
+    tags = _build_celery_sqlcommenter_tags(task)
+    if not tags:
+        return
+
+    current = context.get_current()
+    new_ctx = context.set_value(_SQLCOMMENTER_CONTEXT_KEY, tags, current)
+    token = context.attach(new_ctx)
+    setattr(task, _TOKEN_ATTR, token)
+
+
+def _on_task_postrun(*args: object, **kwargs: object) -> None:
+    task = kwargs.get("task")
+    if not task:
+        return
+
+    token = getattr(task, _TOKEN_ATTR, None)
+    if token is None:
+        return
+
+    try:
+        context.detach(token)
+    except Exception:
+        logger.debug("Failed to detach SQL commenter context", exc_info=True)
+    finally:
+        try:
+            delattr(task, _TOKEN_ATTR)
+        except AttributeError:
+            pass
+
+
+def setup_celery_sqlcommenter() -> None:
+    """
+    Connect Celery task_prerun and task_postrun handlers to inject SQL comment
+    context for worker queries. Call this from init_celery_worker after
+    CeleryInstrumentor().instrument() so our handlers run after the OTEL
+    instrumentor's and the trace context is already attached.
+    """
+    task_prerun.connect(_on_task_prerun, weak=False)
+    task_postrun.connect(_on_task_postrun, weak=False)
@@ -67,11 +67,14 @@ def init_celery_worker(*args, **kwargs):
        from opentelemetry.metrics import get_meter_provider
        from opentelemetry.trace import get_tracer_provider

+        from extensions.otel.celery_sqlcommenter import setup_celery_sqlcommenter
+
        tracer_provider = get_tracer_provider()
        metric_provider = get_meter_provider()
        if dify_config.DEBUG:
            logger.info("Initializing OpenTelemetry for Celery worker")
        CeleryInstrumentor(tracer_provider=tracer_provider, meter_provider=metric_provider).instrument()
+        setup_celery_sqlcommenter()


 def is_instrument_flag_enabled() -> bool:
@@ -10,6 +10,7 @@ import re
 import time
 from datetime import datetime
 from json import JSONDecodeError
+from operator import itemgetter
 from typing import Any, cast
 from uuid import uuid4

@@ -806,41 +807,53 @@ class DocumentSegment(Base):
    def sign_content(self) -> str:
        return self.get_sign_content()

+    @staticmethod
+    def _build_signed_query_params(*, sign_target: str, upload_file_id: str) -> str:
+        nonce = os.urandom(16).hex()
+        timestamp = str(int(time.time()))
+        data_to_sign = f"{sign_target}|{upload_file_id}|{timestamp}|{nonce}"
+        secret_key = dify_config.SECRET_KEY.encode() if dify_config.SECRET_KEY else b""
+        sign = hmac.new(secret_key, data_to_sign.encode(), hashlib.sha256).digest()
+        encoded_sign = base64.urlsafe_b64encode(sign).decode()
+        return f"timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}"
+
+    def _get_accessible_upload_file_ids(self, upload_file_ids: set[str]) -> set[str]:
+        if not upload_file_ids:
+            return set()
+
+        matched_upload_file_ids = db.session.scalars(
+            select(UploadFile.id).where(
+                UploadFile.tenant_id == self.tenant_id,
+                UploadFile.id.in_(list(upload_file_ids)),
+            )
+        ).all()
+        return {str(upload_file_id) for upload_file_id in matched_upload_file_ids}
+
    def get_sign_content(self) -> str:
        signed_urls: list[tuple[int, int, str]] = []
        text = self.content

-        # For data before v0.10.0
-        pattern = r"/files/([a-f0-9\-]+)/image-preview(?:\?.*?)?"
-        matches = re.finditer(pattern, text)
-        for match in matches:
-            upload_file_id = match.group(1)
-            nonce = os.urandom(16).hex()
-            timestamp = str(int(time.time()))
-            data_to_sign = f"image-preview|{upload_file_id}|{timestamp}|{nonce}"
-            secret_key = dify_config.SECRET_KEY.encode() if dify_config.SECRET_KEY else b""
-            sign = hmac.new(secret_key, data_to_sign.encode(), hashlib.sha256).digest()
-            encoded_sign = base64.urlsafe_b64encode(sign).decode()
+        upload_file_preview_patterns = {
+            "image-preview": r"(?:https?://[^\s\)\"\']+)?/files/([a-f0-9\-]+)/image-preview(?:\?[^\s\)\"\']*)?",
+            "file-preview": r"(?:https?://[^\s\)\"\']+)?/files/([a-f0-9\-]+)/file-preview(?:\?[^\s\)\"\']*)?",
+        }
+        upload_file_matches: list[tuple[re.Match[str], str, str]] = []
+        upload_file_ids: set[str] = set()

-            params = f"timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}"
-            base_url = f"/files/{upload_file_id}/image-preview"
-            signed_url = f"{base_url}?{params}"
-            signed_urls.append((match.start(), match.end(), signed_url))
+        for preview_type, pattern in upload_file_preview_patterns.items():
+            for match in re.finditer(pattern, text):
+                upload_file_id = match.group(1)
+                upload_file_matches.append((match, preview_type, upload_file_id))
+                upload_file_ids.add(upload_file_id)

-        # For data after v0.10.0
-        pattern = r"/files/([a-f0-9\-]+)/file-preview(?:\?.*?)?"
-        matches = re.finditer(pattern, text)
-        for match in matches:
-            upload_file_id = match.group(1)
-            nonce = os.urandom(16).hex()
-            timestamp = str(int(time.time()))
-            data_to_sign = f"file-preview|{upload_file_id}|{timestamp}|{nonce}"
-            secret_key = dify_config.SECRET_KEY.encode() if dify_config.SECRET_KEY else b""
-            sign = hmac.new(secret_key, data_to_sign.encode(), hashlib.sha256).digest()
-            encoded_sign = base64.urlsafe_b64encode(sign).decode()
+        accessible_upload_file_ids = self._get_accessible_upload_file_ids(upload_file_ids)

-            params = f"timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}"
-            base_url = f"/files/{upload_file_id}/file-preview"
+        for match, preview_type, upload_file_id in upload_file_matches:
+            if upload_file_id not in accessible_upload_file_ids:
+                continue
+
+            params = self._build_signed_query_params(sign_target=preview_type, upload_file_id=upload_file_id)
+            base_url = f"/files/{upload_file_id}/{preview_type}"
            signed_url = f"{base_url}?{params}"
            signed_urls.append((match.start(), match.end(), signed_url))

@@ -851,19 +864,13 @@ class DocumentSegment(Base):
        for match in matches:
            upload_file_id = match.group(1)
            file_extension = match.group(2)
-            nonce = os.urandom(16).hex()
-            timestamp = str(int(time.time()))
-            data_to_sign = f"file-preview|{upload_file_id}|{timestamp}|{nonce}"
-            secret_key = dify_config.SECRET_KEY.encode() if dify_config.SECRET_KEY else b""
-            sign = hmac.new(secret_key, data_to_sign.encode(), hashlib.sha256).digest()
-            encoded_sign = base64.urlsafe_b64encode(sign).decode()
-
-            params = f"timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}"
+            params = self._build_signed_query_params(sign_target="file-preview", upload_file_id=upload_file_id)
            base_url = f"/files/tools/{upload_file_id}.{file_extension}"
            signed_url = f"{base_url}?{params}"
            signed_urls.append((match.start(), match.end(), signed_url))

        # Reconstruct the text with signed URLs
+        signed_urls.sort(key=itemgetter(0))
        offset = 0
        for start, end, signed_url in signed_urls:
            text = text[: start + offset] + signed_url + text[end + offset :]
@@ -21,6 +21,10 @@ celery_redis = Redis(
    ssl_cert_reqs=getattr(dify_config, "REDIS_SSL_CERT_REQS", None) if dify_config.BROKER_USE_SSL else None,
    ssl_certfile=getattr(dify_config, "REDIS_SSL_CERTFILE", None) if dify_config.BROKER_USE_SSL else None,
    ssl_keyfile=getattr(dify_config, "REDIS_SSL_KEYFILE", None) if dify_config.BROKER_USE_SSL else None,
+    # Add conservative socket timeouts and health checks to avoid long-lived half-open sockets
+    socket_timeout=5,
+    socket_connect_timeout=5,
+    health_check_interval=30,
 )

 logger = logging.getLogger(__name__)
@@ -3,6 +3,7 @@ import math
 import time
 from collections.abc import Iterable, Sequence

+from celery import group
 from sqlalchemy import ColumnElement, and_, func, or_, select
 from sqlalchemy.engine.row import Row
 from sqlalchemy.orm import Session
@@ -85,20 +86,25 @@ def trigger_provider_refresh() -> None:
            lock_keys: list[str] = build_trigger_refresh_lock_keys(subscriptions)
            acquired: list[bool] = _acquire_locks(keys=lock_keys, ttl_seconds=lock_ttl)

-            enqueued: int = 0
-            for (tenant_id, subscription_id), is_locked in zip(subscriptions, acquired):
-                if not is_locked:
-                    continue
-                trigger_subscription_refresh.delay(tenant_id=tenant_id, subscription_id=subscription_id)
-                enqueued += 1
+            if not any(acquired):
+                continue
+
+            jobs = [
+                trigger_subscription_refresh.s(tenant_id=tenant_id, subscription_id=subscription_id)
+                for (tenant_id, subscription_id), is_locked in zip(subscriptions, acquired)
+                if is_locked
+            ]
+            result = group(jobs).apply_async()
+            enqueued = len(jobs)

            logger.info(
-                "Trigger refresh page %d/%d: scanned=%d locks_acquired=%d enqueued=%d",
+                "Trigger refresh page %d/%d: scanned=%d locks_acquired=%d enqueued=%d result=%s",
                page + 1,
                pages,
                len(subscriptions),
                sum(1 for x in acquired if x),
                enqueued,
+                result,
            )

    logger.info("Trigger refresh scan done: due=%d", total_due)
@@ -1,6 +1,6 @@
 import logging

-from celery import group, shared_task
+from celery import current_app, group, shared_task
 from sqlalchemy import and_, select
 from sqlalchemy.orm import Session, sessionmaker

@@ -29,31 +29,27 @@ def poll_workflow_schedules() -> None:
    with session_factory() as session:
        total_dispatched = 0

-        # Process in batches until we've handled all due schedules or hit the limit
        while True:
            due_schedules = _fetch_due_schedules(session)

            if not due_schedules:
                break

-            dispatched_count = _process_schedules(session, due_schedules)
-            total_dispatched += dispatched_count
+            with current_app.producer_or_acquire() as producer:  # type: ignore
+                dispatched_count = _process_schedules(session, due_schedules, producer)
+                total_dispatched += dispatched_count

-            logger.debug("Batch processed: %d dispatched", dispatched_count)
-
-            # Circuit breaker: check if we've hit the per-tick limit (if enabled)
-            if (
-                dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK > 0
-                and total_dispatched >= dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK
-            ):
-                logger.warning(
-                    "Circuit breaker activated: reached dispatch limit (%d), will continue next tick",
-                    dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK,
-                )
-                break
+                logger.debug("Batch processed: %d dispatched", dispatched_count)

+                # Circuit breaker: check if we've hit the per-tick limit (if enabled)
+                if 0 < dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK <= total_dispatched:
+                    logger.warning(
+                        "Circuit breaker activated: reached dispatch limit (%d), will continue next tick",
+                        dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK,
+                    )
+                    break
        if total_dispatched > 0:
-            logger.info("Total processed: %d dispatched", total_dispatched)
+            logger.info("Total processed: %d workflow schedule(s) dispatched", total_dispatched)


 def _fetch_due_schedules(session: Session) -> list[WorkflowSchedulePlan]:
@@ -90,7 +86,7 @@ def _fetch_due_schedules(session: Session) -> list[WorkflowSchedulePlan]:
    return list(due_schedules)


-def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan]) -> int:
+def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan], producer=None) -> int:
    """Process schedules: check quota, update next run time and dispatch to Celery in parallel."""
    if not schedules:
        return 0
@@ -107,7 +103,7 @@ def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan])

    if tasks_to_dispatch:
        job = group(run_schedule_trigger.s(schedule_id) for schedule_id in tasks_to_dispatch)
-        job.apply_async()
+        job.apply_async(producer=producer)

        logger.debug("Dispatched %d tasks in parallel", len(tasks_to_dispatch))

@@ -824,6 +824,7 @@ class DatasourceProviderService:
                "langgenius/firecrawl_datasource",
                "langgenius/notion_datasource",
                "langgenius/jina_datasource",
+                "watercrawl/watercrawl_datasource",
            ]:
                datasource_provider_id = DatasourceProviderID(f"{datasource.plugin_id}/{datasource.provider}")
                credentials = self.list_datasource_credentials(
@@ -3,6 +3,7 @@ import logging

 from pydantic import BaseModel

+from configs import dify_config
 from services.enterprise.base import EnterprisePluginManagerRequest
 from services.errors.base import BaseServiceError

@@ -28,6 +29,11 @@ class CheckCredentialPolicyComplianceRequest(BaseModel):
        return data


+class PreUninstallPluginRequest(BaseModel):
+    tenant_id: str
+    plugin_unique_identifier: str
+
+
 class CredentialPolicyViolationError(BaseServiceError):
    pass

@@ -55,3 +61,21 @@ class PluginManagerService:
            body.dify_credential_id,
            ret.get("result", False),
        )
+
+    @classmethod
+    def try_pre_uninstall_plugin(cls, body: PreUninstallPluginRequest):
+        try:
+            # the invocation must be synchronous.
+            EnterprisePluginManagerRequest.send_request(
+                "POST",
+                "/pre-uninstall-plugin",
+                json=body.model_dump(),
+                raise_for_status=True,
+                timeout=dify_config.ENTERPRISE_REQUEST_TIMEOUT,
+            )
+        except Exception:
+            logger.exception(
+                "failed to perform pre uninstall plugin hook. tenant_id: %s, plugin_unique_identifier: %s",
+                body.tenant_id,
+                body.plugin_unique_identifier,
+            )
@@ -32,6 +32,10 @@ from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from models.provider import Provider, ProviderCredential
 from models.provider_ids import GenericProviderID
+from services.enterprise.plugin_manager_service import (
+    PluginManagerService,
+    PreUninstallPluginRequest,
+)
 from services.errors.plugin import PluginInstallationForbiddenError
 from services.feature_service import FeatureService, PluginInstallationScope

@@ -519,6 +523,13 @@ class PluginService:
        if not plugin:
            return manager.uninstall(tenant_id, plugin_installation_id)

+        if dify_config.ENTERPRISE_ENABLED:
+            PluginManagerService.try_pre_uninstall_plugin(
+                PreUninstallPluginRequest(
+                    tenant_id=tenant_id,
+                    plugin_unique_identifier=plugin.plugin_unique_identifier,
+                )
+            )
        with Session(db.engine) as session, session.begin():
            plugin_id = plugin.plugin_id
            logger.info("Deleting credentials for plugin: %s", plugin_id)
@@ -124,7 +124,7 @@ class WebsiteService:
        if provider == "firecrawl":
            plugin_id = "langgenius/firecrawl_datasource"
        elif provider == "watercrawl":
-            plugin_id = "langgenius/watercrawl_datasource"
+            plugin_id = "watercrawl/watercrawl_datasource"
        elif provider == "jinareader":
            plugin_id = "langgenius/jina_datasource"
        else:
@@ -1,9 +1,10 @@
 import logging
 import time
-from collections.abc import Callable, Sequence
+from collections.abc import Sequence
+from typing import Any, Protocol

 import click
-from celery import shared_task
+from celery import current_app, shared_task

 from configs import dify_config
 from core.db.session_factory import session_factory
@@ -19,6 +20,12 @@ from tasks.generate_summary_index_task import generate_summary_index_task
 logger = logging.getLogger(__name__)


+class CeleryTaskLike(Protocol):
+    def delay(self, *args: Any, **kwargs: Any) -> Any: ...
+
+    def apply_async(self, *args: Any, **kwargs: Any) -> Any: ...
+
+
@shared_task(queue="dataset")
 def document_indexing_task(dataset_id: str, document_ids: list):
    """
@@ -179,8 +186,8 @@ def _document_indexing(dataset_id: str, document_ids: Sequence[str]):


 def _document_indexing_with_tenant_queue(
-    tenant_id: str, dataset_id: str, document_ids: Sequence[str], task_func: Callable[[str, str, Sequence[str]], None]
-):
+    tenant_id: str, dataset_id: str, document_ids: Sequence[str], task_func: CeleryTaskLike
+) -> None:
    try:
        _document_indexing(dataset_id, document_ids)
    except Exception:
@@ -201,16 +208,20 @@ def _document_indexing_with_tenant_queue(
        logger.info("document indexing tenant isolation queue %s next tasks: %s", tenant_id, next_tasks)

        if next_tasks:
-            for next_task in next_tasks:
-                document_task = DocumentTask(**next_task)
-                # Process the next waiting task
-                # Keep the flag set to indicate a task is running
-                tenant_isolated_task_queue.set_task_waiting_time()
-                task_func.delay(  # type: ignore
-                    tenant_id=document_task.tenant_id,
-                    dataset_id=document_task.dataset_id,
-                    document_ids=document_task.document_ids,
-                )
+            with current_app.producer_or_acquire() as producer:  # type: ignore
+                for next_task in next_tasks:
+                    document_task = DocumentTask(**next_task)
+                    # Keep the flag set to indicate a task is running
+                    tenant_isolated_task_queue.set_task_waiting_time()
+                    task_func.apply_async(
+                        kwargs={
+                            "tenant_id": document_task.tenant_id,
+                            "dataset_id": document_task.dataset_id,
+                            "document_ids": document_task.document_ids,
+                        },
+                        producer=producer,
+                    )
+
        else:
            # No more waiting tasks, clear the flag
            tenant_isolated_task_queue.delete_task_key()
@@ -3,12 +3,13 @@ import json
 import logging
 import time
 import uuid
-from collections.abc import Mapping
+from collections.abc import Mapping, Sequence
 from concurrent.futures import ThreadPoolExecutor
+from itertools import islice
 from typing import Any

 import click
-from celery import shared_task  # type: ignore
+from celery import group, shared_task
 from flask import current_app, g
 from sqlalchemy.orm import Session, sessionmaker

@@ -27,6 +28,11 @@ from services.file_service import FileService
 logger = logging.getLogger(__name__)


