Merge branch 'feat/snippet-fe' into deploy/dev

Merge branch 'main' into feat/snippet-fe
fix(web): checkValid of snippet
2026-06-01 13:47:09 +08:00 · 2026-06-01 12:56:52 +08:00 · 2026-06-01 12:55:57 +08:00 · 2026-06-01 10:48:01 +08:00 · 2026-05-29 17:04:05 +08:00 · 2026-05-29 16:47:48 +08:00
2392 changed files with 26109 additions and 112821 deletions
@@ -1,93 +1,73 @@
 ---
 name: frontend-code-review
-description: Review Dify frontend code for correctness, accessibility, component design, dify-ui usage, data/query boundaries, performance, and tests. Trigger for `.tsx`, `.ts`, `.js`, UI, React, Next.js, pending-change, or focused frontend review requests.
+description: "Trigger when the user requests a review of frontend files (e.g., `.tsx`, `.ts`, `.js`). Support both pending-change reviews and focused file reviews while applying the checklist rules."
 ---

 # Frontend Code Review

-## When To Use
+## Intent
+Use this skill whenever the user asks to review frontend code (especially `.tsx`, `.ts`, or `.js` files). Support two review modes:

-Use this skill when the user asks to review, audit, analyze, or sanity-check frontend code under `web/`, `packages/dify-ui/`, or frontend-adjacent TypeScript files.
+1. **Pending-change review** – inspect staged/working-tree files slated for commit and flag checklist violations before submission.
+2. **File-targeted review** – review the specific file(s) the user names and report the relevant checklist findings.

-Supported modes:
+Stick to the checklist below for every applicable file and mode.

- **Pending-change review**: inspect staged and working-tree changes.
- **File-focused review**: inspect explicitly named files or paths.
- **Diff/snippet review**: review pasted diffs or snippets using best-effort references.
+## Checklist
+See [references/code-quality.md](references/code-quality.md), [references/performance.md](references/performance.md), [references/business-logic.md](references/business-logic.md) for the living checklist split by category—treat it as the canonical set of rules to follow.

-Do not use this skill for backend-only code under `api/`; use `backend-code-review` instead.
-
-## Required Context
-
-Before reviewing, read the relevant local contracts:
-
- `web/AGENTS.md` for Dify frontend workflow, overlays, design tokens, state, and tests.
- `packages/dify-ui/README.md` and `packages/dify-ui/AGENTS.md` when code uses or changes `@langgenius/dify-ui/*`.
- `web/docs/overlay.md` when reviewing dialogs, drawers, popovers, tooltips, menus, selects, comboboxes, or other floating UI.
- `web/docs/test.md` and the `frontend-testing` skill when reviewing tests or testability.
- `how-to-write-component` when reviewing React component structure, ownership, effects, query/mutation contracts, or memoization.
-
-For any UI, UX, or accessibility review, fetch the latest Web Interface Guidelines before finalizing findings. Treat them as a required baseline, not the complete source of accessibility truth:
-
-```text
-https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
-```
-
-If the review depends on a current framework, SDK, browser API, or accessibility behavior and local code does not settle it, check the current official docs first. For browser compatibility, deprecation, or behavior-sensitive frontend APIs, verify MDN or the relevant standard.
-
-## Rule Packs
-
-Apply every relevant rule pack:
-
- [references/accessibility-ui.md](references/accessibility-ui.md) — accessibility, semantic HTML, focus, forms, keyboard, disabled states, copy, and long-content behavior. Combines Web Interface Guidelines with Dify UI, Base UI, MDN, and local primitive contracts.
- [references/dify-ui.md](references/dify-ui.md) — Dify UI primitive usage, Base UI semantics, overlays, forms, tokens, radius mapping, and primitive boundaries.
- [references/component-architecture.md](references/component-architecture.md) — component ownership, props, state, effects, exports, wrappers, and feature organization.
- [references/data-query-contracts.md](references/data-query-contracts.md) — generated contracts, TanStack Query, mutations, workspace/auth/SSR boundaries, URL/local storage state.
- [references/performance.md](references/performance.md) — React/Next performance review rules from Vercel guidance, scoped to real risk.
- [references/testing.md](references/testing.md) — frontend test review rules.
- [references/dify-invariants.md](references/dify-invariants.md) — stable Dify-specific runtime invariants that generic React/a11y rules will not catch.
- [references/code-quality.md](references/code-quality.md) — general TypeScript, styling, naming, and maintainability rules.
+Flag each rule violation with urgency metadata so future reviewers can prioritize fixes.

 ## Review Process
+1. Open the relevant component/module. Gather lines that relate to class names, React Flow hooks, prop memoization, and styling.
+2. For each rule in the review point, note where the code deviates and capture a representative snippet.
+3. Compose the review section per the template below. Group violations first by **Urgent** flag, then by category order (Code Quality, Performance, Business Logic).

-1. Identify the review scope. For pending changes, inspect `git diff --stat`, `git diff`, and staged diff if relevant. For file-focused reviews, stay within the named files unless a referenced owner/contract must be read.
-2. Read code around the changed lines and the owning module. Do not review by isolated snippets when nearby ownership, labels, query inputs, or overlay structure decide correctness.
-3. Check user-visible regressions first: accessibility, broken interaction, auth/permission leaks, query/hydration errors, data loss, navigation mistakes, and impossible states.
-4. Then check maintainability and performance: ownership, effects, wrappers, memoization, bundle/waterfall risks, tests, and design-system drift.
-5. Report only actionable findings. Do not list speculative risks, style preferences, or broad refactors unless they are directly tied to a reproducible issue in scope.
+## Required output
+When invoked, the response must exactly follow one of the two templates:

-## Severity
+### Template A (any findings)
+```
+# Code review
+Found <N> urgent issues need to be fixed:

- **P0**: security/privacy/auth leak, data loss, production crash, inaccessible critical flow, or broken primary workflow.
- **P1**: user-visible regression, hydration/SSR failure, invalid API/query contract, broken keyboard/focus behavior, or serious design-system/a11y violation.
- **P2**: maintainability or performance issue likely to cause bugs, duplicated state, incorrect ownership, missing tests for risky behavior, or non-critical a11y issue.
- **P3**: minor cleanup with clear value. Omit unless the user asked for a thorough audit.
+## 1 <brief description of bug>
+FilePath: <path> line <line>
+<relevant code snippet or pointer>

-## Output Format

-Lead with findings, ordered by severity. Use this structure:
+### Suggested fix
+<brief description of suggested fix>

-```markdown
-## Findings
+---
+... (repeat for each urgent issue) ...

- [P1] Short issue title
-  File: `path/to/file.tsx:123`
-  Why it matters and how to reproduce or reason about it.
-  Suggested fix: concrete fix direction.
+Found <M> suggestions for improvement:

-## Open Questions
+## 1 <brief description of suggestion>
+FilePath: <path> line <line>
+<relevant code snippet or pointer>

- Question or assumption, if any.

