mirror of
https://github.com/langgenius/dify.git
synced 2026-05-13 08:57:28 +08:00
0c7e7e0c4e
Port the complete infrastructure for agent sandbox execution and skill system: Sandbox & Virtual Environment (core/sandbox/, core/virtual_environment/): - Sandbox entity with lifecycle management (ready/failed/cancelled states) - SandboxBuilder with fluent API for configuring providers - 5 VM providers: Local, SSH, Docker, E2B, AWS CodeInterpreter - VirtualEnvironment base with command execution, file transfer, transport layers - Channel transport: pipe, queue, socket implementations - Bash session management and DifyCli binary integration - Storage: archive storage, file storage, noop storage, presign storage - Initializers: DifyCli, AppAssets, DraftAppAssets, Skills - Inspector: file browser, archive/runtime source, script utils - Security: encryption utils, debug helpers Skill & App Assets (core/skill/, core/app_assets/, core/app_bundle/): - Skill entity and manager - App asset accessor, builder pipeline (file, skill builders) - App bundle source zip extractor - Storage and converter utilities API Endpoints: - CLI API blueprint (controllers/cli_api/) for sandbox callback - Sandbox provider management (workspace/sandbox_providers) - Sandbox file browser (console/sandbox_files) - App asset management (console/app/app_asset) - Skill management (console/app/skills) - Storage file endpoints (controllers/files/storage_files) Services: - Sandbox service, provider service, file service - App asset service, app bundle service Config: - CliApiConfig, CreatorsPlatformConfig, CollaborationConfig - FILES_API_URL for sandbox file access Note: Controller route registration temporarily commented out (marked TODO) pending resolution of deep dependency chains (socketio, workflow_comment, command node, etc.). Core sandbox modules are fully ported and syntax-validated. 110 files changed, 10,549 insertions. Made-with: Cursor
57 lines
1.5 KiB
Python
57 lines
1.5 KiB
Python
import hashlib
|
|
import hmac
|
|
import time
|
|
from collections.abc import Callable
|
|
from functools import wraps
|
|
from typing import ParamSpec, TypeVar
|
|
|
|
from flask import abort, g, request
|
|
|
|
from core.session.cli_api import CliApiSessionManager
|
|
|
|
P = ParamSpec("P")
|
|
R = TypeVar("R")
|
|
|
|
SIGNATURE_TTL_SECONDS = 300
|
|
|
|
|
|
def _verify_signature(session_secret: str, timestamp: str, body: bytes, signature: str) -> bool:
|
|
expected = hmac.new(
|
|
session_secret.encode(),
|
|
f"{timestamp}.".encode() + body,
|
|
hashlib.sha256,
|
|
).hexdigest()
|
|
return hmac.compare_digest(f"sha256={expected}", signature)
|
|
|
|
|
|
def cli_api_only(view: Callable[P, R]):
|
|
@wraps(view)
|
|
def decorated(*args: P.args, **kwargs: P.kwargs):
|
|
session_id = request.headers.get("X-Cli-Api-Session-Id")
|
|
timestamp = request.headers.get("X-Cli-Api-Timestamp")
|
|
signature = request.headers.get("X-Cli-Api-Signature")
|
|
|
|
if not session_id or not timestamp or not signature:
|
|
abort(401)
|
|
|
|
try:
|
|
ts = int(timestamp)
|
|
if abs(time.time() - ts) > SIGNATURE_TTL_SECONDS:
|
|
abort(401)
|
|
except ValueError:
|
|
abort(401)
|
|
|
|
session = CliApiSessionManager().get(session_id)
|
|
if not session:
|
|
abort(401)
|
|
|
|
body = request.get_data()
|
|
if not _verify_signature(session.secret, timestamp, body, signature):
|
|
abort(401)
|
|
|
|
g.cli_api_session = session
|
|
|
|
return view(*args, **kwargs)
|
|
|
|
return decorated
|