mirror of
https://github.com/langgenius/dify.git
synced 2026-05-09 12:59:18 +08:00
a07b32274a
GET /openapi/v1/workspaces lists tenants the bearer's account is a member of. GET /openapi/v1/workspaces/<id> returns one workspace detail, member-gated (404 on non-member, never 403, so workspace IDs don't leak across tenants). Bearer-authed via @validate_bearer(accept=ACCEPT_USER_ANY). External SSO bearers (no account_id) get an empty list / 404 — same posture as GET /openapi/v1/account. Cookie-authed /console/api/workspaces stays in console for the dashboard SPA — different consumer, different auth model. No legacy /v1/ remount this phase. Plan: docs/superpowers/plans/2026-04-26-openapi-migration.md (in difyctl repo).
30 lines
675 B
Python
30 lines
675 B
Python
from flask import Blueprint
|
|
from flask_restx import Namespace
|
|
|
|
from libs.device_flow_security import attach_anti_framing
|
|
from libs.external_api import ExternalApi
|
|
|
|
bp = Blueprint("openapi", __name__, url_prefix="/openapi/v1")
|
|
attach_anti_framing(bp)
|
|
|
|
api = ExternalApi(
|
|
bp,
|
|
version="1.0",
|
|
title="OpenAPI",
|
|
description="User-scoped programmatic API (bearer auth)",
|
|
)
|
|
|
|
openapi_ns = Namespace("openapi", description="User-scoped operations", path="/")
|
|
|
|
from . import account, index, oauth_device, oauth_device_sso, workspaces
|
|
|
|
__all__ = [
|
|
"account",
|
|
"index",
|
|
"oauth_device",
|
|
"oauth_device_sso",
|
|
"workspaces",
|
|
]
|
|
|
|
api.add_namespace(openapi_ns)
|