-## Summary
+### Suggested fix
+<brief description of suggested fix>

-Brief secondary context. Mention tests not run or residual risk.
+---
+
+... (repeat for each suggestion) ...
 ```

-Rules:
+If there are no urgent issues, omit that section. If there are no suggestions, omit that section.
+
+If the issue number is more than 10, summarize as "10+ urgent issues" or "10+ suggestions" and just output the first 10 issues.
+
+Don't compress the blank lines between sections; keep them as-is for readability.
+
+If you use Template A (i.e., there are issues to fix) and at least one issue requires code changes, append a brief follow-up question after the structured output asking whether the user wants you to apply the suggested fix(es). For example: "Would you like me to use the Suggested fix section to address these issues?"
+
+### Template B (no issues)
+```
+## Code review
+No issues found.
+```

- If there are no findings, say `No issues found.` and mention any test gaps or residual risk.
- Always include file and line when available.
- Keep findings concrete and reproducible.
- Do not include praise sections by default.
- Do not ask to apply fixes unless the user explicitly wants review plus implementation.
@@ -1,109 +0,0 @@
-# Accessibility And UI Rules
-
-Accessibility findings are first-class review findings. Treat broken keyboard access, missing accessible names, focus loss, and unreachable popup content as correctness bugs, not polish.
-
-Before finalizing UI or accessibility findings, fetch the latest Web Interface Guidelines as a required baseline:
-
-```text
-https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
-```
-
-Do not treat that document as the complete accessibility rule set. Combine it with:
-
- `packages/dify-ui/README.md`, `packages/dify-ui/AGENTS.md`, and the relevant primitive implementation when code uses `@langgenius/dify-ui/*`.
- Base UI docs and local `.d.ts` contracts when primitive semantics, focus target, labels, or popup reachability are unclear.
- MDN or relevant WAI-ARIA/browser standards when behavior, compatibility, or deprecation status matters.
- The current feature's product semantics, because an accessible primitive can still be used in an inaccessible workflow.
-
-## Semantic HTML
-
-Flag:
-
- Clickable `div` or `span` used for actions.
- Router navigation implemented with button or `onClick` when a `Link` / `<a>` is the real semantic element.
- Icon-only buttons without `aria-label` or `aria-labelledby`.
- Decorative icons missing `aria-hidden="true"`.
- Images without `alt`; use `alt=""` only when truly decorative.
- Heading levels that skip hierarchy in page-level content.
-
-Prefer semantic HTML before ARIA.
-
-## Keyboard And Focus
-
-Flag:
-
- Interactive elements without visible `focus-visible` treatment.
- `outline-none` / `outline-hidden` without an equivalent focus-visible ring or state.
- Custom interactive elements missing keyboard handling.
- Focus trapped, lost, or sent to the wrong surface after dialog/popover/menu close.
- Focus ring applied to the wrong DOM node. Verify the actual focus target, especially with Base UI controls such as Slider.
-
-Use `focus-visible` for keyboard focus. Use `focus-within` or `has-[:focus-visible]` when the visual wrapper is not the focused element.
-
-## Forms
-
-Flag:
-
- Inputs, selects, switches, checkboxes, radios, comboboxes, or sliders without a label relationship.
- Missing stable `name` on form fields that submit or validate.
- Incorrect input `type`, `inputMode`, `autoComplete`, or `spellCheck` for email, token, URL, number, search, code, or username fields.
- Labels that are not clickable.
- Submit buttons disabled before a request starts, preventing normal submit behavior.
- Non-submit buttons inside forms missing `type="button"`.
- Errors not associated with fields or not reachable by screen readers.
- Error recovery that does not focus or expose the first invalid field.
- `onPaste` blocking paste.
- Placeholder text used as the only label.
- Password managers accidentally triggered on non-auth fields because autocomplete is missing or wrong.
-
-Prefer visible labels. If visible surrounding text already labels the control, use a visually hidden label or a precise `aria-label`.
-
-## Disabled, Loading, And Async States
-
-Flag:
-
- Loading state without `aria-busy`, `role="status"`, or another accessible update path when it changes user interaction.
- Spinner or decorative loading icon exposed to screen readers.
- Disabled controls that hide the reason users cannot proceed.
- `aria-disabled` used without manually blocking click, Space, and Enter.
- Toasts, inline validation, or async status changes that are not announced when users need the update to continue.
- Icon-only loading/error affordances without text or accessible status where the state matters.
-
-Use native `disabled` when the control must not be interactive. Use `aria-disabled` only when the element must remain focusable and the code handles all blocked interactions.
-
-For repeated shared disabled reasons, prefer a visible group message or badge plus native disabled controls. Use per-control popover/info only when the reason is item-specific.
-
-## Overlays And Popup Reachability
-
-Flag:
-
- Tooltip used for long, structured, interactive, or unique information.
- Tooltip content required to understand or complete a flow.
- PreviewCard content that touch or screen-reader users cannot reach through the trigger's click destination.
- Popover/dialog/menu triggers without accessible names.
- Popup content without title/description where the primitive requires them.
-
-Use Popover for explanatory content, rich help, and infotips. Use Tooltip only as a short visual label for a trigger that already has an accessible name.
-
-## Long Content And Layout
-
-Flag:
-
- Text in flex/grid children without `min-w-0` when it can overflow.
- Names, labels, file names, model names, workspace names, or user content lacking `truncate`, `line-clamp`, or `break-words`.
- Right-side icons, badges, checks, or actions that shrink before the text area.
- Empty arrays or empty strings rendering broken layout instead of an empty state.
- Button, tab, badge, chip, menu item, or card text that can overlap sibling controls at common viewport widths.
-
-The usual Dify layout chain is: container has width constraints, text region uses `min-w-0 flex-1 truncate`, adornments use `shrink-0`.
-
-## Motion, Images, And Copy
-
-Flag:
-
- `transition-all`.
- Animations that do not respect reduced motion.
- Layout-affecting animation where transform/opacity would work.
- Images without dimensions.
- Loading copy using `...` instead of `…`.
- Hardcoded dates, times, numbers, or currency formats instead of `Intl.*`.
@@ -0,0 +1,15 @@
+# Rule Catalog — Business Logic
+
+## Can't use workflowStore in Node components
+
+IsUrgent: True
+
+### Description
+
+File path pattern of node components: `web/app/components/workflow/nodes/[nodeName]/node.tsx`
+
+Node components are also used when creating a RAG Pipe from a template, but in that context there is no workflowStore Provider, which results in a blank screen. [This Issue](https://github.com/langgenius/dify/issues/29168) was caused by exactly this reason.
+
+### Suggested Fix
+
+Use `import { useNodes } from 'reactflow'` instead of `import useNodes from '@/app/components/workflow/store/workflow/use-nodes'`.
@@ -1,66 +1,44 @@
-# Code Quality Rules
+# Rule Catalog — Code Quality

-## Scope Control
+## Conditional class names use utility function

-Flag changes that expand beyond the requested feature or review scope:
+IsUrgent: True
+Category: Code Quality

- Repo-wide cleanup mixed into a targeted fix.
- Compatibility exports, aliases, shims, or wrapper layers added without an explicit migration requirement.
- Shared abstractions created before there is stable cross-feature reuse.
- Business components moved into generic shared locations without a clear ownership boundary.
+### Description

-## TypeScript
+Ensure conditional CSS is handled via the shared `classNames` instead of custom ternaries, string concatenation, or template strings. Centralizing class logic keeps components consistent and easier to maintain.

-Flag:
+### Suggested Fix

- `any` or broad `Record<string, any>` where generated/API types or local domain types exist.
- Re-declared API shapes instead of importing generated or returned types.
- Weak route/query param typing that leaks `string | string[] | undefined` deep into components.
- Runtime wrappers added only to satisfy TypeScript when a narrower type boundary would preserve the existing runtime shape.
+```ts
+import { cn } from '@/utils/classnames'
+const classNames = cn(isActive ? 'text-primary-600' : 'text-gray-500')
+```

-Prefer:
+## Tailwind-first styling

- Explicit domain names that match the API contract.
- Type narrowing at route/API boundaries.
- Small conversion helpers colocated with the component that needs them.
+IsUrgent: True
+Category: Code Quality

-## Styling
+### Description

-Flag:
+Favor Tailwind CSS utility classes instead of adding new `.module.css` files unless a Tailwind combination cannot achieve the required styling. Keeping styles in Tailwind improves consistency and reduces maintenance overhead.

- New CSS modules or ad hoc CSS when Tailwind utilities and Dify tokens cover the need.
- Generic color utilities where Dify semantic tokens exist.
- Hardcoded magic class values for colors, spacing, radius, shadow, z-index, or typography when Dify tokens, component variants, or documented radius mappings exist.
- `!` important modifiers or important CSS overrides without a narrow, documented reason.
- Manual string concatenation for conditional classes.
- JS conditional class branches for primitive visual states already exposed by Dify UI/Base UI `data-*` selectors.
- Incoming `className` placed before default classes in `cn(...)`, preventing call-site overrides.
- Arbitrary z-index or one-off layering fixes on overlays.
+Update this file when adding, editing, or removing Code Quality rules so the catalog remains accurate.

-Use:
+## Classname ordering for easy overrides

- `cn(...)` from the local package or utility already used by the file.
- Dify semantic tokens and Tailwind v4 utilities.
- Existing component variants before one-off class forks.
- Primitive selectors such as `data-disabled:*`, `data-checked:*`, `data-highlighted:*`, `group-data-*`, `peer-data-*`, and `has-[:focus-visible]` before adding React state or boolean props solely for styling.
- Component-level variants, semantic tokens, and normal cascade/order before `!` overrides. Use `!` only for a contained compatibility override that cannot be expressed through the component API or local selector structure.
+### Description

-## Imports
+When writing components, always place the incoming `className` prop after the component’s own class values so that downstream consumers can override or extend the styling. This keeps your component’s defaults but still lets external callers change or remove specific styles.

-Flag:
+Example:

- Barrel imports from `@langgenius/dify-ui`; consumers must use subpath exports.
- New overlay imports from legacy `@/app/components/base/modal`, `dialog`, or `drawer`.
- Cross-feature imports that bypass explicit top-level public files.
- Direct imports from generated/internal implementation files when a feature contract already exposes the intended surface.
+```tsx
+import { cn } from '@/utils/classnames'

-## Copy And i18n
-
-Flag:
-
- User-facing hardcoded strings in `web/`.
- Translation namespace drift, especially using unrelated module namespaces for local feature copy.
- Generic button labels like `Continue` where the action is specific.
- Error messages that state only the failure and not the next step.
-
-Use feature-local translation keys by default. Alias only when crossing namespaces.
+const Button = ({ className }) => {
+  return <div className={cn('bg-primary-600', className)}></div>
+}
+```
@@ -1,85 +0,0 @@
-# Component Architecture Rules
-
-Use these rules for React component structure, ownership, state, props, effects, and module organization.
-
-## Ownership
-
-Flag:
-
- State, query, mutation, or handlers hoisted above the lowest component that actually uses them.
- Parent components owning row/item actions that do not coordinate a workflow.
- Prop drilling through multiple pass-through layers.
- A page/tab-level section component becoming the data owner without needing a shared snapshot or shared loading/error/empty UI.
- Feature code promoted to shared only because it appears once or might be reused later.
-
-Accept repeated TanStack Query calls in siblings when each component independently consumes the data. Cache deduplication is not a reason to hoist by itself.
-
-## Component Boundaries
-
-Flag:
-
- Shallow wrappers that only rename props or hide the real primitive.
- Extra DOM wrappers that do not provide layout, semantics, accessibility, state ownership, or library integration.
- Dialog/dropdown/popover hidden surfaces that obscure the parent flow when they should be extracted into a small local component.
- Business forms, menu bodies, or one-off helpers moved away from their owner without reuse or semantic value.
-
-Prefer colocated components split by actual data and state needs.
-
-## Bad Component Design Patterns
-
-Flag:
-
- Components that mix data fetching, mutation side effects, popup state, form validation, layout, and row rendering without a clear owner.
- Generic components with many boolean props that encode one feature's workflow.
- A shared component that imports feature-specific copy, routes, or API contracts.
- A feature component that accepts pre-rendered fragments only to avoid placing ownership correctly.
- A child component that receives both raw server data and separately derived flags for the same concept.
- A wrapper that changes accessible semantics of the primitive it wraps.
- A component that exposes controlled props but still keeps a competing private state for the same value.
- A component that cannot render empty, loading, or missing optional API fields without caller-side preprocessing.
-
-## Props And Types
-
-Flag:
-
- `React.FC` / `FC`.
- Default exports outside framework-required files.
- Named `Props` types for trivial one-off props where inline typing is clearer.
- Props named by UI implementation instead of domain/API role.
- API data converted too early or under a generic name that breaks traceability.
- Callers duplicating fallback checks that the lowest rendering component already handles.
-
-Prefer top-level `function` declarations for components and module helpers. Use arrow functions for callbacks and local lambdas.
-
-## Effects
-
-Flag effects that:
-
- Transform props/state for rendering.
- Copy one state value into another representing the same concept.
- Handle user actions that belong in event handlers.
- Reset state from props when a keyed reset, stable ID, or render-time derivation would work.
- Fetch data that belongs in framework APIs or TanStack Query.
-
-If an effect remains, it must synchronize with a named external system: browser API, subscription, timer, analytics-on-visibility, non-React widget, or imperative DOM integration.
-
-## State Modeling
-
-Flag:
-
- Storing derived booleans, disabled flags, default tabs, or loading labels that can be calculated from current query/feature state.
- Local state used to fake server data or generated contract fields.
- UI state persisted to localStorage when it is live app state.
- Feature-local mock shells wired to unrelated existing APIs before the real API is confirmed.
-
-Prefer render-time derivation. Keep true local state for user choices, transient input, controlled popups, and feature UI state that has no server source.
-
-## Navigation
-
-Flag:
-
- Imperative router navigation for ordinary links.
- Button semantics used for navigation.
- Navigation state hidden in component state when URL state is required for shareable filters, tabs, or pagination.
-
-Use `Link` for normal navigation. Use router APIs for mutation success, guarded redirects, command flows, or form submission side effects.
@@ -1,74 +0,0 @@
-# Data, Query, And Contract Rules
-
-Use these rules for generated contracts, TanStack Query, mutations, auth/SSR boundaries, URL state, and client persistence.
-
-## Generated Contracts
-
-Flag:
-
- New legacy service/helper wrappers around generated `queryOptions()` or `mutationOptions()`.
- Continuing to use deprecated contract operations when a ready generated contract exists.
- Assuming a generated file means an operation is ready without checking deprecated markers, schema shape, and the actual UI consumer.
- Re-declaring API DTOs in components.
- Adding compatibility layers instead of migrating the pointed line and deleting the old layer.
-
-Use `web/contract/*` as the API shape source of truth. Follow existing `{ params, query?, body? }` input shape.
-
-## Queries
-
-Flag:
-
- `enabled` used to hide missing required input instead of `input: skipToken`.
- Fake fallback IDs or placeholder inputs used to force a query to run.
- Query results copied into local state for rendering.
- Shared query behavior such as invalidation, stale defaults, or retry rules reimplemented at call sites.
- `prefetchQuery` treated as a hard gate or as returning data/errors to the caller.
-
-Use `useQuery(consoleQuery.xxx.queryOptions(...))` or `useQuery(marketplaceQuery.xxx.queryOptions(...))` directly unless a feature hook performs real orchestration.
-
-## Mutations
-
-Flag:
-
- Deprecated `useInvalid` or `useReset`.
- `mutateAsync` used without a need for Promise semantics.
- Awaited mutations without `try/catch`.
- Components owning shared cache invalidation that belongs in query defaults.
- Optimistic updates that do not match current list/detail ownership.
-
-Use generated `mutationOptions()` directly when possible. Put shared cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`.
-
-## SSR, Auth, And Route Boundaries
-
-Flag:
-
- Request-time auth, setup, workspace role, or tenant decisions moved into static `next.config redirects()`.
- Dynamic role gates depending on `workspaces.current` implemented as static path redirects.
- Authorization logic depending on soft `prefetchQuery`.
- Removing a client fallback before server API unavailable behavior is defined.
- Global placeholder query contracts introduced to solve a route-local Suspense issue.
- Branding-sensitive UI reading placeholder defaults without checking pending/placeholder state.
-
-Separate hard gates from soft prefetches. `fetchQuery` can be a server decision boundary; `prefetchQuery` is cache warmup.
-
-## Workspace And Tenant
-
-Flag:
-
- Treating workspace switch as ordinary CRUD invalidation when the current app flow performs server switch plus full reload.
- Query keys that omit workspace/tenant identity when the query truly varies by workspace and no full reload boundary applies.
- Mixing `workspace_id` and `tenant_id` without tracing the current backend/API contract.
-
-Current Dify workspace switch should be reviewed as a tenant cache boundary first.
-
-## URL State And Local Storage
-
-Flag:
-
- Shareable filters, tabs, pagination, selected panels, or search state hidden only in component state.
- One-shot navigation signals modeled as subscribed persistent state.
- Live app state stored in localStorage.
- Direct `window.localStorage`, `globalThis.localStorage`, or raw storage calls in app code.
- High-frequency interaction state persisted on every change instead of on commit/settle.
-
-Use URL state for shareable UI state, feature/Jotai/store state for live UI state, and `@/hooks/use-local-storage` only for low-frequency client-only preferences, dismissed notices, and UI defaults.
@@ -1,22 +0,0 @@
-# Dify Invariants
-
-Use these stable Dify-specific runtime rules in addition to the generic review packs.
-
-This file is not a place for active feature notes. Do not add rules for one branch, one PR, or a short-lived product decision such as a specific agent-v2, plugin, model-provider, or onboarding task. Keep a rule here only when all of these are true:
-
- It is a stable Dify runtime invariant.
- Generic React, TypeScript, accessibility, dify-ui, query, or performance rules would not catch it.
- The failure mode is concrete enough to produce a file-line review finding.
- The rule is likely to remain valid across normal feature work.
-
-## Workflow Nodes And RAG Pipe
-
-Flag:
-
- Node components under `web/app/components/workflow/nodes/[nodeName]/node.tsx` importing workflow store hooks that are unavailable in RAG Pipe template rendering.
- Node UI relying on provider context that is not mounted in every rendering surface.
- Store reads in render where React Flow `useNodes` / `useEdges` provide the actual node/edge source.
-
-Known failure mode: workflow node components can also render while creating a RAG Pipe from a template. In that context there may be no workflowStore provider, causing a blank screen.
-
-Prefer React Flow hooks for node/edge UI consumption. Use store APIs only where the provider is guaranteed and the code path is workflow-only.
@@ -1,123 +0,0 @@
-# Dify UI Rules
-
-Use these rules whenever a review touches `packages/dify-ui/` or code consuming `@langgenius/dify-ui/*`.
-
-Before finalizing findings for those files, read the current local docs that apply:
-
- `packages/dify-ui/README.md`
- `packages/dify-ui/AGENTS.md`
- `web/docs/overlay.md` for floating UI
- `packages/dify-ui/src/<primitive>/index.tsx` for the primitive being changed or consumed
-
-## Package Boundary
-
-Flag in `packages/dify-ui`:
-
- Imports from `web/`.
- Dependencies on Next.js, i18n, ky, Jotai, Zustand, TanStack Query, oRPC, or business APIs.
- Business-specific component behavior that belongs in `web/`.
- Multiple unrelated primitives in one component folder.
-
-`packages/dify-ui` is a primitive layer: Base UI headless components + `cva` + `cn` + Dify design tokens.
-
-## Imports And Exports
-
-Flag:
-
- Consumer imports from `@langgenius/dify-ui` without a subpath.
- Missing `package.json#exports` entry for a new primitive.
- Internal package imports using workspace subpaths instead of relative paths.
- Exported props using internal-only types that consumers cannot import from the component subpath.
-
-Consumers use subpath exports such as `@langgenius/dify-ui/button`.
-
-## Props And State
-
-Flag:
-
- Flattened props where related values need a discriminated union, such as `value` / `defaultValue`, `multiple` / `value`, or `clearable` / `onChange`.
- React state used only to mirror Base UI state for class names.
- JavaScript conditional class logic for visual states that the Dify UI/Base UI primitive already exposes through `data-*` attributes or CSS variables.
- Controlled props added when uncontrolled DOM state or CSS variables would be enough.
- Thin wrappers that rename Base UI parts without adding semantics.
-
-Prefer Base UI/Dify UI data attributes and CSS variables for visual state: `data-open`, `data-checked`, `data-disabled`, `data-highlighted`, `data-popup-open`, `group-data-*`, `peer-data-*`, `has-[:focus-visible]`, and primitive CSS variables such as anchor width or transform origin. Use JS conditional classes for product/business state that the primitive does not expose.
-
-## Forms
-
-Flag:
-
- Form-like UI using unrelated `Input` and `Button` pieces without a submit boundary.
- Text-like fields not composed through `FieldRoot`, `FieldLabel`, and `FieldControl` when using Dify UI form semantics.
- Select fields using `FieldLabel` instead of `SelectLabel`.
- Slider fields using a generic label instead of `SliderLabel`.
- Checkbox/radio groups missing `FieldsetRoot` and `FieldsetLegend`.
- Field errors or descriptions rendered without `FieldDescription` / `FieldError` relationships.
-
-`Form` is the submit boundary. Dify UI form primitives are not a form state-management framework; business validation and schema-driven behavior belong in `web/`.
-
-## Overlay Contract
-
-Flag:
-
- Legacy web overlay imports in new or modified code.
- Manual portals around Dify UI overlay primitives.
- Call-site `z-*` overrides on overlays.
- Missing root `isolation: isolate` assumptions when debugging overlay stacking.
- Repeated backdrop, z-index, or portal chrome at call sites.
- Tooltip used for infotips, long text, or interactive content.
-
-All Dify UI body-portalled overlays use `z-50`. Toast uses `z-60`. DOM order handles stacking between overlays.
-
-## Primitive Selection
-
-Flag:
-
- `Tabs` used for simple mode/filter/view selection where `SegmentedControl` is the semantic primitive.
- `SegmentedControl` used where `tablist` / `tabpanel` semantics are required.
- `Select` used for searchable or free-form input.
- `Combobox` used for unrestricted search text where no selected option is remembered.
- `Autocomplete` used for closed-list selection.
- Tooltip or PreviewCard used for content that must be reachable on touch or by screen readers.
-
-Use:
-
- `Autocomplete` for free-form text with optional suggestions.
- `Combobox` for searchable selected values from a collection.
- `Select` for closed, scannable option sets.
- `Popover` for infotips, help text, rich content, or interactions.
-
-## Bad Usage Patterns To Flag
-
-Flag:
-
- Styling a raw Base UI primitive directly in `web/` when a Dify UI primitive exists.
- Wrapping a Dify UI primitive in a feature component that hides its label, error, disabled, or focus contract.
- Replacing a semantic primitive with a generic `div` plus classes to match a screenshot.
- Using `Tooltip` because it is visually convenient when the content is actually help text or needs touch access.
- Adding a `z-*` override to make a child popup appear over a parent dialog.
- Adding a new app-level wrapper around Dialog, Drawer, Popover, Select, or Combobox that repeats portal/backdrop/positioner logic.
- Using dify-ui `Input` as a drop-in replacement for legacy inputs that include search, clear, copy, unit, localized placeholder, or number normalization behavior.
- Building a form row from loose text and controls instead of the matching Field/Form primitives.
- Adding component state only to style `data-open`, `data-checked`, `data-disabled`, or highlighted states that Base UI already exposes.
- Passing booleans down only so children can toggle classes already expressible with primitive `data-*` selectors.
-
-## Tokens, Radius, And Styling
-
-Flag:
-
- `radius-*` class names.
- Custom Tailwind `borderRadius` extension for Figma radius values.
- Generic colors where semantic Dify tokens exist.
- Hardcoded design values where Dify tokens, component variants, or documented Figma radius mappings exist.
- `!` important modifiers used to fight primitive styles instead of fixing the variant, selector, or component composition.
- Manual class strings that duplicate primitive variants.
- `min-w-(--anchor-width)` on picker popups when it defeats viewport clamping.
-
-Use the Figma radius mapping from `packages/dify-ui/AGENTS.md`; for example `--radius/sm` maps to `rounded-md`, and `--radius/md` maps to `rounded-lg`.
-
-Use `!` only for a tightly scoped compatibility override after confirming the primitive API, data attributes, and selector structure cannot express the state.
-
-## Focus Details
-
-Flag focus rings attached to the wrong element. For example, Base UI `Slider.Thumb` focuses an internal `input[type=range]`, so the visible thumb wrapper needs `has-[:focus-visible]` rather than direct wrapper `focus-visible`.
@@ -1,78 +1,45 @@
-# Performance Rules
+# Rule Catalog — Performance

-Review performance only where there is realistic impact. Do not request `memo`, `useMemo`, `useCallback`, virtualization, or caching as style preferences.
+## React Flow data usage

-## Async Waterfalls
+IsUrgent: True
+Category: Performance

-Flag:
+### Description

- Awaiting remote feature flags or fetches before checking cheap synchronous conditions.
- Sequential awaits for independent operations.
- API routes or server components starting requests late when they could start early.
- Nested per-item fetches running serially when each item can fetch in parallel.
- Suspense boundaries that force the whole page to wait when a lower boundary could stream or isolate loading.
+When rendering React Flow, prefer `useNodes`/`useEdges` for UI consumption and rely on `useStoreApi` inside callbacks that mutate or read node/edge state. Avoid manually pulling Flow data outside of these hooks.

-Prefer `Promise.all` for independent work and branch-local awaits for conditionally needed data.
+## Complex prop stability

-## Bundle Size
+IsUrgent: False
+Category: Performance

-Flag:
+### Description

- Barrel imports from heavy libraries or `@langgenius/dify-ui`.
- Dynamic paths that prevent static trace analysis.
- Heavy components loaded eagerly when hidden behind a dialog, tab, command, or feature activation.
- Analytics, logging, editor, visualization, or third-party SDK code loaded before it is needed.
- Feature-local optional modules imported at top level only for rare flows.
+Only require stable object, array, or map props when there is a clear reason: the child is memoized, the value participates in effect/query dependencies, the value is part of a stable-reference API contract, or profiling/local behavior shows avoidable re-renders. Do not request `useMemo` for every inline object by default; `how-to-write-component` treats memoization as a targeted optimization.

-Use direct imports and `next/dynamic` where the user-visible path benefits.
+Update this file when adding, editing, or removing Performance rules so the catalog remains accurate.

-## Server Rendering
+Risky:

-Flag:
+```tsx
+<HeavyComp
+    config={{
+        provider: ...,
+        detail: ...
+    }}
+/>
+```

- Request-specific mutable state stored at module scope in SSR/RSC paths.
- Large duplicate data serialized across RSC/client boundaries.
- Static I/O repeated per request when it could be hoisted safely.
- Cross-request cache without a bounded invalidation strategy.
- Server actions lacking API-route-equivalent auth checks.
+Better when stable identity matters:

-Use request-scoped deduplication such as `React.cache()` when repeated server reads in one request are the problem.
+```tsx
+const config = useMemo(() => ({
+    provider: ...,
+    detail: ...
+}), [provider, detail]);

-## Re-rendering
-
-Flag:
-
- Effects or subscriptions reading broad state when a derived boolean or narrower selector is enough.
- Components defined inside components.
- Derived rendering state stored in state/effects.
- Non-primitive default props recreated for memoized children.
- Expensive work recalculated on every render where it affects real interaction cost.
- High-frequency transient values stored in state when refs or CSS variables would avoid render loops.
-
-Do not flag simple primitive expressions wrapped or not wrapped in `useMemo`; prefer no memo for simple work.
-
-Require stable object/array/function identity only when:
-
- The child is memoized and identity affects renders.
- The value is an effect/query dependency.
- A library API requires stable references.
- Profiling or local behavior shows avoidable re-rendering.
-
-## DOM, Lists, And Rendering
-
-Flag:
-
- Layout reads in render (`getBoundingClientRect`, `offset*`, `scrollTop`).
- Interleaved DOM reads/writes that can cause layout thrashing.
- Large lists rendering without virtualization, pagination, or `content-visibility`.
- SVG/animation code animating expensive properties when transform/opacity would work.
- `transition-all`.
- Long-running non-critical browser work performed immediately instead of idle/deferred scheduling.
-
-## React Flow
-
-For workflow React Flow components, keep this Dify-specific rule:
-
- UI consumption should use React Flow hooks such as `useNodes` / `useEdges`.
- Callback-only reads or mutations can use `useStoreApi`.
- Node components under `web/app/components/workflow/nodes/[nodeName]/node.tsx` must not depend on workflow stores that are absent in RAG Pipe template rendering.
+<HeavyComp
+    config={config}
+/>
+```
@@ -1,72 +0,0 @@
-# Testing Review Rules
-
-Use these rules when reviewing test files, testability of changed code, or risky frontend changes that should have tests.
-
-## Missing Coverage
-
-Flag missing tests when the change affects:
-
- User-visible behavior, navigation, form submission, validation, permissions, or loading/error/empty states.
- Query/mutation cache behavior.
- Accessibility-critical behavior such as labels, keyboard flow, focus, disabled state, or popup reachability.
- URL state parsing/serialization.
- Storage persistence or one-shot signals.
- Regression-prone workflow or generated contract migration paths.
-
-Do not request tests for purely mechanical renames or styling-only changes unless the styling affects layout, focus, or interaction.
-
-## Selectors
-
-Flag:
-
- `getByTestId` used where role, label, text, placeholder, landmark, or scoped dialog/menu queries are available.
- Production `data-testid` added only to satisfy tests.
- Assertions against decorative icons rather than the named control.
- Tests that cannot find controls semantically but leave broken markup unchanged.
-
-Prefer `getByRole` with accessible name, then `getByLabelText`, `getByPlaceholderText`, `getByText`, and `within(...)`.
-
-## Mocking
-
-Flag:
-
- Mocking `@langgenius/dify-ui/*` primitives.
- Mocking `@/app/components/base/*` components when the real component is practical.
- Mocking sibling or child components in the same directory for integration behavior.
- Mocks that do not match the real component's conditional rendering.
- Module-level mock state not reset in `beforeEach`.
- `vi.clearAllMocks()` in `afterEach` instead of `beforeEach`.
-
-Use real project components for integration behavior. Mock APIs, `next/navigation`, browser shims, or complex providers only when setup would dominate the test.
-
-## Behavior
-
-Flag:
-
- Tests inspecting implementation details instead of user-observable behavior.
- Assertions that hardcode brittle copy when pattern matching or semantic roles would express behavior better.
- Fake timers used without real timing behavior.
- Async assertions missing `await`, `findBy*`, or `waitFor`.
- Test data missing required fields because inline partial objects bypass real types.
-
-Use typed factory functions with complete defaults and partial overrides.
-
-## URL State
-
-For `nuqs` or query-state hooks, flag tests that:
-
- Mock URL state when URL synchronization is the behavior under review.
- Do not test parser serialize/parse round trips for custom parsers.
- Do not assert default-clearing behavior when defaults should be removed from the URL.
-
-Prefer shared `NuqsTestingAdapter` helpers when available.
-
-## Organization
-
-Flag:
-
- Component/hook/util tests outside sibling `__tests__/` directories.
- Directory-level reviews that test only `index.tsx` while other files in scope contain behavior.
- Large test files with repeated setup that should use local builders.
-
-When a component is very complex, prefer a refactor finding before asking for exhaustive tests.
@@ -1,33 +0,0 @@
---
-name: karpathy-guidelines
-description: Lightweight coding guardrails for making focused, simple, and verifiable changes in this repo. Use for all coding work.
---
-
-# Karpathy Guidelines
-
-Use this skill whenever you touch code in this repository.
-
-## Principles
-
- Keep the change small and directly tied to the user request.
- Prefer the simplest implementation that fits the existing codebase.
- Read the nearby code first, then match its patterns.
- Avoid unrelated refactors, broad rewrites, or style churn.
- Preserve existing behavior unless the user explicitly asked to change it.
- Treat regressions as a signal to narrow the change, not to add workaround layers.
-
-## Workflow
-
-1. Inspect the current implementation and tests around the change.
-2. Make the smallest coherent edit.
-3. Add or update focused tests when the behavior changes or the risk is non-trivial.
-4. Run the narrowest relevant verification first.
-5. Report exactly what was verified and anything left unverified.
-
-## Review Checklist
-
- Does this change solve the stated problem without expanding scope?
- Did it preserve existing route/component/data-flow semantics?
- Are new abstractions justified by real complexity?
- Are tests focused on the behavior that could regress?
- Are unrelated files and generated artifacts left alone?
@@ -0,0 +1 @@
+../../.agents/skills/frontend-query-mutation
@@ -1 +0,0 @@
-../../.agents/skills/how-to-write-component
@@ -15,10 +15,6 @@
 # Agents
 /.agents/skills/ @hyoban

-# Packages
-/packages/ @lyzno1
-/packages/contracts/ @crazywoola @laipz8200
-
 # Docs
 /docs/ @crazywoola

@@ -147,14 +143,6 @@
 # Frontend
 /web/ @iamjoel

-# Frontend - Platform and Features
-/web/config/ @lyzno1
-/web/contract/ @lyzno1
-/web/env.ts @lyzno1
-/web/features/ @lyzno1
-/web/hooks/ @lyzno1
-/web/scripts/gen-icons.mjs @lyzno1
-
 # Frontend - Web Tests
 /.github/workflows/web-tests.yml @iamjoel

@@ -265,6 +253,7 @@
 /web/utils/time.ts @iamjoel @zxhlyh
 /web/utils/format.ts @iamjoel @zxhlyh
 /web/utils/clipboard.ts @iamjoel @zxhlyh
+/web/hooks/use-document-title.ts @iamjoel @zxhlyh

 # Frontend - Billing and Education
 /web/app/components/billing/ @iamjoel @zxhlyh
@@ -51,15 +51,6 @@ jobs:
        with:
          files: |
            api/**
-      - name: Check dify-agent inputs
-        if: github.event_name != 'merge_group'
-        id: dify-agent-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            dify-agent/**/*.py
-            dify-agent/pyproject.toml
-            dify-agent/uv.lock
      - if: github.event_name != 'merge_group'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
@@ -85,17 +76,6 @@ jobs:
          # Format code
          uv run ruff format ..

-      - if: github.event_name != 'merge_group' && steps.dify-agent-changes.outputs.any_changed == 'true'
-        run: |
-          cd dify-agent
-          uv sync --dev
-          # fmt first to avoid line too long
-          uv run ruff format .
-          # Fix lint errors
-          uv run ruff check --fix .
-          # Format code
-          uv run ruff format .
-
      - name: count migration progress
        if: github.event_name != 'merge_group' && steps.api-changes.outputs.any_changed == 'true'
        run: |
@@ -2,165 +2,87 @@ name: CLI Release

 on:
  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: Dify release tag to attach difyctl assets to (blank = latest stable)
-        required: false
-        type: string
-  workflow_call:
-    inputs:
-      release_tag:
-        description: Dify release tag to attach difyctl assets to (blank = latest stable)
-        required: false
-        type: string
-  release:
-    types: [released]
+  push:
+    tags:
+      - 'difyctl-v*'

 concurrency:
-  group: difyctl-release
-  cancel-in-progress: false
+  group: cli-release-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
-  validate:
-    name: validate manifest + resolve target Dify release
+  release:
+    name: build standalone binaries (all targets)
    runs-on: depot-ubuntu-24.04
    if: github.repository == 'langgenius/dify'
-    permissions:
-      contents: read
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./cli
-    outputs:
-      dify_tag: ${{ steps.resolve.outputs.dify_tag }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Export manifest to env
-        run: node scripts/release-naming.mjs github-env >> "$GITHUB_ENV"
-
-      - name: Validate manifest
-        run: scripts/release-validate-manifest.sh
-
-      - name: Resolve target Dify release
-        id: resolve
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT_TAG: ${{ github.event.release.tag_name }}
-          INPUT_TAG: ${{ inputs.release_tag }}
-        run: |
-          if [ -n "$EVENT_TAG" ]; then
-              tag="$EVENT_TAG"
-          elif [ -n "$INPUT_TAG" ]; then
-              tag="$INPUT_TAG"
-          else
-              tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)"
-          fi
-          if [ -z "$tag" ]; then
-              echo "::error::could not resolve a target Dify release tag"
-              exit 1
-          fi
-          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-              echo "::error::target Dify release ${tag} not found"
-              exit 1
-          fi
-          echo "dify_tag=${tag}" >> "$GITHUB_OUTPUT"
-          echo "::notice::target Dify release ${tag}"
-
-      - name: Compatibility check
-        env:
-          DIFY_TAG: ${{ steps.resolve.outputs.dify_tag }}
-        run: node scripts/release-naming.mjs compat-check "$DIFY_TAG"
-
-      - name: Reject duplicate difyctl version
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${difyctlTag}" >/dev/null 2>&1; then
-              echo "::error::difyctl ${version} already released (tag ${difyctlTag} exists); bump cli/package.json version"
-              exit 1
-          fi
-
-  release:
-    name: build + attach standalone binaries (all targets)
-    needs: validate
-    runs-on: depot-ubuntu-24.04
    permissions:
      contents: write
    defaults:
      run:
        shell: bash
        working-directory: ./cli
-    env:
-      DIFY_TAG: ${{ needs.validate.outputs.dify_tag }}
+
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
-          fetch-depth: 1
-
-      - name: Enable cross-arch native prebuilds
-        working-directory: ./
-        run: cat cli/scripts/cross-arch.pnpm.yaml >> pnpm-workspace.yaml
+          fetch-depth: 0

      - name: Setup web environment
        uses: ./.github/actions/setup-web

-      - name: Export manifest to env
-        run: node scripts/release-naming.mjs github-env >> "$GITHUB_ENV"
-
      - name: Setup Bun
        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.2
        with:
-          bun-version-file: cli/.bun-version
+          bun-version: latest
+
+      - name: Read cli/package.json
+        id: manifest
+        run: |
+          version=$(node -p "require('./package.json').version")
+          channel=$(node -p "require('./package.json').difyctl.channel")
+          minDify=$(node -p "require('./package.json').difyctl.compat.minDify")
+          maxDify=$(node -p "require('./package.json').difyctl.compat.maxDify")
+          {
+              echo "version=$version"
+              echo "channel=$channel"
+              echo "minDify=$minDify"
+              echo "maxDify=$maxDify"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Validate manifest
+        run: scripts/release-validate-manifest.sh
+
+      - name: Install cross-arch native prebuilds
+        # Re-installs node_modules with every @napi-rs/keyring platform variant
+        # so `bun build --compile` can embed the right .node into each target.
+        working-directory: ./
+        run: NPM_CONFIG_USERCONFIG="$PWD/cli/scripts/cross-arch.npmrc" pnpm install --frozen-lockfile

      - name: Compile standalone binaries (all targets)
+        env:
+          CLI_VERSION: ${{ steps.manifest.outputs.version }}
+          DIFYCTL_CHANNEL: ${{ steps.manifest.outputs.channel }}
+          DIFYCTL_MIN_DIFY: ${{ steps.manifest.outputs.minDify }}
+          DIFYCTL_MAX_DIFY: ${{ steps.manifest.outputs.maxDify }}
        run: |
          DIFYCTL_COMMIT="$(git rev-parse HEAD)" \
          DIFYCTL_BUILD_DATE="$(git log -1 --format=%cI HEAD)" \
            pnpm build:bin

      - name: Generate sha256 checksum file
+        env:
+          CLI_VERSION: ${{ steps.manifest.outputs.version }}
        run: scripts/release-write-checksums.sh

-      - name: Attach difyctl assets to Dify release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release upload "$DIFY_TAG" dist/bin/${tagPrefix}* \
-              --repo "$GITHUB_REPOSITORY" --clobber
-
-      - name: Prune stale difyctl assets
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          new_set="$(cd dist/bin && ls ${tagPrefix}*)"
-          gh release view "$DIFY_TAG" --repo "$GITHUB_REPOSITORY" \
-              --json assets --jq '.assets[].name' \
-            | { grep -E "^${tagPrefix}" || true; } \
-            | while IFS= read -r name; do
-                if ! printf '%s\n' "$new_set" | grep -qxF -- "$name"; then
-                    echo "::notice::pruning stale asset ${name}"
-                    gh release delete-asset "$DIFY_TAG" "$name" \
-                        --repo "$GITHUB_REPOSITORY" --yes
-                fi
-              done
-
-      - name: Create provenance tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          ref="refs/tags/${difyctlTag}"
-          sha="$(git rev-parse HEAD)"
-          status="$(gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" \
-                -f ref="$ref" -f sha="$sha" --silent --include 2>/dev/null \
-                | awk 'NR==1 {print $2; exit}' || true)"
-          case "$status" in
-              201) echo "::notice::created ${ref}" ;;
-              422) echo "::notice::tag ${ref} already exists; skipping (immutable)" ;;
-              *)   echo "::error::provenance tag ${ref} not created (HTTP ${status:-unknown})"; exit 1 ;;
-          esac
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        with:
+          tag_name: difyctl-v${{ steps.manifest.outputs.version }}
+          name: difyctl ${{ steps.manifest.outputs.version }}
+          prerelease: ${{ steps.manifest.outputs.channel != 'stable' }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true
+          files: |
+            cli/dist/bin/difyctl-v*
@@ -37,10 +37,6 @@ jobs:
      - name: Setup web environment
        uses: ./.github/actions/setup-web

-      - name: Validate release manifest
-        if: matrix.os == 'depot-ubuntu-24.04'
-        run: scripts/release-validate-manifest.sh
-
      - name: CI pipeline (typecheck, lint, coverage, build)
        run: pnpm ci

@@ -259,6 +259,3 @@ scripts/stress-test/reports/
 .qoder/*
 .context/
 .eslintcache
-
-# Vitest local reports
-web/.vitest-reports/
@@ -17,7 +17,7 @@ FROM base AS packages
 RUN apt-get update \
    && apt-get install -y --no-install-recommends \
          # basic environment
-          git g++ \
+          g++ \
          # for building gmpy2
          libmpfr-dev libmpc-dev

@@ -97,6 +97,7 @@ RUN \
 # Copy Python environment and packages
 ENV VIRTUAL_ENV=/app/api/.venv
 COPY --from=packages --chown=dify:dify ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+COPY --from=packages --chown=dify:dify /app/dify-agent /app/dify-agent
 ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"

 # Download nltk data
@@ -34,7 +34,6 @@ from clients.agent_backend.request_builder import (
    DIFY_PLUGIN_TOOLS_LAYER_ID,
    WORKFLOW_NODE_JOB_PROMPT_LAYER_ID,
    WORKFLOW_USER_PROMPT_LAYER_ID,
-    AgentBackendAgentAppRunInput,
    AgentBackendModelConfig,
    AgentBackendOutputConfig,
    AgentBackendRunRequestBuilder,
@@ -50,7 +49,6 @@ __all__ = [
    "DIFY_PLUGIN_TOOLS_LAYER_ID",
    "WORKFLOW_NODE_JOB_PROMPT_LAYER_ID",
    "WORKFLOW_USER_PROMPT_LAYER_ID",
-    "AgentBackendAgentAppRunInput",
    "AgentBackendError",
    "AgentBackendHTTPError",
    "AgentBackendInternalEvent",
@@ -30,7 +30,6 @@ from dify_agent.layers.execution_context import (
    DifyExecutionContextLayerConfig,
 )
 from dify_agent.layers.output import DIFY_OUTPUT_LAYER_TYPE_ID, DifyOutputLayerConfig
-from dify_agent.layers.shell import DIFY_SHELL_LAYER_TYPE_ID, DifyShellLayerConfig
 from dify_agent.protocol import (
    DIFY_AGENT_HISTORY_LAYER_ID,
    DIFY_AGENT_MODEL_LAYER_ID,
@@ -46,10 +45,8 @@ from pydantic import BaseModel, ConfigDict, Field, JsonValue, field_validator
 AGENT_SOUL_PROMPT_LAYER_ID = "agent_soul_prompt"
 WORKFLOW_NODE_JOB_PROMPT_LAYER_ID = "workflow_node_job_prompt"
 WORKFLOW_USER_PROMPT_LAYER_ID = "workflow_user_prompt"
-AGENT_APP_USER_PROMPT_LAYER_ID = "agent_app_user_prompt"
 DIFY_EXECUTION_CONTEXT_LAYER_ID = "execution_context"
 DIFY_PLUGIN_TOOLS_LAYER_ID = "tools"
-DIFY_SHELL_LAYER_ID = "shell"

 # Layer types that hold credentials in their per-run config. These are excluded
 # from the cleanup-replay composition (and from the snapshot that is sent with
@@ -169,10 +166,6 @@ class AgentBackendWorkflowNodeRunInput(BaseModel):
    idempotency_key: str | None = None
    output: AgentBackendOutputConfig | None = None
    tools: DifyPluginToolsLayerConfig | None = None
-    # Inject the sandboxed shell layer (dify.shell). Requires the agent backend
-    # to be wired with a shellctl entrypoint; see configs AGENT_SHELL_ENABLED.
-    include_shell: bool = False
-    shell_config: DifyShellLayerConfig | None = None
    session_snapshot: CompositorSessionSnapshot | None = None
    include_history: bool = True
    suspend_on_exit: bool = True
@@ -188,154 +181,9 @@ class AgentBackendWorkflowNodeRunInput(BaseModel):
        return value


-class AgentBackendAgentAppRunInput(BaseModel):
-    """Inputs to build one Agent App conversation-turn run request.
-
-    Unlike the workflow-node input there is no workflow-node-job prompt and no
-    previous-node context: the user prompt is the chat message, and multi-turn
-    continuity comes from ``session_snapshot`` + the history layer keyed by the
-    conversation.
-    """
-
-    model: AgentBackendModelConfig
-    execution_context: DifyExecutionContextLayerConfig
-    user_prompt: str
-    agent_soul_prompt: str | None = None
-    purpose: RunPurpose = "agent_app"
-    idempotency_key: str | None = None
-    output: AgentBackendOutputConfig | None = None
-    tools: DifyPluginToolsLayerConfig | None = None
-    # Inject the sandboxed shell layer (dify.shell). Requires the agent backend
-    # to be wired with a shellctl entrypoint; see configs AGENT_SHELL_ENABLED.
-    include_shell: bool = False
-    shell_config: DifyShellLayerConfig | None = None
-    session_snapshot: CompositorSessionSnapshot | None = None
-    include_history: bool = True
-    suspend_on_exit: bool = True
-    metadata: dict[str, JsonValue] = Field(default_factory=dict)
-
-    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid", arbitrary_types_allowed=True)
-
-    @field_validator("user_prompt")
-    @classmethod
-    def _reject_blank_prompt(cls, value: str) -> str:
-        if not value.strip():
-            raise ValueError("prompt must not be blank")
-        return value
-
-
 class AgentBackendRunRequestBuilder:
    """Converts API product state into the public ``dify-agent`` run protocol."""

-    def build_for_agent_app(self, run_input: AgentBackendAgentAppRunInput) -> CreateRunRequest:
-        """Build an Agent App conversation-turn run request.
-
-        Layer graph: optional Agent Soul system prompt → user prompt →
-        execution context → optional history (multi-turn) → LLM → optional
-        plugin tools → optional structured output. Mirrors the workflow-node
-        layer ordering minus the workflow-job / previous-node prompt.
-        """
-        layers: list[RunLayerSpec] = []
-        if run_input.agent_soul_prompt:
-            layers.append(
-                RunLayerSpec(
-                    name=AGENT_SOUL_PROMPT_LAYER_ID,
-                    type=PLAIN_PROMPT_LAYER_TYPE_ID,
-                    metadata={**run_input.metadata, "origin": "agent_soul"},
-                    config=PromptLayerConfig(prefix=run_input.agent_soul_prompt),
-                )
-            )
-
-        layers.extend(
-            [
-                RunLayerSpec(
-                    name=AGENT_APP_USER_PROMPT_LAYER_ID,
-                    type=PLAIN_PROMPT_LAYER_TYPE_ID,
-                    metadata={**run_input.metadata, "origin": "agent_app_user_prompt"},
-                    config=PromptLayerConfig(user=run_input.user_prompt),
-                ),
-                RunLayerSpec(
-                    name=DIFY_EXECUTION_CONTEXT_LAYER_ID,
-                    type=DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID,
-                    metadata=run_input.metadata,
-                    config=run_input.execution_context,
-                ),
-            ]
-        )
-
-        if run_input.include_history:
-            layers.append(
-                RunLayerSpec(
-                    name=DIFY_AGENT_HISTORY_LAYER_ID,
-                    type=PYDANTIC_AI_HISTORY_LAYER_TYPE_ID,
-                    metadata={**run_input.metadata, "origin": "agent_session_history"},
-                )
-            )
-
-        layers.append(
-            RunLayerSpec(
-                name=DIFY_AGENT_MODEL_LAYER_ID,
-                type=DIFY_PLUGIN_LLM_LAYER_TYPE_ID,
-                deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
-                metadata=run_input.metadata,
-                config=DifyPluginLLMLayerConfig(
-                    plugin_id=run_input.model.plugin_id,
-                    model_provider=run_input.model.model_provider,
-                    model=run_input.model.model,
-                    credentials=run_input.model.credentials,
-                    model_settings=run_input.model.model_settings or None,
-                ),
-            )
-        )
-
-        if run_input.tools is not None and run_input.tools.tools:
-            layers.append(
-                RunLayerSpec(
-                    name=DIFY_PLUGIN_TOOLS_LAYER_ID,
-                    type=DIFY_PLUGIN_TOOLS_LAYER_TYPE_ID,
