874406d934
security(api): fix privilege escalation vulnerability in model config and chat message APIs (#25518)
The `ChatMessageApi` (`POST /console/api/apps/{app_id}/chat-messages`) and
`ModelConfigResource` (`POST /console/api/apps/{app_id}/model-config`)
endpoints do not properly validate user permissions, allowing users without `editor`
permission to access restricted functionality.
This PR addresses this issue by adding proper permission check.
1 місяць тому
cbc0e639e4
update sql in batch (#24801)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
1 місяць тому
b51c724a94
refactor: Migrate part of the console basic API module to Flask-RESTX (#24732)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
1 місяць тому
08dd3f7b50
Fix basedpyright type errors (#25435)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
1 місяць тому
38057b1b0e
add typing to all wraps (#25405)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
1 місяць тому
4aba570fa8
Fix flask response: 200 -> {}, 200 (#25404)
1 місяць тому
64c9a2f678
Feat/credential policy (#25151)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
1 місяць тому
ea61420441
Revert "feat: email register refactor" (#25367)
1 місяць тому
860ee20c71
feat: email register refactor (#25344)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
1 місяць тому
f891c67eca
feat: add MCP server headers support #22718 (#24760)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
Co-authored-by: Novice <novice12185727@gmail.com>
1 місяць тому
f6059ef389
add more typing (#24949)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
1 місяць тому
16a3e21410
more assert (#24996)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
1 місяць тому
9b8a03b53b
[Chore/Refactor] Improve type annotations in models module (#25281)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
1 місяць тому
a78339a040
remove bare list, dict, Sequence, None, Any (#25058)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
1 місяць тому
865ba8bb4f
Minor fix: correct get_app_model mode for delete() (#25082)
Signed-off-by: Yongtao Huang <yongtaoh2022@gmail.com>
2 місяці тому
a9c7669c16
chore: comply to RFC 6750 and improve bearer token split (#24955)
2 місяці тому
b673560b92
feat: improve multi model credentials (#25009)
Co-authored-by: Claude <noreply@anthropic.com>
2 місяці тому
9d5956cef8
[Chore/Refactor] Switch from MyPy to Basedpyright for type checking (#25047)
Signed-off-by: -LAN- <laipz8200@outlook.com>
2 місяці тому
1fff4620e6
clean console apis and rag cleans. (#25042)
Signed-off-by: zhanluxianshen <zhanluxianshen@163.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
5092e5f631
fix: workflow not published (#25030)
2 місяці тому
bc9efa7ea8
Refactor: use DatasourceType.XX.value instead of hardcoded (#25015)
Signed-off-by: Yongtao Huang <yongtaoh2022@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
25a11bfafc
Export DSL from history (#24939)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
68c75f221b
fix: workflow log status filter add parial success status (#24977)
2 місяці тому
7b379e2a61
chore: apply ty checks on api code with script and ci action (#24653)
2 місяці тому
067b0d07c4
Fix: ensure InstalledApp deletion uses model instances instead of Row (#24942)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
e048588a88
fix: remove duplicated code (#24893)
2 місяці тому
2e6e414a9e
the conversion OAuthGrantType(parsed_args["grant_type"]) can raise ValueError for invalid values which is not caught and will produce a 500 (#24854)
2 місяці тому
c45d676477
remove duplicated authorization header handling and bearer should be case-insensitive (#24852)
2 місяці тому
24e2b72b71
Update ast-grep pattern for session.query (#24828)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
f32e176d6a
feat: oauth provider (#24206)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yessenia <yessenia.contact@gmail.com>
2 місяці тому
ecf74d91e2
✨fix: has_more logic in ChatMessageListApi to ensure correct on behavior when no more messages are available. (#24661)
2 місяці тому
2a29c61041
Refactor: replace count() > 0 check with exists() (#24583)
Co-authored-by: Yongtao Huang <99629139+hyongtao-db@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
826f19e968
Chore : rm dead code detected by pylance (#24588)
2 місяці тому
b486d72b8e
Chore: remove dead var in `DocumentBatchIndexingEstimateApi` (#24497)
Co-authored-by: Yongtao Huang <99629139+hyongtao-db@users.noreply.github.com>
2 місяці тому
fa753239ad
Refactor: use logger = logging.getLogger(__name__) in logging (#24515)
Co-authored-by: Yongtao Huang <99629139+hyongtao-db@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
2 місяці тому
cfb8d224da
fix: standardize authentication error messages to prevent user enumeration (#24324)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
ac5aed7a45
Fix missing return 200 in response handling (#24499)
Co-authored-by: Yongtao Huang <99629139+hyongtao-db@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
2b91ba2411
example: limit current user usage (#24470)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
6010d5f24c
feat: add multi model credentials (#24451)
Co-authored-by: zxhlyh <jasonapring2015@outlook.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
b08bfa203a
fix(flask_restx): invite member email parse error (#24464)
2 місяці тому
a06681913d
remove: document download file permission (#24459)
2 місяці тому
a9e106b17e
fix: Fix login error handling by raising exception instead of returning (#24452)
2 місяці тому
3aedc139ac
fix delete conversations via Api and delete conversations from db as well (#23591)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: crazywoola <427733928@qq.com>
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2 місяці тому
b7466f8b65
feat: API docs for service api (#24425)
Signed-off-by: -LAN- <laipz8200@outlook.com>
2 місяці тому
18dce66443
try flask_restful -> flask_restx (#24310)
Signed-off-by: -LAN- <laipz8200@outlook.com>
Co-authored-by: -LAN- <laipz8200@outlook.com>
2 місяці тому
8a348bea21
fix child-chunk ownership validation (#24374)
Signed-off-by: kenwoodjw <blackxin55+@gmail.com>
2 місяці тому
5ab6bc283c
[CHORE]: x: T = None to x: Optional[T] = None (#24217)
2 місяці тому
1abf1240b2
refactor: replace try-except blocks with contextlib.suppress for cleaner exception handling (#24284)
2 місяці тому
cfefe4f738
Feat: Education (#24208)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
c2606f9062
fix: correct behaviour of code fix (#24152)
Co-authored-by: Joel <iamjoel007@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2 місяці тому
QuantumGhost
Asuka Minato
Guangdong Liu
-LAN-
Yongtao Huang
Xiyuan Chen
zyssyz123
Cluas
NeatGuyCoding
非法操作
湛露先生
Will
GuanMu
Novice
Bowen Liang
jiangbo721
Junyan Qin (Chin)
Eric Guo
quicksand
znn
kenwoodjw
willzhao
Stream