+def chunked(iterable: Sequence, size: int):
+    it = iter(iterable)
+    return iter(lambda: list(islice(it, size)), [])
+
+
@shared_task(queue="pipeline")
 def rag_pipeline_run_task(
    rag_pipeline_invoke_entities_file_id: str,
@@ -83,16 +89,24 @@ def rag_pipeline_run_task(
        logger.info("rag pipeline tenant isolation queue %s next files: %s", tenant_id, next_file_ids)

        if next_file_ids:
-            for next_file_id in next_file_ids:
-                # Process the next waiting task
-                # Keep the flag set to indicate a task is running
-                tenant_isolated_task_queue.set_task_waiting_time()
-                rag_pipeline_run_task.delay(  # type: ignore
-                    rag_pipeline_invoke_entities_file_id=next_file_id.decode("utf-8")
-                    if isinstance(next_file_id, bytes)
-                    else next_file_id,
-                    tenant_id=tenant_id,
-                )
+            for batch in chunked(next_file_ids, 100):
+                jobs = []
+                for next_file_id in batch:
+                    tenant_isolated_task_queue.set_task_waiting_time()
+
+                    file_id = (
+                        next_file_id.decode("utf-8") if isinstance(next_file_id, (bytes, bytearray)) else next_file_id
+                    )
+
+                    jobs.append(
+                        rag_pipeline_run_task.s(
+                            rag_pipeline_invoke_entities_file_id=file_id,
+                            tenant_id=tenant_id,
+                        )
+                    )
+
+                if jobs:
+                    group(jobs).apply_async()
        else:
            # No more waiting tasks, clear the flag
            tenant_isolated_task_queue.delete_task_key()
@@ -11,6 +11,7 @@ from dify_graph.enums import WorkflowNodeExecutionStatus
 from dify_graph.node_events import StreamCompletedEvent
 from dify_graph.nodes.llm.node import LLMNode
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
+from dify_graph.nodes.protocols import HttpClientProtocol
 from dify_graph.runtime import GraphRuntimeState, VariablePool
 from dify_graph.system_variable import SystemVariable
 from extensions.ext_database import db
@@ -74,6 +75,7 @@ def init_llm_node(config: dict) -> LLMNode:
        credentials_provider=MagicMock(spec=CredentialsProvider),
        model_factory=MagicMock(spec=ModelFactory),
        model_instance=MagicMock(spec=ModelInstance),
+        http_client=MagicMock(spec=HttpClientProtocol),
    )

    return node
@@ -8,6 +8,7 @@ from core.workflow.node_factory import DifyNodeFactory
 from dify_graph.enums import WorkflowNodeExecutionStatus
 from dify_graph.graph import Graph
 from dify_graph.node_events import StreamCompletedEvent
+from dify_graph.nodes.protocols import ToolFileManagerProtocol
 from dify_graph.nodes.tool.tool_node import ToolNode
 from dify_graph.runtime import GraphRuntimeState, VariablePool
 from dify_graph.system_variable import SystemVariable
@@ -55,11 +56,14 @@ def init_tool_node(config: dict):

    graph = Graph.init(graph_config=graph_config, node_factory=node_factory)

+    tool_file_manager_factory = MagicMock(spec=ToolFileManagerProtocol)
+
    node = ToolNode(
        id=str(uuid.uuid4()),
        config=config,
        graph_init_params=init_params,
        graph_runtime_state=graph_runtime_state,
+        tool_file_manager_factory=tool_file_manager_factory,
    )
    return node

@@ -8,6 +8,7 @@ from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
 from dify_graph.repositories.rag_retrieval_protocol import KnowledgeRetrievalRequest
 from models.dataset import Dataset, Document
 from services.account_service import AccountService, TenantService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestGetAvailableDatasetsIntegration:
@@ -22,7 +23,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -83,7 +84,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -136,7 +137,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -189,7 +190,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -252,7 +253,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -286,7 +287,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account1, name=fake.company())
        tenant1 = account1.current_tenant
@@ -295,7 +296,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account2, name=fake.company())
        tenant2 = account2.current_tenant
@@ -362,7 +363,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -384,7 +385,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -445,7 +446,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -513,7 +514,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -561,7 +562,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1 +1,24 @@
 """Helper utilities for integration tests."""
+
+import re
+
+
+def generate_valid_password(fake, length: int = 12) -> str:
+    """Generate a password that always satisfies the project's password validation rules.
+
+    The password validation rule in ``api/libs/password.py`` requires passwords to
+    contain **both letters and digits** with a minimum length of 8:
+
+        ``^(?=.*[a-zA-Z])(?=.*\\d).{8,}$``
+
+    ``Faker.password()`` does **not** guarantee that the generated password will
+    contain both character types, which can cause intermittent test failures.
+
+    This helper re-generates until the result is valid (typically first attempt).
+    """
+    for _ in range(100):
+        pwd = fake.password(length=length)
+        if re.search(r"[a-zA-Z]", pwd) and re.search(r"\d", pwd):
+            return pwd
+    # Fallback: should never be reached in practice
+    return fake.password(length=max(length - 2, 6)) + "a1"
@@ -20,6 +20,7 @@ from services.errors.account import (
    TenantNotFoundError,
 )
 from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAccountService:
@@ -53,7 +54,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -133,7 +134,7 @@ class TestAccountService:
                email=email,
                name=name,
                interface_language="en-US",
-                password=fake.password(length=12),
+                password=generate_valid_password(fake),
            )

    def test_create_account_email_in_freeze(
@@ -145,7 +146,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = True
@@ -169,7 +170,7 @@ class TestAccountService:
        """
        fake = Faker()
        email = fake.email()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        with pytest.raises(AccountPasswordError):
            AccountService.authenticate(email, password)

@@ -180,7 +181,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -208,8 +209,8 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        correct_password = fake.password(length=12)
-        wrong_password = fake.password(length=12)
+        correct_password = generate_valid_password(fake)
+        wrong_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -234,7 +235,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        new_password = fake.password(length=12)
+        new_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -267,7 +268,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -297,8 +298,8 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = fake.password(length=12)
-        new_password = fake.password(length=12)
+        old_password = generate_valid_password(fake)
+        new_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -327,9 +328,9 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = fake.password(length=12)
-        wrong_password = fake.password(length=12)
-        new_password = fake.password(length=12)
+        old_password = generate_valid_password(fake)
+        wrong_password = generate_valid_password(fake)
+        new_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -354,7 +355,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = fake.password(length=12)
+        old_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -378,7 +379,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -412,7 +413,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -437,7 +438,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -535,7 +536,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -563,7 +564,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        updated_name = fake.name()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -592,7 +593,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -615,7 +616,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -645,7 +646,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -684,7 +685,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -714,7 +715,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -747,7 +748,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -792,7 +793,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -825,7 +826,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -864,7 +865,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -892,7 +893,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -926,7 +927,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -957,7 +958,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -997,7 +998,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1043,7 +1044,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1080,7 +1081,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1110,7 +1111,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1139,7 +1140,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        wrong_code = fake.numerify(text="######")
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -1259,7 +1260,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1291,10 +1292,10 @@ class TestTenantService:
        tenant_name = fake.company()
        email1 = fake.email()
        name1 = fake.name()
-        password1 = fake.password(length=12)
+        password1 = generate_valid_password(fake)
        email2 = fake.email()
        name2 = fake.name()
-        password2 = fake.password(length=12)
+        password2 = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1332,7 +1333,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1364,7 +1365,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant1_name = fake.company()
        tenant2_name = fake.company()
        # Setup mocks
@@ -1403,7 +1404,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -1441,7 +1442,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1466,7 +1467,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant1_name = fake.company()
        tenant2_name = fake.company()
        # Setup mocks
@@ -1507,7 +1508,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1534,7 +1535,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -1562,10 +1563,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = fake.password(length=12)
+        admin_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1631,7 +1632,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1664,10 +1665,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = fake.password(length=12)
+        member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1705,7 +1706,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        invalid_action = "invalid_action_that_doesnt_exist"
        # Setup mocks
        mock_external_service_dependencies[
@@ -1738,7 +1739,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1770,10 +1771,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = fake.password(length=12)
+        member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1829,7 +1830,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1861,10 +1862,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        non_member_email = fake.email()
        non_member_name = fake.name()
-        non_member_password = fake.password(length=12)
+        non_member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1900,10 +1901,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = fake.password(length=12)
+        member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1949,10 +1950,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = fake.password(length=12)
+        member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2006,10 +2007,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = fake.password(length=12)
+        member_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2071,7 +2072,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        workspace_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -2110,7 +2111,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        existing_tenant_name = fake.company()
        new_workspace_name = fake.company()
        # Setup mocks
@@ -2151,7 +2152,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        workspace_name = fake.company()
        # Setup mocks to disable workspace creation
        mock_external_service_dependencies[
@@ -2178,13 +2179,13 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = fake.password(length=12)
+        admin_password = generate_valid_password(fake)
        normal_email = fake.email()
        normal_name = fake.name()
-        normal_password = fake.password(length=12)
+        normal_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2244,13 +2245,13 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = fake.password(length=12)
+        owner_password = generate_valid_password(fake)
        operator_email = fake.email()
        operator_name = fake.name()
-        operator_password = fake.password(length=12)
+        operator_password = generate_valid_password(fake)
        normal_email = fake.email()
        normal_name = fake.name()
-        normal_password = fake.password(length=12)
+        normal_password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2351,7 +2352,7 @@ class TestRegisterService:
        fake = Faker()
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = fake.password(length=12)
+        admin_password = generate_valid_password(fake)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2399,7 +2400,7 @@ class TestRegisterService:
        fake = Faker()
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = fake.password(length=12)
+        admin_password = generate_valid_password(fake)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2440,7 +2441,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2531,7 +2532,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2576,7 +2577,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2614,7 +2615,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2653,7 +2654,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2690,7 +2691,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = fake.password(length=12)
+        inviter_password = generate_valid_password(fake)
        new_member_email = fake.email()
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
@@ -2760,10 +2761,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = fake.password(length=12)
+        inviter_password = generate_valid_password(fake)
        existing_member_email = fake.email()
        existing_member_name = fake.name()
-        existing_member_password = fake.password(length=12)
+        existing_member_password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2824,10 +2825,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = fake.password(length=12)
+        inviter_password = generate_valid_password(fake)
        existing_pending_member_email = fake.email()
        existing_pending_member_name = fake.name()
-        existing_pending_member_password = fake.password(length=12)
+        existing_pending_member_password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2914,10 +2915,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = fake.password(length=12)
+        inviter_password = generate_valid_password(fake)
        already_in_tenant_email = fake.email()
        already_in_tenant_name = fake.name()
-        already_in_tenant_password = fake.password(length=12)
+        already_in_tenant_password = generate_valid_password(fake)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2967,7 +2968,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3011,7 +3012,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3058,7 +3059,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3101,7 +3102,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3144,7 +3145,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3212,7 +3213,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        invalid_tenant_id = fake.uuid4()
        token = fake.uuid4()
        # Setup mocks
@@ -3263,7 +3264,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        token = fake.uuid4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -3313,7 +3314,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        token = fake.uuid4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -11,6 +11,7 @@ from models.model import AppModelConfig, Conversation, EndUser, Message, Message
 from services.account_service import AccountService, TenantService
 from services.agent_service import AgentService
 from services.app_service import AppService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAgentService:
@@ -111,7 +112,7 @@ class TestAgentService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -9,6 +9,7 @@ from models import Account
 from models.model import MessageAnnotation
 from services.annotation_service import AppAnnotationService
 from services.app_service import AppService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAnnotationService:
@@ -78,7 +79,7 @@ class TestAnnotationService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -7,6 +7,7 @@ from sqlalchemy.orm import Session
 from models.api_based_extension import APIBasedExtension
 from services.account_service import AccountService, TenantService
 from services.api_based_extension_service import APIBasedExtensionService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAPIBasedExtensionService:
@@ -55,7 +56,7 @@ class TestAPIBasedExtensionService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -9,6 +9,7 @@ from models.model import App, AppModelConfig
 from services.account_service import AccountService, TenantService
 from services.app_dsl_service import AppDslService, ImportMode, ImportStatus
 from services.app_service import AppService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAppDslService:
@@ -89,7 +90,7 @@ class TestAppDslService:
                email=fake.email(),
                name=fake.name(),
                interface_language="en-US",
-                password=fake.password(length=12),
+                password=generate_valid_password(fake),
            )
            TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
            tenant = account.current_tenant
@@ -10,6 +10,7 @@ from models.model import EndUser
 from models.workflow import Workflow
 from services.app_generate_service import AppGenerateService
 from services.errors.app import WorkflowIdFormatError, WorkflowNotFoundError
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAppGenerateService:
@@ -147,7 +148,7 @@ class TestAppGenerateService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -8,6 +8,7 @@ from constants.model_template import default_app_templates
 from models import Account
 from models.model import App, Site
 from services.account_service import AccountService, TenantService
+from tests.test_containers_integration_tests.helpers import generate_valid_password

 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService
@@ -56,7 +57,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -112,7 +113,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -155,7 +156,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -203,7 +204,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -259,7 +260,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -334,7 +335,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -404,7 +405,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -473,7 +474,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -526,7 +527,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -585,7 +586,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -645,7 +646,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -705,7 +706,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -756,7 +757,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -808,7 +809,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -868,7 +869,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -907,7 +908,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -947,7 +948,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -997,7 +998,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1039,7 +1040,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -13,6 +13,7 @@ from services.errors.message import (
    SuggestedQuestionsAfterAnswerDisabledError,
 )
 from services.message_service import MessageService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestMessageService:
@@ -95,7 +96,7 @@ class TestMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -633,7 +634,7 @@ class TestMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(other_account, name=fake.company())

@@ -8,6 +8,7 @@ from models.model import EndUser, Message
 from models.web import SavedMessage
 from services.app_service import AppService
 from services.saved_message_service import SavedMessageService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestSavedMessageService:
@@ -64,7 +65,7 @@ class TestSavedMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -10,6 +10,7 @@ from core.trigger.entities.entities import Subscription as TriggerSubscriptionEn
 from models.provider_ids import TriggerProviderID
 from models.trigger import TriggerSubscription
 from services.trigger.trigger_provider_service import TriggerProviderService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestTriggerProviderService:
@@ -75,7 +76,7 @@ class TestTriggerProviderService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -12,6 +12,7 @@ from models.web import PinnedConversation
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.web_conversation_service import WebConversationService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebConversationService:
@@ -69,7 +70,7 @@ class TestWebConversationService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -12,6 +12,7 @@ from models import Account, AccountStatus, Tenant, TenantAccountJoin, TenantAcco
 from models.model import App, Site
 from services.errors.account import AccountLoginError, AccountNotFoundError, AccountPasswordError
 from services.webapp_auth_service import WebAppAuthService, WebAppAuthType
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebAppAuthService:
@@ -109,7 +110,7 @@ class TestWebAppAuthService:
            tuple: (account, tenant, password) - Created account, tenant and password
        """
        fake = Faker()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)

        # Create account with password
        import uuid
@@ -272,7 +273,7 @@ class TestWebAppAuthService:
        """
        # Arrange: Create banned account
        fake = Faker()
-        password = fake.password(length=12)
+        password = generate_valid_password(fake)
        unique_email = f"test_{uuid.uuid4().hex[:8]}@example.com"

        account = Account(
@@ -13,6 +13,7 @@ from models.trigger import AppTrigger, WorkflowWebhookTrigger
 from models.workflow import Workflow
 from services.account_service import AccountService, TenantService
 from services.trigger.webhook_service import WebhookService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebhookService:
@@ -60,7 +61,7 @@ class TestWebhookService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,6 +15,7 @@ from services.account_service import AccountService, TenantService
 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService
 from services.workflow_app_service import WorkflowAppService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowAppService:
@@ -72,7 +73,7 @@ class TestWorkflowAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -120,7 +121,7 @@ class TestWorkflowAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,6 +15,7 @@ from models.workflow import WorkflowRun
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.workflow_run_service import WorkflowRunService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowRunService:
@@ -72,7 +73,7 @@ class TestWorkflowRunService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -13,6 +13,7 @@ from models.workflow import Workflow as WorkflowModel
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.tools.workflow_tools_manage_service import WorkflowToolManageService
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowToolManageService:
@@ -87,7 +88,7 @@ class TestWorkflowToolManageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,6 +15,7 @@ from faker import Faker
 from models.dataset import Dataset, Document, DocumentSegment
 from services.account_service import AccountService, TenantService
 from tasks.clean_notion_document_task import clean_notion_document_task
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestCleanNotionDocumentTask:
@@ -76,7 +77,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -208,7 +209,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -252,7 +253,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -345,7 +346,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -431,7 +432,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -546,7 +547,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -642,7 +643,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -724,7 +725,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -834,7 +835,7 @@ class TestCleanNotionDocumentTask:
                email=fake.email(),
                name=fake.name(),
                interface_language="en-US",
-                password=fake.password(length=12),
+                password=generate_valid_password(fake),
            )
            TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
            tenant = account.current_tenant
@@ -951,7 +952,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1054,7 +1055,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -322,11 +322,14 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        task_dispatch_spy.delay.assert_called_once_with(
-            tenant_id=next_task["tenant_id"],
-            dataset_id=next_task["dataset_id"],
-            document_ids=next_task["document_ids"],
-        )
+        # apply_async is used by implementation; assert it was called once with expected kwargs
+        assert task_dispatch_spy.apply_async.call_count == 1
+        call_kwargs = task_dispatch_spy.apply_async.call_args.kwargs.get("kwargs", {})
+        assert call_kwargs == {
+            "tenant_id": next_task["tenant_id"],
+            "dataset_id": next_task["dataset_id"],
+            "document_ids": next_task["document_ids"],
+        }
        set_waiting_spy.assert_called_once()
        delete_key_spy.assert_not_called()

@@ -352,7 +355,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        task_dispatch_spy.delay.assert_not_called()
+        task_dispatch_spy.apply_async.assert_not_called()
        delete_key_spy.assert_called_once()

    def test_validation_failure_sets_error_status_when_vector_space_at_limit(
@@ -447,7 +450,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        task_dispatch_spy.delay.assert_called_once()
+        task_dispatch_spy.apply_async.assert_called_once()

    def test_sessions_close_on_successful_indexing(
        self,
@@ -534,7 +537,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        assert task_dispatch_spy.delay.call_count == concurrency_limit
+        assert task_dispatch_spy.apply_async.call_count == concurrency_limit
        assert set_waiting_spy.call_count == concurrency_limit

    def test_task_queue_fifo_ordering(self, db_session_with_containers, patched_external_dependencies):
@@ -565,9 +568,10 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        assert task_dispatch_spy.delay.call_count == 3
+        assert task_dispatch_spy.apply_async.call_count == 3
        for index, expected_task in enumerate(ordered_tasks):
-            assert task_dispatch_spy.delay.call_args_list[index].kwargs["document_ids"] == expected_task["document_ids"]
+            call_kwargs = task_dispatch_spy.apply_async.call_args_list[index].kwargs.get("kwargs", {})
+            assert call_kwargs.get("document_ids") == expected_task["document_ids"]

    def test_billing_disabled_skips_limit_checks(self, db_session_with_containers, patched_external_dependencies):
        """Skip limit checks when billing feature is disabled."""
@@ -15,6 +15,7 @@ from faker import Faker
 from models.dataset import Dataset, Document, DocumentSegment
 from services.account_service import AccountService, TenantService
 from tasks.deal_dataset_vector_index_task import deal_dataset_vector_index_task
+from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestDealDatasetVectorIndexTask:
@@ -61,7 +62,7 @@ class TestDealDatasetVectorIndexTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=fake.password(length=12),
+            password=generate_valid_password(fake),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -762,11 +762,12 @@ class TestDocumentIndexingTasks:
        mock_external_service_dependencies["indexing_runner_instance"].run.assert_called_once()

        # Verify task function was called for each waiting task
-        assert mock_task_func.delay.call_count == 1
+        assert mock_task_func.apply_async.call_count == 1

        # Verify correct parameters for each call
-        calls = mock_task_func.delay.call_args_list
-        assert calls[0][1] == {"tenant_id": tenant_id, "dataset_id": dataset_id, "document_ids": ["waiting-doc-1"]}
+        calls = mock_task_func.apply_async.call_args_list
+        sent_kwargs = calls[0][1]["kwargs"]
+        assert sent_kwargs == {"tenant_id": tenant_id, "dataset_id": dataset_id, "document_ids": ["waiting-doc-1"]}

