feat: enhance E2E testing setup with Cloudflare Access support and improved authentication handling

- Added support for Cloudflare Access headers in Playwright configuration and teardown.
- Updated global setup for E2E tests to validate authentication credentials and handle login more robustly.
- Enhanced README with authentication configuration details and supported methods.
- Updated Playwright reporter configuration to include JSON output for test results.

.claude/skills/frontend-testing/CHECKLIST.md

@@ -76,7 +76,7 @@ Use this checklist when generating or reviewing tests for Dify frontend componen
 - [ ] **DO NOT mock base components** (`@/app/components/base/*`)
 - [ ] `jest.clearAllMocks()` in `beforeEach` (not `afterEach`)
 - [ ] Shared mock state reset in `beforeEach`
-- [ ] i18n uses shared mock (auto-loaded); only override locally for custom translations
+- [ ] i18n mock returns keys (not empty strings)
 - [ ] Router mocks match actual Next.js API
 - [ ] Mocks reflect actual component conditional behavior
 - [ ] Only mock: API services, complex context providers, third-party libs

.claude/skills/frontend-testing/SKILL.md

@@ -318,4 +318,3 @@ For more detailed information, refer to:
 - `web/jest.config.ts` - Jest configuration
 - `web/jest.setup.ts` - Test environment setup
 - `web/testing/analyze-component.js` - Component analysis tool
-- `web/__mocks__/react-i18next.ts` - Shared i18n mock (auto-loaded by Jest, no explicit mock needed; override locally only for custom translations)

.claude/skills/frontend-testing/guides/mocking.md

@@ -46,22 +46,12 @@ Only mock these categories:
 
 ## Essential Mocks
 
-### 1. i18n (Auto-loaded via Shared Mock)
-
-A shared mock is available at `web/__mocks__/react-i18next.ts` and is auto-loaded by Jest.
-**No explicit mock needed** for most tests - it returns translation keys as-is.
-
-For tests requiring custom translations, override the mock:
+### 1. i18n (Always Required)
 
 ```typescript
 jest.mock('react-i18next', () => ({
   useTranslation: () => ({
-    t: (key: string) => {
-      const translations: Record<string, string> = {
-        'my.custom.key': 'Custom translation',
-      }
-      return translations[key] || key
-    },
+    t: (key: string) => key,
   }),
 }))
 ```
@@ -323,7 +313,7 @@ Need to use a component in test?
 │  └─ YES → Mock it (next/navigation, external SDKs)
 │
 └─ Is it i18n?
-   └─ YES → Uses shared mock (auto-loaded). Override only for custom translations
+   └─ YES → Mock to return keys
 ```
 
 ## Factory Function Pattern

.claude/skills/frontend-testing/templates/component-test.template.tsx

@@ -26,20 +26,13 @@ import userEvent from '@testing-library/user-event'
 // WHY: Mocks must be hoisted to top of file (Jest requirement).
 // They run BEFORE imports, so keep them before component imports.
 
-// i18n (automatically mocked)
-// WHY: Shared mock at web/__mocks__/react-i18next.ts is auto-loaded by Jest
-// No explicit mock needed - it returns translation keys as-is
-// Override only if custom translations are required:
-// jest.mock('react-i18next', () => ({
-//   useTranslation: () => ({
-//     t: (key: string) => {
-//       const customTranslations: Record<string, string> = {
-//         'my.custom.key': 'Custom Translation',
-//       }
-//       return customTranslations[key] || key
-//     },
-//   }),
-// }))
+// i18n (always required in Dify)
+// WHY: Returns key instead of translation so tests don't depend on i18n files
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
 
 // Router (if component uses useRouter, usePathname, useSearchParams)
 // WHY: Isolates tests from Next.js routing, enables testing navigation behavior

.github/workflows/api-tests.yml

@@ -93,12 +93,4 @@ jobs:
           # Create a detailed coverage summary
           echo "### Test Coverage Summary :test_tube:" >> $GITHUB_STEP_SUMMARY
           echo "Total Coverage: ${TOTAL_COVERAGE}%" >> $GITHUB_STEP_SUMMARY
-          {
-            echo ""
-            echo "<details><summary>File-level coverage (click to expand)</summary>"
-            echo ""
-            echo '```'
-            uv run --project api coverage report -m
-            echo '```'
-            echo "</details>"
-          } >> $GITHUB_STEP_SUMMARY
+          uv run --project api coverage report --format=markdown >> $GITHUB_STEP_SUMMARY

api/.env.example

@@ -626,7 +626,17 @@ QUEUE_MONITOR_ALERT_EMAILS=
 QUEUE_MONITOR_INTERVAL=30
 
 # Swagger UI configuration
-SWAGGER_UI_ENABLED=true
+# SECURITY: Swagger UI is automatically disabled in PRODUCTION environment (DEPLOY_ENV=PRODUCTION)
+# to prevent API information disclosure.
+#
+# Behavior:
+# - DEPLOY_ENV=PRODUCTION + SWAGGER_UI_ENABLED not set -> Swagger DISABLED (secure default)
+# - DEPLOY_ENV=DEVELOPMENT/TESTING + SWAGGER_UI_ENABLED not set -> Swagger ENABLED
+# - SWAGGER_UI_ENABLED=true -> Swagger ENABLED (overrides environment check)
+# - SWAGGER_UI_ENABLED=false -> Swagger DISABLED (explicit disable)
+#
+# For development, you can uncomment below or set DEPLOY_ENV=DEVELOPMENT
+# SWAGGER_UI_ENABLED=false
 SWAGGER_UI_PATH=/swagger-ui.html
 
 # Whether to encrypt dataset IDs when exporting DSL files (default: true)
@@ -670,4 +680,4 @@ ANNOTATION_IMPORT_MIN_RECORDS=1
 ANNOTATION_IMPORT_RATE_LIMIT_PER_MINUTE=5
 ANNOTATION_IMPORT_RATE_LIMIT_PER_HOUR=20
 # Maximum number of concurrent annotation import tasks per tenant
-ANNOTATION_IMPORT_MAX_CONCURRENT=5
+ANNOTATION_IMPORT_MAX_CONCURRENT=5

api/configs/feature/__init__.py

@@ -1252,9 +1252,19 @@ class WorkflowLogConfig(BaseSettings):
 
 
 class SwaggerUIConfig(BaseSettings):
-    SWAGGER_UI_ENABLED: bool = Field(
-        description="Whether to enable Swagger UI in api module",
-        default=True,
+    """
+    Configuration for Swagger UI documentation.
+
+    Security Note: Swagger UI is automatically disabled in PRODUCTION environment
+    to prevent API information disclosure. Set SWAGGER_UI_ENABLED=true explicitly
+    to enable in production if needed.
+    """
+
+    SWAGGER_UI_ENABLED: bool | None = Field(
+        description="Whether to enable Swagger UI in api module. "
+        "Automatically disabled in PRODUCTION environment for security. "
+        "Set to true explicitly to enable in production.",
+        default=None,
     )
 
     SWAGGER_UI_PATH: str = Field(
@@ -1262,6 +1272,23 @@ class SwaggerUIConfig(BaseSettings):
         default="/swagger-ui.html",
     )
 
+    @property
+    def swagger_ui_enabled(self) -> bool:
+        """
+        Compute whether Swagger UI should be enabled.
+
+        If SWAGGER_UI_ENABLED is explicitly set, use that value.
+        Otherwise, disable in PRODUCTION environment for security.
+        """
+        if self.SWAGGER_UI_ENABLED is not None:
+            return self.SWAGGER_UI_ENABLED
+
+        # Auto-disable in production environment
+        import os
+
+        deploy_env = os.environ.get("DEPLOY_ENV", "PRODUCTION")
+        return deploy_env.upper() != "PRODUCTION"
+
 
 class TenantIsolatedTaskQueueConfig(BaseSettings):
     TENANT_ISOLATED_TASK_CONCURRENCY: int = Field(

api/configs/middleware/__init__.py

@@ -107,7 +107,7 @@ class KeywordStoreConfig(BaseSettings):
 
 class DatabaseConfig(BaseSettings):
     # Database type selector
-    DB_TYPE: Literal["postgresql", "mysql", "oceanbase", "seekdb"] = Field(
+    DB_TYPE: Literal["postgresql", "mysql", "oceanbase"] = Field(
         description="Database type to use. OceanBase is MySQL-compatible.",
         default="postgresql",
     )

api/controllers/console/__init__.py

@@ -54,7 +54,6 @@ from .app import (
     completion,
     conversation,
     conversation_variables,
-    enduser_auth,
     generator,
     mcp_server,
     message,
@@ -163,7 +162,6 @@ __all__ = [
     "datasource_content_preview",
     "email_register",
     "endpoint",
-    "enduser_auth",
     "extension",
     "external",
     "feature",

api/controllers/console/app/enduser_auth.py

@@ -1,230 +0,0 @@
-"""
-End-user authentication API controllers.
-
-Provides API endpoints for managing end-user credentials for tool authentication.
-"""
-
-from flask import request
-from flask_restx import Resource
-from werkzeug.exceptions import BadRequest
-
-from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
-from core.model_runtime.utils.encoders import jsonable_encoder
-from libs.login import current_account_with_tenant, login_required
-from models import AppMode
-from services.tools.app_auth_requirement_service import AppAuthRequirementService
-from services.tools.enduser_auth_service import EndUserAuthService
-from services.tools.enduser_oauth_service import EndUserOAuthService
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/providers")
-class AppAuthProvidersApi(Resource):
-    """
-    Get list of authentication providers required for an app.
-
-    Returns providers that require end-user authentication based on app configuration.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def get(self, app_model):
-        """Get authentication providers required for the app."""
-        _, tenant_id = current_account_with_tenant()
-
-        providers = AppAuthRequirementService.get_required_providers(
-            tenant_id=tenant_id,
-            app_id=str(app_model.id),
-        )
-
-        return jsonable_encoder(providers)
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/providers/<path:provider_id>/credentials")
-class AppAuthProviderCredentialsApi(Resource):
-    """
-    Manage end-user credentials for a specific provider.
-
-    Allows listing, creating, and deleting end-user credentials.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def get(self, app_model, provider_id: str):
-        """List end-user's credentials for this provider."""
-        user, tenant_id = current_account_with_tenant()
-
-        # For console API, use the current account user as end_user_id
-        # In production, this would be the actual end-user ID from the chat/completion request
-        end_user_id = str(user.id)
-
-        credentials = EndUserAuthService.list_credentials(
-            tenant_id=tenant_id,
-            end_user_id=end_user_id,
-            provider_id=provider_id,
-        )
-
-        return jsonable_encoder(credentials)
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def post(self, app_model, provider_id: str):
-        """Create a new credential (API key only)."""
-        user, tenant_id = current_account_with_tenant()
-        end_user_id = str(user.id)
-
-        payload = request.get_json()
-        if not payload:
-            raise BadRequest("Request body is required")
-
-        credential_type = payload.get("credential_type")
-        credentials = payload.get("credentials")
-
-        if not credential_type or not credentials:
-            raise BadRequest("credential_type and credentials are required")
-
-        if credential_type != "api-key":
-            raise BadRequest(
-                "Only 'api-key' credential type can be created via this endpoint. "
-                "Use OAuth flow for OAuth credentials."
-            )
-
-        credential = EndUserAuthService.create_api_key_credential(
-            tenant_id=tenant_id,
-            end_user_id=end_user_id,
-            provider_id=provider_id,
-            credentials=credentials,
-        )
-
-        return jsonable_encoder(credential)
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/providers/<path:provider_id>/credentials/<string:credential_id>")
-class AppAuthProviderCredentialApi(Resource):
-    """
-    Manage a specific end-user credential.
-
-    Allows getting, updating, or deleting a credential.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def delete(self, app_model, provider_id: str, credential_id: str):
-        """Delete a credential."""
-        user, tenant_id = current_account_with_tenant()
-        end_user_id = str(user.id)
-
-        EndUserAuthService.delete_credential(
-            tenant_id=tenant_id,
-            end_user_id=end_user_id,
-            provider_id=provider_id,
-            credential_id=credential_id,
-        )
-
-        return {"result": "success"}
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/oauth/<path:provider_id>/authorization-url")
-class AppAuthOAuthAuthorizationUrlApi(Resource):
-    """
-    Get OAuth authorization URL for end-user authentication.
-
-    Returns the URL where the user should be redirected to authenticate with the provider.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def get(self, app_model, provider_id: str):
-        """Get OAuth authorization URL."""
-        user, tenant_id = current_account_with_tenant()
-        end_user_id = str(user.id)
-
-        result = EndUserOAuthService.get_authorization_url(
-            end_user_id=end_user_id,
-            tenant_id=tenant_id,
-            app_id=str(app_model.id),
-            provider=provider_id,
-        )
-
-        # Set OAuth context cookie for callback
-        response = jsonable_encoder({
-            "authorization_url": result["authorization_url"],
-        })
-
-        # Store context_id in response for frontend to set as cookie
-        response["context_id"] = result["context_id"]
-
-        return response
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/oauth/<path:provider_id>/callback")
-class AppAuthOAuthCallbackApi(Resource):
-    """
-    Handle OAuth callback for end-user authentication.
-
-    This endpoint is called by the OAuth provider after user authorization.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def get(self, app_model, provider_id: str):
-        """Handle OAuth callback and store credentials."""
-        # Get OAuth context ID from cookie
-        context_id = request.cookies.get("oauth_context_id")
-
-        if not context_id:
-            raise BadRequest("Missing OAuth context")
-
-        # Get OAuth error if any
-        error = request.args.get("error")
-        error_description = request.args.get("error_description")
-
-        if error:
-            raise BadRequest(f"OAuth error: {error} - {error_description}")
-
-        # Handle callback and create credential
-        result = EndUserOAuthService.handle_oauth_callback(
-            context_id=context_id,
-            request=request,
-        )
-
-        return jsonable_encoder(result)
-
-
-@console_ns.route("/apps/<uuid:app_id>/auth/providers/<path:provider_id>/credentials/<string:credential_id>/refresh")
-class AppAuthProviderRefreshApi(Resource):
-    """
-    Manually refresh OAuth token for a credential.
-
-    This endpoint allows refreshing an expired OAuth token.
-    """
-
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.COMPLETION, AppMode.WORKFLOW])
-    def post(self, app_model, provider_id: str, credential_id: str):
-        """Refresh OAuth token."""
-        user, tenant_id = current_account_with_tenant()
-        end_user_id = str(user.id)
-
-        result = EndUserOAuthService.refresh_oauth_token(
-            credential_id=credential_id,
-            end_user_id=end_user_id,
-            tenant_id=tenant_id,
-        )
-
-        return jsonable_encoder(result)

api/controllers/console/auth/login.py

@@ -22,12 +22,7 @@ from controllers.console.error import (
     NotAllowedCreateWorkspace,
     WorkspacesLimitExceeded,
 )
-from controllers.console.wraps import (
-    decrypt_code_field,
-    decrypt_password_field,
-    email_password_login_enabled,
-    setup_required,
-)
+from controllers.console.wraps import email_password_login_enabled, setup_required
 from events.tenant_event import tenant_was_created
 from libs.helper import EmailStr, extract_remote_ip
 from libs.login import current_account_with_tenant
@@ -84,7 +79,6 @@ class LoginApi(Resource):
     @setup_required
     @email_password_login_enabled
     @console_ns.expect(console_ns.models[LoginPayload.__name__])
-    @decrypt_password_field
     def post(self):
         """Authenticate user and login."""
         args = LoginPayload.model_validate(console_ns.payload)
@@ -224,7 +218,6 @@ class EmailCodeLoginSendEmailApi(Resource):
 class EmailCodeLoginApi(Resource):
     @setup_required
     @console_ns.expect(console_ns.models[EmailCodeLoginPayload.__name__])
-    @decrypt_code_field
     def post(self):
         args = EmailCodeLoginPayload.model_validate(console_ns.payload)
 

api/controllers/console/datasets/data_source.py

@@ -140,18 +140,6 @@ class DataSourceNotionListApi(Resource):
         credential_id = request.args.get("credential_id", default=None, type=str)
         if not credential_id:
             raise ValueError("Credential id is required.")
-
-        # Get datasource_parameters from query string (optional, for GitHub and other datasources)
-        datasource_parameters_str = request.args.get("datasource_parameters", default=None, type=str)
-        datasource_parameters = {}
-        if datasource_parameters_str:
-            try:
-                datasource_parameters = json.loads(datasource_parameters_str)
-                if not isinstance(datasource_parameters, dict):
-                    raise ValueError("datasource_parameters must be a JSON object.")
-            except json.JSONDecodeError:
-                raise ValueError("Invalid datasource_parameters JSON format.")
-
         datasource_provider_service = DatasourceProviderService()
         credential = datasource_provider_service.get_datasource_credentials(
             tenant_id=current_tenant_id,
@@ -199,7 +187,7 @@ class DataSourceNotionListApi(Resource):
             online_document_result: Generator[OnlineDocumentPagesMessage, None, None] = (
                 datasource_runtime.get_online_document_pages(
                     user_id=current_user.id,
-                    datasource_parameters=datasource_parameters,
+                    datasource_parameters={},
                     provider_type=datasource_runtime.datasource_provider_type(),
                 )
             )
@@ -230,14 +218,14 @@ class DataSourceNotionListApi(Resource):
 
 
 @console_ns.route(
-    "/notion/pages/<uuid:page_id>/<string:page_type>/preview",
+    "/notion/workspaces/<uuid:workspace_id>/pages/<uuid:page_id>/<string:page_type>/preview",
     "/datasets/notion-indexing-estimate",
 )
 class DataSourceNotionApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    def get(self, page_id, page_type):
+    def get(self, workspace_id, page_id, page_type):
         _, current_tenant_id = current_account_with_tenant()
 
         credential_id = request.args.get("credential_id", default=None, type=str)
@@ -251,10 +239,11 @@ class DataSourceNotionApi(Resource):
             plugin_id="langgenius/notion_datasource",
         )
 
+        workspace_id = str(workspace_id)
         page_id = str(page_id)
 
         extractor = NotionExtractor(
-            notion_workspace_id="",
+            notion_workspace_id=workspace_id,
             notion_obj_id=page_id,
             notion_page_type=page_type,
             notion_access_token=credential.get("integration_secret"),

api/controllers/console/datasets/datasets.py

@@ -223,7 +223,6 @@ def _get_retrieval_methods_by_vector_type(vector_type: str | None, is_mock: bool
         VectorType.COUCHBASE,
         VectorType.OPENGAUSS,
         VectorType.OCEANBASE,
-        VectorType.SEEKDB,
         VectorType.TABLESTORE,
         VectorType.HUAWEI_CLOUD,
         VectorType.TENCENT,

api/controllers/console/datasets/rag_pipeline/rag_pipeline_workflow.py

@@ -4,7 +4,7 @@ from typing import Any, Literal, cast
 from uuid import UUID
 
 from flask import abort, request
-from flask_restx import Resource, marshal_with, reqparse  # type: ignore
+from flask_restx import Resource, marshal_with  # type: ignore
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 from werkzeug.exceptions import Forbidden, InternalServerError, NotFound
@@ -975,11 +975,6 @@ class RagPipelineRecommendedPluginApi(Resource):
     @login_required
     @account_initialization_required
     def get(self):
-        parser = reqparse.RequestParser()
-        parser.add_argument("type", type=str, location="args", required=False, default="all")
-        args = parser.parse_args()
-        type = args["type"]
-
         rag_pipeline_service = RagPipelineService()
-        recommended_plugins = rag_pipeline_service.get_recommended_plugins(type)
+        recommended_plugins = rag_pipeline_service.get_recommended_plugins()
         return recommended_plugins

api/controllers/console/wraps.py

@@ -9,12 +9,10 @@ from typing import ParamSpec, TypeVar
 from flask import abort, request
 
 from configs import dify_config
-from controllers.console.auth.error import AuthenticationFailedError, EmailCodeError
 from controllers.console.workspace.error import AccountNotInitializedError
 from enums.cloud_plan import CloudPlan
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
-from libs.encryption import FieldEncryption
 from libs.login import current_account_with_tenant
 from models.account import AccountStatus
 from models.dataset import RateLimitLog
@@ -27,14 +25,6 @@ from .error import NotInitValidateError, NotSetupError, UnauthorizedAndForceLogo
 P = ParamSpec("P")
 R = TypeVar("R")
 
-# Field names for decryption
-FIELD_NAME_PASSWORD = "password"
-FIELD_NAME_CODE = "code"
-
-# Error messages for decryption failures
-ERROR_MSG_INVALID_ENCRYPTED_DATA = "Invalid encrypted data"
-ERROR_MSG_INVALID_ENCRYPTED_CODE = "Invalid encrypted code"
-
 
 def account_initialization_required(view: Callable[P, R]):
     @wraps(view)
@@ -429,75 +419,3 @@ def annotation_import_concurrency_limit(view: Callable[P, R]):
         return view(*args, **kwargs)
 
     return decorated
-
-
-def _decrypt_field(field_name: str, error_class: type[Exception], error_message: str) -> None:
-    """
-    Helper to decode a Base64 encoded field in the request payload.
-
-    Args:
-        field_name: Name of the field to decode
-        error_class: Exception class to raise on decoding failure
-        error_message: Error message to include in the exception
-    """
-    if not request or not request.is_json:
-        return
-    # Get the payload dict - it's cached and mutable
-    payload = request.get_json()
-    if not payload or field_name not in payload:
-        return
-    encoded_value = payload[field_name]
-    decoded_value = FieldEncryption.decrypt_field(encoded_value)
-
-    # If decoding failed, raise error immediately
-    if decoded_value is None:
-        raise error_class(error_message)
-
-    # Update payload dict in-place with decoded value
-    # Since payload is a mutable dict and get_json() returns the cached reference,
-    # modifying it will affect all subsequent accesses including console_ns.payload
-    payload[field_name] = decoded_value
-
-
-def decrypt_password_field(view: Callable[P, R]):
-    """
-    Decorator to decrypt password field in request payload.
-
-    Automatically decrypts the 'password' field if encryption is enabled.
-    If decryption fails, raises AuthenticationFailedError.
-
-    Usage:
-        @decrypt_password_field
-        def post(self):
-            args = LoginPayload.model_validate(console_ns.payload)
-            # args.password is now decrypted
-    """
-
-    @wraps(view)
-    def decorated(*args: P.args, **kwargs: P.kwargs):
-        _decrypt_field(FIELD_NAME_PASSWORD, AuthenticationFailedError, ERROR_MSG_INVALID_ENCRYPTED_DATA)
-        return view(*args, **kwargs)
-
-    return decorated
-
-
-def decrypt_code_field(view: Callable[P, R]):
-    """
-    Decorator to decrypt verification code field in request payload.
-
-    Automatically decrypts the 'code' field if encryption is enabled.
-    If decryption fails, raises EmailCodeError.
-
-    Usage:
-        @decrypt_code_field
-        def post(self):
-            args = EmailCodeLoginPayload.model_validate(console_ns.payload)
-            # args.code is now decrypted
-    """
-
-    @wraps(view)
-    def decorated(*args: P.args, **kwargs: P.kwargs):
-        _decrypt_field(FIELD_NAME_CODE, EmailCodeError, ERROR_MSG_INVALID_ENCRYPTED_CODE)
-        return view(*args, **kwargs)
-
-    return decorated

api/core/agent/entities.py

@@ -3,7 +3,7 @@ from typing import Any, Union
 
 from pydantic import BaseModel, Field
 
-from core.tools.entities.tool_entities import ToolAuthType, ToolInvokeMessage, ToolProviderType
+from core.tools.entities.tool_entities import ToolInvokeMessage, ToolProviderType
 
 
 class AgentToolEntity(BaseModel):
@@ -17,7 +17,6 @@ class AgentToolEntity(BaseModel):
     tool_parameters: dict[str, Any] = Field(default_factory=dict)
     plugin_unique_identifier: str | None = None
     credential_id: str | None = None
-    auth_type: ToolAuthType = ToolAuthType.WORKSPACE
 
 
 class AgentPromptEntity(BaseModel):

api/core/rag/datasource/vdb/vector_factory.py

@@ -163,7 +163,7 @@ class Vector:
                 from core.rag.datasource.vdb.lindorm.lindorm_vector import LindormVectorStoreFactory
 
                 return LindormVectorStoreFactory
-            case VectorType.OCEANBASE | VectorType.SEEKDB:
+            case VectorType.OCEANBASE:
                 from core.rag.datasource.vdb.oceanbase.oceanbase_vector import OceanBaseVectorFactory
 
                 return OceanBaseVectorFactory

api/core/rag/datasource/vdb/vector_type.py

@@ -27,7 +27,6 @@ class VectorType(StrEnum):
     UPSTASH = "upstash"
     TIDB_ON_QDRANT = "tidb_on_qdrant"
     OCEANBASE = "oceanbase"
-    SEEKDB = "seekdb"
     OPENGAUSS = "opengauss"
     TABLESTORE = "tablestore"
     HUAWEI_CLOUD = "huawei_cloud"

api/core/rag/extractor/entity/extract_setting.py

@@ -10,7 +10,7 @@ class NotionInfo(BaseModel):
     """
 
     credential_id: str | None = None
-    notion_workspace_id: str | None = ""
+    notion_workspace_id: str
     notion_obj_id: str
     notion_page_type: str
     document: Document | None = None

api/core/rag/extractor/extract_processor.py

@@ -166,7 +166,7 @@ class ExtractProcessor:
         elif extract_setting.datasource_type == DatasourceType.NOTION:
             assert extract_setting.notion_info is not None, "notion_info is required"
             extractor = NotionExtractor(
-                notion_workspace_id=extract_setting.notion_info.notion_workspace_id or "",
+                notion_workspace_id=extract_setting.notion_info.notion_workspace_id,
                 notion_obj_id=extract_setting.notion_info.notion_obj_id,
                 notion_page_type=extract_setting.notion_info.notion_page_type,
                 document_model=extract_setting.notion_info.document,

api/core/tools/entities/api_entities.py

@@ -124,7 +124,6 @@ class ToolProviderCredentialApiEntity(BaseModel):
         default=False, description="Whether the credential is the default credential for the provider in the workspace"
     )
     credentials: Mapping[str, object] = Field(description="The credentials of the provider", default_factory=dict)
-    expires_at: int = Field(default=-1, description="Unix timestamp when credential expires (-1 for no expiry)")
 
 
 class ToolProviderCredentialInfoApiEntity(BaseModel):

api/core/tools/entities/tool_entities.py

@@ -123,16 +123,6 @@ class ApiProviderAuthType(StrEnum):
         raise ValueError(f"invalid mode value '{value}', expected one of: {valid}")
 
 
-class ToolAuthType(StrEnum):
-    """
-    Enum class for tool authentication type.
-    Determines whether OAuth credentials are workspace-level or end-user-level.
-    """
-
-    WORKSPACE = "workspace"
-    END_USER = "end_user"
-
-
 class ToolInvokeMessage(BaseModel):
     class TextMessage(BaseModel):
         text: str

api/core/tools/tool_manager.py

@@ -49,7 +49,6 @@ from core.tools.entities.api_entities import ToolProviderApiEntity, ToolProvider
 from core.tools.entities.common_entities import I18nObject
 from core.tools.entities.tool_entities import (
     ApiProviderAuthType,
-    ToolAuthType,
     ToolInvokeFrom,
     ToolParameter,
     ToolProviderType,
@@ -59,7 +58,7 @@ from core.tools.tool_label_manager import ToolLabelManager
 from core.tools.utils.configuration import ToolParameterConfigurationManager
 from core.tools.utils.encryption import create_provider_encrypter, create_tool_provider_encrypter
 from core.tools.workflow_as_tool.tool import WorkflowTool
-from models.tools import ApiToolProvider, BuiltinToolProvider, EndUserAuthenticationProvider, WorkflowToolProvider
+from models.tools import ApiToolProvider, BuiltinToolProvider, WorkflowToolProvider
 from services.tools.tools_transform_service import ToolTransformService
 
 if TYPE_CHECKING:
@@ -79,54 +78,6 @@ class ToolManager:
     _builtin_providers_loaded = False
     _builtin_tools_labels: dict[str, Union[I18nObject, None]] = {}
 
-    @classmethod
-    def _refresh_oauth_credentials(
-        cls,
-        tenant_id: str,
-        provider_id: str,
-        user_id: str,
-        decrypted_credentials: Mapping[str, Any],
-    ) -> tuple[dict[str, Any], int]:
-        """
-        Refresh OAuth credentials for a provider.
-
-        This is a helper method to centralize the OAuth token refresh logic
-        used by both end-user and workspace authentication flows.
