update action config.

.github/workflows/build-push.yml

@@ -6,7 +6,7 @@ on:
       - "main"
       - "deploy/dev"
       - "deploy/enterprise"
-      - "e-260"
+      - "e-0156"
   release:
     types: [published]
 

.markdownlint.json

@@ -1,3 +0,0 @@
-{
-    "MD024": false
-}

CHANGELOG.md

@@ -1,32 +0,0 @@
-# Changelog
-
-All notable changes to Dify will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [0.15.7] - 2025-04-27
-
-### Added
-
-- Added support for GPT-4.1 in model providers (#18912)
-- Added support for Amazon Bedrock DeepSeek-R1 model (#18908)
-- Added support for Amazon Bedrock Claude Sonnet 3.7 model (#18788)
-- Refined version compatibility logic in app DSL service
-
-### Fixed
-
-- Fixed issue with creating apps from template categories (#18807, #18868)
-- Fixed DSL version check when creating apps from explore templates (#18872, #18878)
-
-## [0.15.6] - 2025-04-22
-
-### Security
-
-- Fixed clickjacking vulnerability (#18552)
-- Fixed reset password security issue (#18366)
-- Updated reset password token when email code verification succeeds (#18362)
-
-### Fixed
-
-- Fixed Vertex AI Gemini 2.0 Flash 001 schema (#18405)

api/.env.example

@@ -430,7 +430,4 @@ CREATE_TIDB_SERVICE_JOB_ENABLED=false
 # Maximum number of submitted thread count in a ThreadPool for parallel node execution
 MAX_SUBMIT_COUNT=100
 # Lockout duration in seconds
-LOGIN_LOCKOUT_DURATION=86400
-
-# Prevent Clickjacking
-ALLOW_EMBED=false
+LOGIN_LOCKOUT_DURATION=86400

api/configs/packaging/__init__.py

@@ -9,7 +9,7 @@ class PackagingInfo(BaseSettings):
 
     CURRENT_VERSION: str = Field(
         description="Dify version",
-        default="0.15.7",
+        default="0.15.4",
     )
 
     COMMIT_SHA: str = Field(

api/controllers/console/app/app.py

@@ -2,28 +2,30 @@ import uuid
 from typing import cast
 
 from flask_login import current_user  # type: ignore
-from flask_restful import (Resource, inputs, marshal,  # type: ignore
-                           marshal_with, reqparse)
+from flask_restful import Resource, inputs, marshal, marshal_with, reqparse  # type: ignore
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 from werkzeug.exceptions import BadRequest, Forbidden, abort
 
 from controllers.console import api
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (account_initialization_required,
-                                       cloud_edition_billing_resource_check,
-                                       enterprise_license_required,
-                                       setup_required)
+from controllers.console.wraps import (
+    account_initialization_required,
+    cloud_edition_billing_resource_check,
+    enterprise_license_required,
+    setup_required,
+)
 from core.ops.ops_trace_manager import OpsTraceManager
 from extensions.ext_database import db
-from fields.app_fields import (app_detail_fields, app_detail_fields_with_site,
-                               app_pagination_fields)
+from fields.app_fields import (
+    app_detail_fields,
+    app_detail_fields_with_site,
+    app_pagination_fields,
+)
 from libs.login import login_required
 from models import Account, App
 from services.app_dsl_service import AppDslService, ImportMode
 from services.app_service import AppService
-from services.enterprise.enterprise_service import EnterpriseService
-from services.feature_service import FeatureService
 
 ALLOW_CREATE_APP_MODES = ["chat", "agent-chat", "advanced-chat", "workflow", "completion"]
 
@@ -65,17 +67,7 @@ class AppListApi(Resource):
         if not app_pagination:
             return {"data": [], "total": 0, "page": 1, "limit": 20, "has_more": False}
 
-        if FeatureService.get_system_features().webapp_auth.enabled:
-            app_ids = [str(app.id) for app in app_pagination.items]
-            res = EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id(app_ids=app_ids)
-            if len(res) != len(app_ids):
-                raise BadRequest("Invalid app id in webapp auth")
-
-            for app in app_pagination.items:
-                if str(app.id) in res:
-                    app.access_mode = res[str(app.id)].access_mode
-
-        return marshal(app_pagination, app_pagination_fields), 200
+        return marshal(app_pagination, app_pagination_fields)
 
     @setup_required
     @login_required
@@ -119,10 +111,6 @@ class AppApi(Resource):
 
         app_model = app_service.get_app(app_model)
 
-        if FeatureService.get_system_features().webapp_auth.enabled:
-            app_setting = EnterpriseService.WebAppAuth.get_app_access_mode_by_id(app_id=str(app_model.id))
-            app_model.access_mode = app_setting.access_mode
-
         return app_model
 
     @setup_required

api/controllers/console/auth/forgot_password.py

@@ -8,7 +8,7 @@ from constants.languages import languages
 from controllers.console import api
 from controllers.console.auth.error import EmailCodeError, InvalidEmailError, InvalidTokenError, PasswordMismatchError
 from controllers.console.error import AccountInFreezeError, AccountNotFound, EmailSendIpLimitError
-from controllers.console.wraps import email_password_login_enabled, setup_required
+from controllers.console.wraps import setup_required
 from events.tenant_event import tenant_was_created
 from extensions.ext_database import db
 from libs.helper import email, extract_remote_ip
@@ -16,13 +16,12 @@ from libs.password import hash_password, valid_password
 from models.account import Account
 from services.account_service import AccountService, TenantService
 from services.errors.account import AccountRegisterError
-from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
+from services.errors.workspace import WorkSpaceNotAllowedCreateError
 from services.feature_service import FeatureService
 
 
 class ForgotPasswordSendEmailApi(Resource):
     @setup_required
-    @email_password_login_enabled
     def post(self):
         parser = reqparse.RequestParser()
         parser.add_argument("email", type=email, required=True, location="json")
@@ -54,7 +53,6 @@ class ForgotPasswordSendEmailApi(Resource):
 
 class ForgotPasswordCheckApi(Resource):
     @setup_required
-    @email_password_login_enabled
     def post(self):
         parser = reqparse.RequestParser()
         parser.add_argument("email", type=str, required=True, location="json")
@@ -74,20 +72,11 @@ class ForgotPasswordCheckApi(Resource):
         if args["code"] != token_data.get("code"):
             raise EmailCodeError()
 
-        # Verified, revoke the first token
-        AccountService.revoke_reset_password_token(args["token"])
-
-        # Refresh token data by generating a new token
-        _, new_token = AccountService.generate_reset_password_token(
-            user_email, code=args["code"], additional_data={"phase": "reset"}
-        )
-
-        return {"is_valid": True, "email": token_data.get("email"), "token": new_token}
+        return {"is_valid": True, "email": token_data.get("email")}
 
 
 class ForgotPasswordResetApi(Resource):
     @setup_required
-    @email_password_login_enabled
     def post(self):
         parser = reqparse.RequestParser()
         parser.add_argument("token", type=str, required=True, nullable=False, location="json")
@@ -106,9 +95,6 @@ class ForgotPasswordResetApi(Resource):
 
         if reset_data is None:
             raise InvalidTokenError()
-        # Must use token in reset phase
-        if reset_data.get("phase", "") != "reset":
-            raise InvalidTokenError()
 
         AccountService.revoke_reset_password_token(token)
 
@@ -141,8 +127,6 @@ class ForgotPasswordResetApi(Resource):
                 pass
             except AccountRegisterError as are:
                 raise AccountInFreezeError()
-            except WorkspacesLimitExceededError:
-                pass
 
         return {"result": "success"}
 

api/controllers/console/auth/login.py

@@ -21,9 +21,8 @@ from controllers.console.error import (
     AccountNotFound,
     EmailSendIpLimitError,
     NotAllowedCreateWorkspace,
-    WorkspacesLimitExceeded,
 )
-from controllers.console.wraps import email_password_login_enabled, setup_required
+from controllers.console.wraps import setup_required
 from events.tenant_event import tenant_was_created
 from libs.helper import email, extract_remote_ip
 from libs.password import valid_password
@@ -31,7 +30,7 @@ from models.account import Account
 from services.account_service import AccountService, RegisterService, TenantService
 from services.billing_service import BillingService
 from services.errors.account import AccountRegisterError
-from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
+from services.errors.workspace import WorkSpaceNotAllowedCreateError
 from services.feature_service import FeatureService
 
 
@@ -39,7 +38,6 @@ class LoginApi(Resource):
     """Resource for user login."""
 
     @setup_required
-    @email_password_login_enabled
     def post(self):
         """Authenticate user and login."""
         parser = reqparse.RequestParser()
@@ -89,15 +87,10 @@ class LoginApi(Resource):
         # SELF_HOSTED only have one workspace
         tenants = TenantService.get_join_tenants(account)
         if len(tenants) == 0:
-            system_features = FeatureService.get_system_features()
-
-            if system_features.is_allow_create_workspace and not system_features.license.workspaces.is_available():
-                raise WorkspacesLimitExceeded()
-            else:
-                return {
-                    "result": "fail",
-                    "data": "workspace not found, please contact system admin to invite you to join in a workspace",
-                }
+            return {
+                "result": "fail",
+                "data": "workspace not found, please contact system admin to invite you to join in a workspace",
+            }
 
         token_pair = AccountService.login(account=account, ip_address=extract_remote_ip(request))
         AccountService.reset_login_error_rate_limit(args["email"])
@@ -117,7 +110,6 @@ class LogoutApi(Resource):
 
 class ResetPasswordSendEmailApi(Resource):
     @setup_required
-    @email_password_login_enabled
     def post(self):
         parser = reqparse.RequestParser()
         parser.add_argument("email", type=email, required=True, location="json")
@@ -204,9 +196,6 @@ class EmailCodeLoginApi(Resource):
         if account:
             tenant = TenantService.get_join_tenants(account)
             if not tenant:
-                workspaces = FeatureService.get_system_features().license.workspaces
-                if not workspaces.is_available():
-                    raise WorkspacesLimitExceeded()
                 if not FeatureService.get_system_features().is_allow_create_workspace:
                     raise NotAllowedCreateWorkspace()
                 else:
@@ -224,8 +213,6 @@ class EmailCodeLoginApi(Resource):
                 return NotAllowedCreateWorkspace()
             except AccountRegisterError as are:
                 raise AccountInFreezeError()
-            except WorkspacesLimitExceededError:
-                raise WorkspacesLimitExceeded()
         token_pair = AccountService.login(account, ip_address=extract_remote_ip(request))
         AccountService.reset_login_error_rate_limit(args["email"])
         return {"result": "success", "data": token_pair.model_dump()}

api/controllers/console/error.py

@@ -46,18 +46,6 @@ class NotAllowedCreateWorkspace(BaseHTTPException):
     code = 400
 
 
-class WorkspaceMembersLimitExceeded(BaseHTTPException):
-    error_code = "limit_exceeded"
-    description = "Unable to add member because the maximum workspace's member limit was exceeded"
-    code = 400
-
-
-class WorkspacesLimitExceeded(BaseHTTPException):
-    error_code = "limit_exceeded"
-    description = "Unable to create workspace because the maximum workspace limit was exceeded"
-    code = 400
-
-
 class AccountBannedError(BaseHTTPException):
     error_code = "account_banned"
     description = "Account is banned."

api/controllers/console/explore/error.py

@@ -23,9 +23,3 @@ class AppSuggestedQuestionsAfterAnswerDisabledError(BaseHTTPException):
     error_code = "app_suggested_questions_after_answer_disabled"
     description = "Function Suggested questions after answer disabled."
     code = 403
-
-
-class AppAccessDeniedError(BaseHTTPException):
-    error_code = "access_denied"
-    description = "App access denied."
-    code = 403

api/controllers/console/explore/installed_app.py

@@ -1,26 +1,20 @@
-import logging
 from datetime import UTC, datetime
 from typing import Any
 
 from flask import request
 from flask_login import current_user  # type: ignore
-from flask_restful import (Resource, inputs, marshal_with,  # type: ignore
-                           reqparse)
+from flask_restful import Resource, inputs, marshal_with, reqparse  # type: ignore
 from sqlalchemy import and_
 from werkzeug.exceptions import BadRequest, Forbidden, NotFound
 
 from controllers.console import api
 from controllers.console.explore.wraps import InstalledAppResource
-from controllers.console.wraps import (account_initialization_required,
-                                       cloud_edition_billing_resource_check)
+from controllers.console.wraps import account_initialization_required, cloud_edition_billing_resource_check
 from extensions.ext_database import db
 from fields.installed_app_fields import installed_app_list_fields
 from libs.login import login_required
 from models import App, InstalledApp, RecommendedApp
 from services.account_service import TenantService
-from services.app_service import AppService
-from services.enterprise.enterprise_service import EnterpriseService
-from services.feature_service import FeatureService
 
 
 class InstalledAppsListApi(Resource):
@@ -54,23 +48,6 @@ class InstalledAppsListApi(Resource):
             for installed_app in installed_apps
             if installed_app.app is not None
         ]
-
-        # filter out apps that user doesn't have access to
-        if FeatureService.get_system_features().webapp_auth.enabled:
-            user_id = current_user.id
-            res = []
-            for installed_app in installed_app_list:
-                app_code = AppService.get_app_code_by_id(str(installed_app["app"].id))
-                if EnterpriseService.WebAppAuth.is_user_allowed_to_access_webapp(
-                    user_id=user_id,
-                    app_code=app_code,
-                ):
-                    res.append(installed_app)
-            installed_app_list = res
-            logging.info(
-                f"installed_app_list: {installed_app_list}, user_id: {user_id}"
-            )
-
         installed_app_list.sort(
             key=lambda app: (
                 -app["is_pinned"],

api/controllers/console/explore/wraps.py

@@ -4,14 +4,10 @@ from flask_login import current_user  # type: ignore
 from flask_restful import Resource  # type: ignore
 from werkzeug.exceptions import NotFound
 
-from controllers.console.explore.error import AppAccessDeniedError
 from controllers.console.wraps import account_initialization_required
 from extensions.ext_database import db
 from libs.login import login_required
 from models import InstalledApp
-from services.app_service import AppService
-from services.enterprise.enterprise_service import EnterpriseService
-from services.feature_service import FeatureService
 
 
 def installed_app_required(view=None):
@@ -52,30 +48,6 @@ def installed_app_required(view=None):
     return decorator
 
 
-def user_allowed_to_access_app(view=None):
-    def decorator(view):
-        @wraps(view)
-        def decorated(installed_app: InstalledApp, *args, **kwargs):
-            feature = FeatureService.get_system_features()
-            if feature.webapp_auth.enabled:
-                app_id = installed_app.app_id
-                app_code = AppService.get_app_code_by_id(app_id)
-                res = EnterpriseService.WebAppAuth.is_user_allowed_to_access_webapp(
-                    user_id=str(current_user.id),
-                    app_code=app_code,
-                )
-                if not res:
-                    raise AppAccessDeniedError()
-
-            return view(installed_app, *args, **kwargs)
-
-        return decorated
-    if view:
-        return decorator(view)
-    return decorator
-
-
 class InstalledAppResource(Resource):
     # must be reversed if there are multiple decorators
-
-    method_decorators = [user_allowed_to_access_app, installed_app_required, account_initialization_required, login_required]
+    method_decorators = [installed_app_required, account_initialization_required, login_required]

api/controllers/console/workspace/members.py

@@ -6,7 +6,6 @@ from flask_restful import Resource, abort, marshal_with, reqparse  # type: ignor
 import services
 from configs import dify_config
 from controllers.console import api
-from controllers.console.error import WorkspaceMembersLimitExceeded
 from controllers.console.wraps import (
     account_initialization_required,
     cloud_edition_billing_resource_check,
@@ -18,7 +17,6 @@ from libs.login import login_required
 from models.account import Account, TenantAccountRole
 from services.account_service import RegisterService, TenantService
 from services.errors.account import AccountAlreadyInTenantError
-from services.feature_service import FeatureService
 
 
 class MemberListApi(Resource):
@@ -56,12 +54,6 @@ class MemberInviteEmailApi(Resource):
         inviter = current_user
         invitation_results = []
         console_web_url = dify_config.CONSOLE_WEB_URL
-
-        workspace_members = FeatureService.get_features(tenant_id=inviter.current_tenant.id).workspace_members
-
-        if not workspace_members.is_available(len(invitee_emails)):
-            raise WorkspaceMembersLimitExceeded()
-
         for invitee_email in invitee_emails:
             try:
                 token = RegisterService.invite_new_member(

api/controllers/console/wraps.py

@@ -165,16 +165,3 @@ def enterprise_license_required(view):
         return view(*args, **kwargs)
 
     return decorated
-
-
-def email_password_login_enabled(view):
-    @wraps(view)
-    def decorated(*args, **kwargs):
-        features = FeatureService.get_system_features()
-        if features.enable_email_password_login:
-            return view(*args, **kwargs)
-
-        # otherwise, return 403
-        abort(403)
-
-    return decorated

api/controllers/inner_api/__init__.py

@@ -5,5 +5,5 @@ from libs.external_api import ExternalApi
 bp = Blueprint("inner_api", __name__, url_prefix="/inner/api")
 api = ExternalApi(bp)
 
-from . import mail
 from .workspace import workspace
+from . import mail

api/controllers/inner_api/mail.py

@@ -1,7 +1,5 @@
-from flask_restful import (
-    Resource,  # type: ignore
-    reqparse,
-)
+from flask_restful import Resource  # type: ignore
+from flask_restful import reqparse
 
 from controllers.console.wraps import setup_required
 from controllers.inner_api import api
@@ -14,7 +12,7 @@ class EnterpriseMail(Resource):
     @inner_api_only
     def post(self):
         parser = reqparse.RequestParser()
-        parser.add_argument("to", type=str, action="append", required=True)
+        parser.add_argument("to", type=str, action='append', required=True)
         parser.add_argument("subject", type=str, required=True)
         parser.add_argument("body", type=str, required=True)
         parser.add_argument("substitutions", type=dict, required=False)

api/controllers/web/app.py

@@ -1,16 +1,12 @@
-
-from flask import request
-from flask_restful import Resource, marshal_with, reqparse  # type: ignore
+from flask_restful import marshal_with  # type: ignore
 
 from controllers.common import fields
 from controllers.common import helpers as controller_helpers
 from controllers.web import api
 from controllers.web.error import AppUnavailableError
 from controllers.web.wraps import WebApiResource
-from libs.passport import PassportService
 from models.model import App, AppMode
 from services.app_service import AppService
-from services.enterprise.enterprise_service import EnterpriseService
 
 
 class AppParameterApi(WebApiResource):
@@ -46,51 +42,5 @@ class AppMeta(WebApiResource):
         return AppService().get_app_meta(app_model)
 
 
-class AppAccessMode(Resource):
-    def get(self):
-        parser = reqparse.RequestParser()
-        parser.add_argument("appId", type=str, required=True, location="args")
-        args = parser.parse_args()
-
-        app_id = args["appId"]
-        res = EnterpriseService.WebAppAuth.get_app_access_mode_by_id(app_id)
-
-        return {"accessMode": res.access_mode}
-
-
-class AppWebAuthPermission(Resource):
-    def get(self):
-        user_id = "visitor"
-        try:
-            auth_header = request.headers.get("Authorization")
-            if auth_header is None:
-                raise
-            if " " not in auth_header:
-                raise
-
-            auth_scheme, tk = auth_header.split(None, 1)
-            auth_scheme = auth_scheme.lower()
-            if auth_scheme != "bearer":
-                raise
-
-            decoded = PassportService().verify(tk)
-            user_id = decoded.get("user_id", "visitor")
-        except Exception as e:
-            pass
-
-        parser = reqparse.RequestParser()
-        parser.add_argument("appId", type=str, required=True, location="args")
-        args = parser.parse_args()
-
-        app_id = args["appId"]
-        app_code = AppService.get_app_code_by_id(app_id)
-
-        res = EnterpriseService.WebAppAuth.is_user_allowed_to_access_webapp(str(user_id), app_code)
-        return {"result": res}
-
-
 api.add_resource(AppParameterApi, "/parameters")
 api.add_resource(AppMeta, "/meta")
-# webapp auth apis
-api.add_resource(AppAccessMode, "/webapp/access-mode")
-api.add_resource(AppWebAuthPermission, "/webapp/permission")

api/controllers/web/error.py

@@ -121,15 +121,9 @@ class UnsupportedFileTypeError(BaseHTTPException):
     code = 415
 
 
-class WebAppAuthRequiredError(BaseHTTPException):
+class WebSSOAuthRequiredError(BaseHTTPException):
     error_code = "web_sso_auth_required"
-    description = "Web app authentication required."
-    code = 401
-
-
-class WebAppAuthAccessDeniedError(BaseHTTPException):
-    error_code = "web_app_access_denied"
-    description = "You do not have permission to access this web app."
+    description = "Web SSO authentication required."
     code = 401
 
 

api/controllers/web/login.py

@@ -1,121 +0,0 @@
-from flask import request
-from flask_restful import Resource, reqparse
-from jwt import InvalidTokenError  # type: ignore
-from web import api
-from werkzeug.exceptions import BadRequest
-
-import services
-from controllers.console.auth.error import EmailCodeError, EmailOrPasswordMismatchError, InvalidEmailError
-from controllers.console.error import AccountBannedError, AccountNotFound
-from controllers.console.wraps import setup_required
-from libs.helper import email
-from libs.password import valid_password
-from services.account_service import AccountService
-from services.webapp_auth_service import WebAppAuthService
-
-
-class LoginApi(Resource):
-    """Resource for web app email/password login."""
-
-    def post(self):
-        """Authenticate user and login."""
-        parser = reqparse.RequestParser()
-        parser.add_argument("email", type=email, required=True, location="json")
-        parser.add_argument("password", type=valid_password, required=True, location="json")
-        args = parser.parse_args()
-
-        app_code = request.headers.get("X-App-Code")
-        if app_code is None:
-            raise BadRequest("X-App-Code header is missing.")
-
-        try:
-            account = WebAppAuthService.authenticate(args["email"], args["password"])
-        except services.errors.account.AccountLoginError:
-            raise AccountBannedError()
-        except services.errors.account.AccountPasswordError:
-            raise EmailOrPasswordMismatchError()
-        except services.errors.account.AccountNotFoundError:
-            raise AccountNotFound()
-
-        WebAppAuthService._validate_user_accessibility(account=account, app_code=app_code)
-
-        end_user = WebAppAuthService.create_end_user(email=args["email"], app_code=app_code)
-
-        token = WebAppAuthService.login(account=account, app_code=app_code, end_user_id=end_user.id)
-        return {"result": "success", "token": token}
-
-
-# class LogoutApi(Resource):
-#     @setup_required
-#     def get(self):
-#         account = cast(Account, flask_login.current_user)
-#         if isinstance(account, flask_login.AnonymousUserMixin):
-#             return {"result": "success"}
-#         flask_login.logout_user()
-#         return {"result": "success"}
-
-
-class EmailCodeLoginSendEmailApi(Resource):
-    @setup_required
-    def post(self):
-        parser = reqparse.RequestParser()
-        parser.add_argument("email", type=email, required=True, location="json")
-        parser.add_argument("language", type=str, required=False, location="json")
-        args = parser.parse_args()
-
-        if args["language"] is not None and args["language"] == "zh-Hans":
-            language = "zh-Hans"
-        else:
-            language = "en-US"
-
-        account = WebAppAuthService.get_user_through_email(args["email"])
-        if account is None:
-            raise AccountNotFound()
-        else:
-            token = WebAppAuthService.send_email_code_login_email(account=account, language=language)
-
-        return {"result": "success", "data": token}
-
-
-class EmailCodeLoginApi(Resource):
-    @setup_required
-    def post(self):
-        parser = reqparse.RequestParser()
-        parser.add_argument("email", type=str, required=True, location="json")
-        parser.add_argument("code", type=str, required=True, location="json")
-        parser.add_argument("token", type=str, required=True, location="json")
-        args = parser.parse_args()
-
-        user_email = args["email"]
-        app_code = request.headers.get("X-App-Code")
-        if app_code is None:
-            raise BadRequest("X-App-Code header is missing.")
-
-        token_data = WebAppAuthService.get_email_code_login_data(args["token"])
-        if token_data is None:
-            raise InvalidTokenError()
-
-        if token_data["email"] != args["email"]:
-            raise InvalidEmailError()
-
-        if token_data["code"] != args["code"]:
-            raise EmailCodeError()
-
-        WebAppAuthService.revoke_email_code_login_token(args["token"])
-        account = WebAppAuthService.get_user_through_email(user_email)
-        if not account:
-            raise AccountNotFound()
-
-        WebAppAuthService._validate_user_accessibility(account=account, app_code=app_code)
-
-        end_user = WebAppAuthService.create_end_user(email=user_email, app_code=app_code)
-
-        token = WebAppAuthService.login(account=account, app_code=app_code, end_user_id=end_user.id)
-        AccountService.reset_login_error_rate_limit(args["email"])
-        return {"result": "success", "token": token}
-
-
-api.add_resource(LoginApi, "/login")
-# api.add_resource(LogoutApi, "/logout")
-api.add_resource(EmailCodeLoginSendEmailApi, "/email-code-login")
-api.add_resource(EmailCodeLoginApi, "/email-code-login/validity")

api/controllers/web/passport.py

@@ -5,7 +5,7 @@ from flask_restful import Resource  # type: ignore
 from werkzeug.exceptions import NotFound, Unauthorized
 
 from controllers.web import api
-from controllers.web.error import WebAppAuthRequiredError
+from controllers.web.error import WebSSOAuthRequiredError
 from extensions.ext_database import db
 from libs.passport import PassportService
 from models.model import App, EndUser, Site
@@ -22,10 +22,10 @@ class PassportResource(Resource):
         if app_code is None:
             raise Unauthorized("X-App-Code header is missing.")
 