-                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
-                    metadata=run_input.metadata,
-                    config=run_input.tools,
-                )
-            )
-
-        if run_input.include_shell:
-            # Sandboxed bash workspace (dify.shell). The layer declares NoLayerDeps,
-            # so the spec carries no deps; shellctl connection is server-injected.
-            layers.append(
-                RunLayerSpec(
-                    name=DIFY_SHELL_LAYER_ID,
-                    type=DIFY_SHELL_LAYER_TYPE_ID,
-                    metadata=run_input.metadata,
-                    config=run_input.shell_config or DifyShellLayerConfig(),
-                )
-            )
-
-        if run_input.output is not None:
-            layers.append(
-                RunLayerSpec(
-                    name=DIFY_AGENT_OUTPUT_LAYER_ID,
-                    type=DIFY_OUTPUT_LAYER_TYPE_ID,
-                    metadata=run_input.metadata,
-                    config=DifyOutputLayerConfig(
-                        json_schema=run_input.output.json_schema,
-                        description=run_input.output.description,
-                        strict=run_input.output.strict,
-                    ),
-                )
-            )
-
-        return CreateRunRequest(
-            composition=RunComposition(layers=layers),
-            purpose=run_input.purpose,
-            idempotency_key=run_input.idempotency_key,
-            metadata=run_input.metadata,
-            session_snapshot=run_input.session_snapshot,
-            on_exit=LayerExitSignals(
-                default=ExitIntent.SUSPEND if run_input.suspend_on_exit else ExitIntent.DELETE,
-            ),
-        )
-
    def build_cleanup_request(
        self,
        *,
@@ -454,18 +302,6 @@ class AgentBackendRunRequestBuilder:
                )
            )

-        if run_input.include_shell:
-            # Sandboxed bash workspace (dify.shell). The layer declares NoLayerDeps,
-            # so the spec carries no deps; shellctl connection is server-injected.
-            layers.append(
-                RunLayerSpec(
-                    name=DIFY_SHELL_LAYER_ID,
-                    type=DIFY_SHELL_LAYER_TYPE_ID,
-                    metadata=run_input.metadata,
-                    config=run_input.shell_config or DifyShellLayerConfig(),
-                )
-            )
-
        if run_input.output is not None:
            layers.append(
                RunLayerSpec(
@@ -1,135 +0,0 @@
-"""API-side client for the agent backend's read-only workspace file endpoints.
-
-The agent backend exposes ``/workspaces/{session_id}/files{,/preview,/download}``
-to inspect a shell-layer sandbox workspace. This thin synchronous client proxies
-those reads for the console FS inspector and normalizes transport/HTTP failures
-into the API backend's ``AgentBackendError`` boundary, preserving the backend's
-status code and ``{code, message}`` detail so the controller can relay them.
-"""
-
-from __future__ import annotations
-
-import base64
-import binascii
-from dataclasses import dataclass
-from typing import Literal
-
-import httpx
-from pydantic import BaseModel
-
-from clients.agent_backend.errors import AgentBackendHTTPError, AgentBackendTransportError
-
-_DEFAULT_TIMEOUT_SECONDS = 30.0
-
-
-class WorkspaceFileEntry(BaseModel):
-    """One entry in a workspace directory listing."""
-
-    name: str
-    type: Literal["file", "dir", "symlink"]
-    size: int
-    mtime: int
-
-
-class WorkspaceListResult(BaseModel):
-    """Directory listing of a workspace path."""
-
-    path: str
-    entries: list[WorkspaceFileEntry]
-    truncated: bool
-
-
-class WorkspacePreviewResult(BaseModel):
-    """Inline preview of a workspace file."""
-
-    path: str
-    size: int
-    truncated: bool
-    binary: bool
-    text: str | None = None
-
-
-@dataclass(frozen=True, slots=True)
-class WorkspaceDownloadResult:
-    """Decoded bytes of a workspace file for download."""
-
-    path: str
-    size: int
-    truncated: bool
-    content: bytes
-
-
-class WorkspaceFilesBackendClient:
-    """Synchronous proxy to the agent backend workspace file endpoints."""
-
-    def __init__(
-        self,
-        base_url: str,
-        *,
-        timeout: float = _DEFAULT_TIMEOUT_SECONDS,
-        transport: httpx.BaseTransport | None = None,
-    ) -> None:
-        self._base_url = base_url.rstrip("/")
-        self._timeout = timeout
-        self._transport = transport
-
-    def list_files(self, session_id: str, path: str) -> WorkspaceListResult:
-        data = self._get(f"/workspaces/{session_id}/files", params={"path": path})
-        return WorkspaceListResult.model_validate(data)
-
-    def preview(self, session_id: str, path: str) -> WorkspacePreviewResult:
-        data = self._get(f"/workspaces/{session_id}/files/preview", params={"path": path})
-        return WorkspacePreviewResult.model_validate(data)
-
-    def download(self, session_id: str, path: str) -> WorkspaceDownloadResult:
-        data = self._get(f"/workspaces/{session_id}/files/download", params={"path": path})
-        encoded = data.get("content_base64")
-        if not isinstance(encoded, str):
-            raise AgentBackendHTTPError("agent backend download response missing content", status_code=502, detail=data)
-        try:
-            content = base64.b64decode(encoded, validate=True)
-        except (binascii.Error, ValueError) as exc:
-            raise AgentBackendHTTPError(
-                "agent backend returned undecodable download content", status_code=502, detail=str(exc)
-            ) from exc
-        size = data.get("size")
-        return WorkspaceDownloadResult(
-            path=str(data.get("path", path)),
-            size=int(size) if isinstance(size, (int, float)) else len(content),
-            truncated=bool(data.get("truncated")),
-            content=content,
-        )
-
-    def _get(self, route: str, *, params: dict[str, str]) -> dict[str, object]:
-        url = f"{self._base_url}{route}"
-        try:
-            with httpx.Client(timeout=self._timeout, transport=self._transport, trust_env=False) as client:
-                response = client.get(url, params=params)
-        except httpx.HTTPError as exc:
-            raise AgentBackendTransportError(f"failed to reach agent backend workspace endpoint: {exc}") from exc
-        if response.status_code >= 400:
-            detail: object
-            try:
-                detail = response.json().get("detail", response.text)
-            except ValueError:
-                detail = response.text
-            raise AgentBackendHTTPError(
-                f"agent backend workspace request failed ({response.status_code})",
-                status_code=response.status_code,
-                detail=detail,
-            )
-        body = response.json()
-        if not isinstance(body, dict):
-            raise AgentBackendHTTPError(
-                "agent backend workspace response was not an object", status_code=502, detail=body
-            )
-        return body
-
-
-__all__ = [
-    "WorkspaceDownloadResult",
-    "WorkspaceFileEntry",
-    "WorkspaceFilesBackendClient",
-    "WorkspaceListResult",
-    "WorkspacePreviewResult",
-]
@@ -11,7 +11,6 @@ from .data_migration import (
    migration_data_wizard,
 )
 from .plugin import (
-    backfill_plugin_auto_upgrade,
    extract_plugins,
    extract_unique_plugins,
    install_plugins,
@@ -50,7 +49,6 @@ from .vector import (
 __all__ = [
    "add_qdrant_index",
    "archive_workflow_runs",
-    "backfill_plugin_auto_upgrade",
    "clean_expired_messages",
    "clean_workflow_runs",
    "cleanup_orphaned_draft_variables",
@@ -1,11 +1,10 @@
 import json
 import logging
-import time
 from typing import Any, cast

 import click
 from pydantic import TypeAdapter
-from sqlalchemy import delete, func, select
+from sqlalchemy import delete, select
 from sqlalchemy.engine import CursorResult

 from configs import dify_config
@@ -16,13 +15,11 @@ from core.plugin.plugin_service import PluginService
 from core.tools.utils.system_encryption import encrypt_system_params
 from extensions.ext_database import db
 from models import Tenant
-from models.account import TenantPluginAutoUpgradeStrategy
 from models.oauth import DatasourceOauthParamConfig, DatasourceProvider
 from models.provider_ids import DatasourceProviderID, ToolProviderID
 from models.source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
 from models.tools import ToolOAuthSystemClient
 from services.plugin.data_migration import PluginDataMigration
-from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
 from services.plugin.plugin_migration import PluginMigration

 logger = logging.getLogger(__name__)
@@ -405,110 +402,6 @@ def migrate_data_for_plugin():
    click.echo(click.style("Migrate data for plugin completed.", fg="green"))


-def _candidate_auto_upgrade_strategy_tenant_ids_stmt(limit: int | None = None):
-    category_count = len(TenantPluginAutoUpgradeStrategy.PluginCategory)
-    stmt = (
-        select(TenantPluginAutoUpgradeStrategy.tenant_id)
-        .group_by(TenantPluginAutoUpgradeStrategy.tenant_id)
-        .having(func.count(func.distinct(TenantPluginAutoUpgradeStrategy.category)) < category_count)
-        .order_by(TenantPluginAutoUpgradeStrategy.tenant_id)
-    )
-
-    if limit is not None:
-        stmt = stmt.limit(limit)
-
-    return stmt
-
-
-def _count_auto_upgrade_strategy_tenant_ids(limit: int | None) -> int:
-    candidate_stmt = _candidate_auto_upgrade_strategy_tenant_ids_stmt(limit).subquery()
-    return db.session.scalar(select(func.count()).select_from(candidate_stmt)) or 0
-
-
-def _iter_auto_upgrade_strategy_tenant_ids(limit: int | None):
-    stmt = _candidate_auto_upgrade_strategy_tenant_ids_stmt(limit).execution_options(yield_per=1000)
-    yield from db.session.scalars(stmt)
-
-
-@click.command(
-    "backfill-plugin-auto-upgrade",
-    help="Backfill category-scoped plugin auto-upgrade strategies and normalize plugin lists.",
-)
-@click.option("--tenant-id", multiple=True, help="Tenant ID to backfill. Can be passed multiple times.")
-@click.option("--limit", type=int, default=None, help="Maximum number of candidate tenants to process.")
-@click.option("--batch-size", type=int, default=500, show_default=True, help="Progress reporting batch size.")
-@click.option("--dry-run", is_flag=True, help="Only print candidate tenant count.")
-def backfill_plugin_auto_upgrade(
-    tenant_id: tuple[str, ...],
-    limit: int | None,
-    batch_size: int,
-    dry_run: bool,
-):
-    """
-    Backfill historical auto-upgrade strategies after the category column exists.
-
-    Missing category rows are created from the tenant's tool/default row. Pure default
-    strategies become latest for model plugins and fix-only for all other categories.
-    Tenants with include/exclude plugin IDs are split
-    by installed plugin category using plugin daemon metadata.
-    """
-    start_at = time.perf_counter()
-    candidate_count = len(tenant_id) if tenant_id else _count_auto_upgrade_strategy_tenant_ids(limit)
-    click.echo(click.style(f"Found {candidate_count} candidate tenants.", fg="yellow"))
-
-    if dry_run:
-        elapsed = time.perf_counter() - start_at
-        click.echo(click.style(f"Dry run completed. elapsed={elapsed:.2f}s", fg="green"))
-        return
-
-    tenant_ids = list(tenant_id) if tenant_id else _iter_auto_upgrade_strategy_tenant_ids(limit)
-
-    backfilled_count = 0
-    created_count = 0
-    normalized_count = 0
-    skipped_count = 0
-    failed_count = 0
-    for index, current_tenant_id in enumerate(tenant_ids, start=1):
-        try:
-            result = PluginAutoUpgradeService.backfill_strategy_categories(
-                current_tenant_id,
-            )
-        except Exception as e:
-            failed_count += 1
-            click.echo(click.style(f"Failed tenant {current_tenant_id}: {str(e)}", fg="red"))
-            continue
-
-        if result.created_count > 0:
-            backfilled_count += 1
-            created_count += result.created_count
-        elif not result.normalized:
-            skipped_count += 1
-        if result.normalized:
-            normalized_count += 1
-
-        if batch_size > 0 and index % batch_size == 0:
-            click.echo(
-                click.style(
-                    f"Processed {index}/{candidate_count} tenants. "
-                    f"backfilled={backfilled_count}, created_rows={created_count}, "
-                    f"normalized={normalized_count}, skipped={skipped_count}, failed={failed_count}, "
-                    f"elapsed={time.perf_counter() - start_at:.2f}s",
-                    fg="yellow",
-                )
-            )
-
-    elapsed = time.perf_counter() - start_at
-    click.echo(
-        click.style(
-            f"Backfill plugin auto-upgrade strategy categories completed. "
-            f"backfilled={backfilled_count}, created_rows={created_count}, "
-            f"normalized={normalized_count}, skipped={skipped_count}, failed={failed_count}, "
-            f"elapsed={elapsed:.2f}s",
-            fg="green",
-        )
-    )
-
-
@click.command("extract-plugins", help="Extract plugins.")
@click.option("--output_file", prompt=True, help="The file to store the extracted plugins.", default="plugins.jsonl")
@click.option("--workers", prompt=True, help="The number of workers to extract plugins.", default=10)
@@ -29,7 +29,6 @@ class RemoteSettingsSourceFactory(PydanticBaseSettingsSource):
    def get_field_value(self, field: FieldInfo, field_name: str) -> tuple[Any, str, bool]:
        raise NotImplementedError

-    @override
    def __call__(self) -> dict[str, Any]:
        current_state = self.current_state
        remote_source_name = current_state.get("REMOTE_SETTINGS_SOURCE_NAME")
@@ -21,13 +21,3 @@ class AgentBackendConfig(BaseSettings):
        description="Scenario used by the fake Agent backend client.",
        default="success",
    )
-
-    AGENT_SHELL_ENABLED: bool = Field(
-        description=(
-            "Inject the dify.shell layer (sandboxed bash workspace) into Agent runs. "
-            "Requires the agent backend to be wired with a shellctl entrypoint; keep it "
-            "off until shellctl is deployed, otherwise every agent run that includes the "
-            "shell layer will fail."
-        ),
-        default=False,
-    )
@@ -949,11 +949,6 @@ class AuthConfig(BaseSettings):
        default=60,
    )

-    DEVICE_FLOW_APPROVE_RATE_LIMIT_PER_HOUR: PositiveInt = Field(
-        description="Max device-flow approve requests per session per hour on /openapi/oauth/device/approve.",
-        default=10,
-    )
-

 class ModerationConfig(BaseSettings):
    """
@@ -81,15 +81,4 @@ default_app_templates: Mapping[AppMode, Mapping] = {
            },
        },
    },
-    # agent default mode (new Agent App type). The runtime model / prompt / tools
-    # come from the bound Agent Soul snapshot, so no model_config is seeded in the
-    # template; create_app still creates a model-less app_model_config row to hold
-    # app-level presentation features (opener, follow-up, citations, ...).
-    AppMode.AGENT: {
-        "app": {
-            "mode": AppMode.AGENT,
-            "enable_site": True,
-            "enable_api": True,
-        },
-    },
 }
@@ -1,40 +1,10 @@
 import json

-from pydantic import BaseModel, Field, JsonValue
-
-HUMAN_INPUT_FORM_INPUT_EXAMPLE = {
-    "decision": "approve",
-    "attachment": {
-        "transfer_method": "local_file",
-        "upload_file_id": "4e0d1b87-52f2-49f6-b8c6-95cd9c954b3e",
-        "type": "document",
-    },
-    "attachments": [
-        {
-            "transfer_method": "local_file",
-            "upload_file_id": "1a77f0df-c0e6-461c-987c-e72526f341ee",
-            "type": "document",
-        },
-        {
-            "transfer_method": "remote_url",
-            "url": "https://example.com/report.pdf",
-            "type": "document",
-        },
-    ],
-}
+from pydantic import BaseModel, JsonValue


 class HumanInputFormSubmitPayload(BaseModel):
-    inputs: dict[str, JsonValue] = Field(
-        description=(
-            "Submitted human input values keyed by output variable name. "
-            "Use a string for paragraph or select input values, a file mapping for file inputs, "
-            "and a list of file mappings for file-list inputs. Local file mappings use "
-            "`transfer_method=local_file` with `upload_file_id`; remote file mappings use "
-            "`transfer_method=remote_url` with `url` or `remote_url`."
-        ),
-        examples=[HUMAN_INPUT_FORM_INPUT_EXAMPLE],
-    )
+    inputs: dict[str, JsonValue]
    action: str


@@ -36,8 +36,6 @@ QueryParamDoc = TypedDict(
    },
 )

-JsonResponseWithStatus = tuple[dict[str, Any], int]
-

 class QueryArgs(Protocol):
    def to_dict(self, flat: bool = True) -> dict[str, str]: ...
@@ -51,9 +51,6 @@ from .agent import roster as agent_roster
 from .app import (
    advanced_prompt_template,
    agent,
-    agent_app_access,
-    agent_app_feature,
-    agent_app_workspace,
    annotation,
    app,
    audio,
@@ -151,9 +148,6 @@ __all__ = [
    "activate",
    "advanced_prompt_template",
    "agent",
-    "agent_app_access",
-    "agent_app_feature",
-    "agent_app_workspace",
    "agent_composer",
    "agent_providers",
    "agent_roster",
@@ -3,13 +3,7 @@ from flask_restx import Resource
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user_id,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from fields.agent_fields import (
    AgentAppComposerResponse,
    AgentComposerCandidatesResponse,
@@ -18,7 +12,7 @@ from fields.agent_fields import (
    WorkflowAgentComposerResponse,
 )
 from libs.helper import dump_response
-from libs.login import login_required
+from libs.login import current_account_with_tenant, login_required
 from models.model import App, AppMode
 from services.agent.composer_service import AgentComposerService
 from services.agent.composer_validator import ComposerConfigValidator
@@ -44,8 +38,8 @@ class WorkflowAgentComposerApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
-    @with_current_tenant_id
-    def get(self, tenant_id: str, app_model: App, node_id: str):
+    def get(self, app_model: App, node_id: str):
+        _, tenant_id = current_account_with_tenant()
        return dump_response(
            WorkflowAgentComposerResponse,
            AgentComposerService.load_workflow_composer(
@@ -64,9 +58,8 @@ class WorkflowAgentComposerApi(Resource):
    @account_initialization_required
    @edit_permission_required
    @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
-    @with_current_user_id
-    @with_current_tenant_id
-    def put(self, tenant_id: str, account_id: str, app_model: App, node_id: str):
+    def put(self, app_model: App, node_id: str):
+        account, tenant_id = current_account_with_tenant()
        payload = ComposerSavePayload.model_validate(console_ns.payload or {})
        return dump_response(
            WorkflowAgentComposerResponse,
@@ -74,7 +67,7 @@ class WorkflowAgentComposerApi(Resource):
                tenant_id=tenant_id,
                app_id=app_model.id,
                node_id=node_id,
-                account_id=account_id,
+                account_id=account.id,
                payload=payload,
            ),
        )
@@ -120,8 +113,8 @@ class WorkflowAgentComposerImpactApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
-    @with_current_tenant_id
-    def post(self, tenant_id: str, app_model: App, node_id: str):
+    def post(self, app_model: App, node_id: str):
+        _, tenant_id = current_account_with_tenant()
        payload = ComposerSavePayload.model_validate(console_ns.payload or {})
        current_snapshot_id = payload.binding.current_snapshot_id if payload.binding else None
        if not current_snapshot_id:
@@ -145,9 +138,8 @@ class WorkflowAgentComposerSaveToRosterApi(Resource):
    @account_initialization_required
    @edit_permission_required
    @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, account_id: str, app_model: App, node_id: str):
+    def post(self, app_model: App, node_id: str):
+        account, tenant_id = current_account_with_tenant()
        payload = ComposerSavePayload.model_validate(console_ns.payload or {})
        return dump_response(
            WorkflowAgentComposerResponse,
@@ -155,7 +147,7 @@ class WorkflowAgentComposerSaveToRosterApi(Resource):
                tenant_id=tenant_id,
                app_id=app_model.id,
                node_id=node_id,
-                account_id=account_id,
+                account_id=account.id,
                payload=payload,
            ),
        )
@@ -168,8 +160,8 @@ class AgentAppComposerApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model()
-    @with_current_tenant_id
-    def get(self, tenant_id: str, app_model: App):
+    def get(self, app_model: App):
+        _, tenant_id = current_account_with_tenant()
        return dump_response(
            AgentAppComposerResponse,
            AgentComposerService.load_agent_app_composer(tenant_id=tenant_id, app_id=app_model.id),
@@ -182,16 +174,15 @@ class AgentAppComposerApi(Resource):
    @account_initialization_required
    @edit_permission_required
    @get_app_model()
-    @with_current_user_id
-    @with_current_tenant_id
-    def put(self, tenant_id: str, account_id: str, app_model: App):
+    def put(self, app_model: App):
+        account, tenant_id = current_account_with_tenant()
        payload = ComposerSavePayload.model_validate(console_ns.payload or {})
        return dump_response(
            AgentAppComposerResponse,
            AgentComposerService.save_agent_app_composer(
                tenant_id=tenant_id,
                app_id=app_model.id,
-                account_id=account_id,
+                account_id=account.id,
                payload=payload,
            ),
        )
@@ -6,13 +6,7 @@ from pydantic import BaseModel, Field

 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user_id,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from extensions.ext_database import db
 from fields.agent_fields import (
    AgentConfigSnapshotDetailResponse,
@@ -22,7 +16,7 @@ from fields.agent_fields import (
    AgentRosterResponse,
 )
 from libs.helper import dump_response
-from libs.login import login_required
+from libs.login import current_account_with_tenant, login_required
 from services.agent.roster_service import AgentRosterService
 from services.entities.agent_entities import RosterAgentCreatePayload, RosterAgentUpdatePayload, RosterListQuery

@@ -64,8 +58,8 @@ class AgentRosterListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str):
+    def get(self):
+        _, tenant_id = current_account_with_tenant()
        query = RosterListQuery.model_validate(request.args.to_dict(flat=True))
        return dump_response(
            AgentRosterListResponse,
@@ -80,12 +74,11 @@ class AgentRosterListApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, account_id: str):
+    def post(self):
+        account, tenant_id = current_account_with_tenant()
        payload = RosterAgentCreatePayload.model_validate(console_ns.payload or {})
        service = _agent_roster_service()
-        agent = service.create_roster_agent(tenant_id=tenant_id, account_id=account_id, payload=payload)
+        agent = service.create_roster_agent(tenant_id=tenant_id, account_id=account.id, payload=payload)
        return dump_response(
            AgentRosterResponse,
            service.get_roster_agent_detail(tenant_id=tenant_id, agent_id=agent.id),
@@ -99,8 +92,8 @@ class AgentInviteOptionsApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str):
+    def get(self):
+        _, tenant_id = current_account_with_tenant()
        query = AgentInviteOptionsQuery.model_validate(request.args.to_dict(flat=True))
        return dump_response(
            AgentInviteOptionsResponse,
@@ -120,8 +113,8 @@ class AgentRosterDetailApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str, agent_id: UUID):
+    def get(self, agent_id: UUID):
+        _, tenant_id = current_account_with_tenant()
        return dump_response(
            AgentRosterResponse,
            _agent_roster_service().get_roster_agent_detail(tenant_id=tenant_id, agent_id=str(agent_id)),
@@ -133,14 +126,13 @@ class AgentRosterDetailApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def patch(self, tenant_id: str, account_id: str, agent_id: UUID):
+    def patch(self, agent_id: UUID):
+        account, tenant_id = current_account_with_tenant()
        payload = RosterAgentUpdatePayload.model_validate(console_ns.payload or {})
        return dump_response(
            AgentRosterResponse,
            _agent_roster_service().update_roster_agent(
-                tenant_id=tenant_id, agent_id=str(agent_id), account_id=account_id, payload=payload
+                tenant_id=tenant_id, agent_id=str(agent_id), account_id=account.id, payload=payload
            ),
        )

@@ -149,10 +141,9 @@ class AgentRosterDetailApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def delete(self, tenant_id: str, account_id: str, agent_id: UUID):
-        _agent_roster_service().archive_roster_agent(tenant_id=tenant_id, agent_id=str(agent_id), account_id=account_id)
+    def delete(self, agent_id: UUID):
+        account, tenant_id = current_account_with_tenant()
+        _agent_roster_service().archive_roster_agent(tenant_id=tenant_id, agent_id=str(agent_id), account_id=account.id)
        return "", 204


@@ -162,8 +153,8 @@ class AgentRosterVersionsApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str, agent_id: UUID):
+    def get(self, agent_id: UUID):
+        _, tenant_id = current_account_with_tenant()
        return dump_response(
            AgentConfigSnapshotListResponse,
            {"data": _agent_roster_service().list_agent_versions(tenant_id=tenant_id, agent_id=str(agent_id))},
@@ -176,8 +167,8 @@ class AgentRosterVersionDetailApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str, agent_id: UUID, version_id: UUID):
+    def get(self, agent_id: UUID, version_id: UUID):
+        _, tenant_id = current_account_with_tenant()
        return dump_response(
            AgentConfigSnapshotDetailResponse,
            _agent_roster_service().get_agent_version_detail(
@@ -1,59 +0,0 @@
-"""Agent App access & sharing endpoints (read-only workflow references).
-
-An Agent App is backed by a roster Agent that workflow Agent nodes may also
-reference. This exposes the read-only "Workflow access" surface from the PRD:
-which workflow apps use this Agent, without leaking the workflows' internals.
-"""
-
-from flask_restx import Resource
-from pydantic import Field
-
-from controllers.common.schema import register_response_schema_models
-from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required, with_current_tenant_id
-from extensions.ext_database import db
-from fields.base import ResponseModel
-from libs.login import login_required
-from models.model import App, AppMode
-from services.agent.roster_service import AgentRosterService
-
-
-class AgentReferencingWorkflowResponse(ResponseModel):
-    app_id: str
-    app_name: str
-    app_mode: str
-    workflow_id: str
-    node_ids: list[str] = Field(default_factory=list)
-
-
-class AgentReferencingWorkflowsResponse(ResponseModel):
-    data: list[AgentReferencingWorkflowResponse] = Field(default_factory=list)
-
-
-register_response_schema_models(console_ns, AgentReferencingWorkflowsResponse)
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent-referencing-workflows")
-class AgentAppReferencingWorkflowsResource(Resource):
-    @console_ns.doc("list_agent_app_referencing_workflows")
-    @console_ns.doc(description="List workflow apps that reference this Agent App's bound Agent (read-only)")
-    @console_ns.doc(params={"app_id": "Application ID"})
-    @console_ns.response(
-        200,
-        "Referencing workflows listed successfully",
-        console_ns.models[AgentReferencingWorkflowsResponse.__name__],
-    )
-    @console_ns.response(404, "App not found")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT])
-    @with_current_tenant_id
-    def get(self, tenant_id: str, app_model: App):
-        workflows = AgentRosterService(db.session).list_workflows_referencing_app_agent(
-            tenant_id=tenant_id, app_id=app_model.id
-        )
-        return AgentReferencingWorkflowsResponse(
-            data=[AgentReferencingWorkflowResponse.model_validate(workflow) for workflow in workflows]
-        ).model_dump(mode="json")
@@ -1,93 +0,0 @@
-"""Agent App presentation-feature configuration endpoint.
-
-The new Agent App type keeps model / prompt / tools in its bound Agent Soul, so
-the legacy ``/model-config`` surface (which writes model, prompt and agent tool
-config) is the wrong place to configure its app-level presentation features.
-This endpoint exposes only the PRD "Misc Legacy" feature subset — conversation
-opener, follow-up suggestions, citations, content moderation and speech — and
-persists them onto the app's ``app_model_config`` without touching anything the
-Soul owns.
-"""
-
-from flask_restx import Resource
-from pydantic import BaseModel, Field
-
-from controllers.common.fields import SimpleResultResponse
-from controllers.common.schema import register_response_schema_models, register_schema_models
-from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_user,
-)
-from events.app_event import app_model_config_was_updated
-from libs.helper import dump_response
-from libs.login import login_required
-from models import Account
-from models.agent_config_entities import (
-    AgentFeatureToggleConfig,
-    AgentSensitiveWordAvoidanceFeatureConfig,
-    AgentSuggestedQuestionsAfterAnswerFeatureConfig,
-    AgentTextToSpeechFeatureConfig,
-)
-from models.model import App, AppMode
-from services.agent_app_feature_service import AgentAppFeatureConfigService
-
-
-class AgentAppFeaturesPayload(BaseModel):
-    """Presentation features configurable on an Agent App.
-
-    All fields are optional; an omitted field is reset to its disabled/empty
-    default (the config form sends the full desired feature state on save).
-    """
-
-    opening_statement: str | None = Field(default=None, description="Conversation opener shown before the first turn")
-    suggested_questions: list[str] | None = Field(
-        default=None, description="Preset questions shown alongside the opener"
-    )
-    suggested_questions_after_answer: AgentSuggestedQuestionsAfterAnswerFeatureConfig | None = Field(
-        default=None, description="Follow-up suggestions config, e.g. {'enabled': true}"
-    )
-    speech_to_text: AgentFeatureToggleConfig | None = Field(default=None, description="Speech-to-text config")
-    text_to_speech: AgentTextToSpeechFeatureConfig | None = Field(default=None, description="Text-to-speech config")
-    retriever_resource: AgentFeatureToggleConfig | None = Field(
-        default=None, description="Citations / attributions config, e.g. {'enabled': true}"
-    )
-    sensitive_word_avoidance: AgentSensitiveWordAvoidanceFeatureConfig | None = Field(
-        default=None, description="Content moderation config"
-    )
-
-
-register_schema_models(console_ns, AgentAppFeaturesPayload)
-register_response_schema_models(console_ns, SimpleResultResponse)
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent-features")
-class AgentAppFeatureConfigResource(Resource):
-    @console_ns.doc("update_agent_app_features")
-    @console_ns.doc(description="Update an Agent App's presentation features (opener, follow-up, citations, ...)")
-    @console_ns.doc(params={"app_id": "Application ID"})
-    @console_ns.expect(console_ns.models[AgentAppFeaturesPayload.__name__])
-    @console_ns.response(200, "Features updated successfully", console_ns.models[SimpleResultResponse.__name__])
-    @console_ns.response(400, "Invalid configuration")
-    @console_ns.response(404, "App not found")
-    @setup_required
-    @login_required
-    @edit_permission_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT])
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
-        args = AgentAppFeaturesPayload.model_validate(console_ns.payload or {})
-
-        new_app_model_config = AgentAppFeatureConfigService.update_features(
-            app_model=app_model,
-            account=current_user,
-            config=args.model_dump(exclude_none=True),
-        )
-
-        app_model_config_was_updated.send(app_model, app_model_config=new_app_model_config)
-
-        return dump_response(SimpleResultResponse, {"result": "success"})
@@ -1,319 +0,0 @@
-"""Agent App sandbox file-system inspector (read-only).
-
-Exposes the PRD "rc1-like sandbox file system, downloadable not editable" view
-for an Agent App conversation: list a directory, preview a file, or download a
-file from the conversation's shell-layer workspace. The API never touches
-shellctl directly — it resolves the conversation's sandbox ``session_id`` from
-the stored session snapshot and proxies to the agent backend's read-only
-workspace endpoints.
-"""
-
-from typing import Literal
-from uuid import UUID
-
-from flask import Response
-from flask_restx import Resource, fields
-from pydantic import BaseModel, Field
-
-from clients.agent_backend.errors import AgentBackendHTTPError, AgentBackendTransportError
-from clients.agent_backend.workspace_files_client import WorkspaceDownloadResult
-from controllers.common.schema import (
-    query_params_from_model,
-    query_params_from_request,
-    register_response_schema_models,
-)
-from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
-from fields.base import ResponseModel
-from libs.login import current_account_with_tenant, login_required
-from models.model import App, AppMode
-from services.agent_app_workspace_service import (
-    AgentAppWorkspaceService,
-    AgentWorkspaceInspectorError,
-    WorkflowAgentWorkspaceService,
-)
-
-
-class _WorkspaceFileDownloadField(fields.Raw):
-    __schema_type__ = "string"
-    __schema_format__ = "binary"
-
-
-class AgentWorkspaceListQuery(BaseModel):
-    conversation_id: str = Field(min_length=1, description="Agent App conversation ID")
-    path: str = Field(default=".", description="Directory path relative to the sandbox workspace")
-
-
-class AgentWorkspaceFileQuery(BaseModel):
-    conversation_id: str = Field(min_length=1, description="Agent App conversation ID")
-    path: str = Field(min_length=1, description="File path relative to the sandbox workspace")
-
-
-class WorkflowAgentWorkspaceListQuery(BaseModel):
-    path: str = Field(default=".", description="Directory path relative to the sandbox workspace")
-    node_execution_id: str | None = Field(
-        default=None,
-        description=(
-            "Optional workflow node execution ID. When omitted, the latest active session for the node is used."
-        ),
-    )
-
-
-class WorkflowAgentWorkspaceFileQuery(BaseModel):
-    path: str = Field(min_length=1, description="File path relative to the sandbox workspace")
-    node_execution_id: str | None = Field(
-        default=None,
-        description=(
-            "Optional workflow node execution ID. When omitted, the latest active session for the node is used."
-        ),
-    )
-
-
-class WorkspaceFileEntryResponse(ResponseModel):
-    name: str
-    type: Literal["file", "dir", "symlink"]
-    size: int
-    mtime: int
-
-
-class WorkspaceListResponse(ResponseModel):
-    path: str
-    entries: list[WorkspaceFileEntryResponse] = Field(default_factory=list)
-    truncated: bool = False
-
-
-class WorkspacePreviewResponse(ResponseModel):
-    path: str
-    size: int
-    truncated: bool
-    binary: bool
-    text: str | None = None
-
-
-register_response_schema_models(console_ns, WorkspaceListResponse)
-register_response_schema_models(console_ns, WorkspacePreviewResponse)
-
-
-def _handle(exc: Exception) -> tuple[dict[str, object], int]:
-    if isinstance(exc, AgentWorkspaceInspectorError):
-        return {"code": exc.code, "message": exc.message}, exc.status_code
-    if isinstance(exc, AgentBackendHTTPError):
-        detail = exc.detail
-        if isinstance(detail, dict):
-            return {
-                "code": detail.get("code", "agent_backend_error"),
-                "message": detail.get("message", str(exc)),
-            }, exc.status_code
-        return {"code": "agent_backend_error", "message": str(detail)}, exc.status_code
-    if isinstance(exc, AgentBackendTransportError):
-        return {"code": "agent_backend_unreachable", "message": str(exc)}, 502
-    raise exc
-
-
-def _download_response(result: WorkspaceDownloadResult) -> Response | tuple[dict[str, object], int]:
-    if result.truncated:
-        return {
-            "code": "workspace_file_too_large",
-            "message": (
-                "file exceeds the workspace download limit; use preview for partial text or download a smaller file"
-            ),
-            "size": result.size,
-        }, 413
-    filename = result.path.rsplit("/", 1)[-1] or "download"
-    return Response(
-        result.content,
-        mimetype="application/octet-stream",
-        headers={
-            "Content-Disposition": f'attachment; filename="{filename}"',
-            "Content-Length": str(len(result.content)),
-            "X-Workspace-File-Size": str(result.size),
-        },
-    )
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent-workspace/files")
-class AgentAppWorkspaceListResource(Resource):
-    @console_ns.doc("list_agent_app_workspace_files")
-    @console_ns.doc(description="List a directory in an Agent App conversation's sandbox workspace (read-only)")
-    @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentWorkspaceListQuery)})
-    @console_ns.response(200, "Listing returned", console_ns.models[WorkspaceListResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT])
-    def get(self, app_model: App):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(AgentWorkspaceListQuery)
-        try:
-            result = AgentAppWorkspaceService().list_files(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                conversation_id=query.conversation_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return result.model_dump()
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent-workspace/files/preview")
-class AgentAppWorkspacePreviewResource(Resource):
-    @console_ns.doc("preview_agent_app_workspace_file")
-    @console_ns.doc(description="Preview a text/binary file in an Agent App conversation's sandbox workspace")
-    @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentWorkspaceFileQuery)})
-    @console_ns.response(200, "Preview returned", console_ns.models[WorkspacePreviewResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT])
-    def get(self, app_model: App):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(AgentWorkspaceFileQuery)
-        try:
-            result = AgentAppWorkspaceService().preview(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                conversation_id=query.conversation_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return result.model_dump()
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent-workspace/files/download")
-class AgentAppWorkspaceDownloadResource(Resource):
-    @console_ns.doc("download_agent_app_workspace_file")
-    @console_ns.doc(description="Download a file from an Agent App conversation's sandbox workspace (read-only)")
-    @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentWorkspaceFileQuery)})
-    @console_ns.doc(produces=["application/octet-stream"])
-    @console_ns.response(200, "File bytes", _WorkspaceFileDownloadField)
-    @console_ns.response(413, "File exceeds the workspace download limit")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT])
-    def get(self, app_model: App):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(AgentWorkspaceFileQuery)
-        try:
-            result = AgentAppWorkspaceService().download(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                conversation_id=query.conversation_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return _download_response(result)
-
-
-@console_ns.route(
-    "/apps/<uuid:app_id>/workflow-runs/<uuid:workflow_run_id>/agent-nodes/<string:node_id>/workspace/files"
-)
-class WorkflowAgentWorkspaceListResource(Resource):
-    @console_ns.doc("list_workflow_agent_workspace_files")
-    @console_ns.doc(description="List a directory in a Workflow Agent node's sandbox workspace (read-only)")
-    @console_ns.doc(
-        params={
-            "app_id": "Application ID",
-            "workflow_run_id": "Workflow run ID",
-            "node_id": "Workflow Agent node ID",
-            **query_params_from_model(WorkflowAgentWorkspaceListQuery),
-        }
-    )
-    @console_ns.response(200, "Listing returned", console_ns.models[WorkspaceListResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    def get(self, app_model: App, workflow_run_id: UUID, node_id: str):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(WorkflowAgentWorkspaceListQuery)
-        try:
-            result = WorkflowAgentWorkspaceService().list_files(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                workflow_run_id=str(workflow_run_id),
-                node_id=node_id,
-                node_execution_id=query.node_execution_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return result.model_dump()
-
-
-@console_ns.route(
-    "/apps/<uuid:app_id>/workflow-runs/<uuid:workflow_run_id>/agent-nodes/<string:node_id>/workspace/files/preview"
-)
-class WorkflowAgentWorkspacePreviewResource(Resource):
-    @console_ns.doc("preview_workflow_agent_workspace_file")
-    @console_ns.doc(description="Preview a text/binary file in a Workflow Agent node's sandbox workspace")
-    @console_ns.doc(
-        params={
-            "app_id": "Application ID",
-            "workflow_run_id": "Workflow run ID",
-            "node_id": "Workflow Agent node ID",
-            **query_params_from_model(WorkflowAgentWorkspaceFileQuery),
-        }
-    )
-    @console_ns.response(200, "Preview returned", console_ns.models[WorkspacePreviewResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    def get(self, app_model: App, workflow_run_id: UUID, node_id: str):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(WorkflowAgentWorkspaceFileQuery)
-        try:
-            result = WorkflowAgentWorkspaceService().preview(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                workflow_run_id=str(workflow_run_id),
-                node_id=node_id,
-                node_execution_id=query.node_execution_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return result.model_dump()
-
-
-@console_ns.route(
-    "/apps/<uuid:app_id>/workflow-runs/<uuid:workflow_run_id>/agent-nodes/<string:node_id>/workspace/files/download"
-)
-class WorkflowAgentWorkspaceDownloadResource(Resource):
-    @console_ns.doc("download_workflow_agent_workspace_file")
-    @console_ns.doc(description="Download a file from a Workflow Agent node's sandbox workspace (read-only)")
-    @console_ns.doc(
-        params={
-            "app_id": "Application ID",
-            "workflow_run_id": "Workflow run ID",
-            "node_id": "Workflow Agent node ID",
-            **query_params_from_model(WorkflowAgentWorkspaceFileQuery),
-        }
-    )
-    @console_ns.doc(produces=["application/octet-stream"])
-    @console_ns.response(200, "File bytes", _WorkspaceFileDownloadField)
-    @console_ns.response(413, "File exceeds the workspace download limit")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    def get(self, app_model: App, workflow_run_id: UUID, node_id: str):
-        _, tenant_id = current_account_with_tenant()
-        query = query_params_from_request(WorkflowAgentWorkspaceFileQuery)
-        try:
-            result = WorkflowAgentWorkspaceService().download(
-                tenant_id=tenant_id,
-                app_id=app_model.id,
-                workflow_run_id=str(workflow_run_id),
-                node_id=node_id,
-                node_execution_id=query.node_execution_id,
-                path=query.path,
-            )
-        except Exception as exc:  # normalized to an HTTP response below
-            return _handle(exc)
-        return _download_response(result)
@@ -1,9 +1,8 @@
 import logging
 import re
 import uuid
-from collections.abc import Sequence
 from datetime import datetime
-from typing import Any, Literal, cast
+from typing import Any, Literal

 from flask import request
 from flask_restx import Resource
@@ -15,12 +14,7 @@ from werkzeug.exceptions import BadRequest

 from controllers.common.fields import RedirectUrlResponse, SimpleResultResponse
 from controllers.common.helpers import FileInfo
-from controllers.common.schema import (
-    query_params_from_model,
-    register_enum_models,
-    register_response_schema_models,
-    register_schema_models,
-)
+from controllers.common.schema import register_enum_models, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model, with_session
 from controllers.console.workspace.models import LoadBalancingPayload
@@ -31,9 +25,6 @@ from controllers.console.wraps import (
    enterprise_license_required,
    is_admin_or_owner_required,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-    with_current_user_id,
 )
 from core.ops.ops_trace_manager import OpsTraceManager
 from core.rag.entities import PreProcessingRule, Rule, Segmentation
@@ -42,12 +33,12 @@ from core.trigger.constants import TRIGGER_NODE_TYPES
 from extensions.ext_database import db
 from fields.base import ResponseModel
 from graphon.enums import WorkflowExecutionStatus
-from libs.helper import build_icon_url, dump_response, to_timestamp
-from libs.login import login_required
-from models import Account, App, DatasetPermissionEnum, Workflow
+from libs.helper import build_icon_url, to_timestamp
+from libs.login import current_account_with_tenant, login_required
+from models import App, DatasetPermissionEnum, Workflow
 from models.model import IconType
 from services.app_dsl_service import AppDslService
-from services.app_service import AppListParams, AppListSortBy, AppService, CreateAppParams, StarredAppListParams
+from services.app_service import AppListParams, AppService, CreateAppParams
 from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.dsl_entities import ImportMode, ImportStatus
 from services.entities.knowledge_entities.knowledge_entities import (
@@ -64,27 +55,22 @@ from services.entities.knowledge_entities.knowledge_entities import (
 )
 from services.feature_service import FeatureService

-ALLOW_CREATE_APP_MODES = ["chat", "agent-chat", "agent", "advanced-chat", "workflow", "completion"]
+ALLOW_CREATE_APP_MODES = ["chat", "agent-chat", "advanced-chat", "workflow", "completion"]

 register_enum_models(console_ns, IconType)

 _logger = logging.getLogger(__name__)
 _TAG_IDS_BRACKET_PATTERN = re.compile(r"^tag_ids\[(\d+)\]$")
-_CREATOR_IDS_BRACKET_PATTERN = re.compile(r"^creator_ids\[(\d+)\]$")
-AppListMode = Literal["completion", "chat", "advanced-chat", "workflow", "agent-chat", "agent", "channel", "all"]


-class AppListBaseQuery(BaseModel):
+class AppListQuery(BaseModel):
    page: int = Field(default=1, ge=1, le=99999, description="Page number (1-99999)")
    limit: int = Field(default=20, ge=1, le=100, description="Page size (1-100)")
-    mode: AppListMode = Field(default=cast(AppListMode, "all"), description="App mode filter")
-    sort_by: AppListSortBy = Field(
-        default="last_modified",
-        description="Sort apps by last modified, recently created, or earliest created",
+    mode: Literal["completion", "chat", "advanced-chat", "workflow", "agent-chat", "channel", "all"] = Field(
+        default="all", description="App mode filter"
    )
    name: str | None = Field(default=None, description="Filter by app name")
    tag_ids: list[str] | None = Field(default=None, description="Filter by tag IDs")
-    creator_ids: list[str] | None = Field(default=None, description="Filter by creator account IDs")
    is_created_by_me: bool | None = Field(default=None, description="Filter by creator")

    @field_validator("tag_ids", mode="before")
@@ -105,37 +91,10 @@ class AppListBaseQuery(BaseModel):
        except ValueError as exc:
            raise ValueError("Invalid UUID format in tag_ids.") from exc

-    @field_validator("creator_ids", mode="before")
-    @classmethod
-    def validate_creator_ids(cls, value: list[str] | None) -> list[str] | None:
-        if not value:
-            return None
-
-        if not isinstance(value, list):
-            raise ValueError("Unsupported creator_ids type.")
-
-        items = [str(item).strip() for item in value if item and str(item).strip()]
-        if not items:
-            return None
-
-        try:
-            return [str(uuid.UUID(item)) for item in items]
-        except ValueError as exc:
-            raise ValueError("Invalid UUID format in creator_ids.") from exc
-
-
-class AppListQuery(AppListBaseQuery):
-    pass
-
-
-class StarredAppListQuery(AppListBaseQuery):
-    pass
-

 def _normalize_app_list_query_args(query_args: MultiDict[str, str]) -> dict[str, str | list[str]]:
    normalized: dict[str, str | list[str]] = {}
    indexed_tag_ids: list[tuple[int, str]] = []
-    indexed_creator_ids: list[tuple[int, str]] = []

    for key in query_args:
        match = _TAG_IDS_BRACKET_PATTERN.fullmatch(key)
@@ -143,19 +102,12 @@ def _normalize_app_list_query_args(query_args: MultiDict[str, str]) -> dict[str,
            indexed_tag_ids.extend((int(match.group(1)), value) for value in query_args.getlist(key))
            continue

-        match = _CREATOR_IDS_BRACKET_PATTERN.fullmatch(key)
-        if match:
-            indexed_creator_ids.extend((int(match.group(1)), value) for value in query_args.getlist(key))
-            continue
-
        value = query_args.get(key)
        if value is not None:
            normalized[key] = value

    if indexed_tag_ids:
        normalized["tag_ids"] = [value for _, value in sorted(indexed_tag_ids)]
-    if indexed_creator_ids:
-        normalized["creator_ids"] = [value for _, value in sorted(indexed_creator_ids)]

    return normalized

@@ -163,9 +115,7 @@ def _normalize_app_list_query_args(query_args: MultiDict[str, str]) -> dict[str,
 class CreateAppPayload(BaseModel):
    name: str = Field(..., min_length=1, description="App name")
    description: str | None = Field(default=None, description="App description (max 400 chars)", max_length=400)
-    mode: Literal["chat", "agent-chat", "agent", "advanced-chat", "workflow", "completion"] = Field(
-        ..., description="App mode"
-    )
+    mode: Literal["chat", "agent-chat", "advanced-chat", "workflow", "completion"] = Field(..., description="App mode")
    icon_type: IconType | None = Field(default=None, description="Icon type")
    icon: str | None = Field(default=None, description="Icon")
    icon_background: str | None = Field(default=None, description="Icon background color")
@@ -395,7 +345,6 @@ class AppPartial(ResponseModel):
    create_user_name: str | None = None
    author_name: str | None = None
    has_draft_trigger: bool | None = None
-    is_starred: bool = False

    @computed_field(return_type=str | None)  # type: ignore
    @property
@@ -444,8 +393,6 @@ class AppDetailWithSite(AppDetail):
    max_active_requests: int | None = None
    deleted_tools: list[DeletedTool] = Field(default_factory=list)
    site: Site | None = None
-    # For Agent App type: the roster Agent backing this app (None otherwise).
-    bound_agent_id: str | None = None

    @computed_field(return_type=str | None)  # type: ignore
    @property
@@ -465,54 +412,12 @@ class AppExportResponse(ResponseModel):
    data: str


-def _enrich_app_list_items(session: Session, *, apps: Sequence[App], tenant_id: str) -> None:
-    if FeatureService.get_system_features().webapp_auth.enabled:
-        app_ids = [str(app.id) for app in apps]
-        res = EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id(app_ids=app_ids)
-        if len(res) != len(app_ids):
-            raise BadRequest("Invalid app id in webapp auth")
-
-        for app in apps:
-            if str(app.id) in res:
-                app.access_mode = res[str(app.id)].access_mode
-
-    workflow_capable_app_ids = [str(app.id) for app in apps if app.mode in {"workflow", "advanced-chat"}]
-    draft_trigger_app_ids: set[str] = set()
-    if workflow_capable_app_ids:
-        draft_workflows = (
-            session.execute(
-                select(Workflow).where(
-                    Workflow.version == Workflow.VERSION_DRAFT,
-                    Workflow.app_id.in_(workflow_capable_app_ids),
-                    Workflow.tenant_id == tenant_id,
-                )
-            )
-            .scalars()
-            .all()
-        )
-        trigger_node_types = TRIGGER_NODE_TYPES
-        for workflow in draft_workflows:
-            node_id = None
-            try:
-                for node_id, node_data in workflow.walk_nodes():
-                    if node_data.get("type") in trigger_node_types:
-                        draft_trigger_app_ids.add(str(workflow.app_id))