-
-        :param tenant_id: the tenant id
-        :param provider_id: the provider id
-        :param user_id: the user id (end_user_id or workspace user_id)
-        :param decrypted_credentials: the current decrypted credentials
-
-        :return: tuple of (refreshed credentials dict, expires_at timestamp)
-        """
-        from core.plugin.impl.oauth import OAuthHandler
-
-        # Local import to avoid circular dependency at module level
-        # This import is necessary but creates a cycle: tool_manager -> builtin_tools_manage_service -> tool_manager
-        # TODO: Break the circular dependency by refactoring service layer
-        from services.tools.builtin_tools_manage_service import BuiltinToolManageService
-
-        # Parse provider ID and build OAuth configuration
-        tool_provider = ToolProviderID(provider_id)
-        provider_name = tool_provider.provider_name
-        redirect_uri = f"{dify_config.CONSOLE_API_URL}/console/api/oauth/plugin/{provider_id}/tool/callback"
-        system_credentials = BuiltinToolManageService.get_oauth_client(tenant_id, provider_id)
-
-        # Refresh the credentials using OAuth handler
-        oauth_handler = OAuthHandler()
-        refreshed_credentials = oauth_handler.refresh_credentials(
-            tenant_id=tenant_id,
-            user_id=user_id,
-            plugin_id=tool_provider.plugin_id,
-            provider=provider_name,
-            redirect_uri=redirect_uri,
-            system_credentials=system_credentials or {},
-            credentials=decrypted_credentials,
-        )
-
-        return refreshed_credentials.credentials, refreshed_credentials.expires_at
-
     @classmethod
     def get_hardcoded_provider(cls, provider: str) -> BuiltinToolProviderController:
         """
@@ -214,8 +165,6 @@ class ToolManager:
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         tool_invoke_from: ToolInvokeFrom = ToolInvokeFrom.AGENT,
         credential_id: str | None = None,
-        auth_type: ToolAuthType = ToolAuthType.WORKSPACE,
-        end_user_id: str | None = None,
     ) -> Union[BuiltinTool, PluginTool, ApiTool, WorkflowTool, MCPTool]:
         """
         get the tool runtime
@@ -227,8 +176,6 @@ class ToolManager:
         :param invoke_from: invoke from
         :param tool_invoke_from: the tool invoke from
         :param credential_id: the credential id
-        :param auth_type: the authentication type (workspace or end_user)
-        :param end_user_id: the end user id (required when auth_type is END_USER)
 
         :return: the tool
         """
@@ -253,75 +200,6 @@ class ToolManager:
                         )
                     ),
                 )
-
-            # Handle end-user authentication
-            if auth_type == ToolAuthType.END_USER:
-                if not end_user_id:
-                    raise ToolProviderNotFoundError("end_user_id is required for END_USER auth_type")
-
-                # Query end-user credentials
-                enduser_provider = (
-                    db.session.query(EndUserAuthenticationProvider)
-                    .where(
-                        EndUserAuthenticationProvider.tenant_id == tenant_id,
-                        EndUserAuthenticationProvider.end_user_id == end_user_id,
-                        EndUserAuthenticationProvider.provider == provider_id,
-                    )
-                    .order_by(EndUserAuthenticationProvider.created_at.asc())
-                    .first()
-                )
-
-                if enduser_provider is None:
-                    raise ToolProviderNotFoundError(
-                        f"No end-user credentials found for provider {provider_id}"
-                    )
-
-                # Decrypt end-user credentials
-                encrypter, cache = create_provider_encrypter(
-                    tenant_id=tenant_id,
-                    config=[
-                        x.to_basic_provider_config()
-                        for x in provider_controller.get_credentials_schema_by_type(enduser_provider.credential_type)
-                    ],
-                    cache=ToolProviderCredentialsCache(
-                        tenant_id=tenant_id, provider=provider_id, credential_id=enduser_provider.id
-                    ),
-                )
-
-                decrypted_credentials: Mapping[str, Any] = encrypter.decrypt(enduser_provider.credentials)
-
-                # Handle OAuth token refresh for end-users if expired
-                if enduser_provider.expires_at != -1 and (enduser_provider.expires_at - 60) < int(time.time()):
-                    # Refresh credentials using the centralized helper method
-                    refreshed_credentials, expires_at = cls._refresh_oauth_credentials(
-                        tenant_id=tenant_id,
-                        provider_id=provider_id,
-                        user_id=end_user_id,
-                        decrypted_credentials=decrypted_credentials,
-                    )
-
-                    # Update the provider with refreshed credentials
-                    enduser_provider.encrypted_credentials = json.dumps(encrypter.encrypt(refreshed_credentials))
-                    enduser_provider.expires_at = expires_at
-                    db.session.commit()
-                    decrypted_credentials = refreshed_credentials
-                    cache.delete()
-
-                return cast(
-                    BuiltinTool,
-                    builtin_tool.fork_tool_runtime(
-                        runtime=ToolRuntime(
-                            tenant_id=tenant_id,
-                            credentials=dict(decrypted_credentials),
-                            credential_type=CredentialType.of(enduser_provider.credential_type),
-                            runtime_parameters={},
-                            invoke_from=invoke_from,
-                            tool_invoke_from=tool_invoke_from,
-                        )
-                    ),
-                )
-
-            # Handle workspace authentication (existing logic)
             builtin_provider = None
             if isinstance(provider_controller, PluginToolProviderController):
                 provider_id_entity = ToolProviderID(provider_id)
@@ -392,19 +270,34 @@ class ToolManager:
 
             # check if the credentials is expired
             if builtin_provider.expires_at != -1 and (builtin_provider.expires_at - 60) < int(time.time()):
-                # Refresh credentials using the centralized helper method
-                refreshed_credentials, expires_at = cls._refresh_oauth_credentials(
-                    tenant_id=tenant_id,
-                    provider_id=provider_id,
-                    user_id=builtin_provider.user_id,
-                    decrypted_credentials=decrypted_credentials,
-                )
+                # TODO: circular import
+                from core.plugin.impl.oauth import OAuthHandler
+                from services.tools.builtin_tools_manage_service import BuiltinToolManageService
 
-                # Update the provider with refreshed credentials
-                builtin_provider.encrypted_credentials = json.dumps(encrypter.encrypt(refreshed_credentials))
-                builtin_provider.expires_at = expires_at
+                # refresh the credentials
+                tool_provider = ToolProviderID(provider_id)
+                provider_name = tool_provider.provider_name
+                redirect_uri = f"{dify_config.CONSOLE_API_URL}/console/api/oauth/plugin/{provider_id}/tool/callback"
+                system_credentials = BuiltinToolManageService.get_oauth_client(tenant_id, provider_id)
+
+                oauth_handler = OAuthHandler()
+                # refresh the credentials
+                refreshed_credentials = oauth_handler.refresh_credentials(
+                    tenant_id=tenant_id,
+                    user_id=builtin_provider.user_id,
+                    plugin_id=tool_provider.plugin_id,
+                    provider=provider_name,
+                    redirect_uri=redirect_uri,
+                    system_credentials=system_credentials or {},
+                    credentials=decrypted_credentials,
+                )
+                # update the credentials
+                builtin_provider.encrypted_credentials = json.dumps(
+                    encrypter.encrypt(refreshed_credentials.credentials)
+                )
+                builtin_provider.expires_at = refreshed_credentials.expires_at
                 db.session.commit()
-                decrypted_credentials = refreshed_credentials
+                decrypted_credentials = refreshed_credentials.credentials
                 cache.delete()
 
             return cast(
@@ -475,7 +368,6 @@ class ToolManager:
         agent_tool: AgentToolEntity,
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         variable_pool: Optional["VariablePool"] = None,
-        end_user_id: str | None = None,
     ) -> Tool:
         """
         get the agent tool runtime
@@ -488,8 +380,6 @@ class ToolManager:
             invoke_from=invoke_from,
             tool_invoke_from=ToolInvokeFrom.AGENT,
             credential_id=agent_tool.credential_id,
-            auth_type=agent_tool.auth_type,
-            end_user_id=end_user_id,
         )
         runtime_parameters = {}
         parameters = tool_entity.get_merged_runtime_parameters()
@@ -520,7 +410,6 @@ class ToolManager:
         workflow_tool: "ToolEntity",
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         variable_pool: Optional["VariablePool"] = None,
-        end_user_id: str | None = None,
     ) -> Tool:
         """
         get the workflow tool runtime
@@ -534,8 +423,6 @@ class ToolManager:
             invoke_from=invoke_from,
             tool_invoke_from=ToolInvokeFrom.WORKFLOW,
             credential_id=workflow_tool.credential_id,
-            auth_type=workflow_tool.auth_type,
-            end_user_id=end_user_id,
         )
 
         parameters = tool_runtime.get_merged_runtime_parameters()

api/core/workflow/graph_engine/graph_engine.py

@@ -140,10 +140,6 @@ class GraphEngine:
         pause_handler = PauseCommandHandler()
         self._command_processor.register_handler(PauseCommand, pause_handler)
 
-        # === Extensibility ===
-        # Layers allow plugins to extend engine functionality
-        self._layers: list[GraphEngineLayer] = []
-
         # === Worker Pool Setup ===
         # Capture Flask app context for worker threads
         flask_app: Flask | None = None
@@ -162,7 +158,6 @@ class GraphEngine:
             ready_queue=self._ready_queue,
             event_queue=self._event_queue,
             graph=self._graph,
-            layers=self._layers,
             flask_app=flask_app,
             context_vars=context_vars,
             min_workers=self._min_workers,
@@ -201,6 +196,10 @@ class GraphEngine:
             event_emitter=self._event_manager,
         )
 
+        # === Extensibility ===
+        # Layers allow plugins to extend engine functionality
+        self._layers: list[GraphEngineLayer] = []
+
         # === Validation ===
         # Ensure all nodes share the same GraphRuntimeState instance
         self._validate_graph_state_consistency()

api/core/workflow/graph_engine/layers/__init__.py

@@ -8,11 +8,9 @@ with middleware-like components that can observe events and interact with execut
 from .base import GraphEngineLayer
 from .debug_logging import DebugLoggingLayer
 from .execution_limits import ExecutionLimitsLayer
-from .observability import ObservabilityLayer
 
 __all__ = [
     "DebugLoggingLayer",
     "ExecutionLimitsLayer",
     "GraphEngineLayer",
-    "ObservabilityLayer",
 ]

api/core/workflow/graph_engine/layers/base.py

@@ -9,7 +9,6 @@ from abc import ABC, abstractmethod
 
 from core.workflow.graph_engine.protocols.command_channel import CommandChannel
 from core.workflow.graph_events import GraphEngineEvent
-from core.workflow.nodes.base.node import Node
 from core.workflow.runtime import ReadOnlyGraphRuntimeState
 
 
@@ -84,29 +83,3 @@ class GraphEngineLayer(ABC):
             error: The exception that caused execution to fail, or None if successful
         """
         pass
-
-    def on_node_run_start(self, node: Node) -> None:  # noqa: B027
-        """
-        Called immediately before a node begins execution.
-
-        Layers can override to inject behavior (e.g., start spans) prior to node execution.
-        The node's execution ID is available via `node._node_execution_id` and will be
-        consistent with all events emitted by this node execution.
-
-        Args:
-            node: The node instance about to be executed
-        """
-        pass
-
-    def on_node_run_end(self, node: Node, error: Exception | None) -> None:  # noqa: B027
-        """
-        Called after a node finishes execution.
-
-        The node's execution ID is available via `node._node_execution_id` and matches
-        the `id` field in all events emitted by this node execution.
-
-        Args:
-            node: The node instance that just finished execution
-            error: Exception instance if the node failed, otherwise None
-        """
-        pass

api/core/workflow/graph_engine/layers/node_parsers.py

@@ -1,61 +0,0 @@
-"""
-Node-level OpenTelemetry parser interfaces and defaults.
-"""
-
-import json
-from typing import Protocol
-
-from opentelemetry.trace import Span
-from opentelemetry.trace.status import Status, StatusCode
-
-from core.workflow.nodes.base.node import Node
-from core.workflow.nodes.tool.entities import ToolNodeData
-
-
-class NodeOTelParser(Protocol):
-    """Parser interface for node-specific OpenTelemetry enrichment."""
-
-    def parse(self, *, node: Node, span: "Span", error: Exception | None) -> None: ...
-
-
-class DefaultNodeOTelParser:
-    """Fallback parser used when no node-specific parser is registered."""
-
-    def parse(self, *, node: Node, span: "Span", error: Exception | None) -> None:
-        span.set_attribute("node.id", node.id)
-        if node.execution_id:
-            span.set_attribute("node.execution_id", node.execution_id)
-        if hasattr(node, "node_type") and node.node_type:
-            span.set_attribute("node.type", node.node_type.value)
-
-        if error:
-            span.record_exception(error)
-            span.set_status(Status(StatusCode.ERROR, str(error)))
-        else:
-            span.set_status(Status(StatusCode.OK))
-
-
-class ToolNodeOTelParser:
-    """Parser for tool nodes that captures tool-specific metadata."""
-
-    def __init__(self) -> None:
-        self._delegate = DefaultNodeOTelParser()
-
-    def parse(self, *, node: Node, span: "Span", error: Exception | None) -> None:
-        self._delegate.parse(node=node, span=span, error=error)
-
-        tool_data = getattr(node, "_node_data", None)
-        if not isinstance(tool_data, ToolNodeData):
-            return
-
-        span.set_attribute("tool.provider.id", tool_data.provider_id)
-        span.set_attribute("tool.provider.type", tool_data.provider_type.value)
-        span.set_attribute("tool.provider.name", tool_data.provider_name)
-        span.set_attribute("tool.name", tool_data.tool_name)
-        span.set_attribute("tool.label", tool_data.tool_label)
-        if tool_data.plugin_unique_identifier:
-            span.set_attribute("tool.plugin.id", tool_data.plugin_unique_identifier)
-        if tool_data.credential_id:
-            span.set_attribute("tool.credential.id", tool_data.credential_id)
-        if tool_data.tool_configurations:
-            span.set_attribute("tool.config", json.dumps(tool_data.tool_configurations, ensure_ascii=False))

api/core/workflow/graph_engine/layers/observability.py

@@ -1,169 +0,0 @@
-"""
-Observability layer for GraphEngine.
-
-This layer creates OpenTelemetry spans for node execution, enabling distributed
-tracing of workflow execution. It establishes OTel context during node execution
-so that automatic instrumentation (HTTP requests, DB queries, etc.) automatically
-associates with the node span.
-"""
-
-import logging
-from dataclasses import dataclass
-from typing import cast, final
-
-from opentelemetry import context as context_api
-from opentelemetry.trace import Span, SpanKind, Tracer, get_tracer, set_span_in_context
-from typing_extensions import override
-
-from configs import dify_config
-from core.workflow.enums import NodeType
-from core.workflow.graph_engine.layers.base import GraphEngineLayer
-from core.workflow.graph_engine.layers.node_parsers import (
-    DefaultNodeOTelParser,
-    NodeOTelParser,
-    ToolNodeOTelParser,
-)
-from core.workflow.nodes.base.node import Node
-from extensions.otel.runtime import is_instrument_flag_enabled
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass(slots=True)
-class _NodeSpanContext:
-    span: "Span"
-    token: object
-
-
-@final
-class ObservabilityLayer(GraphEngineLayer):
-    """
-    Layer that creates OpenTelemetry spans for node execution.
-
-    This layer:
-    - Creates a span when a node starts execution
-    - Establishes OTel context so automatic instrumentation associates with the span
-    - Sets complete attributes and status when node execution ends
-    """
-
-    def __init__(self) -> None:
-        super().__init__()
-        self._node_contexts: dict[str, _NodeSpanContext] = {}
-        self._parsers: dict[NodeType, NodeOTelParser] = {}
-        self._default_parser: NodeOTelParser = cast(NodeOTelParser, DefaultNodeOTelParser())
-        self._is_disabled: bool = False
-        self._tracer: Tracer | None = None
-        self._build_parser_registry()
-        self._init_tracer()
-
-    def _init_tracer(self) -> None:
-        """Initialize OpenTelemetry tracer in constructor."""
-        if not (dify_config.ENABLE_OTEL or is_instrument_flag_enabled()):
-            self._is_disabled = True
-            return
-
-        try:
-            self._tracer = get_tracer(__name__)
-        except Exception as e:
-            logger.warning("Failed to get OpenTelemetry tracer: %s", e)
-            self._is_disabled = True
-
-    def _build_parser_registry(self) -> None:
-        """Initialize parser registry for node types."""
-        self._parsers = {
-            NodeType.TOOL: ToolNodeOTelParser(),
-        }
-
-    def _get_parser(self, node: Node) -> NodeOTelParser:
-        node_type = getattr(node, "node_type", None)
-        if isinstance(node_type, NodeType):
-            return self._parsers.get(node_type, self._default_parser)
-        return self._default_parser
-
-    @override
-    def on_graph_start(self) -> None:
-        """Called when graph execution starts."""
-        self._node_contexts.clear()
-
-    @override
-    def on_node_run_start(self, node: Node) -> None:
-        """
-        Called when a node starts execution.
-
-        Creates a span and establishes OTel context for automatic instrumentation.
-        """
-        if self._is_disabled:
-            return
-
-        try:
-            if not self._tracer:
-                return
-
-            execution_id = node.execution_id
-            if not execution_id:
-                return
-
-            parent_context = context_api.get_current()
-            span = self._tracer.start_span(
-                f"{node.title}",
-                kind=SpanKind.INTERNAL,
-                context=parent_context,
-            )
-
-            new_context = set_span_in_context(span)
-            token = context_api.attach(new_context)
-
-            self._node_contexts[execution_id] = _NodeSpanContext(span=span, token=token)
-
-        except Exception as e:
-            logger.warning("Failed to create OpenTelemetry span for node %s: %s", node.id, e)
-
-    @override
-    def on_node_run_end(self, node: Node, error: Exception | None) -> None:
-        """
-        Called when a node finishes execution.
-
-        Sets complete attributes, records exceptions, and ends the span.
-        """
-        if self._is_disabled:
-            return
-
-        try:
-            execution_id = node.execution_id
-            if not execution_id:
-                return
-            node_context = self._node_contexts.get(execution_id)
-            if not node_context:
-                return
-
-            span = node_context.span
-            parser = self._get_parser(node)
-            try:
-                parser.parse(node=node, span=span, error=error)
-                span.end()
-            finally:
-                token = node_context.token
-                if token is not None:
-                    try:
-                        context_api.detach(token)
-                    except Exception:
-                        logger.warning("Failed to detach OpenTelemetry token: %s", token)
-                self._node_contexts.pop(execution_id, None)
-
-        except Exception as e:
-            logger.warning("Failed to end OpenTelemetry span for node %s: %s", node.id, e)
-
-    @override
-    def on_event(self, event) -> None:
-        """Not used in this layer."""
-        pass
-
-    @override
-    def on_graph_end(self, error: Exception | None) -> None:
-        """Called when graph execution ends."""
-        if self._node_contexts:
-            logger.warning(
-                "ObservabilityLayer: %d node spans were not properly ended",
-                len(self._node_contexts),
-            )
-            self._node_contexts.clear()

api/core/workflow/graph_engine/worker.py

@@ -9,7 +9,6 @@ import contextvars
 import queue
 import threading
 import time
-from collections.abc import Sequence
 from datetime import datetime
 from typing import final
 from uuid import uuid4
@@ -18,7 +17,6 @@ from flask import Flask
 from typing_extensions import override
 
 from core.workflow.graph import Graph
-from core.workflow.graph_engine.layers.base import GraphEngineLayer
 from core.workflow.graph_events import GraphNodeEventBase, NodeRunFailedEvent
 from core.workflow.nodes.base.node import Node
 from libs.flask_utils import preserve_flask_contexts
@@ -41,7 +39,6 @@ class Worker(threading.Thread):
         ready_queue: ReadyQueue,
         event_queue: queue.Queue[GraphNodeEventBase],
         graph: Graph,
-        layers: Sequence[GraphEngineLayer],
         worker_id: int = 0,
         flask_app: Flask | None = None,
         context_vars: contextvars.Context | None = None,
@@ -53,7 +50,6 @@ class Worker(threading.Thread):
             ready_queue: Ready queue containing node IDs ready for execution
             event_queue: Queue for pushing execution events
             graph: Graph containing nodes to execute
-            layers: Graph engine layers for node execution hooks
             worker_id: Unique identifier for this worker
             flask_app: Optional Flask application for context preservation
             context_vars: Optional context variables to preserve in worker thread
@@ -67,7 +63,6 @@ class Worker(threading.Thread):
         self._context_vars = context_vars
         self._stop_event = threading.Event()
         self._last_task_time = time.time()
-        self._layers = layers if layers is not None else []
 
     def stop(self) -> None:
         """Signal the worker to stop processing."""
@@ -127,51 +122,20 @@ class Worker(threading.Thread):
         Args:
             node: The node instance to execute
         """
-        node.ensure_execution_id()
-
-        error: Exception | None = None
-
+        # Execute the node with preserved context if Flask app is provided
         if self._flask_app and self._context_vars:
             with preserve_flask_contexts(
                 flask_app=self._flask_app,
                 context_vars=self._context_vars,
             ):
-                self._invoke_node_run_start_hooks(node)
-                try:
-                    node_events = node.run()
-                    for event in node_events:
-                        self._event_queue.put(event)
-                except Exception as exc:
-                    error = exc
-                    raise
-                finally:
-                    self._invoke_node_run_end_hooks(node, error)
-        else:
-            self._invoke_node_run_start_hooks(node)
-            try:
+                # Execute the node
                 node_events = node.run()
                 for event in node_events:
+                    # Forward event to dispatcher immediately for streaming
                     self._event_queue.put(event)
-            except Exception as exc:
-                error = exc
-                raise
-            finally:
-                self._invoke_node_run_end_hooks(node, error)
-
-    def _invoke_node_run_start_hooks(self, node: Node) -> None:
-        """Invoke on_node_run_start hooks for all layers."""
-        for layer in self._layers:
-            try:
-                layer.on_node_run_start(node)
-            except Exception:
-                # Silently ignore layer errors to prevent disrupting node execution
-                continue
-
-    def _invoke_node_run_end_hooks(self, node: Node, error: Exception | None) -> None:
-        """Invoke on_node_run_end hooks for all layers."""
-        for layer in self._layers:
-            try:
-                layer.on_node_run_end(node, error)
-            except Exception:
-                # Silently ignore layer errors to prevent disrupting node execution
-                continue
+        else:
+            # Execute without context preservation
+            node_events = node.run()
+            for event in node_events:
+                # Forward event to dispatcher immediately for streaming
+                self._event_queue.put(event)

api/core/workflow/graph_engine/worker_management/worker_pool.py

@@ -14,7 +14,6 @@ from configs import dify_config
 from core.workflow.graph import Graph
 from core.workflow.graph_events import GraphNodeEventBase
 
-from ..layers.base import GraphEngineLayer
 from ..ready_queue import ReadyQueue
 from ..worker import Worker
 
@@ -40,7 +39,6 @@ class WorkerPool:
         ready_queue: ReadyQueue,
         event_queue: queue.Queue[GraphNodeEventBase],
         graph: Graph,
-        layers: list[GraphEngineLayer],
         flask_app: "Flask | None" = None,
         context_vars: "Context | None" = None,
         min_workers: int | None = None,
@@ -55,7 +53,6 @@ class WorkerPool:
             ready_queue: Ready queue for nodes ready for execution
             event_queue: Queue for worker events
             graph: The workflow graph
-            layers: Graph engine layers for node execution hooks
             flask_app: Optional Flask app for context preservation
             context_vars: Optional context variables
             min_workers: Minimum number of workers
@@ -68,7 +65,6 @@ class WorkerPool:
         self._graph = graph
         self._flask_app = flask_app
         self._context_vars = context_vars
-        self._layers = layers
 
         # Scaling parameters with defaults
         self._min_workers = min_workers or dify_config.GRAPH_ENGINE_MIN_WORKERS
@@ -148,7 +144,6 @@ class WorkerPool:
             ready_queue=self._ready_queue,
             event_queue=self._event_queue,
             graph=self._graph,
-            layers=self._layers,
             worker_id=worker_id,
             flask_app=self._flask_app,
             context_vars=self._context_vars,

api/core/workflow/nodes/base/node.py

@@ -244,15 +244,6 @@ class Node(Generic[NodeDataT]):
     def graph_init_params(self) -> "GraphInitParams":
         return self._graph_init_params
 
-    @property
-    def execution_id(self) -> str:
-        return self._node_execution_id
-
-    def ensure_execution_id(self) -> str:
-        if not self._node_execution_id:
-            self._node_execution_id = str(uuid4())
-        return self._node_execution_id
-
     def _hydrate_node_data(self, data: Mapping[str, Any]) -> NodeDataT:
         return cast(NodeDataT, self._node_data_type.model_validate(data))
 
@@ -265,12 +256,14 @@ class Node(Generic[NodeDataT]):
         raise NotImplementedError
 
     def run(self) -> Generator[GraphNodeEventBase, None, None]:
-        execution_id = self.ensure_execution_id()
+        # Generate a single node execution ID to use for all events
+        if not self._node_execution_id:
+            self._node_execution_id = str(uuid4())
         self._start_at = naive_utc_now()
 
         # Create and push start event with required fields
         start_event = NodeRunStartedEvent(
-            id=execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.title,
@@ -328,7 +321,7 @@ class Node(Generic[NodeDataT]):
                 if isinstance(event, NodeEventBase):  # pyright: ignore[reportUnnecessaryIsInstance]
                     yield self._dispatch(event)
                 elif isinstance(event, GraphNodeEventBase) and not event.in_iteration_id and not event.in_loop_id:  # pyright: ignore[reportUnnecessaryIsInstance]
-                    event.id = self.execution_id
+                    event.id = self._node_execution_id
                     yield event
                 else:
                     yield event
@@ -340,7 +333,7 @@ class Node(Generic[NodeDataT]):
                 error_type="WorkflowNodeError",
             )
             yield NodeRunFailedEvent(
-                id=self.execution_id,
+                id=self._node_execution_id,
                 node_id=self._node_id,
                 node_type=self.node_type,
                 start_at=self._start_at,
@@ -519,7 +512,7 @@ class Node(Generic[NodeDataT]):
         match result.status:
             case WorkflowNodeExecutionStatus.FAILED:
                 return NodeRunFailedEvent(
-                    id=self.execution_id,
+                    id=self._node_execution_id,
                     node_id=self.id,
                     node_type=self.node_type,
                     start_at=self._start_at,
@@ -528,7 +521,7 @@ class Node(Generic[NodeDataT]):
                 )
             case WorkflowNodeExecutionStatus.SUCCEEDED:
                 return NodeRunSucceededEvent(
-                    id=self.execution_id,
+                    id=self._node_execution_id,
                     node_id=self.id,
                     node_type=self.node_type,
                     start_at=self._start_at,
@@ -544,7 +537,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: StreamChunkEvent) -> NodeRunStreamChunkEvent:
         return NodeRunStreamChunkEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             selector=event.selector,
@@ -557,7 +550,7 @@ class Node(Generic[NodeDataT]):
         match event.node_run_result.status:
             case WorkflowNodeExecutionStatus.SUCCEEDED:
                 return NodeRunSucceededEvent(
-                    id=self.execution_id,
+                    id=self._node_execution_id,
                     node_id=self._node_id,
                     node_type=self.node_type,
                     start_at=self._start_at,
@@ -565,7 +558,7 @@ class Node(Generic[NodeDataT]):
                 )
             case WorkflowNodeExecutionStatus.FAILED:
                 return NodeRunFailedEvent(
-                    id=self.execution_id,
+                    id=self._node_execution_id,
                     node_id=self._node_id,
                     node_type=self.node_type,
                     start_at=self._start_at,
@@ -580,7 +573,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: PauseRequestedEvent) -> NodeRunPauseRequestedEvent:
         return NodeRunPauseRequestedEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_run_result=NodeRunResult(status=WorkflowNodeExecutionStatus.PAUSED),
@@ -590,7 +583,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: AgentLogEvent) -> NodeRunAgentLogEvent:
         return NodeRunAgentLogEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             message_id=event.message_id,
@@ -606,7 +599,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: LoopStartedEvent) -> NodeRunLoopStartedEvent:
         return NodeRunLoopStartedEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -619,7 +612,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: LoopNextEvent) -> NodeRunLoopNextEvent:
         return NodeRunLoopNextEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -630,7 +623,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: LoopSucceededEvent) -> NodeRunLoopSucceededEvent:
         return NodeRunLoopSucceededEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -644,7 +637,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: LoopFailedEvent) -> NodeRunLoopFailedEvent:
         return NodeRunLoopFailedEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -659,7 +652,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: IterationStartedEvent) -> NodeRunIterationStartedEvent:
         return NodeRunIterationStartedEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -672,7 +665,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: IterationNextEvent) -> NodeRunIterationNextEvent:
         return NodeRunIterationNextEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -683,7 +676,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: IterationSucceededEvent) -> NodeRunIterationSucceededEvent:
         return NodeRunIterationSucceededEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -697,7 +690,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: IterationFailedEvent) -> NodeRunIterationFailedEvent:
         return NodeRunIterationFailedEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             node_title=self.node_data.title,
@@ -712,7 +705,7 @@ class Node(Generic[NodeDataT]):
     @_dispatch.register
     def _(self, event: RunRetrieverResourceEvent) -> NodeRunRetrieverResourceEvent:
         return NodeRunRetrieverResourceEvent(
-            id=self.execution_id,
+            id=self._node_execution_id,
             node_id=self._node_id,
             node_type=self.node_type,
             retriever_resources=event.retriever_resources,

api/core/workflow/nodes/tool/entities.py

@@ -3,7 +3,7 @@ from typing import Any, Literal, Union
 from pydantic import BaseModel, field_validator
 from pydantic_core.core_schema import ValidationInfo
 
-from core.tools.entities.tool_entities import ToolAuthType, ToolProviderType
+from core.tools.entities.tool_entities import ToolProviderType
 from core.workflow.nodes.base.entities import BaseNodeData
 
 
@@ -16,7 +16,6 @@ class ToolEntity(BaseModel):
     tool_configurations: dict[str, Any]
     credential_id: str | None = None
     plugin_unique_identifier: str | None = None  # redundancy
-    auth_type: ToolAuthType = ToolAuthType.WORKSPACE  # OAuth authentication level
 
     @field_validator("tool_configurations", mode="before")
     @classmethod

api/core/workflow/nodes/tool/tool_node.py

@@ -66,7 +66,6 @@ class ToolNode(Node[ToolNodeData]):
         # get tool runtime
         try:
             from core.tools.tool_manager import ToolManager
-            from models.enums import UserFrom
 
             # This is an issue that caused problems before.
             # Logically, we shouldn't use the node_data.version field for judgment
@@ -75,20 +74,8 @@ class ToolNode(Node[ToolNodeData]):
             variable_pool: VariablePool | None = None
             if self.node_data.version != "1" or self.node_data.tool_node_version is not None:
                 variable_pool = self.graph_runtime_state.variable_pool
-
-            # Determine end_user_id based on user_from
-            end_user_id = None
-            if self.user_from == UserFrom.END_USER:
-                end_user_id = self.user_id
-
             tool_runtime = ToolManager.get_workflow_tool_runtime(
-                self.tenant_id,
-                self.app_id,
-                self._node_id,
-                self.node_data,
-                self.invoke_from,
-                variable_pool,
-                end_user_id,
+                self.tenant_id, self.app_id, self._node_id, self.node_data, self.invoke_from, variable_pool
             )
         except ToolNodeError as e:
             yield StreamCompletedEvent(

api/core/workflow/workflow_entry.py

@@ -14,7 +14,7 @@ from core.workflow.errors import WorkflowNodeRunFailedError
 from core.workflow.graph import Graph
 from core.workflow.graph_engine import GraphEngine
 from core.workflow.graph_engine.command_channels import InMemoryChannel
-from core.workflow.graph_engine.layers import DebugLoggingLayer, ExecutionLimitsLayer, ObservabilityLayer
+from core.workflow.graph_engine.layers import DebugLoggingLayer, ExecutionLimitsLayer
 from core.workflow.graph_engine.protocols.command_channel import CommandChannel
 from core.workflow.graph_events import GraphEngineEvent, GraphNodeEventBase, GraphRunFailedEvent
 from core.workflow.nodes import NodeType
@@ -23,7 +23,6 @@ from core.workflow.nodes.node_mapping import NODE_TYPE_CLASSES_MAPPING
 from core.workflow.runtime import GraphRuntimeState, VariablePool
 from core.workflow.system_variable import SystemVariable
 from core.workflow.variable_loader import DUMMY_VARIABLE_LOADER, VariableLoader, load_into_variable_pool
-from extensions.otel.runtime import is_instrument_flag_enabled
 from factories import file_factory
 from models.enums import UserFrom
 from models.workflow import Workflow
@@ -99,10 +98,6 @@ class WorkflowEntry:
         )
         self.graph_engine.layer(limits_layer)
 
-        # Add observability layer when OTel is enabled
-        if dify_config.ENABLE_OTEL or is_instrument_flag_enabled():
-            self.graph_engine.layer(ObservabilityLayer())
-
     def run(self) -> Generator[GraphEngineEvent, None, None]:
         graph_engine = self.graph_engine
 

api/extensions/ext_login.py

@@ -22,8 +22,8 @@ login_manager = flask_login.LoginManager()
 @login_manager.request_loader
 def load_user_from_request(request_from_flask_login):
     """Load user based on the request."""
-    # Skip authentication for documentation endpoints
-    if dify_config.SWAGGER_UI_ENABLED and request.path.endswith((dify_config.SWAGGER_UI_PATH, "/swagger.json")):
+    # Skip authentication for documentation endpoints (only when Swagger is enabled)
+    if dify_config.swagger_ui_enabled and request.path.endswith((dify_config.SWAGGER_UI_PATH, "/swagger.json")):
         return None
 
     auth_token = extract_access_token(request)

api/extensions/otel/decorators/base.py

@@ -1,4 +1,5 @@
 import functools
+import os
 from collections.abc import Callable
 from typing import Any, TypeVar, cast
 
@@ -6,13 +7,22 @@ from opentelemetry.trace import get_tracer
 
 from configs import dify_config
 from extensions.otel.decorators.handler import SpanHandler
-from extensions.otel.runtime import is_instrument_flag_enabled
 
 T = TypeVar("T", bound=Callable[..., Any])
 
 _HANDLER_INSTANCES: dict[type[SpanHandler], SpanHandler] = {SpanHandler: SpanHandler()}
 
 
+def _is_instrument_flag_enabled() -> bool:
+    """
+    Check if external instrumentation is enabled via environment variable.
+
+    Third-party non-invasive instrumentation agents set this flag to coordinate
+    with Dify's manual OpenTelemetry instrumentation.