-        if system_features.webapp_auth.enabled:
-            app_settings = EnterpriseService.WebAppAuth.get_app_access_mode_by_code(app_code=app_code)
-            if not app_settings or not app_settings.access_mode == "public":
-                raise WebAppAuthRequiredError()
+        if system_features.sso_enforced_for_web:
+            app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+            if app_web_sso_enabled:
+                raise WebSSOAuthRequiredError()
 
         # get site from db and check if it is normal
         site = db.session.query(Site).filter(Site.code == app_code, Site.status == "normal").first()

api/controllers/web/wraps.py

@@ -4,7 +4,7 @@ from flask import request
 from flask_restful import Resource  # type: ignore
 from werkzeug.exceptions import BadRequest, NotFound, Unauthorized
 
-from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError
+from controllers.web.error import WebSSOAuthRequiredError
 from extensions.ext_database import db
 from libs.passport import PassportService
 from models.model import App, EndUser, Site
@@ -57,53 +57,35 @@ def decode_jwt_token():
         if not end_user:
             raise NotFound()
 
-        # for enterprise webapp auth
-        app_web_auth_enabled = False
-        if system_features.webapp_auth.enabled:
-            app_web_auth_enabled = (
-                EnterpriseService.WebAppAuth.get_app_access_mode_by_code(app_code=app_code).access_mode != "public"
-            )
-
-        _validate_webapp_token(decoded, app_web_auth_enabled, system_features.webapp_auth.enabled)
-        _validate_user_accessibility(decoded, app_code, app_web_auth_enabled, system_features.webapp_auth.enabled)
+        _validate_web_sso_token(decoded, system_features, app_code)
 
         return app_model, end_user
     except Unauthorized as e:
-        if system_features.webapp_auth.enabled:
-            app_web_auth_enabled = (
-                EnterpriseService.WebAppAuth.get_app_access_mode_by_code(app_code=app_code).access_mode != "public"
-            )
-            if app_web_auth_enabled:
-                raise WebAppAuthRequiredError()
+        if system_features.sso_enforced_for_web:
+            app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+            if app_web_sso_enabled:
+                raise WebSSOAuthRequiredError()
 
         raise Unauthorized(e.description)
 
 
-def _validate_webapp_token(decoded, app_web_auth_enabled: bool, system_webapp_auth_enabled: bool):
-    # Check if authentication is enforced for web app, and if the token source is not webapp,
-    # raise an error and redirect to login
-    if system_webapp_auth_enabled and app_web_auth_enabled:
-        source = decoded.get("token_source")
-        if not source or source != "webapp":
-            raise WebAppAuthRequiredError()
+def _validate_web_sso_token(decoded, system_features, app_code):
+    app_web_sso_enabled = False
 
-    # Check if authentication is not enforced for web, and if the token source is webapp,
+    # Check if SSO is enforced for web, and if the token source is not SSO, raise an error and redirect to SSO login
+    if system_features.sso_enforced_for_web:
+        app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+        if app_web_sso_enabled:
+            source = decoded.get("token_source")
+            if not source or source != "sso":
+                raise WebSSOAuthRequiredError()
+
+    # Check if SSO is not enforced for web, and if the token source is SSO,
     # raise an error and redirect to normal passport login
-    if not system_webapp_auth_enabled or not app_web_auth_enabled:
+    if not system_features.sso_enforced_for_web or not app_web_sso_enabled:
         source = decoded.get("token_source")
-        if source and source == "webapp":
-            raise Unauthorized("webapp token expired.")
-
-
-def _validate_user_accessibility(decoded, app_code, app_web_auth_enabled: bool, system_webapp_auth_enabled: bool):
-    if system_webapp_auth_enabled and app_web_auth_enabled:
-        # Check if the user is allowed to access the web app
-        user_id = decoded.get("user_id")
-        if not user_id:
-            raise WebAppAuthRequiredError()
-
-        if not EnterpriseService.WebAppAuth.is_user_allowed_to_access_webapp(user_id, app_code=app_code):
-            raise WebAppAuthAccessDeniedError()
+        if source and source == "sso":
+            raise Unauthorized("sso token expired.")
 
 
 class WebApiResource(Resource):

api/core/agent/cot_agent_runner.py

@@ -104,6 +104,7 @@ class CotAgentRunner(BaseAgentRunner, ABC):
 
             # recalc llm max tokens
             prompt_messages = self._organize_prompt_messages()
+            self.recalc_llm_max_tokens(self.model_config, prompt_messages)
             # invoke model
             chunks = model_instance.invoke_llm(
                 prompt_messages=prompt_messages,

api/core/agent/fc_agent_runner.py

@@ -84,6 +84,7 @@ class FunctionCallAgentRunner(BaseAgentRunner):
 
             # recalc llm max tokens
             prompt_messages = self._organize_prompt_messages()
+            self.recalc_llm_max_tokens(self.model_config, prompt_messages)
             # invoke model
             chunks: Union[Generator[LLMResultChunk, None, None], LLMResult] = model_instance.invoke_llm(
                 prompt_messages=prompt_messages,

api/core/app/apps/agent_chat/app_runner.py

@@ -55,6 +55,20 @@ class AgentChatAppRunner(AppRunner):
         query = application_generate_entity.query
         files = application_generate_entity.files
 
+        # Pre-calculate the number of tokens of the prompt messages,
+        # and return the rest number of tokens by model context token size limit and max token size limit.
+        # If the rest number of tokens is not enough, raise exception.
+        # Include: prompt template, inputs, query(optional), files(optional)
+        # Not Include: memory, external data, dataset context
+        self.get_pre_calculate_rest_tokens(
+            app_record=app_record,
+            model_config=application_generate_entity.model_conf,
+            prompt_template_entity=app_config.prompt_template,
+            inputs=inputs,
+            files=files,
+            query=query,
+        )
+
         memory = None
         if application_generate_entity.conversation_id:
             # get memory of conversation (read-only)

api/core/app/apps/base_app_runner.py

@@ -15,8 +15,10 @@ from core.app.features.annotation_reply.annotation_reply import AnnotationReplyF
 from core.app.features.hosting_moderation.hosting_moderation import HostingModerationFeature
 from core.external_data_tool.external_data_fetch import ExternalDataFetch
 from core.memory.token_buffer_memory import TokenBufferMemory
+from core.model_manager import ModelInstance
 from core.model_runtime.entities.llm_entities import LLMResult, LLMResultChunk, LLMResultChunkDelta, LLMUsage
 from core.model_runtime.entities.message_entities import AssistantPromptMessage, PromptMessage
+from core.model_runtime.entities.model_entities import ModelPropertyKey
 from core.model_runtime.errors.invoke import InvokeBadRequestError
 from core.moderation.input_moderation import InputModeration
 from core.prompt.advanced_prompt_transform import AdvancedPromptTransform
@@ -29,6 +31,106 @@ if TYPE_CHECKING:
 
 
 class AppRunner:
+    def get_pre_calculate_rest_tokens(
+        self,
+        app_record: App,
+        model_config: ModelConfigWithCredentialsEntity,
+        prompt_template_entity: PromptTemplateEntity,
+        inputs: Mapping[str, str],
+        files: Sequence["File"],
+        query: Optional[str] = None,
+    ) -> int:
+        """
+        Get pre calculate rest tokens
+        :param app_record: app record
+        :param model_config: model config entity
+        :param prompt_template_entity: prompt template entity
+        :param inputs: inputs
+        :param files: files
+        :param query: query
+        :return:
+        """
+        # Invoke model
+        model_instance = ModelInstance(
+            provider_model_bundle=model_config.provider_model_bundle, model=model_config.model
+        )
+
+        model_context_tokens = model_config.model_schema.model_properties.get(ModelPropertyKey.CONTEXT_SIZE)
+
+        max_tokens = 0
+        for parameter_rule in model_config.model_schema.parameter_rules:
+            if parameter_rule.name == "max_tokens" or (
+                parameter_rule.use_template and parameter_rule.use_template == "max_tokens"
+            ):
+                max_tokens = (
+                    model_config.parameters.get(parameter_rule.name)
+                    or model_config.parameters.get(parameter_rule.use_template or "")
+                ) or 0
+
+        if model_context_tokens is None:
+            return -1
+
+        if max_tokens is None:
+            max_tokens = 0
+
+        # get prompt messages without memory and context
+        prompt_messages, stop = self.organize_prompt_messages(
+            app_record=app_record,
+            model_config=model_config,
+            prompt_template_entity=prompt_template_entity,
+            inputs=inputs,
+            files=files,
+            query=query,
+        )
+
+        prompt_tokens = model_instance.get_llm_num_tokens(prompt_messages)
+
+        rest_tokens: int = model_context_tokens - max_tokens - prompt_tokens
+        if rest_tokens < 0:
+            raise InvokeBadRequestError(
+                "Query or prefix prompt is too long, you can reduce the prefix prompt, "
+                "or shrink the max token, or switch to a llm with a larger token limit size."
+            )
+
+        return rest_tokens
+
+    def recalc_llm_max_tokens(
+        self, model_config: ModelConfigWithCredentialsEntity, prompt_messages: list[PromptMessage]
+    ):
+        # recalc max_tokens if sum(prompt_token +  max_tokens) over model token limit
+        model_instance = ModelInstance(
+            provider_model_bundle=model_config.provider_model_bundle, model=model_config.model
+        )
+
+        model_context_tokens = model_config.model_schema.model_properties.get(ModelPropertyKey.CONTEXT_SIZE)
+
+        max_tokens = 0
+        for parameter_rule in model_config.model_schema.parameter_rules:
+            if parameter_rule.name == "max_tokens" or (
+                parameter_rule.use_template and parameter_rule.use_template == "max_tokens"
+            ):
+                max_tokens = (
+                    model_config.parameters.get(parameter_rule.name)
+                    or model_config.parameters.get(parameter_rule.use_template or "")
+                ) or 0
+
+        if model_context_tokens is None:
+            return -1
+
+        if max_tokens is None:
+            max_tokens = 0
+
+        prompt_tokens = model_instance.get_llm_num_tokens(prompt_messages)
+
+        if prompt_tokens + max_tokens > model_context_tokens:
+            max_tokens = max(model_context_tokens - prompt_tokens, 16)
+
+            for parameter_rule in model_config.model_schema.parameter_rules:
+                if parameter_rule.name == "max_tokens" or (
+                    parameter_rule.use_template and parameter_rule.use_template == "max_tokens"
+                ):
+                    model_config.parameters[parameter_rule.name] = max_tokens
+
     def organize_prompt_messages(
         self,
         app_record: App,

api/core/app/apps/chat/app_runner.py

@@ -50,6 +50,20 @@ class ChatAppRunner(AppRunner):
         query = application_generate_entity.query
         files = application_generate_entity.files
 
+        # Pre-calculate the number of tokens of the prompt messages,
+        # and return the rest number of tokens by model context token size limit and max token size limit.
+        # If the rest number of tokens is not enough, raise exception.
+        # Include: prompt template, inputs, query(optional), files(optional)
+        # Not Include: memory, external data, dataset context
+        self.get_pre_calculate_rest_tokens(
+            app_record=app_record,
+            model_config=application_generate_entity.model_conf,
+            prompt_template_entity=app_config.prompt_template,
+            inputs=inputs,
+            files=files,
+            query=query,
+        )
+
         memory = None
         if application_generate_entity.conversation_id:
             # get memory of conversation (read-only)
@@ -180,6 +194,9 @@ class ChatAppRunner(AppRunner):
         if hosting_moderation_result:
             return
 
+        # Re-calculate the max tokens if sum(prompt_token +  max_tokens) over model token limit
+        self.recalc_llm_max_tokens(model_config=application_generate_entity.model_conf, prompt_messages=prompt_messages)
+
         # Invoke model
         model_instance = ModelInstance(
             provider_model_bundle=application_generate_entity.model_conf.provider_model_bundle,

api/core/app/apps/completion/app_runner.py

@@ -43,6 +43,20 @@ class CompletionAppRunner(AppRunner):
         query = application_generate_entity.query
         files = application_generate_entity.files
 
+        # Pre-calculate the number of tokens of the prompt messages,
+        # and return the rest number of tokens by model context token size limit and max token size limit.
+        # If the rest number of tokens is not enough, raise exception.
+        # Include: prompt template, inputs, query(optional), files(optional)
+        # Not Include: memory, external data, dataset context
+        self.get_pre_calculate_rest_tokens(
+            app_record=app_record,
+            model_config=application_generate_entity.model_conf,
+            prompt_template_entity=app_config.prompt_template,
+            inputs=inputs,
+            files=files,
+            query=query,
+        )
+
         # organize all inputs and template to prompt messages
         # Include: prompt template, inputs, query(optional), files(optional)
         prompt_messages, stop = self.organize_prompt_messages(
@@ -138,6 +152,9 @@ class CompletionAppRunner(AppRunner):
         if hosting_moderation_result:
             return
 
+        # Re-calculate the max tokens if sum(prompt_token +  max_tokens) over model token limit
+        self.recalc_llm_max_tokens(model_config=application_generate_entity.model_conf, prompt_messages=prompt_messages)
+
         # Invoke model
         model_instance = ModelInstance(
             provider_model_bundle=application_generate_entity.model_conf.provider_model_bundle,

api/core/memory/token_buffer_memory.py

@@ -26,7 +26,7 @@ class TokenBufferMemory:
         self.model_instance = model_instance
 
     def get_history_prompt_messages(
-        self, max_token_limit: int = 100000, message_limit: Optional[int] = None
+        self, max_token_limit: int = 2000, message_limit: Optional[int] = None
     ) -> Sequence[PromptMessage]:
         """
         Get history prompt messages.

api/core/model_runtime/model_providers/bedrock/llm/eu.anthropic.claude-3.7-sonnet-v1.yaml

@@ -1,115 +0,0 @@
-model: us.anthropic.claude-3-7-sonnet-20250219-v1:0
-label:
-  en_US: Claude 3.7 Sonnet(US.Cross Region Inference)
-icon: icon_s_en.svg
-model_type: llm
-features:
-  - agent-thought
-  - vision
-  - tool-call
-  - stream-tool-call
-model_properties:
-  mode: chat
-  context_size: 200000
-# docs: https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages.html
-parameter_rules:
-  - name: enable_cache
-    label:
-      zh_Hans: 启用提示缓存
-      en_US: Enable Prompt Cache
-    type: boolean
-    required: false
-    default: true
-    help:
-      zh_Hans: 启用提示缓存可以提高性能并降低成本。Claude 3.7 Sonnet支持在system、messages和tools字段中使用缓存检查点。
-      en_US: Enable prompt caching to improve performance and reduce costs. Claude 3.7 Sonnet supports cache checkpoints in system, messages, and tools fields.
-  - name: reasoning_type
-    label:
-      zh_Hans: 推理配置
-      en_US: Reasoning Type
-    type: boolean
-    required: false
-    default: false
-    placeholder:
-      zh_Hans: 设置推理配置
-      en_US: Set reasoning configuration
-    help:
-      zh_Hans: 控制模型的推理能力。启用时，temperature将固定为1且top_p将被禁用。
-      en_US: Controls the model's reasoning capability. When enabled, temperature will be fixed to 1 and top_p will be disabled.
-  - name: reasoning_budget
-    show_on:
-      - variable: reasoning_type
-        value: true
-    label:
-      zh_Hans: 推理预算
-      en_US: Reasoning Budget
-    type: int
-    default: 1024
-    min: 0
-    max: 128000
-    help:
-      zh_Hans: 推理的预算限制（最小1024），必须小于max_tokens。仅在推理类型为enabled时可用。
-      en_US: Budget limit for reasoning (minimum 1024), must be less than max_tokens. Only available when reasoning type is enabled.
-
-  - name: max_tokens
-    use_template: max_tokens
-    required: true
-    label:
-      zh_Hans: 最大token数
-      en_US: Max Tokens
-    type: int
-    default: 8192
-    min: 1
-    max: 128000
-    help:
-      zh_Hans: 停止前生成的最大令牌数。请注意，Anthropic Claude 模型可能会在达到 max_tokens 的值之前停止生成令牌。不同的 Anthropic Claude 模型对此参数具有不同的最大值。
-      en_US: The maximum number of tokens to generate before stopping. Note that Anthropic Claude models might stop generating tokens before reaching the value of max_tokens. Different Anthropic Claude models have different maximum values for this parameter.
-  - name: temperature
-    use_template: temperature
-    required: false
-    label:
-      zh_Hans: 模型温度
-      en_US: Model Temperature
-    type: float
-    default: 1
-    min: 0.0
-    max: 1.0
-    help:
-      zh_Hans: 生成内容的随机性。当推理功能启用时，该值将被固定为1。
-      en_US: The amount of randomness injected into the response. When reasoning is enabled, this value will be fixed to 1.
-  - name: top_p
-    show_on:
-      - variable: reasoning_type
-        value: disabled
-    use_template: top_p
-    label:
-      zh_Hans: Top P
-      en_US: Top P
-    required: false
-    type: float
-    default: 0.999
-    min: 0.000
-    max: 1.000
-    help:
-      zh_Hans: 在核采样中的概率阈值。当推理功能启用时，该参数将被禁用。
-      en_US: The probability threshold in nucleus sampling. When reasoning is enabled, this parameter will be disabled.
-  - name: top_k
-    label:
-      zh_Hans: 取样数量
-      en_US: Top k
-    required: false
-    type: int
-    default: 0
-    min: 0
-    # tip docs from aws has error, max value is 500
-    max: 500
-    help:
-      zh_Hans: 对于每个后续标记，仅从前 K 个选项中进行采样。使用 top_k 删除长尾低概率响应。
-      en_US: Only sample from the top K options for each subsequent token. Use top_k to remove long tail low probability responses.
-  - name: response_format
-    use_template: response_format
-pricing:
-  input: '0.003'
-  output: '0.015'
-  unit: '0.001'
-  currency: USD

api/core/model_runtime/model_providers/bedrock/llm/llm.py

@@ -58,7 +58,6 @@ class BedrockLargeLanguageModel(LargeLanguageModel):
     # TODO There is invoke issue: context limit on Cohere Model, will add them after fixed.
     CONVERSE_API_ENABLED_MODEL_INFO = [
         {"prefix": "anthropic.claude-v2", "support_system_prompts": True, "support_tool_use": False},
-        {"prefix": "us.deepseek", "support_system_prompts": True, "support_tool_use": False},
         {"prefix": "anthropic.claude-v1", "support_system_prompts": True, "support_tool_use": False},
         {"prefix": "us.anthropic.claude-3", "support_system_prompts": True, "support_tool_use": True},
         {"prefix": "eu.anthropic.claude-3", "support_system_prompts": True, "support_tool_use": True},

api/core/model_runtime/model_providers/bedrock/llm/us.deepseek-r1.yaml

@@ -1,63 +0,0 @@
-model: us.deepseek.r1-v1:0
-label:
-  en_US: DeepSeek-R1(US.Cross Region Inference)
-icon: icon_s_en.svg
-model_type: llm
-features:
-  - agent-thought
-  - vision
-  - tool-call
-  - stream-tool-call
-model_properties:
-  mode: chat
-  context_size: 32768
-parameter_rules:
-  - name: max_tokens
-    use_template: max_tokens
-    required: true
-    label:
-      zh_Hans: 最大token数
-      en_US: Max Tokens
-    type: int
-    default: 8192
-    min: 1
-    max: 128000
-    help:
-      zh_Hans: 停止前生成的最大令牌数。
-      en_US: The maximum number of tokens to generate before stopping.
-  - name: temperature
-    use_template: temperature
-    required: false
-    label:
-      zh_Hans: 模型温度
-      en_US: Model Temperature
-    type: float
-    default: 1
-    min: 0.0
-    max: 1.0
-    help:
-      zh_Hans: 生成内容的随机性。当推理功能启用时，该值将被固定为1。
-      en_US: The amount of randomness injected into the response. When reasoning is enabled, this value will be fixed to 1.
-  - name: top_p
-    show_on:
-      - variable: reasoning_type
-        value: disabled
-    use_template: top_p
-    label:
-      zh_Hans: Top P
-      en_US: Top P
-    required: false
-    type: float
-    default: 0.999
-    min: 0.000
-    max: 1.000
-    help:
-      zh_Hans: 在核采样中的概率阈值。当推理功能启用时，该参数将被禁用。
-      en_US: The probability threshold in nucleus sampling. When reasoning is enabled, this parameter will be disabled.
-  - name: response_format
-    use_template: response_format
-pricing:
-  input: '0.001'
-  output: '0.005'
-  unit: '0.001'
-  currency: USD

api/core/model_runtime/model_providers/google/google.py

@@ -19,8 +19,8 @@ class GoogleProvider(ModelProvider):
         try:
             model_instance = self.get_model_instance(ModelType.LLM)
 
-            # Use `gemini-2.0-flash` model for validate,
-            model_instance.validate_credentials(model="gemini-2.0-flash", credentials=credentials)
+            # Use `gemini-pro` model for validate,
+            model_instance.validate_credentials(model="gemini-pro", credentials=credentials)
         except CredentialsValidateFailedError as ex:
             raise ex
         except Exception as ex:

api/core/model_runtime/model_providers/google/llm/_position.yaml

@@ -19,3 +19,5 @@
 - gemini-exp-1206
 - gemini-exp-1121
 - gemini-exp-1114
+- gemini-pro
+- gemini-pro-vision

api/core/model_runtime/model_providers/google/llm/gemini-pro-vision.yaml

@@ -0,0 +1,35 @@
+model: gemini-pro-vision
+label:
+  en_US: Gemini Pro Vision
+model_type: llm
+features:
+  - vision
+model_properties:
+  mode: chat
+  context_size: 12288
+parameter_rules:
+  - name: temperature
+    use_template: temperature
+  - name: top_p
+    use_template: top_p
+  - name: top_k
+    label:
+      zh_Hans: 取样数量
+      en_US: Top k
+    type: int
+    help:
+      zh_Hans: 仅从每个后续标记的前 K 个选项中采样。
+      en_US: Only sample from the top K options for each subsequent token.
+    required: false
+  - name: max_tokens_to_sample
+    use_template: max_tokens
+    required: true
+    default: 4096
+    min: 1
+    max: 4096
+pricing:
+  input: '0.00'
+  output: '0.00'
+  unit: '0.000001'
+  currency: USD
+deprecated: true

api/core/model_runtime/model_providers/google/llm/gemini-pro.yaml

@@ -0,0 +1,39 @@
+model: gemini-pro
+label:
+  en_US: Gemini Pro
+model_type: llm
+features:
+  - agent-thought
+  - tool-call
+  - stream-tool-call
+model_properties:
+  mode: chat
+  context_size: 30720
+parameter_rules:
+  - name: temperature
+    use_template: temperature
+  - name: top_p
+    use_template: top_p
+  - name: top_k
+    label:
+      zh_Hans: 取样数量
+      en_US: Top k
+    type: int
+    help:
+      zh_Hans: 仅从每个后续标记的前 K 个选项中采样。
+      en_US: Only sample from the top K options for each subsequent token.
+    required: false
+  - name: max_tokens_to_sample
+    use_template: max_tokens
+    required: true
+    default: 2048
+    min: 1
+    max: 2048
+  - name: response_format
+    use_template: response_format
+pricing:
+  input: '0.00'
+  output: '0.00'
+  unit: '0.000001'
+  currency: USD
+deprecated: true

api/core/model_runtime/model_providers/openai/llm/llm.py

@@ -1057,7 +1057,7 @@ class OpenAILargeLanguageModel(_CommonOpenAI, LargeLanguageModel):
             model = "gpt-4o"
 
         try:
-            encoding = tiktoken.get_encoding(model)
+            encoding = tiktoken.encoding_for_model(model)
         except KeyError:
             logger.warning("Warning: model not found. Using cl100k_base encoding.")
             model = "cl100k_base"

api/core/model_runtime/model_providers/vertex_ai/llm/gemini-2.0-flash-001.yaml

@@ -5,6 +5,11 @@ model_type: llm
 features:
   - agent-thought
   - vision
+  - tool-call
+  - stream-tool-call
+  - document
+  - video
+  - audio
 model_properties:
   mode: chat
   context_size: 1048576
@@ -15,21 +20,20 @@ parameter_rules:
     use_template: top_p
   - name: top_k
     label:
+      zh_Hans: 取样数量
       en_US: Top k
     type: int
     help:
+      zh_Hans: 仅从每个后续标记的前 K 个选项中采样。
       en_US: Only sample from the top K options for each subsequent token.
     required: false
-  - name: presence_penalty
-    use_template: presence_penalty
-  - name: frequency_penalty
-    use_template: frequency_penalty
   - name: max_output_tokens
     use_template: max_tokens
-    required: true
     default: 8192
     min: 1
     max: 8192
+  - name: json_schema
+    use_template: json_schema
 pricing:
   input: '0.00'
   output: '0.00'

api/core/rag/extractor/word_extractor.py

@@ -85,7 +85,7 @@ class WordExtractor(BaseExtractor):
             if "image" in rel.target_ref:
                 image_count += 1
                 if rel.is_external:
-                    url = rel.target_ref
+                    url = rel.reltype
                     response = ssrf_proxy.get(url)
                     if response.status_code == 200:
                         image_ext = mimetypes.guess_extension(response.headers["Content-Type"])

api/core/workflow/nodes/code/code_node.py

@@ -195,7 +195,7 @@ class CodeNode(BaseNode[CodeNodeData]):
             if output_config.type == "object":
                 # check if output is object
                 if not isinstance(result.get(output_name), dict):
-                    if result.get(output_name) is None:
+                    if isinstance(result.get(output_name), type(None)):
                         transformed_result[output_name] = None
                     else:
                         raise OutputValidationError(
@@ -223,7 +223,7 @@ class CodeNode(BaseNode[CodeNodeData]):
             elif output_config.type == "array[number]":
                 # check if array of number available
                 if not isinstance(result[output_name], list):
-                    if result[output_name] is None:
+                    if isinstance(result[output_name], type(None)):
                         transformed_result[output_name] = None
                     else:
                         raise OutputValidationError(
@@ -244,7 +244,7 @@ class CodeNode(BaseNode[CodeNodeData]):
             elif output_config.type == "array[string]":
                 # check if array of string available
                 if not isinstance(result[output_name], list):
-                    if result[output_name] is None:
+                    if isinstance(result[output_name], type(None)):
                         transformed_result[output_name] = None
                     else:
                         raise OutputValidationError(
@@ -265,7 +265,7 @@ class CodeNode(BaseNode[CodeNodeData]):
             elif output_config.type == "array[object]":
                 # check if array of object available
                 if not isinstance(result[output_name], list):
-                    if result[output_name] is None:
+                    if isinstance(result[output_name], type(None)):
                         transformed_result[output_name] = None
                     else:
                         raise OutputValidationError(

api/core/workflow/nodes/llm/node.py

@@ -968,12 +968,14 @@ def _handle_memory_chat_mode(
     *,
     memory: TokenBufferMemory | None,
     memory_config: MemoryConfig | None,
-    model_config: ModelConfigWithCredentialsEntity,  # TODO(-LAN-): Needs to remove
+    model_config: ModelConfigWithCredentialsEntity,
 ) -> Sequence[PromptMessage]:
     memory_messages: Sequence[PromptMessage] = []
     # Get messages from memory for chat model
     if memory and memory_config:
+        rest_tokens = _calculate_rest_token(prompt_messages=[], model_config=model_config)
         memory_messages = memory.get_history_prompt_messages(
+            max_token_limit=rest_tokens,
             message_limit=memory_config.window.size if memory_config.window.enabled else None,
         )
     return memory_messages

api/fields/app_fields.py

@@ -63,7 +63,6 @@ app_detail_fields = {
     "created_at": TimestampField,
     "updated_by": fields.String,
     "updated_at": TimestampField,
-    "access_mode": fields.String,
 }
 
 prompt_config_fields = {
@@ -99,7 +98,6 @@ app_partial_fields = {
     "updated_by": fields.String,
     "updated_at": TimestampField,
     "tags": fields.List(fields.Nested(tag_fields)),
-    "access_mode": fields.String,
 }
 
 
@@ -172,7 +170,6 @@ app_detail_fields_with_site = {
     "updated_by": fields.String,
     "updated_at": TimestampField,
     "deleted_tools": fields.List(fields.String),
-    "access_mode": fields.String,
 }
 
 app_site_fields = {

api/poetry.lock

@@ -10473,44 +10473,44 @@ client = ["SQLAlchemy (>=1.4,<3)"]
 