-                        break
-            except Exception:
-                _logger.exception("error while walking nodes, workflow_id=%s, node_id=%s", workflow.id, node_id)
-                continue
-
-    for app in apps:
-        app.has_draft_trigger = str(app.id) in draft_trigger_app_ids
-
-
 register_enum_models(console_ns, RetrievalMethod, WorkflowExecutionStatus, DatasetPermissionEnum)
 register_response_schema_models(console_ns, RedirectUrlResponse, SimpleResultResponse)

 register_schema_models(
    console_ns,
    AppListQuery,
-    StarredAppListQuery,
    CreateAppPayload,
    UpdateAppPayload,
    CopyAppPayload,
@@ -556,37 +461,74 @@ register_schema_models(
 class AppListApi(Resource):
    @console_ns.doc("list_apps")
    @console_ns.doc(description="Get list of applications with pagination and filtering")
-    @console_ns.doc(params=query_params_from_model(AppListQuery))
+    @console_ns.expect(console_ns.models[AppListQuery.__name__])
    @console_ns.response(200, "Success", console_ns.models[AppPagination.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
    @with_session(write=False)
-    @with_current_user_id
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user_id: str, session: Session):
+    def get(self, session: Session):
        """Get app list"""
+        current_user, current_tenant_id = current_account_with_tenant()
+
        args = AppListQuery.model_validate(_normalize_app_list_query_args(request.args))
        params = AppListParams(
            page=args.page,
            limit=args.limit,
            mode=args.mode,
-            sort_by=args.sort_by,
            name=args.name,
            tag_ids=args.tag_ids,
-            creator_ids=args.creator_ids,
            is_created_by_me=args.is_created_by_me,
        )

        # get app list
        app_service = AppService()
-        app_pagination = app_service.get_paginate_apps(current_user_id, current_tenant_id, params)
+        app_pagination = app_service.get_paginate_apps(current_user.id, current_tenant_id, params)
        if not app_pagination:
            empty = AppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
            return empty.model_dump(mode="json"), 200

-        _enrich_app_list_items(session, apps=app_pagination.items, tenant_id=current_tenant_id)
+        if FeatureService.get_system_features().webapp_auth.enabled:
+            app_ids = [str(app.id) for app in app_pagination.items]
+            res = EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id(app_ids=app_ids)
+            if len(res) != len(app_ids):
+                raise BadRequest("Invalid app id in webapp auth")
+
+            for app in app_pagination.items:
+                if str(app.id) in res:
+                    app.access_mode = res[str(app.id)].access_mode
+
+        workflow_capable_app_ids = [
+            str(app.id) for app in app_pagination.items if app.mode in {"workflow", "advanced-chat"}
+        ]
+        draft_trigger_app_ids: set[str] = set()
+        if workflow_capable_app_ids:
+            draft_workflows = (
+                session.execute(
+                    select(Workflow).where(
+                        Workflow.version == Workflow.VERSION_DRAFT,
+                        Workflow.app_id.in_(workflow_capable_app_ids),
+                        Workflow.tenant_id == current_tenant_id,
+                    )
+                )
+                .scalars()
+                .all()
+            )
+            trigger_node_types = TRIGGER_NODE_TYPES
+            for workflow in draft_workflows:
+                node_id = None
+                try:
+                    for node_id, node_data in workflow.walk_nodes():
+                        if node_data.get("type") in trigger_node_types:
+                            draft_trigger_app_ids.add(str(workflow.app_id))
+                            break
+                except Exception:
+                    _logger.exception("error while walking nodes, workflow_id=%s, node_id=%s", workflow.id, node_id)
+                    continue
+
+        for app in app_pagination.items:
+            app.has_draft_trigger = str(app.id) in draft_trigger_app_ids

        pagination_model = AppPagination.model_validate(app_pagination, from_attributes=True)
        return pagination_model.model_dump(mode="json"), 200
@@ -602,10 +544,9 @@ class AppListApi(Resource):
    @account_initialization_required
    @cloud_edition_billing_resource_check("apps")
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account):
+    def post(self):
        """Create app"""
+        current_user, current_tenant_id = current_account_with_tenant()
        args = CreateAppPayload.model_validate(console_ns.payload)
        params = CreateAppParams(
            name=args.name,
@@ -622,78 +563,6 @@ class AppListApi(Resource):
        return app_detail.model_dump(mode="json"), 201


-@console_ns.route("/apps/starred")
-class StarredAppListApi(Resource):
-    @console_ns.doc("list_starred_apps")
-    @console_ns.doc(description="Get applications starred by the current account")
-    @console_ns.doc(params=query_params_from_model(StarredAppListQuery))
-    @console_ns.response(200, "Success", console_ns.models[AppPagination.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @enterprise_license_required
-    @with_session(write=False)
-    @with_current_user_id
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user_id: str, session: Session):
-        args = StarredAppListQuery.model_validate(_normalize_app_list_query_args(request.args))
-        params = StarredAppListParams(
-            page=args.page,
-            limit=args.limit,
-            mode=args.mode,
-            sort_by=args.sort_by,
-            name=args.name,
-            tag_ids=args.tag_ids,
-            creator_ids=args.creator_ids,
-            is_created_by_me=args.is_created_by_me,
-        )
-
-        app_pagination = AppService().get_paginate_starred_apps(current_user_id, current_tenant_id, params)
-        if not app_pagination:
-            empty = AppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
-            return empty.model_dump(mode="json"), 200
-
-        _enrich_app_list_items(session, apps=app_pagination.items, tenant_id=current_tenant_id)
-
-        pagination_model = AppPagination.model_validate(app_pagination, from_attributes=True)
-        return pagination_model.model_dump(mode="json"), 200
-
-
-@console_ns.route("/apps/<uuid:app_id>/star")
-class AppStarApi(Resource):
-    @console_ns.doc("star_app")
-    @console_ns.doc(description="Star an application for the current account")
-    @console_ns.doc(params={"app_id": "Application ID"})
-    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @console_ns.response(404, "App not found")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @enterprise_license_required
-    @with_current_user_id
-    @with_session
-    @get_app_model(mode=None)
-    def post(self, session: Session, current_user_id: str, app_model: App):
-        AppService.star_app(session, app=app_model, account_id=current_user_id)
-        return dump_response(SimpleResultResponse, {"result": "success"})
-
-    @console_ns.doc("unstar_app")
-    @console_ns.doc(description="Remove the current account's star from an application")
-    @console_ns.doc(params={"app_id": "Application ID"})
-    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @console_ns.response(404, "App not found")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @enterprise_license_required
-    @with_current_user_id
-    @with_session
-    @get_app_model(mode=None)
-    def delete(self, session: Session, current_user_id: str, app_model: App):
-        AppService.unstar_app(session, app=app_model, account_id=current_user_id)
-        return dump_response(SimpleResultResponse, {"result": "success"})
-
-
@console_ns.route("/apps/<uuid:app_id>")
 class AppApi(Resource):
    @console_ns.doc("get_app_detail")
@@ -780,10 +649,11 @@ class AppCopyApi(Resource):
    @account_initialization_required
    @get_app_model(mode=None)
    @edit_permission_required
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
+    def post(self, app_model: App):
        """Copy app"""
        # The role of the current user in the ta table must be admin, owner, or editor
+        current_user, _ = current_account_with_tenant()
+
        args = CopyAppPayload.model_validate(console_ns.payload or {})

        with Session(db.engine, expire_on_commit=False) as session:
@@ -862,8 +732,7 @@ class AppPublishToCreatorsPlatformApi(Resource):
    @account_initialization_required
    @get_app_model(mode=None)
    @edit_permission_required
-    @with_current_user_id
-    def post(self, current_user_id: str, app_model: App):
+    def post(self, app_model: App):
        """Publish app to Creators Platform"""
        from configs import dify_config
        from core.helper.creators import get_redirect_url, upload_dsl
@@ -871,11 +740,13 @@ class AppPublishToCreatorsPlatformApi(Resource):
        if not dify_config.CREATORS_PLATFORM_FEATURES_ENABLED:
            return {"error": "Creators Platform features are not enabled"}, 403

+        current_user, _ = current_account_with_tenant()
+
        dsl_content = AppDslService.export_dsl(app_model=app_model, include_secret=False)
        dsl_bytes = dsl_content.encode("utf-8")

        claim_code = upload_dsl(dsl_bytes)
-        redirect_url = get_redirect_url(current_user_id, claim_code)
+        redirect_url = get_redirect_url(str(current_user.id), claim_code)

        return {"redirect_url": redirect_url}

@@ -4,7 +4,7 @@ from typing import Any, Literal
 from flask import request
 from flask_restx import Resource
 from pydantic import BaseModel, Field, field_validator
-from werkzeug.exceptions import BadRequest, InternalServerError, NotFound
+from werkzeug.exceptions import InternalServerError, NotFound

 import services
 from controllers.common.fields import SimpleResultResponse
@@ -19,13 +19,7 @@ from controllers.console.app.error import (
    ProviderQuotaExceededError,
 )
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_user,
-    with_current_user_id,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from controllers.web.error import InvokeRateLimitError as InvokeRateLimitHttpError
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.errors.error import (
@@ -37,7 +31,7 @@ from core.helper.trace_id_helper import get_external_trace_id
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs import helper
 from libs.helper import uuid_value
-from libs.login import login_required
+from libs.login import current_user, login_required
 from models import Account
 from models.model import App, AppMode
 from services.app_generate_service import AppGenerateService
@@ -47,24 +41,9 @@ from services.errors.llm import InvokeRateLimitError
 logger = logging.getLogger(__name__)


-def _resolve_debugger_chat_streaming(
-    *, app_mode: AppMode, response_mode: str, response_mode_provided: bool = True
-) -> bool:
-    """Agent App runtime is SSE-only until backend blocking runs are supported."""
-    if app_mode != AppMode.AGENT:
-        return response_mode != "blocking"
-    if response_mode_provided and response_mode == "blocking":
-        raise BadRequest("Agent App only supports streaming response mode.")
-    return True
-
-
 class BaseMessagePayload(BaseModel):
    inputs: dict[str, Any]
-    # Agent Apps (AppMode.AGENT) derive their model + prompt from the bound Agent
-    # Soul, so no override ``model_config`` is sent; chat / agent-chat / completion
-    # debugging still pass it. Optional here, required in practice by those modes
-    # downstream when their config is built from args.
-    model_config_data: dict[str, Any] = Field(default_factory=dict, alias="model_config")
+    model_config_data: dict[str, Any] = Field(..., alias="model_config")
    files: list[Any] | None = Field(default=None, description="Uploaded files")
    response_mode: Literal["blocking", "streaming"] = Field(default="blocking", description="Response mode")
    retriever_from: str = Field(default="dev", description="Retriever source")
@@ -105,8 +84,7 @@ class CompletionMessageApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model(mode=AppMode.COMPLETION)
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
+    def post(self, app_model: App):
        args_model = CompletionMessagePayload.model_validate(console_ns.payload)
        args = args_model.model_dump(exclude_none=True, by_alias=True)

@@ -114,6 +92,8 @@ class CompletionMessageApi(Resource):
        args["auto_generate_name"] = False

        try:
+            if not isinstance(current_user, Account):
+                raise ValueError("current_user must be an Account or EndUser instance")
            response = AppGenerateService.generate(
                app_model=app_model, user=current_user, args=args, invoke_from=InvokeFrom.DEBUGGER, streaming=streaming
            )
@@ -151,13 +131,14 @@ class CompletionMessageStopApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model(mode=AppMode.COMPLETION)
-    @with_current_user_id
-    def post(self, current_user_id: str, app_model: App, task_id: str):
+    def post(self, app_model: App, task_id: str):
+        if not isinstance(current_user, Account):
+            raise ValueError("current_user must be an Account instance")

        AppTaskService.stop_task(
            task_id=task_id,
            invoke_from=InvokeFrom.DEBUGGER,
-            user_id=current_user_id,
+            user_id=current_user.id,
            app_mode=AppMode.value_of(app_model.mode),
        )

@@ -176,21 +157,13 @@ class ChatMessageApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT])
    @edit_permission_required
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
-        raw_payload = console_ns.payload or {}
-        args_model = ChatMessagePayload.model_validate(raw_payload)
+    def post(self, app_model: App):
+        args_model = ChatMessagePayload.model_validate(console_ns.payload)
        args = args_model.model_dump(exclude_none=True, by_alias=True)

-        streaming = _resolve_debugger_chat_streaming(
-            app_mode=AppMode.value_of(app_model.mode),
-            response_mode=args_model.response_mode,
-            response_mode_provided=isinstance(raw_payload, dict) and "response_mode" in raw_payload,
-        )
-        if AppMode.value_of(app_model.mode) == AppMode.AGENT:
-            args["response_mode"] = "streaming"
+        streaming = args_model.response_mode != "blocking"
        args["auto_generate_name"] = False

        external_trace_id = get_external_trace_id(request)
@@ -198,6 +171,8 @@ class ChatMessageApi(Resource):
            args["external_trace_id"] = external_trace_id

        try:
+            if not isinstance(current_user, Account):
+                raise ValueError("current_user must be an Account or EndUser instance")
            response = AppGenerateService.generate(
                app_model=app_model, user=current_user, args=args, invoke_from=InvokeFrom.DEBUGGER, streaming=streaming
            )
@@ -236,14 +211,15 @@ class ChatMessageStopApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
-    @with_current_user_id
-    def post(self, current_user_id: str, app_model: App, task_id: str):
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
+    def post(self, app_model: App, task_id: str):
+        if not isinstance(current_user, Account):
+            raise ValueError("current_user must be an Account instance")

        AppTaskService.stop_task(
            task_id=task_id,
            invoke_from=InvokeFrom.DEBUGGER,
-            user_id=current_user_id,
+            user_id=current_user.id,
            app_mode=AppMode.value_of(app_model.mode),
        )

@@ -212,7 +212,7 @@ class ChatConversationApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @edit_permission_required
    @with_current_user
    def get(self, current_user: Account, app_model: App):
@@ -323,7 +323,7 @@ class ChatConversationDetailApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @edit_permission_required
    @with_current_user
    def get(self, current_user: Account, app_model: App, conversation_id: UUID):
@@ -340,7 +340,7 @@ class ChatConversationDetailApi(Resource):
    @console_ns.response(404, "Conversation not found")
    @setup_required
    @login_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @account_initialization_required
    @edit_permission_required
    @with_current_user
@@ -1,5 +1,4 @@
 from collections.abc import Sequence
-from typing import Literal

 from flask_restx import Resource
 from pydantic import BaseModel, Field
@@ -26,7 +25,6 @@ from graphon.model_runtime.entities.llm_entities import LLMMode
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs.login import login_required
 from models import App
-from services.workflow_generator_service import WorkflowGeneratorService
 from services.workflow_service import WorkflowService


@@ -44,24 +42,6 @@ class InstructionTemplatePayload(BaseModel):
    type: str = Field(..., description="Instruction template type")


-class WorkflowGeneratePayload(BaseModel):
-    """Payload for the cmd+k `/create` and `/refine` workflow generator endpoint.
-
-    See ``services/workflow_generator_service.py`` for behaviour. Errors are
-    surfaced through the same envelope as ``/rule-generate`` so the frontend
-    can reuse its existing handler.
-    """
-
-    mode: Literal["workflow", "advanced-chat"] = Field(..., description="Target app mode for the generated graph")
-    instruction: str = Field(..., description="Natural-language workflow description")
-    ideal_output: str = Field(default="", description="Optional sample output for grounding")
-    model_config_data: ModelConfig = Field(..., alias="model_config", description="Model configuration")
-    current_graph: dict | None = Field(
-        default=None,
-        description="Existing draft graph to refine (cmd+k `/refine`); omit for create-from-scratch",
-    )
-
-
 register_enum_models(console_ns, LLMMode)
 register_schema_models(
    console_ns,
@@ -70,7 +50,6 @@ register_schema_models(
    RuleStructuredOutputPayload,
    InstructionGeneratePayload,
    InstructionTemplatePayload,
-    WorkflowGeneratePayload,
    ModelConfig,
 )

@@ -286,56 +265,3 @@ class InstructionGenerationTemplateApi(Resource):
                return {"data": INSTRUCTION_GENERATE_TEMPLATE_CODE}
            case _:
                raise ValueError(f"Invalid type: {args.type}")
-
-
-@console_ns.route("/workflow-generate")
-class WorkflowGenerateApi(Resource):
-    """Generate a Workflow / Chatflow draft graph from a natural-language description.
-
-    Triggered by the cmd+k `/create` slash command. Returns a graph payload
-    shaped exactly like ``WorkflowService.sync_draft_workflow``'s input, so the
-    frontend can hand it straight to ``/apps/{id}/workflows/draft``.
-    """
-
-    @console_ns.doc("generate_workflow_graph")
-    @console_ns.doc(description="Generate a Dify workflow graph from natural language")
-    @console_ns.expect(console_ns.models[WorkflowGeneratePayload.__name__])
-    @console_ns.response(200, "Workflow graph generated successfully")
-    @console_ns.response(400, "Invalid request parameters")
-    @console_ns.response(402, "Provider quota exceeded")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str):
-        args = WorkflowGeneratePayload.model_validate(console_ns.payload)
-
-        # Reject obviously-empty instructions at the boundary — Pydantic only
-        # validates ``instruction`` is a str, but a whitespace-only string
-        # would still hit the LLM and waste a planner+builder roundtrip on a
-        # response that the postprocess validator would reject anyway.
-        if not args.instruction.strip():
-            return {
-                "error": "Instruction is required",
-                "errors": [{"code": "EMPTY_INSTRUCTION", "detail": "Instruction is required"}],
-            }, 400
-
-        try:
-            result = WorkflowGeneratorService.generate_workflow_graph(
-                tenant_id=current_tenant_id,
-                mode=args.mode,
-                instruction=args.instruction,
-                model_config=args.model_config_data,
-                ideal_output=args.ideal_output,
-                current_graph=args.current_graph,
-            )
-        except ProviderTokenNotInitError as ex:
-            raise ProviderNotInitializeError(ex.description)
-        except QuotaExceededError:
-            raise ProviderQuotaExceededError()
-        except ModelCurrentlyNotSupportError:
-            raise ProviderModelCurrentlyNotSupportError()
-        except InvokeError as e:
-            raise CompletionRequestError(e.description)
-
-        return result
@@ -180,7 +180,7 @@ class ChatMessageListApi(Resource):
    @login_required
    @account_initialization_required
    @setup_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @edit_permission_required
    def get(self, app_model: App):
        args = ChatMessagesQuery.model_validate(request.args.to_dict())
@@ -337,7 +337,7 @@ class MessageSuggestedQuestionApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @with_current_user
    def get(self, current_user: Account, app_model: App, message_id: UUID):
        message_id_str = str(message_id)
@@ -8,20 +8,14 @@ from pydantic import BaseModel, Field
 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user_id,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from core.agent.entities import AgentToolEntity
 from core.tools.tool_manager import ToolManager
 from core.tools.utils.configuration import ToolParameterConfigurationManager
 from events.app_event import app_model_config_was_updated
 from extensions.ext_database import db
 from libs.datetime_utils import naive_utc_now
-from libs.login import login_required
+from libs.login import current_account_with_tenant, login_required
 from models.model import App, AppMode, AppModelConfig
 from services.app_model_config_service import AppModelConfigService

@@ -58,10 +52,9 @@ class ModelConfigResource(Resource):
    @edit_permission_required
    @account_initialization_required
    @get_app_model(mode=[AppMode.AGENT_CHAT, AppMode.CHAT, AppMode.COMPLETION])
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user_id: str, app_model: App):
+    def post(self, app_model: App):
        """Modify app model config"""
+        current_user, current_tenant_id = current_account_with_tenant()
        # validate config
        model_configuration = AppModelConfigService.validate_configuration(
            tenant_id=current_tenant_id,
@@ -71,8 +64,8 @@ class ModelConfigResource(Resource):

        new_app_model_config = AppModelConfig(
            app_id=app_model.id,
-            created_by=current_user_id,
-            updated_by=current_user_id,
+            created_by=current_user.id,
+            updated_by=current_user.id,
        )
        new_app_model_config = new_app_model_config.from_model_config_dict(model_configuration)

@@ -97,7 +90,7 @@ class ModelConfigResource(Resource):
                        tenant_id=current_tenant_id,
                        app_id=app_model.id,
                        agent_tool=agent_tool_entity,
-                        user_id=current_user_id,
+                        user_id=current_user.id,
                    )
                    manager = ToolParameterConfigurationManager(
                        tenant_id=current_tenant_id,
@@ -137,7 +130,7 @@ class ModelConfigResource(Resource):
                            tenant_id=current_tenant_id,
                            app_id=app_model.id,
                            agent_tool=agent_tool_entity,
-                            user_id=current_user_id,
+                            user_id=current_user.id,
                        )
                    except Exception:
                        continue
@@ -174,7 +167,7 @@ class ModelConfigResource(Resource):
        db.session.flush()

        app_model.app_model_config_id = new_app_model_config.id
-        app_model.updated_by = current_user_id
+        app_model.updated_by = current_user.id
        app_model.updated_at = naive_utc_now()
        db.session.commit()

@@ -290,7 +290,7 @@ class AverageSessionInteractionStatistic(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT])
    @with_current_user
    def get(self, account: Account, app_model: App):
        args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
@@ -7,18 +7,12 @@ from pydantic import BaseModel, Field, TypeAdapter, computed_field, field_valida
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from fields.base import ResponseModel
 from fields.member_fields import AccountWithRole
 from libs.helper import build_avatar_url, dump_response, to_timestamp
-from libs.login import login_required
-from models import Account, App
+from libs.login import current_user, login_required
+from models import App
 from services.account_service import TenantService
 from services.workflow_comment_service import WorkflowCommentService

@@ -219,10 +213,9 @@ class WorkflowCommentListApi(Resource):
    @setup_required
    @account_initialization_required
    @get_app_model()
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, app_model: App):
+    def get(self, app_model: App):
        """Get all comments for a workflow."""
-        comments = WorkflowCommentService.get_comments(tenant_id=current_tenant_id, app_id=app_model.id)
+        comments = WorkflowCommentService.get_comments(tenant_id=current_user.current_tenant_id, app_id=app_model.id)

        return WorkflowCommentBasicList.model_validate({"data": comments}).model_dump(mode="json")

@@ -236,14 +229,12 @@ class WorkflowCommentListApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, app_model: App):
+    def post(self, app_model: App):
        """Create a new workflow comment."""
        payload = WorkflowCommentCreatePayload.model_validate(console_ns.payload or {})

        result = WorkflowCommentService.create_comment(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            created_by=current_user.id,
            content=payload.content,
@@ -267,11 +258,10 @@ class WorkflowCommentDetailApi(Resource):
    @setup_required
    @account_initialization_required
    @get_app_model()
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, app_model: App, comment_id: str):
+    def get(self, app_model: App, comment_id: str):
        """Get a specific workflow comment."""
        comment = WorkflowCommentService.get_comment(
-            tenant_id=current_tenant_id, app_id=app_model.id, comment_id=comment_id
+            tenant_id=current_user.current_tenant_id, app_id=app_model.id, comment_id=comment_id
        )

        return dump_response(WorkflowCommentDetail, comment)
@@ -286,14 +276,12 @@ class WorkflowCommentDetailApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def put(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
+    def put(self, app_model: App, comment_id: str):
        """Update a workflow comment."""
        payload = WorkflowCommentUpdatePayload.model_validate(console_ns.payload or {})

        result = WorkflowCommentService.update_comment(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            comment_id=comment_id,
            user_id=current_user.id,
@@ -314,12 +302,10 @@ class WorkflowCommentDetailApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
+    def delete(self, app_model: App, comment_id: str):
        """Delete a workflow comment."""
        WorkflowCommentService.delete_comment(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            comment_id=comment_id,
            user_id=current_user.id,
@@ -341,12 +327,10 @@ class WorkflowCommentResolveApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
+    def post(self, app_model: App, comment_id: str):
        """Resolve a workflow comment."""
        comment = WorkflowCommentService.resolve_comment(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            comment_id=comment_id,
            user_id=current_user.id,
@@ -369,13 +353,11 @@ class WorkflowCommentReplyApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
+    def post(self, app_model: App, comment_id: str):
        """Add a reply to a workflow comment."""
        # Validate comment access first
        WorkflowCommentService.validate_comment_access(
-            comment_id=comment_id, tenant_id=current_tenant_id, app_id=app_model.id
+            comment_id=comment_id, tenant_id=current_user.current_tenant_id, app_id=app_model.id
        )

        payload = WorkflowCommentReplyPayload.model_validate(console_ns.payload or {})
@@ -404,19 +386,17 @@ class WorkflowCommentReplyDetailApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def put(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str, reply_id: str):
+    def put(self, app_model: App, comment_id: str, reply_id: str):
        """Update a comment reply."""
        # Validate comment access first
        WorkflowCommentService.validate_comment_access(
-            comment_id=comment_id, tenant_id=current_tenant_id, app_id=app_model.id
+            comment_id=comment_id, tenant_id=current_user.current_tenant_id, app_id=app_model.id
        )

        payload = WorkflowCommentReplyPayload.model_validate(console_ns.payload or {})

        reply = WorkflowCommentService.update_reply(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            comment_id=comment_id,
            reply_id=reply_id,
@@ -436,17 +416,15 @@ class WorkflowCommentReplyDetailApi(Resource):
    @account_initialization_required
    @get_app_model()
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str, reply_id: str):
+    def delete(self, app_model: App, comment_id: str, reply_id: str):
        """Delete a comment reply."""
        # Validate comment access first
        WorkflowCommentService.validate_comment_access(
-            comment_id=comment_id, tenant_id=current_tenant_id, app_id=app_model.id
+            comment_id=comment_id, tenant_id=current_user.current_tenant_id, app_id=app_model.id
        )

        WorkflowCommentService.delete_reply(
-            tenant_id=current_tenant_id,
+            tenant_id=current_user.current_tenant_id,
            app_id=app_model.id,
            comment_id=comment_id,
            reply_id=reply_id,
@@ -470,13 +448,9 @@ class WorkflowCommentMentionUsersApi(Resource):
    @setup_required
    @account_initialization_required
    @get_app_model()
-    @with_current_user
-    def get(self, current_user: Account, app_model: App):
+    def get(self, app_model: App):
        """Get all users in current tenant for mentions."""
-        current_tenant = current_user.current_tenant  # need the tenant object here
-        if current_tenant is None:
-            raise ValueError("current tenant is required")
-        members = TenantService.get_tenant_members(current_tenant)
+        members = TenantService.get_tenant_members(current_user.current_tenant)
        users = TypeAdapter(list[AccountWithRole]).validate_python(members, from_attributes=True)
        response = WorkflowCommentMentionUsersPayload(users=users)
        return response.model_dump(mode="json"), 200
@@ -1,7 +1,7 @@
 import logging
 from collections.abc import Callable
 from functools import wraps
-from typing import Any, Concatenate, TypedDict
+from typing import Any, TypedDict
 from uuid import UUID

 from flask import Response, request
@@ -15,12 +15,7 @@ from controllers.console.app.error import (
    DraftWorkflowNotExist,
 )
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from controllers.web.error import InvalidArgumentError, NotFoundError
 from core.app.file_access import DatabaseFileAccessController
 from core.workflow.variable_prefixes import CONVERSATION_VARIABLE_NODE_ID, SYSTEM_VARIABLE_NODE_ID
@@ -32,8 +27,8 @@ from graphon.file import helpers as file_helpers
 from graphon.variables.segment_group import SegmentGroup
 from graphon.variables.segments import ArrayFileSegment, FileSegment, Segment
 from graphon.variables.types import SegmentType
-from libs.login import login_required
-from models import Account, App, AppMode
+from libs.login import current_user, login_required
+from models import App, AppMode
 from models.workflow import WorkflowDraftVariable
 from services.workflow_draft_variable_service import WorkflowDraftVariableList, WorkflowDraftVariableService
 from services.workflow_service import WorkflowService
@@ -128,15 +123,14 @@ def _serialize_full_content(variable: WorkflowDraftVariable) -> FullContentDict
    return result


-def ensure_variable_access(
+def _ensure_variable_access(
    variable: WorkflowDraftVariable | None,
    app_id: str,
    variable_id: str,
-    current_user_id: str,
 ) -> WorkflowDraftVariable:
    if variable is None:
        raise NotFoundError(description=f"variable not found, id={variable_id}")
-    if variable.app_id != app_id or variable.user_id != current_user_id:
+    if variable.app_id != app_id or variable.user_id != current_user.id:
        raise NotFoundError(description=f"variable not found, id={variable_id}")
    return variable

@@ -220,9 +214,7 @@ workflow_draft_variable_list_model = console_ns.model(
 )


-def _api_prerequisite[T, **P, R](
-    f: Callable[Concatenate[T, Account, P], R],
-) -> Callable[Concatenate[T, P], R | Response]:
+def _api_prerequisite[**P, R](f: Callable[P, R]) -> Callable[P, R | Response]:
    """Common prerequisites for all draft workflow variable APIs.

    It ensures the following conditions are satisfied:
@@ -238,10 +230,9 @@ def _api_prerequisite[T, **P, R](
    @account_initialization_required
    @edit_permission_required
    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    @with_current_user
    @wraps(f)
-    def wrapper(self: T, current_user: Account, *args: P.args, **kwargs: P.kwargs) -> R | Response:
-        return f(self, current_user, *args, **kwargs)
+    def wrapper(*args: P.args, **kwargs: P.kwargs) -> R | Response:
+        return f(*args, **kwargs)

    return wrapper

@@ -258,7 +249,7 @@ class WorkflowVariableCollectionApi(Resource):
    )
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_without_value_model)
-    def get(self, current_user: Account, app_model: App):
+    def get(self, app_model: App):
        """
        Get draft workflow
        """
@@ -288,7 +279,7 @@ class WorkflowVariableCollectionApi(Resource):
    @console_ns.doc(description="Delete all draft workflow variables")
    @console_ns.response(204, "Workflow variables deleted successfully")
    @_api_prerequisite
-    def delete(self, current_user: Account, app_model: App):
+    def delete(self, app_model: App):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -322,7 +313,7 @@ class NodeVariableCollectionApi(Resource):
    @console_ns.response(200, "Node variables retrieved successfully", workflow_draft_variable_list_model)
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, app_model: App, node_id: str):
+    def get(self, app_model: App, node_id: str):
        validate_node_id(node_id)
        with sessionmaker(bind=db.engine, expire_on_commit=False).begin() as session:
            draft_var_srv = WorkflowDraftVariableService(
@@ -336,7 +327,7 @@ class NodeVariableCollectionApi(Resource):
    @console_ns.doc(description="Delete all variables for a specific node")
    @console_ns.response(204, "Node variables deleted successfully")
    @_api_prerequisite
-    def delete(self, current_user: Account, app_model: App, node_id: str):
+    def delete(self, app_model: App, node_id: str):
        validate_node_id(node_id)
        srv = WorkflowDraftVariableService(db.session())
        srv.delete_node_variables(app_model.id, node_id, user_id=current_user.id)
@@ -356,16 +347,15 @@ class VariableApi(Resource):
    @console_ns.response(404, "Variable not found")
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_model)
-    def get(self, current_user: Account, app_model: App, variable_id: UUID):
+    def get(self, app_model: App, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
        variable_id_str = str(variable_id)
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id_str),
            app_id=app_model.id,
            variable_id=variable_id_str,
-            current_user_id=current_user.id,
        )
        return variable

@@ -376,7 +366,7 @@ class VariableApi(Resource):
    @console_ns.response(404, "Variable not found")
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_model)
-    def patch(self, current_user: Account, app_model: App, variable_id: UUID):
+    def patch(self, app_model: App, variable_id: UUID):
        # Request payload for file types:
        #
        # Local File:
@@ -404,11 +394,10 @@ class VariableApi(Resource):
        args_model = WorkflowDraftVariableUpdatePayload.model_validate(console_ns.payload or {})

        variable_id_str = str(variable_id)
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id_str),
            app_id=app_model.id,
            variable_id=variable_id_str,
-            current_user_id=current_user.id,
        )

        new_name = args_model.name
@@ -449,16 +438,15 @@ class VariableApi(Resource):
    @console_ns.response(204, "Variable deleted successfully")
    @console_ns.response(404, "Variable not found")
    @_api_prerequisite
-    def delete(self, current_user: Account, app_model: App, variable_id: UUID):
+    def delete(self, app_model: App, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
        variable_id_str = str(variable_id)
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id_str),
            app_id=app_model.id,
            variable_id=variable_id_str,
-            current_user_id=current_user.id,
        )
        draft_var_srv.delete_variable(variable)
        db.session.commit()
@@ -474,7 +462,7 @@ class VariableResetApi(Resource):
    @console_ns.response(204, "Variable reset (no content)")
    @console_ns.response(404, "Variable not found")
    @_api_prerequisite
-    def put(self, current_user: Account, app_model: App, variable_id: UUID):
+    def put(self, app_model: App, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -486,11 +474,10 @@ class VariableResetApi(Resource):
                f"Draft workflow not found, app_id={app_model.id}",
            )
        variable_id_str = str(variable_id)
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id_str),
            app_id=app_model.id,
            variable_id=variable_id_str,
-            current_user_id=current_user.id,
        )

        resetted = draft_var_srv.reset_variable(draft_workflow, variable)
@@ -501,20 +488,20 @@ class VariableResetApi(Resource):
            return marshal(resetted, workflow_draft_variable_model)


-def _get_variable_list(app_model: App, node_id: str, current_user_id: str) -> WorkflowDraftVariableList:
+def _get_variable_list(app_model: App, node_id) -> WorkflowDraftVariableList:
    with sessionmaker(bind=db.engine, expire_on_commit=False).begin() as session:
        draft_var_srv = WorkflowDraftVariableService(
            session=session,
        )
        if node_id == CONVERSATION_VARIABLE_NODE_ID:
-            draft_vars = draft_var_srv.list_conversation_variables(app_model.id, user_id=current_user_id)
+            draft_vars = draft_var_srv.list_conversation_variables(app_model.id, user_id=current_user.id)
        elif node_id == SYSTEM_VARIABLE_NODE_ID:
-            draft_vars = draft_var_srv.list_system_variables(app_model.id, user_id=current_user_id)
+            draft_vars = draft_var_srv.list_system_variables(app_model.id, user_id=current_user.id)
        else:
            draft_vars = draft_var_srv.list_node_variables(
                app_id=app_model.id,
                node_id=node_id,
-                user_id=current_user_id,
+                user_id=current_user.id,
            )
    return draft_vars

@@ -528,7 +515,7 @@ class ConversationVariableCollectionApi(Resource):
    @console_ns.response(404, "Draft workflow not found")
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, app_model: App):
+    def get(self, app_model: App):
        # NOTE(QuantumGhost): Prefill conversation variables into the draft variables table
        # so their IDs can be returned to the caller.
        workflow_srv = WorkflowService()
@@ -538,7 +525,7 @@ class ConversationVariableCollectionApi(Resource):
        draft_var_srv = WorkflowDraftVariableService(db.session())
        draft_var_srv.prefill_conversation_variable_default_values(draft_workflow, user_id=current_user.id)
        db.session.commit()
-        return _get_variable_list(app_model, CONVERSATION_VARIABLE_NODE_ID, current_user.id)
+        return _get_variable_list(app_model, CONVERSATION_VARIABLE_NODE_ID)

    @console_ns.expect(console_ns.models[ConversationVariableUpdatePayload.__name__])
    @console_ns.doc("update_conversation_variables")
@@ -550,8 +537,7 @@ class ConversationVariableCollectionApi(Resource):
    @account_initialization_required
    @edit_permission_required
    @get_app_model(mode=AppMode.ADVANCED_CHAT)
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
+    def post(self, app_model: App):
        payload = ConversationVariableUpdatePayload.model_validate(console_ns.payload or {})

        workflow_service = WorkflowService()
@@ -578,8 +564,8 @@ class SystemVariableCollectionApi(Resource):
    @console_ns.response(200, "System variables retrieved successfully", workflow_draft_variable_list_model)
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, app_model: App):
-        return _get_variable_list(app_model, SYSTEM_VARIABLE_NODE_ID, current_user.id)
+    def get(self, app_model: App):
+        return _get_variable_list(app_model, SYSTEM_VARIABLE_NODE_ID)


@console_ns.route("/apps/<uuid:app_id>/workflows/draft/environment-variables")
@@ -590,7 +576,7 @@ class EnvironmentVariableCollectionApi(Resource):
    @console_ns.response(200, "Environment variables retrieved successfully")
    @console_ns.response(404, "Draft workflow not found")
    @_api_prerequisite
-    def get(self, _current_user: Account, app_model: App):
+    def get(self, app_model: App):
        """
        Get draft workflow
        """
@@ -631,8 +617,7 @@ class EnvironmentVariableCollectionApi(Resource):
    @account_initialization_required
    @edit_permission_required
    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
+    def post(self, app_model: App):
        payload = EnvironmentVariableUpdatePayload.model_validate(console_ns.payload or {})

        workflow_service = WorkflowService()
@@ -1,5 +1,5 @@
 from datetime import UTC, datetime, timedelta
-from typing import Literal
+from typing import Literal, cast
 from uuid import UUID

 from flask import request
@@ -12,12 +12,7 @@ from configs import dify_config
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, setup_required
 from controllers.web.error import NotFoundError
 from core.workflow.human_input_forms import load_form_tokens_by_form_id as _load_form_tokens_by_form_id
 from extensions.ext_database import db
@@ -35,8 +30,8 @@ from graphon.enums import WorkflowExecutionStatus
 from libs.archive_storage import ArchiveStorageNotConfiguredError, get_archive_storage
 from libs.custom_inputs import time_duration
 from libs.helper import uuid_value
-from libs.login import login_required
-from models import Account, App, AppMode, WorkflowArchiveLog, WorkflowRunTriggeredFrom
+from libs.login import current_user, login_required
+from models import Account, App, AppMode, EndUser, WorkflowArchiveLog, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowRun
 from repositories.factory import DifyAPIRepositoryFactory
 from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_NAME
@@ -195,8 +190,8 @@ class WorkflowRunExportApi(Resource):
    @account_initialization_required
    @get_app_model()
    def get(self, app_model: App, run_id: UUID):
-        tenant_id = app_model.tenant_id
-        app_id = app_model.id
+        tenant_id = str(app_model.tenant_id)
+        app_id = str(app_model.id)
        run_id_str = str(run_id)

        run_created_at = db.session.scalar(
@@ -402,18 +397,18 @@ class WorkflowRunNodeExecutionListApi(Resource):
    @login_required
    @account_initialization_required
    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
-    @with_current_user
-    def get(self, current_user: Account, app_model: App, run_id: UUID):
+    def get(self, app_model: App, run_id: UUID):
        """
        Get workflow run node execution list
        """
        run_id_str = str(run_id)

        workflow_run_service = WorkflowRunService()
+        user = cast("Account | EndUser", current_user)
        node_executions = workflow_run_service.get_workflow_run_node_executions(
            app_model=app_model,
            run_id=run_id_str,
-            user=current_user,
+            user=user,
        )

        return WorkflowRunNodeExecutionListResponse.model_validate(
@@ -437,8 +432,7 @@ class ConsoleWorkflowPauseDetailsApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, workflow_run_id: str):
+    def get(self, workflow_run_id: str):
        """
        Get workflow pause details.

@@ -455,7 +449,7 @@ class ConsoleWorkflowPauseDetailsApi(Resource):
        if not workflow_run:
            raise NotFoundError("Workflow run not found")

-        if workflow_run.tenant_id != current_tenant_id:
+        if workflow_run.tenant_id != current_user.current_tenant_id:
            raise NotFoundError("Workflow run not found")

        # Check if workflow is suspended
@@ -12,14 +12,14 @@ from configs import dify_config
 from controllers.common.schema import register_schema_models
 from extensions.ext_database import db
 from fields.base import ResponseModel
-from libs.login import login_required
+from libs.login import current_user, login_required
 from models.enums import AppTriggerStatus
-from models.model import App, AppMode
+from models.model import Account, App, AppMode
 from models.trigger import AppTrigger, WorkflowWebhookTrigger

 from .. import console_ns
 from ..app.wraps import get_app_model
-from ..wraps import account_initialization_required, edit_permission_required, setup_required, with_current_tenant_id
+from ..wraps import account_initialization_required, edit_permission_required, setup_required

 logger = logging.getLogger(__name__)

@@ -124,16 +124,18 @@ class AppTriggersApi(Resource):
    @account_initialization_required
    @get_app_model(mode=AppMode.WORKFLOW)
    @console_ns.response(200, "Success", console_ns.models[WorkflowTriggerListResponse.__name__])
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, app_model: App):
+    def get(self, app_model: App):
        """Get app triggers list"""
+        assert isinstance(current_user, Account)
+        assert current_user.current_tenant_id is not None
+
        with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
            # Get all triggers for this app using select API
            triggers = (
                session.execute(
                    select(AppTrigger)
                    .where(
-                        AppTrigger.tenant_id == current_tenant_id,
+                        AppTrigger.tenant_id == current_user.current_tenant_id,
                        AppTrigger.app_id == app_model.id,
                    )
                    .order_by(AppTrigger.created_at.desc(), AppTrigger.id.desc())
@@ -164,18 +166,19 @@ class AppTriggerEnableApi(Resource):
    @edit_permission_required
    @get_app_model(mode=AppMode.WORKFLOW)
    @console_ns.response(200, "Success", console_ns.models[WorkflowTriggerResponse.__name__])
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, app_model: App):
+    def post(self, app_model: App):
        """Update app trigger (enable/disable)"""
        args = ParserEnable.model_validate(console_ns.payload)

+        assert current_user.current_tenant_id is not None
+
        trigger_id = args.trigger_id
        with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
            # Find the trigger using select
            trigger = session.execute(
                select(AppTrigger).where(
                    AppTrigger.id == trigger_id,
-                    AppTrigger.tenant_id == current_tenant_id,
+                    AppTrigger.tenant_id == current_user.current_tenant_id,
                    AppTrigger.app_id == app_model.id,
                )
            ).scalar_one_or_none()
@@ -76,7 +76,7 @@ class EmailRegisterSendEmailApi(Resource):
        if AccountService.is_email_send_ip_limit(ip_address):
            raise EmailSendIpLimitError()
        language = "en-US"
-        if args.language is not None and args.language in languages:
+        if args.language in languages:
            language = args.language

        if dify_config.BILLING_ENABLED and BillingService.is_email_in_freeze(normalized_email):
@@ -8,16 +8,9 @@ from werkzeug.exceptions import BadRequest

 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    only_edition_cloud,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, only_edition_cloud, setup_required
 from enums.cloud_plan import CloudPlan
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from services.billing_service import BillingService


@@ -39,9 +32,8 @@ class Subscription(Resource):
    @login_required
    @account_initialization_required
    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
        args = SubscriptionQuery.model_validate(request.args.to_dict(flat=True))
        BillingService.is_tenant_owner_or_admin(current_user)
        return BillingService.get_subscription(args.plan, args.interval, current_user.email, current_tenant_id)
@@ -53,9 +45,8 @@ class Invoices(Resource):
    @login_required
    @account_initialization_required
    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
        BillingService.is_tenant_owner_or_admin(current_user)
        return BillingService.get_invoices(current_user.email, current_tenant_id)

@@ -72,8 +63,9 @@ class PartnerTenants(Resource):
    @login_required
    @account_initialization_required
    @only_edition_cloud
-    @with_current_user
-    def put(self, current_user: Account, partner_key: str):
+    def put(self, partner_key: str):
+        current_user, _ = current_account_with_tenant()
+
        try:
            args = PartnerTenantsPayload.model_validate(console_ns.payload or {})
            click_id = args.click_id
@@ -3,18 +3,11 @@ from flask_restx import Resource
 from pydantic import BaseModel, Field

 from libs.helper import extract_remote_ip
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from services.billing_service import BillingService

 from .. import console_ns
-from ..wraps import (
-    account_initialization_required,
-    only_edition_cloud,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from ..wraps import account_initialization_required, only_edition_cloud, setup_required


 class ComplianceDownloadQuery(BaseModel):
@@ -36,9 +29,8 @@ class ComplianceApi(Resource):
    @login_required
    @account_initialization_required
    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
        args = ComplianceDownloadQuery.model_validate(request.args.to_dict(flat=True))

        ip_address = extract_remote_ip(request)
@@ -1,37 +1,41 @@
 import json
 from collections.abc import Generator
-from datetime import datetime
 from typing import Any, Literal, cast
 from uuid import UUID

 from flask import request
-from flask_restx import Resource
-from pydantic import BaseModel, Field, field_serializer
+from flask_restx import Resource, fields, marshal_with
+from pydantic import BaseModel, Field
 from sqlalchemy import select
 from sqlalchemy.orm import sessionmaker
 from werkzeug.exceptions import NotFound

 from controllers.common.fields import SimpleResultResponse, TextContentResponse
-from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.common.schema import get_or_create_model, register_response_schema_models, register_schema_model
 from core.datasource.entities.datasource_entities import DatasourceProviderType, OnlineDocumentPagesMessage
 from core.datasource.online_document.online_document_plugin import OnlineDocumentDatasourcePlugin
-from core.entities.knowledge_entities import IndexingEstimate
 from core.indexing_runner import IndexingRunner
 from core.rag.extractor.entity.datasource_type import DatasourceType
 from core.rag.extractor.entity.extract_setting import ExtractSetting, NotionInfo
 from core.rag.extractor.notion_extractor import NotionExtractor
 from extensions.ext_database import db
-from fields.base import ResponseModel
+from fields.data_source_fields import (
+    integrate_fields,
+    integrate_icon_fields,
+    integrate_list_fields,
+    integrate_notion_info_list_fields,
+    integrate_page_fields,
+    integrate_workspace_fields,
+)
 from libs.datetime_utils import naive_utc_now
-from libs.helper import dump_response, to_timestamp
-from libs.login import login_required
-from models import Account, DataSourceOauthBinding, Document
+from libs.login import current_account_with_tenant, login_required
+from models import DataSourceOauthBinding, Document
 from services.dataset_service import DatasetService, DocumentService
 from services.datasource_provider_service import DatasourceProviderService
 from tasks.document_indexing_sync_task import document_indexing_sync_task

 from .. import console_ns
-from ..wraps import account_initialization_required, setup_required, with_current_tenant_id, with_current_user