+    """
+    return os.getenv("ENABLE_OTEL_FOR_INSTRUMENT", "").strip().lower() == "true"
+
+
 def _get_handler_instance(handler_class: type[SpanHandler]) -> SpanHandler:
     """Get or create a singleton instance of the handler class."""
     if handler_class not in _HANDLER_INSTANCES:
@@ -33,7 +43,7 @@ def trace_span(handler_class: type[SpanHandler] | None = None) -> Callable[[T],
     def decorator(func: T) -> T:
         @functools.wraps(func)
         def wrapper(*args: Any, **kwargs: Any) -> Any:
-            if not (dify_config.ENABLE_OTEL or is_instrument_flag_enabled()):
+            if not (dify_config.ENABLE_OTEL or _is_instrument_flag_enabled()):
                 return func(*args, **kwargs)
 
             handler = _get_handler_instance(handler_class or SpanHandler)

api/extensions/otel/runtime.py

@@ -1,5 +1,4 @@
 import logging
-import os
 import sys
 from typing import Union
 
@@ -72,13 +71,3 @@ def init_celery_worker(*args, **kwargs):
         if dify_config.DEBUG:
             logger.info("Initializing OpenTelemetry for Celery worker")
         CeleryInstrumentor(tracer_provider=tracer_provider, meter_provider=metric_provider).instrument()
-
-
-def is_instrument_flag_enabled() -> bool:
-    """
-    Check if external instrumentation is enabled via environment variable.
-
-    Third-party non-invasive instrumentation agents set this flag to coordinate
-    with Dify's manual OpenTelemetry instrumentation.
-    """
-    return os.getenv("ENABLE_OTEL_FOR_INSTRUMENT", "").strip().lower() == "true"

api/libs/encryption.py

@@ -1,66 +0,0 @@
-"""
-Field Encoding/Decoding Utilities
-
-Provides Base64 decoding for sensitive fields (password, verification code)
-received from the frontend.
-
-Note: This uses Base64 encoding for obfuscation, not cryptographic encryption.
-Real security relies on HTTPS for transport layer encryption.
-"""
-
-import base64
-import logging
-
-logger = logging.getLogger(__name__)
-
-
-class FieldEncryption:
-    """Handle decoding of sensitive fields during transmission"""
-
-    @classmethod
-    def decrypt_field(cls, encoded_text: str) -> str | None:
-        """
-        Decode Base64 encoded field from frontend.
-
-        Args:
-            encoded_text: Base64 encoded text from frontend
-
-        Returns:
-            Decoded plaintext, or None if decoding fails
-        """
-        try:
-            # Decode base64
-            decoded_bytes = base64.b64decode(encoded_text)
-            decoded_text = decoded_bytes.decode("utf-8")
-            logger.debug("Field decoding successful")
-            return decoded_text
-
-        except Exception:
-            # Decoding failed - return None to trigger error in caller
-            return None
-
-    @classmethod
-    def decrypt_password(cls, encrypted_password: str) -> str | None:
-        """
-        Decrypt password field
-
-        Args:
-            encrypted_password: Encrypted password from frontend
-
-        Returns:
-            Decrypted password or None if decryption fails
-        """
-        return cls.decrypt_field(encrypted_password)
-
-    @classmethod
-    def decrypt_verification_code(cls, encrypted_code: str) -> str | None:
-        """
-        Decrypt verification code field
-
-        Args:
-            encrypted_code: Encrypted code from frontend
-
-        Returns:
-            Decrypted code or None if decryption fails
-        """
-        return cls.decrypt_field(encrypted_code)

api/libs/external_api.py

@@ -131,12 +131,28 @@ class ExternalApi(Api):
     }
 
     def __init__(self, app: Blueprint | Flask, *args, **kwargs):
+        import logging
+        import os
+
         kwargs.setdefault("authorizations", self._authorizations)
         kwargs.setdefault("security", "Bearer")
-        kwargs["add_specs"] = dify_config.SWAGGER_UI_ENABLED
-        kwargs["doc"] = dify_config.SWAGGER_UI_PATH if dify_config.SWAGGER_UI_ENABLED else False
+
+        # Security: Use computed swagger_ui_enabled which respects DEPLOY_ENV
+        swagger_enabled = dify_config.swagger_ui_enabled
+        kwargs["add_specs"] = swagger_enabled
+        kwargs["doc"] = dify_config.SWAGGER_UI_PATH if swagger_enabled else False
 
         # manual separate call on construction and init_app to ensure configs in kwargs effective
         super().__init__(app=None, *args, **kwargs)
         self.init_app(app, **kwargs)
         register_external_error_handlers(self)
+
+        # Security: Log warning when Swagger is enabled in production environment
+        deploy_env = os.environ.get("DEPLOY_ENV", "PRODUCTION")
+        if swagger_enabled and deploy_env.upper() == "PRODUCTION":
+            logger = logging.getLogger(__name__)
+            logger.warning(
+                "SECURITY WARNING: Swagger UI is ENABLED in PRODUCTION environment. "
+                "This may expose sensitive API documentation. "
+                "Set SWAGGER_UI_ENABLED=false or remove the explicit setting to disable."
+            )

api/libs/helper.py

@@ -184,7 +184,7 @@ def timezone(timezone_string):
 def convert_datetime_to_date(field, target_timezone: str = ":tz"):
     if dify_config.DB_TYPE == "postgresql":
         return f"DATE(DATE_TRUNC('day', {field} AT TIME ZONE 'UTC' AT TIME ZONE {target_timezone}))"
-    elif dify_config.DB_TYPE in ["mysql", "oceanbase", "seekdb"]:
+    elif dify_config.DB_TYPE == "mysql":
         return f"DATE(CONVERT_TZ({field}, 'UTC', {target_timezone}))"
     else:
         raise NotImplementedError(f"Unsupported database type: {dify_config.DB_TYPE}")

api/migrations/versions/2025_11_18_1400-a7b4e8f2c9d1_add_enduser_authentication_provider.py

@@ -1,71 +0,0 @@
-"""add enduser authentication provider
-
-Revision ID: a7b4e8f2c9d1
-Revises: fecff1c3da27
-Create Date: 2025-11-18 14:00:00.000000
-
-"""
-import models as models
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "a7b4e8f2c9d1"
-down_revision = "fecff1c3da27"
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.create_table(
-        "tool_enduser_authentication_providers",
-        sa.Column(
-            "id",
-            models.types.StringUUID(),
-            nullable=False,
-        ),
-        sa.Column(
-            "name",
-            sa.String(length=256),
-            server_default="API KEY 1",
-            nullable=False,
-        ),
-        sa.Column("tenant_id", models.types.StringUUID(), nullable=False),
-        sa.Column("end_user_id", models.types.StringUUID(), nullable=False),
-        sa.Column("provider", sa.Text(), nullable=False),
-        sa.Column("encrypted_credentials", sa.Text(), default="", nullable=False),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            server_default=sa.func.current_timestamp(),
-            nullable=False,
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            server_default=sa.func.current_timestamp(),
-            nullable=False,
-        ),
-        sa.Column(
-            "credential_type",
-            sa.String(length=32),
-            server_default="api-key",
-            nullable=False,
-        ),
-        sa.Column("expires_at", sa.BigInteger(), server_default=sa.text("-1"), nullable=False),
-        sa.PrimaryKeyConstraint("id"),
-        sa.UniqueConstraint(
-            "end_user_id",
-            "provider",
-        ),
-    )
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_table("tool_enduser_authentication_providers")
-    # ### end Alembic commands ###
-
-

api/migrations/versions/2025_12_14_1418-3134f4e0620d_merge_heads.py

@@ -1,25 +0,0 @@
-"""merge_heads
-
-Revision ID: 3134f4e0620d
-Revises: d57accd375ae, a7b4e8f2c9d1
-Create Date: 2025-12-14 14:18:19.393720
-
-"""
-from alembic import op
-import models as models
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = '3134f4e0620d'
-down_revision = ('d57accd375ae', 'a7b4e8f2c9d1')
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    pass
-
-
-def downgrade():
-    pass

api/migrations/versions/2025_12_16_1817-03ea244985ce_add_type_column_not_null_default_tool.py

@@ -1,31 +0,0 @@
-"""add type column not null default tool
-
-Revision ID: 03ea244985ce
-Revises: d57accd375ae
-Create Date: 2025-12-16 18:17:12.193877
-
-"""
-from alembic import op
-import models as models
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision = '03ea244985ce'
-down_revision = 'd57accd375ae'
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    with op.batch_alter_table('pipeline_recommended_plugins', schema=None) as batch_op:
-        batch_op.add_column(sa.Column('type', sa.String(length=50), server_default=sa.text("'tool'"), nullable=False))
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    with op.batch_alter_table('pipeline_recommended_plugins', schema=None) as batch_op:
-        batch_op.drop_column('type')
-    # ### end Alembic commands ###

api/models/__init__.py

@@ -80,7 +80,6 @@ from .task import CeleryTask, CeleryTaskSet
 from .tools import (
     ApiToolProvider,
     BuiltinToolProvider,
-    EndUserAuthenticationProvider,
     ToolConversationVariables,
     ToolFile,
     ToolLabelBinding,
@@ -150,7 +149,6 @@ __all__ = [
     "DocumentSegment",
     "Embedding",
     "EndUser",
-    "EndUserAuthenticationProvider",
     "ExternalKnowledgeApis",
     "ExternalKnowledgeBindings",
     "IconType",

api/models/dataset.py

@@ -1532,7 +1532,6 @@ class PipelineRecommendedPlugin(TypeBase):
     )
     plugin_id: Mapped[str] = mapped_column(LongText, nullable=False)
     provider_name: Mapped[str] = mapped_column(LongText, nullable=False)
-    type: Mapped[str] = mapped_column(sa.String(50), nullable=False, server_default=sa.text("'tool'"))
     position: Mapped[int] = mapped_column(sa.Integer, nullable=False, default=0)
     active: Mapped[bool] = mapped_column(sa.Boolean, nullable=False, default=True)
     created_at: Mapped[datetime] = mapped_column(

api/models/tools.py

@@ -9,11 +9,9 @@ from deprecated import deprecated
 from sqlalchemy import ForeignKey, String, func
 from sqlalchemy.orm import Mapped, mapped_column
 
-from core.plugin.entities.plugin_daemon import CredentialType
 from core.tools.entities.common_entities import I18nObject
 from core.tools.entities.tool_bundle import ApiToolBundle
 from core.tools.entities.tool_entities import ApiProviderSchemaType, WorkflowToolParameterConfiguration
-from libs.uuid_utils import uuidv7
 
 from .base import TypeBase
 from .engine import db
@@ -117,59 +115,6 @@ class BuiltinToolProvider(TypeBase):
         return cast(dict[str, Any], json.loads(self.encrypted_credentials))
 
 
-class EndUserAuthenticationProvider(TypeBase):
-    """
-    This table stores the authentication credentials for end users in tools.
-    Mimics the BuiltinToolProvider structure but for end users instead of tenants.
-    """
-
-    __tablename__ = "tool_enduser_authentication_providers"
-    __table_args__ = (
-        sa.UniqueConstraint("end_user_id", "provider"),
-    )
-
-    # id of the authentication provider
-    id: Mapped[str] = mapped_column(StringUUID, primary_key=True, default=lambda: str(uuidv7()), init=False)
-    # id of the tenant
-    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
-    # id of the end user
-    end_user_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
-    # name of the tool provider
-    provider: Mapped[str] = mapped_column(LongText, nullable=False)
-    name: Mapped[str] = mapped_column(
-        String(256),
-        nullable=False,
-        default="API KEY 1",
-    )
-    # encrypted credentials for the end user
-    encrypted_credentials: Mapped[str] = mapped_column(LongText, nullable=False, default="")
-    created_at: Mapped[datetime] = mapped_column(
-        sa.DateTime, nullable=False, server_default=func.current_timestamp(), init=False
-    )
-    updated_at: Mapped[datetime] = mapped_column(
-        sa.DateTime,
-        nullable=False,
-        server_default=func.current_timestamp(),
-        onupdate=func.current_timestamp(),
-        init=False,
-    )
-    # credential type, e.g., "api-key", "oauth2"
-    credential_type: Mapped[CredentialType] = mapped_column(
-        String(32), nullable=False, default=CredentialType.API_KEY
-    )
-    # Unix timestamp in seconds since epoch (1970-01-01 UTC); -1 indicates no expiration
-    expires_at: Mapped[int] = mapped_column(sa.BigInteger, nullable=False, default=-1)
-
-    @property
-    def credentials(self) -> dict[str, Any]:
-        if not self.encrypted_credentials:
-            return {}
-        try:
-            return cast(dict[str, Any], json.loads(self.encrypted_credentials))
-        except json.JSONDecodeError:
-            return {}
-
-
 class ApiToolProvider(TypeBase):
     """
     The table stores the api providers.

api/services/rag_pipeline/rag_pipeline.py

@@ -1248,13 +1248,14 @@ class RagPipelineService:
             session.commit()
         return workflow_node_execution_db_model
 
-    def get_recommended_plugins(self, type: str) -> dict:
+    def get_recommended_plugins(self) -> dict:
         # Query active recommended plugins
-        query = db.session.query(PipelineRecommendedPlugin).where(PipelineRecommendedPlugin.active == True)
-        if type and type != "all":
-            query = query.where(PipelineRecommendedPlugin.type == type)
-
-        pipeline_recommended_plugins = query.order_by(PipelineRecommendedPlugin.position.asc()).all()
+        pipeline_recommended_plugins = (
+            db.session.query(PipelineRecommendedPlugin)
+            .where(PipelineRecommendedPlugin.active == True)
+            .order_by(PipelineRecommendedPlugin.position.asc())
+            .all()
+        )
 
         if not pipeline_recommended_plugins:
             return {

api/services/tools/app_auth_requirement_service.py

@@ -1,227 +0,0 @@
-import logging
-from typing import Any
-
-from sqlalchemy.orm import Session
-
-from core.tools.tool_manager import ToolManager
-from extensions.ext_database import db
-from models.workflow import Workflow
-from services.tools.enduser_auth_service import EndUserAuthService
-
-logger = logging.getLogger(__name__)
-
-
-class AppAuthRequirementService:
-    """
-    Service for analyzing authentication requirements in apps.
-    Examines workflow DSL to identify which providers need end-user authentication.
-    """
-
-    @staticmethod
-    def get_tool_auth_requirements(
-        app_id: str,
-        tenant_id: str,
-        provider_type: str | None = None,
-    ) -> list[dict[str, Any]]:
-        """
-        Get all authentication requirements for tools in an app.
-
-        :param app_id: The application ID
-        :param tenant_id: The tenant ID
-        :param provider_type: Optional filter by provider type (e.g., "tool")
-        :return: List of provider requirements
-        """
-        try:
-            # Get latest published workflow for the app
-            with Session(db.engine, autoflush=False) as session:
-                workflow = (
-                    session.query(Workflow)
-                    .filter_by(app_id=app_id, tenant_id=tenant_id)
-                    .order_by(Workflow.created_at.desc())
-                    .first()
-                )
-
-                if not workflow:
-                    return []
-
-                # Parse workflow graph to find tool nodes
-                graph = workflow.graph_dict
-                if not graph or "nodes" not in graph:
-                    return []
-
-                providers = []
-                seen_providers = set()
-
-                # Iterate through workflow nodes
-                for node in graph.get("nodes", []):
-                    node_data = node.get("data", {})
-                    node_type = node_data.get("type")
-
-                    # Check if it's a tool node
-                    if node_type == "tool":
-                        provider_id = node_data.get("provider_id")
-                        provider_name = node_data.get("provider_name")
-                        tool_name = node_data.get("tool_name")
-
-                        if not provider_id:
-                            continue
-
-                        # Avoid duplicates
-                        if provider_id in seen_providers:
-                            continue
-
-                        seen_providers.add(provider_id)
-
-                        # Get provider controller to check authentication requirements
-                        try:
-                            provider_controller = ToolManager.get_builtin_provider(provider_id, tenant_id)
-
-                            # Check if provider needs credentials
-                            if not provider_controller.need_credentials:
-                                continue
-
-                            # Get supported credential types
-                            supported_types = provider_controller.get_supported_credential_types()
-
-                            # Determine required credential type (prefer OAuth if supported)
-                            required_type = None
-                            if supported_types:
-                                # Prefer OAuth2, then API key
-                                from core.plugin.entities.plugin_daemon import CredentialType
-
-                                if CredentialType.OAUTH2 in supported_types:
-                                    required_type = "oauth2"
-                                elif CredentialType.API_KEY in supported_types:
-                                    required_type = "api-key"
-                                else:
-                                    required_type = supported_types[0].value
-
-                            providers.append(
-                                {
-                                    "provider_id": provider_id,
-                                    "provider_name": provider_name or provider_id,
-                                    "supported_credential_types": [ct.value for ct in supported_types],
-                                    "required_credential_type": required_type,
-                                    "provider_type": "tool",
-                                    "feature_context": {
-                                        "node_ids": [node.get("id")],
-                                        "tool_names": [tool_name] if tool_name else [],
-                                    },
-                                }
-                            )
-                        except Exception as e:
-                            logger.warning("Error getting provider info for %s: %s", provider_id, e)
-                            continue
-
-                # Filter by provider_type if specified
-                if provider_type:
-                    providers = [p for p in providers if p.get("provider_type") == provider_type]
-
-                return providers
-        except Exception:
-            logger.exception("Error getting auth requirements for app %s", app_id)
-            return []
-
-    @staticmethod
-    def get_required_providers(
-        tenant_id: str,
-        app_id: str,
-    ) -> list[dict[str, Any]]:
-        """
-        Get list of providers that require end-user authentication for an app.
-        Simplified version of get_tool_auth_requirements for API use.
-
-        :param tenant_id: The tenant ID
-        :param app_id: The application ID
-        :return: List of provider information dictionaries
-        """
-        requirements = AppAuthRequirementService.get_tool_auth_requirements(
-            app_id=app_id,
-            tenant_id=tenant_id,
-        )
-
-        # Transform to simpler format for API response
-        return [
-            {
-                "provider_id": req["provider_id"],
-                "provider_name": req["provider_name"],
-                "credential_type": req["required_credential_type"],
-                "is_required": True,
-                "oauth_config": None if req["required_credential_type"] != "oauth2" else {
-                    "supported_types": req["supported_credential_types"],
-                },
-            }
-            for req in requirements
-        ]
-
-    @staticmethod
-    def get_auth_status(
-        app_id: str,
-        end_user_id: str,
-        tenant_id: str,
-    ) -> dict[str, Any]:
-        """
-        Get overall authentication status for an app and end user.
-        Shows which providers are authenticated and which need authentication.
-
-        :param app_id: The application ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :return: Dict with authentication status for all providers
-        """
-        try:
-            # Get required providers for this app
-            required_providers = AppAuthRequirementService.get_tool_auth_requirements(app_id, tenant_id)
-
-            # Check authentication status for each provider
-            provider_statuses = []
-            for provider_info in required_providers:
-                provider_id = provider_info["provider_id"]
-
-                # Get credentials for this provider
-                credentials = EndUserAuthService.list_credentials(tenant_id, end_user_id, provider_id)
-
-                # Build status
-                provider_status = {
-                    "provider_id": provider_id,
-                    "provider_name": provider_info["provider_name"],
-                    "provider_type": provider_info["provider_type"],
-                    "authenticated": len(credentials) > 0,
-                    "credentials": [
-                        {
-                            "credential_id": cred.id,
-                            "name": cred.name,
-                            "type": cred.credential_type.value,
-                            "is_default": cred.is_default,
-                            "expires_at": cred.expires_at,
-                        }
-                        for cred in credentials
-                    ],
-                }
-
-                provider_statuses.append(provider_status)
-
-            return {"providers": provider_statuses}
-        except Exception:
-            logger.exception("Error getting auth status for app %s", app_id)
-            return {"providers": []}
-
-    @staticmethod
-    def is_provider_authenticated(
-        provider_id: str,
-        end_user_id: str,
-        tenant_id: str,
-    ) -> bool:
-        """
-        Check if a specific provider is authenticated for an end user.
-
-        :param provider_id: The provider identifier
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :return: True if authenticated, False otherwise
-        """
-        try:
-            credentials = EndUserAuthService.list_credentials(tenant_id, end_user_id, provider_id)
-            return len(credentials) > 0
-        except Exception:
-            return False

api/services/tools/enduser_auth_service.py

@@ -1,558 +0,0 @@
-import json
-import logging
-
-from sqlalchemy import exists, select
-from sqlalchemy.orm import Session
-
-from constants import HIDDEN_VALUE, UNKNOWN_VALUE
-from core.helper.name_generator import generate_incremental_name
-from core.helper.provider_cache import NoOpProviderCredentialCache
-from core.plugin.entities.plugin_daemon import CredentialType
-from core.tools.entities.api_entities import ToolProviderCredentialApiEntity
-from core.tools.tool_manager import ToolManager
-from core.tools.utils.encryption import create_provider_encrypter
-from extensions.ext_database import db
-from extensions.ext_redis import redis_client
-from models.tools import EndUserAuthenticationProvider
-from services.tools.tools_transform_service import ToolTransformService
-
-logger = logging.getLogger(__name__)
-
-
-class EndUserAuthService:
-    """
-    Service for managing end-user authentication credentials.
-    Follows similar patterns to BuiltinToolManageService but for end users.
-    """
-
-    __MAX_CREDENTIALS_PER_PROVIDER__ = 100
-
-    @staticmethod
-    def list_credentials(
-        tenant_id: str, end_user_id: str, provider_id: str
-    ) -> list[ToolProviderCredentialApiEntity]:
-        """
-        List all credentials for a specific provider and end user.
-
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param provider_id: The provider identifier
-        :return: List of credential entities
-        """
-        with Session(db.engine, autoflush=False) as session:
-            credentials = (
-                session.query(EndUserAuthenticationProvider)
-                .filter_by(end_user_id=end_user_id, tenant_id=tenant_id, provider=provider_id)
-                .order_by(EndUserAuthenticationProvider.created_at.asc())
-                .all()
-            )
-
-            if not credentials:
-                return []
-
-            # Get provider controller to access credential schema
-            provider_controller = ToolManager.get_builtin_provider(provider_id, tenant_id)
-
-            result: list[ToolProviderCredentialApiEntity] = []
-            for credential in credentials:
-                try:
-                    # Create encrypter for masking credentials
-                    encrypter, _ = EndUserAuthService._create_encrypter(
-                        tenant_id, provider_controller, credential.credential_type
-                    )
-
-                    # Decrypt and mask credentials
-                    decrypted = encrypter.decrypt(credential.credentials)
-                    masked_credentials = encrypter.mask_plugin_credentials(decrypted)
-
-                    # Convert to API entity
-                    credential_entity = ToolTransformService.convert_enduser_provider_to_credential_entity(
-                        provider=credential,
-                        credentials=dict(masked_credentials),
-                    )
-                    result.append(credential_entity)
-                except Exception:
-                    logger.exception("Error processing credential %s", credential.id)
-                    continue
-
-            return result
-
-    @staticmethod
-    def get_credential(
-        credential_id: str, end_user_id: str, tenant_id: str, mask_credentials: bool = True
-    ) -> ToolProviderCredentialApiEntity | None:
-        """
-        Get a specific credential by ID.
-
-        :param credential_id: The credential ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param mask_credentials: Whether to mask secret fields
-        :return: Credential entity or None
-        """
-        with Session(db.engine, autoflush=False) as session:
-            credential = (
-                session.query(EndUserAuthenticationProvider)
-                .filter_by(id=credential_id, end_user_id=end_user_id, tenant_id=tenant_id)
-                .first()
-            )
-
-            if not credential:
-                return None
-
-            # Get provider controller
-            provider_controller = ToolManager.get_builtin_provider(credential.provider, tenant_id)
-
-            # Create encrypter
-            encrypter, _ = EndUserAuthService._create_encrypter(
-                tenant_id, provider_controller, credential.credential_type
-            )
-
-            # Decrypt credentials
-            decrypted = encrypter.decrypt(credential.credentials)
-
-            # Mask if requested
-            if mask_credentials:
-                decrypted = encrypter.mask_plugin_credentials(decrypted)
-
-            # Convert to API entity
-            return ToolTransformService.convert_enduser_provider_to_credential_entity(
-                provider=credential,
-                credentials=dict(decrypted),
-            )
-
-    @staticmethod
-    def create_api_key_credential(
-        tenant_id: str,
-        end_user_id: str,
-        provider_id: str,
-        credentials: dict,
-        name: str | None = None,
-    ) -> ToolProviderCredentialApiEntity:
-        """
-        Create a new API key credential for an end user.
-
-        :param tenant_id: The tenant ID
-        :param end_user_id: The end user ID
-        :param provider_id: The provider identifier
-        :param credentials: The credential data
-        :param name: Optional custom name
-        :return: Created credential entity
-        """
-        with Session(db.engine) as session:
-            try:
-                lock = f"enduser_credential_create_lock:{end_user_id}_{provider_id}"
-                with redis_client.lock(lock, timeout=20):
-                    # Get provider controller
-                    provider_controller = ToolManager.get_builtin_provider(provider_id, tenant_id)
-                    if not provider_controller.need_credentials:
-                        raise ValueError(f"Provider {provider_id} does not need credentials")
-
-                    # Check credential count
-                    credential_count = (
-                        session.query(EndUserAuthenticationProvider)
-                        .filter_by(end_user_id=end_user_id, tenant_id=tenant_id, provider=provider_id)
-                        .count()
-                    )
-
-                    if credential_count >= EndUserAuthService.__MAX_CREDENTIALS_PER_PROVIDER__:
-                        raise ValueError(
-                            f"Maximum number of credentials ({EndUserAuthService.__MAX_CREDENTIALS_PER_PROVIDER__}) "
-                            f"reached for provider {provider_id}"
-                        )
-
-                    # Validate credentials
-                    credential_type = CredentialType.API_KEY
-                    if CredentialType.of(credential_type).is_validate_allowed():
-                        provider_controller.validate_credentials(end_user_id, credentials)
-
-                    # Generate name if not provided
-                    if name is None or name == "":
-                        name = EndUserAuthService._generate_credential_name(
-                            session=session,
-                            end_user_id=end_user_id,
-                            tenant_id=tenant_id,
-                            provider=provider_id,
-                            credential_type=credential_type,
-                        )
-                    else:
-                        # Validate name length
-                        if len(name) > 30:
-                            raise ValueError("Credential name must be 30 characters or less")
-
-                        # Check if name is already used
-                        if session.scalar(
-                            select(
-                                exists().where(
-                                    EndUserAuthenticationProvider.end_user_id == end_user_id,
-                                    EndUserAuthenticationProvider.tenant_id == tenant_id,
-                                    EndUserAuthenticationProvider.provider == provider_id,
-                                    EndUserAuthenticationProvider.name == name,
-                                )
-                            )
-                        ):
-                            raise ValueError(f"The credential name '{name}' is already used")
-
-                    # Create encrypter
-                    encrypter, _ = EndUserAuthService._create_encrypter(
-                        tenant_id, provider_controller, credential_type
-                    )
-
-                    # Create credential record
-                    db_credential = EndUserAuthenticationProvider(
-                        tenant_id=tenant_id,
-                        end_user_id=end_user_id,
-                        provider=provider_id,
-                        encrypted_credentials=json.dumps(encrypter.encrypt(credentials)),
-                        credential_type=credential_type,
-                        name=name,
-                        expires_at=-1,  # API keys don't expire
-                    )
-
-                    session.add(db_credential)
-                    session.commit()
-                    session.refresh(db_credential)
-
-                    # Return masked credentials
-                    masked_credentials = encrypter.mask_plugin_credentials(credentials)
-                    return ToolTransformService.convert_enduser_provider_to_credential_entity(
-                        provider=db_credential,
-                        credentials=dict(masked_credentials),
-                    )
-            except Exception as e:
-                session.rollback()
-                logger.exception("Error creating API key credential")
-                raise ValueError(str(e))
-
-    @staticmethod
-    def create_oauth_credential(
-        end_user_id: str,
-        tenant_id: str,
-        provider: str,
-        credentials: dict,
-        expires_at: int = -1,
-        name: str | None = None,
-    ) -> EndUserAuthenticationProvider:
-        """
-        Create a new OAuth credential for an end user.
-        Used internally by OAuth callback handler.
-
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param provider: The provider identifier
-        :param credentials: The OAuth credentials (access_token, refresh_token, etc.)
-        :param expires_at: Unix timestamp when token expires (-1 for no expiry)
-        :param name: Optional custom name
-        :return: Created credential record
-        """
-        with Session(db.engine) as session:
-            try:
-                lock = f"enduser_credential_create_lock:{end_user_id}_{provider}"
-                with redis_client.lock(lock, timeout=20):
-                    # Get provider controller
-                    provider_controller = ToolManager.get_builtin_provider(provider, tenant_id)
-
-                    # Check credential count
-                    credential_count = (
-                        session.query(EndUserAuthenticationProvider)
-                        .filter_by(end_user_id=end_user_id, tenant_id=tenant_id, provider=provider)
-                        .count()
-                    )
-
-                    if credential_count >= EndUserAuthService.__MAX_CREDENTIALS_PER_PROVIDER__:
-                        raise ValueError(
-                            f"Maximum number of credentials ({EndUserAuthService.__MAX_CREDENTIALS_PER_PROVIDER__}) "
-                            f"reached for provider {provider}"
-                        )
-
-                    # Generate name if not provided
-                    credential_type = CredentialType.OAUTH2
-                    if name is None or name == "":
-                        name = EndUserAuthService._generate_credential_name(
-                            session=session,
-                            end_user_id=end_user_id,
-                            tenant_id=tenant_id,
-                            provider=provider,
-                            credential_type=credential_type,
-                        )
-
-                    # Create encrypter
-                    encrypter, _ = EndUserAuthService._create_encrypter(
-                        tenant_id, provider_controller, credential_type
-                    )
-
-                    # Create credential record
-                    db_credential = EndUserAuthenticationProvider(
-                        tenant_id=tenant_id,
-                        end_user_id=end_user_id,
-                        provider=provider,
-                        encrypted_credentials=json.dumps(encrypter.encrypt(credentials)),
-                        credential_type=credential_type,
-                        name=name,
-                        expires_at=expires_at,
-                    )
-
-                    session.add(db_credential)
-                    session.commit()
-                    session.refresh(db_credential)
-
-                    return db_credential
-            except Exception as e:
-                session.rollback()
-                logger.exception("Error creating OAuth credential")
-                raise ValueError(str(e))
-
-    @staticmethod
-    def update_credential(
-        credential_id: str,
-        end_user_id: str,
-        tenant_id: str,
-        credentials: dict | None = None,
-        name: str | None = None,
-    ) -> ToolProviderCredentialApiEntity:
-        """
-        Update an existing credential (API key only).