 [[package]]
 name = "tiktoken"
-version = "0.9.0"
+version = "0.8.0"
 description = "tiktoken is a fast BPE tokeniser for use with OpenAI's models"
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 markers = "python_version == \"3.11\" or python_version >= \"3.12\""
 files = [
-    {file = "tiktoken-0.9.0-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:586c16358138b96ea804c034b8acf3f5d3f0258bd2bc3b0227af4af5d622e382"},
-    {file = "tiktoken-0.9.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:d9c59ccc528c6c5dd51820b3474402f69d9a9e1d656226848ad68a8d5b2e5108"},
-    {file = "tiktoken-0.9.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f0968d5beeafbca2a72c595e8385a1a1f8af58feaebb02b227229b69ca5357fd"},
-    {file = "tiktoken-0.9.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:92a5fb085a6a3b7350b8fc838baf493317ca0e17bd95e8642f95fc69ecfed1de"},
-    {file = "tiktoken-0.9.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:15a2752dea63d93b0332fb0ddb05dd909371ededa145fe6a3242f46724fa7990"},
-    {file = "tiktoken-0.9.0-cp310-cp310-win_amd64.whl", hash = "sha256:26113fec3bd7a352e4b33dbaf1bd8948de2507e30bd95a44e2b1156647bc01b4"},
-    {file = "tiktoken-0.9.0-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:f32cc56168eac4851109e9b5d327637f15fd662aa30dd79f964b7c39fbadd26e"},
-    {file = "tiktoken-0.9.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:45556bc41241e5294063508caf901bf92ba52d8ef9222023f83d2483a3055348"},
-    {file = "tiktoken-0.9.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:03935988a91d6d3216e2ec7c645afbb3d870b37bcb67ada1943ec48678e7ee33"},
-    {file = "tiktoken-0.9.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8b3d80aad8d2c6b9238fc1a5524542087c52b860b10cbf952429ffb714bc1136"},
-    {file = "tiktoken-0.9.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b2a21133be05dc116b1d0372af051cd2c6aa1d2188250c9b553f9fa49301b336"},
-    {file = "tiktoken-0.9.0-cp311-cp311-win_amd64.whl", hash = "sha256:11a20e67fdf58b0e2dea7b8654a288e481bb4fc0289d3ad21291f8d0849915fb"},
-    {file = "tiktoken-0.9.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:e88f121c1c22b726649ce67c089b90ddda8b9662545a8aeb03cfef15967ddd03"},
-    {file = "tiktoken-0.9.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a6600660f2f72369acb13a57fb3e212434ed38b045fd8cc6cdd74947b4b5d210"},
-    {file = "tiktoken-0.9.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:95e811743b5dfa74f4b227927ed86cbc57cad4df859cb3b643be797914e41794"},
-    {file = "tiktoken-0.9.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:99376e1370d59bcf6935c933cb9ba64adc29033b7e73f5f7569f3aad86552b22"},
-    {file = "tiktoken-0.9.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:badb947c32739fb6ddde173e14885fb3de4d32ab9d8c591cbd013c22b4c31dd2"},
-    {file = "tiktoken-0.9.0-cp312-cp312-win_amd64.whl", hash = "sha256:5a62d7a25225bafed786a524c1b9f0910a1128f4232615bf3f8257a73aaa3b16"},
-    {file = "tiktoken-0.9.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:2b0e8e05a26eda1249e824156d537015480af7ae222ccb798e5234ae0285dbdb"},
-    {file = "tiktoken-0.9.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:27d457f096f87685195eea0165a1807fae87b97b2161fe8c9b1df5bd74ca6f63"},
-    {file = "tiktoken-0.9.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cf8ded49cddf825390e36dd1ad35cd49589e8161fdcb52aa25f0583e90a3e01"},
-    {file = "tiktoken-0.9.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cc156cb314119a8bb9748257a2eaebd5cc0753b6cb491d26694ed42fc7cb3139"},
-    {file = "tiktoken-0.9.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cd69372e8c9dd761f0ab873112aba55a0e3e506332dd9f7522ca466e817b1b7a"},
-    {file = "tiktoken-0.9.0-cp313-cp313-win_amd64.whl", hash = "sha256:5ea0edb6f83dc56d794723286215918c1cde03712cbbafa0348b33448faf5b95"},
-    {file = "tiktoken-0.9.0-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:c6386ca815e7d96ef5b4ac61e0048cd32ca5a92d5781255e13b31381d28667dc"},
-    {file = "tiktoken-0.9.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:75f6d5db5bc2c6274b674ceab1615c1778e6416b14705827d19b40e6355f03e0"},
-    {file = "tiktoken-0.9.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e15b16f61e6f4625a57a36496d28dd182a8a60ec20a534c5343ba3cafa156ac7"},
-    {file = "tiktoken-0.9.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ebcec91babf21297022882344c3f7d9eed855931466c3311b1ad6b64befb3df"},
-    {file = "tiktoken-0.9.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:e5fd49e7799579240f03913447c0cdfa1129625ebd5ac440787afc4345990427"},
-    {file = "tiktoken-0.9.0-cp39-cp39-win_amd64.whl", hash = "sha256:26242ca9dc8b58e875ff4ca078b9a94d2f0813e6a535dcd2205df5d49d927cc7"},
-    {file = "tiktoken-0.9.0.tar.gz", hash = "sha256:d02a5ca6a938e0490e1ff957bc48c8b078c88cb83977be1625b1fd8aac792c5d"},
+    {file = "tiktoken-0.8.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:b07e33283463089c81ef1467180e3e00ab00d46c2c4bbcef0acab5f771d6695e"},
+    {file = "tiktoken-0.8.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9269348cb650726f44dd3bbb3f9110ac19a8dcc8f54949ad3ef652ca22a38e21"},
+    {file = "tiktoken-0.8.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:25e13f37bc4ef2d012731e93e0fef21dc3b7aea5bb9009618de9a4026844e560"},
+    {file = "tiktoken-0.8.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f13d13c981511331eac0d01a59b5df7c0d4060a8be1e378672822213da51e0a2"},
+    {file = "tiktoken-0.8.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:6b2ddbc79a22621ce8b1166afa9f9a888a664a579350dc7c09346a3b5de837d9"},
+    {file = "tiktoken-0.8.0-cp310-cp310-win_amd64.whl", hash = "sha256:d8c2d0e5ba6453a290b86cd65fc51fedf247e1ba170191715b049dac1f628005"},
+    {file = "tiktoken-0.8.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:d622d8011e6d6f239297efa42a2657043aaed06c4f68833550cac9e9bc723ef1"},
+    {file = "tiktoken-0.8.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2efaf6199717b4485031b4d6edb94075e4d79177a172f38dd934d911b588d54a"},
+    {file = "tiktoken-0.8.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5637e425ce1fc49cf716d88df3092048359a4b3bbb7da762840426e937ada06d"},
+    {file = "tiktoken-0.8.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9fb0e352d1dbe15aba082883058b3cce9e48d33101bdaac1eccf66424feb5b47"},
+    {file = "tiktoken-0.8.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:56edfefe896c8f10aba372ab5706b9e3558e78db39dd497c940b47bf228bc419"},
+    {file = "tiktoken-0.8.0-cp311-cp311-win_amd64.whl", hash = "sha256:326624128590def898775b722ccc327e90b073714227175ea8febbc920ac0a99"},
+    {file = "tiktoken-0.8.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:881839cfeae051b3628d9823b2e56b5cc93a9e2efb435f4cf15f17dc45f21586"},
+    {file = "tiktoken-0.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fe9399bdc3f29d428f16a2f86c3c8ec20be3eac5f53693ce4980371c3245729b"},
+    {file = "tiktoken-0.8.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9a58deb7075d5b69237a3ff4bb51a726670419db6ea62bdcd8bd80c78497d7ab"},
+    {file = "tiktoken-0.8.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2908c0d043a7d03ebd80347266b0e58440bdef5564f84f4d29fb235b5df3b04"},
+    {file = "tiktoken-0.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:294440d21a2a51e12d4238e68a5972095534fe9878be57d905c476017bff99fc"},
+    {file = "tiktoken-0.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:d8f3192733ac4d77977432947d563d7e1b310b96497acd3c196c9bddb36ed9db"},
+    {file = "tiktoken-0.8.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:02be1666096aff7da6cbd7cdaa8e7917bfed3467cd64b38b1f112e96d3b06a24"},
+    {file = "tiktoken-0.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:c94ff53c5c74b535b2cbf431d907fc13c678bbd009ee633a2aca269a04389f9a"},
+    {file = "tiktoken-0.8.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b231f5e8982c245ee3065cd84a4712d64692348bc609d84467c57b4b72dcbc5"},
+    {file = "tiktoken-0.8.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4177faa809bd55f699e88c96d9bb4635d22e3f59d635ba6fd9ffedf7150b9953"},
+    {file = "tiktoken-0.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:5376b6f8dc4753cd81ead935c5f518fa0fbe7e133d9e25f648d8c4dabdd4bad7"},
+    {file = "tiktoken-0.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:18228d624807d66c87acd8f25fc135665617cab220671eb65b50f5d70fa51f69"},
+    {file = "tiktoken-0.8.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:7e17807445f0cf1f25771c9d86496bd8b5c376f7419912519699f3cc4dc5c12e"},
+    {file = "tiktoken-0.8.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:886f80bd339578bbdba6ed6d0567a0d5c6cfe198d9e587ba6c447654c65b8edc"},
+    {file = "tiktoken-0.8.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6adc8323016d7758d6de7313527f755b0fc6c72985b7d9291be5d96d73ecd1e1"},
+    {file = "tiktoken-0.8.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b591fb2b30d6a72121a80be24ec7a0e9eb51c5500ddc7e4c2496516dd5e3816b"},
+    {file = "tiktoken-0.8.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:845287b9798e476b4d762c3ebda5102be87ca26e5d2c9854002825d60cdb815d"},
+    {file = "tiktoken-0.8.0-cp39-cp39-win_amd64.whl", hash = "sha256:1473cfe584252dc3fa62adceb5b1c763c1874e04511b197da4e6de51d6ce5a02"},
+    {file = "tiktoken-0.8.0.tar.gz", hash = "sha256:9ccbb2740f24542534369c5635cfd9b2b3c2490754a78ac8831d99f89f94eeb2"},
 ]
 
 [package.dependencies]
@@ -12389,4 +12389,4 @@ cffi = ["cffi (>=1.11)"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.11,<3.13"
-content-hash = "0df8aef68385b6596306fd18af317a835023d648eb5028cd57ec463f176e4c0f"
+content-hash = "d197cdff507a70323c1d6aca11609188f54970f67715af744fe6def15b7776fd"

api/pyproject.toml

@@ -85,7 +85,7 @@ sentry-sdk = { version = "~1.44.1", extras = ["flask"] }
 sqlalchemy = "~2.0.29"
 starlette = "0.41.0"
 tencentcloud-sdk-python-hunyuan = "~3.0.1294"
-tiktoken = "^0.9.0"
+tiktoken = "~0.8.0"
 tokenizers = "~0.15.0"
 transformers = "~4.35.0"
 unstructured = { version = "~0.16.1", extras = ["docx", "epub", "md", "msg", "ppt", "pptx"] }

api/services/account_service.py

@@ -49,7 +49,7 @@ from services.errors.account import (
     RoleAlreadyAssignedError,
     TenantNotFoundError,
 )
-from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
+from services.errors.workspace import WorkSpaceNotAllowedCreateError
 from services.feature_service import FeatureService
 from tasks.delete_account_task import delete_account_task
 from tasks.mail_account_deletion_task import send_account_deletion_verification_code
@@ -406,8 +406,10 @@ class AccountService:
 
             raise PasswordResetRateLimitExceededError()
 
-        code, token = cls.generate_reset_password_token(account_email, account)
-
+        code = "".join([str(random.randint(0, 9)) for _ in range(6)])
+        token = TokenManager.generate_token(
+            account=account, email=email, token_type="reset_password", additional_data={"code": code}
+        )
         send_reset_password_mail_task.delay(
             language=language,
             to=account_email,
@@ -416,22 +418,6 @@ class AccountService:
         cls.reset_password_rate_limiter.increment_rate_limit(account_email)
         return token
 
-    @classmethod
-    def generate_reset_password_token(
-        cls,
-        email: str,
-        account: Optional[Account] = None,
-        code: Optional[str] = None,
-        additional_data: dict[str, Any] = {},
-    ):
-        if not code:
-            code = "".join([str(random.randint(0, 9)) for _ in range(6)])
-        additional_data["code"] = code
-        token = TokenManager.generate_token(
-            account=account, email=email, token_type="reset_password", additional_data=additional_data
-        )
-        return code, token
-
     @classmethod
     def revoke_reset_password_token(cls, token: str):
         TokenManager.revoke_token(token, "reset_password")
@@ -599,10 +585,6 @@ class TenantService:
         if not FeatureService.get_system_features().is_allow_create_workspace and not is_setup:
             raise WorkSpaceNotAllowedCreateError()
 
-        workspaces = FeatureService.get_system_features().license.workspaces
-        if not workspaces.is_available():
-            raise WorkspacesLimitExceededError()
-
         if name:
             tenant = TenantService.create_tenant(name=name, is_setup=is_setup)
         else:
@@ -758,8 +740,8 @@ class TenantService:
         """Check member permission"""
         perms = {
             "add": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
-            "remove": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
-            "update": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
+            "remove": [TenantAccountRole.OWNER],
+            "update": [TenantAccountRole.OWNER],
         }
         if action not in {"add", "remove", "update"}:
             raise InvalidActionError("Invalid action.")
@@ -772,24 +754,13 @@ class TenantService:
 
         if not ta_operator or ta_operator.role not in perms[action]:
             raise NoPermissionError(f"No permission to {action} member.")
-        
-        # Admin cannot remove or update other admin and the owner
-        if action in {"remove", "update"}:
-            if ta_operator.role == TenantAccountRole.ADMIN:
-                if member:
-                    ta_member = TenantAccountJoin.query.filter_by(tenant_id=tenant.id, account_id=member.id).first()
-                    if not ta_member or ta_member.role in {TenantAccountRole.OWNER, TenantAccountRole.ADMIN}:
-                        raise NoPermissionError(f"No permission to {action} member.")
-            
 
     @staticmethod
     def remove_member_from_tenant(tenant: Tenant, account: Account, operator: Account) -> None:
         """Remove member from tenant"""
-        if operator.id == account.id:
+        if operator.id == account.id and TenantService.check_member_permission(tenant, operator, account, "remove"):
             raise CannotOperateSelfError("Cannot operate self.")
 
-        TenantService.check_member_permission(tenant, operator, account, "remove")
-
         ta = TenantAccountJoin.query.filter_by(tenant_id=tenant.id, account_id=account.id).first()
         if not ta:
             raise MemberNotInTenantError("Member not in tenant.")
@@ -904,10 +875,7 @@ class RegisterService:
             if open_id is not None and provider is not None:
                 AccountService.link_account_integrate(provider, open_id, account)
 
-            if (FeatureService.get_system_features().is_allow_create_workspace
-                    and create_workspace_required
-                    and FeatureService.get_system_features().license.workspaces.is_available()
-            ):
+            if FeatureService.get_system_features().is_allow_create_workspace and create_workspace_required:
                 tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
                 TenantService.create_tenant_member(tenant, account, role="owner")
                 account.current_tenant = tenant

api/services/app_dsl_service.py

@@ -55,19 +55,13 @@ def _check_version_compatibility(imported_version: str) -> ImportStatus:
     except version.InvalidVersion:
         return ImportStatus.FAILED
 
-    # If imported version is newer than current, always return PENDING
-    if imported_ver > current_ver:
+    # Compare major version and minor version
+    if current_ver.major != imported_ver.major or current_ver.minor != imported_ver.minor:
         return ImportStatus.PENDING
 
-    # If imported version is older than current's major, return PENDING
-    if imported_ver.major < current_ver.major:
-        return ImportStatus.PENDING
-
-    # If imported version is older than current's minor, return COMPLETED_WITH_WARNINGS
-    if imported_ver.minor < current_ver.minor:
+    if current_ver.micro != imported_ver.micro:
         return ImportStatus.COMPLETED_WITH_WARNINGS
 
-    # If imported version equals or is older than current's micro, return COMPLETED
     return ImportStatus.COMPLETED
 
 

api/services/app_service.py

@@ -19,10 +19,8 @@ from core.tools.utils.configuration import ToolParameterConfigurationManager
 from events.app_event import app_was_created
 from extensions.ext_database import db
 from models.account import Account
-from models.model import App, AppMode, AppModelConfig, Site
+from models.model import App, AppMode, AppModelConfig
 from models.tools import ApiToolProvider
-from services.enterprise.enterprise_service import EnterpriseService
-from services.feature_service import FeatureService
 from services.tag_service import TagService
 from tasks.remove_app_and_related_data_task import remove_app_and_related_data_task
 
@@ -154,10 +152,6 @@ class AppService:
 
         app_was_created.send(app, account=account)
 
-        if FeatureService.get_system_features().webapp_auth.enabled:
-            # update web app setting as private
-            EnterpriseService.WebAppAuth.update_app_access_mode(app.id, "private")
-
         return app
 
     def get_app(self, app: App) -> App:
@@ -314,10 +308,6 @@ class AppService:
         db.session.delete(app)
         db.session.commit()
 
-        # clean up web app settings
-        if FeatureService.get_system_features().webapp_auth.enabled:
-            EnterpriseService.WebAppAuth.cleanup_webapp(app.id)
-
         # Trigger asynchronous deletion of app and related data
         remove_app_and_related_data_task.delay(tenant_id=app.tenant_id, app_id=app.id)
 
@@ -384,15 +374,3 @@ class AppService:
                         meta["tool_icons"][tool_name] = {"background": "#252525", "content": "\ud83d\ude01"}
 
         return meta
-
-    @staticmethod
-    def get_app_code_by_id(app_id: str) -> str:
-        """
-        Get app code by app id
-        :param app_id: app id
-        :return: app code
-        """
-        site = db.session.query(Site).filter(Site.app_id == app_id).first()
-        if not site:
-            raise ValueError(f"App with id {app_id} not found")
-        return str(site.code)

api/services/enterprise/enterprise_service.py

@@ -1,91 +1,11 @@
-
-from pydantic import BaseModel, Field
-
 from services.enterprise.base import EnterpriseRequest
 
 
-class WebAppSettings(BaseModel):
-    access_mode: str = Field(
-        description="Access mode for the web app. Can be 'public' or 'private'",
-        default="private",
-        alias="accessMode",
-    )
-
-
 class EnterpriseService:
     @classmethod
     def get_info(cls):
         return EnterpriseRequest.send_request("GET", "/info")
 
     @classmethod
-    def get_workspace_info(cls, tenant_id:str):
-        return EnterpriseRequest.send_request("GET", f"/workspace/{tenant_id}/info")
-
-    class WebAppAuth:
-        @classmethod
-        def is_user_allowed_to_access_webapp(cls, user_id: str, app_code: str) -> bool:
-            params = {"userId": user_id, "appCode": app_code}
-            data = EnterpriseRequest.send_request("GET", "/webapp/permission", params=params)
-
-            return data.get("result", False)
-
-        @classmethod
-        def get_app_access_mode_by_id(cls, app_id: str) -> WebAppSettings:
-            if not app_id:
-                raise ValueError("app_id must be provided.")
-            params = {"appId": app_id}
-            data = EnterpriseRequest.send_request("GET", "/webapp/access-mode/id", params=params)
-            if not data:
-                raise ValueError("No data found.")
-            return WebAppSettings(**data)
-
-        @classmethod
-        def batch_get_app_access_mode_by_id(cls, app_ids: list[str]) -> dict[str, WebAppSettings]:
-            if not app_ids:
-                return {}
-            body = {"appIds": app_ids}
-            data: dict[str, str] = EnterpriseRequest.send_request("POST", "/webapp/access-mode/batch/id", json=body)
-            if not data:
-                raise ValueError("No data found.")
-
-            if not isinstance(data["accessModes"], dict):
-                raise ValueError("Invalid data format.")
-
-            ret = {}
-            for key, value in data["accessModes"].items():
-                curr = WebAppSettings()
-                curr.access_mode = value
-                ret[key] = curr
-
-            return ret
-
-        @classmethod
-        def get_app_access_mode_by_code(cls, app_code: str) -> WebAppSettings:
-            if not app_code:
-                raise ValueError("app_code must be provided.")
-            params = {"appCode": app_code}
-            data = EnterpriseRequest.send_request("GET", "/webapp/access-mode/code", params=params)
-            if not data:
-                raise ValueError("No data found.")
-            return WebAppSettings(**data)
-
-        @classmethod
-        def update_app_access_mode(cls, app_id: str, access_mode: str) -> bool:
-            if not app_id:
-                raise ValueError("app_id must be provided.")
-            if access_mode not in ["public", "private", "private_all"]:
-                raise ValueError("access_mode must be either 'public', 'private', or 'private_all'")
-
-            data = {"appId": app_id, "accessMode": access_mode}
-
-            response = EnterpriseRequest.send_request("POST", "/webapp/access-mode", json=data)
-
-            return response.get("result", False)
-
-        @classmethod
-        def cleanup_webapp(cls, app_id: str):
-            if not app_id:
-                raise ValueError("app_id must be provided.")
-
-            body = {"appId": app_id}
-            EnterpriseRequest.send_request("DELETE", "/webapp/clean", json=body)
+    def get_app_web_sso_enabled(cls, app_code):
+        return EnterpriseRequest.send_request("GET", f"/app-sso-setting?appCode={app_code}")

api/services/enterprise/mail_service.py

@@ -1,18 +1,26 @@
+
+from typing import Dict, List
+
 from pydantic import BaseModel
 
 from tasks.mail_enterprise_task import send_enterprise_email_task
 
 
 class DifyMail(BaseModel):
-    to: list[str]
+    to: List[str]
     subject: str
     body: str
-    substitutions: dict[str, str] = {}
+    substitutions: Dict[str, str] = {}
 
 
 class EnterpriseMailService:
+
     @classmethod
     def send_mail(cls, mail: DifyMail):
+
         send_enterprise_email_task.delay(
-            to=mail.to, subject=mail.subject, body=mail.body, substitutions=mail.substitutions
+            to=mail.to,
+            subject=mail.subject,
+            body=mail.body,
+            substitutions=mail.substitutions
         )

api/services/errors/workspace.py

@@ -7,7 +7,3 @@ class WorkSpaceNotAllowedCreateError(BaseServiceError):
 
 class WorkSpaceNotFoundError(BaseServiceError):
     pass
-
-
-class WorkspacesLimitExceededError(BaseServiceError):
-    pass

api/services/feature_service.py

@@ -1,6 +1,6 @@
 from enum import StrEnum
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict
 
 from configs import dify_config
 from services.billing_service import BillingService
@@ -22,32 +22,6 @@ class LimitationModel(BaseModel):
     limit: int = 0
 
 
-class LicenseLimitationModel(BaseModel):
-    """
-    - enabled: whether this limit is enforced
-    - size: current usage count
-    - limit: maximum allowed count; 0 means unlimited
-    """
-
-    enabled: bool = Field(False, description="Whether this limit is currently active")
-    size: int = Field(0, description="Number of resources already consumed")
-    limit: int = Field(0, description="Maximum number of resources allowed; 0 means no limit")
-
-    def is_available(self, required: int = 1) -> bool:
-        """
-        Determine whether the requested amount can be allocated.
-
-        Returns True if:
-         - this limit is not active, or
-         - the limit is zero (unlimited), or
-         - there is enough remaining quota.
-        """
-        if not self.enabled or self.limit == 0:
-            return True
-
-        return (self.limit - self.size) >= required
-
-
 class LicenseStatus(StrEnum):
     NONE = "none"
     INACTIVE = "inactive"
@@ -60,7 +34,6 @@ class LicenseStatus(StrEnum):
 class LicenseModel(BaseModel):
     status: LicenseStatus = LicenseStatus.NONE
     expired_at: str = ""
-    workspaces: LicenseLimitationModel = LicenseLimitationModel(enabled=False, size=0, limit=0)
 
 
 class BrandingModel(BaseModel):
@@ -71,18 +44,6 @@ class BrandingModel(BaseModel):
     favicon: str = ""
 
 
-class WebAppAuthSSOModel(BaseModel):
-    protocol: str = ""
-
-
-class WebAppAuthModel(BaseModel):
-    enabled: bool = False
-    allow_sso: bool = False
-    sso_config: WebAppAuthSSOModel = WebAppAuthSSOModel()
-    allow_email_code_login: bool = False
-    allow_email_password_login: bool = False
-
-
 class FeatureModel(BaseModel):
     billing: BillingModel = BillingModel()
     members: LimitationModel = LimitationModel(size=0, limit=1)
@@ -95,7 +56,6 @@ class FeatureModel(BaseModel):
     model_load_balancing_enabled: bool = False
     dataset_operator_enabled: bool = False
     webapp_copyright_enabled: bool = False
-    workspace_members: LicenseLimitationModel = LicenseLimitationModel(enabled=False, size=0, limit=0)
 
     # pydantic configs
     model_config = ConfigDict(protected_namespaces=())
@@ -104,6 +64,9 @@ class FeatureModel(BaseModel):
 class SystemFeatureModel(BaseModel):
     sso_enforced_for_signin: bool = False
     sso_enforced_for_signin_protocol: str = ""
+    sso_enforced_for_web: bool = False
+    sso_enforced_for_web_protocol: str = ""
+    enable_web_sso_switch_component: bool = False
     enable_email_code_login: bool = False
     enable_email_password_login: bool = True
     enable_social_oauth_login: bool = False
@@ -112,7 +75,6 @@ class SystemFeatureModel(BaseModel):
     is_email_setup: bool = False
     license: LicenseModel = LicenseModel()
     branding: BrandingModel = BrandingModel()
-    webapp_auth: WebAppAuthModel = WebAppAuthModel()
 
 
 class FeatureService:
@@ -127,7 +89,6 @@ class FeatureService:
 
         if dify_config.ENTERPRISE_ENABLED:
             features.webapp_copyright_enabled = True
-            cls._fulfill_params_from_workspace_info(features, tenant_id)
 
         return features
 
@@ -138,8 +99,8 @@ class FeatureService:
         cls._fulfill_system_params_from_env(system_features)
 
         if dify_config.ENTERPRISE_ENABLED:
+            system_features.enable_web_sso_switch_component = True
             system_features.branding.enabled = True
-            system_features.webapp_auth.enabled = True
             cls._fulfill_params_from_enterprise(system_features)
 
         return system_features
@@ -159,14 +120,6 @@ class FeatureService:
         features.model_load_balancing_enabled = dify_config.MODEL_LB_ENABLED
         features.dataset_operator_enabled = dify_config.DATASET_OPERATOR_ENABLED
 
-    @classmethod
-    def _fulfill_params_from_workspace_info(cls, features: FeatureModel, tenant_id: str):
-        workspace_info = EnterpriseService.get_workspace_info(tenant_id)
-        if "WorkspaceMembers" in workspace_info:
-            features.workspace_members.size = workspace_info["WorkspaceMembers"]["used"]
-            features.workspace_members.limit = workspace_info["WorkspaceMembers"]["limit"]
-            features.workspace_members.enabled = workspace_info["WorkspaceMembers"]["enabled"]
-
     @classmethod
     def _fulfill_params_from_billing_api(cls, features: FeatureModel, tenant_id: str):
         billing_info = BillingService.get_info(tenant_id)
@@ -208,7 +161,7 @@ class FeatureService:
             features.model_load_balancing_enabled = billing_info["model_load_balancing_enabled"]
 
     @classmethod
-    def _fulfill_params_from_enterprise(cls, features: SystemFeatureModel):
+    def _fulfill_params_from_enterprise(cls, features):
         enterprise_info = EnterpriseService.get_info()
 
         if "SSOEnforcedForSignin" in enterprise_info:
@@ -217,6 +170,12 @@ class FeatureService:
         if "SSOEnforcedForSigninProtocol" in enterprise_info:
             features.sso_enforced_for_signin_protocol = enterprise_info["SSOEnforcedForSigninProtocol"]
 
+        if "SSOEnforcedForWeb" in enterprise_info:
+            features.sso_enforced_for_web = enterprise_info["SSOEnforcedForWeb"]
+
+        if "SSOEnforcedForWebProtocol" in enterprise_info:
+            features.sso_enforced_for_web_protocol = enterprise_info["SSOEnforcedForWebProtocol"]
+
         if "EnableEmailCodeLogin" in enterprise_info:
             features.enable_email_code_login = enterprise_info["EnableEmailCodeLogin"]
 
@@ -235,16 +194,6 @@ class FeatureService:
             features.branding.workspace_logo = enterprise_info["Branding"].get("workspaceLogo", "")
             features.branding.favicon = enterprise_info["Branding"].get("favicon", "")
 
-        if "WebAppAuth" in enterprise_info:
-            features.webapp_auth.allow_sso = enterprise_info["WebAppAuth"].get("allowSso", False)
-            features.webapp_auth.allow_email_code_login = enterprise_info["WebAppAuth"].get(
-                "allowEmailCodeLogin", False
-            )
-            features.webapp_auth.allow_email_password_login = enterprise_info["WebAppAuth"].get(
-                "allowEmailPasswordLogin", False
-            )
-            features.webapp_auth.sso_config.protocol = enterprise_info.get("SSOEnforcedForWebProtocol", "")
-
         if "License" in enterprise_info:
             license_info = enterprise_info["License"]
 
@@ -253,8 +202,3 @@ class FeatureService:
 
             if "expiredAt" in license_info:
                 features.license.expired_at = license_info["expiredAt"]
-
-            if "workspaces" in license_info:
-                features.license.workspaces.enabled = license_info["workspaces"]["enabled"]
-                features.license.workspaces.limit = license_info["workspaces"]["limit"]
-                features.license.workspaces.size = license_info["workspaces"]["used"]

api/services/webapp_auth_service.py

@@ -1,137 +0,0 @@
-import random
-from datetime import UTC, datetime, timedelta
-from typing import Any, Optional, cast
-
-from werkzeug.exceptions import NotFound, Unauthorized
-
-from configs import dify_config
-from controllers.web.error import WebAppAuthAccessDeniedError
-from extensions.ext_database import db
-from libs.helper import TokenManager
-from libs.passport import PassportService
-from libs.password import compare_password
-from models.account import Account, AccountStatus
-from models.model import App, EndUser, Site
-from services.enterprise.enterprise_service import EnterpriseService
-from services.errors.account import AccountLoginError, AccountNotFoundError, AccountPasswordError
-from services.feature_service import FeatureService
-from tasks.mail_email_code_login import send_email_code_login_mail_task
-
-
-class WebAppAuthService:
-    """Service for web app authentication."""
-
-    @staticmethod
-    def authenticate(email: str, password: str) -> Account:
-        """authenticate account with email and password"""
-
-        account = Account.query.filter_by(email=email).first()
-        if not account:
-            raise AccountNotFoundError()
-
-        if account.status == AccountStatus.BANNED.value:
-            raise AccountLoginError("Account is banned.")
-
-        if account.password is None or not compare_password(password, account.password, account.password_salt):
-            raise AccountPasswordError("Invalid email or password.")
-
-        return cast(Account, account)
-
-    @classmethod
-    def login(cls, account: Account, app_code: str, end_user_id: str) -> str:
-        site = db.session.query(Site).filter(Site.code == app_code).first()
-        if not site:
-            raise NotFound("Site not found.")
-
-        access_token = cls._get_account_jwt_token(account=account, site=site, end_user_id=end_user_id)
-
-        return access_token
-
-    @classmethod
-    def get_user_through_email(cls, email: str):
-        account = db.session.query(Account).filter(Account.email == email).first()
-        if not account:
-            return None
-
-        if account.status == AccountStatus.BANNED.value:
-            raise Unauthorized("Account is banned.")
-
-        return account
-
-    @classmethod
-    def send_email_code_login_email(
-        cls, account: Optional[Account] = None, email: Optional[str] = None, language: Optional[str] = "en-US"
-    ):
-        email = account.email if account else email
-        if email is None:
-            raise ValueError("Email must be provided.")
-
-        code = "".join([str(random.randint(0, 9)) for _ in range(6)])
-        token = TokenManager.generate_token(
-            account=account, email=email, token_type="webapp_email_code_login", additional_data={"code": code}
-        )
-        send_email_code_login_mail_task.delay(
-            language=language,
-            to=account.email if account else email,
-            code=code,
-        )
-
-        return token
-
-    @classmethod
-    def get_email_code_login_data(cls, token: str) -> Optional[dict[str, Any]]:
-        return TokenManager.get_token_data(token, "webapp_email_code_login")
-
-    @classmethod
-    def revoke_email_code_login_token(cls, token: str):
-        TokenManager.revoke_token(token, "webapp_email_code_login")
-
-    @classmethod
-    def create_end_user(cls, app_code, email) -> EndUser:
-        site = db.session.query(Site).filter(Site.code == app_code).first()
-        app_model = db.session.query(App).filter(App.id == site.app_id).first()
-        end_user = EndUser(
-            tenant_id=app_model.tenant_id,
-            app_id=app_model.id,
-            type="browser",
-            is_anonymous=False,
-            session_id=email,
-            name="enterpriseuser",
-            external_user_id="enterpriseuser",
-        )
-        db.session.add(end_user)
-        db.session.commit()
-
-        return end_user
-
-    @classmethod
-    def _validate_user_accessibility(cls, account: Account, app_code: str):
-        """Check if the user is allowed to access the app."""
-        system_features = FeatureService.get_system_features()
-        if system_features.webapp_auth.enabled:
-            app_settings = EnterpriseService.WebAppAuth.get_app_access_mode_by_code(app_code=app_code)
-
-            if (
-                app_settings.access_mode != "public"
-                and not EnterpriseService.WebAppAuth.is_user_allowed_to_access_webapp(account.id, app_code=app_code)
-            ):
-                raise WebAppAuthAccessDeniedError()
-
-    @classmethod
-    def _get_account_jwt_token(cls, account: Account, site: Site, end_user_id: str) -> str:
-        exp_dt = datetime.now(UTC) + timedelta(hours=dify_config.WebAppSessionTimeoutInHours * 24)
-        exp = int(exp_dt.timestamp())
-
-        payload = {
-            "iss": site.id,
-            "sub": "Web API Passport",
-            "app_id": site.app_id,
-            "app_code": site.code,
-            "user_id": account.id,
-            "end_user_id": end_user_id,
-            "token_source": "webapp",
-            "exp": exp,
-        }
-
-        token: str = PassportService().issue(payload)
-        return token

api/tasks/mail_enterprise_task.py

@@ -13,7 +13,9 @@ def send_enterprise_email_task(to, subject, body, substitutions):
     if not mail.is_inited():
         return
 