        # Verify queue is empty after processing (tasks were pulled)
        remaining_tasks = queue.pull_tasks(count=10)  # Pull more than we added
@@ -830,11 +831,15 @@ class TestDocumentIndexingTasks:
            assert updated_document.processing_started_at is not None

        # Verify waiting task was still processed despite core processing error
-        mock_task_func.delay.assert_called_once()
+        mock_task_func.apply_async.assert_called_once()

        # Verify correct parameters for the call
-        call = mock_task_func.delay.call_args
-        assert call[1] == {"tenant_id": tenant_id, "dataset_id": dataset_id, "document_ids": ["waiting-doc-1"]}
+        call = mock_task_func.apply_async.call_args
+        assert call[1]["kwargs"] == {
+            "tenant_id": tenant_id,
+            "dataset_id": dataset_id,
+            "document_ids": ["waiting-doc-1"],
+        }

        # Verify queue is empty after processing (task was pulled)
        remaining_tasks = queue.pull_tasks(count=10)
@@ -896,9 +901,13 @@ class TestDocumentIndexingTasks:
        mock_external_service_dependencies["indexing_runner_instance"].run.assert_called_once()

        # Verify only tenant1's waiting task was processed
-        mock_task_func.delay.assert_called_once()
-        call = mock_task_func.delay.call_args
-        assert call[1] == {"tenant_id": tenant1_id, "dataset_id": dataset1_id, "document_ids": ["tenant1-doc-1"]}
+        mock_task_func.apply_async.assert_called_once()
+        call = mock_task_func.apply_async.call_args
+        assert call[1]["kwargs"] == {
+            "tenant_id": tenant1_id,
+            "dataset_id": dataset1_id,
+            "document_ids": ["tenant1-doc-1"],
+        }

        # Verify tenant1's queue is empty
        remaining_tasks1 = queue1.pull_tasks(count=10)
@@ -1,6 +1,6 @@
 import json
 import uuid
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch

 import pytest
 from faker import Faker
@@ -388,8 +388,10 @@ class TestRagPipelineRunTasks:
        # Set the task key to indicate there are waiting tasks (legacy behavior)
        redis_client.set(legacy_task_key, 1, ex=60 * 60)

-        # Mock the task function calls
-        with patch("tasks.rag_pipeline.rag_pipeline_run_task.rag_pipeline_run_task.delay") as mock_delay:
+        # Mock the Celery group scheduling used by the implementation
+        with patch("tasks.rag_pipeline.rag_pipeline_run_task.group") as mock_group:
+            mock_group.return_value.apply_async = MagicMock()
+
            # Act: Execute the priority task with new code but legacy queue data
            rag_pipeline_run_task(file_id, tenant.id)

@@ -398,13 +400,14 @@ class TestRagPipelineRunTasks:
            mock_file_service["delete_file"].assert_called_once_with(file_id)
            assert mock_pipeline_generator.call_count == 1

-            # Verify waiting tasks were processed, pull 1 task a time by default
-            assert mock_delay.call_count == 1
+            # Verify waiting tasks were processed via group, pull 1 task a time by default
+            assert mock_group.return_value.apply_async.called

-            # Verify correct parameters for the call
-            call_kwargs = mock_delay.call_args[1] if mock_delay.call_args else {}
-            assert call_kwargs.get("rag_pipeline_invoke_entities_file_id") == legacy_file_ids[0]
-            assert call_kwargs.get("tenant_id") == tenant.id
+            # Verify correct parameters for the first scheduled job signature
+            jobs = mock_group.call_args.args[0] if mock_group.call_args else []
+            first_kwargs = jobs[0].kwargs if jobs else {}
+            assert first_kwargs.get("rag_pipeline_invoke_entities_file_id") == legacy_file_ids[0]
+            assert first_kwargs.get("tenant_id") == tenant.id

            # Verify that new code can process legacy queue entries
            # The new TenantIsolatedTaskQueue should be able to read from the legacy format
@@ -446,8 +449,10 @@ class TestRagPipelineRunTasks:
        waiting_file_ids = [str(uuid.uuid4()) for _ in range(3)]
        queue.push_tasks(waiting_file_ids)

-        # Mock the task function calls
-        with patch("tasks.rag_pipeline.rag_pipeline_run_task.rag_pipeline_run_task.delay") as mock_delay:
+        # Mock the Celery group scheduling used by the implementation
+        with patch("tasks.rag_pipeline.rag_pipeline_run_task.group") as mock_group:
+            mock_group.return_value.apply_async = MagicMock()
+
            # Act: Execute the regular task
            rag_pipeline_run_task(file_id, tenant.id)

@@ -456,13 +461,14 @@ class TestRagPipelineRunTasks:
            mock_file_service["delete_file"].assert_called_once_with(file_id)
            assert mock_pipeline_generator.call_count == 1

-            # Verify waiting tasks were processed, pull 1 task a time by default
-            assert mock_delay.call_count == 1
+            # Verify waiting tasks were processed via group.apply_async
+            assert mock_group.return_value.apply_async.called

-            # Verify correct parameters for the call
-            call_kwargs = mock_delay.call_args[1] if mock_delay.call_args else {}
-            assert call_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_ids[0]
-            assert call_kwargs.get("tenant_id") == tenant.id
+            # Verify correct parameters for the first scheduled job signature
+            jobs = mock_group.call_args.args[0] if mock_group.call_args else []
+            first_kwargs = jobs[0].kwargs if jobs else {}
+            assert first_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_ids[0]
+            assert first_kwargs.get("tenant_id") == tenant.id

            # Verify queue still has remaining tasks (only 1 was pulled)
            remaining_tasks = queue.pull_tasks(count=10)
@@ -557,8 +563,10 @@ class TestRagPipelineRunTasks:
        waiting_file_id = str(uuid.uuid4())
        queue.push_tasks([waiting_file_id])

-        # Mock the task function calls
-        with patch("tasks.rag_pipeline.rag_pipeline_run_task.rag_pipeline_run_task.delay") as mock_delay:
+        # Mock the Celery group scheduling used by the implementation
+        with patch("tasks.rag_pipeline.rag_pipeline_run_task.group") as mock_group:
+            mock_group.return_value.apply_async = MagicMock()
+
            # Act: Execute the regular task (should not raise exception)
            rag_pipeline_run_task(file_id, tenant.id)

@@ -569,12 +577,13 @@ class TestRagPipelineRunTasks:
            assert mock_pipeline_generator.call_count == 1

            # Verify waiting task was still processed despite core processing error
-            mock_delay.assert_called_once()
+            assert mock_group.return_value.apply_async.called

-            # Verify correct parameters for the call
-            call_kwargs = mock_delay.call_args[1] if mock_delay.call_args else {}
-            assert call_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id
-            assert call_kwargs.get("tenant_id") == tenant.id
+            # Verify correct parameters for the first scheduled job signature
+            jobs = mock_group.call_args.args[0] if mock_group.call_args else []
+            first_kwargs = jobs[0].kwargs if jobs else {}
+            assert first_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id
+            assert first_kwargs.get("tenant_id") == tenant.id

            # Verify queue is empty after processing (task was pulled)
            remaining_tasks = queue.pull_tasks(count=10)
@@ -684,8 +693,10 @@ class TestRagPipelineRunTasks:
        queue1.push_tasks([waiting_file_id1])
        queue2.push_tasks([waiting_file_id2])

-        # Mock the task function calls
-        with patch("tasks.rag_pipeline.rag_pipeline_run_task.rag_pipeline_run_task.delay") as mock_delay:
+        # Mock the Celery group scheduling used by the implementation
+        with patch("tasks.rag_pipeline.rag_pipeline_run_task.group") as mock_group:
+            mock_group.return_value.apply_async = MagicMock()
+
            # Act: Execute the regular task for tenant1 only
            rag_pipeline_run_task(file_id1, tenant1.id)

@@ -694,11 +705,12 @@ class TestRagPipelineRunTasks:
            assert mock_file_service["delete_file"].call_count == 1
            assert mock_pipeline_generator.call_count == 1

-            # Verify only tenant1's waiting task was processed
-            mock_delay.assert_called_once()
-            call_kwargs = mock_delay.call_args[1] if mock_delay.call_args else {}
-            assert call_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id1
-            assert call_kwargs.get("tenant_id") == tenant1.id
+            # Verify only tenant1's waiting task was processed (via group)
+            assert mock_group.return_value.apply_async.called
+            jobs = mock_group.call_args.args[0] if mock_group.call_args else []
+            first_kwargs = jobs[0].kwargs if jobs else {}
+            assert first_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id1
+            assert first_kwargs.get("tenant_id") == tenant1.id

            # Verify tenant1's queue is empty
            remaining_tasks1 = queue1.pull_tasks(count=10)
@@ -913,8 +925,10 @@ class TestRagPipelineRunTasks:
        waiting_file_id = str(uuid.uuid4())
        queue.push_tasks([waiting_file_id])

-        # Mock the task function calls
-        with patch("tasks.rag_pipeline.rag_pipeline_run_task.rag_pipeline_run_task.delay") as mock_delay:
+        # Mock the Celery group scheduling used by the implementation
+        with patch("tasks.rag_pipeline.rag_pipeline_run_task.group") as mock_group:
+            mock_group.return_value.apply_async = MagicMock()
+
            # Act & Assert: Execute the regular task (should raise Exception)
            with pytest.raises(Exception, match="File not found"):
                rag_pipeline_run_task(file_id, tenant.id)
@@ -924,12 +938,13 @@ class TestRagPipelineRunTasks:
            mock_pipeline_generator.assert_not_called()

            # Verify waiting task was still processed despite file error
-            mock_delay.assert_called_once()
+            assert mock_group.return_value.apply_async.called

-            # Verify correct parameters for the call
-            call_kwargs = mock_delay.call_args[1] if mock_delay.call_args else {}
-            assert call_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id
-            assert call_kwargs.get("tenant_id") == tenant.id
+            # Verify correct parameters for the first scheduled job signature
+            jobs = mock_group.call_args.args[0] if mock_group.call_args else []
+            first_kwargs = jobs[0].kwargs if jobs else {}
+            assert first_kwargs.get("rag_pipeline_invoke_entities_file_id") == waiting_file_id
+            assert first_kwargs.get("tenant_id") == tenant.id

            # Verify queue is empty after processing (task was pulled)
            remaining_tasks = queue.pull_tasks(count=10)
@@ -105,18 +105,26 @@ def app_model(


 class MockCeleryGroup:
-    """Mock for celery group() function that collects dispatched tasks."""
+    """Mock for celery group() function that collects dispatched tasks.
+
+    Matches the Celery group API loosely, accepting arbitrary kwargs on apply_async
+    (e.g. producer) so production code can pass broker-related options without
+    breaking tests.
+    """

    def __init__(self) -> None:
        self.collected: list[dict[str, Any]] = []
        self._applied = False
+        self.last_apply_async_kwargs: dict[str, Any] | None = None

    def __call__(self, items: Any) -> MockCeleryGroup:
        self.collected = list(items)
        return self

-    def apply_async(self) -> None:
+    def apply_async(self, **kwargs: Any) -> None:
+        # Accept arbitrary kwargs like producer to be compatible with Celery
        self._applied = True
+        self.last_apply_async_kwargs = kwargs

    @property
    def applied(self) -> bool:
@@ -0,0 +1,92 @@
+from __future__ import annotations
+
+from controllers.console.app import annotation as annotation_module
+
+
+def test_annotation_reply_payload_valid():
+    """Test AnnotationReplyPayload with valid data."""
+    payload = annotation_module.AnnotationReplyPayload(
+        score_threshold=0.5,
+        embedding_provider_name="openai",
+        embedding_model_name="text-embedding-3-small",
+    )
+    assert payload.score_threshold == 0.5
+    assert payload.embedding_provider_name == "openai"
+    assert payload.embedding_model_name == "text-embedding-3-small"
+
+
+def test_annotation_setting_update_payload_valid():
+    """Test AnnotationSettingUpdatePayload with valid data."""
+    payload = annotation_module.AnnotationSettingUpdatePayload(
+        score_threshold=0.75,
+    )
+    assert payload.score_threshold == 0.75
+
+
+def test_annotation_list_query_defaults():
+    """Test AnnotationListQuery with default parameters."""
+    query = annotation_module.AnnotationListQuery()
+    assert query.page == 1
+    assert query.limit == 20
+    assert query.keyword == ""
+
+
+def test_annotation_list_query_custom_page():
+    """Test AnnotationListQuery with custom page."""
+    query = annotation_module.AnnotationListQuery(page=3, limit=50)
+    assert query.page == 3
+    assert query.limit == 50
+
+
+def test_annotation_list_query_with_keyword():
+    """Test AnnotationListQuery with keyword."""
+    query = annotation_module.AnnotationListQuery(keyword="test")
+    assert query.keyword == "test"
+
+
+def test_create_annotation_payload_with_message_id():
+    """Test CreateAnnotationPayload with message ID."""
+    payload = annotation_module.CreateAnnotationPayload(
+        message_id="550e8400-e29b-41d4-a716-446655440000",
+        question="What is AI?",
+    )
+    assert payload.message_id == "550e8400-e29b-41d4-a716-446655440000"
+    assert payload.question == "What is AI?"
+
+
+def test_create_annotation_payload_with_text():
+    """Test CreateAnnotationPayload with text content."""
+    payload = annotation_module.CreateAnnotationPayload(
+        question="What is ML?",
+        answer="Machine learning is...",
+    )
+    assert payload.question == "What is ML?"
+    assert payload.answer == "Machine learning is..."
+
+
+def test_update_annotation_payload():
+    """Test UpdateAnnotationPayload."""
+    payload = annotation_module.UpdateAnnotationPayload(
+        question="Updated question",
+        answer="Updated answer",
+    )
+    assert payload.question == "Updated question"
+    assert payload.answer == "Updated answer"
+
+
+def test_annotation_reply_status_query_enable():
+    """Test AnnotationReplyStatusQuery with enable action."""
+    query = annotation_module.AnnotationReplyStatusQuery(action="enable")
+    assert query.action == "enable"
+
+
+def test_annotation_reply_status_query_disable():
+    """Test AnnotationReplyStatusQuery with disable action."""
+    query = annotation_module.AnnotationReplyStatusQuery(action="disable")
+    assert query.action == "disable"
+
+
+def test_annotation_file_payload_valid():
+    """Test AnnotationFilePayload with valid message ID."""
+    payload = annotation_module.AnnotationFilePayload(message_id="550e8400-e29b-41d4-a716-446655440000")
+    assert payload.message_id == "550e8400-e29b-41d4-a716-446655440000"
@@ -13,6 +13,9 @@ from pandas.errors import ParserError
 from werkzeug.datastructures import FileStorage

 from configs import dify_config
+from controllers.console.wraps import annotation_import_concurrency_limit, annotation_import_rate_limit
+from services.annotation_service import AppAnnotationService
+from tasks.annotation.batch_import_annotations_task import batch_import_annotations_task


 class TestAnnotationImportRateLimiting:
@@ -33,8 +36,6 @@ class TestAnnotationImportRateLimiting:

    def test_rate_limit_per_minute_enforced(self, mock_redis, mock_current_account):
        """Test that per-minute rate limit is enforced."""
-        from controllers.console.wraps import annotation_import_rate_limit
-
        # Simulate exceeding per-minute limit
        mock_redis.zcard.side_effect = [
            dify_config.ANNOTATION_IMPORT_RATE_LIMIT_PER_MINUTE + 1,  # Minute check
@@ -54,7 +55,6 @@ class TestAnnotationImportRateLimiting:

    def test_rate_limit_per_hour_enforced(self, mock_redis, mock_current_account):
        """Test that per-hour rate limit is enforced."""
-        from controllers.console.wraps import annotation_import_rate_limit

        # Simulate exceeding per-hour limit
        mock_redis.zcard.side_effect = [
@@ -74,7 +74,6 @@ class TestAnnotationImportRateLimiting:

    def test_rate_limit_within_limits_passes(self, mock_redis, mock_current_account):
        """Test that requests within limits are allowed."""
-        from controllers.console.wraps import annotation_import_rate_limit

        # Simulate being under both limits
        mock_redis.zcard.return_value = 2
@@ -110,7 +109,6 @@ class TestAnnotationImportConcurrencyControl:

    def test_concurrency_limit_enforced(self, mock_redis, mock_current_account):
        """Test that concurrent task limit is enforced."""
-        from controllers.console.wraps import annotation_import_concurrency_limit

        # Simulate max concurrent tasks already running
        mock_redis.zcard.return_value = dify_config.ANNOTATION_IMPORT_MAX_CONCURRENT
@@ -127,7 +125,6 @@ class TestAnnotationImportConcurrencyControl:

    def test_concurrency_within_limit_passes(self, mock_redis, mock_current_account):
        """Test that requests within concurrency limits are allowed."""
-        from controllers.console.wraps import annotation_import_concurrency_limit

        # Simulate being under concurrent task limit
        mock_redis.zcard.return_value = 1
@@ -142,7 +139,6 @@ class TestAnnotationImportConcurrencyControl:

    def test_stale_jobs_are_cleaned_up(self, mock_redis, mock_current_account):
        """Test that old/stale job entries are removed."""
-        from controllers.console.wraps import annotation_import_concurrency_limit

        mock_redis.zcard.return_value = 0

@@ -203,7 +199,6 @@ class TestAnnotationImportServiceValidation:

    def test_max_records_limit_enforced(self, mock_app, mock_db_session):
        """Test that files with too many records are rejected."""
-        from services.annotation_service import AppAnnotationService

        # Create CSV with too many records
        max_records = dify_config.ANNOTATION_IMPORT_MAX_RECORDS
@@ -229,7 +224,6 @@ class TestAnnotationImportServiceValidation:

    def test_min_records_limit_enforced(self, mock_app, mock_db_session):
        """Test that files with too few valid records are rejected."""
-        from services.annotation_service import AppAnnotationService

        # Create CSV with only header (no data rows)
        csv_content = "question,answer\n"
@@ -249,7 +243,6 @@ class TestAnnotationImportServiceValidation:

    def test_invalid_csv_format_handled(self, mock_app, mock_db_session):
        """Test that invalid CSV format is handled gracefully."""
-        from services.annotation_service import AppAnnotationService

        # Any content is fine once we force ParserError
        csv_content = 'invalid,csv,format\nwith,unbalanced,quotes,and"stuff'
@@ -270,7 +263,6 @@ class TestAnnotationImportServiceValidation:

    def test_valid_import_succeeds(self, mock_app, mock_db_session):
        """Test that valid import request succeeds."""
-        from services.annotation_service import AppAnnotationService

        # Create valid CSV
        csv_content = "question,answer\nWhat is AI?,Artificial Intelligence\nWhat is ML?,Machine Learning\n"
@@ -300,18 +292,10 @@ class TestAnnotationImportServiceValidation:
 class TestAnnotationImportTaskOptimization:
    """Test optimizations in batch import task."""

