Commit Graph

8674 Commits

Author SHA1 Message Date
GareArc 8c7f4c2aa9
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-04 02:09:16 -08:00
GareArc 8baffdb114
fix(telemetry): enable metrics and logs for standalone prompt generation
Remove app_id parameter from three endpoints and update trace manager to use
tenant_id as storage identifier when app_id is unavailable. This allows
standalone prompt generation utilities to emit telemetry.

Changes:
- controllers/console/app/generator.py: Remove app_id=None from 3 endpoints
  (RuleGenerateApi, RuleCodeGenerateApi, RuleStructuredOutputGenerateApi)
- core/ops/ops_trace_manager.py: Use tenant_id fallback in send_to_celery
  - Extract tenant_id from task.kwargs when app_id is None
  - Use 'tenant-{tenant_id}' format as storage identifier
  - Skip traces only if neither app_id nor tenant_id available

The trace metadata still contains the actual tenant_id, so enterprise
telemetry correctly emits metrics and logs grouped by tenant.
2026-02-04 02:01:46 -08:00
GareArc 3f75a420cd
fix(telemetry): remove app_id parameter from standalone prompt generation endpoints
Remove app_id=None from three prompt generation endpoints that lack proper
app context. These standalone utilities only have tenant_id available, so
we don't pass app_id at all rather than passing incomplete information.

Affected endpoints:
- /rule-generate (RuleGenerateApi)
- /code-generate (RuleCodeGenerateApi)
- /structured-output-generate (RuleStructuredOutputGenerateApi)
2026-02-04 02:01:43 -08:00
GareArc 1e845b9bdd
fix(telemetry): enable metrics and logs for standalone prompt generation
Remove app_id parameter from three endpoints and update trace manager to use
tenant_id as storage identifier when app_id is unavailable. This allows
standalone prompt generation utilities to emit telemetry.

Changes:
- controllers/console/app/generator.py: Remove app_id=None from 3 endpoints
  (RuleGenerateApi, RuleCodeGenerateApi, RuleStructuredOutputGenerateApi)
- core/ops/ops_trace_manager.py: Use tenant_id fallback in send_to_celery
  - Extract tenant_id from task.kwargs when app_id is None
  - Use 'tenant-{tenant_id}' format as storage identifier
  - Skip traces only if neither app_id nor tenant_id available

The trace metadata still contains the actual tenant_id, so enterprise
telemetry correctly emits metrics and logs grouped by tenant.
2026-02-04 01:52:13 -08:00
GareArc a3fe21bea6
fix(telemetry): remove app_id parameter from standalone prompt generation endpoints
Remove app_id=None from three prompt generation endpoints that lack proper
app context. These standalone utilities only have tenant_id available, so
we don't pass app_id at all rather than passing incomplete information.

Affected endpoints:
- /rule-generate (RuleGenerateApi)
- /code-generate (RuleCodeGenerateApi)
- /structured-output-generate (RuleStructuredOutputGenerateApi)
2026-02-04 01:49:08 -08:00
GareArc 1ca7d69197
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-04 00:47:44 -08:00
GareArc c56e5a5b71
feat(telemetry): add prompt generation telemetry to Enterprise OTEL
- Add PromptGenerationTraceInfo trace entity with operation_type field
- Implement telemetry for rule-generate, code-generate, structured-output, instruction-modify operations
- Emit metrics: tokens (total/input/output), duration histogram, requests counter, errors counter
- Emit structured logs with model info and operation context
- Content redaction controlled by ENTERPRISE_INCLUDE_CONTENT env var
- Fix user_id propagation in TraceTask kwargs
- Fix latency calculation when llm_result is None

No spans exported - metrics and logs only for lightweight observability.
2026-02-04 00:38:17 -08:00
GareArc aafab3f09a
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-03 21:06:00 -08:00
GareArc bada2d18a1
feat(telemetry): add input/output token metrics and fix trace cleanup
- Add dify.tokens.input and dify.tokens.output OTEL metrics
- Remove token split from trace log attributes (keep metrics only)
- Emit split token metrics for workflows and node executions
- Gracefully handle trace file deletion failures to prevent task crashes

BREAKING: None
MIGRATION: None
2026-02-03 21:05:10 -08:00
GareArc 0b479e639e
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-03 19:30:02 -08:00
GareArc d858cbdc0c
feat(telemetry): add input/output token split to enterprise OTEL traces
- Add PROMPT_TOKENS and COMPLETION_TOKENS to WorkflowNodeExecutionMetadataKey
- Store prompt/completion tokens in node execution metadata JSON (no schema change)
- Calculate workflow-level token split by summing node executions on-the-fly
- Export gen_ai.usage.input_tokens and output_tokens to enterprise telemetry
- Add semantic convention constants for token attributes
- Maintain backward compatibility (historical data shows null)