-    logging.info(click.style("Start enterprise mail to {} with subject {}".format(to, subject), fg="green"))
+    logging.info(
+        click.style("Start enterprise mail to {} with subject {}".format(to, subject), fg="green")
+    )
     start_at = time.perf_counter()
 
     try:
@@ -27,7 +29,9 @@ def send_enterprise_email_task(to, subject, body, substitutions):
 
         end_at = time.perf_counter()
         logging.info(
-            click.style("Send enterprise mail to {} succeeded: latency: {}".format(to, end_at - start_at), fg="green")
+            click.style(
+                "Send enterprise mail to {} succeeded: latency: {}".format(to, end_at - start_at), fg="green"
+            )
         )
     except Exception:
         logging.exception("Send enterprise mail to {} failed".format(to))

docker/.env.example

@@ -932,6 +932,3 @@ MAX_SUBMIT_COUNT=100
 
 # The maximum number of top-k value for RAG.
 TOP_K_MAX_VALUE=10
-
-# Prevent Clickjacking
-ALLOW_EMBED=false

docker/docker-compose-template.yaml

@@ -1,8 +1,8 @@
-x-shared-env: &shared-api-worker-env 
+x-shared-env: &shared-api-worker-env
 services:
   # API service
   api:
-    image: langgenius/dify-api:0.15.7
+    image: langgenius/dify-api:0.15.4
     restart: always
     environment:
       # Use the shared environment variables.
@@ -25,7 +25,7 @@ services:
   # worker service
   # The Celery worker for processing the queue.
   worker:
-    image: langgenius/dify-api:0.15.7
+    image: langgenius/dify-api:0.15.4
     restart: always
     environment:
       # Use the shared environment variables.
@@ -47,7 +47,7 @@ services:
 
   # Frontend web application.
   web:
-    image: langgenius/dify-web:0.15.7
+    image: langgenius/dify-web:0.15.4
     restart: always
     environment:
       CONSOLE_API_URL: ${CONSOLE_API_URL:-}
@@ -56,7 +56,6 @@ services:
       NEXT_TELEMETRY_DISABLED: ${NEXT_TELEMETRY_DISABLED:-0}
       TEXT_GENERATION_TIMEOUT_MS: ${TEXT_GENERATION_TIMEOUT_MS:-60000}
       CSP_WHITELIST: ${CSP_WHITELIST:-}
-      ALLOW_EMBED: ${ALLOW_EMBED:-false}
       TOP_K_MAX_VALUE: ${TOP_K_MAX_VALUE:-}
       INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH: ${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH:-}
 

docker/docker-compose.yaml

@@ -389,12 +389,11 @@ x-shared-env: &shared-api-worker-env
   CREATE_TIDB_SERVICE_JOB_ENABLED: ${CREATE_TIDB_SERVICE_JOB_ENABLED:-false}
   MAX_SUBMIT_COUNT: ${MAX_SUBMIT_COUNT:-100}
   TOP_K_MAX_VALUE: ${TOP_K_MAX_VALUE:-10}
-  ALLOW_EMBED: ${ALLOW_EMBED:-false}
 
 services:
   # API service
   api:
-    image: langgenius/dify-api:0.15.7
+    image: langgenius/dify-api:0.15.4
     restart: always
     environment:
       # Use the shared environment variables.
@@ -417,7 +416,7 @@ services:
   # worker service
   # The Celery worker for processing the queue.
   worker:
-    image: langgenius/dify-api:0.15.7
+    image: langgenius/dify-api:0.15.4
     restart: always
     environment:
       # Use the shared environment variables.
@@ -439,7 +438,7 @@ services:
 
   # Frontend web application.
   web:
-    image: langgenius/dify-web:0.15.7
+    image: langgenius/dify-web:0.15.4
     restart: always
     environment:
       CONSOLE_API_URL: ${CONSOLE_API_URL:-}
@@ -448,7 +447,6 @@ services:
       NEXT_TELEMETRY_DISABLED: ${NEXT_TELEMETRY_DISABLED:-0}
       TEXT_GENERATION_TIMEOUT_MS: ${TEXT_GENERATION_TIMEOUT_MS:-60000}
       CSP_WHITELIST: ${CSP_WHITELIST:-}
-      ALLOW_EMBED: ${ALLOW_EMBED:-false}
       TOP_K_MAX_VALUE: ${TOP_K_MAX_VALUE:-}
       INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH: ${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH:-}
 

web/.env.example

@@ -31,6 +31,3 @@ NEXT_PUBLIC_TOP_K_MAX_VALUE=10
 
 # The maximum number of tokens for segmentation
 NEXT_PUBLIC_INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH=4000
-
-# Default is not allow to embed into iframe to prevent Clickjacking: https://owasp.org/www-community/attacks/Clickjacking
-NEXT_PUBLIC_ALLOW_EMBED=

web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout.tsx

@@ -20,7 +20,7 @@ import cn from '@/utils/classnames'
 import { useStore } from '@/app/components/app/store'
 import AppSideBar from '@/app/components/app-sidebar'
 import type { NavIcon } from '@/app/components/app-sidebar/navLink'
-import { fetchAppDetail } from '@/service/apps'
+import { fetchAppDetail, fetchAppSSO } from '@/service/apps'
 import { useAppContext } from '@/context/app-context'
 import Loading from '@/app/components/base/loading'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
@@ -32,13 +32,6 @@ export type IAppDetailLayoutProps = {
   params: { appId: string }
 }
 
-type NavigationType = {
-  name: string
-  href: string
-  icon: NavIcon
-  selectedIcon: NavIcon
-}
-
 const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const {
     children,
@@ -57,7 +50,12 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   })))
   const [isLoadingAppDetail, setIsLoadingAppDetail] = useState(false)
   const [appDetailRes, setAppDetailRes] = useState<App | null>(null)
-  const [navigation, setNavigation] = useState<Array<NavigationType>>([])
+  const [navigation, setNavigation] = useState<Array<{
+    name: string
+    href: string
+    icon: NavIcon
+    selectedIcon: NavIcon
+  }>>([])
   const { systemFeatures } = useGlobalPublicStore()
 
   const getNavigations = useCallback((appId: string, isCurrentWorkspaceEditor: boolean, mode: string) => {
@@ -144,10 +142,15 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
       router.replace(`/app/${appId}/configuration`)
     }
     else {
-      setAppDetail({ ...res })
-      setNavigation(getNavigations(appId, isCurrentWorkspaceEditor, res.mode) as Array<NavigationType>)
+      setAppDetail({ ...res, enable_sso: false })
+      setNavigation(getNavigations(appId, isCurrentWorkspaceEditor, res.mode))
+      if (systemFeatures.enable_web_sso_switch_component && canIEditApp) {
+        fetchAppSSO({ appId }).then((ssoRes) => {
+          setAppDetail({ ...res, enable_sso: ssoRes.enabled })
+        })
+      }
     }
-  }, [appDetailRes, appId, getNavigations, isCurrentWorkspaceEditor, isLoadingAppDetail, isLoadingCurrentWorkspace, pathname, router, setAppDetail])
+  }, [appDetailRes, appId, getNavigations, isCurrentWorkspaceEditor, isLoadingAppDetail, isLoadingCurrentWorkspace, pathname, router, setAppDetail, systemFeatures.enable_web_sso_switch_component])
 
   useUnmount(() => {
     setAppDetail()

web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/cardView.tsx

@@ -8,16 +8,19 @@ import Loading from '@/app/components/base/loading'
 import { ToastContext } from '@/app/components/base/toast'
 import {
   fetchAppDetail,
+  fetchAppSSO,
+  updateAppSSO,
   updateAppSiteAccessToken,
   updateAppSiteConfig,
   updateAppSiteStatus,
 } from '@/service/apps'
-import type { App } from '@/types/app'
+import type { App, AppSSO } from '@/types/app'
 import type { UpdateAppSiteCodeResponse } from '@/models/app'
 import { asyncRunSafe } from '@/utils'
 import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
 import type { IAppCardProps } from '@/app/components/app/overview/appCard'
 import { useStore as useAppStore } from '@/app/components/app/store'
+import { useGlobalPublicStore } from '@/context/global-public-context'
 
 export type ICardViewProps = {
   appId: string
@@ -28,11 +31,18 @@ const CardView: FC<ICardViewProps> = ({ appId }) => {
   const { notify } = useContext(ToastContext)
   const appDetail = useAppStore(state => state.appDetail)
   const setAppDetail = useAppStore(state => state.setAppDetail)
+  const { systemFeatures } = useGlobalPublicStore()
 
   const updateAppDetail = async () => {
     try {
       const res = await fetchAppDetail({ url: '/apps', id: appId })
-      setAppDetail({ ...res })
+      if (systemFeatures.enable_web_sso_switch_component) {
+        const ssoRes = await fetchAppSSO({ appId })
+        setAppDetail({ ...res, enable_sso: ssoRes.enabled })
+      }
+      else {
+        setAppDetail({ ...res })
+      }
     }
     catch (error) { console.error(error) }
   }
@@ -83,6 +93,16 @@ const CardView: FC<ICardViewProps> = ({ appId }) => {
     if (!err)
       localStorage.setItem(NEED_REFRESH_APP_LIST_KEY, '1')
 
+    if (systemFeatures.enable_web_sso_switch_component) {
+      const [sso_err] = await asyncRunSafe<AppSSO>(
+        updateAppSSO({ id: appId, enabled: Boolean(params.enable_sso) }) as Promise<AppSSO>,
+      )
+      if (sso_err) {
+        handleCallbackResult(sso_err)
+        return
+      }
+    }
+
     handleCallbackResult(err)
   }
 

web/app/(commonLayout)/apps/AppCard.tsx

@@ -4,7 +4,7 @@ import { useContext, useContextSelector } from 'use-context-selector'
 import { useRouter } from 'next/navigation'
 import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { RiBuildingLine, RiGlobalLine, RiLockLine, RiMoreFill } from '@remixicon/react'
+import { RiMoreFill } from '@remixicon/react'
 import s from './style.module.css'
 import cn from '@/utils/classnames'
 import type { App } from '@/types/app'
@@ -31,9 +31,6 @@ import DSLExportConfirmModal from '@/app/components/workflow/dsl-export-confirm-
 import { fetchWorkflowDraft } from '@/service/workflow'
 import { fetchInstalledAppList } from '@/service/explore'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
-import Tooltip from '@/app/components/base/tooltip'
-import AccessControl from '@/app/components/app/app-access-control'
-import { AccessMode } from '@/models/access-control'
 
 export type AppCardProps = {
   app: App
@@ -56,7 +53,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
   const [showDuplicateModal, setShowDuplicateModal] = useState(false)
   const [showSwitchModal, setShowSwitchModal] = useState<boolean>(false)
   const [showConfirmDelete, setShowConfirmDelete] = useState(false)
-  const [showAccessControl, setShowAccessControl] = useState(false)
   const [secretEnvList, setSecretEnvList] = useState<EnvironmentVariable[]>([])
 
   const onConfirmDelete = useCallback(async () => {
@@ -75,7 +71,7 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
       })
     }
     setShowConfirmDelete(false)
-  }, [app.id, mutateApps, notify, onPlanInfoChanged, onRefresh, t])
+  }, [app.id])
 
   const onEdit: CreateAppModalProps['onConfirm'] = useCallback(async ({
     name,
@@ -179,13 +175,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
     setShowSwitchModal(false)
   }
 
-  const onUpdateAccessControl = useCallback(() => {
-    if (onRefresh)
-      onRefresh()
-    mutateApps()
-    setShowAccessControl(false)
-  }, [onRefresh, mutateApps, setShowAccessControl])
-
   const Operations = (props: HtmlContentProps) => {
     const onMouseLeave = async () => {
       props.onClose?.()
@@ -220,12 +209,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
       e.preventDefault()
       setShowConfirmDelete(true)
     }
-    const onClickAccessControl = async (e: React.MouseEvent<HTMLButtonElement>) => {
-      e.stopPropagation()
-      props.onClick?.()
-      e.preventDefault()
-      setShowAccessControl(true)
-    }
     const onClickInstalledApp = async (e: React.MouseEvent<HTMLButtonElement>) => {
       e.stopPropagation()
       props.onClick?.()
@@ -269,14 +252,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
           <span className={s.actionName}>{t('app.openInExplore')}</span>
         </button>
         <Divider className="!my-1" />
-        {
-          isCurrentWorkspaceEditor && <>
-            <button className={s.actionItem} onClick={onClickAccessControl}>
-              <span className={s.actionName}>{t('app.accessControl')}</span>
-            </button>
-            <Divider />
-          </>
-        }
         <div
           className={cn(s.actionItem, s.deleteActionItem, 'group')}
           onClick={onClickDelete}
@@ -303,7 +278,7 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
         }}
         className='relative h-[160px] group col-span-1 bg-components-card-bg border-[1px] border-solid border-components-card-border rounded-xl shadow-sm inline-flex flex-col transition-all duration-200 ease-in-out cursor-pointer hover:shadow-lg'
       >
-        <div className='flex p-4 pb-3 h-[68px] items-start gap-3 grow-0 shrink-0'>
+        <div className='flex pt-[14px] px-[14px] pb-3 h-[66px] items-center gap-3 grow-0 shrink-0'>
           <div className='relative shrink-0'>
             <AppIcon
               size="large"
@@ -326,17 +301,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
               {app.mode === 'completion' && <div className='truncate'>{t('app.types.completion').toUpperCase()}</div>}
             </div>
           </div>
-          <div className='shrink-0 w-5 h-5 flex items-center justify-center'>
-            {app.access_mode === AccessMode.PUBLIC && <Tooltip asChild={false} popupContent={t('app.accessItemsDescription.anyone')}>
-              <RiGlobalLine className='text-text-accent w-4 h-4' />
-            </Tooltip>}
-            {app.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS && <Tooltip asChild={false} popupContent={t('app.accessItemsDescription.specific')}>
-              <RiLockLine className='text-text-quaternary w-4 h-4' />
-            </Tooltip>}
-            {app.access_mode === AccessMode.ORGANIZATION && <Tooltip asChild={false} popupContent={t('app.accessItemsDescription.organization')}>
-              <RiBuildingLine className='text-text-quaternary w-4 h-4' />
-            </Tooltip>}
-          </div>
         </div>
         <div className='title-wrapper h-[90px] px-[14px] text-xs leading-normal text-text-tertiary'>
           <div
@@ -393,7 +357,7 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
                   popupClassName={
                     (app.mode === 'completion' || app.mode === 'chat')
                       ? '!w-[256px] translate-x-[-224px]'
-                      : '!w-[216px] translate-x-[-128px]'
+                      : '!w-[160px] translate-x-[-128px]'
                   }
                   className={'h-fit !z-20'}
                 />
@@ -454,9 +418,6 @@ const AppCard = ({ app, onRefresh }: AppCardProps) => {
           onClose={() => setSecretEnvList([])}
         />
       )}
-      {showAccessControl && (
-        <AccessControl app={app} onConfirm={onUpdateAccessControl} onClose={() => setShowAccessControl(false)} />
-      )}
     </>
   )
 }

web/app/(shareLayout)/webapp-signin/page.tsx

@@ -1,21 +1,14 @@
 'use client'
 import { useRouter, useSearchParams } from 'next/navigation'
 import type { FC } from 'react'
-import React, { useCallback, useEffect } from 'react'
-import { useTranslation } from 'react-i18next'
-import { RiDoorLockLine } from '@remixicon/react'
+import React, { useEffect } from 'react'
 import cn from '@/utils/classnames'
 import Toast from '@/app/components/base/toast'
-import { fetchWebOAuth2SSOUrl, fetchWebOIDCSSOUrl, fetchWebSAMLSSOUrl } from '@/service/share'
+import { fetchSystemFeatures, fetchWebOAuth2SSOUrl, fetchWebOIDCSSOUrl, fetchWebSAMLSSOUrl } from '@/service/share'
 import { setAccessToken } from '@/app/components/share/utils'
-import { useGlobalPublicStore } from '@/context/global-public-context'
-import { SSOProtocol } from '@/types/feature'
 import Loading from '@/app/components/base/loading'
-import AppUnavailable from '@/app/components/base/app-unavailable'
 
 const WebSSOForm: FC = () => {
-  const { t } = useTranslation()
-  const systemFeatures = useGlobalPublicStore(s => s.systemFeatures)
   const searchParams = useSearchParams()
   const router = useRouter()
 
@@ -30,15 +23,15 @@ const WebSSOForm: FC = () => {
     })
   }
 
-  const getAppCodeFromRedirectUrl = useCallback(() => {
+  const getAppCodeFromRedirectUrl = () => {
     const appCode = redirectUrl?.split('/').pop()
     if (!appCode)
       return null
 
     return appCode
-  }, [redirectUrl])
+  }
 
-  const processTokenAndRedirect = useCallback(async () => {
+  const processTokenAndRedirect = async () => {
     const appCode = getAppCodeFromRedirectUrl()
     if (!appCode || !tokenFromUrl || !redirectUrl) {
       showErrorToast('redirect url or app code or token is invalid.')
@@ -47,47 +40,48 @@ const WebSSOForm: FC = () => {
 
     await setAccessToken(appCode, tokenFromUrl)
     router.push(redirectUrl)
-  }, [getAppCodeFromRedirectUrl, redirectUrl, router, tokenFromUrl])
+  }
 
-  const handleSSOLogin = useCallback(async () => {
+  const handleSSOLogin = async (protocol: string) => {
     const appCode = getAppCodeFromRedirectUrl()
     if (!appCode || !redirectUrl) {
       showErrorToast('redirect url or app code is invalid.')
       return
     }
 
-    switch (systemFeatures.webapp_auth.sso_config.protocol) {
-      case SSOProtocol.SAML: {
+    switch (protocol) {
+      case 'saml': {
         const samlRes = await fetchWebSAMLSSOUrl(appCode, redirectUrl)
         router.push(samlRes.url)
         break
       }
-      case SSOProtocol.OIDC: {
+      case 'oidc': {
         const oidcRes = await fetchWebOIDCSSOUrl(appCode, redirectUrl)
         router.push(oidcRes.url)
         break
       }
-      case SSOProtocol.OAuth2: {
+      case 'oauth2': {
         const oauth2Res = await fetchWebOAuth2SSOUrl(appCode, redirectUrl)
         router.push(oauth2Res.url)
         break
       }
-      case '':
-        break
       default:
         showErrorToast('SSO protocol is not supported.')
     }
-  }, [getAppCodeFromRedirectUrl, redirectUrl, router, systemFeatures.webapp_auth.sso_config.protocol])
+  }
 
   useEffect(() => {
     const init = async () => {
+      const res = await fetchSystemFeatures()
+      const protocol = res.sso_enforced_for_web_protocol
+
       if (message) {
         showErrorToast(message)
         return
       }
 
       if (!tokenFromUrl) {
-        await handleSSOLogin()
+        await handleSSOLogin(protocol)
         return
       }
 
@@ -95,45 +89,15 @@ const WebSSOForm: FC = () => {
     }
 
     init()
-  }, [message, processTokenAndRedirect, tokenFromUrl, handleSSOLogin])
-  if (tokenFromUrl)
-    return <div className='flex items-center justify-center h-full'><Loading /></div>
-  if (message) {
-    return <div className='flex items-center justify-center h-full'>
-      <AppUnavailable code={'App Unavailable'} unknownReason={message} />
-    </div>
-  }
+  }, [message, tokenFromUrl]) // Added dependencies to useEffect
 
-  if (systemFeatures.webapp_auth.enabled) {
-    if (systemFeatures.webapp_auth.allow_sso) {
-      return (
-        <div className="flex items-center justify-center h-full">
-          <div className={cn('flex flex-col items-center w-full grow justify-center', 'px-6', 'md:px-[108px]')}>
-            <Loading />
-          </div>
-        </div>
-      )
-    }
-    return <div className="flex items-center justify-center h-full">
-      <div className="p-4 rounded-lg bg-gradient-to-r from-workflow-workflow-progress-bg-1 to-workflow-workflow-progress-bg-2">
-        <div className='flex items-center justify-center w-10 h-10 rounded-xl bg-components-card-bg shadow shadows-shadow-lg mb-2'>
-          <RiDoorLockLine className='w-5 h-5' />
-        </div>
-        <p className='system-sm-medium text-text-primary'>{t('login.webapp.noLoginMethod')}</p>
-        <p className='system-xs-regular text-text-tertiary mt-1'>{t('login.webapp.noLoginMethodTip')}</p>
-      </div>
-      <div className="relative my-2 py-2">
-        <div className="absolute inset-0 flex items-center" aria-hidden="true">
-          <div className='bg-gradient-to-r from-background-gradient-mask-transparent via-divider-regular to-background-gradient-mask-transparent h-px w-full'></div>
-        </div>
+  return (
+    <div className="flex items-center justify-center h-full">
+      <div className={cn('flex flex-col items-center w-full grow justify-center', 'px-6', 'md:px-[108px]')}>
+        <Loading type='area' />
       </div>
     </div>
-  }
-  else {
-    return <div className="flex items-center justify-center h-full">
-      <p className='system-xs-regular text-text-tertiary'>{t('login.webapp.disabled')}</p>
-    </div>
-  }
+  )
 }
 
 export default React.memo(WebSSOForm)

web/app/components/app-sidebar/app-info.tsx

@@ -5,7 +5,6 @@ import { RiArrowDownSLine } from '@remixicon/react'
 import React, { useCallback, useState } from 'react'
 import AppIcon from '../base/app-icon'
 import SwitchAppModal from '../app/switch-app-modal'
-import AccessControl from '../app/app-access-control'
 import s from './style.module.css'
 import cn from '@/utils/classnames'
 import {
@@ -19,7 +18,7 @@ import { useStore as useAppStore } from '@/app/components/app/store'
 import { ToastContext } from '@/app/components/base/toast'
 import AppsContext, { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
-import { copyApp, deleteApp, exportAppConfig, fetchAppDetail, updateAppInfo } from '@/service/apps'
+import { copyApp, deleteApp, exportAppConfig, updateAppInfo } from '@/service/apps'
 import DuplicateAppModal from '@/app/components/app/duplicate-modal'
 import type { DuplicateAppModalProps } from '@/app/components/app/duplicate-modal'
 import CreateAppModal from '@/app/components/explore/create-app-modal'
@@ -51,7 +50,6 @@ const AppInfo = ({ expand }: IAppInfoProps) => {
   const [showSwitchTip, setShowSwitchTip] = useState<string>('')
   const [showSwitchModal, setShowSwitchModal] = useState<boolean>(false)
   const [showImportDSLModal, setShowImportDSLModal] = useState<boolean>(false)
-  const [showAccessControl, setShowAccessControl] = useState<boolean>(false)
   const [secretEnvList, setSecretEnvList] = useState<EnvironmentVariable[]>([])
 
   const mutateApps = useContextSelector(
@@ -177,20 +175,7 @@ const AppInfo = ({ expand }: IAppInfoProps) => {
       })
     }
     setShowConfirmDelete(false)
-  }, [appDetail, mutateApps, notify, onPlanInfoChanged, replace, setAppDetail, t])
-
-  const handleClickAccessControl = useCallback(() => {
-    if (!appDetail)
-      return
-    setShowAccessControl(true)
-    setOpen(false)
-  }, [appDetail])
-  const handleAccessControlUpdate = useCallback(() => {
-    fetchAppDetail({ url: '/apps', id: appDetail!.id }).then((res) => {
-      setAppDetail(res)
-      setShowAccessControl(false)
-    })
-  }, [appDetail, setAppDetail])
+  }, [appDetail, mutateApps, notify, onPlanInfoChanged, replace, t])
 
   const { isCurrentWorkspaceEditor } = useAppContext()
 