-
-        :param credential_id: The credential ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param credentials: Updated credentials (optional)
-        :param name: Updated name (optional)
-        :return: Updated credential entity
-        """
-        with Session(db.engine) as session:
-            try:
-                # Get credential
-                db_credential = (
-                    session.query(EndUserAuthenticationProvider)
-                    .filter_by(id=credential_id, end_user_id=end_user_id, tenant_id=tenant_id)
-                    .first()
-                )
-
-                if not db_credential:
-                    raise ValueError(f"Credential {credential_id} not found")
-
-                # Only API key credentials can be updated
-                if not CredentialType.of(db_credential.credential_type).is_editable():
-                    raise ValueError("Only API key credentials can be updated via this endpoint")
-
-                # At least one field must be provided
-                if credentials is None and name is None:
-                    raise ValueError("At least one field (credentials or name) must be provided")
-
-                # Get provider controller
-                provider_controller = ToolManager.get_builtin_provider(db_credential.provider, tenant_id)
-
-                # Create encrypter
-                encrypter, _ = EndUserAuthService._create_encrypter(
-                    tenant_id, provider_controller, db_credential.credential_type
-                )
-
-                # Update credentials if provided
-                if credentials:
-                    # Decrypt original credentials
-                    original_credentials = encrypter.decrypt(db_credential.credentials)
-
-                    # Merge with new credentials, keeping hidden values
-                    new_credentials: dict = {
-                        key: value if value != HIDDEN_VALUE else original_credentials.get(key, UNKNOWN_VALUE)
-                        for key, value in credentials.items()
-                    }
-
-                    # Validate new credentials
-                    if CredentialType.of(db_credential.credential_type).is_validate_allowed():
-                        provider_controller.validate_credentials(end_user_id, new_credentials)
-
-                    # Encrypt and save
-                    db_credential.encrypted_credentials = json.dumps(encrypter.encrypt(new_credentials))
-
-                # Update name if provided
-                if name and name != db_credential.name:
-                    # Validate name length
-                    if len(name) > 30:
-                        raise ValueError("Credential name must be 30 characters or less")
-
-                    # Check if name is already used
-                    if session.scalar(
-                        select(
-                            exists().where(
-                                EndUserAuthenticationProvider.end_user_id == end_user_id,
-                                EndUserAuthenticationProvider.tenant_id == tenant_id,
-                                EndUserAuthenticationProvider.provider == db_credential.provider,
-                                EndUserAuthenticationProvider.name == name,
-                            )
-                        )
-                    ):
-                        raise ValueError(f"The credential name '{name}' is already used")
-
-                    db_credential.name = name
-
-                session.commit()
-                session.refresh(db_credential)
-
-                # Return masked credentials
-                decrypted = encrypter.decrypt(db_credential.credentials)
-                masked_credentials = encrypter.mask_plugin_credentials(decrypted)
-
-                return ToolTransformService.convert_enduser_provider_to_credential_entity(
-                    provider=db_credential,
-                    credentials=dict(masked_credentials),
-                )
-            except Exception as e:
-                session.rollback()
-                logger.exception("Error updating credential")
-                raise ValueError(str(e))
-
-    @staticmethod
-    def delete_credential(
-        tenant_id: str, end_user_id: str, provider_id: str, credential_id: str
-    ) -> bool:
-        """
-        Delete a credential.
-
-        :param credential_id: The credential ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :return: True if deleted successfully
-        """
-        with Session(db.engine) as session:
-            credential = (
-                session.query(EndUserAuthenticationProvider)
-                .filter_by(id=credential_id, end_user_id=end_user_id, tenant_id=tenant_id)
-                .first()
-            )
-
-            if not credential:
-                raise ValueError(f"Credential {credential_id} not found")
-
-            session.delete(credential)
-            session.commit()
-            return True
-
-    @staticmethod
-    def refresh_oauth_token(
-        credential_id: str, end_user_id: str, tenant_id: str, refreshed_credentials: dict, expires_at: int
-    ) -> EndUserAuthenticationProvider:
-        """
-        Update OAuth credentials after token refresh.
-
-        :param credential_id: The credential ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param refreshed_credentials: New credentials from OAuth refresh
-        :param expires_at: New expiration timestamp
-        :return: Updated credential record
-        """
-        with Session(db.engine) as session:
-            try:
-                credential = (
-                    session.query(EndUserAuthenticationProvider)
-                    .filter_by(id=credential_id, end_user_id=end_user_id, tenant_id=tenant_id)
-                    .first()
-                )
-
-                if not credential:
-                    raise ValueError(f"Credential {credential_id} not found")
-
-                if credential.credential_type != CredentialType.OAUTH2:
-                    raise ValueError("Only OAuth credentials can be refreshed")
-
-                # Get provider controller
-                provider_controller = ToolManager.get_builtin_provider(credential.provider, tenant_id)
-
-                # Create encrypter
-                encrypter, _ = EndUserAuthService._create_encrypter(
-                    tenant_id, provider_controller, credential.credential_type
-                )
-
-                # Encrypt and save new credentials
-                credential.encrypted_credentials = json.dumps(encrypter.encrypt(refreshed_credentials))
-                credential.expires_at = expires_at
-
-                session.commit()
-                session.refresh(credential)
-
-                return credential
-            except Exception as e:
-                session.rollback()
-                logger.exception("Error refreshing OAuth token")
-                raise ValueError(str(e))
-
-    @staticmethod
-    def get_default_credential(
-        end_user_id: str, tenant_id: str, provider: str
-    ) -> EndUserAuthenticationProvider | None:
-        """
-        Get the default (oldest) credential for a provider.
-
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param provider: The provider identifier
-        :return: Credential record or None
-        """
-        with Session(db.engine, autoflush=False) as session:
-            return (
-                session.query(EndUserAuthenticationProvider)
-                .filter_by(end_user_id=end_user_id, tenant_id=tenant_id, provider=provider)
-                .order_by(EndUserAuthenticationProvider.created_at.asc())
-                .first()
-            )
-
-    @staticmethod
-    def _generate_credential_name(
-        session: Session,
-        end_user_id: str,
-        tenant_id: str,
-        provider: str,
-        credential_type: CredentialType,
-    ) -> str:
-        """
-        Generate a unique credential name.
-
-        :param session: Database session
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param provider: The provider identifier
-        :param credential_type: The credential type
-        :return: Generated name (e.g., "API KEY 1", "AUTH 1")
-        """
-        existing_credentials = (
-            session.query(EndUserAuthenticationProvider)
-            .filter_by(
-                end_user_id=end_user_id,
-                tenant_id=tenant_id,
-                provider=provider,
-                credential_type=credential_type,
-            )
-            .order_by(EndUserAuthenticationProvider.created_at.desc())
-            .all()
-        )
-
-        return generate_incremental_name(
-            [credential.name for credential in existing_credentials],
-            f"{credential_type.get_name()}",
-        )
-
-    @staticmethod
-    def _create_encrypter(
-        tenant_id: str, provider_controller, credential_type: CredentialType | str
-    ) -> tuple:
-        """
-        Create an encrypter for credential encryption/decryption.
-
-        :param tenant_id: The tenant ID
-        :param provider_controller: The provider controller
-        :param credential_type: The credential type
-        :return: Tuple of (encrypter, cache)
-        """
-        if isinstance(credential_type, str):
-            credential_type = CredentialType.of(credential_type)
-
-        return create_provider_encrypter(
-            tenant_id=tenant_id,
-            config=[
-                x.to_basic_provider_config()
-                for x in provider_controller.get_credentials_schema_by_type(credential_type)
-            ],
-            cache=NoOpProviderCredentialCache(),
-        )

api/services/tools/enduser_oauth_service.py

@@ -1,264 +0,0 @@
-import logging
-from typing import Any
-
-from werkzeug import Request
-
-from configs import dify_config
-from core.plugin.entities.plugin_daemon import CredentialType
-from core.plugin.impl.oauth import OAuthHandler
-from core.tools.tool_manager import ToolManager
-from models.provider_ids import ToolProviderID
-from services.plugin.oauth_service import OAuthProxyService
-from services.tools.builtin_tools_manage_service import BuiltinToolManageService
-from services.tools.enduser_auth_service import EndUserAuthService
-
-logger = logging.getLogger(__name__)
-
-
-class EndUserOAuthService:
-    """
-    Service for managing end-user OAuth authentication flows.
-    Reuses existing OAuthProxyService and OAuthHandler infrastructure.
-    """
-
-    @staticmethod
-    def get_authorization_url(
-        end_user_id: str,
-        tenant_id: str,
-        app_id: str,
-        provider: str,
-    ) -> dict[str, str]:
-        """
-        Initiate OAuth authorization flow for an end user.
-
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :param app_id: The application ID
-        :param provider: The provider identifier
-        :return: Dict with authorization_url
-        """
-        try:
-            # Get OAuth client configuration (reuse workspace-level logic)
-            oauth_client = BuiltinToolManageService.get_oauth_client(tenant_id, provider)
-            if not oauth_client:
-                raise ValueError(f"OAuth client not configured for provider {provider}")
-
-            # Get provider controller
-            provider_controller = ToolManager.get_builtin_provider(provider, tenant_id)
-            tool_provider_id = ToolProviderID(provider)
-
-            # Create OAuth context with end-user specific data
-            context_id = OAuthProxyService.create_proxy_context(
-                user_id=end_user_id,  # Using end_user_id as user_id
-                tenant_id=tenant_id,
-                plugin_id=tool_provider_id.plugin_id,
-                provider=tool_provider_id.provider_name,
-                extra_data={
-                    "app_id": app_id,
-                    "provider_type": "tool",  # For now, only tools support end-user auth
-                },
-            )
-
-            # Use the same redirect URI as workspace OAuth to reuse the same OAuth client
-            redirect_uri = f"{dify_config.CONSOLE_API_URL}/console/api/oauth/plugin/{tool_provider_id}/tool/callback"
-
-            # Get authorization URL from OAuth handler
-            oauth_handler = OAuthHandler()
-            response = oauth_handler.get_authorization_url(
-                tenant_id=tenant_id,
-                user_id=end_user_id,
-                plugin_id=tool_provider_id.plugin_id,
-                provider=tool_provider_id.provider_name,
-                redirect_uri=redirect_uri,
-                system_credentials=oauth_client,
-            )
-
-            return {
-                "authorization_url": response.authorization_url,
-                "context_id": context_id,  # Return for setting cookie
-            }
-        except Exception as e:
-            logger.exception("Error getting authorization URL for end user")
-            raise ValueError(f"Failed to initiate OAuth flow: {str(e)}")
-
-    @staticmethod
-    def handle_oauth_callback(
-        context_id: str,
-        request: Request,
-    ) -> dict[str, Any]:
-        """
-        Handle OAuth callback and create credential.
-
-        :param context_id: The OAuth context ID from cookie
-        :param request: The callback request with authorization code
-        :return: Dict with credential information
-        """
-        try:
-            # Validate and retrieve context
-            context = OAuthProxyService.use_proxy_context(context_id)
-
-            # Extract context data
-            end_user_id = context.get("user_id")  # user_id is actually end_user_id
-            tenant_id = context.get("tenant_id")
-            app_id = context.get("app_id")
-            plugin_id = context.get("plugin_id")
-            provider = context.get("provider")
-
-            if not all([end_user_id, tenant_id, app_id, plugin_id, provider]):
-                raise ValueError("Invalid OAuth context: missing required fields")
-
-            # Reconstruct full provider ID
-            full_provider = f"{plugin_id}/{provider}" if plugin_id != "langgenius" else provider
-
-            # Get OAuth client configuration
-            oauth_client = BuiltinToolManageService.get_oauth_client(tenant_id, full_provider)
-            if not oauth_client:
-                raise ValueError(f"OAuth client not configured for provider {full_provider}")
-
-            # Use the same redirect URI as workspace OAuth (must match authorization request)
-            redirect_uri = f"{dify_config.CONSOLE_API_URL}/console/api/oauth/plugin/{full_provider}/tool/callback"
-
-            # Exchange authorization code for credentials
-            oauth_handler = OAuthHandler()
-            credentials_response = oauth_handler.get_credentials(
-                tenant_id=tenant_id,
-                user_id=end_user_id,
-                plugin_id=plugin_id,
-                provider=provider,
-                redirect_uri=redirect_uri,
-                system_credentials=oauth_client,
-                request=request,
-            )
-
-            # Calculate expiration timestamp
-            expires_at = -1
-            if credentials_response.expires_in and credentials_response.expires_in > 0:
-                import time
-
-                expires_at = int(time.time()) + credentials_response.expires_in
-
-            # Create credential in database
-            credential = EndUserAuthService.create_oauth_credential(
-                end_user_id=end_user_id,
-                tenant_id=tenant_id,
-                provider=full_provider,
-                credentials=credentials_response.credentials,
-                expires_at=expires_at,
-            )
-
-            return {
-                "success": True,
-                "credential_id": credential.id,
-                "provider": full_provider,
-                "app_id": app_id,
-            }
-        except Exception as e:
-            logger.exception("Error handling OAuth callback for end user")
-            raise ValueError(f"Failed to complete OAuth flow: {str(e)}")
-
-    @staticmethod
-    def refresh_oauth_token(
-        credential_id: str,
-        end_user_id: str,
-        tenant_id: str,
-    ) -> dict[str, Any]:
-        """
-        Refresh an expired OAuth token.
-
-        :param credential_id: The credential ID
-        :param end_user_id: The end user ID
-        :param tenant_id: The tenant ID
-        :return: Dict with refresh status
-        """
-        try:
-            # Get existing credential
-            credential = EndUserAuthService.get_credential(
-                credential_id=credential_id,
-                end_user_id=end_user_id,
-                tenant_id=tenant_id,
-                mask_credentials=False,  # Need full credentials for refresh
-            )
-
-            if not credential:
-                raise ValueError(f"Credential {credential_id} not found")
-
-            if credential.credential_type != CredentialType.OAUTH2:
-                raise ValueError("Only OAuth credentials can be refreshed")
-
-            # Get OAuth client configuration
-            oauth_client = BuiltinToolManageService.get_oauth_client(tenant_id, credential.provider)
-            if not oauth_client:
-                raise ValueError(f"OAuth client not configured for provider {credential.provider}")
-
-            # Get provider info
-            tool_provider_id = ToolProviderID(credential.provider)
-            # Use the same redirect URI as workspace OAuth to reuse the same OAuth client
-            redirect_uri = f"{dify_config.CONSOLE_API_URL}/console/api/oauth/plugin/{credential.provider}/tool/callback"
-
-            # Refresh credentials via OAuth handler
-            oauth_handler = OAuthHandler()
-            refreshed_response = oauth_handler.refresh_credentials(
-                tenant_id=tenant_id,
-                user_id=end_user_id,
-                plugin_id=tool_provider_id.plugin_id,
-                provider=tool_provider_id.provider_name,
-                redirect_uri=redirect_uri,
-                system_credentials=oauth_client,
-                credentials=credential.credentials,
-            )
-
-            # Calculate new expiration timestamp
-            expires_at = -1
-            if refreshed_response.expires_in and refreshed_response.expires_in > 0:
-                import time
-
-                expires_at = int(time.time()) + refreshed_response.expires_in
-
-            # Update credential in database
-            updated_credential = EndUserAuthService.refresh_oauth_token(
-                credential_id=credential_id,
-                end_user_id=end_user_id,
-                tenant_id=tenant_id,
-                refreshed_credentials=refreshed_response.credentials,
-                expires_at=expires_at,
-            )
-
-            return {
-                "success": True,
-                "credential_id": updated_credential.id,
-                "expires_at": expires_at,
-                "refreshed_at": int(updated_credential.updated_at.timestamp()),
-            }
-        except Exception:
-            logger.exception("Error refreshing OAuth token for end user")
-            return {
-                "success": False,
-                "error": "Failed to refresh token",
-            }
-
-    @staticmethod
-    def get_oauth_client_info(tenant_id: str, provider: str) -> dict[str, Any]:
-        """
-        Get OAuth client information for a provider.
-        Used to check if OAuth is available and configured.
-
-        :param tenant_id: The tenant ID
-        :param provider: The provider identifier
-        :return: Dict with OAuth client info
-        """
-        try:
-            # Check if OAuth client exists (either system or custom)
-            oauth_client = BuiltinToolManageService.get_oauth_client(tenant_id, provider)
-
-            return {
-                "configured": oauth_client is not None,
-                "system_configured": BuiltinToolManageService.is_oauth_system_client_exists(provider),
-                "custom_configured": BuiltinToolManageService.is_oauth_custom_client_enabled(tenant_id, provider),
-            }
-        except Exception:
-            logger.exception("Error getting OAuth client info")
-            return {
-                "configured": False,
-                "system_configured": False,
-                "custom_configured": False,
-            }

api/services/tools/tools_transform_service.py

@@ -426,27 +426,6 @@ class ToolTransformService:
             credentials=credentials,
         )
 
-    @staticmethod
-    def convert_enduser_provider_to_credential_entity(
-        provider, credentials: dict
-    ) -> ToolProviderCredentialApiEntity:
-        """
-        Convert EndUserAuthenticationProvider to ToolProviderCredentialApiEntity.
-
-        :param provider: EndUserAuthenticationProvider instance
-        :param credentials: Decrypted/masked credentials dict
-        :return: ToolProviderCredentialApiEntity
-        """
-        return ToolProviderCredentialApiEntity(
-            id=provider.id,
-            name=provider.name,
-            provider=provider.provider,
-            credential_type=CredentialType.of(provider.credential_type),
-            is_default=False,  # End-user credentials don't have default flag (use oldest)
-            credentials=credentials,
-            expires_at=provider.expires_at,
-        )
-
     @staticmethod
     def convert_mcp_schema_to_parameter(schema: dict[str, Any]) -> list["ToolParameter"]:
         """

api/services/trigger/webhook_service.py

@@ -33,11 +33,6 @@ from services.errors.app import QuotaExceededError
 from services.trigger.app_trigger_service import AppTriggerService
 from services.workflow.entities import WebhookTriggerData
 
-try:
-    import magic
-except ImportError:
-    magic = None  # type: ignore[assignment]
-
 logger = logging.getLogger(__name__)
 
 
@@ -322,8 +317,7 @@ class WebhookService:
         try:
             file_content = request.get_data()
             if file_content:
-                mimetype = cls._detect_binary_mimetype(file_content)
-                file_obj = cls._create_file_from_binary(file_content, mimetype, webhook_trigger)
+                file_obj = cls._create_file_from_binary(file_content, "application/octet-stream", webhook_trigger)
                 return {"raw": file_obj.to_dict()}, {}
             else:
                 return {"raw": None}, {}
@@ -347,18 +341,6 @@ class WebhookService:
             body = {"raw": ""}
         return body, {}
 
-    @staticmethod
-    def _detect_binary_mimetype(file_content: bytes) -> str:
-        """Guess MIME type for binary payloads using python-magic when available."""
-        if magic is not None:
-            try:
-                detected = magic.from_buffer(file_content[:1024], mime=True)
-                if detected:
-                    return detected
-            except Exception:
-                logger.debug("python-magic detection failed for octet-stream payload")
-        return "application/octet-stream"
-
     @classmethod
     def _process_file_uploads(
         cls, files: Mapping[str, FileStorage], webhook_trigger: WorkflowWebhookTrigger

api/services/variable_truncator.py

@@ -410,12 +410,9 @@ class VariableTruncator(BaseTruncator):
     @overload
     def _truncate_json_primitives(self, val: None, target_size: int) -> _PartResult[None]: ...
 
-    @overload
-    def _truncate_json_primitives(self, val: File, target_size: int) -> _PartResult[File]: ...
-
     def _truncate_json_primitives(
         self,
-        val: UpdatedVariable | File | str | list[object] | dict[str, object] | bool | int | float | None,
+        val: UpdatedVariable | str | list[object] | dict[str, object] | bool | int | float | None,
         target_size: int,
     ) -> _PartResult[Any]:
         """Truncate a value within an object to fit within budget."""
@@ -428,9 +425,6 @@ class VariableTruncator(BaseTruncator):
             return self._truncate_array(val, target_size)
         elif isinstance(val, dict):
             return self._truncate_object(val, target_size)
-        elif isinstance(val, File):
-            # File objects should not be truncated, return as-is
-            return _PartResult(val, self.calculate_json_size(val), False)
         elif val is None or isinstance(val, (bool, int, float)):
             return _PartResult(val, self.calculate_json_size(val), False)
         else:

api/tests/test_containers_integration_tests/libs/broadcast_channel/redis/test_sharded_channel.py

@@ -113,31 +113,16 @@ class TestShardedRedisBroadcastChannelIntegration:
         topic = broadcast_channel.topic(topic_name)
         producer = topic.as_producer()
         subscriptions = [topic.subscribe() for _ in range(subscriber_count)]
-        ready_events = [threading.Event() for _ in range(subscriber_count)]
 
         def producer_thread():
-            deadline = time.time() + 5.0
-            for ev in ready_events:
-                remaining = deadline - time.time()
-                if remaining <= 0:
-                    break
-                if not ev.wait(timeout=max(0.0, remaining)):
-                    pytest.fail("subscriber did not become ready before publish deadline")
+            time.sleep(0.2)  # Allow all subscribers to connect
             producer.publish(message)
             time.sleep(0.2)
             for sub in subscriptions:
                 sub.close()
 
-        def consumer_thread(subscription: Subscription, ready_event: threading.Event) -> list[bytes]:
+        def consumer_thread(subscription: Subscription) -> list[bytes]:
             received_msgs = []
-            # Prime subscription so the underlying Pub/Sub listener thread starts before publishing
-            try:
-                _ = subscription.receive(0.01)
-            except SubscriptionClosedError:
-                return received_msgs
-            finally:
-                ready_event.set()
-
             while True:
                 try:
                     msg = subscription.receive(0.1)
@@ -152,10 +137,7 @@ class TestShardedRedisBroadcastChannelIntegration:
 
         with ThreadPoolExecutor(max_workers=subscriber_count + 1) as executor:
             producer_future = executor.submit(producer_thread)
-            consumer_futures = [
-                executor.submit(consumer_thread, subscription, ready_events[idx])
-                for idx, subscription in enumerate(subscriptions)
-            ]
+            consumer_futures = [executor.submit(consumer_thread, subscription) for subscription in subscriptions]
 
             producer_future.result(timeout=10.0)
             msgs_by_consumers = []

api/tests/unit_tests/controllers/console/auth/test_authentication_security.py

@@ -1,6 +1,5 @@
 """Test authentication security to prevent user enumeration."""
 
-import base64
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -12,11 +11,6 @@ from controllers.console.auth.error import AuthenticationFailedError
 from controllers.console.auth.login import LoginApi
 
 
-def encode_password(password: str) -> str:
-    """Helper to encode password as Base64 for testing."""
-    return base64.b64encode(password.encode("utf-8")).decode()
-
-
 class TestAuthenticationSecurity:
     """Test authentication endpoints for security against user enumeration."""
 
@@ -48,9 +42,7 @@ class TestAuthenticationSecurity:
 
         # Act
         with self.app.test_request_context(
-            "/login",
-            method="POST",
-            json={"email": "nonexistent@example.com", "password": encode_password("WrongPass123!")},
+            "/login", method="POST", json={"email": "nonexistent@example.com", "password": "WrongPass123!"}
         ):
             login_api = LoginApi()
 
@@ -80,9 +72,7 @@ class TestAuthenticationSecurity:
 
         # Act
         with self.app.test_request_context(
-            "/login",
-            method="POST",
-            json={"email": "existing@example.com", "password": encode_password("WrongPass123!")},
+            "/login", method="POST", json={"email": "existing@example.com", "password": "WrongPass123!"}
         ):
             login_api = LoginApi()
 
@@ -114,9 +104,7 @@ class TestAuthenticationSecurity:
 
         # Act
         with self.app.test_request_context(
-            "/login",
-            method="POST",
-            json={"email": "nonexistent@example.com", "password": encode_password("WrongPass123!")},
+            "/login", method="POST", json={"email": "nonexistent@example.com", "password": "WrongPass123!"}
         ):
             login_api = LoginApi()
 

api/tests/unit_tests/controllers/console/auth/test_email_verification.py

@@ -8,7 +8,6 @@ This module tests the email code login mechanism including:
 - Workspace creation for new users
 """
 
-import base64
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -26,11 +25,6 @@ from controllers.console.error import (
 from services.errors.account import AccountRegisterError
 
 
-def encode_code(code: str) -> str:
-    """Helper to encode verification code as Base64 for testing."""
-    return base64.b64encode(code.encode("utf-8")).decode()
-
-
 class TestEmailCodeLoginSendEmailApi:
     """Test cases for sending email verification codes."""
 
@@ -296,7 +290,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "test@example.com", "code": encode_code("123456"), "token": "valid_token"},
+            json={"email": "test@example.com", "code": "123456", "token": "valid_token"},
         ):
             api = EmailCodeLoginApi()
             response = api.post()
@@ -345,12 +339,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={
-                "email": "newuser@example.com",
-                "code": encode_code("123456"),
-                "token": "valid_token",
-                "language": "en-US",
-            },
+            json={"email": "newuser@example.com", "code": "123456", "token": "valid_token", "language": "en-US"},
         ):
             api = EmailCodeLoginApi()
             response = api.post()
@@ -376,7 +365,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "test@example.com", "code": encode_code("123456"), "token": "invalid_token"},
+            json={"email": "test@example.com", "code": "123456", "token": "invalid_token"},
         ):
             api = EmailCodeLoginApi()
             with pytest.raises(InvalidTokenError):
@@ -399,7 +388,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "different@example.com", "code": encode_code("123456"), "token": "token"},
+            json={"email": "different@example.com", "code": "123456", "token": "token"},
         ):
             api = EmailCodeLoginApi()
             with pytest.raises(InvalidEmailError):
@@ -422,7 +411,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "test@example.com", "code": encode_code("wrong_code"), "token": "token"},
+            json={"email": "test@example.com", "code": "wrong_code", "token": "token"},
         ):
             api = EmailCodeLoginApi()
             with pytest.raises(EmailCodeError):
@@ -508,7 +497,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "test@example.com", "code": encode_code("123456"), "token": "token"},
+            json={"email": "test@example.com", "code": "123456", "token": "token"},
         ):
             api = EmailCodeLoginApi()
             with pytest.raises(WorkspacesLimitExceeded):
@@ -550,7 +539,7 @@ class TestEmailCodeLoginApi:
         with app.test_request_context(
             "/email-code-login/validity",
             method="POST",
-            json={"email": "test@example.com", "code": encode_code("123456"), "token": "token"},
+            json={"email": "test@example.com", "code": "123456", "token": "token"},
         ):
             api = EmailCodeLoginApi()
             with pytest.raises(NotAllowedCreateWorkspace):

api/tests/unit_tests/controllers/console/auth/test_login_logout.py

@@ -8,7 +8,6 @@ This module tests the core authentication endpoints including:
 - Account status validation
 """
 
-import base64
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -29,11 +28,6 @@ from controllers.console.error import (
 from services.errors.account import AccountLoginError, AccountPasswordError
 
 
-def encode_password(password: str) -> str:
-    """Helper to encode password as Base64 for testing."""
-    return base64.b64encode(password.encode("utf-8")).decode()
-
-
 class TestLoginApi:
     """Test cases for the LoginApi endpoint."""
 
@@ -112,9 +106,7 @@ class TestLoginApi:
 
         # Act
         with app.test_request_context(
-            "/login",
-            method="POST",
-            json={"email": "test@example.com", "password": encode_password("ValidPass123!")},
+            "/login", method="POST", json={"email": "test@example.com", "password": "ValidPass123!"}
         ):
             login_api = LoginApi()
             response = login_api.post()
@@ -166,11 +158,7 @@ class TestLoginApi:
         with app.test_request_context(
             "/login",
             method="POST",
-            json={
-                "email": "test@example.com",
-                "password": encode_password("ValidPass123!"),
-                "invite_token": "valid_token",
-            },
+            json={"email": "test@example.com", "password": "ValidPass123!", "invite_token": "valid_token"},
         ):
             login_api = LoginApi()
             response = login_api.post()
@@ -198,7 +186,7 @@ class TestLoginApi:
 
         # Act & Assert
         with app.test_request_context(
-            "/login", method="POST", json={"email": "test@example.com", "password": encode_password("password")}
+            "/login", method="POST", json={"email": "test@example.com", "password": "password"}
         ):
             login_api = LoginApi()
             with pytest.raises(EmailPasswordLoginLimitError):
@@ -221,7 +209,7 @@ class TestLoginApi:
 
         # Act & Assert
         with app.test_request_context(
-            "/login", method="POST", json={"email": "frozen@example.com", "password": encode_password("password")}
+            "/login", method="POST", json={"email": "frozen@example.com", "password": "password"}
         ):
             login_api = LoginApi()
             with pytest.raises(AccountInFreezeError):
@@ -258,7 +246,7 @@ class TestLoginApi:
 
         # Act & Assert
         with app.test_request_context(
-            "/login", method="POST", json={"email": "test@example.com", "password": encode_password("WrongPass123!")}
+            "/login", method="POST", json={"email": "test@example.com", "password": "WrongPass123!"}
         ):
             login_api = LoginApi()
             with pytest.raises(AuthenticationFailedError):
@@ -289,7 +277,7 @@ class TestLoginApi:
 
         # Act & Assert
         with app.test_request_context(
-            "/login", method="POST", json={"email": "banned@example.com", "password": encode_password("ValidPass123!")}
+            "/login", method="POST", json={"email": "banned@example.com", "password": "ValidPass123!"}
         ):
             login_api = LoginApi()
             with pytest.raises(AccountBannedError):
@@ -334,7 +322,7 @@ class TestLoginApi:
 
         # Act & Assert
         with app.test_request_context(
-            "/login", method="POST", json={"email": "test@example.com", "password": encode_password("ValidPass123!")}
+            "/login", method="POST", json={"email": "test@example.com", "password": "ValidPass123!"}
         ):
             login_api = LoginApi()
             with pytest.raises(WorkspacesLimitExceeded):
@@ -361,11 +349,7 @@ class TestLoginApi:
         with app.test_request_context(
             "/login",
             method="POST",
-            json={
-                "email": "different@example.com",
-                "password": encode_password("ValidPass123!"),
-                "invite_token": "token",
-            },
+            json={"email": "different@example.com", "password": "ValidPass123!", "invite_token": "token"},
         ):
             login_api = LoginApi()
             with pytest.raises(InvalidEmailError):

api/tests/unit_tests/core/tools/test_enduser_tool_auth.py

@@ -1,486 +0,0 @@
-"""
-Unit tests for end-user tool authentication.
-
-Tests the integration of end-user authentication with tool runtime resolution.
-"""
-
-import time
-from unittest.mock import MagicMock, patch
-
-import pytest
-
-from core.app.entities.app_invoke_entities import InvokeFrom
-from core.tools.entities.tool_entities import ToolAuthType, ToolInvokeFrom, ToolProviderType
-from core.tools.errors import ToolProviderNotFoundError
-from core.tools.tool_manager import ToolManager
-
-
-@pytest.fixture
-def mock_db_session():
-    """Mock database session."""
-    with patch("core.tools.tool_manager.db") as mock_db:
-        yield mock_db.session
-
-
-@pytest.fixture
-def mock_provider_controller():
-    """Mock builtin provider controller."""
-    controller = MagicMock()
-    controller.need_credentials = True
-    controller.get_tool = MagicMock(return_value=MagicMock())
-    controller.get_credentials_schema_by_type = MagicMock(return_value=[])
-    return controller
-
-
-class TestEndUserToolAuthentication:
-    """Test suite for end-user tool authentication."""
-
-    def test_end_user_auth_requires_end_user_id(self, mock_db_session, mock_provider_controller):
-        """
-        Test that END_USER auth_type requires end_user_id parameter.
-
-        When auth_type is END_USER but end_user_id is None, should raise error.
-        """
-        with patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller):
-            with pytest.raises(ToolProviderNotFoundError, match="end_user_id is required"):
-                ToolManager.get_tool_runtime(
-                    provider_type=ToolProviderType.BUILT_IN,
-                    provider_id="test_provider",
-                    tool_name="test_tool",
-                    tenant_id="test_tenant",
-                    invoke_from=InvokeFrom.SERVICE_API,
-                    tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                    auth_type=ToolAuthType.END_USER,
-                    end_user_id=None,  # Missing!
-                )
-
-    def test_end_user_auth_missing_credentials(self, mock_db_session, mock_provider_controller):
-        """
-        Test that error is raised when end-user has no credentials for provider.
-
-        When auth_type is END_USER but no credentials exist, should raise error.