+from ..wraps import account_initialization_required, setup_required


 class NotionEstimatePayload(BaseModel):
@@ -50,74 +54,50 @@ class DataSourceNotionPreviewQuery(BaseModel):
    credential_id: str = Field(..., description="Credential ID", min_length=1)


-class DataSourceIntegrateIconResponse(ResponseModel):
-    type: str | None = None
-    url: str | None = None
-    emoji: str | None = None
+register_schema_model(console_ns, NotionEstimatePayload)
+register_response_schema_models(console_ns, SimpleResultResponse, TextContentResponse)


-class DataSourceIntegratePageResponse(ResponseModel):
-    page_name: str
-    page_id: str
-    page_icon: DataSourceIntegrateIconResponse | None
-    parent_id: str
-    type: str
+integrate_icon_model = get_or_create_model("DataSourceIntegrateIcon", integrate_icon_fields)

+integrate_page_fields_copy = integrate_page_fields.copy()
+integrate_page_fields_copy["page_icon"] = fields.Nested(integrate_icon_model, allow_null=True)
+integrate_page_model = get_or_create_model("DataSourceIntegratePage", integrate_page_fields_copy)

-class DataSourceIntegrateWorkspaceResponse(ResponseModel):
-    workspace_name: str | None
-    workspace_id: str | None
-    workspace_icon: str | None
-    pages: list[DataSourceIntegratePageResponse]
-    total: int
+integrate_workspace_fields_copy = integrate_workspace_fields.copy()
+integrate_workspace_fields_copy["pages"] = fields.List(fields.Nested(integrate_page_model))
+integrate_workspace_model = get_or_create_model("DataSourceIntegrateWorkspace", integrate_workspace_fields_copy)

+integrate_fields_copy = integrate_fields.copy()
+integrate_fields_copy["source_info"] = fields.Nested(integrate_workspace_model)
+integrate_model = get_or_create_model("DataSourceIntegrate", integrate_fields_copy)

-class DataSourceIntegrateResponse(ResponseModel):
-    id: str | None
-    provider: str
-    created_at: datetime | int | None
-    is_bound: bool
-    disabled: bool | None
-    link: str
-    source_info: DataSourceIntegrateWorkspaceResponse | None
+integrate_list_fields_copy = integrate_list_fields.copy()
+integrate_list_fields_copy["data"] = fields.List(fields.Nested(integrate_model))
+integrate_list_model = get_or_create_model("DataSourceIntegrateList", integrate_list_fields_copy)

-    @field_serializer("created_at")
-    def serialize_created_at(self, value: datetime | int | None) -> int | None:
-        return to_timestamp(value)
+notion_page_fields = {
+    "page_name": fields.String,
+    "page_id": fields.String,
+    "page_icon": fields.Nested(integrate_icon_model, allow_null=True),
+    "is_bound": fields.Boolean,
+    "parent_id": fields.String,
+    "type": fields.String,
+}
+notion_page_model = get_or_create_model("NotionIntegratePage", notion_page_fields)

+notion_workspace_fields = {
+    "workspace_name": fields.String,
+    "workspace_id": fields.String,
+    "workspace_icon": fields.String,
+    "pages": fields.List(fields.Nested(notion_page_model)),
+}
+notion_workspace_model = get_or_create_model("NotionIntegrateWorkspace", notion_workspace_fields)

-class DataSourceIntegrateListResponse(ResponseModel):
-    data: list[DataSourceIntegrateResponse]
-
-
-class NotionIntegratePageResponse(ResponseModel):
-    page_name: str
-    page_id: str
-    page_icon: DataSourceIntegrateIconResponse | None
-    parent_id: str | None
-    type: str
-    is_bound: bool
-
-
-class NotionIntegrateWorkspaceResponse(ResponseModel):
-    workspace_name: str | None
-    workspace_id: str | None
-    workspace_icon: str | None
-    pages: list[NotionIntegratePageResponse]
-
-
-class NotionIntegrateInfoListResponse(ResponseModel):
-    notion_info: list[NotionIntegrateWorkspaceResponse]
-
-
-register_schema_models(console_ns, NotionEstimatePayload)
-register_response_schema_models(
-    console_ns,
-    DataSourceIntegrateListResponse,
-    IndexingEstimate,
-    NotionIntegrateInfoListResponse,
-    SimpleResultResponse,
-    TextContentResponse,
+integrate_notion_info_list_fields_copy = integrate_notion_info_list_fields.copy()
+integrate_notion_info_list_fields_copy["notion_info"] = fields.List(fields.Nested(notion_workspace_model))
+integrate_notion_info_list_model = get_or_create_model(
+    "NotionIntegrateInfoList", integrate_notion_info_list_fields_copy
 )


@@ -129,9 +109,10 @@ class DataSourceApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @console_ns.response(200, "Success", console_ns.models[DataSourceIntegrateListResponse.__name__])
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str) -> tuple[dict[str, Any], int]:
+    @marshal_with(integrate_list_model)
+    def get(self):
+        _, current_tenant_id = current_account_with_tenant()
+
        # get workspace data source integrates
        data_source_integrates = db.session.scalars(
            select(DataSourceOauthBinding).where(
@@ -173,21 +154,19 @@ class DataSourceApi(Resource):
                        "link": f"{base_url}{data_source_oauth_base_path}/{provider}",
                    }
                )
-        return dump_response(DataSourceIntegrateListResponse, {"data": integrate_data}), 200
+        return {"data": integrate_data}, 200

    @setup_required
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_tenant_id
-    def patch(
-        self, current_tenant_id: str, binding_id: UUID, action: Literal["enable", "disable"]
-    ) -> tuple[dict[str, str], int]:
-        binding_id_str = str(binding_id)
+    def patch(self, binding_id, action: Literal["enable", "disable"]):
+        _, current_tenant_id = current_account_with_tenant()
+        binding_id = str(binding_id)
        with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
            data_source_binding = session.execute(
                select(DataSourceOauthBinding).where(
-                    DataSourceOauthBinding.id == binding_id_str, DataSourceOauthBinding.tenant_id == current_tenant_id
+                    DataSourceOauthBinding.id == binding_id, DataSourceOauthBinding.tenant_id == current_tenant_id
                )
            ).scalar_one_or_none()
        if data_source_binding is None:
@@ -219,12 +198,12 @@ class DataSourceNotionListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @console_ns.doc(params=query_params_from_model(DataSourceNotionListQuery))
-    @console_ns.response(200, "Success", console_ns.models[NotionIntegrateInfoListResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account) -> tuple[dict[str, Any], int]:
-        query = DataSourceNotionListQuery.model_validate(request.args.to_dict(flat=True))
+    @marshal_with(integrate_notion_info_list_model)
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
+
+        query = DataSourceNotionListQuery.model_validate(request.args.to_dict())
+
        datasource_provider_service = DatasourceProviderService()
        credential = datasource_provider_service.get_datasource_credentials(
            tenant_id=current_tenant_id,
@@ -299,22 +278,22 @@ class DataSourceNotionListApi(Resource):
                            pages.append(page_info)
            except Exception as e:
                raise e
-            notion_info = [{**workspace_info, "pages": pages}] if workspace_info else []
-            return dump_response(NotionIntegrateInfoListResponse, {"notion_info": notion_info}), 200
+            return {"notion_info": {**workspace_info, "pages": pages}}, 200


-@console_ns.route("/notion/pages/<uuid:page_id>/<string:page_type>/preview")
-class DataSourceNotionPreviewApi(Resource):
-    """Preview one authorized Notion page through the datasource credential."""
-
+@console_ns.route(
+    "/notion/pages/<uuid:page_id>/<string:page_type>/preview",
+    "/datasets/notion-indexing-estimate",
+)
+class DataSourceNotionApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @console_ns.doc(params=query_params_from_model(DataSourceNotionPreviewQuery))
    @console_ns.response(200, "Success", console_ns.models[TextContentResponse.__name__])
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, page_id: UUID, page_type: str) -> tuple[dict[str, str], int]:
-        query = DataSourceNotionPreviewQuery.model_validate(request.args.to_dict(flat=True))
+    def get(self, page_id: UUID, page_type: str):
+        _, current_tenant_id = current_account_with_tenant()
+
+        query = DataSourceNotionPreviewQuery.model_validate(request.args.to_dict())

        datasource_provider_service = DatasourceProviderService()
        credential = datasource_provider_service.get_datasource_credentials(
@@ -337,18 +316,13 @@ class DataSourceNotionPreviewApi(Resource):
        text_docs = extractor.extract()
        return {"content": "\n".join([doc.page_content for doc in text_docs])}, 200

-
-@console_ns.route("/datasets/notion-indexing-estimate")
-class DataSourceNotionIndexingEstimateApi(Resource):
-    """Estimate indexing work for selected Notion pages."""
-
    @setup_required
    @login_required
    @account_initialization_required
    @console_ns.expect(console_ns.models[NotionEstimatePayload.__name__])
-    @console_ns.response(200, "Success", console_ns.models[IndexingEstimate.__name__])
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str) -> tuple[dict[str, Any], int]:
+    def post(self):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = NotionEstimatePayload.model_validate(console_ns.payload or {})
        args = payload.model_dump()
        # validate args
@@ -381,7 +355,7 @@ class DataSourceNotionIndexingEstimateApi(Resource):
            args["doc_form"],
            args["doc_language"],
        )
-        return dump_response(IndexingEstimate, response), 200
+        return response.model_dump(), 200


@console_ns.route("/datasets/<uuid:dataset_id>/notion/sync")
@@ -390,7 +364,7 @@ class DataSourceNotionDatasetSyncApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    def get(self, dataset_id: UUID) -> tuple[dict[str, str], int]:
+    def get(self, dataset_id: UUID):
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
        if dataset is None:
@@ -408,7 +382,7 @@ class DataSourceNotionDocumentSyncApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    def get(self, dataset_id: UUID, document_id: UUID) -> tuple[dict[str, str], int]:
+    def get(self, dataset_id: UUID, document_id: UUID):
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -44,8 +44,8 @@ from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.errors.invoke import InvokeAuthorizationError
 from libs.datetime_utils import naive_utc_now
 from libs.helper import dump_response, to_timestamp
-from libs.login import login_required
-from models import Account, DatasetProcessRule, Document, DocumentSegment, UploadFile
+from libs.login import current_account_with_tenant, login_required
+from models import DatasetProcessRule, Document, DocumentSegment, UploadFile
 from models.dataset import DocumentPipelineExecutionLog
 from models.enums import IndexingStatus, SegmentStatus
 from services.dataset_service import DatasetService, DocumentService
@@ -71,8 +71,6 @@ from ..wraps import (
    cloud_edition_billing_rate_limit_check,
    cloud_edition_billing_resource_check,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
 )

 logger = logging.getLogger(__name__)
@@ -171,9 +169,8 @@ register_response_schema_models(


 class DocumentResource(Resource):
-    def get_document(
-        self, dataset_id: str, document_id: str, current_user: Account, current_tenant_id: str
-    ) -> Document:
+    def get_document(self, dataset_id: str, document_id: str) -> Document:
+        current_user, current_tenant_id = current_account_with_tenant()
        dataset = DatasetService.get_dataset(dataset_id)
        if not dataset:
            raise NotFound("Dataset not found.")
@@ -193,7 +190,8 @@ class DocumentResource(Resource):

        return document

-    def get_batch_documents(self, dataset_id: str, batch: str, current_user: Account) -> Sequence[Document]:
+    def get_batch_documents(self, dataset_id: str, batch: str) -> Sequence[Document]:
+        current_user, _ = current_account_with_tenant()
        dataset = DatasetService.get_dataset(dataset_id)
        if not dataset:
            raise NotFound("Dataset not found.")
@@ -220,8 +218,8 @@ class GetProcessRuleApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def get(self, current_user: Account):
+    def get(self):
+        current_user, _ = current_account_with_tenant()
        req_data = request.args

        document_id = req_data.get("document_id")
@@ -281,9 +279,8 @@ class DatasetDocumentListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
+    def get(self, dataset_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        raw_args = request.args.to_dict()
        param = DocumentDatasetListParam.model_validate(raw_args)
@@ -408,8 +405,8 @@ class DatasetDocumentListApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[KnowledgeConfig.__name__])
    @console_ns.response(200, "Documents created successfully", console_ns.models[DatasetAndDocumentResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account, dataset_id: UUID):
+    def post(self, dataset_id: UUID):
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)

        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -483,10 +480,9 @@ class DatasetInitApi(Resource):
    @account_initialization_required
    @cloud_edition_billing_resource_check("vector_space")
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account):
+    def post(self):
        # The role of the current user in the ta table must be admin, owner, dataset_operator, or editor
+        current_user, current_tenant_id = current_account_with_tenant()
        if not current_user.is_dataset_editor:
            raise Forbidden()

@@ -543,12 +539,11 @@ class DocumentIndexingEstimateApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
+        _, current_tenant_id = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        if document.indexing_status in {IndexingStatus.COMPLETED, IndexingStatus.ERROR}:
            raise DocumentAlreadyFinishedError()
@@ -609,11 +604,10 @@ class DocumentBatchIndexingEstimateApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, batch: str):
+    def get(self, dataset_id: UUID, batch: str):
+        _, current_tenant_id = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
-        documents = self.get_batch_documents(dataset_id_str, batch, current_user)
+        documents = self.get_batch_documents(dataset_id_str, batch)
        if not documents:
            return {"tokens": 0, "total_price": 0, "currency": "USD", "total_segments": 0, "preview": []}, 200
        data_process_rule = documents[0].dataset_process_rule
@@ -710,10 +704,9 @@ class DocumentBatchIndexingStatusApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def get(self, current_user: Account, dataset_id: UUID, batch: str):
+    def get(self, dataset_id: UUID, batch: str):
        dataset_id_str = str(dataset_id)
-        documents = self.get_batch_documents(dataset_id_str, batch, current_user)
+        documents = self.get_batch_documents(dataset_id_str, batch)
        documents_status = []
        for document in documents:
            completed_segments = (
@@ -766,18 +759,16 @@ class DocumentIndexingStatusApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        completed_segments = (
            db.session.scalar(
                select(func.count(DocumentSegment.id)).where(
                    DocumentSegment.completed_at.isnot(None),
-                    DocumentSegment.document_id == document_id_str,
+                    DocumentSegment.document_id == str(document_id_str),
                    DocumentSegment.status != SegmentStatus.RE_SEGMENT,
                )
            )
@@ -786,7 +777,7 @@ class DocumentIndexingStatusApi(DocumentResource):
        total_segments = (
            db.session.scalar(
                select(func.count(DocumentSegment.id)).where(
-                    DocumentSegment.document_id == document_id_str,
+                    DocumentSegment.document_id == str(document_id_str),
                    DocumentSegment.status != SegmentStatus.RE_SEGMENT,
                )
            )
@@ -829,12 +820,10 @@ class DocumentApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        metadata = request.args.get("metadata", "all")
        if metadata not in self.METADATA_CHOICES:
@@ -920,9 +909,7 @@ class DocumentApi(DocumentResource):
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.response(204, "Document deleted successfully")
-    @with_current_user
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def delete(self, dataset_id: UUID, document_id: UUID):
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -931,7 +918,7 @@ class DocumentApi(DocumentResource):
        # check user's model setting
        DatasetService.check_dataset_model_setting(dataset)

-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        try:
            DocumentService.delete_document(document)
@@ -952,11 +939,9 @@ class DocumentDownloadApi(DocumentResource):
    @login_required
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID) -> dict[str, Any]:
+    def get(self, dataset_id: UUID, document_id: UUID) -> dict[str, Any]:
        # Reuse the shared permission/tenant checks implemented in DocumentResource.
-        document = self.get_document(str(dataset_id), str(document_id), current_user, current_tenant_id)
+        document = self.get_document(str(dataset_id), str(document_id))
        return {"url": DocumentService.get_document_download_url(document)}


@@ -971,13 +956,12 @@ class DocumentBatchDownloadZipApi(DocumentResource):
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[DocumentBatchDownloadZipPayload.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
+    def post(self, dataset_id: UUID):
        """Stream a ZIP archive containing the requested uploaded documents."""
        # Parse and validate request payload.
        payload = DocumentBatchDownloadZipPayload.model_validate(console_ns.payload or {})

+        current_user, current_tenant_id = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        document_ids: list[str] = [str(document_id) for document_id in payload.document_ids]
        upload_files, download_name = DocumentService.prepare_document_batch_download_zip(
@@ -1019,19 +1003,11 @@ class DocumentProcessingApi(DocumentResource):
    @login_required
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    @with_current_tenant_id
-    def patch(
-        self,
-        current_tenant_id: str,
-        current_user: Account,
-        dataset_id: UUID,
-        document_id: UUID,
-        action: Literal["pause", "resume"],
-    ):
+    def patch(self, dataset_id: UUID, document_id: UUID, action: Literal["pause", "resume"]):
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        # The role of the current user in the ta table must be admin, owner, dataset_operator, or editor
        if not current_user.is_dataset_editor:
@@ -1075,12 +1051,11 @@ class DocumentMetadataApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def put(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def put(self, dataset_id: UUID, document_id: UUID):
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
-        document = self.get_document(dataset_id_str, document_id_str, current_user, current_tenant_id)
+        document = self.get_document(dataset_id_str, document_id_str)

        req_data = DocumentMetadataUpdatePayload.model_validate(request.get_json() or {})

@@ -1125,10 +1100,8 @@ class DocumentStatusApi(DocumentResource):
    @cloud_edition_billing_resource_check("vector_space")
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_user
-    def patch(
-        self, current_user: Account, dataset_id: UUID, action: Literal["enable", "disable", "archive", "un_archive"]
-    ):
+    def patch(self, dataset_id: UUID, action: Literal["enable", "disable", "archive", "un_archive"]):
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
        if dataset is None:
@@ -1243,6 +1216,8 @@ class DocumentRetryApi(DocumentResource):
            raise NotFound("Dataset not found.")
        for document_id in payload.document_ids:
            try:
+                document_id = str(document_id)
+
                document = DocumentService.get_document(dataset.id, document_id)

                # 404 if document not found
@@ -1273,9 +1248,9 @@ class DocumentRenameApi(DocumentResource):
    @account_initialization_required
    @console_ns.response(200, "Document renamed successfully", console_ns.models[DocumentResponse.__name__])
    @console_ns.expect(console_ns.models[DocumentRenamePayload.__name__])
-    @with_current_user
-    def post(self, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def post(self, dataset_id: UUID, document_id: UUID):
        # The role of the current user in the ta table must be admin, owner, editor, or dataset_operator
+        current_user, _ = current_account_with_tenant()
        if not current_user.is_dataset_editor:
            raise Forbidden()
        dataset = DatasetService.get_dataset(dataset_id)
@@ -1298,9 +1273,9 @@ class WebsiteDocumentSyncApi(DocumentResource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
        """sync website document."""
+        _, current_tenant_id = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
        if not dataset:
@@ -1376,8 +1351,7 @@ class DocumentGenerateSummaryApi(Resource):
    @login_required
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    def post(self, current_user: Account, dataset_id: UUID):
+    def post(self, dataset_id: UUID):
        """
        Generate summary index for specified documents.

@@ -1385,6 +1359,7 @@ class DocumentGenerateSummaryApi(Resource):
        (indexing_technique must be 'high_quality' and summary_index_setting.enable must be true),
        then asynchronously generates summary indexes for the provided documents.
        """
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)

        # Get dataset
@@ -1469,8 +1444,7 @@ class DocumentSummaryStatusApi(DocumentResource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def get(self, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
        """
        Get summary index generation status for a document.

@@ -1483,6 +1457,7 @@ class DocumentSummaryStatusApi(DocumentResource):
          - not_started: Number of segments without summary records
        - summaries: List of summary records with status and content preview
        """
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)

@@ -33,8 +33,6 @@ from controllers.console.wraps import (
    cloud_edition_billing_rate_limit_check,
    cloud_edition_billing_resource_check,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
 )
 from core.errors.error import LLMBadRequestError, ProviderTokenNotInitError
 from core.model_manager import ModelManager
@@ -53,8 +51,7 @@ from fields.segment_fields import (
 )
 from graphon.model_runtime.entities.model_entities import ModelType
 from libs.helper import dump_response, escape_like_pattern
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from models.dataset import ChildChunk, DocumentSegment
 from models.model import UploadFile
 from services.dataset_service import DatasetService, DocumentService, SegmentService
@@ -167,9 +164,9 @@ class DatasetDocumentSegmentListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -277,8 +274,9 @@ class DatasetDocumentSegmentListApi(Resource):
    @console_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT)
    @console_ns.doc(params=query_params_from_model(SegmentIdListQuery))
    @console_ns.response(204, "Segments deleted successfully")
-    @with_current_user
-    def delete(self, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def delete(self, dataset_id: UUID, document_id: UUID):
+        current_user, _ = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -314,16 +312,9 @@ class DatasetDocumentSegmentApi(Resource):
    @cloud_edition_billing_resource_check("vector_space")
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def patch(
-        self,
-        current_tenant_id: str,
-        current_user: Account,
-        dataset_id: UUID,
-        document_id: UUID,
-        action: Literal["enable", "disable"],
-    ):
+    def patch(self, dataset_id: UUID, document_id: UUID, action: Literal["enable", "disable"]):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
        if not dataset:
@@ -382,9 +373,9 @@ class DatasetDocumentSegmentAddApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[SegmentCreatePayload.__name__])
    @console_ns.response(200, "Segment created successfully", console_ns.models[SegmentDetailResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def post(self, dataset_id: UUID, document_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -440,11 +431,9 @@ class DatasetDocumentSegmentUpdateApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[SegmentUpdatePayload.__name__])
    @console_ns.response(200, "Segment updated successfully", console_ns.models[SegmentDetailResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def patch(
-        self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
-    ):
+    def patch(self, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -511,11 +500,9 @@ class DatasetDocumentSegmentUpdateApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_SEGMENT)
    @console_ns.response(204, "Segment deleted successfully")
-    @with_current_user
-    @with_current_tenant_id
-    def delete(
-        self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
-    ):
+    def delete(self, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -561,9 +548,9 @@ class DatasetDocumentSegmentBatchImportApi(Resource):
    @cloud_edition_billing_knowledge_limit_check("add_segment")
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[BatchImportPayload.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
+    def post(self, dataset_id: UUID, document_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -632,11 +619,9 @@ class ChildChunkAddApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.expect(console_ns.models[ChildChunkCreatePayload.__name__])
    @console_ns.response(200, "Child chunk created successfully", console_ns.models[ChildChunkDetailResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def post(
-        self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
-    ):
+    def post(self, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -692,8 +677,9 @@ class ChildChunkAddApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+    def get(self, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+        _, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -745,11 +731,9 @@ class ChildChunkAddApi(Resource):
        console_ns.models[ChildChunkBatchUpdateResponse.__name__],
    )
    @console_ns.expect(console_ns.models[ChildChunkBatchUpdatePayload.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def patch(
-        self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
-    ):
+    def patch(self, dataset_id: UUID, document_id: UUID, segment_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -797,17 +781,9 @@ class ChildChunkUpdateApi(Resource):
    @cloud_edition_billing_rate_limit_check("knowledge")
    @console_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_CHILD_CHUNK)
    @console_ns.response(204, "Child chunk deleted successfully")
-    @with_current_user
-    @with_current_tenant_id
-    def delete(
-        self,
-        current_tenant_id: str,
-        current_user: Account,
-        dataset_id: UUID,
-        document_id: UUID,
-        segment_id: UUID,
-        child_chunk_id: UUID,
-    ):
+    def delete(self, dataset_id: UUID, document_id: UUID, segment_id: UUID, child_chunk_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -864,17 +840,9 @@ class ChildChunkUpdateApi(Resource):
    @console_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_CHILD_CHUNK)
    @console_ns.expect(console_ns.models[ChildChunkUpdatePayload.__name__])
    @console_ns.response(200, "Child chunk updated successfully", console_ns.models[ChildChunkDetailResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def patch(
-        self,
-        current_tenant_id: str,
-        current_user: Account,
-        dataset_id: UUID,
-        document_id: UUID,
-        segment_id: UUID,
-        child_chunk_id: UUID,
-    ):
+    def patch(self, dataset_id: UUID, document_id: UUID, segment_id: UUID, child_chunk_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        # check dataset
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
@@ -15,7 +15,6 @@ from controllers.console.wraps import (
    edit_permission_required,
    setup_required,
    with_current_tenant_id,
-    with_current_user,
 )
 from fields.dataset_fields import (
    dataset_detail_fields,
@@ -30,8 +29,7 @@ from fields.dataset_fields import (
    vector_setting_fields,
    weighted_score_fields,
 )
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from services.dataset_service import DatasetService
 from services.external_knowledge_service import ExternalDatasetService
 from services.hit_testing_service import HitTestingService
@@ -154,9 +152,8 @@ class ExternalApiTemplateListApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.expect(console_ns.models[ExternalKnowledgeApiPayload.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account):
+    def post(self):
+        current_user, current_tenant_id = current_account_with_tenant()
        payload = ExternalKnowledgeApiPayload.model_validate(console_ns.payload or {})

        ExternalDatasetService.validate_api_list(payload.settings)
@@ -185,8 +182,8 @@ class ExternalApiTemplateApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, external_knowledge_api_id: UUID):
+    def get(self, external_knowledge_api_id: UUID):
+        _, current_tenant_id = current_account_with_tenant()
        external_knowledge_api_id_str = str(external_knowledge_api_id)
        external_knowledge_api = ExternalDatasetService.get_external_knowledge_api(
            external_knowledge_api_id_str, current_tenant_id
@@ -200,9 +197,8 @@ class ExternalApiTemplateApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.expect(console_ns.models[ExternalKnowledgeApiPayload.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def patch(self, current_tenant_id: str, current_user: Account, external_knowledge_api_id: UUID):
+    def patch(self, external_knowledge_api_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
        external_knowledge_api_id_str = str(external_knowledge_api_id)

        payload = ExternalKnowledgeApiPayload.model_validate(console_ns.payload or {})
@@ -221,9 +217,8 @@ class ExternalApiTemplateApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(204, "External knowledge API deleted successfully")
-    @with_current_user
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, current_user: Account, external_knowledge_api_id: UUID):
+    def delete(self, external_knowledge_api_id: UUID):
+        current_user, current_tenant_id = current_account_with_tenant()
        external_knowledge_api_id_str = str(external_knowledge_api_id)

        if not (current_user.has_edit_permission or current_user.is_dataset_operator):
@@ -242,8 +237,8 @@ class ExternalApiUseCheckApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, external_knowledge_api_id: UUID):
+    def get(self, external_knowledge_api_id: UUID):
+        _, current_tenant_id = current_account_with_tenant()
        external_knowledge_api_id_str = str(external_knowledge_api_id)

        external_knowledge_api_is_using, count = ExternalDatasetService.external_knowledge_api_use_check(
@@ -264,10 +259,9 @@ class ExternalDatasetCreateApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account):
+    def post(self):
        # The role of the current user in the ta table must be admin, owner, or editor
+        current_user, current_tenant_id = current_account_with_tenant()
        payload = ExternalDatasetCreatePayload.model_validate(console_ns.payload or {})
        args = payload.model_dump(exclude_none=True)

@@ -299,8 +293,8 @@ class ExternalKnowledgeHitTestingApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def post(self, current_user: Account, dataset_id: UUID):
+    def post(self, dataset_id: UUID):
+        current_user, _ = current_account_with_tenant()
        dataset_id_str = str(dataset_id)
        dataset = DatasetService.get_dataset(dataset_id_str)
        if dataset is None:
@@ -9,18 +9,11 @@ from configs import dify_config
 from controllers.common.fields import SimpleResultResponse
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from core.plugin.impl.oauth import OAuthHandler
 from graphon.model_runtime.errors.validate import CredentialsValidateFailedError
 from graphon.model_runtime.utils.encoders import jsonable_encoder
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from models.provider_ids import DatasourceProviderID
 from services.datasource_provider_service import DatasourceProviderService
 from services.plugin.oauth_service import OAuthProxyService
@@ -73,10 +66,11 @@ class DatasourcePluginOAuthAuthorizationUrl(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, provider_id: str):
+    def get(self, provider_id: str):
+        current_user, current_tenant_id = current_account_with_tenant()
+
        tenant_id = current_tenant_id
+
        credential_id = request.args.get("credential_id")
        datasource_provider_id = DatasourceProviderID(provider_id)
        provider_name = datasource_provider_id.provider_name
@@ -180,8 +174,9 @@ class DatasourceAuth(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = DatasourceCredentialPayload.model_validate(console_ns.payload or {})
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
@@ -200,17 +195,15 @@ class DatasourceAuth(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, user: Account, provider_id: str):
+    def get(self, provider_id: str):
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
+        _, current_tenant_id = current_account_with_tenant()

        datasources = datasource_provider_service.list_datasource_credentials(
            tenant_id=current_tenant_id,
            provider=datasource_provider_id.provider_name,
            plugin_id=datasource_provider_id.plugin_id,
-            user=user,
        )
        return {"result": datasources}, 200

@@ -223,8 +216,9 @@ class DatasourceAuthDeleteApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        datasource_provider_id = DatasourceProviderID(provider_id)
        plugin_id = datasource_provider_id.plugin_id
        provider_name = datasource_provider_id.provider_name
@@ -247,8 +241,9 @@ class DatasourceAuthUpdateApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        datasource_provider_id = DatasourceProviderID(provider_id)
        payload = DatasourceCredentialUpdatePayload.model_validate(console_ns.payload or {})

@@ -269,8 +264,9 @@ class DatasourceAuthListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str):
+    def get(self):
+        _, current_tenant_id = current_account_with_tenant()
+
        datasource_provider_service = DatasourceProviderService()
        datasources = datasource_provider_service.get_all_datasource_credentials(tenant_id=current_tenant_id)
        return {"result": jsonable_encoder(datasources)}, 200
@@ -281,8 +277,9 @@ class DatasourceHardCodeAuthListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str):
+    def get(self):
+        _, current_tenant_id = current_account_with_tenant()
+
        datasource_provider_service = DatasourceProviderService()
        datasources = datasource_provider_service.get_hard_code_datasource_credentials(tenant_id=current_tenant_id)
        return {"result": jsonable_encoder(datasources)}, 200
@@ -295,8 +292,9 @@ class DatasourceAuthOauthCustomClient(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = DatasourceCustomClientPayload.model_validate(console_ns.payload or {})
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
@@ -312,8 +310,9 @@ class DatasourceAuthOauthCustomClient(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, provider_id: str):
+    def delete(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
        datasource_provider_service.remove_oauth_custom_client_params(
@@ -331,8 +330,9 @@ class DatasourceAuthDefaultApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = DatasourceDefaultPayload.model_validate(console_ns.payload or {})
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
@@ -352,8 +352,9 @@ class DatasourceUpdateProviderNameApi(Resource):
    @login_required
    @account_initialization_required
    @edit_permission_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider_id: str):
+    def post(self, provider_id: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = DatasourceUpdateNamePayload.model_validate(console_ns.payload or {})
        datasource_provider_id = DatasourceProviderID(provider_id)
        datasource_provider_service = DatasourceProviderService()
@@ -2,12 +2,13 @@ from flask_restx import (  # type: ignore
    Resource,  # type: ignore
 )
 from pydantic import BaseModel
+from werkzeug.exceptions import Forbidden

 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
 from controllers.console.datasets.wraps import get_rag_pipeline
-from controllers.console.wraps import account_initialization_required, setup_required, with_current_user
-from libs.login import login_required
+from controllers.console.wraps import account_initialization_required, setup_required
+from libs.login import current_user, login_required
 from models import Account
 from models.dataset import Pipeline
 from services.rag_pipeline.rag_pipeline import RagPipelineService
@@ -29,11 +30,13 @@ class DataSourceContentPreviewApi(Resource):
    @login_required
    @account_initialization_required
    @get_rag_pipeline
-    @with_current_user
-    def post(self, current_user: Account, pipeline: Pipeline, node_id: str):
+    def post(self, pipeline: Pipeline, node_id: str):
        """
        Run datasource content preview
        """
+        if not isinstance(current_user, Account):
+            raise Forbidden()
+
        args = Parser.model_validate(console_ns.payload)

        inputs = args.inputs
@@ -1,20 +1,13 @@
 import logging
-from typing import Any

 from flask import request
 from flask_restx import Resource
 from pydantic import BaseModel, Field
 from sqlalchemy import select
 from sqlalchemy.orm import sessionmaker
-from werkzeug.exceptions import NotFound

 from controllers.common.fields import SimpleDataResponse
-from controllers.common.schema import (
-    JsonResponseWithStatus,
-    query_params_from_model,
-    register_response_schema_models,
-    register_schema_models,
-)
+from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
    account_initialization_required,
@@ -23,132 +16,79 @@ from controllers.console.wraps import (
    setup_required,
 )
 from extensions.ext_database import db
-from fields.base import ResponseModel
-from libs.helper import dump_response
 from libs.login import login_required
 from models.dataset import PipelineCustomizedTemplate
-from services.entities.knowledge_entities.rag_pipeline_entities import IconInfo, PipelineTemplateInfoEntity
+from services.entities.knowledge_entities.rag_pipeline_entities import PipelineTemplateInfoEntity
 from services.rag_pipeline.rag_pipeline import RagPipelineService

-logger: logging.Logger = logging.getLogger(__name__)
-
-
-class PipelineTemplateListQuery(BaseModel):
-    type: str = Field(default="built-in", description="Template source: built-in or customized")
-    language: str = Field(default="en-US", description="Template language")
-
-
-class PipelineTemplateDetailQuery(BaseModel):
-    type: str = Field(default="built-in", description="Template source: built-in or customized")
-
-
-class PipelineTemplateItemResponse(ResponseModel):
-    id: str
-    name: str
-    icon: dict[str, Any]
-    description: str
-    position: int
-    chunk_structure: str
-    copyright: str | None = None
-    privacy_policy: str | None = None
-
-
-class PipelineTemplateListResponse(ResponseModel):
-    pipeline_templates: list[PipelineTemplateItemResponse]
-
-
-class PipelineTemplateDetailResponse(ResponseModel):
-    id: str
-    name: str
-    icon_info: dict[str, Any]
-    description: str
-    chunk_structure: str
-    export_data: str
-    graph: dict[str, Any]
-    created_by: str | None = None
-
-
-class CustomizedPipelineTemplatePayload(BaseModel):
-    name: str = Field(..., min_length=1, max_length=40)
-    description: str = Field(default="", max_length=400)
-    icon_info: dict[str, object] = Field(default_factory=lambda: IconInfo(icon="").model_dump())
-
-
-register_schema_models(
-    console_ns,
-    CustomizedPipelineTemplatePayload,
-    PipelineTemplateDetailQuery,
-    PipelineTemplateListQuery,
-)
-register_response_schema_models(
-    console_ns,
-    PipelineTemplateDetailResponse,
-    PipelineTemplateListResponse,
-    SimpleDataResponse,
-)
+logger = logging.getLogger(__name__)


@console_ns.route("/rag/pipeline/templates")
 class PipelineTemplateListApi(Resource):
-    @console_ns.doc(params=query_params_from_model(PipelineTemplateListQuery))
-    @console_ns.response(200, "Pipeline templates", console_ns.models[PipelineTemplateListResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
-    def get(self) -> JsonResponseWithStatus:
-        query = PipelineTemplateListQuery.model_validate(request.args.to_dict(flat=True))
+    def get(self):
+        type = request.args.get("type", default="built-in", type=str)
+        language = request.args.get("language", default="en-US", type=str)
        # get pipeline templates
-        pipeline_templates = RagPipelineService.get_pipeline_templates(query.type, query.language)
-        return dump_response(PipelineTemplateListResponse, pipeline_templates), 200
+        pipeline_templates = RagPipelineService.get_pipeline_templates(type, language)
+        return pipeline_templates, 200


@console_ns.route("/rag/pipeline/templates/<string:template_id>")
 class PipelineTemplateDetailApi(Resource):
-    @console_ns.doc(params=query_params_from_model(PipelineTemplateDetailQuery))
-    @console_ns.response(200, "Pipeline template", console_ns.models[PipelineTemplateDetailResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
-    def get(self, template_id: str) -> JsonResponseWithStatus:
-        query = PipelineTemplateDetailQuery.model_validate(request.args.to_dict(flat=True))
+    def get(self, template_id: str):
+        type = request.args.get("type", default="built-in", type=str)
        rag_pipeline_service = RagPipelineService()
-        pipeline_template = rag_pipeline_service.get_pipeline_template_detail(template_id, query.type)
+        pipeline_template = rag_pipeline_service.get_pipeline_template_detail(template_id, type)
        if pipeline_template is None:
-            raise NotFound("Pipeline template not found from upstream service.")
-        return dump_response(PipelineTemplateDetailResponse, pipeline_template), 200
+            return {"error": "Pipeline template not found from upstream service."}, 404
+        return pipeline_template, 200
+
+
+class Payload(BaseModel):
+    name: str = Field(..., min_length=1, max_length=40)
+    description: str = Field(default="", max_length=400)
+    icon_info: dict[str, object] | None = None
+
+
+register_schema_models(console_ns, Payload)
+register_response_schema_models(console_ns, SimpleDataResponse)


@console_ns.route("/rag/pipeline/customized/templates/<string:template_id>")
 class CustomizedPipelineTemplateApi(Resource):
-    @console_ns.expect(console_ns.models[CustomizedPipelineTemplatePayload.__name__])
-    @console_ns.response(204, "Pipeline template updated")
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
-    def patch(self, template_id: str) -> tuple[str, int]:
-        payload = CustomizedPipelineTemplatePayload.model_validate(console_ns.payload or {})
+    def patch(self, template_id: str):
+        payload = Payload.model_validate(console_ns.payload or {})
        pipeline_template_info = PipelineTemplateInfoEntity.model_validate(payload.model_dump())
        RagPipelineService.update_customized_pipeline_template(template_id, pipeline_template_info)
-        return "", 204
+        return 200

-    @console_ns.response(204, "Pipeline template deleted")
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
-    def delete(self, template_id: str) -> tuple[str, int]:
+    def delete(self, template_id: str):
        RagPipelineService.delete_customized_pipeline_template(template_id)
-        return "", 204
+        return 200

    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
    @console_ns.response(200, "Success", console_ns.models[SimpleDataResponse.__name__])
-    def post(self, template_id: str) -> JsonResponseWithStatus:
+    def post(self, template_id: str):
        with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
            template = session.scalar(
                select(PipelineCustomizedTemplate).where(PipelineCustomizedTemplate.id == template_id).limit(1)
@@ -156,20 +96,19 @@ class CustomizedPipelineTemplateApi(Resource):
            if not template:
                raise ValueError("Customized pipeline template not found.")

-        return dump_response(SimpleDataResponse, {"data": template.yaml_content}), 200
+        return {"data": template.yaml_content}, 200


@console_ns.route("/rag/pipelines/<string:pipeline_id>/customized/publish")
 class PublishCustomizedPipelineTemplateApi(Resource):
-    @console_ns.expect(console_ns.models[CustomizedPipelineTemplatePayload.__name__])
-    @console_ns.response(204, "Pipeline template published")
+    @console_ns.expect(console_ns.models[Payload.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @enterprise_license_required
    @knowledge_pipeline_publish_enabled
-    def post(self, pipeline_id: str) -> tuple[str, int]:
-        payload = CustomizedPipelineTemplatePayload.model_validate(console_ns.payload or {})
+    def post(self, pipeline_id: str):
+        payload = Payload.model_validate(console_ns.payload or {})
        rag_pipeline_service = RagPipelineService()
        rag_pipeline_service.publish_customized_pipeline_template(pipeline_id, payload.model_dump())
-        return "", 204
+        return {"result": "success"}
@@ -1,25 +1,20 @@
-from flask_restx import Resource
+from flask_restx import Resource, marshal
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
 from werkzeug.exceptions import Forbidden

 import services
-from controllers.common.schema import JsonResponseWithStatus, register_response_schema_models, register_schema_models
+from controllers.common.schema import register_schema_model
 from controllers.console import console_ns
 from controllers.console.datasets.error import DatasetNameDuplicateError
-from controllers.console.datasets.rag_pipeline.rag_pipeline_import import RagPipelineImportResponse
 from controllers.console.wraps import (
    account_initialization_required,
    cloud_edition_billing_rate_limit_check,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
 )
 from extensions.ext_database import db
-from fields.dataset_fields import DatasetDetailResponse
-from libs.helper import dump_response
-from libs.login import login_required
-from models import Account
+from fields.dataset_fields import dataset_detail_fields
+from libs.login import current_account_with_tenant, login_required
 from models.dataset import DatasetPermissionEnum
 from services.dataset_service import DatasetPermissionService, DatasetService
 from services.entities.knowledge_entities.rag_pipeline_entities import IconInfo, RagPipelineDatasetCreateEntity
@@ -30,26 +25,19 @@ class RagPipelineDatasetImportPayload(BaseModel):
    yaml_content: str


-register_schema_models(console_ns, RagPipelineDatasetImportPayload)
-register_response_schema_models(console_ns, DatasetDetailResponse, RagPipelineImportResponse)
+register_schema_model(console_ns, RagPipelineDatasetImportPayload)


@console_ns.route("/rag/pipeline/dataset")
 class CreateRagPipelineDatasetApi(Resource):
    @console_ns.expect(console_ns.models[RagPipelineDatasetImportPayload.__name__])
-    @console_ns.response(
-        201,
-        "RAG pipeline dataset import started",
-        console_ns.models[RagPipelineImportResponse.__name__],
-    )
    @setup_required
    @login_required
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account) -> JsonResponseWithStatus:
+    def post(self):
        payload = RagPipelineDatasetImportPayload.model_validate(console_ns.payload or {})
+        current_user, current_tenant_id = current_account_with_tenant()
        # The role of the current user in the ta table must be admin, owner, or editor, or dataset_operator
        if not current_user.is_dataset_editor:
            raise Forbidden()
@@ -82,20 +70,19 @@ class CreateRagPipelineDatasetApi(Resource):
        except services.errors.dataset.DatasetNameDuplicateError:
            raise DatasetNameDuplicateError()

-        return dump_response(RagPipelineImportResponse, import_info), 201
+        return import_info, 201


@console_ns.route("/rag/pipeline/empty-dataset")
 class CreateEmptyRagPipelineDatasetApi(Resource):
-    @console_ns.response(201, "RAG pipeline dataset created", console_ns.models[DatasetDetailResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @cloud_edition_billing_rate_limit_check("knowledge")
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account) -> JsonResponseWithStatus:
+    def post(self):
        # The role of the current user in the ta table must be admin, owner, or editor, or dataset_operator
+        current_user, current_tenant_id = current_account_with_tenant()
+
        if not current_user.is_dataset_editor:
            raise Forbidden()
        dataset = DatasetService.create_empty_rag_pipeline_dataset(
@@ -112,4 +99,4 @@ class CreateEmptyRagPipelineDatasetApi(Resource):
                partial_member_list=None,
            ),
        )
-        return dump_response(DatasetDetailResponse, dataset), 201
+        return marshal(dataset, dataset_detail_fields), 201
@@ -1,7 +1,6 @@
 import logging
 from collections.abc import Callable
-from functools import wraps
-from typing import Any, Concatenate, NoReturn
+from typing import Any, NoReturn
 from uuid import UUID

 from flask import Response, request
@@ -22,7 +21,7 @@ from controllers.console.app.workflow_draft_variable import (
    workflow_draft_variable_model,
 )
 from controllers.console.datasets.wraps import get_rag_pipeline
-from controllers.console.wraps import account_initialization_required, setup_required, with_current_user
+from controllers.console.wraps import account_initialization_required, setup_required
 from controllers.web.error import InvalidArgumentError, NotFoundError
 from core.app.file_access import DatabaseFileAccessController
 from core.workflow.variable_prefixes import CONVERSATION_VARIABLE_NODE_ID, SYSTEM_VARIABLE_NODE_ID
@@ -30,7 +29,7 @@ from extensions.ext_database import db
 from factories.file_factory import build_from_mapping, build_from_mappings
 from factories.variable_factory import build_segment_with_type
 from graphon.variables.types import SegmentType
-from libs.login import login_required
+from libs.login import current_user, login_required
 from models import Account
 from models.dataset import Pipeline
 from services.rag_pipeline.rag_pipeline import RagPipelineService
@@ -58,9 +57,7 @@ class WorkflowDraftVariablePatchPayload(BaseModel):
 register_schema_models(console_ns, WorkflowDraftVariablePatchPayload)


-def _api_prerequisite[T, **P, R](
-    f: Callable[Concatenate[T, Account, P], R],
-) -> Callable[Concatenate[T, P], R | Response]:
+def _api_prerequisite[**P, R](f: Callable[P, R]) -> Callable[P, R | Response]:
    """Common prerequisites for all draft workflow variable APIs.

    It ensures the following conditions are satisfied:
@@ -75,12 +72,10 @@ def _api_prerequisite[T, **P, R](
    @login_required
    @account_initialization_required
    @get_rag_pipeline
-    @with_current_user
-    @wraps(f)
-    def wrapper(self: T, current_user: Account, *args: P.args, **kwargs: P.kwargs) -> R | Response:
-        if not current_user.has_edit_permission:
+    def wrapper(*args: P.args, **kwargs: P.kwargs) -> R | Response:
+        if not isinstance(current_user, Account) or not current_user.has_edit_permission:
            raise Forbidden()
-        return f(self, current_user, *args, **kwargs)
+        return f(*args, **kwargs)

    return wrapper

@@ -89,7 +84,7 @@ def _api_prerequisite[T, **P, R](
 class RagPipelineVariableCollectionApi(Resource):
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_without_value_model)
-    def get(self, current_user: Account, pipeline: Pipeline):
+    def get(self, pipeline: Pipeline):
        """
        Get draft workflow
        """
@@ -117,7 +112,7 @@ class RagPipelineVariableCollectionApi(Resource):
        return workflow_vars

    @_api_prerequisite
-    def delete(self, current_user: Account, pipeline: Pipeline):
+    def delete(self, pipeline: Pipeline):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -148,7 +143,7 @@ def validate_node_id(node_id: str) -> NoReturn | None:
 class RagPipelineNodeVariableCollectionApi(Resource):