BREAKING: None
MIGRATION: None (uses JSON metadata, no schema changes)
2026-02-03 19:27:11 -08:00
GareArc 822490d9f4
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-03 01:28:07 -08:00
GareArc ae43fd96bf
feat(telemetry): add invoked_by user tracking to enterprise OTEL 2026-02-03 01:27:16 -08:00
GareArc f627c7fdab
fix(enterprise): Remove OTEL log export 2026-02-02 23:28:48 -08:00
GareArc 956ed5a48c
fix(enterprise): Remove OTEL log export 2026-02-02 23:28:39 -08:00
GareArc ad39040fa8
feat(enterprise): Add independent metrics export with dedicated MeterProvider
- Create dedicated MeterProvider instance (independent from ext_otel.py)
- Add create_metric_exporter() to _ExporterFactory with HTTP/gRPC support
- Enterprise metrics now work without requiring standard OTEL to be enabled
- Add MeterProvider shutdown to cleanup lifecycle
- Update module docstring to reflect full independence (Tracer, Logger, Meter)
2026-02-02 22:41:41 -08:00
GareArc aaf324e150
feat(enterprise): Add independent metrics export with dedicated MeterProvider
- Create dedicated MeterProvider instance (independent from ext_otel.py)
- Add create_metric_exporter() to _ExporterFactory with HTTP/gRPC support
- Enterprise metrics now work without requiring standard OTEL to be enabled
- Add MeterProvider shutdown to cleanup lifecycle
- Update module docstring to reflect full independence (Tracer, Logger, Meter)
2026-02-02 22:41:33 -08:00
GareArc fab985f348
fix(enterprise): Scope log handler to telemetry logger only
Only export structured telemetry logs, not all application logs. The attach_log_handler method now attaches to the 'dify.telemetry' logger instead of the root logger.
2026-02-02 22:15:43 -08:00
GareArc 64e5005e3d
fix(enterprise): Scope log handler to telemetry logger only
Only export structured telemetry logs, not all application logs. The attach_log_handler method now attaches to the 'dify.telemetry' logger instead of the root logger.
2026-02-02 22:15:42 -08:00
GareArc a5b93e13e6
feat(enterprise): Add gRPC protocol support for OTLP telemetry
- Add ENTERPRISE_OTLP_PROTOCOL config (http/grpc, default: http)
- Introduce _ExporterFactory class for protocol-agnostic exporter creation
- Support both HTTP and gRPC OTLP endpoints for traces and logs
- Refactor endpoint path handling into factory methods
2026-02-02 21:47:43 -08:00
GareArc d463a450dd
feat(enterprise): Add gRPC protocol support for OTLP telemetry
- Add ENTERPRISE_OTLP_PROTOCOL config (http/grpc, default: http)
- Introduce _ExporterFactory class for protocol-agnostic exporter creation
- Support both HTTP and gRPC OTLP endpoints for traces and logs
- Refactor endpoint path handling into factory methods
2026-02-02 21:46:22 -08:00
NFish 232916a89d Merge branch 'release/e-1.11.4' into deploy/enterprise 2026-02-03 11:22:21 +08:00
GareArc 87b65f9cf6
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-02 18:21:18 -08:00
GareArc 5f6e90e4d2
feat(enterprise): Add OTEL logs export with span_id correlation
- Add ENTERPRISE_OTEL_LOGS_ENABLED and ENTERPRISE_OTLP_LOGS_ENDPOINT config options
- Implement EnterpriseLoggingHandler for log record translation with trace/span ID parsing
- Add LoggerProvider and BatchLogRecordProcessor for OTLP log export
- Correlate telemetry logs with spans via span_id_source parameter
- Attach log handler during enterprise telemetry initialization
2026-02-02 18:16:58 -08:00
GareArc 54b819709d
Merge branch '1.11.4-otel-telemetry-ee' into deploy/enterprise 2026-02-02 16:09:44 -08:00
GareArc 8fc0cbe20d
feat(enterprise): Add OTEL telemetry with slim traces, metrics, and structured logs
- Add EnterpriseOtelTrace handler with span emission for workflows and nodes
- Implement minimal-span strategy: slim spans + detailed companion logs
- Add deterministic span/trace IDs for cross-workflow trace correlation
- Add metric collection at 100% accuracy (counters & histograms)
- Add event handlers for app lifecycle and feedback telemetry
- Add cross-workflow trace linking with parent context propagation
- Add OTEL exporter with configurable sampling and privacy controls
- Wire enterprise telemetry into workflow execution pipeline
- Add telemetry configuration in enterprise configs
2026-02-02 15:50:43 -08:00
NFish 11959a2cfa Merge branch 'release/e-1.11.4' into deploy/enterprise 2026-01-30 15:36:11 +08:00
NFish c727d99e55
fix: hide invite button if current user is not workspace manager (#31742) 2026-01-30 15:35:11 +08:00
GareArc 915b4ce840
feat: Add parent trace context propagation for workflow-as-tool hierarchy
Enables distributed tracing for nested workflows across all trace providers
(Langfuse, LangSmith, community providers). When a workflow invokes another
workflow via workflow-as-tool, the child workflow now includes parent context
attributes that allow trace systems to reconstruct the full execution tree.