@@ -389,10 +374,6 @@ const AppInfo = ({ expand }: IAppInfoProps) => {
                   </div>
                 )
               }
-              <Divider />
-              <div className='h-9 py-2 px-3 mx-1 flex items-center hover:bg-gray-50 rounded-lg cursor-pointer' onClick={handleClickAccessControl}>
-                <span className='text-gray-700 text-sm leading-5'>{t('app.accessControl')}</span>
-              </div>
               <Divider className="!my-1" />
               <div className='group h-9 py-2 px-3 mx-1 flex items-center hover:bg-red-50 rounded-lg cursor-pointer' onClick={() => {
                 setOpen(false)
@@ -485,11 +466,6 @@ const AppInfo = ({ expand }: IAppInfoProps) => {
             onClose={() => setSecretEnvList([])}
           />
         )}
-        {
-          showAccessControl && <AccessControl app={appDetail}
-            onConfirm={handleAccessControlUpdate}
-            onClose={() => { setShowAccessControl(false) }} />
-        }
       </div>
     </PortalToFollowElem>
   )

web/app/components/app-sidebar/index.tsx

@@ -17,7 +17,7 @@ export type IAppDetailNavProps = {
   desc: string
   isExternal?: boolean
   icon: string
-  icon_background: string | null
+  icon_background: string
   navigation: Array<{
     name: string
     href: string

web/app/components/app/app-access-control/access-control-dialog.tsx

@@ -1,61 +0,0 @@
-import { Fragment, useCallback } from 'react'
-import type { ReactNode } from 'react'
-import { Dialog, Transition } from '@headlessui/react'
-import { RiCloseLine } from '@remixicon/react'
-import cn from '@/utils/classnames'
-
-type DialogProps = {
-  className?: string
-  children: ReactNode
-  show: boolean
-  onClose?: () => void
-}
-
-const AccessControlDialog = ({
-  className,
-  children,
-  show,
-  onClose,
-}: DialogProps) => {
-  const close = useCallback(() => {
-    onClose?.()
-  }, [onClose])
-  return (
-    <Transition appear show={show} as={Fragment}>
-      <Dialog as="div" open={true} className="relative z-20" onClose={() => null}>
-        <Transition.Child
-          as={Fragment}
-          enter="ease-out duration-300"
-          enterFrom="opacity-0"
-          enterTo="opacity-100"
-          leave="ease-in duration-200"
-          leaveFrom="opacity-100"
-          leaveTo="opacity-0"
-        >
-          <div className="fixed inset-0 bg-background-overlay bg-opacity-25" />
-        </Transition.Child>
-
-        <div className="fixed inset-0 flex items-center justify-center">
-          <Transition.Child
-            as={Fragment}
-            enter="ease-out duration-300"
-            enterFrom="opacity-0 scale-95"
-            enterTo="opacity-100 scale-100"
-            leave="ease-in duration-200"
-            leaveFrom="opacity-100 scale-100"
-            leaveTo="opacity-0 scale-95"
-          >
-            <Dialog.Panel className={cn('w-[600px] min-h-[323px] h-auto bg-components-panel-bg shadow-xl rounded-2xl transition-all transform relative p-0 overflow-y-auto', className)}>
-              <div onClick={() => close()} className="absolute top-5 right-5 w-8 h-8 flex items-center justify-center cursor-pointer z-10">
-                <RiCloseLine className='w-5 h-5' />
-              </div>
-              {children}
-            </Dialog.Panel>
-          </Transition.Child>
-        </div>
-      </Dialog>
-    </Transition >
-  )
-}
-
-export default AccessControlDialog

web/app/components/app/app-access-control/access-control-item.tsx

@@ -1,30 +0,0 @@
-'use client'
-import type { FC, PropsWithChildren } from 'react'
-import useAccessControlStore from '../../../../context/access-control-store'
-import type { AccessMode } from '@/models/access-control'
-
-type AccessControlItemProps = PropsWithChildren<{
-  type: AccessMode
-}>
-
-const AccessControlItem: FC<AccessControlItemProps> = ({ type, children }) => {
-  const { currentMenu, setCurrentMenu } = useAccessControlStore(s => ({ currentMenu: s.currentMenu, setCurrentMenu: s.setCurrentMenu }))
-  if (currentMenu !== type) {
-    return <div
-      className="rounded-[10px] border-[1px] cursor-pointer
-      border-components-option-card-option-border bg-components-option-card-option-bg
-      hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover"
-      onClick={() => setCurrentMenu(type)} >
-      {children}
-    </div>
-  }
-
-  return <div className="rounded-[10px] border-[1.5px]
-  border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg shadow-sm">
-    {children}
-  </div>
-}
-
-AccessControlItem.displayName = 'AccessControlItem'
-
-export default AccessControlItem

web/app/components/app/app-access-control/add-member-or-group-pop.tsx

@@ -1,204 +0,0 @@
-'use client'
-import { RiAddCircleFill, RiArrowRightSLine, RiOrganizationChart } from '@remixicon/react'
-import { useTranslation } from 'react-i18next'
-import { useCallback, useEffect, useRef, useState } from 'react'
-import { useDebounce } from 'ahooks'
-import { FloatingOverlay } from '@floating-ui/react'
-import Avatar from '../../base/avatar'
-import Button from '../../base/button'
-import Checkbox from '../../base/checkbox'
-import Input from '../../base/input'
-import { PortalToFollowElem, PortalToFollowElemContent, PortalToFollowElemTrigger } from '../../base/portal-to-follow-elem'
-import Loading from '../../base/loading'
-import useAccessControlStore from '../../../../context/access-control-store'
-import classNames from '@/utils/classnames'
-import { useSearchForWhiteListCandidates } from '@/service/access-control'
-import type { AccessControlAccount, AccessControlGroup, Subject, SubjectAccount, SubjectGroup } from '@/models/access-control'
-import { SubjectType } from '@/models/access-control'
-import { useSelector } from '@/context/app-context'
-
-export default function AddMemberOrGroupDialog() {
-  const { t } = useTranslation()
-  const [open, setOpen] = useState(false)
-  const [keyword, setKeyword] = useState('')
-  const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
-  const debouncedKeyword = useDebounce(keyword, { wait: 500 })
-
-  const lastAvailableGroup = selectedGroupsForBreadcrumb[selectedGroupsForBreadcrumb.length - 1]
-  const { isLoading, isFetchingNextPage, fetchNextPage, data } = useSearchForWhiteListCandidates({ keyword: debouncedKeyword, groupId: lastAvailableGroup?.id, resultsPerPage: 10 }, open)
-  const handleKeywordChange = (e: React.ChangeEvent<HTMLInputElement>) => {
-    setKeyword(e.target.value)
-  }
-
-  const anchorRef = useRef<HTMLDivElement>(null)
-  useEffect(() => {
-    const hasMore = data?.pages?.[0].hasMore ?? false
-    let observer: IntersectionObserver | undefined
-    if (anchorRef.current) {
-      observer = new IntersectionObserver((entries) => {
-        if (entries[0].isIntersecting && !isLoading && hasMore)
-          fetchNextPage()
-      }, { rootMargin: '20px' })
-      observer.observe(anchorRef.current)
-    }
-    return () => observer?.disconnect()
-  }, [isLoading, fetchNextPage, anchorRef, data])
-
-  return <PortalToFollowElem open={open} onOpenChange={setOpen} offset={{ crossAxis: 300 }} placement='bottom-end'>
-    <PortalToFollowElemTrigger asChild>
-      <Button variant='ghost-accent' size='small' className='shrink-0 flex items-center gap-x-0.5' onClick={() => setOpen(!open)}>
-        <RiAddCircleFill className='w-4 h-4' />
-        <span>{t('common.operation.add')}</span>
-      </Button>
-    </PortalToFollowElemTrigger>
-    {open && <FloatingOverlay />}
-    <PortalToFollowElemContent className='z-[25]'>
-      <div className='w-[400px] max-h-[400px] relative overflow-y-auto flex flex-col border-[0.5px] border-components-panel-border rounded-xl bg-components-panel-bg-blur backdrop-blur-[5px] shadow-lg'>
-        <div className='p-2 pb-0.5 sticky top-0 bg-components-panel-bg-blur backdrop-blur-[5px] z-1'>
-          <Input value={keyword} onChange={handleKeywordChange} showLeftIcon placeholder={t('app.accessControlDialog.operateGroupAndMember.searchPlaceholder') as string} />
-        </div>
-        {
-          isLoading
-            ? <div className='p-1'><Loading /></div>
-            : (data?.pages?.length ?? 0) > 0
-              ? <>
-                <div className='flex items-center h-7 px-2 py-0.5'>
-                  <SelectedGroupsBreadCrumb />
-                </div>
-                <div className='p-1'>
-                  {renderGroupOrMember(data?.pages ?? [])}
-                  {isFetchingNextPage && <Loading />}
-                </div>
-                <div ref={anchorRef} className='h-0'> </div>
-              </>
-              : <div className='flex items-center justify-center h-7 px-2 py-0.5'>
-                <span className='system-xs-regular text-text-tertiary'>{t('app.accessControlDialog.operateGroupAndMember.noResult')}</span>
-              </div>
-        }
-      </div>
-    </PortalToFollowElemContent>
-  </PortalToFollowElem>
-}
-
-type GroupOrMemberData = { subjects: Subject[]; currPage: number }[]
-function renderGroupOrMember(data: GroupOrMemberData) {
-  return data?.map((page) => {
-    return <div key={`search_group_member_page_${page.currPage}`}>
-      {page.subjects?.map((item, index) => {
-        if (item.subjectType === SubjectType.GROUP)
-          return <GroupItem key={index} group={(item as SubjectGroup).groupData} />
-        return <MemberItem key={index} member={(item as SubjectAccount).accountData} />
-      })}
-    </div>
-  }) ?? null
-}
-
-function SelectedGroupsBreadCrumb() {
-  const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
-  const setSelectedGroupsForBreadcrumb = useAccessControlStore(s => s.setSelectedGroupsForBreadcrumb)
-  const { t } = useTranslation()
-
-  const handleBreadCrumbClick = useCallback((index: number) => {
-    const newGroups = selectedGroupsForBreadcrumb.slice(0, index + 1)
-    setSelectedGroupsForBreadcrumb(newGroups)
-  }, [setSelectedGroupsForBreadcrumb, selectedGroupsForBreadcrumb])
-  const handleReset = useCallback(() => {
-    setSelectedGroupsForBreadcrumb([])
-  }, [setSelectedGroupsForBreadcrumb])
-  return <div className='flex items-center h-7 px-2 py-0.5 gap-x-0.5'>
-    <span className={classNames('system-xs-regular text-text-tertiary', selectedGroupsForBreadcrumb.length > 0 && 'text-text-accent cursor-pointer')} onClick={handleReset}>{t('app.accessControlDialog.operateGroupAndMember.allMembers')}</span>
-    {selectedGroupsForBreadcrumb.map((group, index) => {
-      return <div key={index} className='flex items-center gap-x-0.5 text-text-tertiary system-xs-regular'>
-        <span>/</span>
-        <span className={index === selectedGroupsForBreadcrumb.length - 1 ? '' : 'text-text-accent cursor-pointer'} onClick={() => handleBreadCrumbClick(index)}>{group.name}</span>
-      </div>
-    })}
-  </div>
-}
-
-type GroupItemProps = {
-  group: AccessControlGroup
-}
-function GroupItem({ group }: GroupItemProps) {
-  const { t } = useTranslation()
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
-  const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
-  const setSelectedGroupsForBreadcrumb = useAccessControlStore(s => s.setSelectedGroupsForBreadcrumb)
-  const isChecked = specificGroups.some(g => g.id === group.id)
-  const handleCheckChange = useCallback(() => {
-    if (!isChecked) {
-      const newGroups = [...specificGroups, group]
-      setSpecificGroups(newGroups)
-    }
-    else {
-      const newGroups = specificGroups.filter(g => g.id !== group.id)
-      setSpecificGroups(newGroups)
-    }
-  }, [specificGroups, setSpecificGroups, group, isChecked])
-
-  const handleExpandClick = useCallback(() => {
-    setSelectedGroupsForBreadcrumb([...selectedGroupsForBreadcrumb, group])
-  }, [selectedGroupsForBreadcrumb, setSelectedGroupsForBreadcrumb, group])
-  return <BaseItem>
-    <Checkbox checked={isChecked} className='w-4 h-4 shrink-0' onCheck={handleCheckChange} />
-    <div className='flex item-center grow'>
-      <div className='w-5 h-5 rounded-full bg-components-icon-bg-blue-solid overflow-hidden mr-2'>
-        <div className='w-full h-full flex items-center justify-center bg-access-app-icon-mask-bg'>
-          <RiOrganizationChart className='w-[14px] h-[14px] text-components-avatar-shape-fill-stop-0' />
-        </div>
-      </div>
-      <p className='system-sm-medium text-text-secondary mr-1'>{group.name}</p>
-      <p className='system-xs-regular text-text-tertiary'>{group.groupSize}</p>
-    </div>
-    <Button size="small" disabled={isChecked} variant='ghost-accent'
-      className='py-1 px-1.5 shrink-0 flex items-center justify-between' onClick={handleExpandClick}>
-      <span className='px-[3px]'>{t('app.accessControlDialog.operateGroupAndMember.expand')}</span>
-      <RiArrowRightSLine className='w-4 h-4' />
-    </Button>
-  </BaseItem>
-}
-
-type MemberItemProps = {
-  member: AccessControlAccount
-}
-function MemberItem({ member }: MemberItemProps) {
-  const currentUser = useSelector(s => s.userProfile)
-  const { t } = useTranslation()
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
-  const isChecked = specificMembers.some(m => m.id === member.id)
-  const handleCheckChange = useCallback(() => {
-    if (!isChecked) {
-      const newMembers = [...specificMembers, member]
-      setSpecificMembers(newMembers)
-    }
-    else {
-      const newMembers = specificMembers.filter(m => m.id !== member.id)
-      setSpecificMembers(newMembers)
-    }
-  }, [specificMembers, setSpecificMembers, member, isChecked])
-  return <BaseItem className='pr-3'>
-    <Checkbox checked={isChecked} className='w-4 h-4 shrink-0' onCheck={handleCheckChange} />
-    <div className='flex items-center grow'>
-      <div className='w-5 h-5 rounded-full bg-components-icon-bg-blue-solid overflow-hidden mr-2'>
-        <div className='w-full h-full flex items-center justify-center bg-access-app-icon-mask-bg'>
-          <Avatar className='w-[14px] h-[14px]' textClassName='text-[12px]' avatar={null} name={member.name} />
-        </div>
-      </div>
-      <p className='system-sm-medium text-text-secondary mr-1'>{member.name}</p>
-      {currentUser.email === member.email && <p className='system-xs-regular text-text-tertiary'>({t('common.you')})</p>}
-    </div>
-    <p className='system-xs-regular text-text-quaternary'>{member.email}</p>
-  </BaseItem>
-}
-
-type BaseItemProps = {
-  className?: string
-  children: React.ReactNode
-}
-function BaseItem({ children, className }: BaseItemProps) {
-  return <div className={classNames('p-1 pl-2 flex items-center space-x-2 hover:rounded-lg hover:bg-state-base-hover cursor-pointer', className)}>
-    {children}
-  </div>
-}

web/app/components/app/app-access-control/index.tsx

@@ -1,102 +0,0 @@
-'use client'
-import { Dialog } from '@headlessui/react'
-import { RiBuildingLine, RiGlobalLine } from '@remixicon/react'
-import { useTranslation } from 'react-i18next'
-import { useCallback, useEffect } from 'react'
-import Button from '../../base/button'
-import Toast from '../../base/toast'
-import useAccessControlStore from '../../../../context/access-control-store'
-import AccessControlDialog from './access-control-dialog'
-import AccessControlItem from './access-control-item'
-import SpecificGroupsOrMembers, { WebAppSSONotEnabledTip } from './specific-groups-or-members'
-import { useGlobalPublicStore } from '@/context/global-public-context'
-import type { App } from '@/types/app'
-import type { Subject } from '@/models/access-control'
-import { AccessMode, SubjectType } from '@/models/access-control'
-import { useUpdateAccessMode } from '@/service/access-control'
-
-type AccessControlProps = {
-  app: App
-  onClose: () => void
-  onConfirm?: () => void
-}
-
-export default function AccessControl(props: AccessControlProps) {
-  const { app, onClose, onConfirm } = props
-  const { t } = useTranslation()
-  const systemFeatures = useGlobalPublicStore(s => s.systemFeatures)
-  const setAppId = useAccessControlStore(s => s.setAppId)
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const currentMenu = useAccessControlStore(s => s.currentMenu)
-  const setCurrentMenu = useAccessControlStore(s => s.setCurrentMenu)
-  const hideTip = systemFeatures.webapp_auth.enabled
-    && (systemFeatures.webapp_auth.allow_sso
-      || systemFeatures.webapp_auth.allow_email_password_login
-      || systemFeatures.webapp_auth.allow_email_code_login)
-
-  useEffect(() => {
-    setAppId(app.id)
-    setCurrentMenu(app.access_mode ?? AccessMode.SPECIFIC_GROUPS_MEMBERS)
-  }, [app, setAppId, setCurrentMenu])
-
-  const { isPending, mutateAsync: updateAccessMode } = useUpdateAccessMode()
-  const handleConfirm = useCallback(async () => {
-    const submitData: {
-      appId: string
-      accessMode: AccessMode
-      subjects?: Pick<Subject, 'subjectId' | 'subjectType'>[]
-    } = { appId: app.id, accessMode: currentMenu }
-    if (currentMenu === AccessMode.SPECIFIC_GROUPS_MEMBERS) {
-      const subjects: Pick<Subject, 'subjectId' | 'subjectType'>[] = []
-      specificGroups.forEach((group) => {
-        subjects.push({ subjectId: group.id, subjectType: SubjectType.GROUP })
-      })
-      specificMembers.forEach((member) => {
-        subjects.push({
-          subjectId: member.id,
-          subjectType: SubjectType.ACCOUNT,
-        })
-      })
-      submitData.subjects = subjects
-    }
-    await updateAccessMode(submitData)
-    Toast.notify({ type: 'success', message: t('app.accessControlDialog.updateSuccess') })
-    onConfirm?.()
-  }, [updateAccessMode, app, specificGroups, specificMembers, t, onConfirm, currentMenu])
-  return <AccessControlDialog show onClose={onClose}>
-    <div className='flex flex-col gap-y-3'>
-      <div className='pt-6 pr-14 pb-3 pl-6'>
-        <Dialog.Title className='title-2xl-semi-bold text-text-primary'>{t('app.accessControlDialog.title')}</Dialog.Title>
-        <Dialog.Description className='mt-1 system-xs-regular text-text-tertiary'>{t('app.accessControlDialog.description')}</Dialog.Description>
-      </div>
-      <div className='px-6 pb-3 flex flex-col gap-y-1'>
-        <div className='leading-6'>
-          <p className='system-sm-medium'>{t('app.accessControlDialog.accessLabel')}</p>
-        </div>
-        <AccessControlItem type={AccessMode.ORGANIZATION}>
-          <div className='flex items-center p-3'>
-            <div className='grow flex items-center gap-x-2'>
-              <RiBuildingLine className='w-4 h-4 text-text-primary' />
-              <p className='system-sm-medium text-text-primary'>{t('app.accessControlDialog.accessItems.organization')}</p>
-            </div>
-            {!hideTip && <WebAppSSONotEnabledTip />}
-          </div>
-        </AccessControlItem>
-        <AccessControlItem type={AccessMode.SPECIFIC_GROUPS_MEMBERS}>
-          <SpecificGroupsOrMembers />
-        </AccessControlItem>
-        <AccessControlItem type={AccessMode.PUBLIC}>
-          <div className='flex items-center p-3 gap-x-2'>
-            <RiGlobalLine className='w-4 h-4 text-text-primary' />
-            <p className='system-sm-medium text-text-primary'>{t('app.accessControlDialog.accessItems.anyone')}</p>
-          </div>
-        </AccessControlItem>
-      </div>
-      <div className='flex items-center justify-end p-6 pt-5 gap-x-2'>
-        <Button onClick={onClose}>{t('common.operation.cancel')}</Button>
-        <Button disabled={isPending} loading={isPending} variant='primary' onClick={handleConfirm}>{t('common.operation.confirm')}</Button>
-      </div>
-    </div>
-  </AccessControlDialog>
-}

web/app/components/app/app-access-control/specific-groups-or-members.tsx

@@ -1,139 +0,0 @@
-'use client'
-import { RiAlertFill, RiCloseCircleFill, RiLockLine, RiOrganizationChart } from '@remixicon/react'
-import { useTranslation } from 'react-i18next'
-import { useCallback, useEffect } from 'react'
-import Avatar from '../../base/avatar'
-import Divider from '../../base/divider'
-import Tooltip from '../../base/tooltip'
-import Loading from '../../base/loading'
-import useAccessControlStore from '../../../../context/access-control-store'
-import AddMemberOrGroupDialog from './add-member-or-group-pop'
-import { useGlobalPublicStore } from '@/context/global-public-context'
-import type { AccessControlAccount, AccessControlGroup } from '@/models/access-control'
-import { AccessMode } from '@/models/access-control'
-import { useAppWhiteListSubjects } from '@/service/access-control'
-
-export default function SpecificGroupsOrMembers() {
-  const currentMenu = useAccessControlStore(s => s.currentMenu)
-  const appId = useAccessControlStore(s => s.appId)
-  const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
-  const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
-  const { t } = useTranslation()
-  const systemFeatures = useGlobalPublicStore(s => s.systemFeatures)
-  const hideTip = systemFeatures.webapp_auth.enabled
-    && (systemFeatures.webapp_auth.allow_sso
-      || systemFeatures.webapp_auth.allow_email_password_login
-      || systemFeatures.webapp_auth.allow_email_code_login)
-
-  const { isPending, data } = useAppWhiteListSubjects(appId, Boolean(appId) && currentMenu === AccessMode.SPECIFIC_GROUPS_MEMBERS)
-  useEffect(() => {
-    setSpecificGroups(data?.groups ?? [])
-    setSpecificMembers(data?.members ?? [])
-  }, [data, setSpecificGroups, setSpecificMembers])
-
-  if (currentMenu !== AccessMode.SPECIFIC_GROUPS_MEMBERS) {
-    return <div className='flex items-center p-3'>
-      <div className='grow flex items-center gap-x-2'>
-        <RiLockLine className='w-4 h-4 text-text-primary' />
-        <p className='system-sm-medium text-text-primary'>{t('app.accessControlDialog.accessItems.specific')}</p>
-      </div>
-      {!hideTip && <WebAppSSONotEnabledTip />}
-    </div>
-  }
-
-  return <div>
-    <div className='flex items-center gap-x-1 p-3'>
-      <div className='grow flex items-center gap-x-1'>
-        <RiLockLine className='w-4 h-4 text-text-primary' />
-        <p className='system-sm-medium text-text-primary'>{t('app.accessControlDialog.accessItems.specific')}</p>
-      </div>
-      <div className='flex items-center gap-x-1'>
-        {!hideTip && <>
-          <WebAppSSONotEnabledTip />
-          <Divider className='h-[14px] ml-2 mr-0' type="vertical" />
-        </>}
-        <AddMemberOrGroupDialog />
-      </div>
-    </div>
-    <div className='px-1 pb-1'>
-      <div className='bg-background-section rounded-lg p-2 flex flex-col gap-y-2 max-h-[400px] overflow-y-auto'>
-        {isPending ? <Loading /> : <RenderGroupsAndMembers />}
-      </div>
-    </div>
-  </div >
-}
-
-function RenderGroupsAndMembers() {
-  const { t } = useTranslation()
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  if (specificGroups.length <= 0 && specificMembers.length <= 0)
-    return <div className='px-2 pt-5 pb-1.5'><p className='system-xs-regular text-text-tertiary text-center'>{t('app.accessControlDialog.noGroupsOrMembers')}</p></div>
-  return <>
-    <p className='system-2xs-medium-uppercase text-text-tertiary sticky top-0'>{t('app.accessControlDialog.groups', { count: specificGroups.length ?? 0 })}</p>
-    <div className='flex flex-row flex-wrap gap-1'>
-      {specificGroups.map((group, index) => <GroupItem key={index} group={group} />)}
-    </div>
-    <p className='system-2xs-medium-uppercase text-text-tertiary sticky top-0'>{t('app.accessControlDialog.members', { count: specificMembers.length ?? 0 })}</p>
-    <div className='flex flex-row flex-wrap gap-1'>
-      {specificMembers.map((member, index) => <MemberItem key={index} member={member} />)}
-    </div>
-  </>
-}
-
-type GroupItemProps = {
-  group: AccessControlGroup
-}
-function GroupItem({ group }: GroupItemProps) {
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
-  const handleRemoveGroup = useCallback(() => {
-    setSpecificGroups(specificGroups.filter(g => g.id !== group.id))
-  }, [group, setSpecificGroups, specificGroups])
-  return <BaseItem icon={<RiOrganizationChart className='w-[14px] h-[14px] text-components-avatar-shape-fill-stop-0' />}
-    onRemove={handleRemoveGroup}>
-    <p className='system-xs-regular text-text-primary'>{group.name}</p>
-    <p className='system-xs-regular text-text-tertiary'>{group.groupSize}</p>
-  </BaseItem>
-}
-
-type MemberItemProps = {
-  member: AccessControlAccount
-}
-function MemberItem({ member }: MemberItemProps) {
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
-  const handleRemoveMember = useCallback(() => {
-    setSpecificMembers(specificMembers.filter(m => m.id !== member.id))
-  }, [member, setSpecificMembers, specificMembers])
-  return <BaseItem icon={<Avatar className='w-[14px] h-[14px]' textClassName='text-[12px]' avatar={null} name={member.name} />}
-    onRemove={handleRemoveMember}>
-    <p className='system-xs-regular text-text-primary'>{member.name}</p>
-  </BaseItem>
-}
-
-type BaseItemProps = {
-  icon: React.ReactNode
-  children: React.ReactNode
-  onRemove?: () => void
-}
-function BaseItem({ icon, onRemove, children }: BaseItemProps) {
-  return <div className='rounded-full border-[0.5px] bg-components-badge-white-to-dark shadow-xs p-1 pr-1.5 group flex items-center flex-row gap-x-1'>
-    <div className='w-5 h-5 rounded-full bg-components-icon-bg-blue-solid overflow-hidden'>
-      <div className='w-full h-full flex items-center justify-center bg-access-app-icon-mask-bg'>
-        {icon}
-      </div>
-    </div>
-    {children}
-    <div className='flex items-center justify-center w-4 h-4 cursor-pointer' onClick={onRemove}>
-      <RiCloseCircleFill className='w-[14px] h-[14px] text-text-quaternary' />
-    </div>
-  </div>
-}
-
-export function WebAppSSONotEnabledTip() {
-  const { t } = useTranslation()
-  return <Tooltip asChild={false} popupContent={t('app.accessControlDialog.webAppSSONotEnabledTip')}>
-    <RiAlertFill className='w-4 h-4 text-text-warning-secondary shrink-0' />
-  </Tooltip>
-}

web/app/components/app/app-publisher/index.tsx

@@ -1,18 +1,13 @@
 import {
   memo,
   useCallback,
-  useEffect,
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import dayjs from 'dayjs'
-import { RiArrowDownSLine, RiArrowRightSLine, RiLockLine, RiPlanetLine } from '@remixicon/react'
+import { RiArrowDownSLine, RiPlanetLine } from '@remixicon/react'
 import Toast from '../../base/toast'
 import type { ModelAndParameter } from '../configuration/debug/types'
-import Divider from '../../base/divider'
-import AccessControl from '../app-access-control'
-import Loading from '../../base/loading'
-import Tooltip from '../../base/tooltip'
 import SuggestedAction from './suggested-action'
 import PublishWithMultipleModel from './publish-with-multiple-model'
 import Button from '@/app/components/base/button'
@@ -32,9 +27,6 @@ import { FileText } from '@/app/components/base/icons/src/vender/line/files'
 import WorkflowToolConfigureButton from '@/app/components/tools/workflow-tool/configure-button'
 import type { InputVar } from '@/app/components/workflow/types'
 import { appDefaultIconBackground } from '@/config'
-import { useAppWhiteListSubjects, useGetUserCanAccessApp } from '@/service/access-control'
-import { AccessMode } from '@/models/access-control'
-import { fetchAppDetail } from '@/service/apps'
 
 export type AppPublisherProps = {
   disabled?: boolean
@@ -73,31 +65,10 @@ const AppPublisher = ({
   const [published, setPublished] = useState(false)
   const [open, setOpen] = useState(false)
   const appDetail = useAppStore(state => state.appDetail)
-  const setAppDetail = useAppStore(s => s.setAppDetail)
   const { app_base_url: appBaseURL = '', access_token: accessToken = '' } = appDetail?.site ?? {}
   const appMode = (appDetail?.mode !== 'completion' && appDetail?.mode !== 'workflow') ? 'chat' : appDetail.mode
   const appURL = `${appBaseURL}/${appMode}/${accessToken}`
-  const { data: useCanAccessApp, isLoading: isGettingUserCanAccessApp, refetch } = useGetUserCanAccessApp({ appId: appDetail?.id, enabled: false })
-  const { data: appAccessSubjects, isLoading: isGettingAppWhiteListSubjects } = useAppWhiteListSubjects(appDetail?.id, open && appDetail?.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS)
 
-  useEffect(() => {
-    if (open && appDetail)
-      refetch()
-  }, [open, appDetail, refetch])
-
-  const [showAppAccessControl, setShowAppAccessControl] = useState(false)
-  const [isAppAccessSet, setIsAppAccessSet] = useState(true)
-  useEffect(() => {
-    if (appDetail && appAccessSubjects) {
-      if (appDetail.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS && appAccessSubjects.groups?.length === 0 && appAccessSubjects.members?.length === 0)
-        setIsAppAccessSet(false)
-      else
-        setIsAppAccessSet(true)
-    }
-    else {
-      setIsAppAccessSet(true)
-    }
-  }, [appAccessSubjects, appDetail])
   const language = useGetLanguage()
   const formatTimeFromNow = useCallback((time: number) => {
     return dayjs(time).locale(language === 'zh_Hans' ? 'zh-cn' : language.replace('_', '-')).fromNow()
@@ -149,13 +120,6 @@ const AppPublisher = ({
     }
   }, [appDetail?.id])
 
