mirror of
https://github.com/langgenius/dify.git
synced 2026-05-11 14:58:23 +08:00
fe8510ad1a
Adds a CLI-friendly authorization flow so difyctl (and future
non-browser clients) can obtain user-scoped tokens without copy-
pasting cookies or raw API keys. Two grant paths share one device
flow surface:
1. Account branch — user signs in via the existing /signin
methods, /device page calls console-authed approve, mints a
dfoa_ token tied to (account_id, tenant).
2. External-SSO branch (EE) — /v1/oauth/device/sso-initiate signs
an SSOState envelope, hands off to Enterprise's external ACS,
receives a signed external-subject assertion, mints a dfoe_
token tied to (subject_email, subject_issuer).
API surface (all under /v1, EE-only endpoints 404 on CE):
POST /v1/oauth/device/code — RFC 8628 start
POST /v1/oauth/device/token — RFC 8628 poll
GET /v1/oauth/device/lookup — pre-validate user_code
GET /v1/oauth/device/sso-initiate — SSO branch entry
GET /v1/device/sso-complete — SSO callback sink
GET /v1/oauth/device/approval-context — /device cookie probe
POST /v1/oauth/device/approve-external — SSO approve
GET /v1/me — bearer subject lookup
DELETE /v1/oauth/authorizations/self — self-revoke
POST /console/api/oauth/device/approve — account approve
POST /console/api/oauth/device/deny — account deny
Core primitives:
- libs/oauth_bearer.py: prefix-keyed TokenKindRegistry +
BearerAuthenticator + validate_bearer decorator. Two-tier scope
(full vs apps:run) stamped from the registry, never from the DB.
- libs/jws.py: HS256 compact JWS keyed on the shared Dify
SECRET_KEY — same key-set verifies the SSOState envelope, the
external-subject assertion (minted by Enterprise), and the
approval-grant cookie.
- libs/device_flow_security.py: enterprise_only gate, approval-
grant cookie mint/verify/consume (Path=/v1/oauth/device,
HttpOnly, SameSite=Lax, Secure follows is_secure()), anti-
framing headers.
- libs/rate_limit.py: typed RateLimit / RateLimitScope dispatch
with composite-key buckets; both decorator + imperative form.
- services/oauth_device_flow.py: Redis state machine (PENDING ->
APPROVED|DENIED with atomic consume-on-poll), token mint via
partial unique index uq_oauth_active_per_device (rotates in
place), env-driven TTL policy.
Storage: oauth_access_tokens table with partial unique index on
(subject_email, subject_issuer, client_id, device_label) WHERE
revoked_at IS NULL. account_id NULL distinguishes external-SSO
rows. Hard-expire is CAS UPDATE (revoked_at + nullify token_hash)
so audit events keep their token_id. Retention pruner DELETEs
revoked + zombie-expired rows past OAUTH_ACCESS_TOKEN_RETENTION_DAYS.
Frontend: /device page with code-entry, chooser (account vs SSO),
authorize-account, authorize-sso views. SSO branch detaches from
the URL user_code and reads everything from the cookie via
/approval-context. Anti-framing headers on all responses.
Wiring: ENABLE_OAUTH_BEARER feature flag; ext_oauth_bearer binds
the authenticator at startup; clean_oauth_access_tokens_task
scheduled in ext_celery.
Spec: docs/specs/v1.0/server/{device-flow,tokens,middleware,security}.md
54 lines
1.7 KiB
TypeScript
54 lines
1.7 KiB
TypeScript
import type { NextConfig } from '@/next'
|
|
import createMDX from '@next/mdx'
|
|
import { codeInspectorPlugin } from 'code-inspector-plugin'
|
|
import { env } from './env'
|
|
|
|
const isDev = process.env.NODE_ENV === 'development'
|
|
const withMDX = createMDX()
|
|
|
|
const nextConfig: NextConfig = {
|
|
basePath: env.NEXT_PUBLIC_BASE_PATH,
|
|
transpilePackages: ['@t3-oss/env-core', '@t3-oss/env-nextjs', 'echarts', 'zrender'],
|
|
turbopack: {
|
|
rules: codeInspectorPlugin({
|
|
bundler: 'turbopack',
|
|
}),
|
|
},
|
|
productionBrowserSourceMaps: false, // enable browser source map generation during the production build
|
|
// Configure pageExtensions to include md and mdx
|
|
pageExtensions: ['ts', 'tsx', 'js', 'jsx', 'md', 'mdx'],
|
|
typescript: {
|
|
// https://nextjs.org/docs/api-reference/next.config.js/ignoring-typescript-errors
|
|
ignoreBuildErrors: true,
|
|
},
|
|
async redirects() {
|
|
return [
|
|
{
|
|
source: '/',
|
|
destination: '/apps',
|
|
permanent: false,
|
|
},
|
|
]
|
|
},
|
|
// Anti-framing for device-flow surfaces. A framed /device page could UI-trick
|
|
// a victim with a valid device_approval_grant cookie into approving a
|
|
// device_code — functionally CSRF, bypasses the double-submit token. Deny
|
|
// framing outright on every device-flow route; no trusted embedder exists.
|
|
async headers() {
|
|
const antiFrame = [
|
|
{ key: 'X-Frame-Options', value: 'DENY' },
|
|
{ key: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
|
|
]
|
|
return [
|
|
{ source: '/device', headers: antiFrame },
|
|
{ source: '/device/:path*', headers: antiFrame },
|
|
]
|
|
},
|
|
output: 'standalone',
|
|
compiler: {
|
|
removeConsole: isDev ? false : { exclude: ['warn', 'error'] },
|
|
},
|
|
}
|
|
|
|
export default withMDX(nextConfig)
|