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, pipeline: Pipeline, node_id: str):
+    def get(self, pipeline: Pipeline, node_id: str):
        validate_node_id(node_id)
        with sessionmaker(bind=db.engine, expire_on_commit=False).begin() as session:
            draft_var_srv = WorkflowDraftVariableService(
@@ -159,7 +154,7 @@ class RagPipelineNodeVariableCollectionApi(Resource):
        return node_vars

    @_api_prerequisite
-    def delete(self, current_user: Account, pipeline: Pipeline, node_id: str):
+    def delete(self, pipeline: Pipeline, node_id: str):
        validate_node_id(node_id)
        srv = WorkflowDraftVariableService(db.session())
        srv.delete_node_variables(pipeline.id, node_id, user_id=current_user.id)
@@ -174,7 +169,7 @@ class RagPipelineVariableApi(Resource):

    @_api_prerequisite
    @marshal_with(workflow_draft_variable_model)
-    def get(self, _current_user: Account, pipeline: Pipeline, variable_id: UUID):
+    def get(self, pipeline: Pipeline, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -189,7 +184,7 @@ class RagPipelineVariableApi(Resource):
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_model)
    @console_ns.expect(console_ns.models[WorkflowDraftVariablePatchPayload.__name__])
-    def patch(self, _current_user: Account, pipeline: Pipeline, variable_id: UUID):
+    def patch(self, pipeline: Pipeline, variable_id: UUID):
        # Request payload for file types:
        #
        # Local File:
@@ -258,7 +253,7 @@ class RagPipelineVariableApi(Resource):
        return variable

    @_api_prerequisite
-    def delete(self, _current_user: Account, pipeline: Pipeline, variable_id: UUID):
+    def delete(self, pipeline: Pipeline, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -276,7 +271,7 @@ class RagPipelineVariableApi(Resource):
@console_ns.route("/rag/pipelines/<uuid:pipeline_id>/workflows/draft/variables/<uuid:variable_id>/reset")
 class RagPipelineVariableResetApi(Resource):
    @_api_prerequisite
-    def put(self, _current_user: Account, pipeline: Pipeline, variable_id: UUID):
+    def put(self, pipeline: Pipeline, variable_id: UUID):
        draft_var_srv = WorkflowDraftVariableService(
            session=db.session(),
        )
@@ -302,17 +297,17 @@ class RagPipelineVariableResetApi(Resource):
            return marshal(resetted, _WORKFLOW_DRAFT_VARIABLE_FIELDS)


-def _get_variable_list(pipeline: Pipeline, node_id: str, current_user_id: str) -> WorkflowDraftVariableList:
+def _get_variable_list(pipeline: Pipeline, node_id) -> WorkflowDraftVariableList:
    with sessionmaker(bind=db.engine, expire_on_commit=False).begin() as session:
        draft_var_srv = WorkflowDraftVariableService(
            session=session,
        )
        if node_id == CONVERSATION_VARIABLE_NODE_ID:
-            draft_vars = draft_var_srv.list_conversation_variables(pipeline.id, user_id=current_user_id)
+            draft_vars = draft_var_srv.list_conversation_variables(pipeline.id, user_id=current_user.id)
        elif node_id == SYSTEM_VARIABLE_NODE_ID:
-            draft_vars = draft_var_srv.list_system_variables(pipeline.id, user_id=current_user_id)
+            draft_vars = draft_var_srv.list_system_variables(pipeline.id, user_id=current_user.id)
        else:
-            draft_vars = draft_var_srv.list_node_variables(app_id=pipeline.id, node_id=node_id, user_id=current_user_id)
+            draft_vars = draft_var_srv.list_node_variables(app_id=pipeline.id, node_id=node_id, user_id=current_user.id)
    return draft_vars


@@ -320,14 +315,14 @@ def _get_variable_list(pipeline: Pipeline, node_id: str, current_user_id: str) -
 class RagPipelineSystemVariableCollectionApi(Resource):
    @_api_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, pipeline: Pipeline):
-        return _get_variable_list(pipeline, SYSTEM_VARIABLE_NODE_ID, current_user.id)
+    def get(self, pipeline: Pipeline):
+        return _get_variable_list(pipeline, SYSTEM_VARIABLE_NODE_ID)


@console_ns.route("/rag/pipelines/<uuid:pipeline_id>/workflows/draft/environment-variables")
 class RagPipelineEnvironmentVariableCollectionApi(Resource):
    @_api_prerequisite
-    def get(self, _current_user: Account, pipeline: Pipeline):
+    def get(self, pipeline: Pipeline):
        """
        Get draft workflow
        """
@@ -1,15 +1,9 @@
 from flask import request
-from flask_restx import Resource
+from flask_restx import Resource, fields, marshal_with  # type: ignore
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session

-from controllers.common.fields import SimpleDataResponse
-from controllers.common.schema import (
-    JsonResponseWithStatus,
-    query_params_from_model,
-    register_response_schema_models,
-    register_schema_models,
-)
+from controllers.common.schema import get_or_create_model, register_schema_models
 from controllers.console import console_ns
 from controllers.console.datasets.wraps import get_rag_pipeline
 from controllers.console.wraps import (
@@ -18,10 +12,12 @@ from controllers.console.wraps import (
    setup_required,
    with_current_user,
 )
-from core.plugin.entities.plugin import PluginDependency
 from extensions.ext_database import db
-from fields.base import ResponseModel
-from libs.helper import dump_response
+from fields.rag_pipeline_fields import (
+    leaked_dependency_fields,
+    pipeline_import_check_dependencies_fields,
+    pipeline_import_fields,
+)
 from libs.login import login_required
 from models.account import Account
 from models.dataset import Pipeline
@@ -42,44 +38,34 @@ class RagPipelineImportPayload(BaseModel):


 class IncludeSecretQuery(BaseModel):
-    include_secret: str = Field(default="false", description="Whether to include secret values in the exported DSL")
-
-
-class RagPipelineImportResponse(ResponseModel):
-    id: str
-    status: ImportStatus
-    pipeline_id: str | None = None
-    dataset_id: str | None = None
-    current_dsl_version: str
-    imported_dsl_version: str
-    error: str = ""
-
-
-class RagPipelineImportCheckDependenciesResponse(ResponseModel):
-    leaked_dependencies: list[PluginDependency] = Field(default_factory=list)
+    include_secret: str = Field(default="false")


 register_schema_models(console_ns, RagPipelineImportPayload, IncludeSecretQuery)
-register_response_schema_models(
-    console_ns,
-    RagPipelineImportCheckDependenciesResponse,
-    RagPipelineImportResponse,
-    SimpleDataResponse,
+
+
+pipeline_import_model = get_or_create_model("RagPipelineImport", pipeline_import_fields)
+
+leaked_dependency_model = get_or_create_model("RagPipelineLeakedDependency", leaked_dependency_fields)
+pipeline_import_check_dependencies_fields_copy = pipeline_import_check_dependencies_fields.copy()
+pipeline_import_check_dependencies_fields_copy["leaked_dependencies"] = fields.List(
+    fields.Nested(leaked_dependency_model)
+)
+pipeline_import_check_dependencies_model = get_or_create_model(
+    "RagPipelineImportCheckDependencies", pipeline_import_check_dependencies_fields_copy
 )


@console_ns.route("/rag/pipelines/imports")
 class RagPipelineImportApi(Resource):
-    @console_ns.expect(console_ns.models[RagPipelineImportPayload.__name__])
-    @console_ns.response(200, "Import completed", console_ns.models[RagPipelineImportResponse.__name__])
-    @console_ns.response(202, "Import pending confirmation", console_ns.models[RagPipelineImportResponse.__name__])
-    @console_ns.response(400, "Import failed", console_ns.models[RagPipelineImportResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @edit_permission_required
+    @marshal_with(pipeline_import_model)
+    @console_ns.expect(console_ns.models[RagPipelineImportPayload.__name__])
    @with_current_user
-    def post(self, current_user: Account) -> JsonResponseWithStatus:
+    def post(self, current_user: Account):
        # Check user role first
        payload = RagPipelineImportPayload.model_validate(console_ns.payload or {})

@@ -107,23 +93,22 @@ class RagPipelineImportApi(Resource):
        status = result.status
        match status:
            case ImportStatus.FAILED:
-                return dump_response(RagPipelineImportResponse, result), 400
+                return result.model_dump(mode="json"), 400
            case ImportStatus.PENDING:
-                return dump_response(RagPipelineImportResponse, result), 202
+                return result.model_dump(mode="json"), 202
            case ImportStatus.COMPLETED | ImportStatus.COMPLETED_WITH_WARNINGS:
-                return dump_response(RagPipelineImportResponse, result), 200
+                return result.model_dump(mode="json"), 200


@console_ns.route("/rag/pipelines/imports/<string:import_id>/confirm")
 class RagPipelineImportConfirmApi(Resource):
-    @console_ns.response(200, "Import confirmed", console_ns.models[RagPipelineImportResponse.__name__])
-    @console_ns.response(400, "Import failed", console_ns.models[RagPipelineImportResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @edit_permission_required
+    @marshal_with(pipeline_import_model)
    @with_current_user
-    def post(self, current_user: Account, import_id: str) -> JsonResponseWithStatus:
+    def post(self, current_user: Account, import_id: str):
        with Session(db.engine, expire_on_commit=False) as session:
            import_service = RagPipelineDslService(session)
            account = current_user
@@ -135,40 +120,34 @@ class RagPipelineImportConfirmApi(Resource):

        # Return appropriate status code based on result
        if result.status == ImportStatus.FAILED:
-            return dump_response(RagPipelineImportResponse, result), 400
-        return dump_response(RagPipelineImportResponse, result), 200
+            return result.model_dump(mode="json"), 400
+        return result.model_dump(mode="json"), 200


@console_ns.route("/rag/pipelines/imports/<string:pipeline_id>/check-dependencies")
 class RagPipelineImportCheckDependenciesApi(Resource):
-    @console_ns.response(
-        200,
-        "Dependencies checked",
-        console_ns.models[RagPipelineImportCheckDependenciesResponse.__name__],
-    )
    @setup_required
    @login_required
    @get_rag_pipeline
    @account_initialization_required
    @edit_permission_required
-    def get(self, pipeline: Pipeline) -> JsonResponseWithStatus:
+    @marshal_with(pipeline_import_check_dependencies_model)
+    def get(self, pipeline: Pipeline):
        with Session(db.engine, expire_on_commit=False) as session:
            import_service = RagPipelineDslService(session)
            result = import_service.check_dependencies(pipeline=pipeline)

-        return dump_response(RagPipelineImportCheckDependenciesResponse, result), 200
+        return result.model_dump(mode="json"), 200


@console_ns.route("/rag/pipelines/<string:pipeline_id>/exports")
 class RagPipelineExportApi(Resource):
-    @console_ns.doc(params=query_params_from_model(IncludeSecretQuery))
-    @console_ns.response(200, "Pipeline exported", console_ns.models[SimpleDataResponse.__name__])
    @setup_required
    @login_required
    @get_rag_pipeline
    @account_initialization_required
    @edit_permission_required
-    def get(self, pipeline: Pipeline) -> JsonResponseWithStatus:
+    def get(self, pipeline: Pipeline):
        # Add include_secret params
        query = IncludeSecretQuery.model_validate(request.args.to_dict())

@@ -178,4 +157,4 @@ class RagPipelineExportApi(Resource):
                pipeline=pipeline, include_secret=query.include_secret == "true"
            )

-        return dump_response(SimpleDataResponse, {"data": result}), 200
+        return {"data": result}, 200
@@ -18,7 +18,6 @@ from controllers.console.app.error import (
 )
 from controllers.console.explore.error import NotChatAppError, NotCompletionAppError
 from controllers.console.explore.wraps import InstalledAppResource
-from controllers.console.wraps import with_current_user_id
 from controllers.web.error import InvokeRateLimitError as InvokeRateLimitHttpError
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.errors.error import (
@@ -136,18 +135,20 @@ class CompletionApi(InstalledAppResource):
 )
 class CompletionStopApi(InstalledAppResource):
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_user_id
-    def post(self, current_user_id: str, installed_app: InstalledApp, task_id: str):
+    def post(self, installed_app: InstalledApp, task_id: str):
        app_model = installed_app.app
        if app_model is None:
            raise AppUnavailableError()
        if app_model.mode != AppMode.COMPLETION:
            raise NotCompletionAppError()

+        if not isinstance(current_user, Account):
+            raise ValueError("current_user must be an Account instance")
+
        AppTaskService.stop_task(
            task_id=task_id,
            invoke_from=InvokeFrom.EXPLORE,
-            user_id=current_user_id,
+            user_id=current_user.id,
            app_mode=AppMode.value_of(app_model.mode),
        )

@@ -214,8 +215,7 @@ class ChatApi(InstalledAppResource):
 )
 class ChatStopApi(InstalledAppResource):
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
-    @with_current_user_id
-    def post(self, current_user_id: str, installed_app: InstalledApp, task_id: str):
+    def post(self, installed_app: InstalledApp, task_id: str):
        app_model = installed_app.app
        if app_model is None:
            raise AppUnavailableError()
@@ -223,10 +223,13 @@ class ChatStopApi(InstalledAppResource):
        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

+        if not isinstance(current_user, Account):
+            raise ValueError("current_user must be an Account instance")
+
        AppTaskService.stop_task(
            task_id=task_id,
            invoke_from=InvokeFrom.EXPLORE,
-            user_id=current_user_id,
+            user_id=current_user.id,
            app_mode=app_mode,
        )

@@ -12,19 +12,14 @@ from controllers.common.fields import SimpleMessageResponse, SimpleResultMessage
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.explore.wraps import InstalledAppResource
-from controllers.console.wraps import (
-    account_initialization_required,
-    cloud_edition_billing_resource_check,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, cloud_edition_billing_resource_check
 from extensions.ext_database import db
 from fields.base import ResponseModel
 from graphon.file import helpers as file_helpers
 from libs.datetime_utils import naive_utc_now
 from libs.helper import to_timestamp
-from libs.login import login_required
-from models import Account, App, InstalledApp, RecommendedApp
+from libs.login import current_account_with_tenant, login_required
+from models import App, InstalledApp, RecommendedApp
 from models.model import IconType
 from services.account_service import TenantService
 from services.enterprise.enterprise_service import EnterpriseService
@@ -136,10 +131,9 @@ class InstalledAppsListApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[InstalledAppListResponse.__name__])
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
+    def get(self):
        query = InstalledAppsListQuery.model_validate(request.args.to_dict())
+        current_user, current_tenant_id = current_account_with_tenant()

        if query.app_id:
            installed_apps = db.session.scalars(
@@ -155,28 +149,19 @@ class InstalledAppsListApi(Resource):
        if current_user.current_tenant is None:
            raise ValueError("current_user.current_tenant must not be None")
        current_user.role = TenantService.get_user_role(current_user, current_user.current_tenant)
-
-        app_ids = [installed_app.app_id for installed_app in installed_apps]
-        apps = db.session.scalars(select(App).where(App.id.in_(app_ids))).all() if app_ids else []
-        apps_by_id = {app.id: app for app in apps}
-
-        installed_app_list: list[dict[str, Any]] = []
-        for installed_app in installed_apps:
-            app_model = apps_by_id.get(installed_app.app_id)
-            if app_model is None:
-                continue
-
-            installed_app_list.append(
-                {
-                    "id": installed_app.id,
-                    "app": app_model,
-                    "app_owner_tenant_id": installed_app.app_owner_tenant_id,
-                    "is_pinned": installed_app.is_pinned,
-                    "last_used_at": installed_app.last_used_at,
-                    "editable": current_user.role in {"owner", "admin"},
-                    "uninstallable": current_tenant_id == installed_app.app_owner_tenant_id,
-                }
-            )
+        installed_app_list: list[dict[str, Any]] = [
+            {
+                "id": installed_app.id,
+                "app": installed_app.app,
+                "app_owner_tenant_id": installed_app.app_owner_tenant_id,
+                "is_pinned": installed_app.is_pinned,
+                "last_used_at": installed_app.last_used_at,
+                "editable": current_user.role in {"owner", "admin"},
+                "uninstallable": current_tenant_id == installed_app.app_owner_tenant_id,
+            }
+            for installed_app in installed_apps
+            if installed_app.app is not None
+        ]

        # filter out apps that user doesn't have access to
        if FeatureService.get_system_features().webapp_auth.enabled:
@@ -227,8 +212,7 @@ class InstalledAppsListApi(Resource):
    @account_initialization_required
    @cloud_edition_billing_resource_check("apps")
    @console_ns.response(200, "Success", console_ns.models[SimpleMessageResponse.__name__])
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str):
+    def post(self):
        payload = InstalledAppCreatePayload.model_validate(console_ns.payload or {})

        recommended_app = db.session.scalar(
@@ -237,6 +221,8 @@ class InstalledAppsListApi(Resource):
        if recommended_app is None:
            raise NotFound("Recommended app not found")

+        _, current_tenant_id = current_account_with_tenant()
+
        app = db.session.get(App, payload.app_id)

        if app is None:
@@ -276,8 +262,8 @@ class InstalledAppApi(InstalledAppResource):
    """

    @console_ns.response(204, "App uninstalled successfully")
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, installed_app: InstalledApp):
+    def delete(self, installed_app: InstalledApp):
+        _, current_tenant_id = current_account_with_tenant()
        if installed_app.app_owner_tenant_id == current_tenant_id:
            raise BadRequest("You can't uninstall an app owned by the current tenant")

@@ -8,11 +8,10 @@ from pydantic import BaseModel, Field, computed_field, field_validator
 from constants.languages import languages
 from controllers.common.schema import query_params_from_model, register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import account_initialization_required, with_current_user
+from controllers.console.wraps import account_initialization_required
 from fields.base import ResponseModel
 from libs.helper import build_icon_url
-from libs.login import login_required
-from models import Account
+from libs.login import current_user, login_required
 from services.recommended_app_service import RecommendedAppService


@@ -65,39 +64,31 @@ class RecommendedAppListResponse(ResponseModel):
    categories: list[str]


-class LearnDifyAppListResponse(ResponseModel):
-    recommended_apps: list[RecommendedAppResponse]
-
-
 register_schema_models(
    console_ns,
    RecommendedAppsQuery,
    RecommendedAppInfoResponse,
    RecommendedAppResponse,
    RecommendedAppListResponse,
-    LearnDifyAppListResponse,
 )


-def _resolve_language(language: str | None, user: Account) -> str:
-    if language and language in languages:
-        return language
-    if user.interface_language:
-        return user.interface_language
-    return languages[0]
-
-
@console_ns.route("/explore/apps")
 class RecommendedAppListApi(Resource):
    @console_ns.doc(params=query_params_from_model(RecommendedAppsQuery))
    @console_ns.response(200, "Success", console_ns.models[RecommendedAppListResponse.__name__])
    @login_required
    @account_initialization_required
-    @with_current_user
-    def get(self, current_user: Account):
+    def get(self):
        # language args
        args = RecommendedAppsQuery.model_validate(request.args.to_dict(flat=True))
-        language_prefix = _resolve_language(args.language, current_user)
+        language = args.language
+        if language and language in languages:
+            language_prefix = language
+        elif current_user and current_user.interface_language:
+            language_prefix = current_user.interface_language
+        else:
+            language_prefix = languages[0]

        return RecommendedAppListResponse.model_validate(
            RecommendedAppService.get_recommended_apps_and_categories(language_prefix),
@@ -105,23 +96,6 @@ class RecommendedAppListApi(Resource):
        ).model_dump(mode="json")


-@console_ns.route("/explore/apps/learn-dify")
-class LearnDifyAppListApi(Resource):
-    @console_ns.doc(params=query_params_from_model(RecommendedAppsQuery))
-    @console_ns.response(200, "Success", console_ns.models[LearnDifyAppListResponse.__name__])
-    @login_required
-    @account_initialization_required
-    @with_current_user
-    def get(self, current_user: Account):
-        args = RecommendedAppsQuery.model_validate(request.args.to_dict(flat=True))
-        language_prefix = _resolve_language(args.language, current_user)
-
-        return LearnDifyAppListResponse.model_validate(
-            RecommendedAppService.get_learn_dify_apps(language_prefix),
-            from_attributes=True,
-        ).model_dump(mode="json")
-
-
@console_ns.route("/explore/apps/<uuid:app_id>")
 class RecommendedAppApi(Resource):
    @login_required
@@ -14,13 +14,7 @@ from sqlalchemy.orm import Session, sessionmaker
 from controllers.common.human_input import HumanInputFormSubmitPayload
 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    model_validate,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, model_validate, setup_required
 from controllers.web.error import InvalidArgumentError, NotFoundError
 from core.app.apps.advanced_chat.app_generator import AdvancedChatAppGenerator
 from core.app.apps.base_app_generator import BaseAppGenerator
@@ -29,8 +23,8 @@ from core.app.apps.message_generator import MessageGenerator
 from core.app.apps.workflow.app_generator import WorkflowAppGenerator
 from core.workflow.human_input_policy import HumanInputSurface, is_recipient_type_allowed_for_surface
 from extensions.ext_database import db
-from libs.login import login_required
-from models import Account, App
+from libs.login import current_account_with_tenant, login_required
+from models import App
 from models.enums import CreatorUserRole
 from models.model import AppMode
 from models.workflow import WorkflowRun
@@ -54,8 +48,9 @@ class ConsoleHumanInputFormApi(Resource):
    """Console API for getting human input form definition."""

    @staticmethod
-    def _ensure_console_access(form: Form, current_tenant_id: str) -> None:
-        """Ensure a console form token resolves only inside the current tenant."""
+    def _ensure_console_access(form: Form):
+        _, current_tenant_id = current_account_with_tenant()
+
        if form.tenant_id != current_tenant_id:
            raise NotFoundError("App not found")

@@ -67,8 +62,7 @@ class ConsoleHumanInputFormApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, form_token: str):
+    def get(self, form_token: str):
        """
        Get human input form definition by form token.

@@ -79,23 +73,15 @@ class ConsoleHumanInputFormApi(Resource):
        if form is None:
            raise NotFoundError(f"form not found, token={form_token}")

-        self._ensure_console_access(form, current_tenant_id)
+        self._ensure_console_access(form)

        return _jsonify_form_definition(form)

    @account_initialization_required
    @login_required
-    @with_current_user
-    @with_current_tenant_id
    @model_validate(HumanInputFormSubmitPayload)
    @console_ns.expect(console_ns.models[HumanInputFormSubmitPayload.__name__])
-    def post(
-        self,
-        payload: HumanInputFormSubmitPayload,
-        current_tenant_id: str,
-        current_user: Account,
-        form_token: str,
-    ):
+    def post(self, payload: HumanInputFormSubmitPayload, form_token: str):
        """
        Submit human input form by form token.

@@ -109,12 +95,14 @@ class ConsoleHumanInputFormApi(Resource):
            "action": "Approve"
        }
        """
+        current_user, _ = current_account_with_tenant()
+
        service = HumanInputService(db.engine)
        form = service.get_form_by_token(form_token)
        if form is None:
            raise NotFoundError(f"form not found, token={form_token}")

-        self._ensure_console_access(form, current_tenant_id)
+        self._ensure_console_access(form)
        self._ensure_console_recipient_type(form)
        recipient_type = form.recipient_type
        # The type checker is not smart enought to validate the following invariant.
@@ -138,9 +126,7 @@ class ConsoleWorkflowEventsApi(Resource):

    @account_initialization_required
    @login_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, tenant_id: str, user: Account, workflow_run_id: str):
+    def get(self, workflow_run_id: str):
        """
        Get workflow execution events stream after resume.

@@ -148,6 +134,8 @@ class ConsoleWorkflowEventsApi(Resource):

        Returns Server-Sent Events stream.
        """
+
+        user, tenant_id = current_account_with_tenant()
        session_maker = sessionmaker(db.engine)
        repo = DifyAPIRepositoryFactory.create_api_workflow_run_repository(session_maker)
        workflow_run = repo.get_workflow_run_by_id_and_tenant_id(
@@ -13,7 +13,7 @@ from controllers.common.errors import (
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import with_current_user
-from core.file import remote_fetcher
+from core.helper import ssrf_proxy
 from extensions.ext_database import db
 from fields.file_fields import FileWithSignedUrl, RemoteFileInfo
 from graphon.file import helpers as file_helpers
@@ -36,9 +36,9 @@ class GetRemoteFileInfo(Resource):
    @login_required
    def get(self, url: str):
        decoded_url = helpers.decode_remote_url(url, request.query_string)
-        resp = remote_fetcher.make_request("HEAD", decoded_url)
+        resp = ssrf_proxy.head(decoded_url)
        if resp.status_code != httpx.codes.OK:
-            resp = remote_fetcher.make_request("GET", decoded_url, timeout=3)
+            resp = ssrf_proxy.get(decoded_url, timeout=3)
        resp.raise_for_status()
        return RemoteFileInfo(
            file_type=resp.headers.get("Content-Type", "application/octet-stream"),
@@ -58,9 +58,9 @@ class RemoteFileUpload(Resource):

        # Try to fetch remote file metadata/content first
        try:
-            resp = remote_fetcher.make_request("HEAD", url=url)
+            resp = ssrf_proxy.head(url=url)
            if resp.status_code != httpx.codes.OK:
-                resp = remote_fetcher.make_request("GET", url=url, timeout=3, follow_redirects=True)
+                resp = ssrf_proxy.get(url=url, timeout=3, follow_redirects=True)
            if resp.status_code != httpx.codes.OK:
                # Normalize into a user-friendly error message expected by tests
                raise RemoteFileUploadError(f"Failed to fetch file from {url}: {resp.text}")
@@ -74,7 +74,7 @@ class RemoteFileUpload(Resource):
            raise FileTooLargeError()

        # Load content if needed
-        content = resp.content if resp.request.method == "GET" else remote_fetcher.make_request("GET", url).content
+        content = resp.content if resp.request.method == "GET" else ssrf_proxy.get(url).content

        try:
            upload_file = FileService(db.engine).upload_file(
@@ -1,7 +1,7 @@
 import uuid
 from typing import Any, Literal

-from pydantic import AliasChoices, BaseModel, Field, field_validator
+from pydantic import BaseModel, Field, field_validator


 class SnippetListQuery(BaseModel):
@@ -11,11 +11,7 @@ class SnippetListQuery(BaseModel):
    limit: int = Field(default=20, ge=1, le=100)
    keyword: str | None = None
    is_published: bool | None = Field(default=None, description="Filter by published status")
-    creators: list[str] | None = Field(
-        default=None,
-        description="Filter by creator account IDs",
-        validation_alias=AliasChoices("creators", "creator_id"),
-    )
+    creators: list[str] | None = Field(default=None, description="Filter by creator account IDs")
    tag_ids: list[str] | None = Field(default=None, description="Filter by tag IDs")

    @field_validator("creators", mode="before")
@@ -1,11 +1,12 @@
 import logging
 from collections.abc import Callable
 from functools import wraps
+from typing import ParamSpec, TypeVar

 from flask import request
 from flask_restx import Resource
 from pydantic import Field
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session
 from werkzeug.exceptions import BadRequest, InternalServerError, NotFound

 from controllers.common.schema import register_response_schema_models, register_schema_models
@@ -52,17 +53,10 @@ from services.snippet_service import SnippetService

 logger = logging.getLogger(__name__)

+P = ParamSpec("P")
+R = TypeVar("R")
+
 # Register Pydantic models with Swagger
-
-
-def _snippet_session_maker() -> sessionmaker[Session]:
-    return sessionmaker(bind=db.engine, expire_on_commit=False)
-
-
-def _snippet_service() -> SnippetService:
-    return SnippetService(_snippet_session_maker())
-
-
 class SnippetWorkflowResponse(WorkflowResponse):
    input_fields: list[dict] = Field(default_factory=list)

@@ -95,11 +89,11 @@ class SnippetNotFoundError(Exception):
    pass


-def get_snippet[**P, R](view_func: Callable[P, R]) -> Callable[P, R]:
+def get_snippet(view_func: Callable[P, R]):
    """Decorator to fetch and validate snippet access."""

    @wraps(view_func)
-    def decorated_view(*args: P.args, **kwargs: P.kwargs) -> R:
+    def decorated_view(*args: P.args, **kwargs: P.kwargs):
        if not kwargs.get("snippet_id"):
            raise ValueError("missing snippet_id in path parameters")

@@ -108,8 +102,7 @@ def get_snippet[**P, R](view_func: Callable[P, R]) -> Callable[P, R]:
        snippet_id = str(kwargs.get("snippet_id"))
        del kwargs["snippet_id"]

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=snippet_id,
            tenant_id=current_tenant_id,
        )
@@ -127,11 +120,7 @@ def get_snippet[**P, R](view_func: Callable[P, R]) -> Callable[P, R]:
@console_ns.route("/snippets/<uuid:snippet_id>/workflows/draft")
 class SnippetDraftWorkflowApi(Resource):
    @console_ns.doc("get_snippet_draft_workflow")
-    @console_ns.response(
-        200,
-        "Draft workflow retrieved successfully",
-        console_ns.models[SnippetWorkflowResponse.__name__],
-    )
+    @console_ns.response(200, "Draft workflow retrieved successfully", console_ns.models[SnippetWorkflowResponse.__name__])
    @console_ns.response(404, "Snippet or draft workflow not found")
    @setup_required
    @login_required
@@ -140,16 +129,16 @@ class SnippetDraftWorkflowApi(Resource):
    @edit_permission_required
    def get(self, snippet: CustomizedSnippet):
        """Get draft workflow for snippet."""
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        workflow = snippet_service.get_draft_workflow(snippet=snippet)

        if not workflow:
            raise DraftWorkflowNotExist()

+        db.session.expunge(workflow)
        workflow.conversation_variables = []
-        response = SnippetWorkflowResponse.model_validate(workflow, from_attributes=True).model_dump(mode="json")
-        response["input_fields"] = snippet.input_fields_list
-        return response
+        workflow.input_fields = snippet.input_fields_list
+        return SnippetWorkflowResponse.model_validate(workflow, from_attributes=True).model_dump(mode="json")

    @console_ns.doc("sync_snippet_draft_workflow")
    @console_ns.expect(console_ns.models.get(SnippetDraftSyncPayload.__name__))
@@ -167,7 +156,7 @@ class SnippetDraftWorkflowApi(Resource):
        payload = SnippetDraftSyncPayload.model_validate(console_ns.payload or {})

        try:
-            snippet_service = _snippet_service()
+            snippet_service = SnippetService()
            workflow = snippet_service.sync_draft_workflow(
                snippet=snippet,
                graph=payload.graph,
@@ -206,11 +195,7 @@ class SnippetDraftConfigApi(Resource):
@console_ns.route("/snippets/<uuid:snippet_id>/workflows/publish")
 class SnippetPublishedWorkflowApi(Resource):
    @console_ns.doc("get_snippet_published_workflow")
-    @console_ns.response(
-        200,
-        "Published workflow retrieved successfully",
-        console_ns.models[SnippetWorkflowResponse.__name__],
-    )
+    @console_ns.response(200, "Published workflow retrieved successfully", console_ns.models[SnippetWorkflowResponse.__name__])
    @console_ns.response(404, "Snippet not found")
    @setup_required
    @login_required
@@ -222,15 +207,14 @@ class SnippetPublishedWorkflowApi(Resource):
        if not snippet.is_published:
            return None

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        workflow = snippet_service.get_published_workflow(snippet=snippet)

        if not workflow:
            return None

-        response = SnippetWorkflowResponse.model_validate(workflow, from_attributes=True).model_dump(mode="json")
-        response["input_fields"] = snippet.input_fields_list
-        return response
+        workflow.input_fields = snippet.input_fields_list
+        return SnippetWorkflowResponse.model_validate(workflow, from_attributes=True).model_dump(mode="json")

    @console_ns.doc("publish_snippet_workflow")
    @console_ns.expect(console_ns.models.get(PublishWorkflowPayload.__name__))
@@ -244,7 +228,7 @@ class SnippetPublishedWorkflowApi(Resource):
    def post(self, snippet: CustomizedSnippet):
        """Publish snippet workflow."""
        current_user, _ = current_account_with_tenant()
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()

        with Session(db.engine) as session:
            snippet = session.merge(snippet)
@@ -276,7 +260,7 @@ class SnippetDefaultBlockConfigsApi(Resource):
    @edit_permission_required
    def get(self, snippet: CustomizedSnippet):
        """Get default block configurations for snippet workflow."""
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        return snippet_service.get_default_block_configs()


@@ -286,11 +270,7 @@ class SnippetPublishedAllWorkflowApi(Resource):
    @console_ns.doc("get_all_snippet_published_workflows")
    @console_ns.doc(description="Get all published workflows for a snippet")
    @console_ns.doc(params={"snippet_id": "Snippet ID"})
-    @console_ns.response(
-        200,
-        "Published workflows retrieved successfully",
-        console_ns.models[WorkflowPaginationResponse.__name__],
-    )
+    @console_ns.response(200, "Published workflows retrieved successfully", console_ns.models[WorkflowPaginationResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
@@ -300,7 +280,7 @@ class SnippetPublishedAllWorkflowApi(Resource):
        """Get all published workflow versions for snippet."""
        args = SnippetWorkflowListQuery.model_validate(request.args.to_dict(flat=True))

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        with Session(db.engine) as session:
            workflows, has_more = snippet_service.get_all_published_workflows(
                session=session,
@@ -336,7 +316,7 @@ class SnippetDraftWorkflowRestoreApi(Resource):
    def post(self, snippet: CustomizedSnippet, workflow_id: str):
        """Restore a published snippet workflow version into the draft workflow."""
        current_user, _ = current_account_with_tenant()
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()

        try:
            workflow = snippet_service.restore_published_workflow_to_draft(
@@ -361,11 +341,7 @@ class SnippetDraftWorkflowRestoreApi(Resource):
@console_ns.route("/snippets/<uuid:snippet_id>/workflow-runs")
 class SnippetWorkflowRunsApi(Resource):
    @console_ns.doc("list_snippet_workflow_runs")
-    @console_ns.response(
-        200,
-        "Workflow runs retrieved successfully",
-        console_ns.models[WorkflowRunPaginationResponse.__name__],
-    )
+    @console_ns.response(200, "Workflow runs retrieved successfully", console_ns.models[WorkflowRunPaginationResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
@@ -383,7 +359,7 @@ class SnippetWorkflowRunsApi(Resource):
            "limit": query.limit,
        }

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        result = snippet_service.get_snippet_workflow_runs(snippet=snippet, args=args)

        return WorkflowRunPaginationResponse.model_validate(result, from_attributes=True).model_dump(mode="json")
@@ -392,11 +368,7 @@ class SnippetWorkflowRunsApi(Resource):
@console_ns.route("/snippets/<uuid:snippet_id>/workflow-runs/<uuid:run_id>")
 class SnippetWorkflowRunDetailApi(Resource):
    @console_ns.doc("get_snippet_workflow_run_detail")
-    @console_ns.response(
-        200,
-        "Workflow run detail retrieved successfully",
-        console_ns.models[WorkflowRunDetailResponse.__name__],
-    )
+    @console_ns.response(200, "Workflow run detail retrieved successfully", console_ns.models[WorkflowRunDetailResponse.__name__])
    @console_ns.response(404, "Workflow run not found")
    @setup_required
    @login_required
@@ -406,7 +378,7 @@ class SnippetWorkflowRunDetailApi(Resource):
        """Get workflow run detail for snippet."""
        run_id = str(run_id)

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        workflow_run = snippet_service.get_snippet_workflow_run(snippet=snippet, run_id=run_id)

        if not workflow_run:
@@ -431,7 +403,7 @@ class SnippetWorkflowRunNodeExecutionsApi(Resource):
        """List node executions for a workflow run."""
        run_id = str(run_id)

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        node_executions = snippet_service.get_snippet_workflow_run_node_executions(
            snippet=snippet,
            run_id=run_id,
@@ -470,7 +442,7 @@ class SnippetDraftNodeRunApi(Resource):
        user_inputs = payload.inputs

        # Get draft workflow for file parsing
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        draft_workflow = snippet_service.get_draft_workflow(snippet=snippet)
        if not draft_workflow:
            raise NotFound("Draft workflow not found")
@@ -484,7 +456,6 @@ class SnippetDraftNodeRunApi(Resource):
            account=current_user,
            query=payload.query,
            files=files,
-            session_maker=_snippet_session_maker(),
        )

        return WorkflowRunNodeExecutionResponse.model_validate(
@@ -512,7 +483,7 @@ class SnippetDraftNodeLastRunApi(Resource):
        Returns the most recent execution record for the given node,
        including status, inputs, outputs, and timing information.
        """
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        draft_workflow = snippet_service.get_draft_workflow(snippet=snippet)
        if not draft_workflow:
            raise NotFound("Draft workflow not found")
@@ -553,12 +524,7 @@ class SnippetDraftRunIterationNodeApi(Resource):

        try:
            response = SnippetGenerateService.generate_single_iteration(
-                snippet=snippet,
-                user=current_user,
-                node_id=node_id,
-                args=args,
-                streaming=True,
-                session_maker=_snippet_session_maker(),
+                snippet=snippet, user=current_user, node_id=node_id, args=args, streaming=True
            )

            return helper.compact_generate_response(response)
@@ -594,12 +560,7 @@ class SnippetDraftRunLoopNodeApi(Resource):

        try:
            response = SnippetGenerateService.generate_single_loop(
-                snippet=snippet,
-                user=current_user,
-                node_id=node_id,
-                args=args,
-                streaming=True,
-                session_maker=_snippet_session_maker(),
+                snippet=snippet, user=current_user, node_id=node_id, args=args, streaming=True
            )

            return helper.compact_generate_response(response)
@@ -640,7 +601,6 @@ class SnippetDraftWorkflowRunApi(Resource):
                args=args,
                invoke_from=InvokeFrom.DEBUGGER,
                streaming=True,
-                session_maker=_snippet_session_maker(),
            )

            return helper.compact_generate_response(response)
@@ -12,52 +12,44 @@ Other routes mirror `workflow_draft_variable` app APIs under `/snippets/...`.

 from collections.abc import Callable
 from functools import wraps
-from typing import Any, Concatenate
+from typing import Any, ParamSpec, TypeVar

 from flask import Response, request
 from flask_restx import Resource, marshal, marshal_with
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session

 from controllers.console import console_ns
 from controllers.console.app.error import DraftWorkflowNotExist
 from controllers.console.app.workflow_draft_variable import (
    WorkflowDraftVariableListQuery,
    WorkflowDraftVariableUpdatePayload,
-    ensure_variable_access,
+    _ensure_variable_access,
+    _file_access_controller,
    validate_node_id,
    workflow_draft_variable_list_model,
    workflow_draft_variable_list_without_value_model,
    workflow_draft_variable_model,
 )
 from controllers.console.snippets.snippet_workflow import get_snippet
-from controllers.console.wraps import (
-    account_initialization_required,
-    edit_permission_required,
-    setup_required,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, edit_permission_required, setup_required
 from controllers.web.error import InvalidArgumentError, NotFoundError
-from core.app.file_access import DatabaseFileAccessController
 from core.workflow.variable_prefixes import CONVERSATION_VARIABLE_NODE_ID, SYSTEM_VARIABLE_NODE_ID
 from extensions.ext_database import db
 from factories.file_factory import build_from_mapping, build_from_mappings
 from factories.variable_factory import build_segment_with_type
 from graphon.variables.types import SegmentType
-from libs.login import login_required
-from models import Account
+from libs.login import current_user, login_required
 from models.snippet import CustomizedSnippet
 from models.workflow import WorkflowDraftVariable
 from services.snippet_service import SnippetService
 from services.workflow_draft_variable_service import WorkflowDraftVariableList, WorkflowDraftVariableService

+P = ParamSpec("P")
+R = TypeVar("R")
+
 _SNIPPET_EXCLUDED_DRAFT_VARIABLE_NODE_IDS: frozenset[str] = frozenset(
    {SYSTEM_VARIABLE_NODE_ID, CONVERSATION_VARIABLE_NODE_ID}
 )
-_file_access_controller = DatabaseFileAccessController()
-
-
-def _snippet_service() -> SnippetService:
-    return SnippetService(sessionmaker(bind=db.engine, expire_on_commit=False))


 def _ensure_snippet_draft_variable_row_allowed(
@@ -70,9 +62,7 @@ def _ensure_snippet_draft_variable_row_allowed(
        raise NotFoundError(description=f"variable not found, id={variable_id}")


-def _snippet_draft_var_prerequisite[T, **P, R](
-    f: Callable[Concatenate[T, Account, P], R],
-) -> Callable[Concatenate[T, P], R | Response]:
+def _snippet_draft_var_prerequisite(f: Callable[P, R]) -> Callable[P, R]:
    """Setup, auth, snippet resolution, and tenant edit permission (same stack as snippet workflow APIs)."""

    @setup_required
@@ -80,10 +70,9 @@ def _snippet_draft_var_prerequisite[T, **P, R](
    @account_initialization_required
    @get_snippet
    @edit_permission_required
-    @with_current_user
    @wraps(f)
-    def wrapper(self: T, current_user: Account, *args: P.args, **kwargs: P.kwargs) -> R | Response:
-        return f(self, current_user, *args, **kwargs)
+    def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
+        return f(*args, **kwargs)

    return wrapper

@@ -100,10 +89,10 @@ class SnippetWorkflowVariableCollectionApi(Resource):
    )
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_list_without_value_model)
-    def get(self, current_user: Account, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
+    def get(self, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
        args = WorkflowDraftVariableListQuery.model_validate(request.args.to_dict(flat=True))  # type: ignore

-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        if snippet_service.get_draft_workflow(snippet=snippet) is None:
            raise DraftWorkflowNotExist()

@@ -123,7 +112,7 @@ class SnippetWorkflowVariableCollectionApi(Resource):
    @console_ns.doc(description="Delete all draft workflow variables for the current user (snippet scope)")
    @console_ns.response(204, "Workflow variables deleted successfully")
    @_snippet_draft_var_prerequisite
-    def delete(self, current_user: Account, snippet: CustomizedSnippet) -> Response:
+    def delete(self, snippet: CustomizedSnippet) -> Response:
        draft_var_srv = WorkflowDraftVariableService(session=db.session())
        draft_var_srv.delete_user_workflow_variables(snippet.id, user_id=current_user.id)
        db.session.commit()
@@ -137,7 +126,7 @@ class SnippetNodeVariableCollectionApi(Resource):
    @console_ns.response(200, "Node variables retrieved successfully", workflow_draft_variable_list_model)
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, current_user: Account, snippet: CustomizedSnippet, node_id: str) -> WorkflowDraftVariableList:
+    def get(self, snippet: CustomizedSnippet, node_id: str) -> WorkflowDraftVariableList:
        validate_node_id(node_id)
        with Session(bind=db.engine, expire_on_commit=False) as session:
            draft_var_srv = WorkflowDraftVariableService(session=session)
@@ -149,7 +138,7 @@ class SnippetNodeVariableCollectionApi(Resource):
    @console_ns.doc(description="Delete all variables for a specific node (snippet draft workflow)")
    @console_ns.response(204, "Node variables deleted successfully")
    @_snippet_draft_var_prerequisite
-    def delete(self, current_user: Account, snippet: CustomizedSnippet, node_id: str) -> Response:
+    def delete(self, snippet: CustomizedSnippet, node_id: str) -> Response:
        validate_node_id(node_id)
        srv = WorkflowDraftVariableService(db.session())
        srv.delete_node_variables(snippet.id, node_id, user_id=current_user.id)
@@ -165,13 +154,12 @@ class SnippetVariableApi(Resource):
    @console_ns.response(404, "Variable not found")
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_model)
-    def get(self, current_user: Account, snippet: CustomizedSnippet, variable_id: str) -> WorkflowDraftVariable:
+    def get(self, snippet: CustomizedSnippet, variable_id: str) -> WorkflowDraftVariable:
        draft_var_srv = WorkflowDraftVariableService(session=db.session())
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id),
            app_id=snippet.id,
            variable_id=variable_id,
-            current_user_id=current_user.id,
        )
        _ensure_snippet_draft_variable_row_allowed(variable=variable, variable_id=variable_id)
        return variable
@@ -183,15 +171,14 @@ class SnippetVariableApi(Resource):
    @console_ns.response(404, "Variable not found")
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_model)
-    def patch(self, current_user: Account, snippet: CustomizedSnippet, variable_id: str) -> WorkflowDraftVariable:
+    def patch(self, snippet: CustomizedSnippet, variable_id: str) -> WorkflowDraftVariable:
        draft_var_srv = WorkflowDraftVariableService(session=db.session())
        args_model = WorkflowDraftVariableUpdatePayload.model_validate(console_ns.payload or {})

-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id),
            app_id=snippet.id,
            variable_id=variable_id,
-            current_user_id=current_user.id,
        )
        _ensure_snippet_draft_variable_row_allowed(variable=variable, variable_id=variable_id)

@@ -205,21 +192,21 @@ class SnippetVariableApi(Resource):
            if variable.value_type == SegmentType.FILE:
                if not isinstance(raw_value, dict):
                    raise InvalidArgumentError(description=f"expected dict for file, got {type(raw_value)}")
-                    raw_value = build_from_mapping(
-                        mapping=raw_value,
-                        tenant_id=snippet.tenant_id,
-                        access_controller=_file_access_controller,
-                    )
+                raw_value = build_from_mapping(
+                    mapping=raw_value,
+                    tenant_id=snippet.tenant_id,
+                    access_controller=_file_access_controller,
+                )
            elif variable.value_type == SegmentType.ARRAY_FILE:
                if not isinstance(raw_value, list):
                    raise InvalidArgumentError(description=f"expected list for files, got {type(raw_value)}")
                if len(raw_value) > 0 and not isinstance(raw_value[0], dict):
                    raise InvalidArgumentError(description=f"expected dict for files[0], got {type(raw_value)}")
-                    raw_value = build_from_mappings(
-                        mappings=raw_value,
-                        tenant_id=snippet.tenant_id,
-                        access_controller=_file_access_controller,
-                    )
+                raw_value = build_from_mappings(
+                    mappings=raw_value,
+                    tenant_id=snippet.tenant_id,
+                    access_controller=_file_access_controller,
+                )
            new_value = build_segment_with_type(variable.value_type, raw_value)
        draft_var_srv.update_variable(variable, name=new_name, value=new_value)
        db.session.commit()
@@ -230,13 +217,12 @@ class SnippetVariableApi(Resource):
    @console_ns.response(204, "Variable deleted successfully")
    @console_ns.response(404, "Variable not found")
    @_snippet_draft_var_prerequisite
-    def delete(self, current_user: Account, snippet: CustomizedSnippet, variable_id: str) -> Response:
+    def delete(self, snippet: CustomizedSnippet, variable_id: str) -> Response:
        draft_var_srv = WorkflowDraftVariableService(session=db.session())
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id),
            app_id=snippet.id,
            variable_id=variable_id,
-            current_user_id=current_user.id,
        )
        _ensure_snippet_draft_variable_row_allowed(variable=variable, variable_id=variable_id)
        draft_var_srv.delete_variable(variable)
@@ -252,19 +238,18 @@ class SnippetVariableResetApi(Resource):
    @console_ns.response(204, "Variable reset (no content)")
    @console_ns.response(404, "Variable not found")
    @_snippet_draft_var_prerequisite
-    def put(self, current_user: Account, snippet: CustomizedSnippet, variable_id: str) -> Response | Any:
+    def put(self, snippet: CustomizedSnippet, variable_id: str) -> Response | Any:
        draft_var_srv = WorkflowDraftVariableService(session=db.session())
-        snippet_service = _snippet_service()
+        snippet_service = SnippetService()
        draft_workflow = snippet_service.get_draft_workflow(snippet=snippet)
        if draft_workflow is None:
            raise NotFoundError(
                f"Draft workflow not found, snippet_id={snippet.id}",
            )
-        variable = ensure_variable_access(
+        variable = _ensure_variable_access(
            variable=draft_var_srv.get_variable(variable_id=variable_id),
            app_id=snippet.id,
            variable_id=variable_id,
-            current_user_id=current_user.id,
        )
        _ensure_snippet_draft_variable_row_allowed(variable=variable, variable_id=variable_id)

@@ -284,7 +269,7 @@ class SnippetConversationVariableCollectionApi(Resource):
    @console_ns.response(200, "Conversation variables retrieved successfully", workflow_draft_variable_list_model)
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, _current_user: Account, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
+    def get(self, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
        return WorkflowDraftVariableList(variables=[])


@@ -297,7 +282,7 @@ class SnippetSystemVariableCollectionApi(Resource):
    @console_ns.response(200, "System variables retrieved successfully", workflow_draft_variable_list_model)
    @_snippet_draft_var_prerequisite
    @marshal_with(workflow_draft_variable_list_model)
-    def get(self, _current_user: Account, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
+    def get(self, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
        return WorkflowDraftVariableList(variables=[])


@@ -308,8 +293,8 @@ class SnippetEnvironmentVariableCollectionApi(Resource):
    @console_ns.response(200, "Environment variables retrieved successfully")
    @console_ns.response(404, "Draft workflow not found")
    @_snippet_draft_var_prerequisite
-    def get(self, _current_user: Account, snippet: CustomizedSnippet) -> dict[str, list[dict[str, Any]]]:
-        snippet_service = _snippet_service()