-  const handleAccessControlUpdate = useCallback(() => {
-    fetchAppDetail({ url: '/apps', id: appDetail!.id }).then((res) => {
-      setAppDetail(res)
-      setShowAppAccessControl(false)
-    })
-  }, [appDetail, setAppDetail])
-
   const [embeddingModalOpen, setEmbeddingModalOpen] = useState(false)
 
   return (
@@ -232,95 +196,58 @@ const AppPublisher = ({
               )
             }
           </div>
-          {(isGettingUserCanAccessApp || isGettingAppWhiteListSubjects)
-            ? <div className='py-2'><Loading /></div>
-            : <>
-              <Divider className='my-0' />
-              <div className='p-4 pt-3'>
-                <div className='flex items-center h-6'>
-                  <p className='system-xs-medium text-text-tertiary'>{t('app.publishApp.title')}</p>
-                </div>
-                <div className='h-8 flex items-center pl-2.5 pr-2  py-1 gap-x-0.5 rounded-lg bg-components-input-bg-normal hover:bg-primary-50 hover:text-text-accent cursor-pointer'
+          <div className='p-4 pt-3 border-t-[0.5px] border-t-black/5'>
+            <SuggestedAction disabled={!publishedAt} link={appURL} icon={<PlayCircle />}>{t('workflow.common.runApp')}</SuggestedAction>
+            {appDetail?.mode === 'workflow'
+              ? (
+                <SuggestedAction
+                  disabled={!publishedAt}
+                  link={`${appURL}${appURL.includes('?') ? '&' : '?'}mode=batch`}
+                  icon={<LeftIndent02 className='w-4 h-4' />}
+                >
+                  {t('workflow.common.batchRunApp')}
+                </SuggestedAction>
+              )
+              : (
+                <SuggestedAction
                   onClick={() => {
-                    setShowAppAccessControl(true)
-                  }}>
-                  <div className='grow flex items-center gap-x-1.5 pr-1'>
-                    <RiLockLine className='w-4 h-4 text-text-secondary shrink-0' />
-                    {appDetail?.access_mode === AccessMode.ORGANIZATION && <p className='system-sm-medium text-text-secondary'>{t('app.accessControlDialog.accessItems.organization')}</p>}
-                    {appDetail?.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS && <p className='system-sm-medium text-text-secondary'>{t('app.accessControlDialog.accessItems.specific')}</p>}
-                    {appDetail?.access_mode === AccessMode.PUBLIC && <p className='system-sm-medium text-text-secondary'>{t('app.accessControlDialog.accessItems.anyone')}</p>}
-                  </div>
-                  {!isAppAccessSet && <p className='shrink-0 system-xs-regular text-text-tertiary'>{t('app.publishApp.notSet')}</p>}
-                  <div className='shrink-0 w-4 h-4 flex items-center justify-center'>
-                    <RiArrowRightSLine className='w-4 h-4 text-text-quaternary' />
-                  </div>
-                </div>
-                {!isAppAccessSet && <p className='system-xs-regular text-text-warning mt-1'>{t('app.publishApp.notSetDesc')}</p>}
-              </div>
-              <div className='p-4 pt-3 border-t-[0.5px] border-t-black/5 flex flex-col gap-y-1'>
-                <Tooltip triggerClassName='flex' disabled={useCanAccessApp?.result} popupContent={t('app.noAccessPermission')} asChild={false}>
-                  <SuggestedAction disabled={!publishedAt || !useCanAccessApp?.result} link={appURL} icon={<PlayCircle />}>{t('workflow.common.runApp')}</SuggestedAction>
-                </Tooltip>
-                {appDetail?.mode === 'workflow'
-                  ? (<Tooltip triggerClassName='flex' disabled={useCanAccessApp?.result} popupContent={t('app.noAccessPermission')} asChild={false}>
-                    <SuggestedAction
-                      disabled={!publishedAt || !useCanAccessApp?.result}
-                      link={`${appURL}${appURL.includes('?') ? '&' : '?'}mode=batch`}
-                      icon={<LeftIndent02 className='w-4 h-4' />}
-                    >
-                      {t('workflow.common.batchRunApp')}
-                    </SuggestedAction>
-                  </Tooltip>
-                  )
-                  : (<div className='flex'>
-                    <SuggestedAction
-                      onClick={() => {
-                        setEmbeddingModalOpen(true)
-                        handleTrigger()
-                      }}
-                      disabled={!publishedAt}
-                      icon={<CodeBrowser className='w-4 h-4' />}
-                    >
-                      {t('workflow.common.embedIntoSite')}
-                    </SuggestedAction>
-                  </div>
-                  )}
-                <Tooltip triggerClassName='flex' disabled={useCanAccessApp?.result} popupContent={t('app.noAccessPermission')} asChild={false}>
-                  <SuggestedAction
-                    onClick={() => {
-                      handleOpenInExplore()
-                    }}
-                    disabled={!publishedAt || !useCanAccessApp?.result}
-                    icon={<RiPlanetLine className='w-4 h-4' />}
-                  >
-                    {t('workflow.common.openInExplore')}
-                  </SuggestedAction>
-                </Tooltip>
-                <div className='flex' >
-                  <SuggestedAction disabled={!publishedAt} link='./develop' icon={<FileText className='w-4 h-4' />}>{t('workflow.common.accessAPIReference')}</SuggestedAction>
-                </div>
-
-                {appDetail?.mode === 'workflow' && (
-                  <div className='flex' >
-                    <WorkflowToolConfigureButton
-                      disabled={!publishedAt}
-                      published={!!toolPublished}
-                      detailNeedUpdate={!!toolPublished && published}
-                      workflowAppId={appDetail?.id}
-                      icon={{
-                        content: (appDetail.icon_type === 'image' ? '🤖' : appDetail?.icon) || '🤖',
-                        background: (appDetail.icon_type === 'image' ? appDefaultIconBackground : appDetail?.icon_background) || appDefaultIconBackground,
-                      }}
-                      name={appDetail?.name}
-                      description={appDetail?.description}
-                      inputs={inputs}
-                      handlePublish={handlePublish}
-                      onRefreshData={onRefreshData}
-                    />
-                  </div>
-                )}
-              </div>
-            </>}
+                    setEmbeddingModalOpen(true)
+                    handleTrigger()
+                  }}
+                  disabled={!publishedAt}
+                  icon={<CodeBrowser className='w-4 h-4' />}
+                >
+                  {t('workflow.common.embedIntoSite')}
+                </SuggestedAction>
+              )}
+            <SuggestedAction
+              onClick={() => {
+                handleOpenInExplore()
+              }}
+              disabled={!publishedAt}
+              icon={<RiPlanetLine className='w-4 h-4' />}
+            >
+              {t('workflow.common.openInExplore')}
+            </SuggestedAction>
+            <SuggestedAction disabled={!publishedAt} link='./develop' icon={<FileText className='w-4 h-4' />}>{t('workflow.common.accessAPIReference')}</SuggestedAction>
+            {appDetail?.mode === 'workflow' && (
+              <WorkflowToolConfigureButton
+                disabled={!publishedAt}
+                published={!!toolPublished}
+                detailNeedUpdate={!!toolPublished && published}
+                workflowAppId={appDetail?.id}
+                icon={{
+                  content: (appDetail.icon_type === 'image' ? '🤖' : appDetail?.icon) || '🤖',
+                  background: (appDetail.icon_type === 'image' ? appDefaultIconBackground : appDetail?.icon_background) || appDefaultIconBackground,
+                }}
+                name={appDetail?.name}
+                description={appDetail?.description}
+                inputs={inputs}
+                handlePublish={handlePublish}
+                onRefreshData={onRefreshData}
+              />
+            )}
+          </div>
         </div>
       </PortalToFollowElemContent>
       <EmbeddedModal
@@ -330,7 +257,6 @@ const AppPublisher = ({
         appBaseUrl={appBaseURL}
         accessToken={accessToken}
       />
-      {showAppAccessControl && <AccessControl app={appDetail!} onConfirm={handleAccessControlUpdate} onClose={() => { setShowAppAccessControl(false) }} />}
     </PortalToFollowElem >
   )
 }

web/app/components/app/app-publisher/suggested-action.tsx

@@ -8,30 +8,22 @@ export type SuggestedActionProps = PropsWithChildren<HTMLProps<HTMLAnchorElement
   disabled?: boolean
 }>
 
-const SuggestedAction = ({ icon, link, disabled, children, className, onClick, ...props }: SuggestedActionProps) => {
-  const handleClick = (e: React.MouseEvent<HTMLAnchorElement>) => {
-    if (disabled)
-      return
-    onClick?.(e)
-  }
-  return (
-    <a
-      href={disabled ? undefined : link}
-      target='_blank'
-      rel='noreferrer'
-      className={classNames(
-        'flex-1 flex justify-start items-center text-text-secondary gap-2 h-[34px] px-2.5 bg-gray-100 rounded-lg transition-colors [&:not(:first-child)]:mt-1',
-        disabled ? 'shadow-xs opacity-30 cursor-not-allowed' : 'hover:bg-primary-50 hover:text-primary-600 cursor-pointer',
-        className,
-      )}
-      onClick={handleClick}
-      {...props}
-    >
-      <div className='relative w-4 h-4'>{icon}</div>
-      <div className='grow shrink basis-0 text-[13px] font-medium leading-[18px]'>{children}</div>
-      <ArrowUpRight />
-    </a>
-  )
-}
+const SuggestedAction = ({ icon, link, disabled, children, className, ...props }: SuggestedActionProps) => (
+  <a
+    href={disabled ? undefined : link}
+    target='_blank'
+    rel='noreferrer'
+    className={classNames(
+      'flex justify-start items-center gap-2 h-[34px] px-2.5 bg-gray-100 rounded-lg transition-colors [&:not(:first-child)]:mt-1',
+      disabled ? 'shadow-xs opacity-30 cursor-not-allowed' : 'hover:bg-primary-50 hover:text-primary-600 cursor-pointer',
+      className,
+    )}
+    {...props}
+  >
+    <div className='relative w-4 h-4'>{icon}</div>
+    <div className='grow shrink basis-0 text-[13px] font-medium leading-[18px]'>{children}</div>
+    <ArrowUpRight />
+  </a>
+)
 
 export default SuggestedAction

web/app/components/app/create-app-dialog/app-list/index.tsx

@@ -186,17 +186,15 @@ const Apps = ({
         <div className='w-[180px] h-8'></div>
       </div>
       <div className='relative flex flex-1 overflow-y-auto'>
-        {!searchKeywords && <div className='h-full w-[200px] p-4'>
-          <Sidebar current={currCategory as AppCategories} categories={categories} onClick={(category) => { setCurrCategory(category) }} onCreateFromBlank={onCreateFromBlank} />
+        {!searchKeywords && <div className='w-[200px] h-full p-4'>
+          <Sidebar current={currCategory as AppCategories} onClick={(category) => { setCurrCategory(category) }} onCreateFromBlank={onCreateFromBlank} />
         </div>}
         <div className='flex-1 h-full overflow-auto shrink-0 grow p-6 pt-2 border-l border-divider-burn'>
           {searchFilteredList && searchFilteredList.length > 0 && <>
             <div className='pt-4 pb-1'>
               {searchKeywords
                 ? <p className='title-md-semi-bold text-text-tertiary'>{searchFilteredList.length > 1 ? t('app.newApp.foundResults', { count: searchFilteredList.length }) : t('app.newApp.foundResult', { count: searchFilteredList.length })}</p>
-                : <div className='flex h-[22px] items-center'>
-                  <AppCategoryLabel category={currCategory as AppCategories} className='title-md-semi-bold text-text-primary' />
-                </div>}
+                : <AppCategoryLabel category={currCategory as AppCategories} className='title-md-semi-bold text-text-primary' />}
             </div>
             <div
               className={cn(

web/app/components/app/create-app-dialog/app-list/sidebar.tsx

@@ -1,29 +1,39 @@
 'use client'
-import { RiStickyNoteAddLine, RiThumbUpLine } from '@remixicon/react'
+import { RiAppsFill, RiChatSmileAiFill, RiExchange2Fill, RiPassPendingFill, RiQuillPenAiFill, RiSpeakAiFill, RiStickyNoteAddLine, RiTerminalBoxFill, RiThumbUpFill } from '@remixicon/react'
 import { useTranslation } from 'react-i18next'
 import classNames from '@/utils/classnames'
 import Divider from '@/app/components/base/divider'
 
 export enum AppCategories {
   RECOMMENDED = 'Recommended',
+  ASSISTANT = 'Assistant',
+  AGENT = 'Agent',
+  HR = 'HR',
+  PROGRAMMING = 'Programming',
+  WORKFLOW = 'Workflow',
+  WRITING = 'Writing',
 }
 
 type SidebarProps = {
-  current: AppCategories | string
-  categories: string[]
-  onClick?: (category: AppCategories | string) => void
+  current: AppCategories
+  onClick?: (category: AppCategories) => void
   onCreateFromBlank?: () => void
 }
 
-export default function Sidebar({ current, categories, onClick, onCreateFromBlank }: SidebarProps) {
+export default function Sidebar({ current, onClick, onCreateFromBlank }: SidebarProps) {
   const { t } = useTranslation()
-  return <div className="flex h-full w-full flex-col">
-    <ul className='pt-0.5'>
+  return <div className="w-full h-full flex flex-col">
+    <ul>
       <CategoryItem category={AppCategories.RECOMMENDED} active={current === AppCategories.RECOMMENDED} onClick={onClick} />
     </ul>
-    <div className='system-xs-medium-uppercase mb-0.5 mt-3 px-3 pb-1 pt-2 text-text-tertiary'>{t('app.newAppFromTemplate.byCategories')}</div>
-    <ul className='flex grow flex-col gap-0.5'>
-      {categories.map(category => (<CategoryItem key={category} category={category} active={current === category} onClick={onClick} />))}
+    <div className='px-3 pt-2 pb-1 system-xs-medium-uppercase text-text-tertiary'>{t('app.newAppFromTemplate.byCategories')}</div>
+    <ul className='flex-grow flex flex-col gap-0.5'>
+      <CategoryItem category={AppCategories.ASSISTANT} active={current === AppCategories.ASSISTANT} onClick={onClick} />
+      <CategoryItem category={AppCategories.AGENT} active={current === AppCategories.AGENT} onClick={onClick} />
+      <CategoryItem category={AppCategories.HR} active={current === AppCategories.HR} onClick={onClick} />
+      <CategoryItem category={AppCategories.PROGRAMMING} active={current === AppCategories.PROGRAMMING} onClick={onClick} />
+      <CategoryItem category={AppCategories.WORKFLOW} active={current === AppCategories.WORKFLOW} onClick={onClick} />
+      <CategoryItem category={AppCategories.WRITING} active={current === AppCategories.WRITING} onClick={onClick} />
     </ul>
     <Divider bgStyle='gradient' />
     <div className='px-3 py-1 flex items-center gap-1 text-text-tertiary cursor-pointer' onClick={onCreateFromBlank}>
@@ -35,26 +45,47 @@ export default function Sidebar({ current, categories, onClick, onCreateFromBlan
 
 type CategoryItemProps = {
   active: boolean
-  category: AppCategories | string
-  onClick?: (category: AppCategories | string) => void
+  category: AppCategories
+  onClick?: (category: AppCategories) => void
 }
 function CategoryItem({ category, active, onClick }: CategoryItemProps) {
   return <li
-    className={classNames('p-1 pl-3 h-8 rounded-lg flex items-center gap-2 group cursor-pointer hover:bg-state-base-hover [&.active]:bg-state-base-active', active && 'active')}
+    className={classNames('p-1 pl-3 rounded-lg flex items-center gap-2 group cursor-pointer hover:bg-state-base-hover [&.active]:bg-state-base-active', active && 'active')}
     onClick={() => { onClick?.(category) }}>
-    {category === AppCategories.RECOMMENDED && <div className='inline-flex h-5 w-5 items-center justify-center rounded-md'>
-      <RiThumbUpLine className='h-4 w-4 text-components-menu-item-text group-[.active]:text-components-menu-item-text-active' />
-    </div>}
+    <div className='w-5 h-5 inline-flex items-center justify-center rounded-md border border-divider-regular bg-components-icon-bg-midnight-solid group-[.active]:bg-components-icon-bg-blue-solid'>
+      <AppCategoryIcon category={category} />
+    </div>
     <AppCategoryLabel category={category}
       className={classNames('system-sm-medium text-components-menu-item-text group-[.active]:text-components-menu-item-text-active group-hover:text-components-menu-item-text-hover', active && 'system-sm-semibold')} />
   </li >
 }
 
 type AppCategoryLabelProps = {
-  category: AppCategories | string
+  category: AppCategories
   className?: string
 }
 export function AppCategoryLabel({ category, className }: AppCategoryLabelProps) {
   const { t } = useTranslation()
-  return <span className={className}>{category === AppCategories.RECOMMENDED ? t('app.newAppFromTemplate.sidebar.Recommended') : category}</span>
+  return <span className={className}>{t(`app.newAppFromTemplate.sidebar.${category}`)}</span>
+}
+
+type AppCategoryIconProps = {
+  category: AppCategories
+}
+function AppCategoryIcon({ category }: AppCategoryIconProps) {
+  if (category === AppCategories.AGENT)
+    return <RiSpeakAiFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.ASSISTANT)
+    return <RiChatSmileAiFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.HR)
+    return <RiPassPendingFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.PROGRAMMING)
+    return <RiTerminalBoxFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.RECOMMENDED)
+    return <RiThumbUpFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.WRITING)
+    return <RiQuillPenAiFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  if (category === AppCategories.WORKFLOW)
+    return <RiExchange2Fill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
+  return <RiAppsFill className='w-3.5 h-3.5 text-components-avatar-shape-fill-stop-100' />
 }

web/app/components/app/create-from-dsl-modal/dsl-confirm-modal.tsx

@@ -1,46 +0,0 @@
-import { useTranslation } from 'react-i18next'
-import Modal from '@/app/components/base/modal'
-import Button from '@/app/components/base/button'
-
-type DSLConfirmModalProps = {
-  versions?: {
-    importedVersion: string
-    systemVersion: string
-  }
-  onCancel: () => void
-  onConfirm: () => void
-  confirmDisabled?: boolean
-}
-const DSLConfirmModal = ({
-  versions = { importedVersion: '', systemVersion: '' },
-  onCancel,
-  onConfirm,
-  confirmDisabled = false,
-}: DSLConfirmModalProps) => {
-  const { t } = useTranslation()
-
-  return (
-    <Modal
-      isShow
-      onClose={() => onCancel()}
-      className='w-[480px]'
-    >
-      <div className='flex flex-col items-start gap-2 self-stretch pb-4'>
-        <div className='title-2xl-semi-bold text-text-primary'>{t('app.newApp.appCreateDSLErrorTitle')}</div>
-        <div className='system-md-regular flex grow flex-col text-text-secondary'>
-          <div>{t('app.newApp.appCreateDSLErrorPart1')}</div>
-          <div>{t('app.newApp.appCreateDSLErrorPart2')}</div>
-          <br />
-          <div>{t('app.newApp.appCreateDSLErrorPart3')}<span className='system-md-medium'>{versions.importedVersion}</span></div>
-          <div>{t('app.newApp.appCreateDSLErrorPart4')}<span className='system-md-medium'>{versions.systemVersion}</span></div>
-        </div>
-      </div>
-      <div className='flex items-start justify-end gap-2 self-stretch pt-6'>
-        <Button variant='secondary' onClick={() => onCancel()}>{t('app.newApp.Cancel')}</Button>
-        <Button variant='primary' destructive onClick={onConfirm} disabled={confirmDisabled}>{t('app.newApp.Confirm')}</Button>
-      </div>
-    </Modal>
-  )
-}
-
-export default DSLConfirmModal

web/app/components/app/overview/embedded/index.tsx

@@ -24,7 +24,7 @@ const OPTION_MAP = {
   iframe: {
     getContent: (url: string, token: string) =>
       `<iframe
- src="${url}/chat/${token}"
+ src="${url}/chatbot/${token}"
  style="width: 100%; height: 100%; min-height: 700px"
  frameborder="0"
  allow="microphone">
@@ -35,12 +35,12 @@ const OPTION_MAP = {
       `<script>
  window.difyChatbotConfig = {
   token: '${token}'${isTestEnv
-        ? `,
+  ? `,
   isDev: true`
-        : ''}${IS_CE_EDITION
-          ? `,
+  : ''}${IS_CE_EDITION
+  ? `,
   baseUrl: '${url}'`
-          : ''}
+  : ''}
  }
 </script>
 <script

web/app/components/app/overview/settings/index.tsx

@@ -21,12 +21,14 @@ import type { AppIconType, AppSSO, Language } from '@/types/app'
 import { useToastContext } from '@/app/components/base/toast'
 import { LanguagesSupported, languages } from '@/i18n/language'
 import Tooltip from '@/app/components/base/tooltip'
+import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useModalContext } from '@/context/modal-context'
 import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
 import AppIconPicker from '@/app/components/base/app-icon-picker'
 import I18n from '@/context/i18n'
 import cn from '@/utils/classnames'
+import { useGlobalPublicStore } from '@/context/global-public-context'
 
 export type ISettingsModalProps = {
   isChat: boolean
@@ -64,6 +66,8 @@ const SettingsModal: FC<ISettingsModalProps> = ({
   onClose,
   onSave,
 }) => {
+  const { systemFeatures } = useGlobalPublicStore()
+  const { isCurrentWorkspaceEditor } = useAppContext()
   const { notify } = useToastContext()
   const [isShowMore, setIsShowMore] = useState(false)
   const {
@@ -135,7 +139,7 @@ const SettingsModal: FC<ISettingsModalProps> = ({
     setAppIcon(icon_type === 'image'
       ? { type: 'image', url: icon_url!, fileId: icon }
       : { type: 'emoji', icon, background: icon_background! })
-  }, [appInfo, chat_color_theme, chat_color_theme_inverted, copyright, custom_disclaimer, default_language, description, icon, icon_background, icon_type, icon_url, privacy_policy, show_workflow_steps, title, use_icon_as_answer_icon])
+  }, [appInfo])
 
   const onHide = () => {
     onClose()
@@ -321,6 +325,28 @@ const SettingsModal: FC<ISettingsModalProps> = ({
             </div>
             <p className='pb-0.5 text-text-tertiary body-xs-regular'>{t(`${prefixSettings}.workflow.showDesc`)}</p>
           </div>
+          {/* SSO */}
+          {systemFeatures.enable_web_sso_switch_component && (
+            <>
+              <Divider className="h-px my-0" />
+              <div className='w-full'>
+                <p className='mb-1 system-xs-medium-uppercase text-text-tertiary'>{t(`${prefixSettings}.sso.label`)}</p>
+                <div className='flex justify-between items-center'>
+                  <div className={cn('py-1 text-text-secondary system-sm-semibold')}>{t(`${prefixSettings}.sso.title`)}</div>
+                  <Tooltip
+                    disabled={systemFeatures.sso_enforced_for_web}
+                    popupContent={
+                      <div className='w-[180px]'>{t(`${prefixSettings}.sso.tooltip`)}</div>
+                    }
+                    asChild={false}
+                  >
+                    <Switch disabled={!systemFeatures.sso_enforced_for_web || !isCurrentWorkspaceEditor} defaultValue={systemFeatures.sso_enforced_for_web && inputInfo.enable_sso} onChange={v => setInputInfo({ ...inputInfo, enable_sso: v })}></Switch>
+                  </Tooltip>
+                </div>
+                <p className='pb-0.5 body-xs-regular text-text-tertiary'>{t(`${prefixSettings}.sso.description`)}</p>
+              </div>
+            </>
+          )}
           {/* more settings switch */}
           <Divider className="h-px my-0" />
           {!isShowMore && (

web/app/components/base/app-unavailable.tsx

@@ -4,7 +4,7 @@ import React from 'react'
 import { useTranslation } from 'react-i18next'
 
 type IAppUnavailableProps = {
-  code?: number | string
+  code?: number
   isUnknownReason?: boolean
   unknownReason?: string
 }
@@ -17,7 +17,7 @@ const AppUnavailable: FC<IAppUnavailableProps> = ({
   const { t } = useTranslation()
 
   return (
-    <div className='flex items-center justify-center w-full h-full'>
+    <div className='flex items-center justify-center w-screen h-screen'>
       <h1 className='mr-5 h-[50px] leading-[50px] pr-5 text-[24px] font-medium'
         style={{
           borderRight: '1px solid rgba(0,0,0,.3)',

web/app/components/base/chat/chat-with-history/context.tsx

@@ -15,15 +15,12 @@ import type {
   AppMeta,
   ConversationItem,
 } from '@/models/share'
-import { AccessMode } from '@/models/access-control'
 
 export type ChatWithHistoryContextValue = {
   appInfoError?: any
   appInfoLoading?: boolean
   appMeta?: AppMeta
   appData?: AppData
-  accessMode?: AccessMode
-  userCanAccess?: boolean
   appParams?: ChatConfig
   appChatListDataLoading?: boolean
   currentConversationId: string
@@ -55,8 +52,6 @@ export type ChatWithHistoryContextValue = {
 }
 
 export const ChatWithHistoryContext = createContext<ChatWithHistoryContextValue>({
-  accessMode: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-  userCanAccess: false,
   currentConversationId: '',
   appPrevChatTree: [],
   pinnedConversationList: [],
@@ -64,21 +59,21 @@ export const ChatWithHistoryContext = createContext<ChatWithHistoryContextValue>
   showConfigPanelBeforeChat: false,
   newConversationInputs: {},
   newConversationInputsRef: { current: {} },
-  handleNewConversationInputsChange: () => { },
+  handleNewConversationInputsChange: () => {},
   inputsForms: [],
-  handleNewConversation: () => { },
-  handleStartChat: () => { },
-  handleChangeConversation: () => { },
-  handlePinConversation: () => { },
-  handleUnpinConversation: () => { },
-  handleDeleteConversation: () => { },
+  handleNewConversation: () => {},
+  handleStartChat: () => {},
+  handleChangeConversation: () => {},
+  handlePinConversation: () => {},
+  handleUnpinConversation: () => {},
+  handleDeleteConversation: () => {},
   conversationRenaming: false,
-  handleRenameConversation: () => { },
-  handleNewConversationCompleted: () => { },
+  handleRenameConversation: () => {},
+  handleNewConversationCompleted: () => {},
   chatShouldReloadKey: '',
   isMobile: false,
   isInstalledApp: false,
-  handleFeedback: () => { },
-  currentChatInstanceRef: { current: { handleStop: () => { } } },
+  handleFeedback: () => {},
+  currentChatInstanceRef: { current: { handleStop: () => {} } },
 })
 export const useChatWithHistoryContext = () => useContext(ChatWithHistoryContext)

web/app/components/base/chat/chat-with-history/hooks.tsx

@@ -42,7 +42,6 @@ import { changeLanguage } from '@/i18n/i18next-config'
 import { useAppFavicon } from '@/hooks/use-app-favicon'
 import { InputVarType } from '@/app/components/workflow/types'
 import { TransferMethod } from '@/types/app'
-import { useGetAppAccessMode, useGetUserCanAccessApp } from '@/service/access-control'
 
 function getFormattedChatList(messages: any[]) {
   const newChatList: ChatItem[] = []
@@ -73,8 +72,6 @@ function getFormattedChatList(messages: any[]) {
 export const useChatWithHistory = (installedAppInfo?: InstalledApp) => {
   const isInstalledApp = useMemo(() => !!installedAppInfo, [installedAppInfo])
   const { data: appInfo, isLoading: appInfoLoading, error: appInfoError } = useSWR(installedAppInfo ? null : 'appInfo', fetchAppInfo)
-  const { isPending: isGettingAccessMode, data: appAccessMode } = useGetAppAccessMode({ appId: installedAppInfo?.app.id || appInfo?.app_id, isInstalledApp })
-  const { isPending: isCheckingPermission, data: userCanAccessResult } = useGetUserCanAccessApp({ appId: installedAppInfo?.app.id || appInfo?.app_id, isInstalledApp })
 
   useAppFavicon({
     enable: !installedAppInfo,
@@ -421,9 +418,7 @@ export const useChatWithHistory = (installedAppInfo?: InstalledApp) => {
 
   return {
     appInfoError,
-    appInfoLoading: appInfoLoading || isGettingAccessMode || isCheckingPermission,
-    accessMode: appAccessMode?.accessMode,
-    userCanAccess: userCanAccessResult?.result,
+    appInfoLoading,
     isInstalledApp,
     appId,
     currentConversationId,

web/app/components/base/chat/chat-with-history/index.tsx

@@ -27,7 +27,6 @@ const ChatWithHistory: FC<ChatWithHistoryProps> = ({
   className,
 }) => {
   const {
-    userCanAccess,
     appInfoError,
     appData,
     appInfoLoading,
@@ -58,8 +57,6 @@ const ChatWithHistory: FC<ChatWithHistoryProps> = ({
       <Loading type='app' />
     )
   }
-  if (!userCanAccess)
-    return <AppUnavailable code={403} unknownReason='no permission.' />
 
   if (appInfoError) {
     return (
@@ -117,8 +114,6 @@ const ChatWithHistoryWrap: FC<ChatWithHistoryWrapProps> = ({
   const {
     appInfoError,
     appInfoLoading,
-    accessMode,
-    userCanAccess,
     appData,
     appParams,
     appMeta,
@@ -154,8 +149,6 @@ const ChatWithHistoryWrap: FC<ChatWithHistoryWrapProps> = ({
       appInfoError,
       appInfoLoading,
       appData,
-      accessMode,
-      userCanAccess,
       appParams,
       appMeta,
       appChatListDataLoading,

web/app/components/base/chat/chat-with-history/sidebar/index.tsx

@@ -11,14 +11,10 @@ import { Edit05 } from '@/app/components/base/icons/src/vender/line/general'
 import type { ConversationItem } from '@/models/share'
 import Confirm from '@/app/components/base/confirm'
 import RenameModal from '@/app/components/base/chat/chat-with-history/sidebar/rename-modal'
-import MenuDropdown from '@/app/components/share/text-generation/menu-dropdown'
-import { AccessMode } from '@/models/access-control'
 
 const Sidebar = () => {
   const { t } = useTranslation()
   const {
-    isInstalledApp,
-    accessMode,
     appData,
     pinnedConversationList,
     conversationList,
@@ -119,14 +115,11 @@ const Sidebar = () => {
           )
         }
       </div>
-      <div className='flex items-center justify-between px-4 pb-4 '>
-        <MenuDropdown hideLogout={isInstalledApp || accessMode === AccessMode.PUBLIC} placement='top-start' data={appData?.site} />
-        {appData?.site.copyright && (
-          <div className='text-xs text-gray-400 truncate'>
-            © {(new Date()).getFullYear()} {appData?.site.copyright}
-          </div>
-        )}
-      </div>
+      {appData?.site.copyright && (
+        <div className='px-4 pb-4 text-xs text-gray-400'>
+          © {(new Date()).getFullYear()} {appData?.site.copyright}
+        </div>
+      )}
       {!!showConfirm && (
         <Confirm
           title={t('share.chat.deleteConversation.title')}

web/app/components/base/chat/embedded-chatbot/context.tsx

@@ -14,11 +14,8 @@ import type {
   AppMeta,
   ConversationItem,
 } from '@/models/share'
-import { AccessMode } from '@/models/access-control'
 
 export type EmbeddedChatbotContextValue = {
-  accessMode?: AccessMode
-  userCanAccess?: boolean
   appInfoError?: any
   appInfoLoading?: boolean
   appMeta?: AppMeta
@@ -49,8 +46,6 @@ export type EmbeddedChatbotContextValue = {
 }
 
 export const EmbeddedChatbotContext = createContext<EmbeddedChatbotContextValue>({
-  userCanAccess: false,
-  accessMode: AccessMode.SPECIFIC_GROUPS_MEMBERS,
   currentConversationId: '',
   appPrevChatList: [],
   pinnedConversationList: [],
@@ -58,16 +53,16 @@ export const EmbeddedChatbotContext = createContext<EmbeddedChatbotContextValue>
   showConfigPanelBeforeChat: false,
   newConversationInputs: {},
   newConversationInputsRef: { current: {} },
-  handleNewConversationInputsChange: () => { },
+  handleNewConversationInputsChange: () => {},
   inputsForms: [],
-  handleNewConversation: () => { },
-  handleStartChat: () => { },
-  handleChangeConversation: () => { },
-  handleNewConversationCompleted: () => { },
+  handleNewConversation: () => {},
+  handleStartChat: () => {},
+  handleChangeConversation: () => {},
+  handleNewConversationCompleted: () => {},
   chatShouldReloadKey: '',
   isMobile: false,
   isInstalledApp: false,
-  handleFeedback: () => { },
-  currentChatInstanceRef: { current: { handleStop: () => { } } },
+  handleFeedback: () => {},
+  currentChatInstanceRef: { current: { handleStop: () => {} } },
 })
 export const useEmbeddedChatbotContext = () => useContext(EmbeddedChatbotContext)

web/app/components/base/chat/embedded-chatbot/hooks.tsx

@@ -35,7 +35,6 @@ import { changeLanguage } from '@/i18n/i18next-config'
 import { InputVarType } from '@/app/components/workflow/types'
 import { TransferMethod } from '@/types/app'
 import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
-import { useGetAppAccessMode, useGetUserCanAccessApp } from '@/service/access-control'
 
 function getFormattedChatList(messages: any[]) {
   const newChatList: ChatItem[] = []
@@ -66,8 +65,6 @@ function getFormattedChatList(messages: any[]) {
 export const useEmbeddedChatbot = () => {
   const isInstalledApp = false
   const { data: appInfo, isLoading: appInfoLoading, error: appInfoError } = useSWR('appInfo', fetchAppInfo)
-  const { isPending: isGettingAccessMode, data: appAccessMode } = useGetAppAccessMode({ appId: appInfo?.app_id, isInstalledApp })
-  const { isPending: isCheckingPermission, data: userCanAccessResult } = useGetUserCanAccessApp({ appId: appInfo?.app_id, isInstalledApp })
 
   const appData = useMemo(() => {
     return appInfo
@@ -322,9 +319,7 @@ export const useEmbeddedChatbot = () => {
 
   return {
     appInfoError,
-    appInfoLoading: appInfoLoading || isGettingAccessMode || isCheckingPermission,
-    accessMode: appAccessMode?.accessMode,
-    userCanAccess: userCanAccessResult?.result,
+    appInfoLoading,
     isInstalledApp,
     appId,
     currentConversationId,

web/app/components/base/chat/embedded-chatbot/index.tsx

@@ -26,7 +26,6 @@ import Tooltip from '@/app/components/base/tooltip'
 const Chatbot = () => {
   const { t } = useTranslation()
   const {
-    userCanAccess,
     isMobile,
     appInfoError,
     appInfoLoading,
@@ -60,9 +59,6 @@ const Chatbot = () => {
     )
   }
 