-    def test_task_has_timeout_configured(self):
-        """Test that task has proper timeout configuration."""
-        from tasks.annotation.batch_import_annotations_task import batch_import_annotations_task
-
-        # Verify task configuration
-        assert hasattr(batch_import_annotations_task, "time_limit")
-        assert hasattr(batch_import_annotations_task, "soft_time_limit")
-
-        # Check timeout values are reasonable
-        # Hard limit should be 6 minutes (360s)
-        # Soft limit should be 5 minutes (300s)
-        # Note: actual values depend on Celery configuration
+    def test_task_is_registered_with_queue(self):
+        """Test that task is registered with the correct queue."""
+        assert hasattr(batch_import_annotations_task, "apply_async")
+        assert hasattr(batch_import_annotations_task, "delay")


 class TestConfigurationValues:
@@ -0,0 +1,585 @@
+"""
+Additional tests to improve coverage for low-coverage modules in controllers/console/app.
+Target: increase coverage for files with <75% coverage.
+"""
+
+from __future__ import annotations
+
+import uuid
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+from werkzeug.exceptions import BadRequest, NotFound
+
+from controllers.console.app import (
+    annotation as annotation_module,
+)
+from controllers.console.app import (
+    completion as completion_module,
+)
+from controllers.console.app import (
+    message as message_module,
+)
+from controllers.console.app import (
+    ops_trace as ops_trace_module,
+)
+from controllers.console.app import (
+    site as site_module,
+)
+from controllers.console.app import (
+    statistic as statistic_module,
+)
+from controllers.console.app import (
+    workflow_app_log as workflow_app_log_module,
+)
+from controllers.console.app import (
+    workflow_draft_variable as workflow_draft_variable_module,
+)
+from controllers.console.app import (
+    workflow_statistic as workflow_statistic_module,
+)
+from controllers.console.app import (
+    workflow_trigger as workflow_trigger_module,
+)
+from controllers.console.app import (
+    wraps as wraps_module,
+)
+from controllers.console.app.completion import ChatMessagePayload, CompletionMessagePayload
+from controllers.console.app.mcp_server import MCPServerCreatePayload, MCPServerUpdatePayload
+from controllers.console.app.ops_trace import TraceConfigPayload, TraceProviderQuery
+from controllers.console.app.site import AppSiteUpdatePayload
+from controllers.console.app.workflow import AdvancedChatWorkflowRunPayload, SyncDraftWorkflowPayload
+from controllers.console.app.workflow_app_log import WorkflowAppLogQuery
+from controllers.console.app.workflow_draft_variable import WorkflowDraftVariableUpdatePayload
+from controllers.console.app.workflow_statistic import WorkflowStatisticQuery
+from controllers.console.app.workflow_trigger import Parser, ParserEnable
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+class _ConnContext:
+    def __init__(self, rows):
+        self._rows = rows
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+    def execute(self, _query, _args):
+        return self._rows
+
+
+# ========== Completion Tests ==========
+class TestCompletionEndpoints:
+    """Tests for completion API endpoints."""
+
+    def test_completion_create_payload(self):
+        """Test completion creation payload."""
+        payload = CompletionMessagePayload(inputs={"prompt": "test"}, model_config={})
+        assert payload.inputs == {"prompt": "test"}
+
+    def test_chat_message_payload_uuid_validation(self):
+        payload = ChatMessagePayload(
+            inputs={},
+            model_config={},
+            query="hi",
+            conversation_id=str(uuid.uuid4()),
+            parent_message_id=str(uuid.uuid4()),
+        )
+        assert payload.query == "hi"
+
+    def test_completion_api_success(self, app, monkeypatch):
+        api = completion_module.CompletionMessageApi()
+        method = _unwrap(api.post)
+
+        class DummyAccount:
+            pass
+
+        dummy_account = DummyAccount()
+
+        monkeypatch.setattr(completion_module, "current_user", dummy_account)
+        monkeypatch.setattr(completion_module, "Account", DummyAccount)
+        monkeypatch.setattr(
+            completion_module.AppGenerateService,
+            "generate",
+            lambda **_kwargs: {"text": "ok"},
+        )
+        monkeypatch.setattr(
+            completion_module.helper,
+            "compact_generate_response",
+            lambda response: {"result": response},
+        )
+
+        with app.test_request_context(
+            "/",
+            json={"inputs": {}, "model_config": {}, "query": "hi"},
+        ):
+            resp = method(app_model=MagicMock(id="app-1"))
+
+        assert resp == {"result": {"text": "ok"}}
+
+    def test_completion_api_conversation_not_exists(self, app, monkeypatch):
+        api = completion_module.CompletionMessageApi()
+        method = _unwrap(api.post)
+
+        class DummyAccount:
+            pass
+
+        dummy_account = DummyAccount()
+
+        monkeypatch.setattr(completion_module, "current_user", dummy_account)
+        monkeypatch.setattr(completion_module, "Account", DummyAccount)
+        monkeypatch.setattr(
+            completion_module.AppGenerateService,
+            "generate",
+            lambda **_kwargs: (_ for _ in ()).throw(
+                completion_module.services.errors.conversation.ConversationNotExistsError()
+            ),
+        )
+
+        with app.test_request_context(
+            "/",
+            json={"inputs": {}, "model_config": {}, "query": "hi"},
+        ):
+            with pytest.raises(NotFound):
+                method(app_model=MagicMock(id="app-1"))
+
+    def test_completion_api_provider_not_initialized(self, app, monkeypatch):
+        api = completion_module.CompletionMessageApi()
+        method = _unwrap(api.post)
+
+        class DummyAccount:
+            pass
+
+        dummy_account = DummyAccount()
+
+        monkeypatch.setattr(completion_module, "current_user", dummy_account)
+        monkeypatch.setattr(completion_module, "Account", DummyAccount)
+        monkeypatch.setattr(
+            completion_module.AppGenerateService,
+            "generate",
+            lambda **_kwargs: (_ for _ in ()).throw(completion_module.ProviderTokenNotInitError("x")),
+        )
+
+        with app.test_request_context(
+            "/",
+            json={"inputs": {}, "model_config": {}, "query": "hi"},
+        ):
+            with pytest.raises(completion_module.ProviderNotInitializeError):
+                method(app_model=MagicMock(id="app-1"))
+
+    def test_completion_api_quota_exceeded(self, app, monkeypatch):
+        api = completion_module.CompletionMessageApi()
+        method = _unwrap(api.post)
+
+        class DummyAccount:
+            pass
+
+        dummy_account = DummyAccount()
+
+        monkeypatch.setattr(completion_module, "current_user", dummy_account)
+        monkeypatch.setattr(completion_module, "Account", DummyAccount)
+        monkeypatch.setattr(
+            completion_module.AppGenerateService,
+            "generate",
+            lambda **_kwargs: (_ for _ in ()).throw(completion_module.QuotaExceededError()),
+        )
+
+        with app.test_request_context(
+            "/",
+            json={"inputs": {}, "model_config": {}, "query": "hi"},
+        ):
+            with pytest.raises(completion_module.ProviderQuotaExceededError):
+                method(app_model=MagicMock(id="app-1"))
+
+
+# ========== OpsTrace Tests ==========
+class TestOpsTraceEndpoints:
+    """Tests for ops_trace endpoint."""
+
+    def test_ops_trace_query_basic(self):
+        """Test ops_trace query."""
+        query = TraceProviderQuery(tracing_provider="langfuse")
+        assert query.tracing_provider == "langfuse"
+
+    def test_ops_trace_config_payload(self):
+        payload = TraceConfigPayload(tracing_provider="langfuse", tracing_config={"api_key": "k"})
+        assert payload.tracing_config["api_key"] == "k"
+
+    def test_trace_app_config_get_empty(self, app, monkeypatch):
+        api = ops_trace_module.TraceAppConfigApi()
+        method = _unwrap(api.get)
+
+        monkeypatch.setattr(
+            ops_trace_module.OpsService,
+            "get_tracing_app_config",
+            lambda **_kwargs: None,
+        )
+
+        with app.test_request_context("/?tracing_provider=langfuse"):
+            result = method(app_id="app-1")
+
+        assert result == {"has_not_configured": True}
+
+    def test_trace_app_config_post_invalid(self, app, monkeypatch):
+        api = ops_trace_module.TraceAppConfigApi()
+        method = _unwrap(api.post)
+
+        monkeypatch.setattr(
+            ops_trace_module.OpsService,
+            "create_tracing_app_config",
+            lambda **_kwargs: {"error": True},
+        )
+
+        with app.test_request_context(
+            "/",
+            json={"tracing_provider": "langfuse", "tracing_config": {"api_key": "k"}},
+        ):
+            with pytest.raises(BadRequest):
+                method(app_id="app-1")
+
+    def test_trace_app_config_delete_not_found(self, app, monkeypatch):
+        api = ops_trace_module.TraceAppConfigApi()
+        method = _unwrap(api.delete)
+
+        monkeypatch.setattr(
+            ops_trace_module.OpsService,
+            "delete_tracing_app_config",
+            lambda **_kwargs: False,
+        )
+
+        with app.test_request_context("/?tracing_provider=langfuse"):
+            with pytest.raises(BadRequest):
+                method(app_id="app-1")
+
+
+# ========== Site Tests ==========
+class TestSiteEndpoints:
+    """Tests for site endpoint."""
+
+    def test_site_response_structure(self):
+        """Test site response structure."""
+        payload = AppSiteUpdatePayload(title="My Site", description="Test site")
+        assert payload.title == "My Site"
+
+    def test_site_default_language_validation(self):
+        payload = AppSiteUpdatePayload(default_language="en-US")
+        assert payload.default_language == "en-US"
+
+    def test_app_site_update_post(self, app, monkeypatch):
+        api = site_module.AppSite()
+        method = _unwrap(api.post)
+
+        site = MagicMock()
+        query = MagicMock()
+        query.where.return_value.first.return_value = site
+        monkeypatch.setattr(
+            site_module.db,
+            "session",
+            MagicMock(query=lambda *_args, **_kwargs: query, commit=lambda: None),
+        )
+        monkeypatch.setattr(
+            site_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "t1"),
+        )
+        monkeypatch.setattr(site_module, "naive_utc_now", lambda: "now")
+
+        with app.test_request_context("/", json={"title": "My Site"}):
+            result = method(app_model=SimpleNamespace(id="app-1"))
+
+        assert result is site
+
+    def test_app_site_access_token_reset(self, app, monkeypatch):
+        api = site_module.AppSiteAccessTokenReset()
+        method = _unwrap(api.post)
+
+        site = MagicMock()
+        query = MagicMock()
+        query.where.return_value.first.return_value = site
+        monkeypatch.setattr(
+            site_module.db,
+            "session",
+            MagicMock(query=lambda *_args, **_kwargs: query, commit=lambda: None),
+        )
+        monkeypatch.setattr(site_module.Site, "generate_code", lambda *_args, **_kwargs: "code")
+        monkeypatch.setattr(
+            site_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "t1"),
+        )
+        monkeypatch.setattr(site_module, "naive_utc_now", lambda: "now")
+
+        with app.test_request_context("/"):
+            result = method(app_model=SimpleNamespace(id="app-1"))
+
+        assert result is site
+
+
+# ========== Workflow Tests ==========
+class TestWorkflowEndpoints:
+    """Tests for workflow endpoints."""
+
+    def test_workflow_copy_payload(self):
+        """Test workflow copy payload."""
+        payload = SyncDraftWorkflowPayload(graph={}, features={})
+        assert payload.graph == {}
+
+    def test_workflow_mode_query(self):
+        """Test workflow mode query."""
+        payload = AdvancedChatWorkflowRunPayload(inputs={}, query="hi")
+        assert payload.query == "hi"
+
+
+# ========== Workflow App Log Tests ==========
+class TestWorkflowAppLogEndpoints:
+    """Tests for workflow app log endpoints."""
+
+    def test_workflow_app_log_query(self):
+        """Test workflow app log query."""
+        query = WorkflowAppLogQuery(keyword="test", page=1, limit=20)
+        assert query.keyword == "test"
+
+    def test_workflow_app_log_query_detail_bool(self):
+        query = WorkflowAppLogQuery(detail="true")
+        assert query.detail is True
+
+    def test_workflow_app_log_api_get(self, app, monkeypatch):
+        api = workflow_app_log_module.WorkflowAppLogApi()
+        method = _unwrap(api.get)
+
+        monkeypatch.setattr(workflow_app_log_module, "db", SimpleNamespace(engine=MagicMock()))
+
+        class DummySession:
+            def __enter__(self):
+                return "session"
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+        monkeypatch.setattr(workflow_app_log_module, "Session", lambda *args, **kwargs: DummySession())
+
+        def fake_get_paginate(self, **_kwargs):
+            return {"items": [], "total": 0}
+
+        monkeypatch.setattr(
+            workflow_app_log_module.WorkflowAppService,
+            "get_paginate_workflow_app_logs",
+            fake_get_paginate,
+        )
+
+        with app.test_request_context("/?page=1&limit=20"):
+            result = method(app_model=SimpleNamespace(id="app-1"))
+
+        assert result == {"items": [], "total": 0}
+
+
+# ========== Workflow Draft Variable Tests ==========
+class TestWorkflowDraftVariableEndpoints:
+    """Tests for workflow draft variable endpoints."""
+
+    def test_workflow_variable_creation(self):
+        """Test workflow variable creation."""
+        payload = WorkflowDraftVariableUpdatePayload(name="var1", value="test")
+        assert payload.name == "var1"
+
+    def test_workflow_variable_collection_get(self, app, monkeypatch):
+        api = workflow_draft_variable_module.WorkflowVariableCollectionApi()
+        method = _unwrap(api.get)
+
+        monkeypatch.setattr(workflow_draft_variable_module, "db", SimpleNamespace(engine=MagicMock()))
+
+        class DummySession:
+            def __enter__(self):
+                return "session"
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+        class DummyDraftService:
+            def __init__(self, session):
+                self.session = session
+
+            def list_variables_without_values(self, **_kwargs):
+                return {"items": [], "total": 0}
+
+        monkeypatch.setattr(workflow_draft_variable_module, "Session", lambda *args, **kwargs: DummySession())
+
+        class DummyWorkflowService:
+            def is_workflow_exist(self, *args, **kwargs):
+                return True
+
+        monkeypatch.setattr(workflow_draft_variable_module, "WorkflowDraftVariableService", DummyDraftService)
+        monkeypatch.setattr(workflow_draft_variable_module, "WorkflowService", DummyWorkflowService)
+
+        with app.test_request_context("/?page=1&limit=20"):
+            result = method(app_model=SimpleNamespace(id="app-1"))
+
+        assert result == {"items": [], "total": 0}
+
+
+# ========== Workflow Statistic Tests ==========
+class TestWorkflowStatisticEndpoints:
+    """Tests for workflow statistic endpoints."""
+
+    def test_workflow_statistic_time_range(self):
+        """Test workflow statistic time range query."""
+        query = WorkflowStatisticQuery(start="2024-01-01", end="2024-12-31")
+        assert query.start == "2024-01-01"
+
+    def test_workflow_statistic_blank_to_none(self):
+        query = WorkflowStatisticQuery(start="", end="")
+        assert query.start is None
+        assert query.end is None
+
+    def test_workflow_daily_runs_statistic(self, app, monkeypatch):
+        monkeypatch.setattr(workflow_statistic_module, "db", SimpleNamespace(engine=MagicMock()))
+        monkeypatch.setattr(
+            workflow_statistic_module.DifyAPIRepositoryFactory,
+            "create_api_workflow_run_repository",
+            lambda *_args, **_kwargs: SimpleNamespace(get_daily_runs_statistics=lambda **_kw: [{"date": "2024-01-01"}]),
+        )
+        monkeypatch.setattr(
+            workflow_statistic_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(timezone="UTC"), "t1"),
+        )
+        monkeypatch.setattr(
+            workflow_statistic_module,
+            "parse_time_range",
+            lambda *_args, **_kwargs: (None, None),
+        )
+
+        api = workflow_statistic_module.WorkflowDailyRunsStatistic()
+        method = _unwrap(api.get)
+
+        with app.test_request_context("/"):
+            response = method(app_model=SimpleNamespace(tenant_id="t1", id="app-1"))
+
+        assert response.get_json() == {"data": [{"date": "2024-01-01"}]}
+
+    def test_workflow_daily_terminals_statistic(self, app, monkeypatch):
+        monkeypatch.setattr(workflow_statistic_module, "db", SimpleNamespace(engine=MagicMock()))
+        monkeypatch.setattr(
+            workflow_statistic_module.DifyAPIRepositoryFactory,
+            "create_api_workflow_run_repository",
+            lambda *_args, **_kwargs: SimpleNamespace(
+                get_daily_terminals_statistics=lambda **_kw: [{"date": "2024-01-02"}]
+            ),
+        )
+        monkeypatch.setattr(
+            workflow_statistic_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(timezone="UTC"), "t1"),
+        )
+        monkeypatch.setattr(
+            workflow_statistic_module,
+            "parse_time_range",
+            lambda *_args, **_kwargs: (None, None),
+        )
+
+        api = workflow_statistic_module.WorkflowDailyTerminalsStatistic()
+        method = _unwrap(api.get)
+
+        with app.test_request_context("/"):
+            response = method(app_model=SimpleNamespace(tenant_id="t1", id="app-1"))
+
+        assert response.get_json() == {"data": [{"date": "2024-01-02"}]}
+
+
+# ========== Workflow Trigger Tests ==========
+class TestWorkflowTriggerEndpoints:
+    """Tests for workflow trigger endpoints."""
+
+    def test_webhook_trigger_payload(self):
+        """Test webhook trigger payload."""
+        payload = Parser(node_id="node-1")
+        assert payload.node_id == "node-1"
+
+        enable_payload = ParserEnable(trigger_id="trigger-1", enable_trigger=True)
+        assert enable_payload.enable_trigger is True
+
+    def test_webhook_trigger_api_get(self, app, monkeypatch):
+        api = workflow_trigger_module.WebhookTriggerApi()
+        method = _unwrap(api.get)
+
+        monkeypatch.setattr(workflow_trigger_module, "db", SimpleNamespace(engine=MagicMock()))
+
+        trigger = MagicMock()
+        session = MagicMock()
+        session.query.return_value.where.return_value.first.return_value = trigger
+
+        class DummySession:
+            def __enter__(self):
+                return session
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+        monkeypatch.setattr(workflow_trigger_module, "Session", lambda *_args, **_kwargs: DummySession())
+
+        with app.test_request_context("/?node_id=node-1"):
+            result = method(app_model=SimpleNamespace(id="app-1"))
+
+        assert result is trigger
+
+
+# ========== Wraps Tests ==========
+class TestWrapsEndpoints:
+    """Tests for wraps utility functions."""
+
+    def test_get_app_model_context(self):
+        """Test get_app_model wrapper context."""
+        # These are decorator functions, so we test their availability
+        assert hasattr(wraps_module, "get_app_model")
+
+
+# ========== MCP Server Tests ==========
+class TestMCPServerEndpoints:
+    """Tests for MCP server endpoints."""
+
+    def test_mcp_server_connection(self):
+        """Test MCP server connection."""
+        payload = MCPServerCreatePayload(parameters={"url": "http://localhost:3000"})
+        assert payload.parameters["url"] == "http://localhost:3000"
+
+    def test_mcp_server_update_payload(self):
+        payload = MCPServerUpdatePayload(id="server-1", parameters={"timeout": 30}, status="active")
+        assert payload.status == "active"
+
+
+# ========== Error Handling Tests ==========
+class TestErrorHandling:
+    """Tests for error handling in various endpoints."""
+
+    def test_annotation_list_query_validation(self):
+        """Test annotation list query validation."""
+        with pytest.raises(ValueError):
+            annotation_module.AnnotationListQuery(page=0)
+
+
+# ========== Integration-like Tests ==========
+class TestPayloadIntegration:
+    """Integration tests for payload handling."""
+
+    def test_multiple_payload_types(self):
+        """Test handling of multiple payload types."""
+        payloads = [
+            annotation_module.AnnotationReplyPayload(
+                score_threshold=0.5, embedding_provider_name="openai", embedding_model_name="text-embedding-3-small"
+            ),
+            message_module.MessageFeedbackPayload(message_id=str(uuid.uuid4()), rating="like"),
+            statistic_module.StatisticTimeRangeQuery(start="2024-01-01"),
+        ]
+        assert len(payloads) == 3
+        assert all(p is not None for p in payloads)
@@ -0,0 +1,157 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from controllers.console.app import app_import as app_import_module
+from services.app_dsl_service import ImportStatus
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+class _Result:
+    def __init__(self, status: ImportStatus, app_id: str | None = "app-1"):
+        self.status = status
+        self.app_id = app_id
+
+    def model_dump(self, mode: str = "json"):
+        return {"status": self.status, "app_id": self.app_id}
+
+
+class _SessionContext:
+    def __init__(self, session):
+        self._session = session
+
+    def __enter__(self):
+        return self._session
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+