+    def get(self, snippet: CustomizedSnippet) -> dict[str, list[dict[str, Any]]]:
+        snippet_service = SnippetService()
        workflow = snippet_service.get_draft_workflow(snippet=snippet)
        if workflow is None:
            raise DraftWorkflowNotExist()
@@ -18,7 +18,7 @@ from controllers.common.fields import (
    SimpleResultResponse,
    VerificationTokenResponse,
 )
-from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.auth.error import (
    EmailAlreadyInUseError,
@@ -42,17 +42,15 @@ from controllers.console.wraps import (
    enterprise_license_required,
    only_edition_cloud,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
 )
 from extensions.ext_database import db
 from fields.base import ResponseModel
 from fields.member_fields import Account as AccountResponse
 from graphon.file import helpers as file_helpers
 from libs.datetime_utils import naive_utc_now
-from libs.helper import EmailStr, dump_response, extract_remote_ip, timezone, to_timestamp
-from libs.login import login_required
-from models import Account, AccountIntegrate, InvitationCode
+from libs.helper import EmailStr, extract_remote_ip, timezone, to_timestamp
+from libs.login import current_account_with_tenant, login_required
+from models import AccountIntegrate, InvitationCode
 from models.account import AccountStatus, InvitationCodeStatus
 from models.enums import CreatorUserRole
 from models.model import UploadFile
@@ -175,6 +173,7 @@ class CheckEmailUniquePayload(BaseModel):

 register_schema_models(
    console_ns,
+    AccountResponse,
    AccountInitPayload,
    AccountNamePayload,
    AccountAvatarPayload,
@@ -246,7 +245,6 @@ register_schema_models(
 )
 register_response_schema_models(
    console_ns,
-    AccountResponse,
    AvatarUrlResponse,
    SimpleResultDataResponse,
    SimpleResultResponse,
@@ -260,8 +258,9 @@ class AccountInitApi(Resource):
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
    @setup_required
    @login_required
-    @with_current_user
-    def post(self, account: Account):
+    def post(self):
+        account, _ = current_account_with_tenant()
+
        if account.status == "active":
            raise AccountAlreadyInitedError()

@@ -307,8 +306,8 @@ class AccountProfileApi(Resource):
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
    @enterprise_license_required
-    @with_current_user
-    def get(self, current_user: Account):
+    def get(self):
+        current_user, _ = current_account_with_tenant()
        return _serialize_account(current_user)


@@ -319,8 +318,8 @@ class AccountNameApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountNamePayload.model_validate(payload)
        updated_account = AccountService.update_account(current_user, name=args.name)
@@ -330,21 +329,20 @@ class AccountNameApi(Resource):

@console_ns.route("/account/avatar")
 class AccountAvatarApi(Resource):
+    @console_ns.expect(console_ns.models[AccountAvatarQuery.__name__])
    @console_ns.doc("get_account_avatar")
    @console_ns.doc(description="Get account avatar url")
-    @console_ns.doc(params=query_params_from_model(AccountAvatarQuery))
    @console_ns.response(200, "Success", console_ns.models[AvatarUrlResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
        args = AccountAvatarQuery.model_validate(request.args.to_dict(flat=True))
        avatar = args.avatar

        if avatar.startswith(("http://", "https://")):
-            return dump_response(AvatarUrlResponse, {"avatar_url": avatar})
+            return {"avatar_url": avatar}

        upload_file = db.session.scalar(select(UploadFile).where(UploadFile.id == avatar).limit(1))
        if upload_file is None:
@@ -357,15 +355,15 @@ class AccountAvatarApi(Resource):
            raise NotFound("Avatar file not found")

        avatar_url = file_helpers.get_signed_file_url(upload_file_id=upload_file.id)
-        return dump_response(AvatarUrlResponse, {"avatar_url": avatar_url})
+        return {"avatar_url": avatar_url}

    @console_ns.expect(console_ns.models[AccountAvatarPayload.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountAvatarPayload.model_validate(payload)

@@ -381,8 +379,8 @@ class AccountInterfaceLanguageApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountInterfaceLanguagePayload.model_validate(payload)

@@ -398,8 +396,8 @@ class AccountInterfaceThemeApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountInterfaceThemePayload.model_validate(payload)

@@ -415,8 +413,8 @@ class AccountTimezoneApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountTimezonePayload.model_validate(payload)

@@ -432,8 +430,8 @@ class AccountPasswordApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = AccountPasswordPayload.model_validate(payload)

@@ -451,8 +449,9 @@ class AccountIntegrateApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountIntegrateListResponse.__name__])
-    @with_current_user
-    def get(self, account: Account):
+    def get(self):
+        account, _ = current_account_with_tenant()
+
        account_integrates = db.session.scalars(
            select(AccountIntegrate).where(AccountIntegrate.account_id == account.id)
        ).all()
@@ -496,8 +495,9 @@ class AccountDeleteVerifyApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[SimpleResultDataResponse.__name__])
-    @with_current_user
-    def get(self, account: Account):
+    def get(self):
+        account, _ = current_account_with_tenant()
+
        token, code = AccountService.generate_account_deletion_verification_code(account)
        AccountService.send_account_deletion_verification_email(account, code)

@@ -511,8 +511,9 @@ class AccountDeleteApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def post(self, account: Account):
+    def post(self):
+        account, _ = current_account_with_tenant()
+
        payload = console_ns.payload or {}
        args = AccountDeletePayload.model_validate(payload)

@@ -546,8 +547,9 @@ class EducationVerifyApi(Resource):
    @only_edition_cloud
    @cloud_edition_billing_enabled
    @console_ns.response(200, "Success", console_ns.models[EducationVerifyResponse.__name__])
-    @with_current_user
-    def get(self, account: Account):
+    def get(self):
+        account, _ = current_account_with_tenant()
+
        return EducationVerifyResponse.model_validate(
            BillingService.EducationIdentity.verify(account.id, account.email) or {}
        ).model_dump(mode="json")
@@ -561,8 +563,9 @@ class EducationApi(Resource):
    @account_initialization_required
    @only_edition_cloud
    @cloud_edition_billing_enabled
-    @with_current_user
-    def post(self, account: Account):
+    def post(self):
+        account, _ = current_account_with_tenant()
+
        payload = console_ns.payload or {}
        args = EducationActivatePayload.model_validate(payload)

@@ -574,8 +577,9 @@ class EducationApi(Resource):
    @only_edition_cloud
    @cloud_edition_billing_enabled
    @console_ns.response(200, "Success", console_ns.models[EducationStatusResponse.__name__])
-    @with_current_user
-    def get(self, account: Account):
+    def get(self):
+        account, _ = current_account_with_tenant()
+
        res = BillingService.EducationIdentity.status(account.id) or {}
        # convert expire_at to UTC timestamp from isoformat
        if res and "expire_at" in res:
@@ -609,8 +613,8 @@ class ChangeEmailSendEmailApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ChangeEmailSendPayload.model_validate(payload)

@@ -669,8 +673,8 @@ class ChangeEmailCheckApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ChangeEmailValidityPayload.model_validate(payload)

@@ -716,8 +720,7 @@ class ChangeEmailResetApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[AccountResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
        payload = console_ns.payload or {}
        args = ChangeEmailResetPayload.model_validate(payload)
        normalized_new_email = args.new_email.lower()
@@ -728,6 +731,7 @@ class ChangeEmailResetApi(Resource):
        if not AccountService.check_email_unique(normalized_new_email):
            raise EmailAlreadyInUseError()

+        current_user, _ = current_account_with_tenant()
        reset_data = AccountService.get_change_email_data(args.token)
        if not reset_data:
            raise InvalidTokenError()
@@ -1,15 +1,9 @@
 from flask_restx import Resource, fields

 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, setup_required
 from graphon.model_runtime.utils.encoders import jsonable_encoder
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from services.agent_service import AgentService


@@ -25,10 +19,14 @@ class AgentProviderListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
-        return jsonable_encoder(AgentService.list_agent_providers(current_user.id, current_tenant_id))
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
+        user = current_user
+
+        user_id = user.id
+        tenant_id = current_tenant_id
+
+        return jsonable_encoder(AgentService.list_agent_providers(user_id, tenant_id))


@console_ns.route("/workspaces/current/agent-provider/<path:provider_name>")
@@ -44,7 +42,6 @@ class AgentProviderApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, provider_name: str):
+    def get(self, provider_name: str):
+        current_user, current_tenant_id = current_account_with_tenant()
        return jsonable_encoder(AgentService.get_agent_provider(current_user.id, current_tenant_id, provider_name))
@@ -14,16 +14,10 @@ from pydantic import BaseModel, Field

 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    is_admin_or_owner_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user_id,
-)
+from controllers.console.wraps import account_initialization_required, is_admin_or_owner_required, setup_required
 from core.plugin.impl.exc import PluginPermissionDeniedError
 from graphon.model_runtime.utils.encoders import jsonable_encoder
-from libs.login import login_required
+from libs.login import current_account_with_tenant, login_required
 from services.plugin.endpoint_service import EndpointService


@@ -102,15 +96,17 @@ register_schema_models(
 )


-def _create_endpoint(tenant_id: str, user_id: str) -> dict[str, bool]:
-    """Create a plugin endpoint for the injected workspace and user."""
+def _create_endpoint() -> dict[str, bool]:
+    """Create a plugin endpoint for the current workspace."""
+    user, tenant_id = current_account_with_tenant()
+
    args = EndpointCreatePayload.model_validate(console_ns.payload)

    try:
        return {
            "success": EndpointService.create_endpoint(
                tenant_id=tenant_id,
-                user_id=user_id,
+                user_id=user.id,
                plugin_unique_identifier=args.plugin_unique_identifier,
                name=args.name,
                settings=args.settings,
@@ -120,14 +116,16 @@ def _create_endpoint(tenant_id: str, user_id: str) -> dict[str, bool]:
        raise ValueError(e.description) from e


-def _update_endpoint(tenant_id: str, user_id: str, endpoint_id: str) -> dict[str, bool]:
+def _update_endpoint(endpoint_id: str) -> dict[str, bool]:
    """Update a plugin endpoint identified by the canonical path parameter."""
+    user, tenant_id = current_account_with_tenant()
+
    args = EndpointUpdatePayload.model_validate(console_ns.payload)

    return {
        "success": EndpointService.update_endpoint(
            tenant_id=tenant_id,
-            user_id=user_id,
+            user_id=user.id,
            endpoint_id=endpoint_id,
            name=args.name,
            settings=args.settings,
@@ -135,12 +133,14 @@ def _update_endpoint(tenant_id: str, user_id: str, endpoint_id: str) -> dict[str
    }


-def _delete_endpoint(tenant_id: str, user_id: str, endpoint_id: str) -> dict[str, bool]:
+def _delete_endpoint(endpoint_id: str) -> dict[str, bool]:
    """Delete a plugin endpoint identified by the canonical path parameter."""
+    user, tenant_id = current_account_with_tenant()
+
    return {
        "success": EndpointService.delete_endpoint(
            tenant_id=tenant_id,
-            user_id=user_id,
+            user_id=user.id,
            endpoint_id=endpoint_id,
        )
    }
@@ -163,10 +163,8 @@ class EndpointCollectionApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
-        return _create_endpoint(tenant_id=tenant_id, user_id=user_id)
+    def post(self):
+        return _create_endpoint()


@console_ns.route("/workspaces/current/endpoints/create")
@@ -191,10 +189,8 @@ class DeprecatedEndpointCreateApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
-        return _create_endpoint(tenant_id=tenant_id, user_id=user_id)
+    def post(self):
+        return _create_endpoint()


@console_ns.route("/workspaces/current/endpoints/list")
@@ -210,9 +206,9 @@ class EndpointListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def get(self, tenant_id: str, user_id: str):
+    def get(self):
+        user, tenant_id = current_account_with_tenant()
+
        args = EndpointListQuery.model_validate(request.args.to_dict(flat=True))

        page = args.page
@@ -222,7 +218,7 @@ class EndpointListApi(Resource):
            {
                "endpoints": EndpointService.list_endpoints(
                    tenant_id=tenant_id,
-                    user_id=user_id,
+                    user_id=user.id,
                    page=page,
                    page_size=page_size,
                )
@@ -243,9 +239,9 @@ class EndpointListForSinglePluginApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def get(self, tenant_id: str, user_id: str):
+    def get(self):
+        user, tenant_id = current_account_with_tenant()
+
        args = EndpointListForPluginQuery.model_validate(request.args.to_dict(flat=True))

        page = args.page
@@ -256,7 +252,7 @@ class EndpointListForSinglePluginApi(Resource):
            {
                "endpoints": EndpointService.list_endpoints_for_single_plugin(
                    tenant_id=tenant_id,
-                    user_id=user_id,
+                    user_id=user.id,
                    plugin_id=plugin_id,
                    page=page,
                    page_size=page_size,
@@ -282,10 +278,8 @@ class EndpointItemApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def delete(self, tenant_id: str, user_id: str, id: str):
-        return _delete_endpoint(tenant_id=tenant_id, user_id=user_id, endpoint_id=id)
+    def delete(self, id: str):
+        return _delete_endpoint(endpoint_id=id)

    @console_ns.doc("update_endpoint")
    @console_ns.doc(description="Update a plugin endpoint")
@@ -301,10 +295,8 @@ class EndpointItemApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def patch(self, tenant_id: str, user_id: str, id: str):
-        return _update_endpoint(tenant_id=tenant_id, user_id=user_id, endpoint_id=id)
+    def patch(self, id: str):
+        return _update_endpoint(endpoint_id=id)


@console_ns.route("/workspaces/current/endpoints/delete")
@@ -330,11 +322,9 @@ class DeprecatedEndpointDeleteApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
+    def post(self):
        args = EndpointIdPayload.model_validate(console_ns.payload)
-        return _delete_endpoint(tenant_id=tenant_id, user_id=user_id, endpoint_id=args.endpoint_id)
+        return _delete_endpoint(endpoint_id=args.endpoint_id)


@console_ns.route("/workspaces/current/endpoints/update")
@@ -360,11 +350,9 @@ class DeprecatedEndpointUpdateApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
+    def post(self):
        args = LegacyEndpointUpdatePayload.model_validate(console_ns.payload)
-        return _update_endpoint(tenant_id=tenant_id, user_id=user_id, endpoint_id=args.endpoint_id)
+        return _update_endpoint(endpoint_id=args.endpoint_id)


@console_ns.route("/workspaces/current/endpoints/enable")
@@ -382,14 +370,14 @@ class EndpointEnableApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
+    def post(self):
+        user, tenant_id = current_account_with_tenant()
+
        args = EndpointIdPayload.model_validate(console_ns.payload)

        return {
            "success": EndpointService.enable_endpoint(
-                tenant_id=tenant_id, user_id=user_id, endpoint_id=args.endpoint_id
+                tenant_id=tenant_id, user_id=user.id, endpoint_id=args.endpoint_id
            )
        }

@@ -409,13 +397,13 @@ class EndpointDisableApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_user_id
-    @with_current_tenant_id
-    def post(self, tenant_id: str, user_id: str):
+    def post(self):
+        user, tenant_id = current_account_with_tenant()
+
        args = EndpointIdPayload.model_validate(console_ns.payload)

        return {
            "success": EndpointService.disable_endpoint(
-                tenant_id=tenant_id, user_id=user_id, endpoint_id=args.endpoint_id
+                tenant_id=tenant_id, user_id=user.id, endpoint_id=args.endpoint_id
            )
        }
@@ -4,16 +4,11 @@ from werkzeug.exceptions import Forbidden

 from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, setup_required
 from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.errors.validate import CredentialsValidateFailedError
-from libs.login import login_required
-from models import Account, TenantAccountRole
+from libs.login import current_account_with_tenant, login_required
+from models import TenantAccountRole
 from services.model_load_balancing_service import ModelLoadBalancingService


@@ -34,9 +29,8 @@ class LoadBalancingCredentialsValidateApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, provider: str):
+    def post(self, provider: str):
+        current_user, current_tenant_id = current_account_with_tenant()
        if not TenantAccountRole.is_privileged_role(current_user.current_role):
            raise Forbidden()

@@ -78,9 +72,8 @@ class LoadBalancingConfigCredentialsValidateApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, current_user: Account, provider: str, config_id: str):
+    def post(self, provider: str, config_id: str):
+        current_user, current_tenant_id = current_account_with_tenant()
        if not TenantAccountRole.is_privileged_role(current_user.current_role):
            raise Forbidden()

@@ -8,19 +8,12 @@ from pydantic import BaseModel, Field, field_validator
 from controllers.common.fields import SimpleResultResponse
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    is_admin_or_owner_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, is_admin_or_owner_required, setup_required
 from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.errors.validate import CredentialsValidateFailedError
 from graphon.model_runtime.utils.encoders import jsonable_encoder
 from libs.helper import uuid_value
-from libs.login import login_required
-from models import Account
+from libs.login import current_account_with_tenant, login_required
 from services.billing_service import BillingService
 from services.model_provider_service import ModelProviderService

@@ -102,8 +95,10 @@ class ModelProviderListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str):
+    def get(self):
+        _, current_tenant_id = current_account_with_tenant()
+        tenant_id = current_tenant_id
+
        payload = request.args.to_dict(flat=True)
        args = ParserModelList.model_validate(payload)

@@ -119,8 +114,9 @@ class ModelProviderCredentialApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str, provider: str):
+    def get(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
+        tenant_id = current_tenant_id
        # if credential_id is not provided, return current used credential
        payload = request.args.to_dict(flat=True)
        args = ParserCredentialId.model_validate(payload)
@@ -137,8 +133,8 @@ class ModelProviderCredentialApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider: str):
+    def post(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ParserCredentialCreate.model_validate(payload)

@@ -161,8 +157,9 @@ class ModelProviderCredentialApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_tenant_id
-    def put(self, current_tenant_id: str, provider: str):
+    def put(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
+
        payload = console_ns.payload or {}
        args = ParserCredentialUpdate.model_validate(payload)

@@ -187,8 +184,8 @@ class ModelProviderCredentialApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_tenant_id
-    def delete(self, current_tenant_id: str, provider: str):
+    def delete(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ParserCredentialDelete.model_validate(payload)

@@ -208,8 +205,8 @@ class ModelProviderCredentialSwitchApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider: str):
+    def post(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ParserCredentialSwitch.model_validate(payload)

@@ -228,8 +225,8 @@ class ModelProviderValidateApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str, provider: str):
+    def post(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = ParserCredentialValidate.model_validate(payload)

@@ -283,8 +280,11 @@ class PreferredProviderTypeUpdateApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    @with_current_tenant_id
-    def post(self, tenant_id: str, provider: str):
+    def post(self, provider: str):
+        _, current_tenant_id = current_account_with_tenant()
+
+        tenant_id = current_tenant_id
+
        payload = console_ns.payload or {}
        args = ParserPreferredProviderType.model_validate(payload)

@@ -301,11 +301,10 @@ class ModelProviderPaymentCheckoutUrlApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, provider: str):
+    def get(self, provider: str):
        if provider != "anthropic":
            raise ValueError(f"provider name {provider} is invalid")
+        current_user, current_tenant_id = current_account_with_tenant()
        BillingService.is_tenant_owner_or_admin(current_user)
        data = BillingService.get_model_provider_payment_link(
            provider_name=provider,
@@ -13,14 +13,12 @@ from controllers.console.wraps import (
    is_admin_or_owner_required,
    setup_required,
    with_current_tenant_id,
-    with_current_user,
 )
 from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.errors.validate import CredentialsValidateFailedError
 from graphon.model_runtime.utils.encoders import jsonable_encoder
 from libs.helper import uuid_value
 from libs.login import login_required
-from models import Account
 from services.model_load_balancing_service import ModelLoadBalancingService
 from services.model_provider_service import ModelProviderService

@@ -195,7 +193,7 @@ class ModelProviderModelApi(Resource):
    @login_required
    @account_initialization_required
    @with_current_tenant_id
-    def get(self, tenant_id: str, provider: str):
+    def get(self, tenant_id: str, provider):
        model_provider_service = ModelProviderService()
        models = model_provider_service.get_models_by_provider(tenant_id=tenant_id, provider=provider)

@@ -271,9 +269,8 @@ class ModelProviderModelCredentialApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
    @with_current_tenant_id
-    def get(self, tenant_id: str, user: Account, provider: str):
+    def get(self, tenant_id: str, provider: str):
        args = ParserGetCredentials.model_validate(request.args.to_dict(flat=True))

        model_provider_service = ModelProviderService()
@@ -295,13 +292,9 @@ class ModelProviderModelCredentialApi(Resource):
        )

        if args.config_from == "predefined-model":
-            # Only the predefined-model branch needs visibility filtering by user.
-            # The account is injected once by the handler and only passed into the
-            # service branch that needs user-scoped credential visibility.
            available_credentials = model_provider_service.get_provider_available_credentials(
                tenant_id=tenant_id,
                provider=provider,
-                user=user,
            )
        else:
            available_credentials = model_provider_service.get_provider_model_available_credentials(
@@ -1,51 +1,28 @@
 import io
 from collections.abc import Mapping
-from datetime import datetime
-from typing import Any, Literal, TypedDict
+from typing import Any, Literal

 from flask import request, send_file
 from flask_restx import Resource
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, Field
 from werkzeug.datastructures import FileStorage
 from werkzeug.exceptions import Forbidden

 from configs import dify_config
 from controllers.common.fields import SuccessResponse
-from controllers.common.schema import (
-    query_params_from_model,
-    register_enum_models,
-    register_response_schema_models,
-    register_schema_models,
-)
+from controllers.common.schema import register_enum_models, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.workspace import plugin_permission_required
 from controllers.console.wraps import account_initialization_required, is_admin_or_owner_required, setup_required
-from core.helper.position_helper import is_filtered
-from core.plugin.entities.plugin import PluginCategory, PluginDeclaration, PluginInstallationSource
 from core.plugin.impl.exc import PluginDaemonClientSideError
 from core.plugin.plugin_service import PluginService
-from core.tools.builtin_tool.providers._positions import BuiltinToolProviderSort
-from core.tools.entities.common_entities import I18nObject
-from core.tools.entities.tool_entities import ToolProviderType
-from core.tools.tool_manager import ToolManager
 from fields.base import ResponseModel
 from graphon.model_runtime.utils.encoders import jsonable_encoder
-from libs.helper import dump_response
 from libs.login import current_account_with_tenant, login_required
 from models.account import TenantPluginAutoUpgradeStrategy, TenantPluginPermission
-from models.provider_ids import ToolProviderID
 from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
 from services.plugin.plugin_parameter_service import PluginParameterService
 from services.plugin.plugin_permission_service import PluginPermissionService
-from services.tools.tools_transform_service import ToolTransformService
-
-
-class AutoUpgradeSettingsResponse(TypedDict):
-    strategy_setting: TenantPluginAutoUpgradeStrategy.StrategySetting
-    upgrade_time_of_day: int
-    upgrade_mode: TenantPluginAutoUpgradeStrategy.UpgradeMode
-    exclude_plugins: list[str]
-    include_plugins: list[str]


 class ParserList(BaseModel):
@@ -53,11 +30,6 @@ class ParserList(BaseModel):
    page_size: int = Field(default=256, ge=1, le=256, description="Page size (1-256)")


-class PluginCategoryListQuery(BaseModel):
-    page: int = Field(default=1, ge=1, description="Page number")
-    page_size: int = Field(default=256, ge=1, le=256, description="Page size (1-256)")
-
-
 class ParserLatest(BaseModel):
    plugin_ids: list[str]

@@ -116,8 +88,8 @@ class ParserUninstall(BaseModel):


 class ParserPermissionChange(BaseModel):
-    install_permission: TenantPluginPermission.InstallPermission = TenantPluginPermission.InstallPermission.EVERYONE
-    debug_permission: TenantPluginPermission.DebugPermission = TenantPluginPermission.DebugPermission.EVERYONE
+    install_permission: TenantPluginPermission.InstallPermission
+    debug_permission: TenantPluginPermission.DebugPermission


 class ParserDynamicOptions(BaseModel):
@@ -153,40 +125,13 @@ class PluginAutoUpgradeSettingsPayload(BaseModel):
    include_plugins: list[str] = Field(default_factory=list)


-class PluginAutoUpgradeChangeResponse(ResponseModel):
-    success: bool
-    message: str | None = None
-
-
-class PluginAutoUpgradeSettingsResponseModel(ResponseModel):
-    strategy_setting: TenantPluginAutoUpgradeStrategy.StrategySetting
-    upgrade_time_of_day: int
-    upgrade_mode: TenantPluginAutoUpgradeStrategy.UpgradeMode
-    exclude_plugins: list[str]
-    include_plugins: list[str]
-
-
-class PluginAutoUpgradeFetchResponse(ResponseModel):
-    category: TenantPluginAutoUpgradeStrategy.PluginCategory
-    auto_upgrade: PluginAutoUpgradeSettingsResponseModel
-
-
-class ParserAutoUpgradeChange(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    category: TenantPluginAutoUpgradeStrategy.PluginCategory
+class ParserPreferencesChange(BaseModel):
+    permission: PluginPermissionSettingsPayload
    auto_upgrade: PluginAutoUpgradeSettingsPayload


-class ParserAutoUpgradeFetch(BaseModel):
-    category: TenantPluginAutoUpgradeStrategy.PluginCategory
-
-
 class ParserExcludePlugin(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
    plugin_id: str
-    category: TenantPluginAutoUpgradeStrategy.PluginCategory


 class ParserReadme(BaseModel):
@@ -200,67 +145,9 @@ class PluginDebuggingKeyResponse(ResponseModel):
    port: int


-class PluginCategoryInstalledPluginResponse(ResponseModel):
-    id: str
-    name: str
-    tenant_id: str
-    plugin_id: str
-    plugin_unique_identifier: str
-    endpoints_active: int
-    endpoints_setups: int
-    installation_id: str
-    declaration: PluginDeclaration
-    runtime_type: str
-    version: str
-    created_at: datetime
-    updated_at: datetime
-    source: PluginInstallationSource
-    checksum: str
-    meta: Mapping[str, Any]
-
-
-class PluginCategoryBuiltinToolResponse(ResponseModel):
-    model_config = ConfigDict(extra="allow")
-
-    author: str
-    name: str
-    label: I18nObject
-    description: I18nObject
-    parameters: list[Mapping[str, Any]] | None = None
-    labels: list[str]
-    output_schema: Mapping[str, object]
-
-
-class PluginCategoryBuiltinToolProviderResponse(ResponseModel):
-    model_config = ConfigDict(extra="allow")
-
-    id: str
-    author: str
-    name: str
-    plugin_id: str | None
-    plugin_unique_identifier: str | None
-    description: I18nObject
-    icon: str | Mapping[str, str]
-    icon_dark: str | Mapping[str, str] | None
-    label: I18nObject
-    type: ToolProviderType
-    team_credentials: Mapping[str, object]
-    is_team_authorization: bool
-    allow_delete: bool
-    tools: list[PluginCategoryBuiltinToolResponse]
-    labels: list[str]
-
-
-class PluginCategoryListResponse(ResponseModel):
-    plugins: list[PluginCategoryInstalledPluginResponse]
-    builtin_tools: list[PluginCategoryBuiltinToolProviderResponse]
-    has_more: bool
-
-
 register_schema_models(
    console_ns,
    ParserList,
-    PluginCategoryListQuery,
    PluginAutoUpgradeSettingsPayload,
    PluginPermissionSettingsPayload,
    ParserLatest,
@@ -277,57 +164,21 @@ register_schema_models(
    ParserPermissionChange,
    ParserDynamicOptions,
    ParserDynamicOptionsWithCredentials,
-    ParserAutoUpgradeChange,
-    ParserAutoUpgradeFetch,
+    ParserPreferencesChange,
    ParserExcludePlugin,
    ParserReadme,
 )
-register_response_schema_models(
-    console_ns,
-    PluginAutoUpgradeChangeResponse,
-    PluginAutoUpgradeFetchResponse,
-    PluginAutoUpgradeSettingsResponseModel,
-    PluginDebuggingKeyResponse,
-    PluginCategoryInstalledPluginResponse,
-    PluginCategoryBuiltinToolResponse,
-    PluginCategoryBuiltinToolProviderResponse,
-    PluginCategoryListResponse,
-    SuccessResponse,
-)
+register_response_schema_models(console_ns, PluginDebuggingKeyResponse, SuccessResponse)

 register_enum_models(
    console_ns,
    TenantPluginPermission.DebugPermission,
-    TenantPluginAutoUpgradeStrategy.PluginCategory,
    TenantPluginAutoUpgradeStrategy.UpgradeMode,
    TenantPluginAutoUpgradeStrategy.StrategySetting,
    TenantPluginPermission.InstallPermission,
 )


-def _default_auto_upgrade_settings(
-    tenant_id: str,
-    category: TenantPluginAutoUpgradeStrategy.PluginCategory,
-) -> AutoUpgradeSettingsResponse:
-    return {
-        "strategy_setting": PluginAutoUpgradeService.default_strategy_setting_for_category(category),
-        "upgrade_time_of_day": PluginAutoUpgradeService.default_upgrade_time_of_day(tenant_id),
-        "upgrade_mode": TenantPluginAutoUpgradeStrategy.UpgradeMode.EXCLUDE,
-        "exclude_plugins": [],
-        "include_plugins": [],
-    }
-
-
-def _auto_upgrade_settings_to_dict(strategy: TenantPluginAutoUpgradeStrategy) -> AutoUpgradeSettingsResponse:
-    return {
-        "strategy_setting": strategy.strategy_setting,
-        "upgrade_time_of_day": strategy.upgrade_time_of_day,
-        "upgrade_mode": strategy.upgrade_mode,
-        "exclude_plugins": strategy.exclude_plugins,
-        "include_plugins": strategy.include_plugins,
-    }
-
-
 def _read_upload_content(file: FileStorage, max_size: int) -> bytes:
    """
    Read the uploaded file and validate its actual size before delegating to the plugin service.
@@ -342,33 +193,6 @@ def _read_upload_content(file: FileStorage, max_size: int) -> bytes:
    return content


-def _list_hardcoded_builtin_tool_providers(tenant_id: str) -> list[dict[str, Any]]:
-    db_builtin_providers = {
-        str(ToolProviderID(provider.provider)): provider
-        for provider in ToolManager.list_default_builtin_providers(tenant_id)
-    }
-    builtin_providers = []
-
-    for provider in ToolManager.list_hardcoded_providers():
-        if is_filtered(
-            include_set=dify_config.POSITION_TOOL_INCLUDES_SET,
-            exclude_set=dify_config.POSITION_TOOL_EXCLUDES_SET,
-            data=provider,
-            name_func=lambda provider_controller: provider_controller.entity.identity.name,
-        ):
-            continue
-
-        user_provider = ToolTransformService.builtin_provider_to_user_provider(
-            provider_controller=provider,
-            db_provider=db_builtin_providers.get(provider.entity.identity.name),
-            decrypt_credentials=False,
-        )
-        ToolTransformService.repack_provider(tenant_id=tenant_id, provider=user_provider)
-        builtin_providers.append(user_provider)
-
-    return [provider.to_dict() for provider in BuiltinToolProviderSort.sort(builtin_providers)]
-
-
@console_ns.route("/workspaces/current/plugin/debugging-key")
 class PluginDebuggingKeyApi(Resource):
    @console_ns.response(200, "Success", console_ns.models[PluginDebuggingKeyResponse.__name__])
@@ -406,41 +230,6 @@ class PluginListApi(Resource):
        return jsonable_encoder({"plugins": plugins_with_total.list, "total": plugins_with_total.total})


-@console_ns.route("/workspaces/current/plugin/<string:category>/list")
-class PluginCategoryListApi(Resource):
-    @console_ns.doc(params=query_params_from_model(PluginCategoryListQuery))
-    @console_ns.response(200, "Success", console_ns.models[PluginCategoryListResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    def get(self, category: str):
-        _, tenant_id = current_account_with_tenant()
-        args = PluginCategoryListQuery.model_validate(request.args.to_dict(flat=True))
-
-        try:
-            plugin_category = PluginCategory(category)
-        except ValueError:
-            return {"code": "invalid_param", "message": "invalid plugin category"}, 400
-
-        try:
-            plugins = PluginService.list_by_category(tenant_id, plugin_category, args.page, args.page_size)
-        except PluginDaemonClientSideError as e:
-            return {"code": "plugin_error", "message": e.description}, 400
-
-        builtin_tools = []
-        if plugin_category == PluginCategory.Tool:
-            builtin_tools = _list_hardcoded_builtin_tool_providers(tenant_id)
-
-        return dump_response(
-            PluginCategoryListResponse,
-            {
-                "plugins": jsonable_encoder(plugins.list),
-                "builtin_tools": builtin_tools,
-                "has_more": plugins.has_more,
-            },
-        )
-
-
@console_ns.route("/workspaces/current/plugin/list/latest-versions")
 class PluginListLatestVersionsApi(Resource):
    @console_ns.expect(console_ns.models[ParserLatest.__name__])
@@ -843,13 +632,11 @@ class PluginChangePermissionApi(Resource):

        tenant_id = current_tenant_id

-        set_permission_result = PluginPermissionService.change_permission(
-            tenant_id, args.install_permission, args.debug_permission
-        )
-        if not set_permission_result:
-            return jsonable_encoder({"success": False, "message": "Failed to set permission"})
-
-        return jsonable_encoder({"success": True})
+        return {
+            "success": PluginPermissionService.change_permission(
+                tenant_id, args.install_permission, args.debug_permission
+            )
+        }


@console_ns.route("/workspaces/current/plugin/permission/fetch")
@@ -938,10 +725,9 @@ class PluginFetchDynamicSelectOptionsWithCredentialsApi(Resource):
        return jsonable_encoder({"options": options})


-@console_ns.route("/workspaces/current/plugin/auto-upgrade/change")
-class PluginChangeAutoUpgradeApi(Resource):
-    @console_ns.expect(console_ns.models[ParserAutoUpgradeChange.__name__])
-    @console_ns.response(200, "Success", console_ns.models[PluginAutoUpgradeChangeResponse.__name__])
+@console_ns.route("/workspaces/current/plugin/preferences/change")
+class PluginChangePreferencesApi(Resource):
+    @console_ns.expect(console_ns.models[ParserPreferencesChange.__name__])
    @setup_required
    @login_required
    @account_initialization_required
@@ -950,17 +736,38 @@ class PluginChangeAutoUpgradeApi(Resource):
        if not user.is_admin_or_owner:
            raise Forbidden()

-        args = ParserAutoUpgradeChange.model_validate(console_ns.payload)
+        args = ParserPreferencesChange.model_validate(console_ns.payload)
+
+        permission = args.permission
+
+        install_permission = permission.install_permission
+        debug_permission = permission.debug_permission

        auto_upgrade = args.auto_upgrade
+
+        strategy_setting = auto_upgrade.strategy_setting
+        upgrade_time_of_day = auto_upgrade.upgrade_time_of_day
+        upgrade_mode = auto_upgrade.upgrade_mode
+        exclude_plugins = auto_upgrade.exclude_plugins
+        include_plugins = auto_upgrade.include_plugins
+
+        # set permission
+        set_permission_result = PluginPermissionService.change_permission(
+            tenant_id,
+            install_permission,
+            debug_permission,
+        )
+        if not set_permission_result:
+            return jsonable_encoder({"success": False, "message": "Failed to set permission"})
+
+        # set auto upgrade strategy
        set_auto_upgrade_strategy_result = PluginAutoUpgradeService.change_strategy(
            tenant_id,
-            auto_upgrade.strategy_setting,
-            auto_upgrade.upgrade_time_of_day,
-            auto_upgrade.upgrade_mode,
-            auto_upgrade.exclude_plugins,
-            auto_upgrade.include_plugins,
-            category=args.category,
+            strategy_setting,
+            upgrade_time_of_day,
+            upgrade_mode,
+            exclude_plugins,
+            include_plugins,
        )
        if not set_auto_upgrade_strategy_result:
            return jsonable_encoder({"success": False, "message": "Failed to set auto upgrade strategy"})
@@ -968,36 +775,48 @@ class PluginChangeAutoUpgradeApi(Resource):
        return jsonable_encoder({"success": True})


-@console_ns.route("/workspaces/current/plugin/auto-upgrade/fetch")
-class PluginFetchAutoUpgradeApi(Resource):
-    @console_ns.doc(params=query_params_from_model(ParserAutoUpgradeFetch))
-    @console_ns.response(200, "Success", console_ns.models[PluginAutoUpgradeFetchResponse.__name__])
+@console_ns.route("/workspaces/current/plugin/preferences/fetch")
+class PluginFetchPreferencesApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
    def get(self):
        _, tenant_id = current_account_with_tenant()

-        args = ParserAutoUpgradeFetch.model_validate(request.args.to_dict(flat=True))
-        auto_upgrade = PluginAutoUpgradeService.get_strategy(tenant_id, args.category)
-        auto_upgrade_dict = (
-            _auto_upgrade_settings_to_dict(auto_upgrade)
-            if auto_upgrade
-            else _default_auto_upgrade_settings(tenant_id, args.category)
-        )
+        permission = PluginPermissionService.get_permission(tenant_id)
+        permission_dict = {
+            "install_permission": TenantPluginPermission.InstallPermission.EVERYONE,
+            "debug_permission": TenantPluginPermission.DebugPermission.EVERYONE,
+        }

-        return jsonable_encoder(
-            {
-                "category": args.category,
-                "auto_upgrade": auto_upgrade_dict,
+        if permission:
+            permission_dict["install_permission"] = permission.install_permission
+            permission_dict["debug_permission"] = permission.debug_permission
+
+        auto_upgrade = PluginAutoUpgradeService.get_strategy(tenant_id)
+        auto_upgrade_dict = {
+            "strategy_setting": TenantPluginAutoUpgradeStrategy.StrategySetting.DISABLED,
+            "upgrade_time_of_day": 0,
+            "upgrade_mode": TenantPluginAutoUpgradeStrategy.UpgradeMode.EXCLUDE,
+            "exclude_plugins": [],
+            "include_plugins": [],
+        }
+
+        if auto_upgrade:
+            auto_upgrade_dict = {
+                "strategy_setting": auto_upgrade.strategy_setting,
+                "upgrade_time_of_day": auto_upgrade.upgrade_time_of_day,
+                "upgrade_mode": auto_upgrade.upgrade_mode,
+                "exclude_plugins": auto_upgrade.exclude_plugins,
+                "include_plugins": auto_upgrade.include_plugins,
            }
-        )
+
+        return jsonable_encoder({"permission": permission_dict, "auto_upgrade": auto_upgrade_dict})


-@console_ns.route("/workspaces/current/plugin/auto-upgrade/exclude")
+@console_ns.route("/workspaces/current/plugin/preferences/autoupgrade/exclude")
 class PluginAutoUpgradeExcludePluginApi(Resource):
    @console_ns.expect(console_ns.models[ParserExcludePlugin.__name__])
-    @console_ns.response(200, "Success", console_ns.models[SuccessResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
@@ -1007,9 +826,7 @@ class PluginAutoUpgradeExcludePluginApi(Resource):

        args = ParserExcludePlugin.model_validate(console_ns.payload)

-        return jsonable_encoder(
-            {"success": PluginAutoUpgradeService.exclude_plugin(tenant_id, args.plugin_id, args.category)}
-        )
+        return jsonable_encoder({"success": PluginAutoUpgradeService.exclude_plugin(tenant_id, args.plugin_id)})


@console_ns.route("/workspaces/current/plugin/readme")
@@ -4,7 +4,7 @@ from urllib.parse import quote

 from flask import Response, request
 from flask_restx import Resource, marshal
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session
 from werkzeug.datastructures import MultiDict
 from werkzeug.exceptions import NotFound

@@ -32,17 +32,11 @@ from services.snippet_service import SnippetService

 logger = logging.getLogger(__name__)
 _TAG_IDS_BRACKET_PATTERN = re.compile(r"^tag_ids\[(\d+)\]$")
-_CREATOR_IDS_BRACKET_PATTERN = re.compile(r"^creator_ids\[(\d+)\]$")
-
-
-def _snippet_service() -> SnippetService:
-    return SnippetService(sessionmaker(bind=db.engine, expire_on_commit=False))


 def _normalize_snippet_list_query_args(query_args: MultiDict[str, str]) -> dict[str, str | list[str]]:
    normalized: dict[str, str | list[str]] = {}
    indexed_tag_ids: list[tuple[int, str]] = []
-    indexed_creator_ids: list[tuple[int, str]] = []

    for key in query_args:
        match = _TAG_IDS_BRACKET_PATTERN.fullmatch(key)
@@ -50,19 +44,12 @@ def _normalize_snippet_list_query_args(query_args: MultiDict[str, str]) -> dict[
            indexed_tag_ids.extend((int(match.group(1)), value) for value in query_args.getlist(key))
            continue

-        match = _CREATOR_IDS_BRACKET_PATTERN.fullmatch(key)
-        if match:
-            indexed_creator_ids.extend((int(match.group(1)), value) for value in query_args.getlist(key))
-            continue
-
        value = query_args.get(key)
        if value is not None:
            normalized[key] = value

    if indexed_tag_ids:
        normalized["tag_ids"] = [value for _, value in sorted(indexed_tag_ids)]
-    if indexed_creator_ids:
-        normalized["creators"] = [value for _, value in sorted(indexed_creator_ids)]

    return normalized

@@ -97,8 +84,7 @@ class CustomizedSnippetsApi(Resource):

        query = SnippetListQuery.model_validate(_normalize_snippet_list_query_args(request.args))

-        snippet_service = _snippet_service()
-        snippets, total, has_more = snippet_service.get_snippets(
+        snippets, total, has_more = SnippetService.get_snippets(
            tenant_id=current_tenant_id,
            page=query.page,
            limit=query.limit,
@@ -139,8 +125,7 @@ class CustomizedSnippetsApi(Resource):
            if payload.graph is not None:
                SnippetService.validate_snippet_graph_forbidden_nodes(payload.graph)

-            snippet_service = _snippet_service()
-            snippet = snippet_service.create_snippet(
+            snippet = SnippetService.create_snippet(
                tenant_id=current_tenant_id,
                name=payload.name,
                description=payload.description,
@@ -167,8 +152,7 @@ class CustomizedSnippetDetailApi(Resource):
        """Get customized snippet details."""
        _, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -191,8 +175,7 @@ class CustomizedSnippetDetailApi(Resource):
        """Update customized snippet."""
        current_user, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -235,8 +218,7 @@ class CustomizedSnippetDetailApi(Resource):
        """Delete customized snippet."""
        _, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -270,8 +252,7 @@ class CustomizedSnippetExportApi(Resource):
        """Export snippet as DSL."""
        _, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -289,14 +270,14 @@ class CustomizedSnippetExportApi(Resource):
        # Set filename with .snippet extension
        filename = f"{snippet.name}.snippet"
        encoded_filename = quote(filename)
-
+        
        response = Response(
            result,
            mimetype="application/x-yaml",
        )
        response.headers["Content-Disposition"] = f"attachment; filename*=UTF-8''{encoded_filename}"
        response.headers["Content-Type"] = "application/x-yaml"
-
+        
        return response


@@ -379,8 +360,7 @@ class CustomizedSnippetCheckDependenciesApi(Resource):
        """Check dependencies for a snippet."""
        _, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -410,8 +390,7 @@ class CustomizedSnippetUseCountIncrementApi(Resource):
        """Increment snippet use count when it is inserted into a workflow."""
        _, current_tenant_id = current_account_with_tenant()

-        snippet_service = _snippet_service()
-        snippet = snippet_service.get_snippet_by_id(
+        snippet = SnippetService.get_snippet_by_id(
            snippet_id=str(snippet_id),
            tenant_id=current_tenant_id,
        )
@@ -20,7 +20,7 @@ from controllers.console.wraps import (
    setup_required,
 )
 from core.db.session_factory import session_factory
-from core.entities.mcp_provider import IdentityMode, MCPAuthentication, MCPConfiguration
+from core.entities.mcp_provider import MCPAuthentication, MCPConfiguration
 from core.mcp.auth.auth_flow import auth, handle_callback
 from core.mcp.error import MCPAuthError, MCPError, MCPRefreshTokenError
 from core.mcp.mcp_client import MCPClient
@@ -69,7 +69,6 @@ class BuiltinToolAddPayload(BaseModel):
    credentials: dict[str, Any]
    name: str | None = Field(default=None, max_length=30)
    type: CredentialType
-    visibility: str | None = None


 class BuiltinToolUpdatePayload(BaseModel):
@@ -210,30 +209,6 @@ class MCPProviderBasePayload(BaseModel):
    configuration: dict[str, Any] | None = Field(default_factory=dict)
    headers: dict[str, Any] | None = Field(default_factory=dict)
    authentication: dict[str, Any] | None = Field(default_factory=dict)
-    # None means "leave unchanged" on update; the controller resolves it to a
-    # concrete IdentityMode before calling the service (see _resolve_identity_mode).
-    identity_mode: IdentityMode | None = None
-
-
-def _resolve_identity_mode(requested: IdentityMode | None, *, current: IdentityMode) -> IdentityMode:
-    """Resolve the effective MCP identity_mode for a create/update request.
-
-    Keeps two API-layer concerns out of the service so the service always
-    receives a concrete value:
-
-    * ``None`` means "leave unchanged" (update semantics) — fall back to
-      ``current`` (``IdentityMode.OFF`` for a brand-new provider).
-    * Identity forwarding is an enterprise-only capability. On non-enterprise
-      deployments any non-OFF value is coerced back to OFF so a persisted row
-      can never imply forwarding that the runtime won't perform. This gates the
-      API surface to match the backend gate in
-      ``MCPTool._forwarding_requested`` — both the API and the backend
-      invocation must be gated on ``dify_config.ENTERPRISE_ENABLED``.
-    """
-    mode = current if requested is None else requested
-    if mode != IdentityMode.OFF and not dify_config.ENTERPRISE_ENABLED:
-        return IdentityMode.OFF
-    return mode


 class MCPProviderCreatePayload(MCPProviderBasePayload):
@@ -302,7 +277,7 @@ class ToolBuiltinProviderListToolsApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        _, tenant_id = current_account_with_tenant()

        return jsonable_encoder(
@@ -318,7 +293,7 @@ class ToolBuiltinProviderInfoApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        _, tenant_id = current_account_with_tenant()

        return jsonable_encoder(BuiltinToolManageService.get_builtin_tool_provider_info(tenant_id, provider))
@@ -331,7 +306,7 @@ class ToolBuiltinProviderDeleteApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        _, tenant_id = current_account_with_tenant()

        payload = BuiltinToolCredentialDeletePayload.model_validate(console_ns.payload or {})
@@ -349,7 +324,7 @@ class ToolBuiltinProviderAddApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        user, tenant_id = current_account_with_tenant()

        user_id = user.id
@@ -363,7 +338,6 @@ class ToolBuiltinProviderAddApi(Resource):
            credentials=payload.credentials,
            name=payload.name,
            api_type=CredentialType.of(payload.type),
-            visibility=payload.visibility,
        )


@@ -374,7 +348,7 @@ class ToolBuiltinProviderUpdateApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        user, tenant_id = current_account_with_tenant()
        user_id = user.id

@@ -396,20 +370,13 @@ class ToolBuiltinProviderGetCredentialsApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
-        user, tenant_id = current_account_with_tenant()
-        # Optional list of credential IDs to include even if visibility would hide them
-        # (used when a workflow/agent node still references another member's only_me credential).
-        include_credential_ids = request.args.getlist("include_credential_ids") or [
-            s for s in (request.args.get("include_credential_ids") or "").split(",") if s
-        ]
+    def get(self, provider):
+        _, tenant_id = current_account_with_tenant()

        return jsonable_encoder(
            BuiltinToolManageService.get_builtin_tool_provider_credentials(
                tenant_id=tenant_id,
                provider_name=provider,
-                user=user,
-                include_credential_ids=include_credential_ids or None,
            )
        )

@@ -417,7 +384,7 @@ class ToolBuiltinProviderGetCredentialsApi(Resource):
@console_ns.route("/workspaces/current/tool-provider/builtin/<path:provider>/icon")
 class ToolBuiltinProviderIconApi(Resource):
    @setup_required
-    def get(self, provider: str):
+    def get(self, provider):
        icon_bytes, mimetype = BuiltinToolManageService.get_builtin_tool_provider_icon(provider)
        icon_cache_max_age = dify_config.TOOL_ICON_CACHE_MAX_AGE
        return send_file(io.BytesIO(icon_bytes), mimetype=mimetype, max_age=icon_cache_max_age)
@@ -817,7 +784,7 @@ class ToolPluginOAuthApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        tool_provider = ToolProviderID(provider)
        plugin_id = tool_provider.plugin_id
        provider_name = tool_provider.provider_name
@@ -855,7 +822,7 @@ class ToolPluginOAuthApi(Resource):
@console_ns.route("/oauth/plugin/<path:provider>/tool/callback")
 class ToolOAuthCallback(Resource):
    @setup_required
-    def get(self, provider: str):
+    def get(self, provider):
        context_id = request.cookies.get("context_id")
        if not context_id:
            raise Forbidden("context_id not found")
@@ -892,7 +859,7 @@ class ToolOAuthCallback(Resource):
        if not credentials:
            raise Exception("the plugin credentials failed")

-        # add credentials to database — OAuth tokens default to only_me since they're personal
+        # add credentials to database
        BuiltinToolManageService.add_builtin_tool_provider(
            user_id=user_id,
            tenant_id=tenant_id,
@@ -900,7 +867,6 @@ class ToolOAuthCallback(Resource):
            credentials=dict(credentials),
            expires_at=expires_at,
            api_type=CredentialType.OAUTH2,
-            visibility="only_me",
        )
        return redirect(f"{dify_config.CONSOLE_WEB_URL}/oauth-callback")