-  if (!userCanAccess)
-    return <AppUnavailable code={403} unknownReason='no permission.' />
-
   if (appInfoError) {
     return (
       <AppUnavailable />
@@ -95,7 +91,7 @@ const Chatbot = () => {
                     popupContent={t('share.chat.resetChat')}
                   >
                     <div className='p-1.5 bg-white border-[0.5px] border-gray-100 rounded-lg shadow-md cursor-pointer' onClick={handleNewConversation}>
-                      <RiLoopLeftLine className="h-4 w-4 text-gray-500" />
+                      <RiLoopLeftLine className="h-4 w-4 text-gray-500"/>
                     </div>
                   </Tooltip>
                 </div>
@@ -118,8 +114,6 @@ const EmbeddedChatbotWrapper = () => {
     appInfoError,
     appInfoLoading,
     appData,
-    accessMode,
-    userCanAccess,
     appParams,
     appMeta,
     appChatListDataLoading,
@@ -145,8 +139,6 @@ const EmbeddedChatbotWrapper = () => {
   } = useEmbeddedChatbot()
 
   return <EmbeddedChatbotContext.Provider value={{
-    userCanAccess,
-    accessMode,
     appInfoError,
     appInfoLoading,
     appData,

web/app/components/base/chat/utils.ts

@@ -1,8 +1,6 @@
 import { UUID_NIL } from './constants'
 import type { IChatItem } from './chat/type'
 import type { ChatItem, ChatItemInTree } from './types'
-import { addFileInfos, sortAgentSorts } from '../../tools/utils'
-import { getProcessedFilesFromResponse } from '../file-uploader/utils'
 
 async function decodeBase64AndDecompress(base64String: string) {
   const binaryString = atob(base64String)
@@ -21,60 +19,6 @@ function getProcessedInputsFromUrlParams(): Record<string, any> {
   return inputs
 }
 
-function appendQAToChatList(chatList: ChatItem[], item: any) {
-  // we append answer first and then question since will reverse the whole chatList later
-  const answerFiles = item.message_files?.filter((file: any) => file.belongs_to === 'assistant') || []
-  chatList.push({
-    id: item.id,
-    content: item.answer,
-    agent_thoughts: addFileInfos(item.agent_thoughts ? sortAgentSorts(item.agent_thoughts) : item.agent_thoughts, item.message_files),
-    feedback: item.feedback,
-    isAnswer: true,
-    citation: item.retriever_resources,
-    message_files: getProcessedFilesFromResponse(answerFiles.map((item: any) => ({ ...item, related_id: item.id }))),
-  })
-  const questionFiles = item.message_files?.filter((file: any) => file.belongs_to === 'user') || []
-  chatList.push({
-    id: `question-${item.id}`,
-    content: item.query,
-    isAnswer: false,
-    message_files: getProcessedFilesFromResponse(questionFiles.map((item: any) => ({ ...item, related_id: item.id }))),
-  })
-}
-
-/**
- * Computes the latest thread messages from all messages of the conversation.
- * Same logic as backend codebase `api/core/prompt/utils/extract_thread_messages.py`
- *
- * @param fetchedMessages - The history chat list data from the backend, sorted by created_at in descending order. This includes all flattened history messages of the conversation.
- * @returns An array of ChatItems representing the latest thread.
- */
-
-
-function getPrevChatList(fetchedMessages: any[]) {
-  const ret: ChatItem[] = []
-  let nextMessageId = null
-
-  for (const item of fetchedMessages) {
-    if (!item.parent_message_id) {
-      appendQAToChatList(ret, item)
-      break
-    }
-
-    if (!nextMessageId) {
-      appendQAToChatList(ret, item)
-      nextMessageId = item.parent_message_id
-    }
-    else {
-      if (item.id === nextMessageId || nextMessageId === UUID_NIL) {
-        appendQAToChatList(ret, item)
-        nextMessageId = item.parent_message_id
-      }
-    }
-  }
-  return ret.reverse()
-}
-
 function isValidGeneratedAnswer(item?: ChatItem | ChatItemInTree): boolean {
   return !!item && item.isAnswer && !item.id.startsWith('answer-placeholder-') && !item.isOpeningStatement
 }
@@ -220,7 +164,6 @@ function getThreadMessages(tree: ChatItemInTree[], targetMessageId?: string): Ch
 export {
   getProcessedInputsFromUrlParams,
   isValidGeneratedAnswer,
-  getPrevChatList,
   getLastAnswer,
   buildChatItemTree,
   getThreadMessages,

web/app/components/base/tooltip/index.tsx

@@ -90,7 +90,6 @@ const Tooltip: FC<TooltipProps> = ({
         }}
         onMouseLeave={() => triggerMethod === 'hover' && handleLeave(true)}
         asChild={asChild}
-        className={!asChild ? triggerClassName : ''}
       >
         {children || <div className={triggerClassName || 'p-[1px] w-3.5 h-3.5 shrink-0'}><RiQuestionLine className='text-text-quaternary hover:text-text-tertiary w-full h-full' /></div>}
       </PortalToFollowElemTrigger>

web/app/components/billing/type.ts

@@ -68,10 +68,6 @@ export type CurrentPlanInfoBackend = {
   model_load_balancing_enabled: boolean
   dataset_operator_enabled: boolean
   webapp_copyright_enabled: boolean
-  workspace_members: {
-    size: number
-    limit: number
-  }
 }
 
 export type SubscriptionItem = {

web/app/components/datasets/create/step-one/index.tsx

@@ -18,12 +18,12 @@ import { NotionPageSelector } from '@/app/components/base/notion-page-selector'
 import { useDatasetDetailContext } from '@/context/dataset-detail'
 import { useProviderContext } from '@/context/provider-context'
 import VectorSpaceFull from '@/app/components/billing/vector-space-full'
-import { Icon3Dots } from '@/app/components/base/icons/src/vender/line/others'
+import classNames from '@/utils/classnames'
 
 type IStepOneProps = {
   datasetId?: string
   dataSourceType?: DataSourceType
-  dataSourceTypeDisable: boolean
+  dataSourceTypeDisable: Boolean
   hasConnection: boolean
   onSetting: () => void
   files: FileItem[]
@@ -44,20 +44,14 @@ type IStepOneProps = {
 type NotionConnectorProps = {
   onSetting: () => void
 }
-export const NotionConnector = (props: NotionConnectorProps) => {
-  const { onSetting } = props
+export const NotionConnector = ({ onSetting }: NotionConnectorProps) => {
   const { t } = useTranslation()
 
   return (
-    <div className='flex w-[640px] flex-col items-start rounded-2xl bg-workflow-process-bg p-6'>
-      <span className={cn(s.notionIcon, 'mb-2 h-12 w-12 rounded-[10px] border-[0.5px] border-components-card-border p-3 shadow-lg shadow-shadow-shadow-5')} />
-      <div className='mb-1 flex flex-col gap-y-1 pb-3 pt-1'>
-        <span className='system-md-semibold text-text-secondary'>
-          {t('datasetCreation.stepOne.notionSyncTitle')}
-          <Icon3Dots className='relative -left-1.5 -top-2.5 inline h-4 w-4 text-text-secondary' />
-        </span>
-        <div className='system-sm-regular text-text-tertiary'>{t('datasetCreation.stepOne.notionSyncTip')}</div>
-      </div>
+    <div className={s.notionConnectionTip}>
+      <span className={s.notionIcon} />
+      <div className={s.title}>{t('datasetCreation.stepOne.notionSyncTitle')}</div>
+      <div className={s.tip}>{t('datasetCreation.stepOne.notionSyncTip')}</div>
       <Button className='h-8' variant='primary' onClick={onSetting}>{t('datasetCreation.stepOne.connect')}</Button>
     </div>
   )
@@ -126,195 +120,175 @@ const StepOne = ({
       return true
     if (files.some(file => !file.file.id))
       return true
-    return isShowVectorSpaceFull
+    if (isShowVectorSpaceFull)
+      return true
+    return false
   }, [files, isShowVectorSpaceFull])
 
   return (
-    <div className='h-full w-full overflow-x-auto'>
-      <div className='flex h-full w-full min-w-[1440px]'>
-        <div className='relative h-full w-1/2 overflow-y-auto'>
-          <div className='flex justify-end'>
-            <div className={cn(s.form)}>
-              {
-                shouldShowDataSourceTypeList && (
-                  <div className={cn(s.stepHeader, 'text-text-secondary system-md-semibold')}>
-                    {t('datasetCreation.steps.one')}
+    <div className='flex w-full h-full'>
+      <div className='w-1/2 h-full overflow-y-auto relative'>
+        <div className='flex justify-end'>
+          <div className={classNames(s.form)}>
+            {
+              shouldShowDataSourceTypeList && (
+                <div className={classNames(s.stepHeader, 'z-10 text-text-secondary bg-components-panel-bg-blur')}>{t('datasetCreation.steps.one')}</div>
+              )
+            }
+            {
+              shouldShowDataSourceTypeList && (
+                <div className='flex items-center mb-8 flex-wrap gap-4'>
+                  <div
+                    className={cn(
+                      s.dataSourceItem,
+                      dataSourceType === DataSourceType.FILE && s.active,
+                      dataSourceTypeDisable && dataSourceType !== DataSourceType.FILE && s.disabled,
+                    )}
+                    onClick={() => {
+                      if (dataSourceTypeDisable)
+                        return
+                      changeType(DataSourceType.FILE)
+                      hideFilePreview()
+                      hideNotionPagePreview()
+                    }}
+                  >
+                    <span className={cn(s.datasetIcon)} />
+                    {t('datasetCreation.stepOne.dataSourceType.file')}
                   </div>
-                )
-              }
-              {
-                shouldShowDataSourceTypeList && (
-                  <div className='mb-8 grid grid-cols-3 gap-4'>
-                    <div
-                      className={cn(
-                        s.dataSourceItem,
-                        'system-sm-medium',
-                        dataSourceType === DataSourceType.FILE && s.active,
-                        dataSourceTypeDisable && dataSourceType !== DataSourceType.FILE && s.disabled,
-                      )}
-                      onClick={() => {
-                        if (dataSourceTypeDisable)
-                          return
-                        changeType(DataSourceType.FILE)
-                        hideFilePreview()
-                        hideNotionPagePreview()
-                      }}
-                    >
-                      <span className={cn(s.datasetIcon)} />
-                      <span
-                        title={t('datasetCreation.stepOne.dataSourceType.file')!}
-                        className='truncate'
-                      >
-                        {t('datasetCreation.stepOne.dataSourceType.file')}
-                      </span>
-                    </div>
-                    <div
-                      className={cn(
-                        s.dataSourceItem,
-                        'system-sm-medium',
-                        dataSourceType === DataSourceType.NOTION && s.active,
-                        dataSourceTypeDisable && dataSourceType !== DataSourceType.NOTION && s.disabled,
-                      )}
-                      onClick={() => {
-                        if (dataSourceTypeDisable)
-                          return
-                        changeType(DataSourceType.NOTION)
-                        hideFilePreview()
-                        hideNotionPagePreview()
-                      }}
-                    >
-                      <span className={cn(s.datasetIcon, s.notion)} />
-                      <span
-                        title={t('datasetCreation.stepOne.dataSourceType.notion')!}
-                        className='truncate'
-                      >
-                        {t('datasetCreation.stepOne.dataSourceType.notion')}
-                      </span>
-                    </div>
-                    <div
-                      className={cn(
-                        s.dataSourceItem,
-                        'system-sm-medium',
-                        dataSourceType === DataSourceType.WEB && s.active,
-                        dataSourceTypeDisable && dataSourceType !== DataSourceType.WEB && s.disabled,
-                      )}
-                      onClick={() => changeType(DataSourceType.WEB)}
-                    >
-                      <span className={cn(s.datasetIcon, s.web)} />
-                      <span
-                        title={t('datasetCreation.stepOne.dataSourceType.web')!}
-                        className='truncate'
-                      >
-                        {t('datasetCreation.stepOne.dataSourceType.web')}
-                      </span>
-                    </div>
+                  <div
+                    className={cn(
+                      s.dataSourceItem,
+                      dataSourceType === DataSourceType.NOTION && s.active,
+                      dataSourceTypeDisable && dataSourceType !== DataSourceType.NOTION && s.disabled,
+                    )}
+                    onClick={() => {
+                      if (dataSourceTypeDisable)
+                        return
+                      changeType(DataSourceType.NOTION)
+                      hideFilePreview()
+                      hideNotionPagePreview()
+                    }}
+                  >
+                    <span className={cn(s.datasetIcon, s.notion)} />
+                    {t('datasetCreation.stepOne.dataSourceType.notion')}
                   </div>
-                )
-              }
-              {dataSourceType === DataSourceType.FILE && (
-                <>
-                  <FileUploader
-                    fileList={files}
-                    titleClassName={!shouldShowDataSourceTypeList ? 'mt-[30px] !mb-[44px] !text-lg' : undefined}
-                    prepareFileList={updateFileList}
-                    onFileListUpdate={updateFileList}
-                    onFileUpdate={updateFile}
-                    onPreview={updateCurrentFile}
-                    notSupportBatchUpload={notSupportBatchUpload}
+                  <div
+                    className={cn(
+                      s.dataSourceItem,
+                      dataSourceType === DataSourceType.WEB && s.active,
+                      dataSourceTypeDisable && dataSourceType !== DataSourceType.WEB && s.disabled,
+                    )}
+                    onClick={() => changeType(DataSourceType.WEB)}
+                  >
+                    <span className={cn(s.datasetIcon, s.web)} />
+                    {t('datasetCreation.stepOne.dataSourceType.web')}
+                  </div>
+                </div>
+              )
+            }
+            {dataSourceType === DataSourceType.FILE && (
+              <>
+                <FileUploader
+                  fileList={files}
+                  titleClassName={!shouldShowDataSourceTypeList ? 'mt-[30px] !mb-[44px] !text-lg !font-semibold !text-gray-900' : undefined}
+                  prepareFileList={updateFileList}
+                  onFileListUpdate={updateFileList}
+                  onFileUpdate={updateFile}
+                  onPreview={updateCurrentFile}
+                  notSupportBatchUpload={notSupportBatchUpload}
+                />
+                {isShowVectorSpaceFull && (
+                  <div className='max-w-[640px] mb-4'>
+                    <VectorSpaceFull />
+                  </div>
+                )}
+                <div className="flex justify-end gap-2 max-w-[640px]">
+                  {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
+                  <Button disabled={nextDisabled} variant='primary' onClick={onStepChange}>
+                    <span className="flex gap-0.5 px-[10px]">
+                      <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
+                      <RiArrowRightLine className="size-4" />
+                    </span>
+                  </Button>
+                </div>
+              </>
+            )}
+            {dataSourceType === DataSourceType.NOTION && (
+              <>
+                {!hasConnection && <NotionConnector onSetting={onSetting} />}
+                {hasConnection && (
+                  <>
+                    <div className='mb-8 w-[640px]'>
+                      <NotionPageSelector
+                        value={notionPages.map(page => page.page_id)}
+                        onSelect={updateNotionPages}
+                        onPreview={updateCurrentPage}
+                      />
+                    </div>
+                    {isShowVectorSpaceFull && (
+                      <div className='max-w-[640px] mb-4'>
+                        <VectorSpaceFull />
+                      </div>
+                    )}
+                    <div className="flex justify-end gap-2 max-w-[640px]">
+                      {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
+                      <Button disabled={isShowVectorSpaceFull || !notionPages.length} variant='primary' onClick={onStepChange}>
+                        <span className="flex gap-0.5 px-[10px]">
+                          <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
+                          <RiArrowRightLine className="size-4" />
+                        </span>
+                      </Button>
+                    </div>
+                  </>
+                )}
+              </>
+            )}
+            {dataSourceType === DataSourceType.WEB && (
+              <>
+                <div className={cn('mb-8 w-[640px]', !shouldShowDataSourceTypeList && 'mt-12')}>
+                  <Website
+                    onPreview={setCurrentWebsite}
+                    checkedCrawlResult={websitePages}
+                    onCheckedCrawlResultChange={updateWebsitePages}
+                    onCrawlProviderChange={onWebsiteCrawlProviderChange}
+                    onJobIdChange={onWebsiteCrawlJobIdChange}
+                    crawlOptions={crawlOptions}
+                    onCrawlOptionsChange={onCrawlOptionsChange}
                   />
-                  {isShowVectorSpaceFull && (
-                    <div className='mb-4 max-w-[640px]'>
-                      <VectorSpaceFull />
-                    </div>
-                  )}
-                  <div className="flex max-w-[640px] justify-end gap-2">
-                    {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
-                    <Button disabled={nextDisabled} variant='primary' onClick={onStepChange}>
-                      <span className="flex gap-0.5 px-[10px]">
-                        <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
-                        <RiArrowRightLine className="size-4" />
-                      </span>
-                    </Button>
+                </div>
+                {isShowVectorSpaceFull && (
+                  <div className='max-w-[640px] mb-4'>
+                    <VectorSpaceFull />
                   </div>
-                </>
-              )}
-              {dataSourceType === DataSourceType.NOTION && (
-                <>
-                  {!hasConnection && <NotionConnector onSetting={onSetting} />}
-                  {hasConnection && (
-                    <>
-                      <div className='mb-8 w-[640px]'>
-                        <NotionPageSelector
-                          value={notionPages.map(page => page.page_id)}
-                          onSelect={updateNotionPages}
-                          onPreview={updateCurrentPage}
-                        />
-                      </div>
-                      {isShowVectorSpaceFull && (
-                        <div className='mb-4 max-w-[640px]'>
-                          <VectorSpaceFull />
-                        </div>
-                      )}
-                      <div className="flex max-w-[640px] justify-end gap-2">
-                        {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
-                        <Button disabled={isShowVectorSpaceFull || !notionPages.length} variant='primary' onClick={onStepChange}>
-                          <span className="flex gap-0.5 px-[10px]">
-                            <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
-                            <RiArrowRightLine className="size-4" />
-                          </span>
-                        </Button>
-                      </div>
-                    </>
-                  )}
-                </>
-              )}
-              {dataSourceType === DataSourceType.WEB && (
-                <>
-                  <div className={cn('mb-8 w-[640px]', !shouldShowDataSourceTypeList && 'mt-12')}>
-                    <Website
-                      onPreview={setCurrentWebsite}
-                      checkedCrawlResult={websitePages}
-                      onCheckedCrawlResultChange={updateWebsitePages}
-                      onCrawlProviderChange={onWebsiteCrawlProviderChange}
-                      onJobIdChange={onWebsiteCrawlJobIdChange}
-                      crawlOptions={crawlOptions}
-                      onCrawlOptionsChange={onCrawlOptionsChange}
-                    />
-                  </div>
-                  {isShowVectorSpaceFull && (
-                    <div className='mb-4 max-w-[640px]'>
-                      <VectorSpaceFull />
-                    </div>
-                  )}
-                  <div className="flex max-w-[640px] justify-end gap-2">
-                    {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
-                    <Button disabled={isShowVectorSpaceFull || !websitePages.length} variant='primary' onClick={onStepChange}>
-                      <span className="flex gap-0.5 px-[10px]">
-                        <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
-                        <RiArrowRightLine className="size-4" />
-                      </span>
-                    </Button>
-                  </div>
-                </>
-              )}
-              {!datasetId && (
-                <>
-                  <div className='my-8 h-px max-w-[640px] bg-divider-regular' />
-                  <span className="inline-flex cursor-pointer items-center text-[13px] leading-4 text-text-accent" onClick={modalShowHandle}>
-                    <RiFolder6Line className="mr-1 size-4" />
-                    {t('datasetCreation.stepOne.emptyDatasetCreation')}
-                  </span>
-                </>
-              )}
-            </div>
-            <EmptyDatasetCreationModal show={showModal} onHide={modalCloseHandle} />
+                )}
+                <div className="flex justify-end gap-2 max-w-[640px]">
+                  {/* <Button>{t('datasetCreation.stepOne.cancel')}</Button> */}
+                  <Button disabled={isShowVectorSpaceFull || !websitePages.length} variant='primary' onClick={onStepChange}>
+                    <span className="flex gap-0.5 px-[10px]">
+                      <span className="px-0.5">{t('datasetCreation.stepOne.button')}</span>
+                      <RiArrowRightLine className="size-4" />
+                    </span>
+                  </Button>
+                </div>
+              </>
+            )}
+            {!datasetId && (
+              <>
+                <div className={s.dividerLine} />
+                <span className="inline-flex items-center cursor-pointer text-[13px] leading-4 text-text-accent" onClick={modalShowHandle}>
+                  <RiFolder6Line className="size-4 mr-1" />
+                  {t('datasetCreation.stepOne.emptyDatasetCreation')}
+                </span>
+              </>
+            )}
           </div>
+          <EmptyDatasetCreationModal show={showModal} onHide={modalCloseHandle} />
         </div>
-        <div className='h-full w-1/2 overflow-y-auto'>
-          {currentFile && <FilePreview file={currentFile} hidePreview={hideFilePreview} />}
-          {currentNotionPage && <NotionPagePreview currentPage={currentNotionPage} hidePreview={hideNotionPagePreview} />}
-          {currentWebsite && <WebsitePreview payload={currentWebsite} hidePreview={hideWebsitePreview} />}
-        </div>
+      </div>
+      <div className='w-1/2 h-full overflow-y-auto'>
+        {currentFile && <FilePreview file={currentFile} hidePreview={hideFilePreview} />}
+        {currentNotionPage && <NotionPagePreview currentPage={currentNotionPage} hidePreview={hideNotionPagePreview} />}
+        {currentWebsite && <WebsitePreview payload={currentWebsite} hidePreview={hideWebsitePreview} />}
       </div>
     </div>
   )

web/app/components/explore/app-list/index.tsx

@@ -1,10 +1,12 @@
 'use client'
 
-import React, { useCallback, useMemo, useState } from 'react'
+import React, { useMemo, useState } from 'react'
+import { useRouter } from 'next/navigation'
 import { useTranslation } from 'react-i18next'
 import { useContext } from 'use-context-selector'
 import useSWR from 'swr'
 import { useDebounceFn } from 'ahooks'
+import Toast from '../../base/toast'
 import s from './style.module.css'
 import cn from '@/utils/classnames'
 import ExploreContext from '@/context/explore-context'
@@ -12,17 +14,17 @@ import type { App } from '@/models/explore'
 import Category from '@/app/components/explore/category'
 import AppCard from '@/app/components/explore/app-card'
 import { fetchAppDetail, fetchAppList } from '@/service/explore'
+import { importDSL } from '@/service/apps'
 import { useTabSearchParams } from '@/hooks/use-tab-searchparams'
 import CreateAppModal from '@/app/components/explore/create-app-modal'
 import AppTypeSelector from '@/app/components/app/type-selector'
 import type { CreateAppModalProps } from '@/app/components/explore/create-app-modal'
 import Loading from '@/app/components/base/loading'
+import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { useAppContext } from '@/context/app-context'
+import { getRedirection } from '@/utils/app-redirection'
 import Input from '@/app/components/base/input'
-import {
-  DSLImportMode,
-} from '@/models/app'
-import { useImportDSL } from '@/hooks/use-import-dsl'
-import DSLConfirmModal from '@/app/components/app/create-from-dsl-modal/dsl-confirm-modal'
+import { DSLImportMode } from '@/models/app'
 
 type AppsProps = {
   pageType?: PageType
@@ -39,6 +41,8 @@ const Apps = ({
   onSuccess,
 }: AppsProps) => {
   const { t } = useTranslation()
+  const { isCurrentWorkspaceEditor } = useAppContext()
+  const { push } = useRouter()
   const { hasEditPermission } = useContext(ExploreContext)
   const allCategoriesEn = t('explore.apps.allCategories', { lng: 'en' })
 
@@ -113,14 +117,6 @@ const Apps = ({
 
   const [currApp, setCurrApp] = React.useState<App | null>(null)
   const [isShowCreateModal, setIsShowCreateModal] = React.useState(false)
-
-  const {
-    handleImportDSL,
-    handleImportDSLConfirm,
-    versions,
-    isFetching,
-  } = useImportDSL()
-  const [showDSLConfirmModal, setShowDSLConfirmModal] = useState(false)
   const onCreate: CreateAppModalProps['onConfirm'] = async ({
     name,
     icon_type,
@@ -131,31 +127,31 @@ const Apps = ({
     const { export_data } = await fetchAppDetail(
       currApp?.app.id as string,
     )
-    const payload = {
-      mode: DSLImportMode.YAML_CONTENT,
-      yaml_content: export_data,
-      name,
-      icon_type,
-      icon,
-      icon_background,
-      description,
+    try {
+      const app = await importDSL({
+        mode: DSLImportMode.YAML_CONTENT,
+        yaml_content: export_data,
+        name,
+        icon_type,
+        icon,
+        icon_background,
+        description,
+      })
+      setIsShowCreateModal(false)
+      Toast.notify({
+        type: 'success',
+        message: t('app.newApp.appCreated'),
+      })
+      if (onSuccess)
+        onSuccess()
+      localStorage.setItem(NEED_REFRESH_APP_LIST_KEY, '1')
+      getRedirection(isCurrentWorkspaceEditor, { id: app.app_id }, push)
+    }
+    catch (e) {
+      Toast.notify({ type: 'error', message: t('app.newApp.appCreateFailed') })
     }
-    await handleImportDSL(payload, {
-      onSuccess: () => {
-        setIsShowCreateModal(false)
-      },
-      onPending: () => {
-        setShowDSLConfirmModal(true)
-      },
-    })
   }
 