-        """
-        # Mock no credentials found
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = None
-
-        with patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller):
-            with pytest.raises(ToolProviderNotFoundError, match="No end-user credentials found"):
-                ToolManager.get_tool_runtime(
-                    provider_type=ToolProviderType.BUILT_IN,
-                    provider_id="test_provider",
-                    tool_name="test_tool",
-                    tenant_id="test_tenant",
-                    invoke_from=InvokeFrom.SERVICE_API,
-                    tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                    auth_type=ToolAuthType.END_USER,
-                    end_user_id="end_user_123",
-                )
-
-    def test_end_user_auth_with_credentials(self, mock_db_session, mock_provider_controller):
-        """
-        Test successful end-user credential resolution.
-
-        When auth_type is END_USER and credentials exist, should return tool runtime.
-        """
-        # Mock end-user provider
-        mock_enduser_provider = MagicMock()
-        mock_enduser_provider.id = "cred_123"
-        mock_enduser_provider.credential_type = "api-key"
-        mock_enduser_provider.credentials = '{"api_key": "encrypted"}'
-        mock_enduser_provider.expires_at = -1  # No expiry
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_enduser_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"api_key": "decrypted_key"}
-        mock_cache = MagicMock()
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="test_provider",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.END_USER,
-                end_user_id="end_user_123",
-            )
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-            # Verify encrypter was called with decrypted credentials
-            mock_encrypter.decrypt.assert_called_once()
-
-    def test_workspace_auth_backward_compatibility(self, mock_db_session, mock_provider_controller):
-        """
-        Test that workspace authentication still works (backward compatibility).
-
-        When auth_type is WORKSPACE (default), should use workspace credentials.
-        """
-        # Mock workspace provider
-        mock_workspace_provider = MagicMock()
-        mock_workspace_provider.id = "workspace_cred_123"
-        mock_workspace_provider.credential_type = "api-key"
-        mock_workspace_provider.credentials = '{"api_key": "workspace_encrypted"}'
-        mock_workspace_provider.expires_at = -1
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_workspace_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"api_key": "workspace_decrypted"}
-        mock_cache = MagicMock()
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-            patch("core.helper.credential_utils.check_credential_policy_compliance"),
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="test_provider",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.WORKSPACE,  # Workspace auth
-                end_user_id=None,  # Not needed for workspace auth
-            )
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-
-    def test_workflow_tool_runtime_passes_end_user_id(self, mock_db_session, mock_provider_controller):
-        """
-        Test that get_workflow_tool_runtime correctly passes end_user_id to get_tool_runtime.
-        """
-        from core.workflow.nodes.tool.entities import ToolEntity
-
-        # Create a mock ToolEntity with END_USER auth_type
-        workflow_tool = MagicMock(spec=ToolEntity)
-        workflow_tool.provider_type = ToolProviderType.BUILT_IN
-        workflow_tool.provider_id = "test_provider"
-        workflow_tool.tool_name = "test_tool"
-        workflow_tool.credential_id = None
-        workflow_tool.auth_type = ToolAuthType.END_USER
-        workflow_tool.tool_configurations = {}
-
-        # Mock end-user credentials
-        mock_enduser_provider = MagicMock()
-        mock_enduser_provider.id = "cred_123"
-        mock_enduser_provider.credential_type = "api-key"
-        mock_enduser_provider.credentials = '{"api_key": "encrypted"}'
-        mock_enduser_provider.expires_at = -1
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_enduser_provider
-        )
-
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"api_key": "decrypted"}
-        mock_cache = MagicMock()
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-        ):
-            tool_runtime = ToolManager.get_workflow_tool_runtime(
-                tenant_id="test_tenant",
-                app_id="test_app",
-                node_id="test_node",
-                workflow_tool=workflow_tool,
-                invoke_from=InvokeFrom.SERVICE_API,
-                variable_pool=None,
-                end_user_id="end_user_123",  # Pass end_user_id
-            )
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-
-
-class TestOAuthTokenRefresh:
-    """Test suite for OAuth token refresh functionality."""
-
-    def test_enduser_oauth_token_refresh_when_expired(self, mock_db_session, mock_provider_controller):
-        """
-        Test that end-user OAuth tokens are automatically refreshed when expired.
-
-        When an OAuth token is expired (expires_at < current_time + 60s buffer),
-        the system should automatically refresh it before using.
-        """
-        # Mock end-user provider with expired OAuth token
-        mock_enduser_provider = MagicMock()
-        mock_enduser_provider.id = "cred_123"
-        mock_enduser_provider.credential_type = "oauth2"
-        mock_enduser_provider.credentials = '{"access_token": "old_token", "refresh_token": "refresh"}'
-        # Set expiry to past (token expired)
-        mock_enduser_provider.expires_at = int(time.time()) - 100
-        mock_enduser_provider.encrypted_credentials = '{"access_token": "old_token", "refresh_token": "refresh"}'
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_enduser_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"access_token": "old_token", "refresh_token": "refresh"}
-        mock_encrypter.encrypt.return_value = {"access_token": "new_token", "refresh_token": "refresh"}
-        mock_cache = MagicMock()
-
-        # Mock OAuth refresh response
-        mock_refreshed_credentials = MagicMock()
-        mock_refreshed_credentials.credentials = {"access_token": "new_token", "refresh_token": "refresh"}
-        mock_refreshed_credentials.expires_at = int(time.time()) + 3600  # New expiry 1 hour from now
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-            patch.object(
-                ToolManager,
-                "_refresh_oauth_credentials",
-                return_value=(
-                    mock_refreshed_credentials.credentials,
-                    mock_refreshed_credentials.expires_at,
-                ),
-            ) as mock_refresh,
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="github",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.END_USER,
-                end_user_id="end_user_123",
-            )
-
-            # Verify refresh was called
-            mock_refresh.assert_called_once_with(
-                tenant_id="test_tenant",
-                provider_id="github",
-                user_id="end_user_123",
-                decrypted_credentials={"access_token": "old_token", "refresh_token": "refresh"},
-            )
-
-            # Verify provider was updated with new credentials
-            assert mock_enduser_provider.expires_at == mock_refreshed_credentials.expires_at
-            mock_db_session.commit.assert_called_once()
-            mock_cache.delete.assert_called_once()
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-
-    def test_enduser_oauth_token_not_refreshed_when_valid(self, mock_db_session, mock_provider_controller):
-        """
-        Test that valid OAuth tokens are NOT refreshed.
-
-        When an OAuth token is still valid (expires_at > current_time + 60s buffer),
-        the system should use it without refreshing.
-        """
-        # Mock end-user provider with valid OAuth token
-        mock_enduser_provider = MagicMock()
-        mock_enduser_provider.id = "cred_123"
-        mock_enduser_provider.credential_type = "oauth2"
-        mock_enduser_provider.credentials = '{"access_token": "valid_token", "refresh_token": "refresh"}'
-        # Set expiry to future (token still valid with buffer)
-        mock_enduser_provider.expires_at = int(time.time()) + 3600  # Valid for 1 hour
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_enduser_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"access_token": "valid_token", "refresh_token": "refresh"}
-        mock_cache = MagicMock()
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-            patch.object(ToolManager, "_refresh_oauth_credentials") as mock_refresh,
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="github",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.END_USER,
-                end_user_id="end_user_123",
-            )
-
-            # Verify refresh was NOT called (token still valid)
-            mock_refresh.assert_not_called()
-
-            # Verify tool runtime was created with original credentials
-            assert tool_runtime is not None
-
-    def test_workspace_oauth_token_refresh_when_expired(self, mock_db_session, mock_provider_controller):
-        """
-        Test that workspace OAuth tokens are automatically refreshed when expired.
-
-        This ensures the refactored _refresh_oauth_credentials helper works
-        for both end-user and workspace authentication flows.
-        """
-        # Mock workspace provider with expired OAuth token
-        mock_workspace_provider = MagicMock()
-        mock_workspace_provider.id = "workspace_cred_123"
-        mock_workspace_provider.user_id = "workspace_user_456"
-        mock_workspace_provider.credential_type = "oauth2"
-        mock_workspace_provider.credentials = '{"access_token": "old_workspace_token"}'
-        mock_workspace_provider.expires_at = int(time.time()) - 100  # Expired
-        mock_workspace_provider.encrypted_credentials = '{"access_token": "old_workspace_token"}'
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_workspace_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"access_token": "old_workspace_token"}
-        mock_encrypter.encrypt.return_value = {"access_token": "new_workspace_token"}
-        mock_cache = MagicMock()
-
-        # Mock OAuth refresh response
-        refreshed_creds = {"access_token": "new_workspace_token"}
-        new_expires_at = int(time.time()) + 3600
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-            patch("core.helper.credential_utils.check_credential_policy_compliance"),
-            patch.object(
-                ToolManager, "_refresh_oauth_credentials", return_value=(refreshed_creds, new_expires_at)
-            ) as mock_refresh,
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="github",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.WORKSPACE,
-            )
-
-            # Verify refresh was called with workspace user_id
-            mock_refresh.assert_called_once_with(
-                tenant_id="test_tenant",
-                provider_id="github",
-                user_id="workspace_user_456",
-                decrypted_credentials={"access_token": "old_workspace_token"},
-            )
-
-            # Verify provider was updated
-            assert mock_workspace_provider.expires_at == new_expires_at
-            mock_db_session.commit.assert_called_once()
-            mock_cache.delete.assert_called_once()
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-
-    def test_oauth_token_no_refresh_for_non_oauth_credentials(self, mock_db_session, mock_provider_controller):
-        """
-        Test that non-OAuth credentials (API keys) are never refreshed.
-
-        API keys with expires_at = -1 should not trigger refresh logic.
-        """
-        # Mock end-user provider with API key (no expiry)
-        mock_enduser_provider = MagicMock()
-        mock_enduser_provider.id = "cred_123"
-        mock_enduser_provider.credential_type = "api-key"
-        mock_enduser_provider.credentials = '{"api_key": "sk-1234567890"}'
-        mock_enduser_provider.expires_at = -1  # API keys don't expire
-
-        mock_db_session.query.return_value.where.return_value.order_by.return_value.first.return_value = (
-            mock_enduser_provider
-        )
-
-        # Mock encrypter
-        mock_encrypter = MagicMock()
-        mock_encrypter.decrypt.return_value = {"api_key": "sk-1234567890"}
-        mock_cache = MagicMock()
-
-        with (
-            patch.object(ToolManager, "get_builtin_provider", return_value=mock_provider_controller),
-            patch("core.tools.tool_manager.create_provider_encrypter", return_value=(mock_encrypter, mock_cache)),
-            patch.object(ToolManager, "_refresh_oauth_credentials") as mock_refresh,
-        ):
-            tool_runtime = ToolManager.get_tool_runtime(
-                provider_type=ToolProviderType.BUILT_IN,
-                provider_id="openai",
-                tool_name="test_tool",
-                tenant_id="test_tenant",
-                invoke_from=InvokeFrom.SERVICE_API,
-                tool_invoke_from=ToolInvokeFrom.WORKFLOW,
-                auth_type=ToolAuthType.END_USER,
-                end_user_id="end_user_123",
-            )
-
-            # Verify refresh was NOT called (API key doesn't need refresh)
-            mock_refresh.assert_not_called()
-
-            # Verify tool runtime was created
-            assert tool_runtime is not None
-
-    def test_refresh_oauth_credentials_helper_method(self):
-        """
-        Test the _refresh_oauth_credentials helper method directly.
-
-        This tests the centralized OAuth refresh logic that is used by both
-        end-user and workspace authentication flows.
-        """
-        # Mock dependencies
-        mock_oauth_handler = MagicMock()
-        mock_refreshed = MagicMock()
-        mock_refreshed.credentials = {"access_token": "new_token", "refresh_token": "new_refresh"}
-        mock_refreshed.expires_at = int(time.time()) + 7200
-        mock_oauth_handler.refresh_credentials.return_value = mock_refreshed
-
-        with (
-            # Patch OAuthHandler where it's imported (inside the method)
-            patch("core.plugin.impl.oauth.OAuthHandler", return_value=mock_oauth_handler),
-            patch("core.tools.tool_manager.ToolProviderID") as mock_provider_id,
-            patch(
-                "services.tools.builtin_tools_manage_service.BuiltinToolManageService.get_oauth_client",
-                return_value={"client_id": "test"},
-            ),
-            patch("core.tools.tool_manager.dify_config.CONSOLE_API_URL", "http://localhost:5001"),
-        ):
-            # Setup provider ID mock
-            mock_provider_id.return_value.provider_name = "github"
-            mock_provider_id.return_value.plugin_id = "builtin"
-
-            # Call the helper method
-            credentials, expires_at = ToolManager._refresh_oauth_credentials(
-                tenant_id="test_tenant",
-                provider_id="langgenius/github/github",
-                user_id="user_123",
-                decrypted_credentials={"access_token": "old_token", "refresh_token": "old_refresh"},
-            )
-
-            # Verify OAuth handler was called correctly
-            mock_oauth_handler.refresh_credentials.assert_called_once_with(
-                tenant_id="test_tenant",
-                user_id="user_123",
-                plugin_id="builtin",
-                provider="github",
-                redirect_uri="http://localhost:5001/console/api/oauth/plugin/langgenius/github/github/tool/callback",
-                system_credentials={"client_id": "test"},
-                credentials={"access_token": "old_token", "refresh_token": "old_refresh"},
-            )
-
-            # Verify returned values
-            assert credentials == {"access_token": "new_token", "refresh_token": "new_refresh"}
-            assert expires_at == mock_refreshed.expires_at

api/tests/unit_tests/core/workflow/graph_engine/layers/conftest.py

@@ -1,101 +0,0 @@
-"""
-Shared fixtures for ObservabilityLayer tests.
-"""
-
-from unittest.mock import MagicMock, patch
-
-import pytest
-from opentelemetry.sdk.trace import TracerProvider
-from opentelemetry.sdk.trace.export import SimpleSpanProcessor
-from opentelemetry.sdk.trace.export.in_memory_span_exporter import InMemorySpanExporter
-from opentelemetry.trace import set_tracer_provider
-
-from core.workflow.enums import NodeType
-
-
-@pytest.fixture
-def memory_span_exporter():
-    """Provide an in-memory span exporter for testing."""
-    return InMemorySpanExporter()
-
-
-@pytest.fixture
-def tracer_provider_with_memory_exporter(memory_span_exporter):
-    """Provide a TracerProvider configured with memory exporter."""
-    import opentelemetry.trace as trace_api
-
-    trace_api._TRACER_PROVIDER = None
-    trace_api._TRACER_PROVIDER_SET_ONCE._done = False
-
-    provider = TracerProvider()
-    processor = SimpleSpanProcessor(memory_span_exporter)
-    provider.add_span_processor(processor)
-    set_tracer_provider(provider)
-
-    yield provider
-
-    provider.force_flush()
-
-
-@pytest.fixture
-def mock_start_node():
-    """Create a mock Start Node."""
-    node = MagicMock()
-    node.id = "test-start-node-id"
-    node.title = "Start Node"
-    node.execution_id = "test-start-execution-id"
-    node.node_type = NodeType.START
-    return node
-
-
-@pytest.fixture
-def mock_llm_node():
-    """Create a mock LLM Node."""
-    node = MagicMock()
-    node.id = "test-llm-node-id"
-    node.title = "LLM Node"
-    node.execution_id = "test-llm-execution-id"
-    node.node_type = NodeType.LLM
-    return node
-
-
-@pytest.fixture
-def mock_tool_node():
-    """Create a mock Tool Node with tool-specific attributes."""
-    from core.tools.entities.tool_entities import ToolProviderType
-    from core.workflow.nodes.tool.entities import ToolNodeData
-
-    node = MagicMock()
-    node.id = "test-tool-node-id"
-    node.title = "Test Tool Node"
-    node.execution_id = "test-tool-execution-id"
-    node.node_type = NodeType.TOOL
-
-    tool_data = ToolNodeData(
-        title="Test Tool Node",
-        desc=None,
-        provider_id="test-provider-id",
-        provider_type=ToolProviderType.BUILT_IN,
-        provider_name="test-provider",
-        tool_name="test-tool",
-        tool_label="Test Tool",
-        tool_configurations={},
-        tool_parameters={},
-    )
-    node._node_data = tool_data
-
-    return node
-
-
-@pytest.fixture
-def mock_is_instrument_flag_enabled_false():
-    """Mock is_instrument_flag_enabled to return False."""
-    with patch("core.workflow.graph_engine.layers.observability.is_instrument_flag_enabled", return_value=False):
-        yield
-
-
-@pytest.fixture
-def mock_is_instrument_flag_enabled_true():
-    """Mock is_instrument_flag_enabled to return True."""
-    with patch("core.workflow.graph_engine.layers.observability.is_instrument_flag_enabled", return_value=True):
-        yield

api/tests/unit_tests/core/workflow/graph_engine/layers/test_observability.py

@@ -1,219 +0,0 @@
-"""
-Tests for ObservabilityLayer.
-
-Test coverage:
-- Initialization and enable/disable logic
-- Node span lifecycle (start, end, error handling)
-- Parser integration (default and tool-specific)
-- Graph lifecycle management
-- Disabled mode behavior
-"""
-
-from unittest.mock import patch
-
-import pytest
-from opentelemetry.trace import StatusCode
-
-from core.workflow.enums import NodeType
-from core.workflow.graph_engine.layers.observability import ObservabilityLayer
-
-
-class TestObservabilityLayerInitialization:
-    """Test ObservabilityLayer initialization logic."""
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_initialization_when_otel_enabled(self, tracer_provider_with_memory_exporter):
-        """Test that layer initializes correctly when OTel is enabled."""
-        layer = ObservabilityLayer()
-        assert not layer._is_disabled
-        assert layer._tracer is not None
-        assert NodeType.TOOL in layer._parsers
-        assert layer._default_parser is not None
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", False)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_true")
-    def test_initialization_when_instrument_flag_enabled(self, tracer_provider_with_memory_exporter):
-        """Test that layer enables when instrument flag is enabled."""
-        layer = ObservabilityLayer()
-        assert not layer._is_disabled
-        assert layer._tracer is not None
-        assert NodeType.TOOL in layer._parsers
-        assert layer._default_parser is not None
-
-
-class TestObservabilityLayerNodeSpanLifecycle:
-    """Test node span creation and lifecycle management."""
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_node_span_created_and_ended(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_llm_node
-    ):
-        """Test that span is created on node start and ended on node end."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_llm_node)
-        layer.on_node_run_end(mock_llm_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 1
-        assert spans[0].name == mock_llm_node.title
-        assert spans[0].status.status_code == StatusCode.OK
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_node_error_recorded_in_span(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_llm_node
-    ):
-        """Test that node execution errors are recorded in span."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        error = ValueError("Test error")
-        layer.on_node_run_start(mock_llm_node)
-        layer.on_node_run_end(mock_llm_node, error)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 1
-        assert spans[0].status.status_code == StatusCode.ERROR
-        assert len(spans[0].events) > 0
-        assert any("exception" in event.name.lower() for event in spans[0].events)
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_node_end_without_start_handled_gracefully(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_llm_node
-    ):
-        """Test that ending a node without start doesn't crash."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_end(mock_llm_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 0
-
-
-class TestObservabilityLayerParserIntegration:
-    """Test parser integration for different node types."""
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_default_parser_used_for_regular_node(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_start_node
-    ):
-        """Test that default parser is used for non-tool nodes."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_start_node)
-        layer.on_node_run_end(mock_start_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 1
-        attrs = spans[0].attributes
-        assert attrs["node.id"] == mock_start_node.id
-        assert attrs["node.execution_id"] == mock_start_node.execution_id
-        assert attrs["node.type"] == mock_start_node.node_type.value
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_tool_parser_used_for_tool_node(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_tool_node
-    ):
-        """Test that tool parser is used for tool nodes."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_tool_node)
-        layer.on_node_run_end(mock_tool_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 1
-        attrs = spans[0].attributes
-        assert attrs["node.id"] == mock_tool_node.id
-        assert attrs["tool.provider.id"] == mock_tool_node._node_data.provider_id
-        assert attrs["tool.provider.type"] == mock_tool_node._node_data.provider_type.value
-        assert attrs["tool.name"] == mock_tool_node._node_data.tool_name
-
-
-class TestObservabilityLayerGraphLifecycle:
-    """Test graph lifecycle management."""
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_on_graph_start_clears_contexts(self, tracer_provider_with_memory_exporter, mock_llm_node):
-        """Test that on_graph_start clears node contexts."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_llm_node)
-        assert len(layer._node_contexts) == 1
-
-        layer.on_graph_start()
-        assert len(layer._node_contexts) == 0
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_on_graph_end_with_no_unfinished_spans(
-        self, tracer_provider_with_memory_exporter, memory_span_exporter, mock_llm_node
-    ):
-        """Test that on_graph_end handles normal completion."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_llm_node)
-        layer.on_node_run_end(mock_llm_node, None)
-        layer.on_graph_end(None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 1
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", True)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_on_graph_end_with_unfinished_spans_logs_warning(
-        self, tracer_provider_with_memory_exporter, mock_llm_node, caplog
-    ):
-        """Test that on_graph_end logs warning for unfinished spans."""
-        layer = ObservabilityLayer()
-        layer.on_graph_start()
-
-        layer.on_node_run_start(mock_llm_node)
-        assert len(layer._node_contexts) == 1
-
-        layer.on_graph_end(None)
-
-        assert len(layer._node_contexts) == 0
-        assert "node spans were not properly ended" in caplog.text
-
-
-class TestObservabilityLayerDisabledMode:
-    """Test behavior when layer is disabled."""
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", False)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_disabled_mode_skips_node_start(self, memory_span_exporter, mock_start_node):
-        """Test that disabled layer doesn't create spans on node start."""
-        layer = ObservabilityLayer()
-        assert layer._is_disabled
-
-        layer.on_graph_start()
-        layer.on_node_run_start(mock_start_node)
-        layer.on_node_run_end(mock_start_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 0
-
-    @patch("core.workflow.graph_engine.layers.observability.dify_config.ENABLE_OTEL", False)
-    @pytest.mark.usefixtures("mock_is_instrument_flag_enabled_false")
-    def test_disabled_mode_skips_node_end(self, memory_span_exporter, mock_llm_node):
-        """Test that disabled layer doesn't process node end."""
-        layer = ObservabilityLayer()
-        assert layer._is_disabled
-
-        layer.on_node_run_end(mock_llm_node, None)
-
-        spans = memory_span_exporter.get_finished_spans()
-        assert len(spans) == 0

api/tests/unit_tests/libs/test_encryption.py

@@ -1,150 +0,0 @@
-"""
-Unit tests for field encoding/decoding utilities.
-
-These tests verify Base64 encoding/decoding functionality and
-proper error handling and fallback behavior.
-"""
-
-import base64
-
-from libs.encryption import FieldEncryption
-
-
-class TestDecodeField:
-    """Test cases for field decoding functionality."""
-
-    def test_decode_valid_base64(self):
-        """Test decoding a valid Base64 encoded string."""
-        plaintext = "password123"
-        encoded = base64.b64encode(plaintext.encode("utf-8")).decode()
-
-        result = FieldEncryption.decrypt_field(encoded)
-        assert result == plaintext
-
-    def test_decode_non_base64_returns_none(self):
-        """Test that non-base64 input returns None."""
-        non_base64 = "plain-password-!@#"
-        result = FieldEncryption.decrypt_field(non_base64)
-        # Should return None (decoding failed)
-        assert result is None
-
-    def test_decode_unicode_text(self):
-        """Test decoding Base64 encoded Unicode text."""
-        plaintext = "密码Test123"
-        encoded = base64.b64encode(plaintext.encode("utf-8")).decode()
-
-        result = FieldEncryption.decrypt_field(encoded)
-        assert result == plaintext
-
-    def test_decode_empty_string(self):
-        """Test decoding an empty string returns empty string."""
-        result = FieldEncryption.decrypt_field("")
-        # Empty string base64 decodes to empty string
-        assert result == ""
-
-    def test_decode_special_characters(self):
-        """Test decoding with special characters."""
-        plaintext = "P@ssw0rd!#$%^&*()"
-        encoded = base64.b64encode(plaintext.encode("utf-8")).decode()
-
-        result = FieldEncryption.decrypt_field(encoded)
-        assert result == plaintext
-
-
-class TestDecodePassword:
-    """Test cases for password decoding."""
-
-    def test_decode_password_base64(self):
-        """Test decoding a Base64 encoded password."""
-        password = "SecureP@ssw0rd!"
-        encoded = base64.b64encode(password.encode("utf-8")).decode()
-
-        result = FieldEncryption.decrypt_password(encoded)
-        assert result == password
-
-    def test_decode_password_invalid_returns_none(self):
-        """Test that invalid base64 passwords return None."""
-        invalid = "PlainPassword!@#"
-        result = FieldEncryption.decrypt_password(invalid)
-        # Should return None (decoding failed)
-        assert result is None
-
-
-class TestDecodeVerificationCode:
-    """Test cases for verification code decoding."""
-
-    def test_decode_code_base64(self):
-        """Test decoding a Base64 encoded verification code."""
-        code = "789012"
-        encoded = base64.b64encode(code.encode("utf-8")).decode()
-
-        result = FieldEncryption.decrypt_verification_code(encoded)
-        assert result == code
-
-    def test_decode_code_invalid_returns_none(self):
-        """Test that invalid base64 codes return None."""
-        invalid = "123456"  # Plain 6-digit code, not base64
-        result = FieldEncryption.decrypt_verification_code(invalid)
-        # Should return None (decoding failed)
-        assert result is None
-
-
-class TestRoundTripEncodingDecoding:
-    """
-    Integration tests for complete encoding-decoding cycle.
-    These tests simulate the full frontend-to-backend flow using Base64.
-    """
-
-    def test_roundtrip_password(self):
-        """Test encoding and decoding a password."""
-        original_password = "SecureP@ssw0rd!"
-
-        # Simulate frontend encoding (Base64)
-        encoded = base64.b64encode(original_password.encode("utf-8")).decode()
-
-        # Backend decoding
-        decoded = FieldEncryption.decrypt_password(encoded)
-
-        assert decoded == original_password
-
-    def test_roundtrip_verification_code(self):
-        """Test encoding and decoding a verification code."""
-        original_code = "123456"
-
-        # Simulate frontend encoding
-        encoded = base64.b64encode(original_code.encode("utf-8")).decode()
-
-        # Backend decoding
-        decoded = FieldEncryption.decrypt_verification_code(encoded)
-
-        assert decoded == original_code
-
-    def test_roundtrip_unicode_password(self):
-        """Test encoding and decoding password with Unicode characters."""
-        original_password = "密码Test123!@#"
-
-        # Frontend encoding
-        encoded = base64.b64encode(original_password.encode("utf-8")).decode()
-
-        # Backend decoding
-        decoded = FieldEncryption.decrypt_password(encoded)
-
-        assert decoded == original_password
-
-    def test_roundtrip_long_password(self):
-        """Test encoding and decoding a long password."""
-        original_password = "ThisIsAVeryLongPasswordWithLotsOfCharacters123!@#$%^&*()"
-
-        encoded = base64.b64encode(original_password.encode("utf-8")).decode()
-        decoded = FieldEncryption.decrypt_password(encoded)
-
-        assert decoded == original_password
-
-    def test_roundtrip_with_whitespace(self):
-        """Test encoding and decoding with whitespace."""
-        original_password = "pass word with spaces"
-
-        encoded = base64.b64encode(original_password.encode("utf-8")).decode()
-        decoded = FieldEncryption.decrypt_field(encoded)
-
-        assert decoded == original_password

api/tests/unit_tests/services/test_variable_truncator.py

@@ -518,55 +518,6 @@ class TestEdgeCases:
         assert isinstance(result.result, StringSegment)
 
 
-class TestTruncateJsonPrimitives:
-    """Test _truncate_json_primitives method with different data types."""
-
-    @pytest.fixture
-    def truncator(self):
-        return VariableTruncator()
-
-    def test_truncate_json_primitives_file_type(self, truncator, file):
-        """Test that File objects are handled correctly in _truncate_json_primitives."""
-        # Test File object is returned as-is without truncation
-        result = truncator._truncate_json_primitives(file, 1000)
-
-        assert result.value == file
-        assert result.truncated is False
-        # Size should be calculated correctly
-        expected_size = VariableTruncator.calculate_json_size(file)
-        assert result.value_size == expected_size
-
-    def test_truncate_json_primitives_file_type_small_budget(self, truncator, file):
-        """Test that File objects are returned as-is even with small budget."""
-        # Even with a small size budget, File objects should not be truncated
-        result = truncator._truncate_json_primitives(file, 10)
-
-        assert result.value == file
-        assert result.truncated is False
-
-    def test_truncate_json_primitives_file_type_in_array(self, truncator, file):
-        """Test File objects in arrays are handled correctly."""
-        array_with_files = [file, file]
-        result = truncator._truncate_json_primitives(array_with_files, 1000)
-
-        assert isinstance(result.value, list)
-        assert len(result.value) == 2
-        assert result.value[0] == file
-        assert result.value[1] == file
-        assert result.truncated is False
-
-    def test_truncate_json_primitives_file_type_in_object(self, truncator, file):
-        """Test File objects in objects are handled correctly."""
-        obj_with_files = {"file1": file, "file2": file}
-        result = truncator._truncate_json_primitives(obj_with_files, 1000)
-
-        assert isinstance(result.value, dict)
-        assert len(result.value) == 2
-        assert result.value["file1"] == file
-        assert result.value["file2"] == file
-        assert result.truncated is False
-
-
 class TestIntegrationScenarios:
     """Test realistic integration scenarios."""
 

api/tests/unit_tests/services/test_webhook_service.py

@@ -110,70 +110,6 @@ class TestWebhookServiceUnit:
             assert webhook_data["method"] == "POST"
             assert webhook_data["body"]["raw"] == "raw text content"
 
-    def test_extract_octet_stream_body_uses_detected_mime(self):
-        """Octet-stream uploads should rely on detected MIME type."""
-        app = Flask(__name__)
-        binary_content = b"plain text data"
-
-        with app.test_request_context(
-            "/webhook", method="POST", headers={"Content-Type": "application/octet-stream"}, data=binary_content
-        ):
-            webhook_trigger = MagicMock()
-            mock_file = MagicMock()
-            mock_file.to_dict.return_value = {"file": "data"}
-
-            with (
-                patch.object(WebhookService, "_detect_binary_mimetype", return_value="text/plain") as mock_detect,
-                patch.object(WebhookService, "_create_file_from_binary") as mock_create,
-            ):
-                mock_create.return_value = mock_file
-                body, files = WebhookService._extract_octet_stream_body(webhook_trigger)
-
-            assert body["raw"] == {"file": "data"}
-            assert files == {}
-            mock_detect.assert_called_once_with(binary_content)
-            mock_create.assert_called_once()
-            args = mock_create.call_args[0]
-            assert args[0] == binary_content
-            assert args[1] == "text/plain"
-            assert args[2] is webhook_trigger
-
-    def test_detect_binary_mimetype_uses_magic(self, monkeypatch):
-        """python-magic output should be used when available."""
-        fake_magic = MagicMock()
-        fake_magic.from_buffer.return_value = "image/png"
-        monkeypatch.setattr("services.trigger.webhook_service.magic", fake_magic)
-
-        result = WebhookService._detect_binary_mimetype(b"binary data")
-
-        assert result == "image/png"
-        fake_magic.from_buffer.assert_called_once()
-
-    def test_detect_binary_mimetype_fallback_without_magic(self, monkeypatch):
-        """Fallback MIME type should be used when python-magic is unavailable."""
-        monkeypatch.setattr("services.trigger.webhook_service.magic", None)
-
-        result = WebhookService._detect_binary_mimetype(b"binary data")
-
-        assert result == "application/octet-stream"
-
-    def test_detect_binary_mimetype_handles_magic_exception(self, monkeypatch):
-        """Fallback MIME type should be used when python-magic raises an exception."""