+def _install_session(monkeypatch: pytest.MonkeyPatch, session: MagicMock) -> None:
+    monkeypatch.setattr(app_import_module, "Session", lambda *_: _SessionContext(session))
+    monkeypatch.setattr(app_import_module, "db", SimpleNamespace(engine=object()))
+
+
+def _install_features(monkeypatch: pytest.MonkeyPatch, enabled: bool) -> None:
+    features = SimpleNamespace(webapp_auth=SimpleNamespace(enabled=enabled))
+    monkeypatch.setattr(app_import_module.FeatureService, "get_system_features", lambda: features)
+
+
+def test_import_post_returns_failed_status(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = app_import_module.AppImportApi()
+    method = _unwrap(api.post)
+
+    session = MagicMock()
+    _install_session(monkeypatch, session)
+    _install_features(monkeypatch, enabled=False)
+    monkeypatch.setattr(
+        app_import_module.AppDslService,
+        "import_app",
+        lambda *_args, **_kwargs: _Result(ImportStatus.FAILED, app_id=None),
+    )
+    monkeypatch.setattr(app_import_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    with app.test_request_context("/console/api/apps/imports", method="POST", json={"mode": "yaml-content"}):
+        response, status = method()
+
+    session.commit.assert_called_once()
+    assert status == 400
+    assert response["status"] == ImportStatus.FAILED
+
+
+def test_import_post_returns_pending_status(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = app_import_module.AppImportApi()
+    method = _unwrap(api.post)
+
+    session = MagicMock()
+    _install_session(monkeypatch, session)
+    _install_features(monkeypatch, enabled=False)
+    monkeypatch.setattr(
+        app_import_module.AppDslService,
+        "import_app",
+        lambda *_args, **_kwargs: _Result(ImportStatus.PENDING),
+    )
+    monkeypatch.setattr(app_import_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    with app.test_request_context("/console/api/apps/imports", method="POST", json={"mode": "yaml-content"}):
+        response, status = method()
+
+    session.commit.assert_called_once()
+    assert status == 202
+    assert response["status"] == ImportStatus.PENDING
+
+
+def test_import_post_updates_webapp_auth_when_enabled(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = app_import_module.AppImportApi()
+    method = _unwrap(api.post)
+
+    session = MagicMock()
+    _install_session(monkeypatch, session)
+    _install_features(monkeypatch, enabled=True)
+    monkeypatch.setattr(
+        app_import_module.AppDslService,
+        "import_app",
+        lambda *_args, **_kwargs: _Result(ImportStatus.COMPLETED, app_id="app-123"),
+    )
+    update_access = MagicMock()
+    monkeypatch.setattr(app_import_module.EnterpriseService.WebAppAuth, "update_app_access_mode", update_access)
+    monkeypatch.setattr(app_import_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    with app.test_request_context("/console/api/apps/imports", method="POST", json={"mode": "yaml-content"}):
+        response, status = method()
+
+    session.commit.assert_called_once()
+    update_access.assert_called_once_with("app-123", "private")
+    assert status == 200
+    assert response["status"] == ImportStatus.COMPLETED
+
+
+def test_import_confirm_returns_failed_status(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = app_import_module.AppImportConfirmApi()
+    method = _unwrap(api.post)
+
+    session = MagicMock()
+    _install_session(monkeypatch, session)
+    monkeypatch.setattr(
+        app_import_module.AppDslService,
+        "confirm_import",
+        lambda *_args, **_kwargs: _Result(ImportStatus.FAILED),
+    )
+    monkeypatch.setattr(app_import_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    with app.test_request_context("/console/api/apps/imports/import-1/confirm", method="POST"):
+        response, status = method(import_id="import-1")
+
+    session.commit.assert_called_once()
+    assert status == 400
+    assert response["status"] == ImportStatus.FAILED
+
+
+def test_import_check_dependencies_returns_result(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = app_import_module.AppImportCheckDependenciesApi()
+    method = _unwrap(api.get)
+
+    session = MagicMock()
+    _install_session(monkeypatch, session)
+    monkeypatch.setattr(
+        app_import_module.AppDslService,
+        "check_dependencies",
+        lambda *_args, **_kwargs: SimpleNamespace(model_dump=lambda mode="json": {"leaked_dependencies": []}),
+    )
+
+    with app.test_request_context("/console/api/apps/imports/app-1/check-dependencies", method="GET"):
+        response, status = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert status == 200
+    assert response["leaked_dependencies"] == []
@@ -0,0 +1,292 @@
+from __future__ import annotations
+
+import io
+from types import SimpleNamespace
+
+import pytest
+from werkzeug.datastructures import FileStorage
+from werkzeug.exceptions import InternalServerError
+
+from controllers.console.app.audio import ChatMessageAudioApi, ChatMessageTextApi, TextModesApi
+from controllers.console.app.error import (
+    AppUnavailableError,
+    AudioTooLargeError,
+    CompletionRequestError,
+    NoAudioUploadedError,
+    ProviderModelCurrentlyNotSupportError,
+    ProviderNotInitializeError,
+    ProviderNotSupportSpeechToTextError,
+    ProviderQuotaExceededError,
+    UnsupportedAudioTypeError,
+)
+from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
+from dify_graph.model_runtime.errors.invoke import InvokeError
+from services.audio_service import AudioService
+from services.errors.app_model_config import AppModelConfigBrokenError
+from services.errors.audio import (
+    AudioTooLargeServiceError,
+    NoAudioUploadedServiceError,
+    ProviderNotSupportSpeechToTextServiceError,
+    ProviderNotSupportTextToSpeechLanageServiceError,
+    UnsupportedAudioTypeServiceError,
+)
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def _file_data():
+    return FileStorage(stream=io.BytesIO(b"audio"), filename="audio.wav", content_type="audio/wav")
+
+
+def test_console_audio_api_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(AudioService, "transcript_asr", lambda **_kwargs: {"text": "ok"})
+    api = ChatMessageAudioApi()
+    handler = _unwrap(api.post)
+    app_model = SimpleNamespace(id="a1")
+
+    with app.test_request_context("/console/api/apps/app/audio-to-text", method="POST", data={"file": _file_data()}):
+        response = handler(app_model=app_model)
+
+    assert response == {"text": "ok"}
+
+
+@pytest.mark.parametrize(
+    ("exc", "expected"),
+    [
+        (AppModelConfigBrokenError(), AppUnavailableError),
+        (NoAudioUploadedServiceError(), NoAudioUploadedError),
+        (AudioTooLargeServiceError("too big"), AudioTooLargeError),
+        (UnsupportedAudioTypeServiceError(), UnsupportedAudioTypeError),
+        (ProviderNotSupportSpeechToTextServiceError(), ProviderNotSupportSpeechToTextError),
+        (ProviderTokenNotInitError("token"), ProviderNotInitializeError),
+        (QuotaExceededError(), ProviderQuotaExceededError),
+        (ModelCurrentlyNotSupportError(), ProviderModelCurrentlyNotSupportError),
+        (InvokeError("invoke"), CompletionRequestError),
+    ],
+)
+def test_console_audio_api_error_mapping(app, monkeypatch: pytest.MonkeyPatch, exc, expected) -> None:
+    monkeypatch.setattr(AudioService, "transcript_asr", lambda **_kwargs: (_ for _ in ()).throw(exc))
+    api = ChatMessageAudioApi()
+    handler = _unwrap(api.post)
+    app_model = SimpleNamespace(id="a1")
+
+    with app.test_request_context("/console/api/apps/app/audio-to-text", method="POST", data={"file": _file_data()}):
+        with pytest.raises(expected):
+            handler(app_model=app_model)
+
+
+def test_console_audio_api_unhandled_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(AudioService, "transcript_asr", lambda **_kwargs: (_ for _ in ()).throw(RuntimeError("boom")))
+    api = ChatMessageAudioApi()
+    handler = _unwrap(api.post)
+    app_model = SimpleNamespace(id="a1")
+
+    with app.test_request_context("/console/api/apps/app/audio-to-text", method="POST", data={"file": _file_data()}):
+        with pytest.raises(InternalServerError):
+            handler(app_model=app_model)
+
+
+def test_console_text_api_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(AudioService, "transcript_tts", lambda **_kwargs: {"audio": "ok"})
+
+    api = ChatMessageTextApi()
+    handler = _unwrap(api.post)
+    app_model = SimpleNamespace(id="a1")
+
+    with app.test_request_context(
+        "/console/api/apps/app/text-to-audio",
+        method="POST",
+        json={"text": "hello", "voice": "v"},
+    ):
+        response = handler(app_model=app_model)
+
+    assert response == {"audio": "ok"}
+
+
+def test_console_text_api_error_mapping(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(AudioService, "transcript_tts", lambda **_kwargs: (_ for _ in ()).throw(QuotaExceededError()))
+
+    api = ChatMessageTextApi()
+    handler = _unwrap(api.post)
+    app_model = SimpleNamespace(id="a1")
+
+    with app.test_request_context(
+        "/console/api/apps/app/text-to-audio",
+        method="POST",
+        json={"text": "hello"},
+    ):
+        with pytest.raises(ProviderQuotaExceededError):
+            handler(app_model=app_model)
+
+
+def test_console_text_modes_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(AudioService, "transcript_tts_voices", lambda **_kwargs: ["voice-1"])
+
+    api = TextModesApi()
+    handler = _unwrap(api.get)
+    app_model = SimpleNamespace(tenant_id="t1")
+
+    with app.test_request_context("/console/api/apps/app/text-to-audio/voices?language=en", method="GET"):
+        response = handler(app_model=app_model)
+
+    assert response == ["voice-1"]
+
+
+def test_console_text_modes_language_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        AudioService,
+        "transcript_tts_voices",
+        lambda **_kwargs: (_ for _ in ()).throw(ProviderNotSupportTextToSpeechLanageServiceError()),
+    )
+
+    api = TextModesApi()
+    handler = _unwrap(api.get)
+    app_model = SimpleNamespace(tenant_id="t1")
+
+    with app.test_request_context("/console/api/apps/app/text-to-audio/voices?language=en", method="GET"):
+        with pytest.raises(AppUnavailableError):
+            handler(app_model=app_model)
+
+
+def test_audio_to_text_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    response_payload = {"text": "hello"}
+    monkeypatch.setattr(AudioService, "transcript_asr", lambda **_kwargs: response_payload)
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"x"), "sample.wav")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        response = method(app_model=app_model)
+
+    assert response == response_payload
+
+
+def test_audio_to_text_maps_audio_too_large(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(
+        AudioService,
+        "transcript_asr",
+        lambda **_kwargs: (_ for _ in ()).throw(AudioTooLargeServiceError("too large")),
+    )
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"x"), "sample.wav")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        with pytest.raises(AudioTooLargeError):
+            method(app_model=app_model)
+
+
+def test_text_to_audio_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = ChatMessageTextApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(AudioService, "transcript_tts", lambda **_kwargs: {"audio": "ok"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio",
+        method="POST",
+        json={"text": "hello"},
+    ):
+        response = method(app_model=app_model)
+
+    assert response == {"audio": "ok"}
+
+
+def test_text_to_audio_voices_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = TextModesApi()
+    method = _unwrap(api.get)
+
+    monkeypatch.setattr(AudioService, "transcript_tts_voices", lambda **_kwargs: ["voice-1"])
+
+    app_model = SimpleNamespace(tenant_id="tenant-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio/voices",
+        method="GET",
+        query_string={"language": "en-US"},
+    ):
+        response = method(app_model=app_model)
+
+    assert response == ["voice-1"]
+
+
+def test_audio_to_text_with_invalid_file(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(AudioService, "transcript_asr", lambda **_kwargs: {"text": "test"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"invalid"), "sample.xyz")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        # Should not raise, AudioService is mocked
+        response = method(app_model=app_model)
+        assert response == {"text": "test"}
+
+
+def test_text_to_audio_with_language_param(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = ChatMessageTextApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(AudioService, "transcript_tts", lambda **_kwargs: {"audio": "test"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio",
+        method="POST",
+        json={"text": "hello", "language": "en-US"},
+    ):
+        response = method(app_model=app_model)
+        assert response == {"audio": "test"}
+
+
+def test_text_to_audio_voices_with_language_filter(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = TextModesApi()
+    method = _unwrap(api.get)
+
+    monkeypatch.setattr(
+        AudioService,
+        "transcript_tts_voices",
+        lambda **_kwargs: [{"id": "voice-1", "name": "Voice 1"}],
+    )
+
+    app_model = SimpleNamespace(tenant_id="tenant-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio/voices?language=en-US",
+        method="GET",
+    ):
+        response = method(app_model=app_model)
+        assert isinstance(response, list)
@@ -0,0 +1,156 @@
+from __future__ import annotations
+
+import io
+from types import SimpleNamespace
+
+import pytest
+
+from controllers.console.app import audio as audio_module
+from controllers.console.app.error import AudioTooLargeError
+from services.errors.audio import AudioTooLargeServiceError
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def test_audio_to_text_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    response_payload = {"text": "hello"}
+    monkeypatch.setattr(audio_module.AudioService, "transcript_asr", lambda **_kwargs: response_payload)
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"x"), "sample.wav")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        response = method(app_model=app_model)
+
+    assert response == response_payload
+
+
+def test_audio_to_text_maps_audio_too_large(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(
+        audio_module.AudioService,
+        "transcript_asr",
+        lambda **_kwargs: (_ for _ in ()).throw(AudioTooLargeServiceError("too large")),
+    )
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"x"), "sample.wav")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        with pytest.raises(AudioTooLargeError):
+            method(app_model=app_model)
+
+
+def test_text_to_audio_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.ChatMessageTextApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(audio_module.AudioService, "transcript_tts", lambda **_kwargs: {"audio": "ok"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio",
+        method="POST",
+        json={"text": "hello"},
+    ):
+        response = method(app_model=app_model)
+
+    assert response == {"audio": "ok"}
+
+
+def test_text_to_audio_voices_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.TextModesApi()
+    method = _unwrap(api.get)
+
+    monkeypatch.setattr(audio_module.AudioService, "transcript_tts_voices", lambda **_kwargs: ["voice-1"])
+
+    app_model = SimpleNamespace(tenant_id="tenant-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio/voices",
+        method="GET",
+        query_string={"language": "en-US"},
+    ):
+        response = method(app_model=app_model)
+
+    assert response == ["voice-1"]
+
+
+def test_audio_to_text_with_invalid_file(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.ChatMessageAudioApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(audio_module.AudioService, "transcript_asr", lambda **_kwargs: {"text": "test"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    data = {"file": (io.BytesIO(b"invalid"), "sample.xyz")}
+    with app.test_request_context(
+        "/console/api/apps/app-1/audio-to-text",
+        method="POST",
+        data=data,
+        content_type="multipart/form-data",
+    ):
+        # Should not raise, AudioService is mocked
+        response = method(app_model=app_model)
+        assert response == {"text": "test"}
+
+
+def test_text_to_audio_with_language_param(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.ChatMessageTextApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(audio_module.AudioService, "transcript_tts", lambda **_kwargs: {"audio": "test"})
+
+    app_model = SimpleNamespace(id="app-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio",
+        method="POST",
+        json={"text": "hello", "language": "en-US"},
+    ):
+        response = method(app_model=app_model)
+        assert response == {"audio": "test"}
+
+
+def test_text_to_audio_voices_with_language_filter(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = audio_module.TextModesApi()
+    method = _unwrap(api.get)
+
+    monkeypatch.setattr(
+        audio_module.AudioService,
+        "transcript_tts_voices",
+        lambda **_kwargs: [{"id": "voice-1", "name": "Voice 1"}],
+    )
+
+    app_model = SimpleNamespace(tenant_id="tenant-1")
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/text-to-audio/voices?language=en-US",
+        method="GET",
+    ):
+        response = method(app_model=app_model)
+        assert isinstance(response, list)
@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+from werkzeug.exceptions import BadRequest, NotFound
+
+from controllers.console.app import conversation as conversation_module
+from models.model import AppMode
+from services.errors.conversation import ConversationNotExistsError
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def _make_account():
+    return SimpleNamespace(timezone="UTC", id="u1")
+
+
+def test_completion_conversation_list_returns_paginated_result(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = conversation_module.CompletionConversationApi()
+    method = _unwrap(api.get)
+
+    account = _make_account()
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (account, "t1"))
+    monkeypatch.setattr(conversation_module, "parse_time_range", lambda *_args, **_kwargs: (None, None))
+
+    paginate_result = MagicMock()
+    monkeypatch.setattr(conversation_module.db, "paginate", lambda *_args, **_kwargs: paginate_result)
+
+    with app.test_request_context("/console/api/apps/app-1/completion-conversations", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response is paginate_result
+
+
+def test_completion_conversation_list_invalid_time_range(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = conversation_module.CompletionConversationApi()
+    method = _unwrap(api.get)
+
+    account = _make_account()
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (account, "t1"))
+    monkeypatch.setattr(
+        conversation_module,
+        "parse_time_range",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(ValueError("bad range")),
+    )
+
+    with app.test_request_context(
+        "/console/api/apps/app-1/completion-conversations",
+        method="GET",
+        query_string={"start": "bad"},
+    ):
+        with pytest.raises(BadRequest):
+            method(app_model=SimpleNamespace(id="app-1"))
+
+
+def test_chat_conversation_list_advanced_chat_calls_paginate(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = conversation_module.ChatConversationApi()
+    method = _unwrap(api.get)
+
+    account = _make_account()
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (account, "t1"))
+    monkeypatch.setattr(conversation_module, "parse_time_range", lambda *_args, **_kwargs: (None, None))
+
+    paginate_result = MagicMock()
+    monkeypatch.setattr(conversation_module.db, "paginate", lambda *_args, **_kwargs: paginate_result)
+
+    with app.test_request_context("/console/api/apps/app-1/chat-conversations", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1", mode=AppMode.ADVANCED_CHAT))
+
+    assert response is paginate_result
+
+
+def test_get_conversation_updates_read_at(monkeypatch: pytest.MonkeyPatch) -> None:
+    conversation = SimpleNamespace(id="c1", app_id="app-1")
+
+    query = MagicMock()
+    query.where.return_value = query
+    query.first.return_value = conversation
+
+    session = MagicMock()
+    session.query.return_value = query
+
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (_make_account(), "t1"))
+    monkeypatch.setattr(conversation_module.db, "session", session)
+
+    result = conversation_module._get_conversation(SimpleNamespace(id="app-1"), "c1")
+
+    assert result is conversation
+    session.execute.assert_called_once()
+    session.commit.assert_called_once()
+    session.refresh.assert_called_once_with(conversation)
+
+
+def test_get_conversation_missing_raises_not_found(monkeypatch: pytest.MonkeyPatch) -> None:
+    query = MagicMock()
+    query.where.return_value = query
+    query.first.return_value = None
+
+    session = MagicMock()
+    session.query.return_value = query
+
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (_make_account(), "t1"))
+    monkeypatch.setattr(conversation_module.db, "session", session)
+
+    with pytest.raises(NotFound):
+        conversation_module._get_conversation(SimpleNamespace(id="app-1"), "missing")
+
+
+def test_completion_conversation_delete_maps_not_found(monkeypatch: pytest.MonkeyPatch) -> None:
+    api = conversation_module.CompletionConversationDetailApi()
+    method = _unwrap(api.delete)
+
+    monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (_make_account(), "t1"))
+    monkeypatch.setattr(
+        conversation_module.ConversationService,
+        "delete",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(ConversationNotExistsError()),
+    )
+
+    with pytest.raises(NotFound):
+        method(app_model=SimpleNamespace(id="app-1"), conversation_id="c1")