Changes:
- Add parent_trace_context field to WorkflowTool
- Set parent context in tool node when invoking workflow-as-tool
- Extract and pass parent context through app generator

This is a community enhancement (ungated) that improves distributed tracing
for all users. Parent context includes: trace_id, node_execution_id,
workflow_run_id, and app_id.
2026-01-29 20:05:11 -08:00
yunlu.wen af7eb70898 chore: upgrade deps, see pull #30976 2026-01-28 13:22:54 +08:00
yunlu.wen ffc18bf318 chore: upgrade deps, see pull #30976 2026-01-28 13:02:01 +08:00
Yunlu Wen 7623990f7b
chore: sync enterprise release (#31626)
Co-authored-by: zhsama <torvalds@linux.do>
2026-01-28 10:39:35 +08:00
NFish 0c4c912f8a
fix: enterprise CVE 2026 23864 (#31599) 2026-01-27 16:13:18 +08:00
NFish eba305b1c8 Merge branch 'fix/e-CVE-2026-23864' into deploy/enterprise 2026-01-27 16:06:56 +08:00
NFish bfa9cdf6fa fix: regenerate pnpm-lock.yaml 2026-01-27 16:06:42 +08:00
NFish cc661d793b Merge branch 'fix/e-CVE-2026-23864' into deploy/enterprise 2026-01-27 16:02:51 +08:00
NFish 4f27736b60 fix: update @types/react version in resolutions config field 2026-01-27 16:02:37 +08:00
NFish 7907ca698c Merge branch 'fix/e-CVE-2026-23864' into deploy/enterprise 2026-01-27 15:57:52 +08:00
NFish b5b82d0fa3 fix: CVE-2026-23864 for enterprise edtion 2026-01-27 15:57:21 +08:00
GareArc 6fd5df658c
fix: add TYPE_CHECKING import for Account type annotation 2026-01-26 16:08:09 -08:00
GareArc 69b11cc364
security: fix IDOR and privilege escalation in set_default_provider
- Add tenant_id verification to prevent IDOR attacks
- Add admin check for enterprise tenant-wide default changes
- Preserve non-enterprise behavior (users can set own defaults)
2026-01-26 16:01:06 -08:00
GareArc 57721225b9
fix: remove user_id filter when clearing default provider (enterprise only)
When setting a new default credential in enterprise mode, the code was
only clearing is_default for credentials matching the current user_id.
This caused issues when:
1. Enterprise credential A (synced with system user_id) was default
2. User sets local credential B as default
3. A still had is_default=true (different user_id)
4. Both A and B were considered defaults

The fix removes user_id from the filter only for enterprise deployments,
since enterprise credentials may have different user_id than local ones.
Non-enterprise behavior is unchanged to avoid breaking existing setups.

Fixes EE-1511
2026-01-26 15:43:13 -08:00
GareArc 68dfb3d4d9
feat: add redis mq for account deletion cleanup 2026-01-25 22:38:19 -08:00
Xiyuan Chen 7058de7a88
feat: implement workspace permission checks for member invitations an… (#31202) 2026-01-25 21:21:58 -08:00
NFish 9c75061bdd feat: ee workspace permission control (#30841) 2026-01-26 13:16:02 +08:00
wangxiaolei d7509e6cdd
fix: fix visibilityState event handle (#31354) 2026-01-22 11:25:20 +08:00
wangxiaolei 5cd11a0071
fix: remove _try_resolve_user_from_request (#31360) 2026-01-22 11:25:06 +08:00
wangxiaolei 37c2f3d4b6
fix: fix instance is not bind to session (#30913) 2026-01-21 17:05:13 +08:00
CodingOnStar fa56c53aaf fix(i18n): update model provider tip to only mention OpenAI in English, Japanese, and Simplified Chinese translations 2026-01-21 15:50:49 +08:00
CodingOnStar 500428331b chore(web): comment out unused provider entries in quota panel 2026-01-21 11:28:38 +08:00