From e9db50f78186a83708f364cf2ad3023e3cd14e7c Mon Sep 17 00:00:00 2001 From: "Byron.wang" Date: Wed, 11 Feb 2026 12:11:09 +0800 Subject: [PATCH] docs(api): mark SetupApi as unauthenticated by design (#32224) --- api/controllers/console/setup.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/api/controllers/console/setup.py b/api/controllers/console/setup.py index e1ea007232..e099fe0f32 100644 --- a/api/controllers/console/setup.py +++ b/api/controllers/console/setup.py @@ -42,7 +42,15 @@ class SetupResponse(BaseModel): tags=["console"], ) def get_setup_status_api() -> SetupStatusResponse: - """Get system setup status.""" + """Get system setup status. + + NOTE: This endpoint is unauthenticated by design. + + During first-time bootstrap there is no admin account yet, so frontend initialization must be + able to query setup progress before any login flow exists. + + Only bootstrap-safe status information should be returned by this endpoint. + """ if dify_config.EDITION == "SELF_HOSTED": setup_status = get_setup_status() if setup_status and not isinstance(setup_status, bool): @@ -61,7 +69,12 @@ def get_setup_status_api() -> SetupStatusResponse: ) @only_edition_self_hosted def setup_system(payload: SetupRequestPayload) -> SetupResponse: - """Initialize system setup with admin account.""" + """Initialize system setup with admin account. + + NOTE: This endpoint is unauthenticated by design for first-time bootstrap. + Access is restricted by deployment mode (`SELF_HOSTED`), one-time setup guards, + and init-password validation rather than user session authentication. + """ if get_setup_status(): raise AlreadySetupError()