@@ -0,0 +1,260 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from controllers.console.app import generator as generator_module
+from controllers.console.app.error import ProviderNotInitializeError
+from core.errors.error import ProviderTokenNotInitError
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def _model_config_payload():
+    return {"provider": "openai", "name": "gpt-4o", "mode": "chat", "completion_params": {}}
+
+
+def _install_workflow_service(monkeypatch: pytest.MonkeyPatch, workflow):
+    class _Service:
+        def get_draft_workflow(self, app_model):
+            return workflow
+
+    monkeypatch.setattr(generator_module, "WorkflowService", lambda: _Service())
+
+
+def test_rule_generate_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.RuleGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+    monkeypatch.setattr(generator_module.LLMGenerator, "generate_rule_config", lambda **_kwargs: {"rules": []})
+
+    with app.test_request_context(
+        "/console/api/rule-generate",
+        method="POST",
+        json={"instruction": "do it", "model_config": _model_config_payload()},
+    ):
+        response = method()
+
+    assert response == {"rules": []}
+
+
+def test_rule_code_generate_maps_token_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.RuleCodeGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    def _raise(*_args, **_kwargs):
+        raise ProviderTokenNotInitError("missing token")
+
+    monkeypatch.setattr(generator_module.LLMGenerator, "generate_code", _raise)
+
+    with app.test_request_context(
+        "/console/api/rule-code-generate",
+        method="POST",
+        json={"instruction": "do it", "model_config": _model_config_payload()},
+    ):
+        with pytest.raises(ProviderNotInitializeError):
+            method()
+
+
+def test_instruction_generate_app_not_found(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: None)
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "node-1",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response, status = method()
+
+    assert status == 400
+    assert response["error"] == "app app-1 not found"
+
+
+def test_instruction_generate_workflow_not_found(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    app_model = SimpleNamespace(id="app-1")
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    _install_workflow_service(monkeypatch, workflow=None)
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "node-1",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response, status = method()
+
+    assert status == 400
+    assert response["error"] == "workflow app-1 not found"
+
+
+def test_instruction_generate_node_missing(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    app_model = SimpleNamespace(id="app-1")
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+
+    workflow = SimpleNamespace(graph_dict={"nodes": []})
+    _install_workflow_service(monkeypatch, workflow=workflow)
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "node-1",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response, status = method()
+
+    assert status == 400
+    assert response["error"] == "node node-1 not found"
+
+
+def test_instruction_generate_code_node(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    app_model = SimpleNamespace(id="app-1")
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+
+    workflow = SimpleNamespace(
+        graph_dict={
+            "nodes": [
+                {"id": "node-1", "data": {"type": "code"}},
+            ]
+        }
+    )
+    _install_workflow_service(monkeypatch, workflow=workflow)
+    monkeypatch.setattr(generator_module.LLMGenerator, "generate_code", lambda **_kwargs: {"code": "x"})
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "node-1",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response = method()
+
+    assert response == {"code": "x"}
+
+
+def test_instruction_generate_legacy_modify(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+    monkeypatch.setattr(
+        generator_module.LLMGenerator,
+        "instruction_modify_legacy",
+        lambda **_kwargs: {"instruction": "ok"},
+    )
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "",
+            "current": "old",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response = method()
+
+    assert response == {"instruction": "ok"}
+
+
+def test_instruction_generate_incompatible_params(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = generator_module.InstructionGenerateApi()
+    method = _unwrap(api.post)
+
+    monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
+
+    with app.test_request_context(
+        "/console/api/instruction-generate",
+        method="POST",
+        json={
+            "flow_id": "app-1",
+            "node_id": "",
+            "current": "",
+            "instruction": "do",
+            "model_config": _model_config_payload(),
+        },
+    ):
+        response, status = method()
+
+    assert status == 400
+    assert response["error"] == "incompatible parameters"
+
+
+def test_instruction_template_prompt(app) -> None:
+    api = generator_module.InstructionGenerationTemplateApi()
+    method = _unwrap(api.post)
+
+    with app.test_request_context(
+        "/console/api/instruction-generate/template",
+        method="POST",
+        json={"type": "prompt"},
+    ):
+        response = method()
+
+    assert "data" in response
+
+
+def test_instruction_template_invalid_type(app) -> None:
+    api = generator_module.InstructionGenerationTemplateApi()
+    method = _unwrap(api.post)
+
+    with app.test_request_context(
+        "/console/api/instruction-generate/template",
+        method="POST",
+        json={"type": "unknown"},
+    ):
+        with pytest.raises(ValueError):
+            method()
@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import pytest
+
+from controllers.console.app import message as message_module
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def test_chat_messages_query_valid(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test valid ChatMessagesQuery with all fields."""
+    query = message_module.ChatMessagesQuery(
+        conversation_id="550e8400-e29b-41d4-a716-446655440000",
+        first_id="550e8400-e29b-41d4-a716-446655440001",
+        limit=50,
+    )
+    assert query.limit == 50
+
+
+def test_chat_messages_query_defaults(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test ChatMessagesQuery with defaults."""
+    query = message_module.ChatMessagesQuery(conversation_id="550e8400-e29b-41d4-a716-446655440000")
+    assert query.first_id is None
+    assert query.limit == 20
+
+
+def test_chat_messages_query_empty_first_id(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test ChatMessagesQuery converts empty first_id to None."""
+    query = message_module.ChatMessagesQuery(
+        conversation_id="550e8400-e29b-41d4-a716-446655440000",
+        first_id="",
+    )
+    assert query.first_id is None
+
+
+def test_message_feedback_payload_valid_like(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test MessageFeedbackPayload with like rating."""
+    payload = message_module.MessageFeedbackPayload(
+        message_id="550e8400-e29b-41d4-a716-446655440000",
+        rating="like",
+        content="Good answer",
+    )
+    assert payload.rating == "like"
+    assert payload.content == "Good answer"
+
+
+def test_message_feedback_payload_valid_dislike(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test MessageFeedbackPayload with dislike rating."""
+    payload = message_module.MessageFeedbackPayload(
+        message_id="550e8400-e29b-41d4-a716-446655440000",
+        rating="dislike",
+    )
+    assert payload.rating == "dislike"
+
+
+def test_message_feedback_payload_no_rating(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test MessageFeedbackPayload without rating."""
+    payload = message_module.MessageFeedbackPayload(message_id="550e8400-e29b-41d4-a716-446655440000")
+    assert payload.rating is None
+
+
+def test_feedback_export_query_defaults(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with default format."""
+    query = message_module.FeedbackExportQuery()
+    assert query.format == "csv"
+    assert query.from_source is None
+
+
+def test_feedback_export_query_json_format(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with JSON format."""
+    query = message_module.FeedbackExportQuery(format="json")
+    assert query.format == "json"
+
+
+def test_feedback_export_query_has_comment_true(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with has_comment as true string."""
+    query = message_module.FeedbackExportQuery(has_comment="true")
+    assert query.has_comment is True
+
+
+def test_feedback_export_query_has_comment_false(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with has_comment as false string."""
+    query = message_module.FeedbackExportQuery(has_comment="false")
+    assert query.has_comment is False
+
+
+def test_feedback_export_query_has_comment_1(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with has_comment as 1."""
+    query = message_module.FeedbackExportQuery(has_comment="1")
+    assert query.has_comment is True
+
+
+def test_feedback_export_query_has_comment_0(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with has_comment as 0."""
+    query = message_module.FeedbackExportQuery(has_comment="0")
+    assert query.has_comment is False
+
+
+def test_feedback_export_query_rating_filter(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test FeedbackExportQuery with rating filter."""
+    query = message_module.FeedbackExportQuery(rating="like")
+    assert query.rating == "like"
+
+
+def test_annotation_count_response(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test AnnotationCountResponse creation."""
+    response = message_module.AnnotationCountResponse(count=10)
+    assert response.count == 10
+
+
+def test_suggested_questions_response(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test SuggestedQuestionsResponse creation."""
+    response = message_module.SuggestedQuestionsResponse(data=["What is AI?", "How does ML work?"])
+    assert len(response.data) == 2
+    assert response.data[0] == "What is AI?"
@@ -0,0 +1,151 @@
+from __future__ import annotations
+
+import json
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from controllers.console.app import model_config as model_config_module
+from models.model import AppMode, AppModelConfig
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+def test_post_updates_app_model_config_for_chat(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = model_config_module.ModelConfigResource()
+    method = _unwrap(api.post)
+
+    app_model = SimpleNamespace(
+        id="app-1",
+        mode=AppMode.CHAT.value,
+        is_agent=False,
+        app_model_config_id=None,
+        updated_by=None,
+        updated_at=None,
+    )
+    monkeypatch.setattr(
+        model_config_module.AppModelConfigService,
+        "validate_configuration",
+        lambda **_kwargs: {"pre_prompt": "hi"},
+    )
+    monkeypatch.setattr(model_config_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    session = MagicMock()
+    monkeypatch.setattr(model_config_module.db, "session", session)
+
+    def _from_model_config_dict(self, model_config):
+        self.pre_prompt = model_config["pre_prompt"]
+        self.id = "config-1"
+        return self
+
+    monkeypatch.setattr(AppModelConfig, "from_model_config_dict", _from_model_config_dict)
+    send_mock = MagicMock()
+    monkeypatch.setattr(model_config_module.app_model_config_was_updated, "send", send_mock)
+
+    with app.test_request_context("/console/api/apps/app-1/model-config", method="POST", json={"pre_prompt": "hi"}):
+        response = method(app_model=app_model)
+
+    session.add.assert_called_once()
+    session.flush.assert_called_once()
+    session.commit.assert_called_once()
+    send_mock.assert_called_once()
+    assert app_model.app_model_config_id == "config-1"
+    assert response["result"] == "success"
+
+
+def test_post_encrypts_agent_tool_parameters(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = model_config_module.ModelConfigResource()
+    method = _unwrap(api.post)
+
+    app_model = SimpleNamespace(
+        id="app-1",
+        mode=AppMode.AGENT_CHAT.value,
+        is_agent=True,
+        app_model_config_id="config-0",
+        updated_by=None,
+        updated_at=None,
+    )
+
+    original_config = AppModelConfig(app_id="app-1", created_by="u1", updated_by="u1")
+    original_config.agent_mode = json.dumps(
+        {
+            "enabled": True,
+            "strategy": "function-calling",
+            "tools": [
+                {
+                    "provider_id": "provider",
+                    "provider_type": "builtin",
+                    "tool_name": "tool",
+                    "tool_parameters": {"secret": "masked"},
+                }
+            ],
+            "prompt": None,
+        }
+    )
+
+    session = MagicMock()
+    query = MagicMock()
+    query.where.return_value = query
+    query.first.return_value = original_config
+    session.query.return_value = query
+    monkeypatch.setattr(model_config_module.db, "session", session)
+
+    monkeypatch.setattr(
+        model_config_module.AppModelConfigService,
+        "validate_configuration",
+        lambda **_kwargs: {
+            "pre_prompt": "hi",
+            "agent_mode": {
+                "enabled": True,
+                "strategy": "function-calling",
+                "tools": [
+                    {
+                        "provider_id": "provider",
+                        "provider_type": "builtin",
+                        "tool_name": "tool",
+                        "tool_parameters": {"secret": "masked"},
+                    }
+                ],
+                "prompt": None,
+            },
+        },
+    )
+    monkeypatch.setattr(model_config_module, "current_account_with_tenant", lambda: (SimpleNamespace(id="u1"), "t1"))
+
+    monkeypatch.setattr(model_config_module.ToolManager, "get_agent_tool_runtime", lambda **_kwargs: object())
+
+    class _ParamManager:
+        def __init__(self, **_kwargs):
+            self.delete_called = False
+
+        def decrypt_tool_parameters(self, _value):
+            return {"secret": "decrypted"}
+
+        def mask_tool_parameters(self, _value):
+            return {"secret": "masked"}
+
+        def encrypt_tool_parameters(self, _value):
+            return {"secret": "encrypted"}
+
+        def delete_tool_parameters_cache(self):
+            self.delete_called = True
+
+    monkeypatch.setattr(model_config_module, "ToolParameterConfigurationManager", _ParamManager)
+    send_mock = MagicMock()
+    monkeypatch.setattr(model_config_module.app_model_config_was_updated, "send", send_mock)
+
+    with app.test_request_context("/console/api/apps/app-1/model-config", method="POST", json={"pre_prompt": "hi"}):
+        response = method(app_model=app_model)
+
+    stored_config = session.add.call_args[0][0]
+    stored_agent_mode = json.loads(stored_config.agent_mode)
+    assert stored_agent_mode["tools"][0]["tool_parameters"]["secret"] == "encrypted"
+    assert response["result"] == "success"
@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+from decimal import Decimal
+from types import SimpleNamespace
+
+import pytest
+from werkzeug.exceptions import BadRequest
+
+from controllers.console.app import statistic as statistic_module
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+class _ConnContext:
+    def __init__(self, rows):
+        self._rows = rows
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+    def execute(self, _query, _args):
+        return self._rows
+
+
+def _install_db(monkeypatch: pytest.MonkeyPatch, rows) -> None:
+    engine = SimpleNamespace(begin=lambda: _ConnContext(rows))
+    monkeypatch.setattr(statistic_module, "db", SimpleNamespace(engine=engine))
+
+
+def _install_common(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        statistic_module,
+        "current_account_with_tenant",
+        lambda: (SimpleNamespace(timezone="UTC"), "t1"),
+    )
+    monkeypatch.setattr(
+        statistic_module,
+        "parse_time_range",
+        lambda *_args, **_kwargs: (None, None),
+    )
+    monkeypatch.setattr(statistic_module, "convert_datetime_to_date", lambda field: field)
+
+
+def test_daily_message_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyMessageStatistic()
+    method = _unwrap(api.get)
+
+    rows = [SimpleNamespace(date="2024-01-01", message_count=3)]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-messages", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response.get_json() == {"data": [{"date": "2024-01-01", "message_count": 3}]}
+
+
+def test_daily_conversation_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyConversationStatistic()
+    method = _unwrap(api.get)
+
+    rows = [SimpleNamespace(date="2024-01-02", conversation_count=5)]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-conversations", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response.get_json() == {"data": [{"date": "2024-01-02", "conversation_count": 5}]}
+
+
+def test_daily_token_cost_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyTokenCostStatistic()
+    method = _unwrap(api.get)
+
+    rows = [SimpleNamespace(date="2024-01-03", token_count=10, total_price=0.25, currency="USD")]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/token-costs", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    data = response.get_json()
+    assert len(data["data"]) == 1
+    assert data["data"][0]["date"] == "2024-01-03"
+    assert data["data"][0]["token_count"] == 10
+    assert data["data"][0]["total_price"] == 0.25
+
+
+def test_daily_terminals_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyTerminalsStatistic()
+    method = _unwrap(api.get)
+
+    rows = [SimpleNamespace(date="2024-01-04", terminal_count=7)]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-end-users", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response.get_json() == {"data": [{"date": "2024-01-04", "terminal_count": 7}]}
+
+
+def test_average_session_interaction_statistic_requires_chat_mode(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test that AverageSessionInteractionStatistic is limited to chat/agent modes."""
+    # This just verifies the decorator is applied correctly
+    # Actual endpoint testing would require complex JOIN mocking
+    api = statistic_module.AverageSessionInteractionStatistic()
+    method = _unwrap(api.get)
+    assert callable(method)
+
+
+def test_daily_message_statistic_with_invalid_time_range(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyMessageStatistic()
+    method = _unwrap(api.get)
+
+    def mock_parse(*args, **kwargs):
+        raise ValueError("Invalid time range")
+
+    _install_db(monkeypatch, [])
+    monkeypatch.setattr(
+        statistic_module,
+        "current_account_with_tenant",
+        lambda: (SimpleNamespace(timezone="UTC"), "t1"),
+    )
+    monkeypatch.setattr(statistic_module, "parse_time_range", mock_parse)
+    monkeypatch.setattr(statistic_module, "convert_datetime_to_date", lambda field: field)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-messages", method="GET"):
+        with pytest.raises(BadRequest):
+            method(app_model=SimpleNamespace(id="app-1"))
+
+
+def test_daily_message_statistic_multiple_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyMessageStatistic()
+    method = _unwrap(api.get)
+
+    rows = [
+        SimpleNamespace(date="2024-01-01", message_count=10),
+        SimpleNamespace(date="2024-01-02", message_count=15),
+        SimpleNamespace(date="2024-01-03", message_count=12),
+    ]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-messages", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    data = response.get_json()
+    assert len(data["data"]) == 3
+
+
+def test_daily_message_statistic_empty_result(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyMessageStatistic()
+    method = _unwrap(api.get)
+
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, [])
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-messages", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response.get_json() == {"data": []}
+
+
+def test_daily_conversation_statistic_with_time_range(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyConversationStatistic()
+    method = _unwrap(api.get)
+
+    rows = [SimpleNamespace(date="2024-01-02", conversation_count=5)]
+    _install_db(monkeypatch, rows)
+    monkeypatch.setattr(
+        statistic_module,
+        "current_account_with_tenant",
+        lambda: (SimpleNamespace(timezone="UTC"), "t1"),
+    )
+    monkeypatch.setattr(
+        statistic_module,
+        "parse_time_range",
+        lambda *_args, **_kwargs: ("s", "e"),
+    )
+    monkeypatch.setattr(statistic_module, "convert_datetime_to_date", lambda field: field)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/daily-conversations", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    assert response.get_json() == {"data": [{"date": "2024-01-02", "conversation_count": 5}]}
+
+
+def test_daily_token_cost_with_multiple_currencies(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = statistic_module.DailyTokenCostStatistic()
+    method = _unwrap(api.get)
+
+    rows = [
+        SimpleNamespace(date="2024-01-01", token_count=100, total_price=Decimal("0.50"), currency="USD"),
+        SimpleNamespace(date="2024-01-02", token_count=200, total_price=Decimal("1.00"), currency="USD"),
+    ]
+    _install_common(monkeypatch)
+    _install_db(monkeypatch, rows)
+
+    with app.test_request_context("/console/api/apps/app-1/statistics/token-costs", method="GET"):
+        response = method(app_model=SimpleNamespace(id="app-1"))
+
+    data = response.get_json()
+    assert len(data["data"]) == 2
@@ -0,0 +1,163 @@
+from __future__ import annotations
+
+from datetime import datetime
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+import pytest