-        try:
-            import magic as real_magic
-        except ImportError:
-            pytest.skip("python-magic is not installed")
-
-        fake_magic = MagicMock()
-        fake_magic.from_buffer.side_effect = real_magic.MagicException("magic error")
-        monkeypatch.setattr("services.trigger.webhook_service.magic", fake_magic)
-
-        with patch("services.trigger.webhook_service.logger") as mock_logger:
-            result = WebhookService._detect_binary_mimetype(b"binary data")
-
-            assert result == "application/octet-stream"
-            mock_logger.debug.assert_called_once()
-
     def test_extract_webhook_data_invalid_json(self):
         """Test webhook data extraction with invalid JSON."""
         app = Flask(__name__)

docker/.env.example

@@ -1229,7 +1229,7 @@ NGINX_SSL_PORT=443
 # and modify the env vars below accordingly.
 NGINX_SSL_CERT_FILENAME=dify.crt
 NGINX_SSL_CERT_KEY_FILENAME=dify.key
-NGINX_SSL_PROTOCOLS=TLSv1.2 TLSv1.3
+NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3
 
 # Nginx performance tuning
 NGINX_WORKER_PROCESSES=auto
@@ -1421,7 +1421,7 @@ QUEUE_MONITOR_ALERT_EMAILS=
 QUEUE_MONITOR_INTERVAL=30
 
 # Swagger UI configuration
-SWAGGER_UI_ENABLED=false
+SWAGGER_UI_ENABLED=true
 SWAGGER_UI_PATH=/swagger-ui.html
 
 # Whether to encrypt dataset IDs when exporting DSL files (default: true)
@@ -1460,4 +1460,4 @@ ANNOTATION_IMPORT_RATE_LIMIT_PER_HOUR=20
 ANNOTATION_IMPORT_MAX_CONCURRENT=5
 
 # The API key of amplitude
-AMPLITUDE_API_KEY=
+AMPLITUDE_API_KEY=

docker/docker-compose-template.yaml

@@ -414,7 +414,7 @@ services:
       # and modify the env vars below in .env if HTTPS_ENABLED is true.
       NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
       NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
-      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.2 TLSv1.3}
+      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3}
       NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
       NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-100M}
       NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}

docker/docker-compose.yaml

@@ -528,7 +528,7 @@ x-shared-env: &shared-api-worker-env
   NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443}
   NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
   NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
-  NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.2 TLSv1.3}
+  NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3}
   NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
   NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-100M}
   NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}
@@ -631,7 +631,7 @@ x-shared-env: &shared-api-worker-env
   QUEUE_MONITOR_THRESHOLD: ${QUEUE_MONITOR_THRESHOLD:-200}
   QUEUE_MONITOR_ALERT_EMAILS: ${QUEUE_MONITOR_ALERT_EMAILS:-}
   QUEUE_MONITOR_INTERVAL: ${QUEUE_MONITOR_INTERVAL:-30}
-  SWAGGER_UI_ENABLED: ${SWAGGER_UI_ENABLED:-false}
+  SWAGGER_UI_ENABLED: ${SWAGGER_UI_ENABLED:-true}
   SWAGGER_UI_PATH: ${SWAGGER_UI_PATH:-/swagger-ui.html}
   DSL_EXPORT_ENCRYPT_DATASET_ID: ${DSL_EXPORT_ENCRYPT_DATASET_ID:-true}
   DATASET_MAX_SEGMENTS_PER_REQUEST: ${DATASET_MAX_SEGMENTS_PER_REQUEST:-0}
@@ -1071,7 +1071,7 @@ services:
       # and modify the env vars below in .env if HTTPS_ENABLED is true.
       NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
       NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
-      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.2 TLSv1.3}
+      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3}
       NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
       NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-100M}
       NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}

web/.gitignore

@@ -8,6 +8,13 @@
 # testing
 /coverage
 
+# playwright e2e
+/e2e/.auth/
+/e2e/test-results/
+/playwright-report/
+/blob-report/
+/test-results/
+
 # next.js
 /.next/
 /out/

web/AGENTS.md

@@ -2,4 +2,3 @@
 
 - Use `web/testing/testing.md` as the canonical instruction set for generating frontend automated tests.
 - When proposing or saving tests, re-read that document and follow every requirement.
-- All frontend tests MUST also comply with the `frontend-testing` skill. Treat the skill as a mandatory constraint, not optional guidance.

web/CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

web/__mocks__/react-i18next.ts

@@ -1,40 +0,0 @@
-/**
- * Shared mock for react-i18next
- *
- * Jest automatically uses this mock when react-i18next is imported in tests.
- * The default behavior returns the translation key as-is, which is suitable
- * for most test scenarios.
- *
- * For tests that need custom translations, you can override with jest.mock():
- *
- * @example
- * jest.mock('react-i18next', () => ({
- *   useTranslation: () => ({
- *     t: (key: string) => {
- *       if (key === 'some.key') return 'Custom translation'
- *       return key
- *     },
- *   }),
- * }))
- */
-
-export const useTranslation = () => ({
-  t: (key: string, options?: Record<string, unknown>) => {
-    if (options?.returnObjects)
-      return [`${key}-feature-1`, `${key}-feature-2`]
-    if (options)
-      return `${key}:${JSON.stringify(options)}`
-    return key
-  },
-  i18n: {
-    language: 'en',
-    changeLanguage: jest.fn(),
-  },
-})
-
-export const Trans = ({ children }: { children?: React.ReactNode }) => children
-
-export const initReactI18next = {
-  type: '3rdParty',
-  init: jest.fn(),
-}

web/__tests__/embedded-user-id-auth.test.tsx

@@ -4,6 +4,12 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import MailAndPasswordAuth from '@/app/(shareLayout)/webapp-signin/components/mail-and-password-auth'
 import CheckCode from '@/app/(shareLayout)/webapp-signin/check-code/page'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 const replaceMock = jest.fn()
 const backMock = jest.fn()
 

web/__tests__/goto-anything/command-selector.test.tsx

@@ -4,6 +4,12 @@ import '@testing-library/jest-dom'
 import CommandSelector from '../../app/components/goto-anything/command-selector'
 import type { ActionItem } from '../../app/components/goto-anything/actions/types'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 jest.mock('cmdk', () => ({
   Command: {
     Group: ({ children, className }: any) => <div className={className}>{children}</div>,

web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/__tests__/svg-attribute-error-reproduction.spec.tsx

@@ -3,6 +3,13 @@ import { render } from '@testing-library/react'
 import '@testing-library/jest-dom'
 import { OpikIconBig } from '@/app/components/base/icons/src/public/tracing'
 
+// Mock dependencies to isolate the SVG rendering issue
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 describe('SVG Attribute Error Reproduction', () => {
   // Capture console errors
   const originalError = console.error

web/app/components/app/annotation/add-annotation-modal/edit-item/index.spec.tsx

@@ -1,53 +0,0 @@
-import React from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
-import EditItem, { EditItemType } from './index'
-
-jest.mock('react-i18next', () => ({
-  useTranslation: () => ({
-    t: (key: string) => key,
-  }),
-}))
-
-describe('AddAnnotationModal/EditItem', () => {
-  test('should render query inputs with user avatar and placeholder strings', () => {
-    render(
-      <EditItem
-        type={EditItemType.Query}
-        content="Why?"
-        onChange={jest.fn()}
-      />,
-    )
-
-    expect(screen.getByText('appAnnotation.addModal.queryName')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('appAnnotation.addModal.queryPlaceholder')).toBeInTheDocument()
-    expect(screen.getByText('Why?')).toBeInTheDocument()
-  })
-
-  test('should render answer name and placeholder text', () => {
-    render(
-      <EditItem
-        type={EditItemType.Answer}
-        content="Existing answer"
-        onChange={jest.fn()}
-      />,
-    )
-
-    expect(screen.getByText('appAnnotation.addModal.answerName')).toBeInTheDocument()
-    expect(screen.getByPlaceholderText('appAnnotation.addModal.answerPlaceholder')).toBeInTheDocument()
-    expect(screen.getByDisplayValue('Existing answer')).toBeInTheDocument()
-  })
-
-  test('should propagate changes when answer content updates', () => {
-    const handleChange = jest.fn()
-    render(
-      <EditItem
-        type={EditItemType.Answer}
-        content=""
-        onChange={handleChange}
-      />,
-    )
-
-    fireEvent.change(screen.getByPlaceholderText('appAnnotation.addModal.answerPlaceholder'), { target: { value: 'Because' } })
-    expect(handleChange).toHaveBeenCalledWith('Because')
-  })
-})

web/app/components/app/annotation/add-annotation-modal/index.spec.tsx

@@ -1,155 +0,0 @@
-import React from 'react'
-import { act, fireEvent, render, screen, waitFor } from '@testing-library/react'
-import AddAnnotationModal from './index'
-import { useProviderContext } from '@/context/provider-context'
-
-jest.mock('@/context/provider-context', () => ({
-  useProviderContext: jest.fn(),
-}))
-
-const mockToastNotify = jest.fn()
-jest.mock('@/app/components/base/toast', () => ({
-  __esModule: true,
-  default: {
-    notify: jest.fn(args => mockToastNotify(args)),
-  },
-}))
-
-jest.mock('@/app/components/billing/annotation-full', () => () => <div data-testid="annotation-full" />)
-
-const mockUseProviderContext = useProviderContext as jest.Mock
-
-const getProviderContext = ({ usage = 0, total = 10, enableBilling = false } = {}) => ({
-  plan: {
-    usage: { annotatedResponse: usage },
-    total: { annotatedResponse: total },
-  },
-  enableBilling,
-})
-
-describe('AddAnnotationModal', () => {
-  const baseProps = {
-    isShow: true,
-    onHide: jest.fn(),
-    onAdd: jest.fn(),
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-    mockUseProviderContext.mockReturnValue(getProviderContext())
-  })
-
-  const typeQuestion = (value: string) => {
-    fireEvent.change(screen.getByPlaceholderText('appAnnotation.addModal.queryPlaceholder'), {
-      target: { value },
-    })
-  }
-
-  const typeAnswer = (value: string) => {
-    fireEvent.change(screen.getByPlaceholderText('appAnnotation.addModal.answerPlaceholder'), {
-      target: { value },
-    })
-  }
-
-  test('should render modal title when drawer is visible', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-
-    expect(screen.getByText('appAnnotation.addModal.title')).toBeInTheDocument()
-  })
-
-  test('should capture query input text when typing', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-    typeQuestion('Sample question')
-    expect(screen.getByPlaceholderText('appAnnotation.addModal.queryPlaceholder')).toHaveValue('Sample question')
-  })
-
-  test('should capture answer input text when typing', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-    typeAnswer('Sample answer')
-    expect(screen.getByPlaceholderText('appAnnotation.addModal.answerPlaceholder')).toHaveValue('Sample answer')
-  })
-
-  test('should show annotation full notice and disable submit when quota exceeded', () => {
-    mockUseProviderContext.mockReturnValue(getProviderContext({ usage: 10, total: 10, enableBilling: true }))
-    render(<AddAnnotationModal {...baseProps} />)
-
-    expect(screen.getByTestId('annotation-full')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'common.operation.add' })).toBeDisabled()
-  })
-
-  test('should call onAdd with form values when create next enabled', async () => {
-    const onAdd = jest.fn().mockResolvedValue(undefined)
-    render(<AddAnnotationModal {...baseProps} onAdd={onAdd} />)
-
-    typeQuestion('Question value')
-    typeAnswer('Answer value')
-    fireEvent.click(screen.getByTestId('checkbox-create-next-checkbox'))
-
-    await act(async () => {
-      fireEvent.click(screen.getByRole('button', { name: 'common.operation.add' }))
-    })
-
-    expect(onAdd).toHaveBeenCalledWith({ question: 'Question value', answer: 'Answer value' })
-  })
-
-  test('should reset fields after saving when create next enabled', async () => {
-    const onAdd = jest.fn().mockResolvedValue(undefined)
-    render(<AddAnnotationModal {...baseProps} onAdd={onAdd} />)
-
-    typeQuestion('Question value')
-    typeAnswer('Answer value')
-    const createNextToggle = screen.getByText('appAnnotation.addModal.createNext').previousElementSibling as HTMLElement
-    fireEvent.click(createNextToggle)
-
-    await act(async () => {
-      fireEvent.click(screen.getByRole('button', { name: 'common.operation.add' }))
-    })
-
-    await waitFor(() => {
-      expect(screen.getByPlaceholderText('appAnnotation.addModal.queryPlaceholder')).toHaveValue('')
-      expect(screen.getByPlaceholderText('appAnnotation.addModal.answerPlaceholder')).toHaveValue('')
-    })
-  })
-
-  test('should show toast when validation fails for missing question', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-
-    fireEvent.click(screen.getByRole('button', { name: 'common.operation.add' }))
-    expect(mockToastNotify).toHaveBeenCalledWith(expect.objectContaining({
-      type: 'error',
-      message: 'appAnnotation.errorMessage.queryRequired',
-    }))
-  })
-
-  test('should show toast when validation fails for missing answer', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-    typeQuestion('Filled question')
-    fireEvent.click(screen.getByRole('button', { name: 'common.operation.add' }))
-
-    expect(mockToastNotify).toHaveBeenCalledWith(expect.objectContaining({
-      type: 'error',
-      message: 'appAnnotation.errorMessage.answerRequired',
-    }))
-  })
-
-  test('should close modal when save completes and create next unchecked', async () => {
-    const onAdd = jest.fn().mockResolvedValue(undefined)
-    render(<AddAnnotationModal {...baseProps} onAdd={onAdd} />)
-
-    typeQuestion('Q')
-    typeAnswer('A')
-
-    await act(async () => {
-      fireEvent.click(screen.getByRole('button', { name: 'common.operation.add' }))
-    })
-
-    expect(baseProps.onHide).toHaveBeenCalled()
-  })
-
-  test('should allow cancel button to close the drawer', () => {
-    render(<AddAnnotationModal {...baseProps} />)
-
-    fireEvent.click(screen.getByRole('button', { name: 'common.operation.cancel' }))
-    expect(baseProps.onHide).toHaveBeenCalled()
-  })
-})

web/app/components/app/annotation/add-annotation-modal/index.tsx

@@ -101,7 +101,7 @@ const AddAnnotationModal: FC<Props> = ({
                 <div
                   className='flex items-center space-x-2'
                 >
-                  <Checkbox id='create-next-checkbox' checked={isCreateNext} onCheck={() => setIsCreateNext(!isCreateNext)} />
+                  <Checkbox checked={isCreateNext} onCheck={() => setIsCreateNext(!isCreateNext)} />
                   <div>{t('appAnnotation.addModal.createNext')}</div>
                 </div>
                 <div className='mt-2 flex space-x-2'>

web/app/components/app/annotation/batch-add-annotation-modal/csv-uploader.spec.tsx

@@ -3,6 +3,12 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import CSVUploader, { type Props } from './csv-uploader'
 import { ToastContext } from '@/app/components/base/toast'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 describe('CSVUploader', () => {
   const notify = jest.fn()
   const updateFile = jest.fn()

web/app/components/app/annotation/edit-annotation-modal/edit-item/index.spec.tsx

@@ -1,397 +0,0 @@
-import { render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import EditItem, { EditItemType, EditTitle } from './index'
-
-describe('EditTitle', () => {
-  it('should render title content correctly', () => {
-    // Arrange
-    const props = { title: 'Test Title' }
-
-    // Act
-    render(<EditTitle {...props} />)
-
-    // Assert
-    expect(screen.getByText(/test title/i)).toBeInTheDocument()
-    // Should contain edit icon (svg element)
-    expect(document.querySelector('svg')).toBeInTheDocument()
-  })
-
-  it('should apply custom className when provided', () => {
-    // Arrange
-    const props = {
-      title: 'Test Title',
-      className: 'custom-class',
-    }
-
-    // Act
-    const { container } = render(<EditTitle {...props} />)
-
-    // Assert
-    expect(screen.getByText(/test title/i)).toBeInTheDocument()
-    expect(container.querySelector('.custom-class')).toBeInTheDocument()
-  })
-})
-
-describe('EditItem', () => {
-  const defaultProps = {
-    type: EditItemType.Query,
-    content: 'Test content',
-    onSave: jest.fn(),
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  // Rendering tests (REQUIRED)
-  describe('Rendering', () => {
-    it('should render content correctly', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(/test content/i)).toBeInTheDocument()
-      // Should show item name (query or answer)
-      expect(screen.getByText('appAnnotation.editModal.queryName')).toBeInTheDocument()
-    })
-
-    it('should render different item types correctly', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        type: EditItemType.Answer,
-        content: 'Answer content',
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(/answer content/i)).toBeInTheDocument()
-      expect(screen.getByText('appAnnotation.editModal.answerName')).toBeInTheDocument()
-    })
-
-    it('should show edit controls when not readonly', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText('common.operation.edit')).toBeInTheDocument()
-    })
-
-    it('should hide edit controls when readonly', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        readonly: true,
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.queryByText('common.operation.edit')).not.toBeInTheDocument()
-    })
-  })
-
-  // Props tests (REQUIRED)
-  describe('Props', () => {
-    it('should respect readonly prop for edit functionality', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        readonly: true,
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(/test content/i)).toBeInTheDocument()
-      expect(screen.queryByText('common.operation.edit')).not.toBeInTheDocument()
-    })
-
-    it('should display provided content', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        content: 'Custom content for testing',
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(/custom content for testing/i)).toBeInTheDocument()
-    })
-
-    it('should render appropriate content based on type', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        type: EditItemType.Query,
-        content: 'Question content',
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(/question content/i)).toBeInTheDocument()
-      expect(screen.getByText('appAnnotation.editModal.queryName')).toBeInTheDocument()
-    })
-  })
-
-  // User Interactions
-  describe('User Interactions', () => {
-    it('should activate edit mode when edit button is clicked', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-
-      // Assert
-      expect(screen.getByRole('textbox')).toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'common.operation.save' })).toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'common.operation.cancel' })).toBeInTheDocument()
-    })
-
-    it('should save new content when save button is clicked', async () => {
-      // Arrange
-      const mockSave = jest.fn().mockResolvedValue(undefined)
-      const props = {
-        ...defaultProps,
-        onSave: mockSave,
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-
-      // Type new content
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'Updated content')
-
-      // Save
-      await user.click(screen.getByRole('button', { name: 'common.operation.save' }))
-
-      // Assert
-      expect(mockSave).toHaveBeenCalledWith('Updated content')
-    })
-
-    it('should exit edit mode when cancel button is clicked', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-      await user.click(screen.getByRole('button', { name: 'common.operation.cancel' }))
-
-      // Assert
-      expect(screen.queryByRole('textbox')).not.toBeInTheDocument()
-      expect(screen.getByText(/test content/i)).toBeInTheDocument()
-    })
-
-    it('should show content preview while typing', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-
-      const textarea = screen.getByRole('textbox')
-      await user.type(textarea, 'New content')
-
-      // Assert
-      expect(screen.getByText(/new content/i)).toBeInTheDocument()
-    })
-
-    it('should call onSave with correct content when saving', async () => {
-      // Arrange
-      const mockSave = jest.fn().mockResolvedValue(undefined)
-      const props = {
-        ...defaultProps,
-        onSave: mockSave,
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'Test save content')
-
-      // Save
-      await user.click(screen.getByRole('button', { name: 'common.operation.save' }))
-
-      // Assert
-      expect(mockSave).toHaveBeenCalledWith('Test save content')
-    })
-
-    it('should show delete option when content changes', async () => {
-      // Arrange
-      const mockSave = jest.fn().mockResolvedValue(undefined)
-      const props = {
-        ...defaultProps,
-        onSave: mockSave,
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Enter edit mode and change content
-      await user.click(screen.getByText('common.operation.edit'))
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'Modified content')
-
-      // Save to trigger content change
-      await user.click(screen.getByRole('button', { name: 'common.operation.save' }))
-
-      // Assert
-      expect(mockSave).toHaveBeenCalledWith('Modified content')
-    })
-
-    it('should handle keyboard interactions in edit mode', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-      await user.click(screen.getByText('common.operation.edit'))
-
-      const textarea = screen.getByRole('textbox')
-
-      // Test typing
-      await user.type(textarea, 'Keyboard test')
-
-      // Assert
-      expect(textarea).toHaveValue('Keyboard test')
-      expect(screen.getByText(/keyboard test/i)).toBeInTheDocument()
-    })
-  })
-
-  // State Management
-  describe('State Management', () => {
-    it('should reset newContent when content prop changes', async () => {
-      // Arrange
-      const { rerender } = render(<EditItem {...defaultProps} />)
-
-      // Act - Enter edit mode and type something
-      const user = userEvent.setup()
-      await user.click(screen.getByText('common.operation.edit'))
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'New content')
-
-      // Rerender with new content prop
-      rerender(<EditItem {...defaultProps} content="Updated content" />)
-
-      // Assert - Textarea value should be reset due to useEffect
-      expect(textarea).toHaveValue('')
-    })
-
-    it('should preserve edit state across content changes', async () => {
-      // Arrange
-      const { rerender } = render(<EditItem {...defaultProps} />)
-      const user = userEvent.setup()
-
-      // Act - Enter edit mode
-      await user.click(screen.getByText('common.operation.edit'))
-
-      // Rerender with new content
-      rerender(<EditItem {...defaultProps} content="Updated content" />)
-
-      // Assert - Should still be in edit mode
-      expect(screen.getByRole('textbox')).toBeInTheDocument()
-    })
-  })
-
-  // Edge Cases (REQUIRED)
-  describe('Edge Cases', () => {
-    it('should handle empty content', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        content: '',
-      }
-
-      // Act
-      const { container } = render(<EditItem {...props} />)
-
-      // Assert - Should render without crashing
-      // Check that the component renders properly with empty content
-      expect(container.querySelector('.grow')).toBeInTheDocument()
-      // Should still show edit button
-      expect(screen.getByText('common.operation.edit')).toBeInTheDocument()
-    })
-
-    it('should handle very long content', () => {
-      // Arrange
-      const longContent = 'A'.repeat(1000)
-      const props = {
-        ...defaultProps,
-        content: longContent,
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(longContent)).toBeInTheDocument()
-    })
-
-    it('should handle content with special characters', () => {
-      // Arrange
-      const specialContent = 'Content with & < > " \' characters'
-      const props = {
-        ...defaultProps,
-        content: specialContent,
-      }
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Assert
-      expect(screen.getByText(specialContent)).toBeInTheDocument()
-    })
-
-    it('should handle rapid edit/cancel operations', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditItem {...props} />)
-
-      // Rapid edit/cancel operations
-      await user.click(screen.getByText('common.operation.edit'))
-      await user.click(screen.getByText('common.operation.cancel'))
-      await user.click(screen.getByText('common.operation.edit'))
-      await user.click(screen.getByText('common.operation.cancel'))
-
-      // Assert
-      expect(screen.queryByRole('textbox')).not.toBeInTheDocument()
-      expect(screen.getByText('Test content')).toBeInTheDocument()
-    })
-  })
-})

web/app/components/app/annotation/edit-annotation-modal/index.spec.tsx

@@ -1,408 +0,0 @@
-import { render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import Toast, { type IToastProps, type ToastHandle } from '@/app/components/base/toast'
-import EditAnnotationModal from './index'
-
-// Mock only external dependencies
-jest.mock('@/service/annotation', () => ({
-  addAnnotation: jest.fn(),
-  editAnnotation: jest.fn(),
-}))
-
-jest.mock('@/context/provider-context', () => ({
-  useProviderContext: () => ({
-    plan: {
-      usage: { annotatedResponse: 5 },
-      total: { annotatedResponse: 10 },
-    },
-    enableBilling: true,
-  }),
-}))
-
-jest.mock('@/hooks/use-timestamp', () => ({
-  __esModule: true,
-  default: () => ({
-    formatTime: () => '2023-12-01 10:30:00',
-  }),
-}))
-
-// Note: i18n is automatically mocked by Jest via __mocks__/react-i18next.ts
-
-jest.mock('@/app/components/billing/annotation-full', () => ({
-  __esModule: true,
-  default: () => <div data-testid="annotation-full" />,
-}))
-
-type ToastNotifyProps = Pick<IToastProps, 'type' | 'size' | 'message' | 'duration' | 'className' | 'customComponent' | 'onClose'>
-type ToastWithNotify = typeof Toast & { notify: (props: ToastNotifyProps) => ToastHandle }
-const toastWithNotify = Toast as unknown as ToastWithNotify
-const toastNotifySpy = jest.spyOn(toastWithNotify, 'notify').mockReturnValue({ clear: jest.fn() })
-
-const { addAnnotation: mockAddAnnotation, editAnnotation: mockEditAnnotation } = jest.requireMock('@/service/annotation') as {
-  addAnnotation: jest.Mock
-  editAnnotation: jest.Mock
-}
-
-describe('EditAnnotationModal', () => {
-  const defaultProps = {
-    isShow: true,
-    onHide: jest.fn(),
-    appId: 'test-app-id',
-    query: 'Test query',
-    answer: 'Test answer',
-    onEdited: jest.fn(),
-    onAdded: jest.fn(),
-    onRemove: jest.fn(),
-  }
-
-  afterAll(() => {
-    toastNotifySpy.mockRestore()
-  })
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-    mockAddAnnotation.mockResolvedValue({
-      id: 'test-id',
-      account: { name: 'Test User' },
-    })
-    mockEditAnnotation.mockResolvedValue({})
-  })
-
-  // Rendering tests (REQUIRED)
-  describe('Rendering', () => {
-    it('should render modal when isShow is true', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Check for modal title as it appears in the mock
-      expect(screen.getByText('appAnnotation.editModal.title')).toBeInTheDocument()
-    })
-
-    it('should not render modal when isShow is false', () => {
-      // Arrange
-      const props = { ...defaultProps, isShow: false }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert
-      expect(screen.queryByText('appAnnotation.editModal.title')).not.toBeInTheDocument()
-    })
-
-    it('should display query and answer sections', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Look for query and answer content
-      expect(screen.getByText('Test query')).toBeInTheDocument()
-      expect(screen.getByText('Test answer')).toBeInTheDocument()
-    })
-  })
-
-  // Props tests (REQUIRED)
-  describe('Props', () => {
-    it('should handle different query and answer content', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        query: 'Custom query content',
-        answer: 'Custom answer content',
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Check content is displayed
-      expect(screen.getByText('Custom query content')).toBeInTheDocument()
-      expect(screen.getByText('Custom answer content')).toBeInTheDocument()
-    })
-
-    it('should show remove option when annotationId is provided', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        annotationId: 'test-annotation-id',
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Remove option should be present (using pattern)
-      expect(screen.getByText('appAnnotation.editModal.removeThisCache')).toBeInTheDocument()
-    })
-  })
-
-  // User Interactions
-  describe('User Interactions', () => {
-    it('should enable editing for query and answer sections', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Edit links should be visible (using text content)
-      const editLinks = screen.getAllByText(/common\.operation\.edit/i)
-      expect(editLinks).toHaveLength(2)
-    })
-
-    it('should show remove option when annotationId is provided', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        annotationId: 'test-annotation-id',
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert
-      expect(screen.getByText('appAnnotation.editModal.removeThisCache')).toBeInTheDocument()
-    })
-
-    it('should save content when edited', async () => {
-      // Arrange
-      const mockOnAdded = jest.fn()
-      const props = {
-        ...defaultProps,
-        onAdded: mockOnAdded,
-      }
-      const user = userEvent.setup()
-
-      // Mock API response
-      mockAddAnnotation.mockResolvedValueOnce({
-        id: 'test-annotation-id',
-        account: { name: 'Test User' },
-      })
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Find and click edit link for query
-      const editLinks = screen.getAllByText(/common\.operation\.edit/i)
-      await user.click(editLinks[0])
-
-      // Find textarea and enter new content
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'New query content')
-
-      // Click save button
-      const saveButton = screen.getByRole('button', { name: 'common.operation.save' })
-      await user.click(saveButton)
-
-      // Assert
-      expect(mockAddAnnotation).toHaveBeenCalledWith('test-app-id', {
-        question: 'New query content',
-        answer: 'Test answer',
-        message_id: undefined,
-      })
-    })
-  })
-
-  // API Calls
-  describe('API Calls', () => {
-    it('should call addAnnotation when saving new annotation', async () => {
-      // Arrange
-      const mockOnAdded = jest.fn()
-      const props = {
-        ...defaultProps,
-        onAdded: mockOnAdded,
-      }
-      const user = userEvent.setup()
-
-      // Mock the API response
-      mockAddAnnotation.mockResolvedValueOnce({
-        id: 'test-annotation-id',
-        account: { name: 'Test User' },
-      })
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Edit query content
-      const editLinks = screen.getAllByText(/common\.operation\.edit/i)
-      await user.click(editLinks[0])
-
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'Updated query')
-
-      const saveButton = screen.getByRole('button', { name: 'common.operation.save' })
-      await user.click(saveButton)
-
-      // Assert
-      expect(mockAddAnnotation).toHaveBeenCalledWith('test-app-id', {
-        question: 'Updated query',
-        answer: 'Test answer',
-        message_id: undefined,
-      })
-    })
-
-    it('should call editAnnotation when updating existing annotation', async () => {
-      // Arrange
-      const mockOnEdited = jest.fn()
-      const props = {
-        ...defaultProps,
-        annotationId: 'test-annotation-id',
-        messageId: 'test-message-id',
-        onEdited: mockOnEdited,
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Edit query content
-      const editLinks = screen.getAllByText(/common\.operation\.edit/i)
-      await user.click(editLinks[0])
-
-      const textarea = screen.getByRole('textbox')
-      await user.clear(textarea)
-      await user.type(textarea, 'Modified query')
-
-      const saveButton = screen.getByRole('button', { name: 'common.operation.save' })
-      await user.click(saveButton)
-
-      // Assert
-      expect(mockEditAnnotation).toHaveBeenCalledWith(
-        'test-app-id',
-        'test-annotation-id',
-        {
-          message_id: 'test-message-id',
-          question: 'Modified query',
-          answer: 'Test answer',
-        },
-      )
-    })
-  })
-
-  // State Management
-  describe('State Management', () => {
-    it('should initialize with closed confirm modal', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Confirm dialog should not be visible initially
-      expect(screen.queryByText('appDebug.feature.annotation.removeConfirm')).not.toBeInTheDocument()
-    })
-
-    it('should show confirm modal when remove is clicked', async () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        annotationId: 'test-annotation-id',
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-      await user.click(screen.getByText('appAnnotation.editModal.removeThisCache'))
-
-      // Assert - Confirmation dialog should appear
-      expect(screen.getByText('appDebug.feature.annotation.removeConfirm')).toBeInTheDocument()
-    })
-
-    it('should call onRemove when removal is confirmed', async () => {
-      // Arrange
-      const mockOnRemove = jest.fn()
-      const props = {
-        ...defaultProps,
-        annotationId: 'test-annotation-id',
-        onRemove: mockOnRemove,
-      }
-      const user = userEvent.setup()
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Click remove
-      await user.click(screen.getByText('appAnnotation.editModal.removeThisCache'))
-
-      // Click confirm
-      const confirmButton = screen.getByRole('button', { name: 'common.operation.confirm' })
-      await user.click(confirmButton)
-
-      // Assert
-      expect(mockOnRemove).toHaveBeenCalled()
-    })
-  })
-
-  // Edge Cases (REQUIRED)
-  describe('Edge Cases', () => {
-    it('should handle empty query and answer', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        query: '',
-        answer: '',
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert
-      expect(screen.getByText('appAnnotation.editModal.title')).toBeInTheDocument()
-    })
-
-    it('should handle very long content', () => {
-      // Arrange
-      const longQuery = 'Q'.repeat(1000)
-      const longAnswer = 'A'.repeat(1000)
-      const props = {
-        ...defaultProps,
-        query: longQuery,
-        answer: longAnswer,
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert
-      expect(screen.getByText(longQuery)).toBeInTheDocument()
-      expect(screen.getByText(longAnswer)).toBeInTheDocument()
-    })
-
-    it('should handle special characters in content', () => {
-      // Arrange
-      const specialQuery = 'Query with & < > " \' characters'
-      const specialAnswer = 'Answer with & < > " \' characters'
-      const props = {
-        ...defaultProps,
-        query: specialQuery,
-        answer: specialAnswer,
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert
-      expect(screen.getByText(specialQuery)).toBeInTheDocument()
-      expect(screen.getByText(specialAnswer)).toBeInTheDocument()
-    })
-
-    it('should handle onlyEditResponse prop', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        onlyEditResponse: true,
-      }
-
-      // Act
-      render(<EditAnnotationModal {...props} />)
-
-      // Assert - Query should be readonly, answer should be editable
-      const editLinks = screen.queryAllByText(/common\.operation\.edit/i)
-      expect(editLinks).toHaveLength(1) // Only answer should have edit button
-    })
-  })
-})

web/app/components/app/configuration/base/operation-btn/index.spec.tsx

@@ -1,6 +1,12 @@
 import { fireEvent, render, screen } from '@testing-library/react'
 import OperationBtn from './index'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 jest.mock('@remixicon/react', () => ({
   RiAddLine: (props: { className?: string }) => (
     <svg data-testid='add-icon' className={props.className} />

web/app/components/app/configuration/base/warning-mask/cannot-query-dataset.spec.tsx

@@ -1,22 +0,0 @@
-import React from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
-import CannotQueryDataset from './cannot-query-dataset'
-
-describe('CannotQueryDataset WarningMask', () => {
-  test('should render dataset warning copy and action button', () => {
-    const onConfirm = jest.fn()
-    render(<CannotQueryDataset onConfirm={onConfirm} />)
-
-    expect(screen.getByText('appDebug.feature.dataSet.queryVariable.unableToQueryDataSet')).toBeInTheDocument()
-    expect(screen.getByText('appDebug.feature.dataSet.queryVariable.unableToQueryDataSetTip')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'appDebug.feature.dataSet.queryVariable.ok' })).toBeInTheDocument()
-  })
-
-  test('should invoke onConfirm when OK button clicked', () => {
-    const onConfirm = jest.fn()
-    render(<CannotQueryDataset onConfirm={onConfirm} />)
-
-    fireEvent.click(screen.getByRole('button', { name: 'appDebug.feature.dataSet.queryVariable.ok' }))
-    expect(onConfirm).toHaveBeenCalledTimes(1)
-  })
-})

web/app/components/app/configuration/base/warning-mask/formatting-changed.spec.tsx

@@ -1,39 +0,0 @@
-import React from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
-import FormattingChanged from './formatting-changed'
-
-describe('FormattingChanged WarningMask', () => {
-  test('should display translation text and both actions', () => {
-    const onConfirm = jest.fn()
-    const onCancel = jest.fn()
-
-    render(
-      <FormattingChanged
-        onConfirm={onConfirm}
-        onCancel={onCancel}
-      />,
-    )
-
-    expect(screen.getByText('appDebug.formattingChangedTitle')).toBeInTheDocument()
-    expect(screen.getByText('appDebug.formattingChangedText')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'common.operation.cancel' })).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: /common\.operation\.refresh/ })).toBeInTheDocument()
-  })
-
-  test('should call callbacks when buttons are clicked', () => {
-    const onConfirm = jest.fn()
-    const onCancel = jest.fn()
-    render(
-      <FormattingChanged
-        onConfirm={onConfirm}
-        onCancel={onCancel}
-      />,
-    )
-
-    fireEvent.click(screen.getByRole('button', { name: /common\.operation\.refresh/ }))
-    fireEvent.click(screen.getByRole('button', { name: 'common.operation.cancel' }))
-
-    expect(onConfirm).toHaveBeenCalledTimes(1)
-    expect(onCancel).toHaveBeenCalledTimes(1)
-  })
-})

web/app/components/app/configuration/base/warning-mask/has-not-set-api.spec.tsx

@@ -1,26 +0,0 @@
-import React from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
-import HasNotSetAPI from './has-not-set-api'
-
-describe('HasNotSetAPI WarningMask', () => {
-  test('should show default title when trial not finished', () => {
-    render(<HasNotSetAPI isTrailFinished={false} onSetting={jest.fn()} />)
-
-    expect(screen.getByText('appDebug.notSetAPIKey.title')).toBeInTheDocument()
-    expect(screen.getByText('appDebug.notSetAPIKey.description')).toBeInTheDocument()
-  })
-
-  test('should show trail finished title when flag is true', () => {
-    render(<HasNotSetAPI isTrailFinished onSetting={jest.fn()} />)
-
-    expect(screen.getByText('appDebug.notSetAPIKey.trailFinished')).toBeInTheDocument()
-  })
-
-  test('should call onSetting when primary button clicked', () => {
-    const onSetting = jest.fn()
-    render(<HasNotSetAPI isTrailFinished={false} onSetting={onSetting} />)
-
-    fireEvent.click(screen.getByRole('button', { name: 'appDebug.notSetAPIKey.settingBtn' }))
-    expect(onSetting).toHaveBeenCalledTimes(1)
-  })
-})

web/app/components/app/configuration/base/warning-mask/index.spec.tsx

@@ -1,25 +0,0 @@
-import React from 'react'
-import { render, screen } from '@testing-library/react'
-import WarningMask from './index'
-
-describe('WarningMask', () => {
-  // Rendering of title, description, and footer content
-  describe('Rendering', () => {
-    test('should display provided title, description, and footer node', () => {
-      const footer = <button type="button">Retry</button>
-      // Arrange
-      render(
-        <WarningMask
-          title="Access Restricted"
-          description="Only workspace owners may modify this section."