-  const onConfirmDSL = useCallback(async () => {
-    await handleImportDSLConfirm({
-      onSuccess,
-    })
-  }, [handleImportDSLConfirm, onSuccess])
-
   if (!categories || categories.length === 0) {
     return (
       <div className="flex h-full items-center">
@@ -238,20 +234,9 @@ const Apps = ({
           appDescription={currApp?.app.description || ''}
           show={isShowCreateModal}
           onConfirm={onCreate}
-          confirmDisabled={isFetching}
           onHide={() => setIsShowCreateModal(false)}
         />
       )}
-      {
-        showDSLConfirmModal && (
-          <DSLConfirmModal
-            versions={versions}
-            onCancel={() => setShowDSLConfirmModal(false)}
-            onConfirm={onConfirmDSL}
-            confirmDisabled={isFetching}
-          />
-        )
-      }
     </div>
   )
 }

web/app/components/explore/create-app-modal/index.tsx

@@ -33,7 +33,6 @@ export type CreateAppModalProps = {
     description: string
     use_icon_as_answer_icon?: boolean
   }) => Promise<void>
-  confirmDisabled?: boolean
   onHide: () => void
 }
 
@@ -49,7 +48,6 @@ const CreateAppModal = ({
   appMode,
   appUseIconAsAnswerIcon,
   onConfirm,
-  confirmDisabled,
   onHide,
 }: CreateAppModalProps) => {
   const { t } = useTranslation()
@@ -147,7 +145,7 @@ const CreateAppModal = ({
           {!isEditModal && isAppsFull && <AppsFull loc='app-explore-create' />}
         </div>
         <div className='flex flex-row-reverse'>
-          <Button disabled={(!isEditModal && isAppsFull) || !name.trim() || confirmDisabled} className='w-24 ml-2' variant='primary' onClick={submit}>{!isEditModal ? t('common.operation.create') : t('common.operation.save')}</Button>
+          <Button disabled={!isEditModal && isAppsFull} className='w-24 ml-2' variant='primary' onClick={submit}>{!isEditModal ? t('common.operation.create') : t('common.operation.save')}</Button>
           <Button className='w-24' onClick={onHide}>{t('common.operation.cancel')}</Button>
         </div>
       </Modal>

web/app/components/explore/installed-app/index.tsx

@@ -26,15 +26,15 @@ const InstalledApp: FC<IInstalledAppProps> = ({
   }
 
   return (
-    <div className='h-full py-2 pl-0 pr-2 sm:p-2 bg-background-default'>
+    <div className='h-full py-2 pl-0 pr-2 sm:p-2'>
       {installedApp.app.mode !== 'completion' && installedApp.app.mode !== 'workflow' && (
         <ChatWithHistory installedAppInfo={installedApp} className='rounded-2xl shadow-md overflow-hidden' />
       )}
       {installedApp.app.mode === 'completion' && (
-        <TextGenerationApp isInstalledApp installedAppInfo={installedApp} />
+        <TextGenerationApp isInstalledApp installedAppInfo={installedApp}/>
       )}
       {installedApp.app.mode === 'workflow' && (
-        <TextGenerationApp isWorkflow isInstalledApp installedAppInfo={installedApp} />
+        <TextGenerationApp isWorkflow isInstalledApp installedAppInfo={installedApp}/>
       )}
     </div>
   )

web/app/components/header/account-setting/members-page/invite-modal/index.tsx

@@ -1,5 +1,5 @@
 'use client'
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useState } from 'react'
 import { useContext } from 'use-context-selector'
 import { XMarkIcon } from '@heroicons/react/24/outline'
 import { useTranslation } from 'react-i18next'
@@ -17,7 +17,6 @@ import type { InvitationResult } from '@/models/common'
 import I18n from '@/context/i18n'
 
 import 'react-multi-email/dist/style.css'
-import { useProviderContextSelector } from '@/context/provider-context'
 type IInviteModalProps = {
   isEmailSetup: boolean
   onCancel: () => void
@@ -30,26 +29,13 @@ const InviteModal = ({
   onSend,
 }: IInviteModalProps) => {
   const { t } = useTranslation()
-  const licenseLimit = useProviderContextSelector(s => s.licenseLimit)
   const [emails, setEmails] = useState<string[]>([])
   const { notify } = useContext(ToastContext)
-  const [isLimited, setIsLimited] = useState(false)
-  const [isLimitExceeded, setIsLimitExceeded] = useState(false)
-  const [usedSize, setUsedSize] = useState(licenseLimit.workspace_members.size ?? 0)
-  useEffect(() => {
-    const limited = licenseLimit.workspace_members.limit > 0
-    const used = emails.length + licenseLimit.workspace_members.size
-    setIsLimited(limited)
-    setUsedSize(used)
-    setIsLimitExceeded(limited && (used > licenseLimit.workspace_members.limit))
-  }, [licenseLimit, emails])
 
   const { locale } = useContext(I18n)
   const [role, setRole] = useState<string>('normal')
 
   const handleSend = useCallback(async () => {
-    if (isLimitExceeded)
-      return
     if (emails.map((email: string) => emailRegex.test(email)).every(Boolean)) {
       try {
         const { result, invitation_results } = await inviteMember({
@@ -67,7 +53,7 @@ const InviteModal = ({
     else {
       notify({ type: 'error', message: t('common.members.emailInvalid') })
     }
-  }, [isLimitExceeded, emails, role, locale, onCancel, onSend, notify, t])
+  }, [role, emails, notify, onCancel, onSend, t])
 
   return (
     <div className={cn(s.wrap)}>
@@ -95,7 +81,7 @@ const InviteModal = ({
 
         <div>
           <div className='mb-2 text-sm font-medium text-gray-900'>{t('common.members.email')}</div>
-          <div className='mb-8 h-36 flex flex-col items-stretch'>
+          <div className='mb-8 h-36 flex items-stretch'>
             <ReactMultiEmail
               className={cn('w-full pt-2 px-3 outline-none border-none',
                 'appearance-none text-sm text-gray-900 rounded-lg overflow-y-auto',
@@ -115,14 +101,6 @@ const InviteModal = ({
               }
               placeholder={t('common.members.emailPlaceholder') || ''}
             />
-            <div className={
-              cn('flex items-center justify-end system-xs-regular text-text-tertiary',
-                (isLimited && usedSize > licenseLimit.workspace_members.limit) ? 'text-text-destructive' : '')}
-            >
-              <span>{usedSize}</span>
-              <span>/</span>
-              <span>{isLimited ? licenseLimit.workspace_members.limit : t('common.license.unlimited')}</span>
-            </div>
           </div>
           <div className='mb-6'>
             <RoleSelector value={role} onChange={setRole} />
@@ -131,7 +109,7 @@ const InviteModal = ({
             tabIndex={0}
             className='w-full'
             onClick={handleSend}
-            disabled={!emails.length || isLimitExceeded}
+            disabled={!emails.length}
             variant='primary'
           >
             {t('common.members.sendInvite')}

web/app/components/share/text-generation/index.tsx

@@ -11,11 +11,9 @@ import { usePathname, useRouter, useSearchParams } from 'next/navigation'
 import TabHeader from '../../base/tab-header'
 import Button from '../../base/button'
 import { checkOrSetAccessToken } from '../utils'
-import AppUnavailable from '../../base/app-unavailable'
 import s from './style.module.css'
 import RunBatch from './run-batch'
 import ResDownload from './run-batch/res-download'
-import MenuDropdown from './menu-dropdown'
 import cn from '@/utils/classnames'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import RunOnce from '@/app/components/share/text-generation/run-once'
@@ -39,8 +37,6 @@ import Toast from '@/app/components/base/toast'
 import type { VisionFile, VisionSettings } from '@/types/app'
 import { Resolution, TransferMethod } from '@/types/app'
 import { useAppFavicon } from '@/hooks/use-app-favicon'
-import { useGetAppAccessMode, useGetUserCanAccessApp } from '@/service/access-control'
-import { AccessMode } from '@/models/access-control'
 
 const GROUP_SIZE = 5 // to avoid RPM(Request per minute) limit. The group task finished then the next group.
 enum TaskStatus {
@@ -110,9 +106,6 @@ const TextGeneration: FC<IMainProps> = ({
   const [moreLikeThisConfig, setMoreLikeThisConfig] = useState<MoreLikeThisConfig | null>(null)
   const [textToSpeechConfig, setTextToSpeechConfig] = useState<TextToSpeechConfig | null>(null)
 
-  const { isPending: isGettingAccessMode, data: appAccessMode } = useGetAppAccessMode({ appId, isInstalledApp })
-  const { isPending: isCheckingPermission, data: userCanAccessResult } = useGetUserCanAccessApp({ appId, isInstalledApp })
-
   // save message
   const [savedMessages, setSavedMessages] = useState<SavedMessage[]>([])
   const fetchSavedMessage = async () => {
@@ -544,14 +537,12 @@ const TextGeneration: FC<IMainProps> = ({
     </div>
   )
 
-  if (!appId || !siteInfo || !promptConfig || isGettingAccessMode || isCheckingPermission) {
+  if (!appId || !siteInfo || !promptConfig) {
     return (
       <div className='flex items-center h-screen'>
         <Loading type='app' />
       </div>)
   }
-  if (!userCanAccessResult?.result)
-    return <AppUnavailable code={403} unknownReason='no permission.' />
 
   return (
     <>
@@ -567,19 +558,16 @@ const TextGeneration: FC<IMainProps> = ({
           'shrink-0 relative flex flex-col pb-10 h-full border-r border-gray-100 bg-white',
         )}>
           <div className='mb-6'>
-            <div className='flex items-center'>
-              <div className='flex grow'>
-                <div className='flex items-center space-x-3 grow'>
-                  <AppIcon
-                    size="small"
-                    iconType={siteInfo.icon_type}
-                    icon={siteInfo.icon}
-                    background={siteInfo.icon_background || appDefaultIconBackground}
-                    imageUrl={siteInfo.icon_url}
-                  />
-                  <div className='text-lg font-semibold text-gray-800'>{siteInfo.title}</div>
-                </div>
-                <MenuDropdown hideLogout={isInstalledApp || appAccessMode?.accessMode === AccessMode.PUBLIC} />
+            <div className='flex items-center justify-between'>
+              <div className='flex items-center space-x-3'>
+                <AppIcon
+                  size="small"
+                  iconType={siteInfo.icon_type}
+                  icon={siteInfo.icon}
+                  background={siteInfo.icon_background || appDefaultIconBackground}
+                  imageUrl={siteInfo.icon_url}
+                />
+                <div className='text-lg font-semibold text-gray-800'>{siteInfo.title}</div>
               </div>
               {!isPC && (
                 <Button

web/app/components/share/text-generation/info-modal.tsx

@@ -1,49 +0,0 @@
-import React from 'react'
-import cn from 'classnames'
-import Modal from '@/app/components/base/modal'
-import AppIcon from '@/app/components/base/app-icon'
-import type { SiteInfo } from '@/models/share'
-import { appDefaultIconBackground } from '@/config'
-
-type Props = {
-  data?: SiteInfo
-  isShow: boolean
-  onClose: () => void
-}
-
-const InfoModal = ({
-  isShow,
-  onClose,
-  data,
-}: Props) => {
-  return (
-    <Modal
-      isShow={isShow}
-      onClose={onClose}
-      className='min-w-[400px] max-w-[400px] !p-0'
-      closable
-    >
-      <div className={cn('flex flex-col items-center gap-4 px-4 pb-8 pt-10')}>
-        <AppIcon
-          size='xxl'
-          iconType={data?.icon_type}
-          icon={data?.icon}
-          background={data?.icon_background || appDefaultIconBackground}
-          imageUrl={data?.icon_url}
-        />
-        <div className='system-xl-semibold text-text-secondary'>{data?.title}</div>
-        <div className='system-xs-regular text-text-tertiary'>
-          {/* copyright */}
-          {data?.copyright && (
-            <div>© {(new Date()).getFullYear()} {data?.copyright}</div>
-          )}
-          {data?.custom_disclaimer && (
-            <div className='mt-2'>{data.custom_disclaimer}</div>
-          )}
-        </div>
-      </div>
-    </Modal>
-  )
-}
-
-export default InfoModal

web/app/components/share/text-generation/menu-dropdown.tsx

@@ -1,113 +0,0 @@
-'use client'
-import type { FC } from 'react'
-import React, { useCallback, useRef, useState } from 'react'
-import { useTranslation } from 'react-i18next'
-import type { Placement } from '@floating-ui/react'
-import {
-  RiEqualizer2Line,
-} from '@remixicon/react'
-import { useRouter } from 'next/navigation'
-import Divider from '../../base/divider'
-import { removeAccessToken } from '../utils'
-import InfoModal from './info-modal'
-import ActionButton from '@/app/components/base/action-button'
-import {
-  PortalToFollowElem,
-  PortalToFollowElemContent,
-  PortalToFollowElemTrigger,
-} from '@/app/components/base/portal-to-follow-elem'
-import type { SiteInfo } from '@/models/share'
-import cn from '@/utils/classnames'
-
-type Props = {
-  data?: SiteInfo
-  placement?: Placement
-  hideLogout?: boolean
-}
-
-const MenuDropdown: FC<Props> = ({
-  data,
-  placement,
-  hideLogout,
-}) => {
-  const router = useRouter()
-  const { t } = useTranslation()
-  const [open, doSetOpen] = useState(false)
-  const openRef = useRef(open)
-  const setOpen = useCallback((v: boolean) => {
-    doSetOpen(v)
-    openRef.current = v
-  }, [doSetOpen])
-
-  const handleTrigger = useCallback(() => {
-    setOpen(!openRef.current)
-  }, [setOpen])
-
-  const handleLogout = useCallback(() => {
-    removeAccessToken()
-    router.replace(`/webapp-signin?redirect_url=${window.location.href}`)
-  }, [router])
-
-  const [show, setShow] = useState(false)
-
-  return (
-    <>
-      <PortalToFollowElem
-        open={open}
-        onOpenChange={setOpen}
-        placement={placement || 'bottom-end'}
-        offset={{
-          mainAxis: 4,
-          crossAxis: -4,
-        }}
-      >
-        <PortalToFollowElemTrigger onClick={handleTrigger}>
-          <div>
-            <ActionButton size='l' className={cn(open && 'bg-state-base-hover')}>
-              <RiEqualizer2Line className='h-[18px] w-[18px]' />
-            </ActionButton>
-          </div>
-        </PortalToFollowElemTrigger>
-        <PortalToFollowElemContent className='z-50'>
-          <div className='w-[224px] rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-sm'>
-            <div className='p-1'>
-              {data?.privacy_policy && (
-                <a href={data.privacy_policy} target='_blank' className='system-md-regular flex cursor-pointer items-center rounded-lg px-3 py-1.5 text-text-secondary hover:bg-state-base-hover'>
-                  <span className='grow'>{t('share.chat.privacyPolicyMiddle')}</span>
-                </a>
-              )}
-              <div
-                onClick={() => {
-                  handleTrigger()
-                  setShow(true)
-                }}
-                className='system-md-regular cursor-pointer rounded-lg px-3 py-1.5 text-text-secondary hover:bg-state-base-hover'
-              >{t('common.userProfile.about')}</div>
-              {false && (
-                <>
-                  <Divider />
-                  <div
-                    onClick={() => {
-                      handleLogout()
-                    }}
-                    className='system-md-regular cursor-pointer rounded-lg px-3 py-1.5 text-text-destructive hover:bg-state-base-hover'
-                  >{t('common.userProfile.logout')}</div>
-                </>
-              )}
-            </div>
-          </div>
-        </PortalToFollowElemContent>
-      </PortalToFollowElem>
-      {show && (
-        <InfoModal
-          isShow={show}
-          onClose={() => {
-            setShow(false)
-          }}
-          data={data}
-        />
-      )}
-    </>
-  )
-}
-export default React.memo(MenuDropdown)

web/app/reset-password/check-code/page.tsx

@@ -39,11 +39,7 @@ export default function CheckCode() {
       }
       setIsLoading(true)
       const ret = await verifyResetPasswordCode({ email, code, token })
-      if (ret.is_valid) {
-        const params = new URLSearchParams(searchParams)
-        params.set('token', encodeURIComponent(ret.token))
-        router.push(`/reset-password/set-password?${params.toString()}`)
-      }
+      ret.is_valid && router.push(`/reset-password/set-password?${searchParams.toString()}`)
     }
     catch (error) { console.error(error) }
     finally {

web/context/access-control-store.ts

@@ -1,34 +0,0 @@
-import { create } from 'zustand'
-import type { AccessControlAccount, AccessControlGroup } from '@/models/access-control'
-import { AccessMode } from '@/models/access-control'
-import type { App } from '@/types/app'
-
-type AccessControlStore = {
-  appId: App['id']
-  setAppId: (appId: App['id']) => void
-  specificGroups: AccessControlGroup[]
-  setSpecificGroups: (specificGroups: AccessControlGroup[]) => void
-  specificMembers: AccessControlAccount[]
-  setSpecificMembers: (specificMembers: AccessControlAccount[]) => void
-  currentMenu: AccessMode
-  setCurrentMenu: (currentMenu: AccessMode) => void
-  selectedGroupsForBreadcrumb: AccessControlGroup[]
-  setSelectedGroupsForBreadcrumb: (selectedGroupsForBreadcrumb: AccessControlGroup[]) => void
-}
-
-const useAccessControlStore = create<AccessControlStore>((set) => {
-  return {
-    appId: '',
-    setAppId: appId => set({ appId }),
-    specificGroups: [],
-    setSpecificGroups: specificGroups => set({ specificGroups }),
-    specificMembers: [],
-    setSpecificMembers: specificMembers => set({ specificMembers }),
-    currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-    setCurrentMenu: currentMenu => set({ currentMenu }),
-    selectedGroupsForBreadcrumb: [],
-    setSelectedGroupsForBreadcrumb: selectedGroupsForBreadcrumb => set({ selectedGroupsForBreadcrumb }),
-  }
-})
-
-export default useAccessControlStore

web/context/provider-context.tsx

@@ -36,12 +36,6 @@ type ProviderContextState = {
   modelLoadBalancingEnabled: boolean
   datasetOperatorEnabled: boolean
   webappCopyrightEnabled: boolean
-  licenseLimit: {
-    workspace_members: {
-      size: number
-      limit: number
-    }
-  }
 }
 const ProviderContext = createContext<ProviderContextState>({
   modelProviders: [],
@@ -72,12 +66,6 @@ const ProviderContext = createContext<ProviderContextState>({
   modelLoadBalancingEnabled: false,
   datasetOperatorEnabled: false,
   webappCopyrightEnabled: false,
-  licenseLimit: {
-    workspace_members: {
-      size: 0,
-      limit: 0,
-    },
-  },
 })
 
 export const useProviderContext = () => useContext(ProviderContext)
@@ -106,12 +94,6 @@ export const ProviderContextProvider = ({
   const [modelLoadBalancingEnabled, setModelLoadBalancingEnabled] = useState(false)
   const [datasetOperatorEnabled, setDatasetOperatorEnabled] = useState(false)
   const [webappCopyrightEnabled, setWebappCopyrightEnabled] = useState(false)
-  const [licenseLimit, setLicenseLimit] = useState({
-    workspace_members: {
-      size: 0,
-      limit: 0,
-    },
-  })
 
   const fetchPlan = async () => {
     const data = await fetchCurrentPlanInfo()
@@ -128,8 +110,6 @@ export const ProviderContextProvider = ({
       setDatasetOperatorEnabled(true)
     if (data.webapp_copyright_enabled)
       setWebappCopyrightEnabled(true)
-    if (data.workspace_members)
-      setLicenseLimit({ workspace_members: data.workspace_members })
   }
   useEffect(() => {
     fetchPlan()
@@ -149,7 +129,6 @@ export const ProviderContextProvider = ({
       modelLoadBalancingEnabled,
       datasetOperatorEnabled,
       webappCopyrightEnabled,
-      licenseLimit,
     }}>
       {children}
     </ProviderContext.Provider>

web/docker/entrypoint.sh

@@ -23,7 +23,6 @@ export NEXT_TELEMETRY_DISABLED=${NEXT_TELEMETRY_DISABLED}
 
 export NEXT_PUBLIC_TEXT_GENERATION_TIMEOUT_MS=${TEXT_GENERATION_TIMEOUT_MS}
 export NEXT_PUBLIC_CSP_WHITELIST=${CSP_WHITELIST}
-export NEXT_PUBLIC_ALLOW_EMBED=${ALLOW_EMBED}
 export NEXT_PUBLIC_TOP_K_MAX_VALUE=${TOP_K_MAX_VALUE}
 export NEXT_PUBLIC_INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH=${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH}
 

web/hooks/use-document-title.ts

@@ -9,8 +9,7 @@ export default function useDocumentTitle(title: string) {
     if (systemFeatures.branding.enabled) {
       document.title = `${prefix}${systemFeatures.branding.application_title}`
       const faviconEle = document.querySelector('link[rel*=\'icon\']') as HTMLLinkElement
-      if (faviconEle)
-        faviconEle.href = systemFeatures.branding.favicon
+      faviconEle.href = systemFeatures.branding.favicon
     }
     else {
       document.title = `${prefix}Dify`

web/hooks/use-import-dsl.ts

@@ -1,158 +0,0 @@
-import {
-  useCallback,
-  useRef,
-  useState,
-} from 'react'
-import { useTranslation } from 'react-i18next'
-import { useRouter } from 'next/navigation'
-import type {
-  DSLImportMode,
-  DSLImportResponse,
-} from '@/models/app'
-import { DSLImportStatus } from '@/models/app'
-import {
-  importDSL,
-  importDSLConfirm,
-} from '@/service/apps'
-import type { AppIconType } from '@/types/app'
-import { useToastContext } from '@/app/components/base/toast'
-import { getRedirection } from '@/utils/app-redirection'
-import { useSelector } from '@/context/app-context'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
-
-type DSLPayload = {
-  mode: DSLImportMode
-  yaml_content?: string
-  yaml_url?: string
-  name?: string
-  icon_type?: AppIconType
-  icon?: string
-  icon_background?: string
-  description?: string
-}
-type ResponseCallback = {
-  onSuccess?: () => void
-  onPending?: (payload: DSLImportResponse) => void
-  onFailed?: () => void
-}
-export const useImportDSL = () => {
-  const { t } = useTranslation()
-  const { notify } = useToastContext()
-  const [isFetching, setIsFetching] = useState(false)
-  const isCurrentWorkspaceEditor = useSelector(s => s.isCurrentWorkspaceEditor)
-  const { push } = useRouter()
-  const [versions, setVersions] = useState<{ importedVersion: string; systemVersion: string }>()
-  const importIdRef = useRef<string>('')
-
-  const handleImportDSL = useCallback(async (
-    payload: DSLPayload,
-    {
-      onSuccess,
-      onPending,
-      onFailed,
-    }: ResponseCallback,
-  ) => {
-    if (isFetching)
-      return
-    setIsFetching(true)
-
-    try {
-      const response = await importDSL(payload)
-
-      if (!response)
-        return
-
-      const {
-        id,
-        status,
-        app_id,
-        imported_dsl_version,
-        current_dsl_version,
-      } = response
-
-      if (status === DSLImportStatus.COMPLETED || status === DSLImportStatus.COMPLETED_WITH_WARNINGS) {
-        if (!app_id)
-          return
-
-        notify({
-          type: status === DSLImportStatus.COMPLETED ? 'success' : 'warning',
-          message: t(status === DSLImportStatus.COMPLETED ? 'app.newApp.appCreated' : 'app.newApp.caution'),
-          children: status === DSLImportStatus.COMPLETED_WITH_WARNINGS && t('app.newApp.appCreateDSLWarning'),
-        })
-        onSuccess?.()
-        localStorage.setItem(NEED_REFRESH_APP_LIST_KEY, '1')
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id }, push)
-      }
-      else if (status === DSLImportStatus.PENDING) {
-        setVersions({
-          importedVersion: imported_dsl_version ?? '',
-          systemVersion: current_dsl_version ?? '',
-        })
-        importIdRef.current = id
-        onPending?.(response)
-      }
-      else {
-        notify({ type: 'error', message: t('app.newApp.appCreateFailed') })
-        onFailed?.()
-      }
-    }
-    catch {
-      notify({ type: 'error', message: t('app.newApp.appCreateFailed') })
-      onFailed?.()
-    }
-    finally {
-      setIsFetching(false)
-    }
-  }, [t, notify, isCurrentWorkspaceEditor, push, isFetching])
-
-  const handleImportDSLConfirm = useCallback(async (
-    {
-      onSuccess,
-      onFailed,
-    }: Pick<ResponseCallback, 'onSuccess' | 'onFailed'>,
-  ) => {
-    if (isFetching)
-      return
-    setIsFetching(true)
-    if (!importIdRef.current)
-      return
-
-    try {
-      const response = await importDSLConfirm({
-        import_id: importIdRef.current,
-      })
-
-      const { status, app_id } = response
-      if (!app_id)
-        return
-
-      if (status === DSLImportStatus.COMPLETED) {
-        onSuccess?.()
-        notify({
-          type: 'success',
-          message: t('app.newApp.appCreated'),
-        })
-        localStorage.setItem(NEED_REFRESH_APP_LIST_KEY, '1')
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id! }, push)
-      }
-      else if (status === DSLImportStatus.FAILED) {
-        notify({ type: 'error', message: t('app.newApp.appCreateFailed') })
-        onFailed?.()
-      }
-    }
-    catch {
-      notify({ type: 'error', message: t('app.newApp.appCreateFailed') })
-      onFailed?.()
-    }
-    finally {
-      setIsFetching(false)
-    }
-  }, [t, notify, isCurrentWorkspaceEditor, push, isFetching])
-
-  return {
-    handleImportDSL,
-    handleImportDSLConfirm,
-    versions,
-    isFetching,
-  }
-}

web/i18n/de-DE/app-overview.ts

@@ -30,26 +30,26 @@ const translation = {
   overview: {
     title: 'Übersicht',
     appInfo: {
-      explanation: 'Einsatzbereite AI-web app',
+      explanation: 'Einsatzbereite AI-WebApp',
       accessibleAddress: 'Öffentliche URL',
       preview: 'Vorschau',
       regenerate: 'Regenerieren',
       regenerateNotice: 'Möchten Sie die öffentliche URL neu generieren?',
-      preUseReminder: 'Bitte aktivieren Sie web app, bevor Sie fortfahren.',
+      preUseReminder: 'Bitte aktivieren Sie WebApp, bevor Sie fortfahren.',
       settings: {
         entry: 'Einstellungen',
-        title: 'web app Einstellungen',
-        webName: 'web app Name',
-        webDesc: 'web app Beschreibung',
+        title: 'WebApp-Einstellungen',
+        webName: 'WebApp-Name',
+        webDesc: 'WebApp-Beschreibung',
         webDescTip: 'Dieser Text wird auf der Clientseite angezeigt und bietet grundlegende Anleitungen zur Verwendung der Anwendung',
-        webDescPlaceholder: 'Geben Sie die Beschreibung der web app ein',
+        webDescPlaceholder: 'Geben Sie die Beschreibung der WebApp ein',
         language: 'Sprache',
         workflow: {
           title: 'Workflow-Schritte',
           show: 'Anzeigen',
           hide: 'Verbergen',
           subTitle: 'Details zum Arbeitsablauf',
-          showDesc: 'Ein- oder Ausblenden von Workflow-Details in der web app',
+          showDesc: 'Ein- oder Ausblenden von Workflow-Details in der WebApp',
         },
         chatColorTheme: 'Chat-Farbschema',
         chatColorThemeDesc: 'Legen Sie das Farbschema des Chatbots fest',
@@ -69,10 +69,10 @@ const translation = {
           copyrightTooltip: 'Bitte führen Sie ein Upgrade auf den Professional-Plan oder höher durch',
         },
         sso: {
-          title: 'web app SSO',
-          description: 'Alle Benutzer müssen sich mit SSO anmelden, bevor sie web app verwenden können',
+          title: 'WebApp-SSO',
+          description: 'Alle Benutzer müssen sich mit SSO anmelden, bevor sie WebApp verwenden können',
           label: 'SSO-Authentifizierung',
-          tooltip: 'Wenden Sie sich an den Administrator, um web app SSO zu aktivieren',
+          tooltip: 'Wenden Sie sich an den Administrator, um WebApp-SSO zu aktivieren',
         },
         modalTip: 'Einstellungen für clientseitige Web-Apps.',
       },
@@ -94,7 +94,7 @@ const translation = {
       customize: {
         way: 'Art',
         entry: 'Anpassen',
-        title: 'AI-web app anpassen',
+        title: 'AI-WebApp anpassen',
         explanation: 'Sie können das Frontend der Web-App an Ihre Szenarien und Stilbedürfnisse anpassen.',
         way1: {
           name: 'Forken Sie den Client-Code, ändern Sie ihn und deployen Sie ihn auf Vercel (empfohlen)',