+from werkzeug.exceptions import HTTPException, NotFound
+
+from controllers.console.app import workflow as workflow_module
+from controllers.console.app.error import DraftWorkflowNotExist, DraftWorkflowNotSync
+from dify_graph.file.enums import FileTransferMethod, FileType
+from dify_graph.file.models import File
+
+
+def _unwrap(func):
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    return func
+
+
+def test_parse_file_no_config(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(workflow_module.FileUploadConfigManager, "convert", lambda *_args, **_kwargs: None)
+    workflow = SimpleNamespace(features_dict={}, tenant_id="t1")
+
+    assert workflow_module._parse_file(workflow, files=[{"id": "f"}]) == []
+
+
+def test_parse_file_with_config(monkeypatch: pytest.MonkeyPatch) -> None:
+    config = object()
+    file_list = [
+        File(
+            tenant_id="t1",
+            type=FileType.IMAGE,
+            transfer_method=FileTransferMethod.REMOTE_URL,
+            remote_url="http://u",
+        )
+    ]
+    build_mock = Mock(return_value=file_list)
+    monkeypatch.setattr(workflow_module.FileUploadConfigManager, "convert", lambda *_args, **_kwargs: config)
+    monkeypatch.setattr(workflow_module.file_factory, "build_from_mappings", build_mock)
+
+    workflow = SimpleNamespace(features_dict={}, tenant_id="t1")
+    result = workflow_module._parse_file(workflow, files=[{"id": "f"}])
+
+    assert result == file_list
+    build_mock.assert_called_once()
+
+
+def test_sync_draft_workflow_invalid_content_type(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = workflow_module.DraftWorkflowApi()
+    handler = _unwrap(api.post)
+
+    monkeypatch.setattr(workflow_module, "current_account_with_tenant", lambda: (SimpleNamespace(), "t1"))
+
+    with app.test_request_context("/apps/app/workflows/draft", method="POST", data="x", content_type="text/html"):
+        with pytest.raises(HTTPException) as exc:
+            handler(api, app_model=SimpleNamespace(id="app"))
+
+    assert exc.value.code == 415
+
+
+def test_sync_draft_workflow_invalid_json(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    api = workflow_module.DraftWorkflowApi()
+    handler = _unwrap(api.post)
+
+    monkeypatch.setattr(workflow_module, "current_account_with_tenant", lambda: (SimpleNamespace(), "t1"))
+
+    with app.test_request_context(
+        "/apps/app/workflows/draft",
+        method="POST",
+        data="[]",
+        content_type="application/json",
+    ):
+        response, status = handler(api, app_model=SimpleNamespace(id="app"))
+
+    assert status == 400
+    assert response["message"] == "Invalid JSON data"
+
+
+def test_sync_draft_workflow_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    workflow = SimpleNamespace(
+        unique_hash="h",
+        updated_at=None,
+        created_at=datetime(2024, 1, 1),
+    )
+    monkeypatch.setattr(workflow_module, "current_account_with_tenant", lambda: (SimpleNamespace(), "t1"))
+    monkeypatch.setattr(
+        workflow_module.variable_factory, "build_environment_variable_from_mapping", lambda *_args: "env"
+    )
+    monkeypatch.setattr(
+        workflow_module.variable_factory, "build_conversation_variable_from_mapping", lambda *_args: "conv"
+    )
+
+    service = SimpleNamespace(sync_draft_workflow=lambda **_kwargs: workflow)
+    monkeypatch.setattr(workflow_module, "WorkflowService", lambda: service)
+
+    api = workflow_module.DraftWorkflowApi()
+    handler = _unwrap(api.post)
+
+    with app.test_request_context(
+        "/apps/app/workflows/draft",
+        method="POST",
+        json={"graph": {}, "features": {}, "hash": "h"},
+    ):
+        response = handler(api, app_model=SimpleNamespace(id="app"))
+
+    assert response["result"] == "success"
+
+
+def test_sync_draft_workflow_hash_mismatch(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(workflow_module, "current_account_with_tenant", lambda: (SimpleNamespace(), "t1"))
+
+    def _raise(*_args, **_kwargs):
+        raise workflow_module.WorkflowHashNotEqualError()
+
+    service = SimpleNamespace(sync_draft_workflow=_raise)
+    monkeypatch.setattr(workflow_module, "WorkflowService", lambda: service)
+
+    api = workflow_module.DraftWorkflowApi()
+    handler = _unwrap(api.post)
+
+    with app.test_request_context(
+        "/apps/app/workflows/draft",
+        method="POST",
+        json={"graph": {}, "features": {}, "hash": "h"},
+    ):
+        with pytest.raises(DraftWorkflowNotSync):
+            handler(api, app_model=SimpleNamespace(id="app"))
+
+
+def test_draft_workflow_get_not_found(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        workflow_module, "WorkflowService", lambda: SimpleNamespace(get_draft_workflow=lambda **_k: None)
+    )
+
+    api = workflow_module.DraftWorkflowApi()
+    handler = _unwrap(api.get)
+
+    with pytest.raises(DraftWorkflowNotExist):
+        handler(api, app_model=SimpleNamespace(id="app"))
+
+
+def test_advanced_chat_run_conversation_not_exists(app, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        workflow_module.AppGenerateService,
+        "generate",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            workflow_module.services.errors.conversation.ConversationNotExistsError()
+        ),
+    )
+    monkeypatch.setattr(workflow_module, "current_account_with_tenant", lambda: (SimpleNamespace(), "t1"))
+
+    api = workflow_module.AdvancedChatDraftWorkflowRunApi()
+    handler = _unwrap(api.post)
+
+    with app.test_request_context(
+        "/apps/app/advanced-chat/workflows/draft/run",
+        method="POST",
+        json={"inputs": {}},
+    ):
+        with pytest.raises(NotFound):
+            handler(api, app_model=SimpleNamespace(id="app"))
@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from controllers.console.app import wraps as wraps_module
+from controllers.console.app.error import AppNotFoundError
+from models.model import AppMode
+
+
+def test_get_app_model_injects_model(monkeypatch: pytest.MonkeyPatch) -> None:
+    app_model = SimpleNamespace(id="app-1", mode=AppMode.CHAT.value, status="normal", tenant_id="t1")
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
+
+    monkeypatch.setattr(wraps_module, "current_account_with_tenant", lambda: (None, "t1"))
+    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+
+    @wraps_module.get_app_model
+    def handler(app_model):
+        return app_model.id
+
+    assert handler(app_id="app-1") == "app-1"
+
+
+def test_get_app_model_rejects_wrong_mode(monkeypatch: pytest.MonkeyPatch) -> None:
+    app_model = SimpleNamespace(id="app-1", mode=AppMode.CHAT.value, status="normal", tenant_id="t1")
+    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
+
+    monkeypatch.setattr(wraps_module, "current_account_with_tenant", lambda: (None, "t1"))
+    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+
+    @wraps_module.get_app_model(mode=[AppMode.COMPLETION])
+    def handler(app_model):
+        return app_model.id
+
+    with pytest.raises(AppNotFoundError):
+        handler(app_id="app-1")
+
+
+def test_get_app_model_requires_app_id() -> None:
+    @wraps_module.get_app_model
+    def handler(app_model):
+        return app_model.id
+
+    with pytest.raises(ValueError):
+        handler()
@@ -0,0 +1,817 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+from werkzeug.exceptions import Forbidden, NotFound
+
+from controllers.console import console_ns
+from controllers.console.datasets.rag_pipeline.datasource_auth import (
+    DatasourceAuth,
+    DatasourceAuthDefaultApi,
+    DatasourceAuthDeleteApi,
+    DatasourceAuthListApi,
+    DatasourceAuthOauthCustomClient,
+    DatasourceAuthUpdateApi,
+    DatasourceHardCodeAuthListApi,
+    DatasourceOAuthCallback,
+    DatasourcePluginOAuthAuthorizationUrl,
+    DatasourceUpdateProviderNameApi,
+)
+from core.plugin.impl.oauth import OAuthHandler
+from dify_graph.model_runtime.errors.validate import CredentialsValidateFailedError
+from services.datasource_provider_service import DatasourceProviderService
+from services.plugin.oauth_service import OAuthProxyService
+
+
+def unwrap(func):
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    return func
+
+
+class TestDatasourcePluginOAuthAuthorizationUrl:
+    def test_get_success(self, app):
+        api = DatasourcePluginOAuthAuthorizationUrl()
+        method = unwrap(api.get)
+
+        user = MagicMock(id="user-1")
+
+        with (
+            app.test_request_context("/?credential_id=cred-1"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value={"client_id": "abc"},
+            ),
+            patch.object(
+                OAuthProxyService,
+                "create_proxy_context",
+                return_value="ctx-1",
+            ),
+            patch.object(
+                OAuthHandler,
+                "get_authorization_url",
+                return_value={"url": "http://auth"},
+            ),
+        ):
+            response = method(api, "notion")
+
+        assert response.status_code == 200
+
+    def test_get_no_oauth_config(self, app):
+        api = DatasourcePluginOAuthAuthorizationUrl()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value=None,
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+    def test_get_without_credential_id_sets_cookie(self, app):
+        api = DatasourcePluginOAuthAuthorizationUrl()
+        method = unwrap(api.get)
+
+        user = MagicMock(id="user-1")
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value={"client_id": "abc"},
+            ),
+            patch.object(
+                OAuthProxyService,
+                "create_proxy_context",
+                return_value="ctx-123",
+            ),
+            patch.object(
+                OAuthHandler,
+                "get_authorization_url",
+                return_value={"url": "http://auth"},
+            ),
+        ):
+            response = method(api, "notion")
+
+        assert response.status_code == 200
+        assert "context_id" in response.headers.get("Set-Cookie")
+
+
+class TestDatasourceOAuthCallback:
+    def test_callback_success_new_credential(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        oauth_response = MagicMock()
+        oauth_response.credentials = {"token": "abc"}
+        oauth_response.expires_at = None
+        oauth_response.metadata = {"name": "test"}
+
+        context = {
+            "user_id": "user-1",
+            "tenant_id": "tenant-1",
+            "credential_id": None,
+        }
+
+        with (
+            app.test_request_context("/?context_id=ctx"),
+            patch.object(
+                OAuthProxyService,
+                "use_proxy_context",
+                return_value=context,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value={"client_id": "abc"},
+            ),
+            patch.object(
+                OAuthHandler,
+                "get_credentials",
+                return_value=oauth_response,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "add_datasource_oauth_provider",
+                return_value=None,
+            ),
+        ):
+            response = method(api, "notion")
+
+        assert response.status_code == 302
+
+    def test_callback_missing_context(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        with app.test_request_context("/"):
+            with pytest.raises(Forbidden):
+                method(api, "notion")
+
+    def test_callback_invalid_context(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/?context_id=bad"),
+            patch.object(
+                OAuthProxyService,
+                "use_proxy_context",
+                return_value=None,
+            ),
+        ):
+            with pytest.raises(Forbidden):
+                method(api, "notion")
+
+    def test_callback_oauth_config_not_found(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        context = {"user_id": "u", "tenant_id": "t"}
+
+        with (
+            app.test_request_context("/?context_id=ctx"),
+            patch.object(
+                OAuthProxyService,
+                "use_proxy_context",
+                return_value=context,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value=None,
+            ),
+        ):
+            with pytest.raises(NotFound):
+                method(api, "notion")
+
+    def test_callback_reauthorize_existing_credential(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        oauth_response = MagicMock()
+        oauth_response.credentials = {"token": "abc"}
+        oauth_response.expires_at = None
+        oauth_response.metadata = {}  # avatar + name missing
+
+        context = {
+            "user_id": "user-1",
+            "tenant_id": "tenant-1",
+            "credential_id": "cred-1",
+        }
+
+        with (
+            app.test_request_context("/?context_id=ctx"),
+            patch.object(
+                OAuthProxyService,
+                "use_proxy_context",
+                return_value=context,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value={"client_id": "abc"},
+            ),
+            patch.object(
+                OAuthHandler,
+                "get_credentials",
+                return_value=oauth_response,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "reauthorize_datasource_oauth_provider",
+                return_value=None,
+            ),
+        ):
+            response = method(api, "notion")
+
+        assert response.status_code == 302
+        assert "/oauth-callback" in response.location
+
+    def test_callback_context_id_from_cookie(self, app):
+        api = DatasourceOAuthCallback()
+        method = unwrap(api.get)
+
+        oauth_response = MagicMock()
+        oauth_response.credentials = {"token": "abc"}
+        oauth_response.expires_at = None
+        oauth_response.metadata = {}
+
+        context = {
+            "user_id": "user-1",
+            "tenant_id": "tenant-1",
+            "credential_id": None,
+        }
+
+        with (
+            app.test_request_context("/", headers={"Cookie": "context_id=ctx"}),
+            patch.object(
+                OAuthProxyService,
+                "use_proxy_context",
+                return_value=context,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_oauth_client",
+                return_value={"client_id": "abc"},
+            ),
+            patch.object(
+                OAuthHandler,
+                "get_credentials",
+                return_value=oauth_response,
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "add_datasource_oauth_provider",
+                return_value=None,
+            ),
+        ):
+            response = method(api, "notion")
+
+        assert response.status_code == 302
+
+
+class TestDatasourceAuth:
+    def test_post_success(self, app):
+        api = DatasourceAuth()
+        method = unwrap(api.post)
+
+        payload = {"credentials": {"key": "val"}}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "add_datasource_api_key_provider",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_post_invalid_credentials(self, app):
+        api = DatasourceAuth()
+        method = unwrap(api.post)
+
+        payload = {"credentials": {"key": "bad"}}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "add_datasource_api_key_provider",
+                side_effect=CredentialsValidateFailedError("invalid"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+    def test_get_success(self, app):
+        api = DatasourceAuth()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "list_datasource_credentials",
+                return_value=[{"id": "1"}],
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+        assert response["result"]
+
+    def test_post_missing_credentials(self, app):
+        api = DatasourceAuth()
+        method = unwrap(api.post)
+
+        payload = {}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+    def test_get_empty_list(self, app):
+        api = DatasourceAuth()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "list_datasource_credentials",
+                return_value=[],
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+        assert response["result"] == []
+
+
+class TestDatasourceAuthDeleteApi:
+    def test_delete_success(self, app):
+        api = DatasourceAuthDeleteApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "cred-1"}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "remove_datasource_credentials",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_delete_missing_credential_id(self, app):
+        api = DatasourceAuthDeleteApi()
+        method = unwrap(api.post)
+
+        payload = {}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+
+class TestDatasourceAuthUpdateApi:
+    def test_update_success(self, app):
+        api = DatasourceAuthUpdateApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "id", "credentials": {"k": "v"}}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "update_datasource_credentials",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 201
+
+    def test_update_with_credentials_none(self, app):
+        api = DatasourceAuthUpdateApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "id", "credentials": None}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "update_datasource_credentials",
+                return_value=None,
+            ) as update_mock,
+        ):
+            response, status = method(api, "notion")
+
+        update_mock.assert_called_once()
+        assert status == 201
+
+    def test_update_name_only(self, app):
+        api = DatasourceAuthUpdateApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "id", "name": "New Name"}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "update_datasource_credentials",
+                return_value=None,
+            ),
+        ):
+            _, status = method(api, "notion")
+
+        assert status == 201
+
+    def test_update_with_empty_credentials_dict(self, app):
+        api = DatasourceAuthUpdateApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "id", "credentials": {}}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "update_datasource_credentials",
+                return_value=None,
+            ) as update_mock,
+        ):
+            _, status = method(api, "notion")
+
+        update_mock.assert_called_once()
+        assert status == 201
+
+
+class TestDatasourceAuthListApi:
+    def test_list_success(self, app):
+        api = DatasourceAuthListApi()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_all_datasource_credentials",
+                return_value=[{"id": "1"}],
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 200
+
+    def test_auth_list_empty(self, app):
+        api = DatasourceAuthListApi()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_all_datasource_credentials",
+                return_value=[],
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 200
+        assert response["result"] == []
+
+    def test_hardcode_list_empty(self, app):
+        api = DatasourceHardCodeAuthListApi()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_hard_code_datasource_credentials",
+                return_value=[],
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 200
+        assert response["result"] == []
+
+
+class TestDatasourceHardCodeAuthListApi:
+    def test_list_success(self, app):
+        api = DatasourceHardCodeAuthListApi()
+        method = unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "get_hard_code_datasource_credentials",
+                return_value=[{"id": "1"}],
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 200
+
+
+class TestDatasourceAuthOauthCustomClient:
+    def test_post_success(self, app):
+        api = DatasourceAuthOauthCustomClient()
+        method = unwrap(api.post)
+
+        payload = {"client_params": {}, "enable_oauth_custom_client": True}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "setup_oauth_custom_client_params",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_delete_success(self, app):
+        api = DatasourceAuthOauthCustomClient()
+        method = unwrap(api.delete)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "remove_oauth_custom_client_params",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_post_empty_payload(self, app):
+        api = DatasourceAuthOauthCustomClient()
+        method = unwrap(api.post)
+
+        payload = {}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "setup_oauth_custom_client_params",
+                return_value=None,
+            ),
+        ):
+            _, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_post_disabled_flag(self, app):
+        api = DatasourceAuthOauthCustomClient()
+        method = unwrap(api.post)
+
+        payload = {
+            "client_params": {"a": 1},
+            "enable_oauth_custom_client": False,
+        }
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "setup_oauth_custom_client_params",
+                return_value=None,
+            ) as setup_mock,
+        ):
+            _, status = method(api, "notion")
+
+        setup_mock.assert_called_once()
+        assert status == 200
+
+
+class TestDatasourceAuthDefaultApi:
+    def test_set_default_success(self, app):
+        api = DatasourceAuthDefaultApi()
+        method = unwrap(api.post)
+
+        payload = {"id": "cred-1"}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "set_default_datasource_provider",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_default_missing_id(self, app):
+        api = DatasourceAuthDefaultApi()
+        method = unwrap(api.post)
+
+        payload = {}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+
+class TestDatasourceUpdateProviderNameApi:
+    def test_update_name_success(self, app):
+        api = DatasourceUpdateProviderNameApi()
+        method = unwrap(api.post)
+
+        payload = {"credential_id": "id", "name": "New Name"}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+            patch.object(
+                DatasourceProviderService,
+                "update_datasource_provider_name",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, "notion")
+