-          footer={footer}
-        />,
-      )
-
-      // Assert
-      expect(screen.getByText('Access Restricted')).toBeInTheDocument()
-      expect(screen.getByText('Only workspace owners may modify this section.')).toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'Retry' })).toBeInTheDocument()
-    })
-  })
-})

web/app/components/app/configuration/config-prompt/confirm-add-var/index.spec.tsx

@@ -2,6 +2,12 @@ import React from 'react'
 import { fireEvent, render, screen } from '@testing-library/react'
 import ConfirmAddVar from './index'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 jest.mock('../../base/var-highlight', () => ({
   __esModule: true,
   default: ({ name }: { name: string }) => <span data-testid="var-highlight">{name}</span>,

web/app/components/app/configuration/config-prompt/conversation-history/edit-modal.spec.tsx

@@ -3,6 +3,12 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import EditModal from './edit-modal'
 import type { ConversationHistoriesRole } from '@/models/debug'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 jest.mock('@/app/components/base/modal', () => ({
   __esModule: true,
   default: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,

web/app/components/app/configuration/config-prompt/conversation-history/history-panel.spec.tsx

@@ -2,6 +2,12 @@ import React from 'react'
 import { render, screen } from '@testing-library/react'
 import HistoryPanel from './history-panel'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 const mockDocLink = jest.fn(() => 'doc-link')
 jest.mock('@/context/i18n', () => ({
   useDocLink: () => mockDocLink,

web/app/components/app/configuration/config-prompt/index.spec.tsx

@@ -6,6 +6,12 @@ import { MAX_PROMPT_MESSAGE_LENGTH } from '@/config'
 import { type PromptItem, PromptRole, type PromptVariable } from '@/models/debug'
 import { AppModeEnum, ModelModeType } from '@/types/app'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 type DebugConfiguration = {
   isAdvancedMode: boolean
   currentAdvancedPrompt: PromptItem | PromptItem[]

web/app/components/app/configuration/config-var/config-select/index.spec.tsx

@@ -5,6 +5,12 @@ jest.mock('react-sortablejs', () => ({
   ReactSortable: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
 }))
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 describe('ConfigSelect Component', () => {
   const defaultProps = {
     options: ['Option 1', 'Option 2'],

web/app/components/app/configuration/config-var/config-string/index.spec.tsx

@@ -1,121 +0,0 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import ConfigString, { type IConfigStringProps } from './index'
-
-const renderConfigString = (props?: Partial<IConfigStringProps>) => {
-  const onChange = jest.fn()
-  const defaultProps: IConfigStringProps = {
-    value: 5,
-    maxLength: 10,
-    modelId: 'model-id',
-    onChange,
-  }
-
-  render(<ConfigString {...defaultProps} {...props} />)
-
-  return { onChange }
-}
-
-describe('ConfigString', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  describe('Rendering', () => {
-    it('should render numeric input with bounds', () => {
-      renderConfigString({ value: 3, maxLength: 8 })
-
-      const input = screen.getByRole('spinbutton')
-
-      expect(input).toHaveValue(3)
-      expect(input).toHaveAttribute('min', '1')
-      expect(input).toHaveAttribute('max', '8')
-    })
-
-    it('should render empty input when value is undefined', () => {
-      const { onChange } = renderConfigString({ value: undefined })
-
-      expect(screen.getByRole('spinbutton')).toHaveValue(null)
-      expect(onChange).not.toHaveBeenCalled()
-    })
-  })
-
-  describe('Effect behavior', () => {
-    it('should clamp initial value to maxLength when it exceeds limit', async () => {
-      const onChange = jest.fn()
-      render(
-        <ConfigString
-          value={15}
-          maxLength={10}
-          modelId="model-id"
-          onChange={onChange}
-        />,
-      )
-
-      await waitFor(() => {
-        expect(onChange).toHaveBeenCalledWith(10)
-      })
-      expect(onChange).toHaveBeenCalledTimes(1)
-    })
-
-    it('should clamp when updated prop value exceeds maxLength', async () => {
-      const onChange = jest.fn()
-      const { rerender } = render(
-        <ConfigString
-          value={4}
-          maxLength={6}
-          modelId="model-id"
-          onChange={onChange}
-        />,
-      )
-
-      rerender(
-        <ConfigString
-          value={9}
-          maxLength={6}
-          modelId="model-id"
-          onChange={onChange}
-        />,
-      )
-
-      await waitFor(() => {
-        expect(onChange).toHaveBeenCalledWith(6)
-      })
-      expect(onChange).toHaveBeenCalledTimes(1)
-    })
-  })
-
-  describe('User interactions', () => {
-    it('should clamp entered value above maxLength', () => {
-      const { onChange } = renderConfigString({ maxLength: 7 })
-
-      fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '12' } })
-
-      expect(onChange).toHaveBeenCalledWith(7)
-    })
-
-    it('should raise value below minimum to one', () => {
-      const { onChange } = renderConfigString()
-
-      fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '0' } })
-
-      expect(onChange).toHaveBeenCalledWith(1)
-    })
-
-    it('should forward parsed value when within bounds', () => {
-      const { onChange } = renderConfigString({ maxLength: 9 })
-
-      fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '7' } })
-
-      expect(onChange).toHaveBeenCalledWith(7)
-    })
-
-    it('should pass through NaN when input is cleared', () => {
-      const { onChange } = renderConfigString()
-
-      fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '' } })
-
-      expect(onChange).toHaveBeenCalledTimes(1)
-      expect(onChange.mock.calls[0][0]).toBeNaN()
-    })
-  })
-})

web/app/components/app/configuration/config-var/select-type-item/index.spec.tsx

@@ -1,45 +0,0 @@
-import React from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
-import SelectTypeItem from './index'
-import { InputVarType } from '@/app/components/workflow/types'
-
-describe('SelectTypeItem', () => {
-  // Rendering pathways based on type and selection state
-  describe('Rendering', () => {
-    test('should render ok', () => {
-      // Arrange
-      const { container } = render(
-        <SelectTypeItem
-          type={InputVarType.textInput}
-          selected={false}
-          onClick={jest.fn()}
-        />,
-      )
-
-      // Assert
-      expect(screen.getByText('appDebug.variableConfig.text-input')).toBeInTheDocument()
-      expect(container.querySelector('svg')).not.toBeNull()
-    })
-  })
-
-  // User interaction outcomes
-  describe('Interactions', () => {
-    test('should trigger onClick when item is pressed', () => {
-      const handleClick = jest.fn()
-      // Arrange
-      render(
-        <SelectTypeItem
-          type={InputVarType.paragraph}
-          selected={false}
-          onClick={handleClick}
-        />,
-      )
-
-      // Act
-      fireEvent.click(screen.getByText('appDebug.variableConfig.paragraph'))
-
-      // Assert
-      expect(handleClick).toHaveBeenCalledTimes(1)
-    })
-  })
-})

web/app/components/app/configuration/config/agent/agent-tools/group-auth-control.tsx

@@ -1,142 +0,0 @@
-'use client'
-import type { FC } from 'react'
-import React, { useCallback } from 'react'
-import { RiArrowDownSLine } from '@remixicon/react'
-import { useTranslation } from 'react-i18next'
-import Button from '@/app/components/base/button'
-import Indicator from '@/app/components/header/indicator'
-import Authorize from '@/app/components/plugins/plugin-auth/authorize'
-import Authorized from '@/app/components/plugins/plugin-auth/authorized'
-import { AuthCategory } from '@/app/components/plugins/plugin-auth'
-import { usePluginAuth } from '@/app/components/plugins/plugin-auth/hooks/use-plugin-auth'
-import type { Credential } from '@/app/components/plugins/plugin-auth/types'
-import cn from '@/utils/classnames'
-import type { CollectionType } from '@/app/components/tools/types'
-
-type GroupAuthControlProps = {
-  providerId: string
-  providerName: string
-  providerType: CollectionType
-  credentialId?: string
-  onChange: (credentialId: string) => void
-}
-
-const GroupAuthControl: FC<GroupAuthControlProps> = ({
-  providerId,
-  providerName,
-  providerType,
-  credentialId,
-  onChange,
-}) => {
-  const { t } = useTranslation()
-  const {
-    isAuthorized,
-    canOAuth,
-    canApiKey,
-    credentials,
-    disabled,
-    invalidPluginCredentialInfo,
-    notAllowCustomCredential,
-  } = usePluginAuth({
-    provider: providerName,
-    providerType,
-    category: AuthCategory.tool,
-    detail: { id: providerId, name: providerName, type: providerType } as any,
-  }, true)
-
-  const extraAuthorizationItems: Credential[] = [
-    {
-      id: '__workspace_default__',
-      name: t('plugin.auth.workspaceDefault'),
-      provider: '',
-      is_default: !credentialId,
-      isWorkspaceDefault: true,
-    },
-  ]
-
-  const handleAuthorizationItemClick = useCallback((id: string) => {
-    onChange(id === '__workspace_default__' ? '' : id)
-  }, [onChange])
-
-  const renderTrigger = useCallback((open?: boolean) => {
-    let label = ''
-    let removed = false
-    let unavailable = false
-    let color = 'green'
-    if (!credentialId) {
-      label = t('plugin.auth.workspaceDefault')
-    }
-    else {
-      const credential = credentials.find(c => c.id === credentialId)
-      label = credential ? credential.name : t('plugin.auth.authRemoved')
-      removed = !credential
-      unavailable = !!credential?.not_allowed_to_use && !credential?.from_enterprise
-      if (removed)
-        color = 'red'
-      else if (unavailable)
-        color = 'gray'
-    }
-
-    return (
-      <Button
-        className={cn(
-          'h-9',
-          open && 'bg-components-button-secondary-bg-hover',
-          removed && 'text-text-destructive',
-        )}
-        variant='secondary'
-        size='small'
-      >
-        <Indicator className='mr-2' color={color as any} />
-        {label}
-        {
-          unavailable && t('plugin.auth.unavailable')
-        }
-        <RiArrowDownSLine className='ml-0.5 h-4 w-4' />
-      </Button>
-    )
-  }, [credentialId, credentials, t])
-
-  if (!isAuthorized) {
-    return (
-      <Authorize
-        pluginPayload={{
-          provider: providerName,
-          providerType,
-          category: AuthCategory.tool,
-          detail: { id: providerId, name: providerName, type: providerType } as any,
-        }}
-        canOAuth={canOAuth}
-        canApiKey={canApiKey}
-        disabled={disabled}
-        onUpdate={invalidPluginCredentialInfo}
-        notAllowCustomCredential={notAllowCustomCredential}
-      />
-    )
-  }
-
-  return (
-    <Authorized
-      pluginPayload={{
-        provider: providerName,
-        providerType,
-        category: AuthCategory.tool,
-        detail: { id: providerId, name: providerName, type: providerType } as any,
-      }}
-      credentials={credentials}
-      canOAuth={canOAuth}
-      canApiKey={canApiKey}
-      disabled={disabled}
-      disableSetDefault
-      onItemClick={handleAuthorizationItemClick}
-      extraAuthorizationItems={extraAuthorizationItems}
-      showItemSelectedIcon
-      renderTrigger={renderTrigger}
-      selectedCredentialId={credentialId || '__workspace_default__'}
-      onUpdate={invalidPluginCredentialInfo}
-      notAllowCustomCredential={notAllowCustomCredential}
-    />
-  )
-}
-
-export default React.memo(GroupAuthControl)

web/app/components/app/configuration/config/agent/agent-tools/index.tsx

@@ -6,7 +6,6 @@ import { useContext } from 'use-context-selector'
 import copy from 'copy-to-clipboard'
 import { produce } from 'immer'
 import {
-  RiArrowDownSLine,
   RiDeleteBinLine,
   RiEqualizer2Line,
   RiInformation2Line,
@@ -25,6 +24,7 @@ import { type Collection, CollectionType } from '@/app/components/tools/types'
 import { MAX_TOOLS_NUM } from '@/config'
 import { AlertTriangle } from '@/app/components/base/icons/src/vender/solid/alertsAndFeedback'
 import Tooltip from '@/app/components/base/tooltip'
+import { DefaultToolIcon } from '@/app/components/base/icons/src/public/other'
 import cn from '@/utils/classnames'
 import ToolPicker from '@/app/components/workflow/block-selector/tool-picker'
 import type { ToolDefaultValue, ToolValue } from '@/app/components/workflow/block-selector/types'
@@ -33,9 +33,8 @@ import { useAllBuiltInTools, useAllCustomTools, useAllMCPTools, useAllWorkflowTo
 import type { ToolWithProvider } from '@/app/components/workflow/types'
 import { useMittContextSelector } from '@/context/mitt-context'
 import { addDefaultValue, toolParametersToFormSchemas } from '@/app/components/tools/utils/to-form-schema'
-import { DefaultToolIcon } from '@/app/components/base/icons/src/public/other'
 
-type AgentToolWithMoreInfo = (AgentTool & { icon: any; collection?: Collection; use_end_user_credentials?: boolean; end_user_credential_type?: string }) | null
+type AgentToolWithMoreInfo = AgentTool & { icon: any; collection?: Collection } | null
 const AgentTools: FC = () => {
   const { t } = useTranslation()
   const [isShowChooseTool, setIsShowChooseTool] = useState(false)
@@ -94,13 +93,6 @@ const AgentTools: FC = () => {
   }
 
   const [isDeleting, setIsDeleting] = useState<number>(-1)
-  const [expandedProviders, setExpandedProviders] = useState<Record<string, boolean>>({})
-  const toggleProviderExpand = useCallback((providerId: string) => {
-    setExpandedProviders(prev => ({
-      ...prev,
-      [providerId]: !prev[providerId],
-    }))
-  }, [])
   const getToolValue = (tool: ToolDefaultValue) => {
     const currToolInCollections = collectionList.find(c => c.id === tool.provider_id)
     const currToolWithConfigs = currToolInCollections?.tools.find(t => t.name === tool.tool_name)
@@ -115,9 +107,7 @@ const AgentTools: FC = () => {
       tool_parameters: paramsWithDefaultValue,
       notAuthor: !tool.is_team_authorization,
       enabled: true,
-      use_end_user_credentials: false,
-      end_user_credential_type: '',
-    } as any
+    }
   }
   const handleSelectTool = (tool: ToolDefaultValue) => {
     const newModelConfig = produce(modelConfig, (draft) => {
@@ -153,34 +143,6 @@ const AgentTools: FC = () => {
     formattingChangedDispatcher()
   }, [currentTool, modelConfig, setModelConfig, formattingChangedDispatcher])
 
-  const handleEndUserCredentialChange = useCallback((enabled: boolean) => {
-    const newModelConfig = produce(modelConfig, (draft) => {
-      const tool = (draft.agentConfig.tools).find((item: any) => item.provider_id === currentTool?.provider_id)
-      if (tool)
-        (tool as AgentTool).use_end_user_credentials = enabled
-    })
-    setCurrentTool({
-      ...currentTool,
-      use_end_user_credentials: enabled,
-    } as any)
-    setModelConfig(newModelConfig)
-    formattingChangedDispatcher()
-  }, [currentTool, modelConfig, setModelConfig, formattingChangedDispatcher])
-
-  const handleEndUserCredentialTypeChange = useCallback((type: string) => {
-    const newModelConfig = produce(modelConfig, (draft) => {
-      const tool = (draft.agentConfig.tools).find((item: any) => item.provider_id === currentTool?.provider_id)
-      if (tool)
-        (tool as AgentTool).end_user_credential_type = type
-    })
-    setCurrentTool({
-      ...currentTool,
-      end_user_credential_type: type,
-    } as any)
-    setModelConfig(newModelConfig)
-    formattingChangedDispatcher()
-  }, [currentTool, modelConfig, setModelConfig, formattingChangedDispatcher])
-
   return (
     <>
       <Panel
@@ -220,307 +182,135 @@ const AgentTools: FC = () => {
           </div>
         }
       >
-        <div className='space-y-2'>
-          {Object.values(
-            tools.reduce((acc, item, idx) => {
-              const key = item.provider_id
-              if (!acc[key]) {
-                acc[key] = {
-                  providerId: item.provider_id,
-                  providerName: getProviderShowName(item) || '',
-                  icon: item.icon,
-                  providerType: item.provider_type,
-                  tools: [] as (AgentTool & { __index: number })[],
-                }
-              }
-              acc[key].tools.push({ ...item, __index: idx })
-              return acc
-            }, {} as Record<string, { providerId: string; providerName: string; providerType: CollectionType; icon: any; tools: (AgentTool & { __index: number })[] }>),
-          ).map(group => (
-            <div
-              key={group.providerId}
-              className='rounded-lg border border-components-panel-border-subtle bg-components-panel-on-panel-item-bg p-2 shadow-xs'
+        <div className='grid grid-cols-1 flex-wrap items-center justify-between gap-1 2xl:grid-cols-2'>
+          {tools.map((item: AgentTool & { icon: any; collection?: Collection }, index) => (
+            <div key={index}
+              className={cn(
+                'cursor group relative flex w-full items-center justify-between rounded-lg border-[0.5px] border-components-panel-border-subtle bg-components-panel-on-panel-item-bg p-1.5 pr-2 shadow-xs last-of-type:mb-0 hover:bg-components-panel-on-panel-item-bg-hover hover:shadow-sm',
+                isDeleting === index && 'border-state-destructive-border hover:bg-state-destructive-hover',
+              )}
             >
-              <div
-                className='flex cursor-pointer items-center gap-2 px-1'
-                onClick={() => toggleProviderExpand(group.providerId)}
-              >
-                <RiArrowDownSLine
-                  className={cn(
-                    'h-4 w-4 shrink-0 text-text-tertiary transition-transform',
-                    !expandedProviders[group.providerId] && '-rotate-90',
-                  )}
-                />
-                {typeof group.icon === 'string'
-                  ? <div className='h-5 w-5 shrink-0 rounded-md bg-cover bg-center' style={{ backgroundImage: `url(${group.icon})` }} />
-                  : <AppIcon className='shrink-0 rounded-md' size='xs' icon={group.icon?.content} background={group.icon?.background} />}
-                <div className='system-sm-semibold truncate text-text-secondary'>{group.providerName}</div>
-                <div className='ml-auto flex shrink-0 items-center gap-2'>
-                  <div className='system-xs-regular text-text-tertiary'>
-                    {group.tools.filter(tool => tool.enabled).length}/{group.tools.length}&nbsp;{t('appDebug.agent.tools.enabled')}
+              <div className='flex w-0 grow items-center'>
+                {item.isDeleted && <DefaultToolIcon className='h-5 w-5' />}
+                {!item.isDeleted && (
+                  <div className={cn((item.notAuthor || !item.enabled) && 'shrink-0 opacity-50')}>
+                    {typeof item.icon === 'string' && <div className='h-5 w-5 rounded-md bg-cover bg-center' style={{ backgroundImage: `url(${item.icon})` }} />}
+                    {typeof item.icon !== 'string' && <AppIcon className='rounded-md' size='xs' icon={item.icon?.content} background={item.icon?.background} />}
                   </div>
-                  {group.tools.every(tool => tool.notAuthor) && (
-                    <Button
-                      variant='secondary'
-                      size='small'
-                      onClick={(e) => {
-                        e.stopPropagation()
-                        const first = group.tools[0]
-                        setCurrentTool(first as any)
-                        setIsShowSettingTool(true)
-                      }}
+                )}
+                <div
+                  className={cn(
+                    'system-xs-regular ml-1.5 flex w-0 grow items-center truncate',
+                    (item.isDeleted || item.notAuthor || !item.enabled) ? 'opacity-50' : '',
+                  )}
+                >
+                  <span className='system-xs-medium pr-1.5 text-text-secondary'>{getProviderShowName(item)}</span>
+                  <span className='text-text-tertiary'>{item.tool_label}</span>
+                  {!item.isDeleted && (
+                    <Tooltip
+                      popupContent={
+                        <div className='w-[180px]'>
+                          <div className='mb-1.5 text-text-secondary'>{item.tool_name}</div>
+                          <div className='mb-1.5 text-text-tertiary'>{t('tools.toolNameUsageTip')}</div>
+                          <div className='cursor-pointer text-text-accent' onClick={() => copy(item.tool_name)}>{t('tools.copyToolName')}</div>
+                        </div>
+                      }
                     >
+                      <div className='h-4 w-4'>
+                        <div className='ml-0.5 hidden group-hover:inline-block'>
+                          <RiInformation2Line className='h-4 w-4 text-text-tertiary' />
+                        </div>
+                      </div>
+                    </Tooltip>
+                  )}
+                </div>
+              </div>
+              <div className='ml-1 flex shrink-0 items-center'>
+                {item.isDeleted && (
+                  <div className='mr-2 flex items-center'>
+                    <Tooltip
+                      popupContent={t('tools.toolRemoved')}
+                    >
+                      <div className='mr-1 cursor-pointer rounded-md p-1 hover:bg-black/5'>
+                        <AlertTriangle className='h-4 w-4 text-[#F79009]' />
+                      </div>
+                    </Tooltip>
+                    <div
+                      className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
+                      onClick={() => {
+                        const newModelConfig = produce(modelConfig, (draft) => {
+                          draft.agentConfig.tools.splice(index, 1)
+                        })
+                        setModelConfig(newModelConfig)
+                        formattingChangedDispatcher()
+                      }}
+                      onMouseOver={() => setIsDeleting(index)}
+                      onMouseLeave={() => setIsDeleting(-1)}
+                    >
+                      <RiDeleteBinLine className='h-4 w-4' />
+                    </div>
+                  </div>
+                )}
+                {!item.isDeleted && (
+                  <div className='mr-2 hidden items-center gap-1 group-hover:flex'>
+                    {!item.notAuthor && (
+                      <Tooltip
+                        popupContent={t('tools.setBuiltInTools.infoAndSetting')}
+                        needsDelay={false}
+                      >
+                        <div className='cursor-pointer rounded-md p-1  hover:bg-black/5' onClick={() => {
+                          setCurrentTool(item)
+                          setIsShowSettingTool(true)
+                        }}>
+                          <RiEqualizer2Line className='h-4 w-4 text-text-tertiary' />
+                        </div>
+                      </Tooltip>
+                    )}
+                    <div
+                      className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
+                      onClick={() => {
+                        const newModelConfig = produce(modelConfig, (draft) => {
+                          draft.agentConfig.tools.splice(index, 1)
+                        })
+                        setModelConfig(newModelConfig)
+                        formattingChangedDispatcher()
+                      }}
+                      onMouseOver={() => setIsDeleting(index)}
+                      onMouseLeave={() => setIsDeleting(-1)}
+                    >
+                      <RiDeleteBinLine className='h-4 w-4' />
+                    </div>
+                  </div>
+                )}
+                <div className={cn(item.isDeleted && 'opacity-50')}>
+                  {!item.notAuthor && (
+                    <Switch
+                      defaultValue={item.isDeleted ? false : item.enabled}
+                      disabled={item.isDeleted}
+                      size='md'
+                      onChange={(enabled) => {
+                        const newModelConfig = produce(modelConfig, (draft) => {
+                          (draft.agentConfig.tools[index] as any).enabled = enabled
+                        })
+                        setModelConfig(newModelConfig)
+                        formattingChangedDispatcher()
+                      }} />
+                  )}
+                  {item.notAuthor && (
+                    <Button variant='secondary' size='small' onClick={() => {
+                      setCurrentTool(item)
+                      setIsShowSettingTool(true)
+                    }}>
                       {t('tools.notAuthorized')}
                       <Indicator className='ml-2' color='orange' />
                     </Button>
                   )}
                 </div>
               </div>
-              <div className={cn('space-y-1', expandedProviders[group.providerId] ? 'mt-1' : 'hidden')}>
-                {group.tools.map(item => (
-                  <div
-                    key={`${item.provider_id}-${item.tool_name}`}
-                    className={cn(
-                      'group relative flex w-full items-center justify-between rounded-lg pl-[21px] pr-2 hover:bg-state-base-hover',
-                      isDeleting === item.__index && 'border border-state-destructive-border hover:bg-state-destructive-hover',
-                    )}
-                  >
-                    <div className='flex w-0 grow items-center'>
-                      <div
-                        className={cn(
-                          'system-xs-regular flex w-0 grow items-center truncate border-l-2 border-divider-subtle pl-4',
-                          (item.isDeleted || item.notAuthor || !item.enabled) ? 'opacity-50' : '',
-                        )}
-                      >
-                        <span className='system-xs-medium pr-1.5 text-text-secondary'>{item.tool_label}</span>
-                        <span className='text-text-tertiary'>{item.tool_name}</span>
-                        {!item.isDeleted && (
-                          <Tooltip
-                            popupContent={
-                              <div className='w-[180px]'>
-                                <div className='mb-1.5 text-text-secondary'>{item.tool_name}</div>
-                                <div className='mb-1.5 text-text-tertiary'>{t('tools.toolNameUsageTip')}</div>
-                                <div className='cursor-pointer text-text-accent' onClick={() => copy(item.tool_name)}>{t('tools.copyToolName')}</div>
-                              </div>
-                            }
-                          >
-                            <div className='h-4 w-4'>
-                              <div className='ml-0.5 hidden group-hover:inline-block'>
-                                <RiInformation2Line className='h-4 w-4 text-text-tertiary' />
-                              </div>
-                            </div>
-                          </Tooltip>
-                        )}
-                      </div>
-                    </div>
-
-                    <div className='flex shrink-0 items-center space-x-2'>
-                      {item.isDeleted && (
-                        <div className='mr-2 flex items-center'>
-                          <Tooltip
-                            popupContent={t('tools.toolRemoved')}
-                          >
-                            <div className='mr-1 cursor-pointer rounded-md p-1 hover:bg-black/5'>
-                              <AlertTriangle className='h-4 w-4 text-[#F79009]' />
-                            </div>
-                          </Tooltip>
-                          <div
-                            className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
-                            onClick={() => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                draft.agentConfig.tools.splice(item.__index, 1)
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }}
-                            onMouseOver={() => setIsDeleting(item.__index)}
-                            onMouseLeave={() => setIsDeleting(-1)}
-                          >
-                            <RiDeleteBinLine className='h-4 w-4' />
-                          </div>
-                        </div>
-                      )}
-                      {!item.isDeleted && (
-                        <div className='pointer-events-none mr-2 flex items-center gap-1 opacity-0 transition-opacity duration-150 group-hover:pointer-events-auto group-hover:opacity-100'>
-                          {!item.notAuthor && (
-                            <Tooltip
-                              popupContent={t('tools.setBuiltInTools.infoAndSetting')}
-                            >
-                              <div className='cursor-pointer rounded-md p-1 hover:bg-black/5' onClick={() => {
-                                setCurrentTool(item as any)
-                                setIsShowSettingTool(true)
-                              }}>
-                                <RiEqualizer2Line className='h-4 w-4 text-text-tertiary' />
-                              </div>
-                            </Tooltip>
-                          )}
-                          <div
-                            className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
-                            onClick={() => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                draft.agentConfig.tools.splice(item.__index, 1)
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }}
-                            onMouseOver={() => setIsDeleting(item.__index)}
-                            onMouseLeave={() => setIsDeleting(-1)}
-                          >
-                            <RiDeleteBinLine className='h-4 w-4' />
-                          </div>
-                        </div>
-                      )}
-                      <div className={cn(item.isDeleted && 'opacity-50')}>
-                        {!item.notAuthor && (
-                          <Switch
-                            defaultValue={item.isDeleted ? false : item.enabled}
-                            disabled={item.isDeleted}
-                            size='md'
-                            onChange={(enabled) => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                (draft.agentConfig.tools[item.__index] as any).enabled = enabled
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }} />
-                        )}
-                      </div>
-                    </div>
-                  </div>
-                ))}
-              </div>
-              <div className='grid grid-cols-1 flex-wrap items-center justify-between gap-1 2xl:grid-cols-2'>
-                {tools.map((item: AgentTool & { icon: any; collection?: Collection }, index) => (
-                  <div key={index}
-                    className={cn(
-                      'cursor group relative flex w-full items-center justify-between rounded-lg border-[0.5px] border-components-panel-border-subtle bg-components-panel-on-panel-item-bg p-1.5 pr-2 shadow-xs last-of-type:mb-0 hover:bg-components-panel-on-panel-item-bg-hover hover:shadow-sm',
-                      isDeleting === index && 'border-state-destructive-border hover:bg-state-destructive-hover',
-                    )}
-                  >
-                    <div className='flex w-0 grow items-center'>
-                      {item.isDeleted && <DefaultToolIcon className='h-5 w-5' />}
-                      {!item.isDeleted && (
-                        <div className={cn((item.notAuthor || !item.enabled) && 'shrink-0 opacity-50')}>
-                          {typeof item.icon === 'string' && <div className='h-5 w-5 rounded-md bg-cover bg-center' style={{ backgroundImage: `url(${item.icon})` }} />}
-                          {typeof item.icon !== 'string' && <AppIcon className='rounded-md' size='xs' icon={item.icon?.content} background={item.icon?.background} />}
-                        </div>
-                      )}
-                      <div
-                        className={cn(
-                          'system-xs-regular ml-1.5 flex w-0 grow items-center truncate',
-                          (item.isDeleted || item.notAuthor || !item.enabled) ? 'opacity-50' : '',
-                        )}
-                      >
-                        <span className='system-xs-medium pr-1.5 text-text-secondary'>{getProviderShowName(item)}</span>