@@ -912,7 +878,7 @@ class ToolBuiltinProviderSetDefaultApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        _, current_tenant_id = current_account_with_tenant()
        payload = BuiltinProviderDefaultCredentialPayload.model_validate(console_ns.payload or {})
        return BuiltinToolManageService.set_default_provider(
@@ -944,7 +910,7 @@ class ToolOAuthCustomClient(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        _, current_tenant_id = current_account_with_tenant()
        return jsonable_encoder(
            BuiltinToolManageService.get_custom_oauth_client_params(tenant_id=current_tenant_id, provider=provider)
@@ -953,7 +919,7 @@ class ToolOAuthCustomClient(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def delete(self, provider: str):
+    def delete(self, provider):
        _, current_tenant_id = current_account_with_tenant()
        return jsonable_encoder(
            BuiltinToolManageService.delete_custom_oauth_client_params(tenant_id=current_tenant_id, provider=provider)
@@ -965,7 +931,7 @@ class ToolBuiltinProviderGetOauthClientSchemaApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        _, current_tenant_id = current_account_with_tenant()
        return jsonable_encoder(
            BuiltinToolManageService.get_builtin_tool_provider_oauth_client_schema(
@@ -979,18 +945,13 @@ class ToolBuiltinProviderGetCredentialInfoApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
-        user, tenant_id = current_account_with_tenant()
-        include_credential_ids = request.args.getlist("include_credential_ids") or [
-            s for s in (request.args.get("include_credential_ids") or "").split(",") if s
-        ]
+    def get(self, provider):
+        _, tenant_id = current_account_with_tenant()

        return jsonable_encoder(
            BuiltinToolManageService.get_builtin_tool_provider_credential_info(
                tenant_id=tenant_id,
                provider=provider,
-                user=user,
-                include_credential_ids=include_credential_ids or None,
            )
        )

@@ -1024,7 +985,6 @@ class ToolProviderMCPApi(Resource):
                headers=payload.headers or {},
                configuration=configuration,
                authentication=authentication,
-                identity_mode=_resolve_identity_mode(payload.identity_mode, current=IdentityMode.OFF),
            )

        # 2) Try to fetch tools immediately after creation so they appear without a second save.
@@ -1079,11 +1039,6 @@ class ToolProviderMCPApi(Resource):
        # Step 3: Perform database update in a transaction
        with sessionmaker(db.engine).begin() as session:
            service = MCPToolManageService(session=session)
-            # Resolve "leave unchanged" (None) against the stored value, and gate
-            # the result on ENTERPRISE_ENABLED — both are API-layer concerns, so
-            # the service receives a concrete IdentityMode.
-            existing = service.get_provider(provider_id=payload.provider_id, tenant_id=current_tenant_id)
-            identity_mode = _resolve_identity_mode(payload.identity_mode, current=IdentityMode(existing.identity_mode))
            service.update_provider(
                tenant_id=current_tenant_id,
                provider_id=payload.provider_id,
@@ -1097,7 +1052,6 @@ class ToolProviderMCPApi(Resource):
                configuration=configuration,
                authentication=authentication,
                validation_result=validation_result,
-                identity_mode=identity_mode,
            )

        return {"result": "success"}
@@ -1197,7 +1151,7 @@ class ToolMCPDetailApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider_id: str):
+    def get(self, provider_id):
        _, tenant_id = current_account_with_tenant()
        with sessionmaker(db.engine).begin() as session:
            service = MCPToolManageService(session=session)
@@ -1226,7 +1180,7 @@ class ToolMCPUpdateApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider_id: str):
+    def get(self, provider_id):
        _, tenant_id = current_account_with_tenant()
        with sessionmaker(db.engine).begin() as session:
            service = MCPToolManageService(session=session)
@@ -77,7 +77,7 @@ class TriggerProviderIconApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        user = current_user
        assert isinstance(user, Account)
        assert user.current_tenant_id is not None
@@ -103,7 +103,7 @@ class TriggerProviderInfoApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        """Get info for a trigger provider"""
        user = current_user
        assert isinstance(user, Account)
@@ -119,18 +119,15 @@ class TriggerSubscriptionListApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        """List all trigger subscriptions for the current tenant's provider"""
        user = current_user
-        assert isinstance(user, Account)
        assert user.current_tenant_id is not None

        try:
            return jsonable_encoder(
                TriggerProviderService.list_trigger_provider_subscriptions(
-                    tenant_id=user.current_tenant_id,
-                    provider_id=TriggerProviderID(provider),
-                    user=user,
+                    tenant_id=user.current_tenant_id, provider_id=TriggerProviderID(provider)
                )
            )
        except ValueError as e:
@@ -149,7 +146,7 @@ class TriggerSubscriptionBuilderCreateApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        """Add a new subscription instance for a trigger provider"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -178,7 +175,7 @@ class TriggerSubscriptionBuilderGetApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def get(self, provider: str, subscription_builder_id: str):
+    def get(self, provider, subscription_builder_id):
        """Get a subscription instance for a trigger provider"""
        return jsonable_encoder(
            TriggerSubscriptionBuilderService.get_subscription_builder_by_id(subscription_builder_id)
@@ -194,7 +191,7 @@ class TriggerSubscriptionBuilderVerifyApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def post(self, provider: str, subscription_builder_id: str):
+    def post(self, provider, subscription_builder_id):
        """Verify and update a subscription instance for a trigger provider"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -226,7 +223,7 @@ class TriggerSubscriptionBuilderUpdateApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def post(self, provider: str, subscription_builder_id: str):
+    def post(self, provider, subscription_builder_id):
        """Update a subscription instance for a trigger provider"""
        user = current_user
        assert isinstance(user, Account)
@@ -260,7 +257,7 @@ class TriggerSubscriptionBuilderLogsApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def get(self, provider: str, subscription_builder_id: str):
+    def get(self, provider, subscription_builder_id):
        """Get the request logs for a subscription instance for a trigger provider"""
        user = current_user
        assert isinstance(user, Account)
@@ -283,7 +280,7 @@ class TriggerSubscriptionBuilderBuildApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def post(self, provider: str, subscription_builder_id: str):
+    def post(self, provider, subscription_builder_id):
        """Build a subscription instance for a trigger provider"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -407,7 +404,7 @@ class TriggerOAuthAuthorizeApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        """Initiate OAuth authorization flow for a trigger provider"""
        user = current_user
        assert isinstance(user, Account)
@@ -489,7 +486,7 @@ class TriggerOAuthAuthorizeApi(Resource):
@console_ns.route("/oauth/plugin/<path:provider>/trigger/callback")
 class TriggerOAuthCallbackApi(Resource):
    @setup_required
-    def get(self, provider: str):
+    def get(self, provider):
        """Handle OAuth callback for trigger provider"""
        context_id = request.cookies.get("context_id")
        if not context_id:
@@ -557,7 +554,7 @@ class TriggerOAuthClientManageApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def get(self, provider: str):
+    def get(self, provider):
        """Get OAuth client configuration for a provider"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -603,7 +600,7 @@ class TriggerOAuthClientManageApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def post(self, provider: str):
+    def post(self, provider):
        """Configure custom OAuth client for a provider"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -629,7 +626,7 @@ class TriggerOAuthClientManageApi(Resource):
    @login_required
    @is_admin_or_owner_required
    @account_initialization_required
-    def delete(self, provider: str):
+    def delete(self, provider):
        """Remove custom OAuth client configuration"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -657,7 +654,7 @@ class TriggerSubscriptionVerifyApi(Resource):
    @login_required
    @edit_permission_required
    @account_initialization_required
-    def post(self, provider: str, subscription_id: str):
+    def post(self, provider, subscription_id):
        """Verify credentials for an existing subscription (edit mode only)"""
        user = current_user
        assert user.current_tenant_id is not None
@@ -25,15 +25,13 @@ from controllers.console.wraps import (
    cloud_edition_billing_resource_check,
    only_edition_enterprise,
    setup_required,
-    with_current_tenant_id,
-    with_current_user,
 )
 from enums.cloud_plan import CloudPlan
 from extensions.ext_database import db
 from fields.base import ResponseModel
-from libs.helper import OptionalTimestampField, TimestampField, dump_response, to_timestamp
-from libs.login import login_required
-from models.account import Account, Tenant, TenantAccountJoin, TenantCustomConfigDict, TenantStatus
+from libs.helper import TimestampField, dump_response, to_timestamp
+from libs.login import current_account_with_tenant, login_required
+from models.account import Tenant, TenantCustomConfigDict, TenantStatus
 from services.account_service import TenantService
 from services.billing_service import BillingService, SubscriptionPlan
 from services.enterprise.enterprise_service import EnterpriseService
@@ -144,7 +142,6 @@ tenants_fields = {
    "plan": fields.String,
    "status": fields.String,
    "created_at": TimestampField,
-    "last_opened_at": OptionalTimestampField,
    "current": fields.Boolean,
 }

@@ -156,15 +153,9 @@ class TenantListApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
-        tenant_rows: list[tuple[Tenant, TenantAccountJoin]] = [
-            (tenant, membership)
-            for tenant, membership in TenantService.get_workspaces_for_account(db.session, current_user.id)
-            if tenant.status == TenantStatus.NORMAL
-        ]
-        tenants = [tenant for tenant, _ in tenant_rows]
+    def get(self):
+        current_user, current_tenant_id = current_account_with_tenant()
+        tenants = TenantService.get_join_tenants(current_user)
        tenant_dicts = []
        is_enterprise_only = dify_config.ENTERPRISE_ENABLED and not dify_config.BILLING_ENABLED
        is_saas = dify_config.EDITION == "CLOUD" and dify_config.BILLING_ENABLED
@@ -177,7 +168,7 @@ class TenantListApi(Resource):
                if not tenant_plans:
                    logger.warning("get_plan_bulk returned empty result, falling back to legacy feature path")

-        for tenant, membership in tenant_rows:
+        for tenant in tenants:
            plan: str = CloudPlan.SANDBOX
            if is_saas:
                tenant_plan = tenant_plans.get(tenant.id)
@@ -196,7 +187,6 @@ class TenantListApi(Resource):
                "name": tenant.name,
                "status": tenant.status,
                "created_at": tenant.created_at,
-                "last_opened_at": membership.last_opened_at,
                "plan": plan,
                "current": tenant.id == current_tenant_id if current_tenant_id else False,
            }
@@ -238,11 +228,11 @@ class TenantApi(Resource):
    @login_required
    @account_initialization_required
    @console_ns.response(200, "Success", console_ns.models[TenantInfoResponse.__name__])
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
        if request.path == "/info":
            logger.warning("Deprecated URL /info was used.")

+        current_user, _ = current_account_with_tenant()
        tenant = current_user.current_tenant
        if not tenant:
            raise ValueError("No current tenant")
@@ -266,8 +256,8 @@ class SwitchWorkspaceApi(Resource):
    @setup_required
    @login_required
    @account_initialization_required
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = SwitchWorkspacePayload.model_validate(payload)

@@ -291,8 +281,8 @@ class CustomConfigWorkspaceApi(Resource):
    @login_required
    @account_initialization_required
    @cloud_edition_billing_resource_check("workspace_custom")
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str):
+    def post(self):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = WorkspaceCustomConfigPayload.model_validate(payload)
        tenant = db.get_or_404(Tenant, current_tenant_id)
@@ -318,8 +308,8 @@ class WebappLogoWorkspaceApi(Resource):
    @login_required
    @account_initialization_required
    @cloud_edition_billing_resource_check("workspace_custom")
-    @with_current_user
-    def post(self, current_user: Account):
+    def post(self):
+        current_user, _ = current_account_with_tenant()
        # check file
        if "file" not in request.files:
            raise NoFileUploadedError()
@@ -359,8 +349,8 @@ class WorkspaceInfoApi(Resource):
    @login_required
    @account_initialization_required
    # Change workspace name
-    @with_current_tenant_id
-    def post(self, current_tenant_id: str):
+    def post(self):
+        _, current_tenant_id = current_account_with_tenant()
        payload = console_ns.payload or {}
        args = WorkspaceInfoPayload.model_validate(payload)

@@ -382,12 +372,13 @@ class WorkspacePermissionApi(Resource):
    @login_required
    @account_initialization_required
    @only_edition_enterprise
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str):
+    def get(self):
        """
        Get workspace permission settings.
        Returns permission flags that control workspace features like member invitations and owner transfer.
        """
+        _, current_tenant_id = current_account_with_tenant()
+
        if not current_tenant_id:
            raise ValueError("No current tenant")

@@ -4,7 +4,7 @@ import os
 import time
 from collections.abc import Callable
 from functools import wraps
-from typing import Any, Concatenate, overload
+from typing import Concatenate

 from flask import abort, request
 from pydantic import BaseModel, ValidationError
@@ -37,21 +37,9 @@ ERROR_MSG_INVALID_ENCRYPTED_DATA = "Invalid encrypted data"
 ERROR_MSG_INVALID_ENCRYPTED_CODE = "Invalid encrypted code"


-@overload
-def account_initialization_required[T, **P, R](
-    view: Callable[Concatenate[T, P], R],
-) -> Callable[Concatenate[T, P], R]: ...
-
-
-@overload
-def account_initialization_required[**P, R](view: Callable[P, R]) -> Callable[P, R]: ...
-
-
-def account_initialization_required[R](view: Callable[..., R]) -> Callable[..., R]:
+def account_initialization_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:
    @wraps(view)
-    def decorated(*args: Any, **kwargs: Any) -> R:
-        # The overloads keep Resource methods method-aware for pyrefly while
-        # preserving support for plain functions used in tests and utilities.
+    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
        # check account initialization
        current_user, _ = current_account_with_tenant()
        if current_user.status == AccountStatus.UNINITIALIZED:
@@ -230,21 +218,9 @@ def cloud_utm_record[**P, R](view: Callable[P, R]) -> Callable[P, R]:
    return decorated


-@overload
-def setup_required[T, **P, R](
-    view: Callable[Concatenate[T, P], R],
-) -> Callable[Concatenate[T, P], R]: ...
-
-
-@overload
-def setup_required[**P, R](view: Callable[P, R]) -> Callable[P, R]: ...
-
-
-def setup_required[R](view: Callable[..., R]) -> Callable[..., R]:
+def setup_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:
    @wraps(view)
-    def decorated(*args: Any, **kwargs: Any) -> R:
-        # The overloads keep Resource methods method-aware for pyrefly while
-        # preserving support for plain functions used in tests and utilities.
+    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
        # check setup
        if dify_config.EDITION == "SELF_HOSTED" and not db.session.scalar(select(DifySetup).limit(1)):
            if os.environ.get("INIT_PASSWORD"):
@@ -576,7 +552,7 @@ def with_current_user_id[T, **P, R](
    @wraps(view)
    def decorated(self: T, *args: P.args, **kwargs: P.kwargs) -> R:
        current_user, _ = current_account_with_tenant()
-        return view(self, current_user.id, *args, **kwargs)
+        return view(self, str(current_user.id), *args, **kwargs)

    return decorated

@@ -1,3 +1,3 @@
-from fastopenapi.routers.flask import FlaskRouter
+from fastopenapi.routers import FlaskRouter

 console_router = FlaskRouter()
@@ -7,7 +7,7 @@ from hmac import new as hmac_new
 from flask import abort, request

 from configs import dify_config
-from core.db.session_factory import session_factory
+from extensions.ext_database import db
 from models.model import EndUser


@@ -44,8 +44,6 @@ def enterprise_inner_api_only[**P, R](view: Callable[P, R]) -> Callable[P, R]:


 def enterprise_inner_api_user_auth[**P, R](view: Callable[P, R]) -> Callable[P, R]:
-    """Inject an EndUser for valid inner API HMAC auth, otherwise pass the request through unchanged."""
-
    @wraps(view)
    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
        if not dify_config.INNER_API:
@@ -74,9 +72,9 @@ def enterprise_inner_api_user_auth[**P, R](view: Callable[P, R]) -> Callable[P,
        if signature_base64 != token:
            return view(*args, **kwargs)

-        with session_factory.create_session() as session:
-            kwargs["user"] = session.get(EndUser, user_id)
-            return view(*args, **kwargs)
+        kwargs["user"] = db.session.get(EndUser, user_id)
+
+        return view(*args, **kwargs)

    return decorated

@@ -147,7 +147,7 @@ class AppDescribeApi(AppReadResource):
 class AppListApi(Resource):
    @openapi_ns.doc(params=query_params_from_model(AppListQuery))
    @openapi_ns.response(200, "App list", openapi_ns.models[AppListResponse.__name__])
-    @auth_router.guard_workspace(scope=Scope.APPS_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @auth_router.guard(scope=Scope.APPS_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
    def get(self, *, auth_data: AuthData):
        try:
            query: AppListQuery = AppListQuery.model_validate(request.args.to_dict(flat=True))
@@ -1,13 +1,11 @@
 from __future__ import annotations

 from controllers.openapi.auth.conditions import (
+    EDITION_CE,
    EDITION_EE,
-    HAS_ALLOWED_ROLES,
    LOADED_APP_IS_PRIVATE,
    PATH_HAS_APP_ID,
    WEBAPP_AUTH_ENABLED,
-    WORKSPACE_MEMBERSHIP_REQUIRED,
-    WORKSPACE_SCOPED,
 )
 from controllers.openapi.auth.data import Edition
 from controllers.openapi.auth.flow import When
@@ -17,18 +15,14 @@ from controllers.openapi.auth.prepare import (
    load_app,
    load_app_access_mode,
    load_tenant,
-    load_tenant_from_request,
-    load_workspace_role,
    resolve_external_user,
 )
 from controllers.openapi.auth.verify import (
    check_acl,
-    check_app_api_enabled,
+    check_app_access,
+    check_membership,
    check_private_app_permission,
    check_scope,
-    check_workspace_member,
-    check_workspace_mismatch,
-    check_workspace_role,
 )
 from libs.oauth_bearer import TokenType

@@ -36,17 +30,13 @@ account_pipeline = AuthPipeline(
    prepare=[
        When(PATH_HAS_APP_ID, then=load_app),
        When(PATH_HAS_APP_ID, then=load_tenant),
-        When(WORKSPACE_MEMBERSHIP_REQUIRED, then=load_tenant_from_request),
-        load_account,
-        When(WORKSPACE_SCOPED, then=load_workspace_role),
+        load_account,  # all tokens here are account tokens
        When(PATH_HAS_APP_ID & EDITION_EE, then=load_app_access_mode),
    ],
    auth=[
-        When(PATH_HAS_APP_ID, then=check_app_api_enabled),
        check_scope,
-        When(WORKSPACE_SCOPED, then=check_workspace_member),
-        When(PATH_HAS_APP_ID, then=check_workspace_mismatch),
-        When(HAS_ALLOWED_ROLES, then=check_workspace_role),
+        When(EDITION_CE & PATH_HAS_APP_ID, then=check_membership),
+        When(EDITION_EE & PATH_HAS_APP_ID & ~WEBAPP_AUTH_ENABLED, then=check_app_access),
        When(PATH_HAS_APP_ID & EDITION_EE & WEBAPP_AUTH_ENABLED, then=check_acl),
        When(EDITION_EE & LOADED_APP_IS_PRIVATE, then=check_private_app_permission),
    ],
@@ -60,7 +50,6 @@ external_sso_pipeline = AuthPipeline(
        When(PATH_HAS_APP_ID, then=load_app_access_mode),
    ],
    auth=[
-        When(PATH_HAS_APP_ID, then=check_app_api_enabled),
        check_scope,
        When(PATH_HAS_APP_ID & WEBAPP_AUTH_ENABLED, then=check_acl),
        When(LOADED_APP_IS_PRIVATE, then=check_private_app_permission),
@@ -50,11 +50,4 @@ EDITION_SAAS = config_cond(lambda: current_edition() == Edition.SAAS)

 WEBAPP_AUTH_ENABLED = config_cond(lambda: FeatureService.get_system_features().webapp_auth.enabled)

-WORKSPACE_MEMBERSHIP_REQUIRED = request_cond(lambda ctx: ctx.workspace_membership)
-HAS_ALLOWED_ROLES = request_cond(lambda ctx: ctx.allowed_roles is not None)
-
-# Caller must belong to the resolved tenant: either an app-scoped path (tenant
-# from the app) or an explicit workspace-membership path (tenant from request).
-WORKSPACE_SCOPED = PATH_HAS_APP_ID | WORKSPACE_MEMBERSHIP_REQUIRED
-
 LOADED_APP_IS_PRIVATE = data_cond(lambda data: data.app_access_mode == WebAppAccessMode.PRIVATE)
@@ -9,7 +9,7 @@ from werkzeug.exceptions import InternalServerError

 from configs import dify_config
 from libs.oauth_bearer import Scope, TokenType
-from models.account import Account, Tenant, TenantAccountRole
+from models.account import Account, Tenant
 from models.model import App, EndUser
 from services.enterprise.enterprise_service import WebAppAccessMode

@@ -41,8 +41,6 @@ class RequestContext(BaseModel):
    token_type: TokenType
    scope: Scope | None = None
    path_params: dict[str, str]
-    workspace_membership: bool = False
-    allowed_roles: frozenset[TenantAccountRole] | None = None


 class AuthData(BaseModel):
@@ -58,14 +56,10 @@ class AuthData(BaseModel):
    external_identity: ExternalIdentity | None = None
    path_params: dict[str, str] = Field(default_factory=dict)

-    allowed_roles: frozenset[TenantAccountRole] | None = None
-
    app: App | None = None
    tenant: Tenant | None = None
    app_access_mode: WebAppAccessMode | None = None

-    tenant_role: TenantAccountRole | None = None
-
    caller: Account | EndUser | None = None
    caller_kind: Literal["account", "end_user"] | None = None

@@ -34,7 +34,6 @@ from libs.oauth_bearer import (
    reset_auth_ctx,
    set_auth_ctx,
 )
-from models.account import TenantAccountRole
 from services.feature_service import FeatureService, LicenseStatus


@@ -57,15 +56,11 @@ class AuthPipeline:
        view: Callable,
        *,
        scope: Scope | None,
-        workspace_membership: bool = False,
-        allowed_roles: frozenset[TenantAccountRole] | None = None,
    ) -> Any:
        req_ctx = RequestContext(
            token_type=identity.token_type,
            scope=scope,
            path_params=dict(request.view_args or {}),
-            workspace_membership=workspace_membership,
-            allowed_roles=allowed_roles,
        )

        data = AuthData(
@@ -76,7 +71,6 @@ class AuthPipeline:
            scopes=frozenset(identity.scopes),
            tenants=dict(identity.verified_tenants),
            required_scope=scope,
-            allowed_roles=allowed_roles,
            path_params=dict(req_ctx.path_params),
            external_identity=(
                ExternalIdentity(email=identity.subject_email, issuer=identity.subject_issuer)
@@ -127,41 +121,6 @@ class PipelineRouter:
        scope: Scope | None = None,
        allowed_token_types: frozenset[TokenType] | None = None,
        edition: frozenset[Edition] | None = None,
-        workspace_membership: bool = False,
-        allowed_roles: frozenset[TenantAccountRole] | None = None,
-    ) -> Callable:
-        return self._make_decorator(
-            scope=scope,
-            allowed_token_types=allowed_token_types,
-            edition=edition,
-            workspace_membership=workspace_membership,
-            allowed_roles=allowed_roles,
-        )
-
-    def guard_workspace(
-        self,
-        *,
-        scope: Scope | None = None,
-        allowed_token_types: frozenset[TokenType] | None = None,
-        edition: frozenset[Edition] | None = None,
-        allowed_roles: frozenset[TenantAccountRole] | None = None,
-    ) -> Callable:
-        return self._make_decorator(
-            scope=scope,
-            allowed_token_types=allowed_token_types,
-            edition=edition,
-            workspace_membership=True,
-            allowed_roles=allowed_roles,
-        )
-
-    def _make_decorator(
-        self,
-        *,
-        scope: Scope | None,
-        allowed_token_types: frozenset[TokenType] | None,
-        edition: frozenset[Edition] | None,
-        workspace_membership: bool,
-        allowed_roles: frozenset[TenantAccountRole] | None,
    ) -> Callable:
        def decorator(view: Callable) -> Callable:
            @wraps(view)
@@ -173,8 +132,6 @@ class PipelineRouter:
                    scope=scope,
                    allowed_token_types=allowed_token_types,
                    edition=edition,
-                    workspace_membership=workspace_membership,
-                    allowed_roles=allowed_roles,
                )

            return decorated
@@ -190,8 +147,6 @@ class PipelineRouter:
        scope: Scope | None,
        allowed_token_types: frozenset[TokenType] | None,
        edition: frozenset[Edition] | None,
-        workspace_membership: bool = False,
-        allowed_roles: frozenset[TenantAccountRole] | None = None,
    ) -> Any:
        # 404 not 403 — this edition doesn't expose the feature at all
        if edition is not None and current_edition() not in edition:
@@ -227,15 +182,7 @@ class PipelineRouter:
            if not license_checked and Edition.EE in route.required_edition:
                _check_license()

-        return route.pipeline._run(
-            identity,
-            args,
-            kwargs,
-            view,
-            scope=scope,
-            workspace_membership=workspace_membership,
-            allowed_roles=allowed_roles,
-        )
+        return route.pipeline._run(identity, args, kwargs, view, scope=scope)


 def _should_run(step: Any, req_ctx: RequestContext, data: AuthData | None) -> bool:
@@ -1,8 +1,5 @@
 from __future__ import annotations

-import uuid
-
-from flask import request
 from werkzeug.exceptions import Forbidden, InternalServerError, NotFound, Unauthorized

 from controllers.openapi.auth.data import AuthData
@@ -16,18 +13,16 @@ from services.enterprise.enterprise_service import EnterpriseService, WebAppAcce


 def load_app(data: AuthData) -> None:
-    if data.app is not None:
-        return
    app_id = data.path_params["app_id"]
    app = AppService.get_app_by_id(db.session, app_id)
    if not app or app.status != "normal":
        raise NotFound("app not found")
+    if not app.enable_api:
+        raise Forbidden("service_api_disabled")
    data.app = app


 def load_tenant(data: AuthData) -> None:
-    if data.tenant is not None:
-        return
    if data.app is None:
        raise InternalServerError("pipeline_invariant_violated: app not loaded before load_tenant")
    tenant = TenantService.get_tenant_by_id(db.session, str(data.app.tenant_id))
@@ -36,25 +31,7 @@ def load_tenant(data: AuthData) -> None:
    data.tenant = tenant


-def load_tenant_from_request(data: AuthData) -> None:
-    if data.tenant is not None:
-        return
-    workspace_id = data.path_params.get("workspace_id") or request.args.get("workspace_id")
-    if not workspace_id:
-        raise NotFound("workspace not found")
-    try:
-        uuid.UUID(workspace_id)
-    except ValueError:
-        raise NotFound("workspace not found")
-    tenant = TenantService.get_tenant_by_id(db.session, workspace_id)
-    if tenant is None or tenant.status == TenantStatus.ARCHIVE:
-        raise NotFound("workspace not found")
-    data.tenant = tenant
-
-
 def load_account(data: AuthData) -> None:
-    if data.caller is not None:
-        return
    account = AccountService.get_account_by_id(db.session, str(data.account_id))
    if account is None:
        raise Unauthorized("account not found")
@@ -64,19 +41,6 @@ def load_account(data: AuthData) -> None:
    data.caller_kind = "account"


-def load_workspace_role(data: AuthData) -> None:
-    if data.tenant_role is not None:
-        return
-    if data.tenant is None or data.account_id is None:
-        return
-    if data.caller is not None and getattr(data.caller, "status", None) != "active":
-        return
-    role = TenantService.get_account_role_in_tenant(db.session, str(data.account_id), str(data.tenant.id))
-    if role is None:
-        return
-    data.tenant_role = role
-
-
 def resolve_external_user(data: AuthData) -> None:
    if data.tenant is None or data.app is None or data.external_identity is None:
        raise Unauthorized("missing context for external user resolution")
@@ -0,0 +1,77 @@
+"""Workspace role gate.
+
+Layered on top of `validate_bearer` + `accept_subjects(SubjectType.ACCOUNT)`
+for routes whose access depends on the caller's `TenantAccountJoin.role`
+in the workspace named by the `workspace_id` path parameter.
+
+Usage::
+
+    @openapi_ns.route("/workspaces/<string:workspace_id>/members")
+    class Members(Resource):
+        @validate_bearer(accept=ACCEPT_USER_ANY)
+        @accept_subjects(SubjectType.ACCOUNT)
+        @require_workspace_role()  # any member
+        def get(self, workspace_id: str): ...
+
+        @validate_bearer(accept=ACCEPT_USER_ANY)
+        @accept_subjects(SubjectType.ACCOUNT)
+        @require_workspace_role(TenantAccountRole.OWNER, TenantAccountRole.ADMIN)
+        def post(self, workspace_id: str): ...
+
+Non-member callers get 404 (matching `GET /openapi/v1/workspaces/<id>`)
+so workspace IDs do not leak across tenants. A member without one of the
+allowed roles gets 403.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from functools import wraps
+from typing import TypeVar
+
+from werkzeug.exceptions import Forbidden, NotFound
+
+from extensions.ext_database import db
+from libs.oauth_bearer import try_get_auth_ctx
+from models.account import TenantAccountRole
+from services.account_service import TenantService
+
+F = TypeVar("F", bound=Callable[..., object])
+
+
+def require_workspace_role(*allowed_roles: TenantAccountRole) -> Callable[[F], F]:
+    """Gate a route on the caller's role in ``workspace_id``.
+
+    Pass no roles to require only membership. Pass one or more roles to
+    require the caller's role be in that set.
+    """
+
+    allowed = frozenset(allowed_roles)
+
+    def deco(fn: F) -> F:
+        @wraps(fn)
+        def wrapper(*args: object, **kwargs: object) -> object:
+            ctx = try_get_auth_ctx()
+            if ctx is None or ctx.account_id is None:
+                raise RuntimeError(
+                    "require_workspace_role called without account-bearer context; "
+                    "stack validate_bearer + accept_subjects(SubjectType.ACCOUNT) above it"
+                )
+
+            workspace_id = kwargs.get("workspace_id")
+            if not workspace_id:
+                raise RuntimeError("require_workspace_role expects a 'workspace_id' route parameter")
+
+            role = TenantService.get_account_role_in_tenant(db.session, str(ctx.account_id), str(workspace_id))
+
+            if role is None:
+                raise NotFound("workspace not found")
+
+            if allowed and role not in allowed:
+                raise Forbidden("insufficient workspace role")
+
+            return fn(*args, **kwargs)
+
+        return wrapper  # type: ignore[return-value]
+
+    return deco
@@ -1,11 +1,10 @@
 from __future__ import annotations

-from flask import request
-from werkzeug.exceptions import Forbidden, NotFound, UnprocessableEntity
+from werkzeug.exceptions import Forbidden, Unauthorized

 from controllers.openapi.auth.data import AuthData
 from extensions.ext_database import db
-from libs.oauth_bearer import Scope, TokenType
+from libs.oauth_bearer import Scope, TokenType, check_workspace_membership
 from services.account_service import AccountService, TenantService
 from services.enterprise.enterprise_service import EnterpriseService, WebAppAccessMode

@@ -18,39 +17,17 @@ def check_scope(data: AuthData) -> None:
    raise Forbidden("insufficient_scope")


-def check_workspace_member(data: AuthData) -> None:
-    """Assert the caller belongs to the resolved tenant.
-
-    `load_workspace_role` stashes the membership role (None when the caller is
-    not a member or is inactive). A missing membership surfaces as 404, not
-    403, so workspace IDs don't leak across tenants.
-    """
-    if data.tenant_role is None:
-        raise NotFound("workspace not found")
-
-
-def check_workspace_mismatch(data: AuthData) -> None:
+def check_membership(data: AuthData) -> None:
    if data.tenant is None:
-        return
-    request_workspace_id = data.path_params.get("workspace_id") or request.args.get("workspace_id")
-    if request_workspace_id and request_workspace_id != str(data.tenant.id):
-        raise UnprocessableEntity("workspace_id does not match app's workspace")
-
-
-def check_workspace_role(data: AuthData) -> None:
-    if data.allowed_roles is None:
-        return
-    if data.tenant_role is None:
-        raise NotFound("workspace not found")
-    if data.tenant_role not in data.allowed_roles:
-        raise Forbidden("insufficient workspace role")
-
-
-def check_app_api_enabled(data: AuthData) -> None:
-    if data.app is None:
-        return
-    if not data.app.enable_api:
-        raise Forbidden("service_api_disabled")
+        raise Unauthorized("tenant unset")
+    if data.account_id is None:
+        raise Unauthorized("account_id unset")
+    check_workspace_membership(
+        account_id=data.account_id,
+        tenant_id=data.tenant.id,
+        token_hash=data.token_hash,
+        membership_cache=data.tenants,
+    )


 def check_app_access(data: AuthData) -> None:
@@ -26,12 +26,7 @@ from werkzeug.exceptions import BadRequest

 from configs import dify_config
 from controllers.common.schema import query_params_from_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.wraps import account_initialization_required, setup_required
 from controllers.openapi import openapi_ns
 from controllers.openapi._models import (
    AccountPayload,
@@ -47,14 +42,14 @@ from controllers.openapi._models import (
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from libs.helper import extract_remote_ip
+from libs.login import current_account_with_tenant
 from libs.oauth_bearer import MINTABLE_PROFILES, SubjectType, bearer_feature_required
 from libs.rate_limit import (
+    LIMIT_APPROVE_CONSOLE,
    LIMIT_DEVICE_CODE_PER_IP,
-    LIMIT_DEVICE_FLOW_APPROVE,
    LIMIT_LOOKUP_PUBLIC,
    rate_limit,
 )
-from models import Account
 from services.account_service import TenantService
 from services.oauth_device_flow import (
    ACCOUNT_ISSUER_SENTINEL,
@@ -210,13 +205,12 @@ class DeviceApproveApi(Resource):
    @login_required
    @account_initialization_required
    @bearer_feature_required
-    @rate_limit(LIMIT_DEVICE_FLOW_APPROVE)
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, tenant: str, account: Account):
+    @rate_limit(LIMIT_APPROVE_CONSOLE)
+    def post(self):
        payload = _validate_json(DeviceMutateRequest)
        user_code = payload.user_code.strip().upper()

+        account, tenant = current_account_with_tenant()
        store = DeviceFlowRedis(redis_client)

        found = store.load_by_user_code(user_code)
@@ -287,7 +281,7 @@ class DeviceDenyApi(Resource):
    @login_required
    @account_initialization_required
    @bearer_feature_required
-    @rate_limit(LIMIT_DEVICE_FLOW_APPROVE)
+    @rate_limit(LIMIT_APPROVE_CONSOLE)
    def post(self):
        payload = _validate_json(DeviceMutateRequest)
        user_code = payload.user_code.strip().upper()
@@ -5,8 +5,9 @@ endpoints. Account bearers (dfoa_) see every tenant they're a member of.
 External SSO bearers (dfoe_) have no account_id and so see an empty list —
 that matches /openapi/v1/account.

-Member-management endpoints use ``guard_workspace`` which enforces
-workspace membership and optional role requirements via the auth pipeline.
+Member-management endpoints are gated by both `accept_subjects` (SSO out)
+and `require_workspace_role` (membership / role lookup against the path's
+``workspace_id``).
 """

 from __future__ import annotations
@@ -36,6 +37,7 @@ from controllers.openapi._models import (
 )
 from controllers.openapi.auth.composition import auth_router
 from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.role_gate import require_workspace_role
 from extensions.ext_database import db
 from libs.oauth_bearer import Scope, TokenType
 from models import Account, Tenant, TenantAccountJoin
@@ -150,7 +152,8 @@ class WorkspaceSwitchApi(Resource):
    """

    @openapi_ns.response(200, "Workspace detail", openapi_ns.models[WorkspaceDetailResponse.__name__])
-    @auth_router.guard_workspace(scope=Scope.WORKSPACE_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @auth_router.guard(scope=Scope.WORKSPACE_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @require_workspace_role()
    def post(self, workspace_id: str, *, auth_data: AuthData):
        account = _load_account(auth_data.account_id)

@@ -176,7 +179,8 @@ class WorkspaceMembersApi(Resource):

    @openapi_ns.doc(params=query_params_from_model(MemberListQuery))
    @openapi_ns.response(200, "Member list", openapi_ns.models[MemberListResponse.__name__])
-    @auth_router.guard_workspace(scope=Scope.WORKSPACE_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @auth_router.guard(scope=Scope.WORKSPACE_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @require_workspace_role()
    def get(self, workspace_id: str, *, auth_data: AuthData):
        try:
            query = MemberListQuery.model_validate(request.args.to_dict(flat=True))
@@ -198,11 +202,8 @@ class WorkspaceMembersApi(Resource):

    @openapi_ns.expect(openapi_ns.models[MemberInvitePayload.__name__])
    @openapi_ns.response(201, "Member invited", openapi_ns.models[MemberInviteResponse.__name__])
-    @auth_router.guard_workspace(
-        scope=Scope.WORKSPACE_WRITE,
-        allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
-        allowed_roles=frozenset({TenantAccountRole.OWNER, TenantAccountRole.ADMIN}),
-    )
+    @auth_router.guard(scope=Scope.WORKSPACE_WRITE, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @require_workspace_role(TenantAccountRole.OWNER, TenantAccountRole.ADMIN)
    def post(self, workspace_id: str, *, auth_data: AuthData):
        payload = _validate_body(MemberInvitePayload)
        inviter = _load_account(auth_data.account_id)
@@ -252,11 +253,8 @@ class WorkspaceMemberApi(Resource):
    """

    @openapi_ns.response(200, "Member removed", openapi_ns.models[MemberActionResponse.__name__])
-    @auth_router.guard_workspace(
-        scope=Scope.WORKSPACE_WRITE,
-        allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
-        allowed_roles=frozenset({TenantAccountRole.OWNER, TenantAccountRole.ADMIN}),
-    )
+    @auth_router.guard(scope=Scope.WORKSPACE_WRITE, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @require_workspace_role(TenantAccountRole.OWNER, TenantAccountRole.ADMIN)
    def delete(self, workspace_id: str, member_id: str, *, auth_data: AuthData):
        operator = _load_account(auth_data.account_id)
        tenant = _load_tenant(workspace_id)
@@ -286,11 +284,8 @@ class WorkspaceMemberRoleApi(Resource):

    @openapi_ns.expect(openapi_ns.models[MemberRoleUpdatePayload.__name__])
    @openapi_ns.response(200, "Role updated", openapi_ns.models[MemberActionResponse.__name__])
-    @auth_router.guard_workspace(
-        scope=Scope.WORKSPACE_WRITE,
-        allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
-        allowed_roles=frozenset({TenantAccountRole.OWNER, TenantAccountRole.ADMIN}),
-    )
+    @auth_router.guard(scope=Scope.WORKSPACE_WRITE, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @require_workspace_role(TenantAccountRole.OWNER, TenantAccountRole.ADMIN)
    def put(self, workspace_id: str, member_id: str, *, auth_data: AuthData):
        payload = _validate_body(MemberRoleUpdatePayload)
        operator = _load_account(auth_data.account_id)
@@ -28,7 +28,7 @@ from core.errors.error import (
    ProviderTokenNotInitError,
    QuotaExceededError,
 )
-from core.helper.trace_id_helper import get_external_trace_id, get_trace_session_id, omit_trace_session_id_from_payload
+from core.helper.trace_id_helper import get_external_trace_id
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs import helper
 from libs.helper import UUIDStrOrEmpty
@@ -41,22 +41,12 @@ from services.errors.llm import InvokeRateLimitError
 logger = logging.getLogger(__name__)


-def _resolve_agent_app_streaming(*, app_mode: AppMode, response_mode: str | None) -> bool:
-    """Agent App runtime is SSE-only until backend blocking runs are supported."""
-    if app_mode != AppMode.AGENT:
-        return response_mode == "streaming"
-    if response_mode == "blocking":
-        raise BadRequest("Agent App only supports streaming response mode.")
-    return True
-
-
 class CompletionRequestPayload(BaseModel):
    inputs: dict[str, Any]
    query: str = Field(default="")
    files: list[dict[str, Any]] | None = None
    response_mode: Literal["blocking", "streaming"] | None = None
    retriever_from: str = Field(default="dev")
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")


 class ChatRequestPayload(BaseModel):
@@ -68,7 +58,6 @@ class ChatRequestPayload(BaseModel):
    retriever_from: str = Field(default="dev")
    auto_generate_name: bool = Field(default=True, description="Auto generate conversation name")
    workflow_id: str | None = Field(default=None, description="Workflow ID for advanced chat")
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")

    @field_validator("conversation_id", mode="before")
    @classmethod
@@ -114,14 +103,9 @@ class CompletionApi(Resource):
        if app_model.mode != AppMode.COMPLETION:
            raise AppUnavailableError()

-        payload = CompletionRequestPayload.model_validate(
-            omit_trace_session_id_from_payload(service_api_ns.payload) or {}
-        )
+        payload = CompletionRequestPayload.model_validate(service_api_ns.payload or {})
        external_trace_id = get_external_trace_id(request)
        args = payload.model_dump(exclude_none=True)
-        trace_session_id = get_trace_session_id(request)
-        if trace_session_id:
-            args["trace_session_id"] = trace_session_id
        if external_trace_id:
            args["external_trace_id"] = external_trace_id

@@ -213,20 +197,17 @@ class ChatApi(Resource):
        Supports conversation management and both blocking and streaming response modes.
        """
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

-        payload = ChatRequestPayload.model_validate(omit_trace_session_id_from_payload(service_api_ns.payload) or {})
+        payload = ChatRequestPayload.model_validate(service_api_ns.payload or {})

        external_trace_id = get_external_trace_id(request)
        args = payload.model_dump(exclude_none=True)
-        trace_session_id = get_trace_session_id(request)
-        if trace_session_id:
-            args["trace_session_id"] = trace_session_id
        if external_trace_id:
            args["external_trace_id"] = external_trace_id

-        streaming = _resolve_agent_app_streaming(app_mode=app_mode, response_mode=payload.response_mode)
+        streaming = payload.response_mode == "streaming"

        try:
            response = AppGenerateService.generate(
@@ -281,7 +262,7 @@ class ChatStopApi(Resource):
    def post(self, app_model: App, end_user: EndUser, task_id: str):
        """Stop a running chat message generation."""
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        AppTaskService.stop_task(
@@ -155,7 +155,7 @@ class ConversationApi(Resource):
        Supports pagination using last_id and limit parameters.
        """
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        query_args = ConversationListQuery.model_validate(request.args.to_dict())
@@ -199,7 +199,7 @@ class ConversationDetailApi(Resource):
    def delete(self, app_model: App, end_user: EndUser, c_id: UUID):
        """Delete a specific conversation."""
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        conversation_id = str(c_id)
@@ -228,7 +228,7 @@ class ConversationRenameApi(Resource):
    def post(self, app_model: App, end_user: EndUser, c_id: UUID):
        """Rename a conversation or auto-generate a name."""
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        conversation_id = str(c_id)
@@ -7,7 +7,6 @@ paused human input forms in workflow/chatflow runs.

 import json
 import logging
-from collections.abc import Sequence

 from flask import Response
 from flask_restx import Resource
@@ -19,7 +18,6 @@ from controllers.service_api import service_api_ns
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.workflow.human_input_policy import HumanInputSurface, is_recipient_type_allowed_for_surface
 from extensions.ext_database import db
-from graphon.nodes.human_input.entities import FormInputConfig
 from libs.helper import to_timestamp
 from models.model import App, EndUser
 from services.human_input_service import Form, FormNotFoundError, HumanInputService
@@ -30,11 +28,11 @@ logger = logging.getLogger(__name__)
 register_schema_models(service_api_ns, HumanInputFormSubmitPayload)


-def _jsonify_form_definition(form: Form, *, inputs: Sequence[FormInputConfig] = ()) -> Response:
-    definition_payload = form.get_definition().model_dump(mode="json")
+def _jsonify_form_definition(form: Form) -> Response:
+    definition_payload = form.get_definition().model_dump()
    payload = {
        "form_content": definition_payload["rendered_content"],
-        "inputs": [form_input.model_dump(mode="json") for form_input in inputs],
+        "inputs": definition_payload["inputs"],
        "resolved_default_values": stringify_form_default_values(definition_payload["default_values"]),
        "user_actions": definition_payload["user_actions"],
        "expiration_time": to_timestamp(form.expiration_time),
@@ -77,8 +75,7 @@ class WorkflowHumanInputFormApi(Resource):
        _ensure_form_belongs_to_app(form, app_model)
        _ensure_form_is_allowed_for_service_api(form)
        service.ensure_form_active(form)
-        inputs = service.resolve_form_inputs(form)
-        return _jsonify_form_definition(form, inputs=inputs)
+        return _jsonify_form_definition(form)

    @service_api_ns.expect(service_api_ns.models[HumanInputFormSubmitPayload.__name__])
    @service_api_ns.doc("submit_human_input_form")
@@ -56,7 +56,7 @@ class MessageListApi(Resource):
        Retrieves messages with pagination support using first_id.
        """
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        query_args = MessageListQuery.model_validate(request.args.to_dict())
@@ -167,7 +167,7 @@ class MessageSuggestedApi(Resource):
        """
        message_id_str = str(message_id)
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        try:
@@ -30,7 +30,7 @@ from core.errors.error import (
    ProviderTokenNotInitError,
    QuotaExceededError,
 )
-from core.helper.trace_id_helper import get_external_trace_id, get_trace_session_id, omit_trace_session_id_from_payload
+from core.helper.trace_id_helper import get_external_trace_id
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from fields.base import ResponseModel
@@ -54,7 +54,6 @@ logger = logging.getLogger(__name__)

 class WorkflowRunPayload(WorkflowRunPayloadBase):
    response_mode: Literal["blocking", "streaming"] | None = None
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")


 class WorkflowLogQuery(BaseModel):
@@ -273,11 +272,8 @@ class WorkflowRunApi(Resource):
        if app_mode != AppMode.WORKFLOW:
            raise NotWorkflowAppError()

-        payload = WorkflowRunPayload.model_validate(omit_trace_session_id_from_payload(service_api_ns.payload) or {})
+        payload = WorkflowRunPayload.model_validate(service_api_ns.payload or {})
        args = payload.model_dump(exclude_none=True)
-        trace_session_id = get_trace_session_id(request)
-        if trace_session_id:
-            args["trace_session_id"] = trace_session_id
        external_trace_id = get_external_trace_id(request)
        if external_trace_id:
            args["external_trace_id"] = external_trace_id
@@ -332,11 +328,8 @@ class WorkflowRunByIdApi(Resource):
        if app_mode != AppMode.WORKFLOW:
            raise NotWorkflowAppError()

-        payload = WorkflowRunPayload.model_validate(omit_trace_session_id_from_payload(service_api_ns.payload) or {})
+        payload = WorkflowRunPayload.model_validate(service_api_ns.payload or {})
        args = payload.model_dump(exclude_none=True)
-        trace_session_id = get_trace_session_id(request)
-        if trace_session_id:
-            args["trace_session_id"] = trace_session_id

        # Add workflow_id to args for AppGenerateService
        args["workflow_id"] = workflow_id
@@ -23,7 +23,6 @@ from . import (
    feature,
    files,
    forgot_password,
-    human_input_file_upload,
    human_input_form,
    login,
    message,
@@ -47,7 +46,6 @@ __all__ = [
    "feature",
    "files",
    "forgot_password",
-    "human_input_file_upload",
    "human_input_form",
    "login",
    "message",
@@ -4,7 +4,7 @@ from typing import Any, cast
 from flask import request
 from flask_restx import Resource
 from pydantic import BaseModel, ConfigDict, Field
-from werkzeug.exceptions import Unauthorized
+from werkzeug.exceptions import BadRequest, Unauthorized

 from constants import HEADER_NAME_APP_CODE
 from controllers.common import fields
@@ -58,6 +58,9 @@ class AppParameterApi(WebApiResource):
    )
    def get(self, app_model: App, end_user: EndUser):
        """Retrieve app parameters."""
+        if not app_model.enable_site:
+            raise BadRequest("Site is disabled.")
+
        if app_model.mode in {AppMode.ADVANCED_CHAT, AppMode.WORKFLOW}:
            workflow = app_model.workflow
            if workflow is None:
@@ -2,7 +2,7 @@ import logging
 from typing import Any, Literal

 from pydantic import BaseModel, Field, field_validator
-from werkzeug.exceptions import BadRequest, InternalServerError, NotFound
+from werkzeug.exceptions import InternalServerError, NotFound

 import services
 from controllers.common.fields import SimpleResultResponse
@@ -37,15 +37,6 @@ from services.errors.llm import InvokeRateLimitError
 logger = logging.getLogger(__name__)


-def _resolve_agent_app_streaming(*, app_mode: AppMode, response_mode: str | None) -> bool:
-    """Agent App runtime is SSE-only until backend blocking runs are supported."""
-    if app_mode != AppMode.AGENT:
-        return response_mode == "streaming"
-    if response_mode == "blocking":
-        raise BadRequest("Agent App only supports streaming response mode.")
-    return True
-
-
 class CompletionMessagePayload(BaseModel):
    inputs: dict[str, Any] = Field(description="Input variables for the completion")
    query: str = Field(default="", description="Query text for completion")
@@ -180,13 +171,13 @@ class ChatApi(WebApiResource):
    )
    def post(self, app_model: App, end_user: EndUser):
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        payload = ChatMessagePayload.model_validate(web_ns.payload or {})
        args = payload.model_dump(exclude_none=True)

-        streaming = _resolve_agent_app_streaming(app_mode=app_mode, response_mode=payload.response_mode)
+        streaming = payload.response_mode == "streaming"
        args["auto_generate_name"] = False

        try:
@@ -237,7 +228,7 @@ class ChatStopApi(WebApiResource):
    @web_ns.response(200, "Success", web_ns.models[SimpleResultResponse.__name__])
    def post(self, app_model: App, end_user: EndUser, task_id: str):
        app_mode = AppMode.value_of(app_model.mode)
-        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT}:
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
            raise NotChatAppError()

        AppTaskService.stop_task(
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`../../.agents/skills/frontend-query-mutation`
				`@@ -1 +0,0 @@`
				`../../.agents/skills/how-to-write-component`