+        assert status == 200
+
+    def test_update_name_too_long(self, app):
+        api = DatasourceUpdateProviderNameApi()
+        method = unwrap(api.post)
+
+        payload = {
+            "credential_id": "id",
+            "name": "x" * 101,
+        }
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
+
+    def test_update_name_missing_credential_id(self, app):
+        api = DatasourceUpdateProviderNameApi()
+        method = unwrap(api.post)
+
+        payload = {"name": "Valid"}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_auth.current_account_with_tenant",
+                return_value=(MagicMock(), "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "notion")
@@ -0,0 +1,143 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+from werkzeug.exceptions import Forbidden
+
+from controllers.console import console_ns
+from controllers.console.datasets.rag_pipeline.datasource_content_preview import (
+    DataSourceContentPreviewApi,
+)
+from models import Account
+from models.dataset import Pipeline
+
+
+def unwrap(func):
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    return func
+
+
+class TestDataSourceContentPreviewApi:
+    def _valid_payload(self):
+        return {
+            "inputs": {"query": "hello"},
+            "datasource_type": "notion",
+            "credential_id": "cred-1",
+        }
+
+    def test_post_success(self, app):
+        api = DataSourceContentPreviewApi()
+        method = unwrap(api.post)
+
+        payload = self._valid_payload()
+
+        pipeline = MagicMock(spec=Pipeline)
+        node_id = "node-1"
+        account = MagicMock(spec=Account)
+
+        preview_result = {"content": "preview data"}
+
+        service_instance = MagicMock()
+        service_instance.run_datasource_node_preview.return_value = preview_result
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.current_user",
+                account,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.RagPipelineService",
+                return_value=service_instance,
+            ),
+        ):
+            response, status = method(api, pipeline, node_id)
+
+        service_instance.run_datasource_node_preview.assert_called_once_with(
+            pipeline=pipeline,
+            node_id=node_id,
+            user_inputs=payload["inputs"],
+            account=account,
+            datasource_type=payload["datasource_type"],
+            is_published=True,
+            credential_id=payload["credential_id"],
+        )
+        assert status == 200
+        assert response == preview_result
+
+    def test_post_forbidden_non_account_user(self, app):
+        api = DataSourceContentPreviewApi()
+        method = unwrap(api.post)
+
+        payload = self._valid_payload()
+
+        pipeline = MagicMock(spec=Pipeline)
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.current_user",
+                MagicMock(),  # NOT Account
+            ),
+        ):
+            with pytest.raises(Forbidden):
+                method(api, pipeline, "node-1")
+
+    def test_post_invalid_payload(self, app):
+        api = DataSourceContentPreviewApi()
+        method = unwrap(api.post)
+
+        payload = {
+            "inputs": {"query": "hello"},
+            # datasource_type missing
+        }
+
+        pipeline = MagicMock(spec=Pipeline)
+        account = MagicMock(spec=Account)
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.current_user",
+                account,
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, pipeline, "node-1")
+
+    def test_post_without_credential_id(self, app):
+        api = DataSourceContentPreviewApi()
+        method = unwrap(api.post)
+
+        payload = {
+            "inputs": {"query": "hello"},
+            "datasource_type": "notion",
+            "credential_id": None,
+        }
+
+        pipeline = MagicMock(spec=Pipeline)
+        account = MagicMock(spec=Account)
+
+        service_instance = MagicMock()
+        service_instance.run_datasource_node_preview.return_value = {"ok": True}
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.current_user",
+                account,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.datasource_content_preview.RagPipelineService",
+                return_value=service_instance,
+            ),
+        ):
+            response, status = method(api, pipeline, "node-1")
+
+        service_instance.run_datasource_node_preview.assert_called_once()
+        assert status == 200
+        assert response == {"ok": True}
@@ -0,0 +1,187 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from controllers.console import console_ns
+from controllers.console.datasets.rag_pipeline.rag_pipeline import (
+    CustomizedPipelineTemplateApi,
+    PipelineTemplateDetailApi,
+    PipelineTemplateListApi,
+    PublishCustomizedPipelineTemplateApi,
+)
+
+
+def unwrap(func):
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    return func
+
+
+class TestPipelineTemplateListApi:
+    def test_get_success(self, app):
+        api = PipelineTemplateListApi()
+        method = unwrap(api.get)
+
+        templates = [{"id": "t1"}]
+
+        with (
+            app.test_request_context("/?type=built-in&language=en-US"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.RagPipelineService.get_pipeline_templates",
+                return_value=templates,
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 200
+        assert response == templates
+
+
+class TestPipelineTemplateDetailApi:
+    def test_get_success(self, app):
+        api = PipelineTemplateDetailApi()
+        method = unwrap(api.get)
+
+        template = {"id": "tpl-1"}
+
+        service = MagicMock()
+        service.get_pipeline_template_detail.return_value = template
+
+        with (
+            app.test_request_context("/?type=built-in"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.RagPipelineService",
+                return_value=service,
+            ),
+        ):
+            response, status = method(api, "tpl-1")
+
+        assert status == 200
+        assert response == template
+
+
+class TestCustomizedPipelineTemplateApi:
+    def test_patch_success(self, app):
+        api = CustomizedPipelineTemplateApi()
+        method = unwrap(api.patch)
+
+        payload = {
+            "name": "Template",
+            "description": "Desc",
+            "icon_info": {"icon": "📘"},
+        }
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.RagPipelineService.update_customized_pipeline_template"
+            ) as update_mock,
+        ):
+            response = method(api, "tpl-1")
+
+        update_mock.assert_called_once()
+        assert response == 200
+
+    def test_delete_success(self, app):
+        api = CustomizedPipelineTemplateApi()
+        method = unwrap(api.delete)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.RagPipelineService.delete_customized_pipeline_template"
+            ) as delete_mock,
+        ):
+            response = method(api, "tpl-1")
+
+        delete_mock.assert_called_once_with("tpl-1")
+        assert response == 200
+
+    def test_post_success(self, app):
+        api = CustomizedPipelineTemplateApi()
+        method = unwrap(api.post)
+
+        template = MagicMock()
+        template.yaml_content = "yaml-data"
+
+        fake_db = MagicMock()
+        fake_db.engine = MagicMock()
+
+        session = MagicMock()
+        session.query.return_value.where.return_value.first.return_value = template
+
+        session_ctx = MagicMock()
+        session_ctx.__enter__.return_value = session
+        session_ctx.__exit__.return_value = None
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.db",
+                fake_db,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.Session",
+                return_value=session_ctx,
+            ),
+        ):
+            response, status = method(api, "tpl-1")
+
+        assert status == 200
+        assert response == {"data": "yaml-data"}
+
+    def test_post_template_not_found(self, app):
+        api = CustomizedPipelineTemplateApi()
+        method = unwrap(api.post)
+
+        fake_db = MagicMock()
+        fake_db.engine = MagicMock()
+
+        session = MagicMock()
+        session.query.return_value.where.return_value.first.return_value = None
+
+        session_ctx = MagicMock()
+        session_ctx.__enter__.return_value = session
+        session_ctx.__exit__.return_value = None
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.db",
+                fake_db,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.Session",
+                return_value=session_ctx,
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api, "tpl-1")
+
+
+class TestPublishCustomizedPipelineTemplateApi:
+    def test_post_success(self, app):
+        api = PublishCustomizedPipelineTemplateApi()
+        method = unwrap(api.post)
+
+        payload = {
+            "name": "Template",
+            "description": "Desc",
+            "icon_info": {"icon": "📘"},
+        }
+
+        service = MagicMock()
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline.RagPipelineService",
+                return_value=service,
+            ),
+        ):
+            response = method(api, "pipeline-1")
+
+        service.publish_customized_pipeline_template.assert_called_once()
+        assert response == {"result": "success"}
@@ -0,0 +1,187 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+from werkzeug.exceptions import Forbidden
+
+import services
+from controllers.console import console_ns
+from controllers.console.datasets.error import DatasetNameDuplicateError
+from controllers.console.datasets.rag_pipeline.rag_pipeline_datasets import (
+    CreateEmptyRagPipelineDatasetApi,
+    CreateRagPipelineDatasetApi,
+)
+
+
+def unwrap(func):
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    return func
+
+
+class TestCreateRagPipelineDatasetApi:
+    def _valid_payload(self):
+        return {"yaml_content": "name: test"}
+
+    def test_post_success(self, app):
+        api = CreateRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        payload = self._valid_payload()
+        user = MagicMock(is_dataset_editor=True)
+        import_info = {"dataset_id": "ds-1"}
+
+        mock_service = MagicMock()
+        mock_service.create_rag_pipeline_dataset.return_value = import_info
+
+        mock_session_ctx = MagicMock()
+        mock_session_ctx.__enter__.return_value = MagicMock()
+        mock_session_ctx.__exit__.return_value = None
+
+        fake_db = MagicMock()
+        fake_db.engine = MagicMock()
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.db",
+                fake_db,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.Session",
+                return_value=mock_session_ctx,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.RagPipelineDslService",
+                return_value=mock_service,
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 201
+        assert response == import_info
+
+    def test_post_forbidden_non_editor(self, app):
+        api = CreateRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        payload = self._valid_payload()
+        user = MagicMock(is_dataset_editor=False)
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+        ):
+            with pytest.raises(Forbidden):
+                method(api)
+
+    def test_post_dataset_name_duplicate(self, app):
+        api = CreateRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        payload = self._valid_payload()
+        user = MagicMock(is_dataset_editor=True)
+
+        mock_service = MagicMock()
+        mock_service.create_rag_pipeline_dataset.side_effect = services.errors.dataset.DatasetNameDuplicateError()
+
+        mock_session_ctx = MagicMock()
+        mock_session_ctx.__enter__.return_value = MagicMock()
+        mock_session_ctx.__exit__.return_value = None
+
+        fake_db = MagicMock()
+        fake_db.engine = MagicMock()
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.db",
+                fake_db,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.Session",
+                return_value=mock_session_ctx,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.RagPipelineDslService",
+                return_value=mock_service,
+            ),
+        ):
+            with pytest.raises(DatasetNameDuplicateError):
+                method(api)
+
+    def test_post_invalid_payload(self, app):
+        api = CreateRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        payload = {}
+        user = MagicMock(is_dataset_editor=True)
+
+        with (
+            app.test_request_context("/", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+        ):
+            with pytest.raises(ValueError):
+                method(api)
+
+
+class TestCreateEmptyRagPipelineDatasetApi:
+    def test_post_success(self, app):
+        api = CreateEmptyRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        user = MagicMock(is_dataset_editor=True)
+        dataset = MagicMock()
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.DatasetService.create_empty_rag_pipeline_dataset",
+                return_value=dataset,
+            ),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.marshal",
+                return_value={"id": "ds-1"},
+            ),
+        ):
+            response, status = method(api)
+
+        assert status == 201
+        assert response == {"id": "ds-1"}
+
+    def test_post_forbidden_non_editor(self, app):
+        api = CreateEmptyRagPipelineDatasetApi()
+        method = unwrap(api.post)
+
+        user = MagicMock(is_dataset_editor=False)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.rag_pipeline.rag_pipeline_datasets.current_account_with_tenant",
+                return_value=(user, "tenant-1"),
+            ),
+        ):
+            with pytest.raises(Forbidden):
+                method(api)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
autofix-ci[bot]andGitHub	a98c467a33	[autofix.ci] apply automated fixes	2026-03-10 10:14:46 +00:00
Yanli 盐粒	cb094558e3	Merge remote-tracking branch 'origin/main' into yanli/docx-image-render # Conflicts: # api/tests/unit_tests/core/rag/extractor/test_word_extractor.py	2026-03-10 18:10:16 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	125ece1d0c	chore(deps-dev): bump the storybook group in /web with 7 updates (#33198 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-10 18:17:11 +09:00
elliotllliu GitHub GitHub User	fd71e85ed4	ci: add anti-slop GitHub Action to detect low-quality AI PRs (#33193 ) Co-authored-by: GitHub User <user@example.com>	2026-03-10 18:16:01 +09:00
Wu Tianwei GitHub Stephen Zhou Stephen Zhou yyh	75bbb616ea	refactor: replace react markdown with streamdown (#32971 ) Co-authored-by: Stephen Zhou <hi@hyoban.cc> Co-authored-by: Stephen Zhou <38493346+hyoban@users.noreply.github.com> Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com>	2026-03-10 17:02:37 +08:00
hizhujianfengandGitHub	2a468da440	fix: copy to clipboard failed in non-secure (HTTP) contexts (#32287 )	2026-03-10 15:46:17 +08:00
sasha GitHub aadereiko Boris Feld Claude Opus 4.6autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>Crazywoola	322d3cd555	fix: nested spans and traces; (#33049 ) Co-authored-by: aadereiko <aliaksandr@comet.com> Co-authored-by: Boris Feld <boris@comet.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Crazywoola <100913391+crazywoola@users.noreply.github.com>	2026-03-10 15:45:44 +08:00
Jeff.li GitHub Jeffgemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	e1df0fad2b	fix: ensure external knowledge API key updates are persisted (#33188 ) Co-authored-by: Jeff <jeff@WKS0003265039.eu.boehringer.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-03-10 15:45:20 +08:00
GuanMu GitHub Crazywoola	3f515dcdda	refactor: use `generate_valid_password` helper for creating test account passwords (#33192 ) Co-authored-by: Crazywoola <100913391+crazywoola@users.noreply.github.com>	2026-03-10 15:42:52 +08:00
wangxiaoleiandGitHub	db627e75f6	fix: fix request.metadata_model_config param check (#33189 )	2026-03-10 15:09:35 +08:00
Yunlu Wen GitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	1ecedab024	feat: enterprise plugin pre uninstall (#33158 ) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-10 15:03:37 +08:00
rajatagarwal-ossandGitHub	a0ed350871	test: unit test for core.rag module (#32630 )	2026-03-10 14:10:24 +08:00
Tyson Cung GitHub yyh yyh	a5832df586	fix: prevent hydration warning from div nesting inside p for inline markdown images (#32419 ) Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com> Co-authored-by: yyh <yuanyouhuilyz@gmail.com>	2026-03-10 14:07:55 +08:00
mahammadasimandGitHub	a808389122	test: add new unit tests for message service utilities, get message, feedback, and retention services. (#33169 )	2026-03-10 13:55:18 +08:00
yyhandGitHub	45a8967b8b	chore(ui): raise overlay primitives z-index for legacy coexistence (#33185 )	2026-03-10 13:46:38 +08:00
Bruno Gondell GitHub bgondell Claude Opus 4.6autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>crazywoola Crazywoola	3835cfe87e	fix: use correct plugin_id for WaterCrawl datasource (#33182 ) Co-authored-by: bgondell <bruno.gondell@gmail.com0> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: crazywoola <427733928@qq.com> Co-authored-by: Crazywoola <100913391+crazywoola@users.noreply.github.com>	2026-03-10 13:32:40 +08:00
Desel72andGitHub	eaf86c521f	feat: Improve SQL Comment Context for Celery Worker Queries (#33058 )	2026-03-10 12:37:26 +08:00
不做了睡大觉 GitHub User	08b3bce53c	fix: copy button stays disabled after Human Input node pause/resume (#32662 ) Co-authored-by: User <user@example.com>	2026-03-10 12:12:30 +08:00
agent-stevenandGitHub	2a3cc2951b	feat: configurable Enter/Shift+Enter send behavior in embedded chat (#32295 ) (#32300 )	2026-03-10 11:44:11 +08:00
Vincent KocandGitHub	504138bb23	docs: Update Opik intergration docs (#32336 )	2026-03-10 11:31:33 +08:00
GuanMuandGitHub	0ab4e16335	feat: add batch download for dataset documents as ZIP and signed URL for single document download. (#33100 )	2026-03-10 11:28:37 +08:00
rajatagarwal-ossandGitHub	01991f3536	test: unit test cases for console.explore and tag module (#32186 )	2026-03-10 11:25:00 +08:00
Dev SharmaandGitHub	4f835107b2	test: add UTs for api core.trigger (#32587 )	2026-03-10 10:18:32 +08:00
KVOJJJinandGitHub	3f3b788356	fix(web): correct responding state after annotation reply completed (#33173 )	2026-03-10 10:08:07 +08:00
wangxiaolei GitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	b9d05d3456	refactor: tool node decouple db (#33166 ) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-10 01:47:15 +08:00
rajatagarwal-ossandGitHub	a480e9beb1	test: unit test case for controllers.console.app module (#32247 )	2026-03-10 00:54:47 +08:00
Stephen ZhouandGitHub	a59c54b3e7	ci: update actions version, reuse workflow by composite action (#33177 )	2026-03-09 23:44:17 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Stephen Zhouautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	7737bdc699	chore(deps): bump the npm-dependencies group across 1 directory with 55 updates (#33170 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Stephen Zhou <38493346+hyoban@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-09 23:24:48 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Stephen Zhouautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	65637fc6b7	chore(deps): bump the npm-dependencies group across 1 directory with 55 updates (#33170 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Stephen Zhou <38493346+hyoban@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-09 23:24:36 +08:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Stephen Zhou	be6f7b8712	chore(deps-dev): bump the eslint-group group in /web with 5 updates (#33168 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Stephen Zhou <38493346+hyoban@users.noreply.github.com>	2026-03-09 19:59:44 +08:00
dependabot[bot]andGitHub	b257e8ed44	chore(deps-dev): bump the storybook group in /web with 7 updates (#33163 )	2026-03-09 19:36:00 +08:00
Stephen ZhouandGitHub	176d3c8c3a	ci: ignore ky and tailwind-merge in update (#33167 )	2026-03-09 19:21:18 +08:00
Stephen ZhouandGitHub	c72ac8a434	ci: ignore some major update (#33161 )	2026-03-09 17:24:56 +08:00
rajatagarwal-ossandGitHub	497feac48e	test: unit test case for controllers.console.workspace module (#32181 )	2026-03-09 17:07:40 +08:00
rajatagarwal-oss GitHub akashseth-ifp	8906ab8e52	test: unit test cases for console.datasets module (#32179 ) Co-authored-by: akashseth-ifp <akash.seth@infocusp.com>	2026-03-09 17:07:13 +08:00
非法操作 GitHub Stephen Zhou	03dcbeafdf	fix: stop responding icon not display (#33154 ) Co-authored-by: Stephen Zhou <38493346+hyoban@users.noreply.github.com>	2026-03-09 16:27:45 +08:00
wangxiaolei GitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	bbfa28e8a7	refactor: file saver decouple db engine and ssrf proxy (#33076 ) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-09 16:09:44 +08:00
Dev Sharma GitHub Rajat Agarwal	6c19e75969	test: improve unit tests for controllers.web (#32150 ) Co-authored-by: Rajat Agarwal <rajat.agarwal@infocusp.com>	2026-03-09 15:58:34 +08:00
wangxiaolei GitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	9970f4449a	refactor: reuse redis connection instead of create new one (#32678 ) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>	2026-03-09 15:53:21 +08:00
Sense_wang GitHub Contributor	cbb19cce39	docs: use docker compose command consistently in README (#33077 ) Co-authored-by: Contributor <contributor@example.com>	2026-03-09 15:02:30 +08:00
Yanli 盐粒	60c858aa48	style: normalize import ordering in dataset model	2026-03-01 17:40:28 +08:00
Yanli 盐粒	46a3a2ae09	fix: sort signed URL replacements by position	2026-03-01 17:38:45 +08:00
Yanli 盐粒	30af50cb47	test: avoid MagicMock dependency in segment signing tests	2026-03-01 17:23:18 +08:00
Yanli 盐粒	0d6a4bac0f	fix: harden segment file URL signing	2026-03-01 17:12:07 +08:00
autofix-ci[bot]andGitHub	c693cb9789	[autofix.ci] apply automated fixes	2026-02-20 18:41:55 +00:00
Yanli 盐粒	fc91a7a38b	Fix docx segment image URLs	2026-02-09 20:14:52 +08:00