-                        <span className='text-text-tertiary'>{item.tool_label}</span>
-                        {!item.isDeleted && (
-                          <Tooltip
-                            popupContent={
-                              <div className='w-[180px]'>
-                                <div className='mb-1.5 text-text-secondary'>{item.tool_name}</div>
-                                <div className='mb-1.5 text-text-tertiary'>{t('tools.toolNameUsageTip')}</div>
-                                <div className='cursor-pointer text-text-accent' onClick={() => copy(item.tool_name)}>{t('tools.copyToolName')}</div>
-                              </div>
-                            }
-                          >
-                            <div className='h-4 w-4'>
-                              <div className='ml-0.5 hidden group-hover:inline-block'>
-                                <RiInformation2Line className='h-4 w-4 text-text-tertiary' />
-                              </div>
-                            </div>
-                          </Tooltip>
-                        )}
-                      </div>
-                    </div>
-                    <div className='ml-1 flex shrink-0 items-center'>
-                      {item.isDeleted && (
-                        <div className='mr-2 flex items-center'>
-                          <Tooltip
-                            popupContent={t('tools.toolRemoved')}
-                          >
-                            <div className='mr-1 cursor-pointer rounded-md p-1 hover:bg-black/5'>
-                              <AlertTriangle className='h-4 w-4 text-[#F79009]' />
-                            </div>
-                          </Tooltip>
-                          <div
-                            className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
-                            onClick={() => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                draft.agentConfig.tools.splice(index, 1)
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }}
-                            onMouseOver={() => setIsDeleting(index)}
-                            onMouseLeave={() => setIsDeleting(-1)}
-                          >
-                            <RiDeleteBinLine className='h-4 w-4' />
-                          </div>
-                        </div>
-                      )}
-                      {!item.isDeleted && (
-                        <div className='mr-2 hidden items-center gap-1 group-hover:flex'>
-                          {!item.notAuthor && (
-                            <Tooltip
-                              popupContent={t('tools.setBuiltInTools.infoAndSetting')}
-                              needsDelay={false}
-                            >
-                              <div className='cursor-pointer rounded-md p-1  hover:bg-black/5' onClick={() => {
-                                setCurrentTool(item)
-                                setIsShowSettingTool(true)
-                              }}>
-                                <RiEqualizer2Line className='h-4 w-4 text-text-tertiary' />
-                              </div>
-                            </Tooltip>
-                          )}
-                          <div
-                            className='cursor-pointer rounded-md p-1 text-text-tertiary hover:text-text-destructive'
-                            onClick={() => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                draft.agentConfig.tools.splice(index, 1)
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }}
-                            onMouseOver={() => setIsDeleting(index)}
-                            onMouseLeave={() => setIsDeleting(-1)}
-                          >
-                            <RiDeleteBinLine className='h-4 w-4' />
-                          </div>
-                        </div>
-                      )}
-                      <div className={cn(item.isDeleted && 'opacity-50')}>
-                        {!item.notAuthor && (
-                          <Switch
-                            defaultValue={item.isDeleted ? false : item.enabled}
-                            disabled={item.isDeleted}
-                            size='md'
-                            onChange={(enabled) => {
-                              const newModelConfig = produce(modelConfig, (draft) => {
-                                (draft.agentConfig.tools[index] as any).enabled = enabled
-                              })
-                              setModelConfig(newModelConfig)
-                              formattingChangedDispatcher()
-                            }} />
-                        )}
-                        {item.notAuthor && (
-                          <Button variant='secondary' size='small' onClick={() => {
-                            setCurrentTool(item)
-                            setIsShowSettingTool(true)
-                          }}>
-                            {t('tools.notAuthorized')}
-                            <Indicator className='ml-2' color='orange' />
-                          </Button>
-                        )}
-                      </div>
-                    </div>
-                  </div>
-                ))}
-              </div>
             </div>
           ))}
-        </div>
-      </Panel>
+        </div >
+      </Panel >
       {isShowSettingTool && (
         <SettingBuiltInTool
           toolName={currentTool?.tool_name as string}
@@ -531,10 +321,6 @@ const AgentTools: FC = () => {
           onHide={() => setIsShowSettingTool(false)}
           credentialId={currentTool?.credential_id}
           onAuthorizationItemClick={handleAuthorizationItemClick}
-          useEndUserCredentialEnabled={currentTool?.use_end_user_credentials}
-          endUserCredentialType={currentTool?.end_user_credential_type}
-          onEndUserCredentialChange={handleEndUserCredentialChange}
-          onEndUserCredentialTypeChange={handleEndUserCredentialTypeChange}
         />
       )}
     </>

web/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool.tsx

@@ -42,10 +42,6 @@ type Props = {
   onSave?: (value: Record<string, any>) => void
   credentialId?: string
   onAuthorizationItemClick?: (id: string) => void
-  useEndUserCredentialEnabled?: boolean
-  endUserCredentialType?: string
-  onEndUserCredentialChange?: (enabled: boolean) => void
-  onEndUserCredentialTypeChange?: (type: string) => void
 }
 
 const SettingBuiltInTool: FC<Props> = ({
@@ -60,10 +56,6 @@ const SettingBuiltInTool: FC<Props> = ({
   onSave,
   credentialId,
   onAuthorizationItemClick,
-  useEndUserCredentialEnabled,
-  endUserCredentialType,
-  onEndUserCredentialChange,
-  onEndUserCredentialTypeChange,
 }) => {
   const { locale } = useContext(I18n)
   const language = getLanguage(locale)
@@ -224,10 +216,6 @@ const SettingBuiltInTool: FC<Props> = ({
                     }}
                     credentialId={credentialId}
                     onAuthorizationItemClick={onAuthorizationItemClick}
-                    useEndUserCredentialEnabled={useEndUserCredentialEnabled}
-                    endUserCredentialType={endUserCredentialType}
-                    onEndUserCredentialChange={onEndUserCredentialChange}
-                    onEndUserCredentialTypeChange={onEndUserCredentialTypeChange}
                   />
                 )
               }

web/app/components/app/configuration/ctrl-btn-group/index.spec.tsx

@@ -1,6 +1,12 @@
 import { fireEvent, render, screen } from '@testing-library/react'
 import ContrlBtnGroup from './index'
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 describe('ContrlBtnGroup', () => {
   beforeEach(() => {
     jest.clearAllMocks()

web/app/components/app/configuration/dataset-config/card-item/index.spec.tsx

@@ -1,242 +0,0 @@
-import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import Item from './index'
-import type React from 'react'
-import type { DataSet } from '@/models/datasets'
-import { ChunkingMode, DataSourceType, DatasetPermission } from '@/models/datasets'
-import type { IndexingType } from '@/app/components/datasets/create/step-two'
-import type { RetrievalConfig } from '@/types/app'
-import { RETRIEVE_METHOD } from '@/types/app'
-import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
-
-jest.mock('../settings-modal', () => ({
-  __esModule: true,
-  default: ({ onSave, onCancel, currentDataset }: any) => (
-    <div>
-      <div>Mock settings modal</div>
-      <button onClick={() => onSave({ ...currentDataset, name: 'Updated dataset' })}>Save changes</button>
-      <button onClick={onCancel}>Close</button>
-    </div>
-  ),
-}))
-
-jest.mock('@/hooks/use-breakpoints', () => {
-  const actual = jest.requireActual('@/hooks/use-breakpoints')
-  return {
-    __esModule: true,
-    ...actual,
-    default: jest.fn(() => actual.MediaType.pc),
-  }
-})
-
-const mockedUseBreakpoints = useBreakpoints as jest.MockedFunction<typeof useBreakpoints>
-
-const baseRetrievalConfig: RetrievalConfig = {
-  search_method: RETRIEVE_METHOD.semantic,
-  reranking_enable: false,
-  reranking_model: {
-    reranking_provider_name: 'provider',
-    reranking_model_name: 'rerank-model',
-  },
-  top_k: 4,
-  score_threshold_enabled: false,
-  score_threshold: 0,
-}
-
-const defaultIndexingTechnique: IndexingType = 'high_quality' as IndexingType
-
-const createDataset = (overrides: Partial<DataSet> = {}): DataSet => {
-  const {
-    retrieval_model,
-    retrieval_model_dict,
-    icon_info,
-    ...restOverrides
-  } = overrides
-
-  const resolvedRetrievalModelDict = {
-    ...baseRetrievalConfig,
-    ...retrieval_model_dict,
-  }
-  const resolvedRetrievalModel = {
-    ...baseRetrievalConfig,
-    ...(retrieval_model ?? retrieval_model_dict),
-  }
-
-  const defaultIconInfo = {
-    icon: '📘',
-    icon_type: 'emoji',
-    icon_background: '#FFEAD5',
-    icon_url: '',
-  }
-
-  const resolvedIconInfo = ('icon_info' in overrides)
-    ? icon_info
-    : defaultIconInfo
-
-  return {
-    id: 'dataset-id',
-    name: 'Dataset Name',
-    indexing_status: 'completed',
-    icon_info: resolvedIconInfo as DataSet['icon_info'],
-    description: 'A test dataset',
-    permission: DatasetPermission.onlyMe,
-    data_source_type: DataSourceType.FILE,
-    indexing_technique: defaultIndexingTechnique,
-    author_name: 'author',
-    created_by: 'creator',
-    updated_by: 'updater',
-    updated_at: 0,
-    app_count: 0,
-    doc_form: ChunkingMode.text,
-    document_count: 0,
-    total_document_count: 0,
-    total_available_documents: 0,
-    word_count: 0,
-    provider: 'dify',
-    embedding_model: 'text-embedding',
-    embedding_model_provider: 'openai',
-    embedding_available: true,
-    retrieval_model_dict: resolvedRetrievalModelDict,
-    retrieval_model: resolvedRetrievalModel,
-    tags: [],
-    external_knowledge_info: {
-      external_knowledge_id: 'external-id',
-      external_knowledge_api_id: 'api-id',
-      external_knowledge_api_name: 'api-name',
-      external_knowledge_api_endpoint: 'https://endpoint',
-    },
-    external_retrieval_model: {
-      top_k: 2,
-      score_threshold: 0.5,
-      score_threshold_enabled: true,
-    },
-    built_in_field_enabled: true,
-    doc_metadata: [],
-    keyword_number: 3,
-    pipeline_id: 'pipeline-id',
-    is_published: true,
-    runtime_mode: 'general',
-    enable_api: true,
-    is_multimodal: false,
-    ...restOverrides,
-  }
-}
-
-const renderItem = (config: DataSet, props?: Partial<React.ComponentProps<typeof Item>>) => {
-  const onSave = jest.fn()
-  const onRemove = jest.fn()
-
-  render(
-    <Item
-      config={config}
-      onSave={onSave}
-      onRemove={onRemove}
-      {...props}
-    />,
-  )
-
-  return { onSave, onRemove }
-}
-
-describe('dataset-config/card-item', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-    mockedUseBreakpoints.mockReturnValue(MediaType.pc)
-  })
-
-  it('should render dataset details with indexing and external badges', () => {
-    const dataset = createDataset({
-      provider: 'external',
-      retrieval_model_dict: {
-        ...baseRetrievalConfig,
-        search_method: RETRIEVE_METHOD.semantic,
-      },
-    })
-
-    renderItem(dataset)
-
-    const card = screen.getByText(dataset.name).closest('.group') as HTMLElement
-    const actionButtons = within(card).getAllByRole('button', { hidden: true })
-
-    expect(screen.getByText(dataset.name)).toBeInTheDocument()
-    expect(screen.getByText('dataset.indexingTechnique.high_quality · dataset.indexingMethod.semantic_search')).toBeInTheDocument()
-    expect(screen.getByText('dataset.externalTag')).toBeInTheDocument()
-    expect(actionButtons).toHaveLength(2)
-  })
-
-  it('should open settings drawer from edit action and close after saving', async () => {
-    const user = userEvent.setup()
-    const dataset = createDataset()
-    const { onSave } = renderItem(dataset)
-
-    const card = screen.getByText(dataset.name).closest('.group') as HTMLElement
-    const [editButton] = within(card).getAllByRole('button', { hidden: true })
-    await user.click(editButton)
-
-    expect(screen.getByText('Mock settings modal')).toBeInTheDocument()
-    await waitFor(() => {
-      expect(screen.getByRole('dialog')).toBeVisible()
-    })
-
-    await user.click(screen.getByText('Save changes'))
-
-    await waitFor(() => {
-      expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ name: 'Updated dataset' }))
-    })
-    await waitFor(() => {
-      expect(screen.getByText('Mock settings modal')).not.toBeVisible()
-    })
-  })
-
-  it('should call onRemove and toggle destructive state on hover', async () => {
-    const user = userEvent.setup()
-    const dataset = createDataset()
-    const { onRemove } = renderItem(dataset)
-
-    const card = screen.getByText(dataset.name).closest('.group') as HTMLElement
-    const buttons = within(card).getAllByRole('button', { hidden: true })
-    const deleteButton = buttons[buttons.length - 1]
-
-    expect(deleteButton.className).not.toContain('action-btn-destructive')
-
-    fireEvent.mouseEnter(deleteButton)
-    expect(deleteButton.className).toContain('action-btn-destructive')
-    expect(card.className).toContain('border-state-destructive-border')
-
-    fireEvent.mouseLeave(deleteButton)
-    expect(deleteButton.className).not.toContain('action-btn-destructive')
-
-    await user.click(deleteButton)
-    expect(onRemove).toHaveBeenCalledWith(dataset.id)
-  })
-
-  it('should use default icon information when icon details are missing', () => {
-    const dataset = createDataset({ icon_info: undefined })
-
-    renderItem(dataset)
-
-    const nameElement = screen.getByText(dataset.name)
-    const iconElement = nameElement.parentElement?.firstElementChild as HTMLElement
-
-    expect(iconElement).toHaveStyle({ background: '#FFF4ED' })
-    expect(iconElement.querySelector('em-emoji')).toHaveAttribute('id', '📙')
-  })
-
-  it('should apply mask overlay on mobile when drawer is open', async () => {
-    mockedUseBreakpoints.mockReturnValue(MediaType.mobile)
-    const user = userEvent.setup()
-    const dataset = createDataset()
-
-    renderItem(dataset)
-
-    const card = screen.getByText(dataset.name).closest('.group') as HTMLElement
-    const [editButton] = within(card).getAllByRole('button', { hidden: true })
-    await user.click(editButton)
-    expect(screen.getByText('Mock settings modal')).toBeInTheDocument()
-
-    const overlay = Array.from(document.querySelectorAll('[class]'))
-      .find(element => element.className.toString().includes('bg-black/30'))
-
-    expect(overlay).toBeInTheDocument()
-  })
-})

web/app/components/app/configuration/dataset-config/context-var/index.spec.tsx

@@ -1,299 +0,0 @@
-import * as React from 'react'
-import { render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import ContextVar from './index'
-import type { Props } from './var-picker'
-
-// Mock external dependencies only
-jest.mock('next/navigation', () => ({
-  useRouter: () => ({ push: jest.fn() }),
-  usePathname: () => '/test',
-}))
-
-type PortalToFollowElemProps = {
-  children: React.ReactNode
-  open?: boolean
-  onOpenChange?: (open: boolean) => void
-}
-type PortalToFollowElemTriggerProps = React.HTMLAttributes<HTMLElement> & { children?: React.ReactNode; asChild?: boolean }
-type PortalToFollowElemContentProps = React.HTMLAttributes<HTMLDivElement> & { children?: React.ReactNode }
-
-jest.mock('@/app/components/base/portal-to-follow-elem', () => {
-  const PortalContext = React.createContext({ open: false })
-
-  const PortalToFollowElem = ({ children, open }: PortalToFollowElemProps) => {
-    return (
-      <PortalContext.Provider value={{ open: !!open }}>
-        <div data-testid="portal">{children}</div>
-      </PortalContext.Provider>
-    )
-  }
-
-  const PortalToFollowElemContent = ({ children, ...props }: PortalToFollowElemContentProps) => {
-    const { open } = React.useContext(PortalContext)
-    if (!open) return null
-    return (
-      <div data-testid="portal-content" {...props}>
-        {children}
-      </div>
-    )
-  }
-
-  const PortalToFollowElemTrigger = ({ children, asChild, ...props }: PortalToFollowElemTriggerProps) => {
-    if (asChild && React.isValidElement(children)) {
-      return React.cloneElement(children, {
-        ...props,
-        'data-testid': 'portal-trigger',
-      } as React.HTMLAttributes<HTMLElement>)
-    }
-    return (
-      <div data-testid="portal-trigger" {...props}>
-        {children}
-      </div>
-    )
-  }
-
-  return {
-    PortalToFollowElem,
-    PortalToFollowElemContent,
-    PortalToFollowElemTrigger,
-  }
-})
-
-describe('ContextVar', () => {
-  const mockOptions: Props['options'] = [
-    { name: 'Variable 1', value: 'var1', type: 'string' },
-    { name: 'Variable 2', value: 'var2', type: 'number' },
-  ]
-
-  const defaultProps: Props = {
-    value: 'var1',
-    options: mockOptions,
-    onChange: jest.fn(),
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  // Rendering tests (REQUIRED)
-  describe('Rendering', () => {
-    it('should display query variable selector when options are provided', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.title')).toBeInTheDocument()
-    })
-
-    it('should show selected variable with proper formatting when value is provided', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('var1')).toBeInTheDocument()
-      expect(screen.getByText('{{')).toBeInTheDocument()
-      expect(screen.getByText('}}')).toBeInTheDocument()
-    })
-  })
-
-  // Props tests (REQUIRED)
-  describe('Props', () => {
-    it('should display selected variable when value prop is provided', () => {
-      // Arrange
-      const props = { ...defaultProps, value: 'var2' }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert - Should display the selected value
-      expect(screen.getByText('var2')).toBeInTheDocument()
-    })
-
-    it('should show placeholder text when no value is selected', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert - Should show placeholder instead of variable
-      expect(screen.queryByText('var1')).not.toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should display custom tip message when notSelectedVarTip is provided', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-        notSelectedVarTip: 'Select a variable',
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('Select a variable')).toBeInTheDocument()
-    })
-
-    it('should apply custom className to VarPicker when provided', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        className: 'custom-class',
-      }
-
-      // Act
-      const { container } = render(<ContextVar {...props} />)
-
-      // Assert
-      expect(container.querySelector('.custom-class')).toBeInTheDocument()
-    })
-  })
-
-  // User Interactions
-  describe('User Interactions', () => {
-    it('should call onChange when user selects a different variable', async () => {
-      // Arrange
-      const onChange = jest.fn()
-      const props = { ...defaultProps, onChange }
-      const user = userEvent.setup()
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      const triggers = screen.getAllByTestId('portal-trigger')
-      const varPickerTrigger = triggers[triggers.length - 1]
-
-      await user.click(varPickerTrigger)
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-
-      // Select a different option
-      const options = screen.getAllByText('var2')
-      expect(options.length).toBeGreaterThan(0)
-      await user.click(options[0])
-
-      // Assert
-      expect(onChange).toHaveBeenCalledWith('var2')
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-
-    it('should toggle dropdown when clicking the trigger button', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      const triggers = screen.getAllByTestId('portal-trigger')
-      const varPickerTrigger = triggers[triggers.length - 1]
-
-      // Open dropdown
-      await user.click(varPickerTrigger)
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-
-      // Close dropdown
-      await user.click(varPickerTrigger)
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-  })
-
-  // Edge Cases (REQUIRED)
-  describe('Edge Cases', () => {
-    it('should handle undefined value gracefully', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.title')).toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-      expect(screen.queryByText('var1')).not.toBeInTheDocument()
-    })
-
-    it('should handle empty options array', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [],
-        value: undefined,
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.title')).toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should handle null value without crashing', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.title')).toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should handle options with different data types', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [
-          { name: 'String Var', value: 'strVar', type: 'string' },
-          { name: 'Number Var', value: '42', type: 'number' },
-          { name: 'Boolean Var', value: 'true', type: 'boolean' },
-        ],
-        value: 'strVar',
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('strVar')).toBeInTheDocument()
-      expect(screen.getByText('{{')).toBeInTheDocument()
-      expect(screen.getByText('}}')).toBeInTheDocument()
-    })
-
-    it('should render variable names with special characters safely', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [
-          { name: 'Variable with & < > " \' characters', value: 'specialVar', type: 'string' },
-        ],
-        value: 'specialVar',
-      }
-
-      // Act
-      render(<ContextVar {...props} />)
-
-      // Assert
-      expect(screen.getByText('specialVar')).toBeInTheDocument()
-    })
-  })
-})

web/app/components/app/configuration/dataset-config/context-var/var-picker.spec.tsx

@@ -1,392 +0,0 @@
-import * as React from 'react'
-import { render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import VarPicker, { type Props } from './var-picker'
-
-// Mock external dependencies only
-jest.mock('next/navigation', () => ({
-  useRouter: () => ({ push: jest.fn() }),
-  usePathname: () => '/test',
-}))
-
-type PortalToFollowElemProps = {
-  children: React.ReactNode
-  open?: boolean
-  onOpenChange?: (open: boolean) => void
-}
-type PortalToFollowElemTriggerProps = React.HTMLAttributes<HTMLElement> & { children?: React.ReactNode; asChild?: boolean }
-type PortalToFollowElemContentProps = React.HTMLAttributes<HTMLDivElement> & { children?: React.ReactNode }
-
-jest.mock('@/app/components/base/portal-to-follow-elem', () => {
-  const PortalContext = React.createContext({ open: false })
-
-  const PortalToFollowElem = ({ children, open }: PortalToFollowElemProps) => {
-    return (
-      <PortalContext.Provider value={{ open: !!open }}>
-        <div data-testid="portal">{children}</div>
-      </PortalContext.Provider>
-    )
-  }
-
-  const PortalToFollowElemContent = ({ children, ...props }: PortalToFollowElemContentProps) => {
-    const { open } = React.useContext(PortalContext)
-    if (!open) return null
-    return (
-      <div data-testid="portal-content" {...props}>
-        {children}
-      </div>
-    )
-  }
-
-  const PortalToFollowElemTrigger = ({ children, asChild, ...props }: PortalToFollowElemTriggerProps) => {
-    if (asChild && React.isValidElement(children)) {
-      return React.cloneElement(children, {
-        ...props,
-        'data-testid': 'portal-trigger',
-      } as React.HTMLAttributes<HTMLElement>)
-    }
-    return (
-      <div data-testid="portal-trigger" {...props}>
-        {children}
-      </div>
-    )
-  }
-
-  return {
-    PortalToFollowElem,
-    PortalToFollowElemContent,
-    PortalToFollowElemTrigger,
-  }
-})
-
-describe('VarPicker', () => {
-  const mockOptions: Props['options'] = [
-    { name: 'Variable 1', value: 'var1', type: 'string' },
-    { name: 'Variable 2', value: 'var2', type: 'number' },
-    { name: 'Variable 3', value: 'var3', type: 'boolean' },
-  ]
-
-  const defaultProps: Props = {
-    value: 'var1',
-    options: mockOptions,
-    onChange: jest.fn(),
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  // Rendering tests (REQUIRED)
-  describe('Rendering', () => {
-    it('should render variable picker with dropdown trigger', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByTestId('portal-trigger')).toBeInTheDocument()
-      expect(screen.getByText('var1')).toBeInTheDocument()
-    })
-
-    it('should display selected variable with type icon when value is provided', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('var1')).toBeInTheDocument()
-      expect(screen.getByText('{{')).toBeInTheDocument()
-      expect(screen.getByText('}}')).toBeInTheDocument()
-      // IconTypeIcon should be rendered (check for svg icon)
-      expect(document.querySelector('svg')).toBeInTheDocument()
-    })
-
-    it('should show placeholder text when no value is selected', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.queryByText('var1')).not.toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should display custom tip message when notSelectedVarTip is provided', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-        notSelectedVarTip: 'Select a variable',
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('Select a variable')).toBeInTheDocument()
-    })
-
-    it('should render dropdown indicator icon', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert - Trigger should be present
-      expect(screen.getByTestId('portal-trigger')).toBeInTheDocument()
-    })
-  })
-
-  // Props tests (REQUIRED)
-  describe('Props', () => {
-    it('should apply custom className to wrapper', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        className: 'custom-class',
-      }
-
-      // Act
-      const { container } = render(<VarPicker {...props} />)
-
-      // Assert
-      expect(container.querySelector('.custom-class')).toBeInTheDocument()
-    })
-
-    it('should apply custom triggerClassName to trigger button', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        triggerClassName: 'custom-trigger-class',
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByTestId('portal-trigger')).toHaveClass('custom-trigger-class')
-    })
-
-    it('should display selected value with proper formatting', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: 'customVar',
-        options: [
-          { name: 'Custom Variable', value: 'customVar', type: 'string' },
-        ],
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('customVar')).toBeInTheDocument()
-      expect(screen.getByText('{{')).toBeInTheDocument()
-      expect(screen.getByText('}}')).toBeInTheDocument()
-    })
-  })
-
-  // User Interactions
-  describe('User Interactions', () => {
-    it('should open dropdown when clicking the trigger button', async () => {
-      // Arrange
-      const onChange = jest.fn()
-      const props = { ...defaultProps, onChange }
-      const user = userEvent.setup()
-
-      // Act
-      render(<VarPicker {...props} />)
-      await user.click(screen.getByTestId('portal-trigger'))
-
-      // Assert
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-    })
-
-    it('should call onChange and close dropdown when selecting an option', async () => {
-      // Arrange
-      const onChange = jest.fn()
-      const props = { ...defaultProps, onChange }
-      const user = userEvent.setup()
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Open dropdown
-      await user.click(screen.getByTestId('portal-trigger'))
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-
-      // Select a different option
-      const options = screen.getAllByText('var2')
-      expect(options.length).toBeGreaterThan(0)
-      await user.click(options[0])
-
-      // Assert
-      expect(onChange).toHaveBeenCalledWith('var2')
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-
-    it('should toggle dropdown when clicking trigger button multiple times', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      const trigger = screen.getByTestId('portal-trigger')
-
-      // Open dropdown
-      await user.click(trigger)
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-
-      // Close dropdown
-      await user.click(trigger)
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-  })
-
-  // State Management
-  describe('State Management', () => {
-    it('should initialize with closed dropdown', () => {
-      // Arrange
-      const props = { ...defaultProps }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-
-    it('should toggle dropdown state on trigger click', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      const trigger = screen.getByTestId('portal-trigger')
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-
-      // Open dropdown
-      await user.click(trigger)
-      expect(screen.getByTestId('portal-content')).toBeInTheDocument()
-
-      // Close dropdown
-      await user.click(trigger)
-      expect(screen.queryByTestId('portal-content')).not.toBeInTheDocument()
-    })
-
-    it('should preserve selected value when dropdown is closed without selection', async () => {
-      // Arrange
-      const props = { ...defaultProps }
-      const user = userEvent.setup()
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Open and close dropdown without selecting anything
-      const trigger = screen.getByTestId('portal-trigger')
-      await user.click(trigger)
-      await user.click(trigger)
-
-      // Assert
-      expect(screen.getByText('var1')).toBeInTheDocument() // Original value still displayed
-    })
-  })
-
-  // Edge Cases (REQUIRED)
-  describe('Edge Cases', () => {
-    it('should handle undefined value gracefully', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-      expect(screen.getByTestId('portal-trigger')).toBeInTheDocument()
-    })
-
-    it('should handle empty options array', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [],
-        value: undefined,
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByTestId('portal-trigger')).toBeInTheDocument()
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should handle null value without crashing', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        value: undefined,
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('appDebug.feature.dataSet.queryVariable.choosePlaceholder')).toBeInTheDocument()
-    })
-
-    it('should handle variable names with special characters safely', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [
-          { name: 'Variable with & < > " \' characters', value: 'specialVar', type: 'string' },
-        ],
-        value: 'specialVar',
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('specialVar')).toBeInTheDocument()
-    })
-
-    it('should handle long variable names', () => {
-      // Arrange
-      const props = {
-        ...defaultProps,
-        options: [
-          { name: 'A very long variable name that should be truncated', value: 'longVar', type: 'string' },
-        ],
-        value: 'longVar',
-      }
-
-      // Act
-      render(<VarPicker {...props} />)
-
-      // Assert
-      expect(screen.getByText('longVar')).toBeInTheDocument()
-      expect(screen.getByTestId('portal-trigger')).toBeInTheDocument()
-    })
-  })
-})

web/app/components/app/configuration/debug/debug-with-multiple-model/index.spec.tsx

@@ -51,6 +51,12 @@ const mockFiles: FileEntity[] = [
   },
 ]
 
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 jest.mock('@/context/debug-configuration', () => ({
   __esModule: true,
   useDebugConfigurationContext: () => mockUseDebugConfigurationContext(),