* fix: available dependencies in sandbox
* fix: better url validation and prevent arbitrary url injection into the sandbox
* fix: permissions in docker
* revert: all docker-related changes
* fix: review feedback
* update: node version
* fix: lint issues
* add: missing dependency in ci for faiss
* fix: pin pnpm version
* fix: more dependency issues
* fix: even more dependency issues
* update: pnpm overrides
* revert: experimental changes
* feat: implement scheduling functionality for AgentflowV2
- Added ScheduleQueue class for managing scheduled jobs using BullMQ.
- Introduced scheduleService for creating, updating, and disabling schedules.
- Integrated schedule validation and cron expression handling.
- Enhanced chatflow service to manage schedules for agentflows.
- Added UI components for time and day selection (TimePicker, WeekDaysPicker, MonthDaysPicker).
- Updated NodeInputHandler to support new input types for scheduling.
- Improved validation for schedule configurations in agentflows.
* feat: implement schedule management for agentflows
- Refactor ScheduleQueue to utilize executeScheduleJob for job execution.
- Add new endpoints for schedule status retrieval and enabling/disabling schedules in chatflows.
- Update chatflow service to handle schedule creation, updates, and deletions more effectively.
- Introduce DatePicker component for date input in UI.
- Enhance CanvasHeader to manage schedule state and toggle functionality.
- Integrate schedule validation logic to ensure proper configuration before enabling schedules.
- Update dependencies to include node-cron for improved scheduling capabilities.
* feat(schedule): refactor schedule services and tests for schedule job
- Seperate the utils function from schedule service.
- Created comprehensive unit tests for all utility functions in `utils.test.ts`, covering various scenarios for cron expression validation, visual picker validation, and schedule resolution.
- Ensured proper handling of edge cases and error messages for invalid inputs.
* feat(schedule): remove timestamp in schedule tabes to support sqlite
- Change the way to update the existing schedule to avoid typescript issue when building.
- Add merge function in mockRepo in schedule service test.
* fix(schedule): add nullable to optional entity columns and entity interfaces
- Add nullable: true to lastRunAt, nextRunAt, endDate on ScheduleRecord
entity to match migration DDL and prevent runtime errors
- Add IScheduleRecord and IScheduleTriggerLog interfaces to Interface.ts
- Have entities implement their respective interfaces per codebase convention
* fixed tests and hide schedule input from package/agentflow
* feat: integrate IdentityManager into worker and queue management
- Remove supporting cron express with 6 fields (second)
- Calculate the prediction usage in cron job
* feat: add support for MIN_SCHEDULE_INTERVAL_SECONDS in cron job configuration and validation
* fixed broken tests
* UI UX fixes for scheduler in dark mode
* fix(schedule): remove unnecessary UUID generation in createOrUpdateSchedule
* adds required scheduleInputMode column with text/form/none variants, ChatType.SCHEDULED, trigger-logs endpoint + drawer UI, IANA timezone dropdown, and dark-mode UX polish.
* add deleteScheduleTriggerLogs endpoint and UI integration for log deletion
* feat: enhance cron job handling for last day of month (L) in ScheduleBeat and related utilities
Co-authored-by: Copilot <[email protected]>
* - fix(start-node): persist declared defaults of newly-visible fields so saves don't drop required values
- update ui for last day to include hints and next run datetime
---------
Co-authored-by: Jackie Chui <[email protected]>
Co-authored-by: Henry <[email protected]>
Co-authored-by: Copilot <[email protected]>
* feat: implement the custom MCP Server in tool
- Implemented MCPServersTable for displaying MCP server data with status badges and tools count.
- Created CustomMcpServerDialog for adding and editing custom MCP servers with validation and authorization features.
- Integrated MCP server management into the Tools view with tabbed navigation for Custom Tools and Custom MCP Servers.
- Added pagination and loading states for MCP servers.
* tfix nodes.test.ts ESM load crash
* feat(custom-mcp): harden security, scalability, and UI polish
* enhance custom mcp server creation flow and UI updates
* feat(mcp): add MCP server handshake timeout, enhance UI UX for editing custom mcp server
---------
Co-authored-by: Henry <[email protected]>
* Fix isPathTraversal method to be less strict
* Fix isPathTraversal method to be less strict
* Control isPathTraversal via an Env Var
* Path traversal check env var
---------
Co-authored-by: christopherholland-workday <[email protected]>
* fix: make TOKEN_HASH_SECRET required and add check on server start
* fix: make EXPRESS_SESSION_SECRET required and add check on server start
* fix: make jwt variables required and validate on server start
* fix: formatting
* fix: cypress tests
* fix: remove env file for cypress and refactor
* revert: changes to workflow and env examples
* update: how missing/weak default secrets are handled
* update: how auth secrets are setup and read
* fix: update env examples for docker
* fix: weak defaults list
* fix: weak defaults list
---------
Co-authored-by: yau-wd <[email protected]>
Co-authored-by: yau-wd <[email protected]>
* feat(database.util.ts): add function to check if column exists in table
* feat(migrations): add permission column to apikey table
* chore(services/apikey): remove auto-create default API key
* chore: remove auto-create default API key
* fix(migrations): rename permission to permissions in apikey table
* feat(services/apikey): add permissions to create and update
* feat(views/apikey): add permissions to create and update
* feat(api): use API key permissions instead of role permissions
* feat(permissions): filter by user.permissions except for ROLE type
* feat(services/apikey): filter keys by user permissions in getAllApiKeys
* feat(services/apikey): limit API key permissions to user permissions during creation/update
* fix(database.util.ts): replace non-null assertion with explicit error handling
* feat(services/apikey): log errors for malformed API key permissions
* refactor(services/apikey): extract permission validation
* feat(permission): enhance permission filtering based on user features and platform type
* chore(migrations): lower API key permission value
* Update packages/ui/src/views/apikey/APIKeyDialog.jsx
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update packages/ui/src/views/apikey/APIKeyDialog.jsx
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* refactor: remove deprecated APIKEY_PATH and APIKEY migration
* refactor(apikey): remove functionality related to import apikey
* feat(permission): filter out workspace and admin categories for non-ROLE
* feat(services/apikey): validate API key permissions during create and update
* chore(migrations): clean up role permissions values
* fix(migrations): handle corrupted permissions gracefully
* fix(server/src/index.ts): add error handling for API key permissions parsing
* fix(APIKeyDialog.jsx): handle corrupted permissions when editing API key
* fix(views/apikey/index.jsx): handle corrupted permissions in API key list
* fix(services/apikey): validate permissions JSON in API key operations
* Potential fix for code scanning alert no. 83: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* feat(migrations): change ApiKey.permissions column from TEXT to JSON
* Update packages/server/src/services/apikey/index.ts
Co-authored-by: Jocelyn Lin <[email protected]>
* feat(PricingDialog.jsx): handle downgrade with excessive apikey permissions
* feat(controllers\apikey): enforce permissions validation
* chore(services/apikey): remove redundant null checks
* fix(services/dataset): throw error when dataset not found before fetching rows
---------
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Jocelyn Lin <[email protected]>
* Sanitize sensitive fields in request header and body in logger
* fix: log request headers, body, and query only when debug logs are enabled
* fix: add missing env to examples
* fix: crash due to missing env vars
feat: enhance security validation for MCP configurations
- Added environment variable checks for CUSTOM_MCP_SECURITY_CHECK, CUSTOM_MCP_PROTOCOL, and HTTP_DENY_LIST across various Docker and application files.
- Implemented validation functions in MCP core to prevent command injection and ensure safe environment variable usage
Ilango