langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #23812] Feature/workspace api authentication #30407

New Issue
Open
opened 2026-02-21 20:47:26 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:47:26 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/23812

State: open
Merged: No

Workspace API Authentication System Implementation

Important

  1. Make sure you have read our contribution guidelines
  2. Ensure there is an associated issue and you have been assigned to it
  3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

This PR implements comprehensive workspace API authentication with scoped permissions for the Dify platform. It introduces a robust API key system that allows granular access control to workspace resources while maintaining security best practices.

Key Features Implemented:

  1. Workspace API Key Management

    • Full CRUD operations for workspace API keys
    • Secure token generation with RSA encryption
    • Automatic expiration handling and validation
    • Last usage tracking for security monitoring

  2. Scoped Permission System

    • Hierarchical scope validation (admin > write > read)
    • Resource-specific permissions (workspace, apps, members)
    • Role-based access control integration
    • Comprehensive scope validation utilities

  3. Authentication Infrastructure

    • Decorator-based authentication for workspace API endpoints
    • Database-backed permission verification
    • Secure header-based token authentication
    • Request context integration for authenticated requests

  4. API Endpoints

    • Console endpoints for API key management (/console/api/workspaces/current/api-keys)
    • Workspace API endpoints with scoped authentication
    • Scope discovery endpoints for client integration
    • Token regeneration and secure key rotation

  5. Comprehensive Testing

    • 35+ unit tests covering all authentication scenarios
    • Edge case testing for malformed requests and error conditions
    • Mock-based testing to avoid external dependencies
    • Performance testing for large scope lists

Technical Implementation:

  • Security: RSA-based token encryption with configurable key management
  • Database: New WorkspaceApiKey model with proper indexing and relationships
  • Architecture: Service layer pattern with clear separation of concerns
  • Validation: Input validation with detailed error messages and type checking
  • Documentation: Comprehensive docstrings and usage examples

This implementation provides a foundation for secure workspace-level API access while maintaining compatibility with existing Dify authentication systems.

Files Added/Modified:

  • models/workspace_api_key.py - New database model for API keys
  • services/workspace_api_key_service.py - Core business logic
  • controllers/console/workspace/api_keys.py - Console management endpoints
  • controllers/workspace/ - Workspace API endpoints with authentication
  • libs/login.py - Authentication decorators and utilities
  • constants/workspace_scopes.py - Scope definitions and validation
  • tests/unit_tests/ - Comprehensive test suite (35+ tests)

close #23834

Screenshots

Before After
No workspace API authentication system Complete workspace API key management with scoped permissions
Manual workspace access control Automated, scalable API authentication with role-based permissions

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods

Additional Notes:

  • Test Coverage: 35 comprehensive unit tests ensuring robust functionality
  • Security: All authentication tokens are properly encrypted and validated
  • Performance: Efficient scope checking with minimal database queries
  • Backward Compatibility: No breaking changes to existing API endpoints
  • Error Handling: Comprehensive error handling with informative messages
  • Code Quality: All linting rules passed and code follows project standards
**Original Pull Request:** https://github.com/langgenius/dify/pull/23812 **State:** open **Merged:** No --- # Workspace API Authentication System Implementation > [!IMPORTANT] > > 1. Make sure you have read our [contribution guidelines](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) > 2. Ensure there is an associated issue and you have been assigned to it > 3. Use the correct syntax to link this PR: `Fixes #<issue number>`. ## Summary This PR implements comprehensive workspace API authentication with scoped permissions for the Dify platform. It introduces a robust API key system that allows granular access control to workspace resources while maintaining security best practices. ### Key Features Implemented: 1. **Workspace API Key Management** - Full CRUD operations for workspace API keys - Secure token generation with RSA encryption - Automatic expiration handling and validation - Last usage tracking for security monitoring 2. **Scoped Permission System** - Hierarchical scope validation (admin > write > read) - Resource-specific permissions (workspace, apps, members) - Role-based access control integration - Comprehensive scope validation utilities 3. **Authentication Infrastructure** - Decorator-based authentication for workspace API endpoints - Database-backed permission verification - Secure header-based token authentication - Request context integration for authenticated requests 4. **API Endpoints** - Console endpoints for API key management (`/console/api/workspaces/current/api-keys`) - Workspace API endpoints with scoped authentication - Scope discovery endpoints for client integration - Token regeneration and secure key rotation 5. **Comprehensive Testing** - 35+ unit tests covering all authentication scenarios - Edge case testing for malformed requests and error conditions - Mock-based testing to avoid external dependencies - Performance testing for large scope lists ### Technical Implementation: - **Security**: RSA-based token encryption with configurable key management - **Database**: New `WorkspaceApiKey` model with proper indexing and relationships - **Architecture**: Service layer pattern with clear separation of concerns - **Validation**: Input validation with detailed error messages and type checking - **Documentation**: Comprehensive docstrings and usage examples This implementation provides a foundation for secure workspace-level API access while maintaining compatibility with existing Dify authentication systems. ### Files Added/Modified: - `models/workspace_api_key.py` - New database model for API keys - `services/workspace_api_key_service.py` - Core business logic - `controllers/console/workspace/api_keys.py` - Console management endpoints - `controllers/workspace/` - Workspace API endpoints with authentication - `libs/login.py` - Authentication decorators and utilities - `constants/workspace_scopes.py` - Scope definitions and validation - `tests/unit_tests/` - Comprehensive test suite (35+ tests) close #23834 ## Screenshots | Before | After | |--------|-------| | No workspace API authentication system | Complete workspace API key management with scoped permissions | | Manual workspace access control | Automated, scalable API authentication with role-based permissions | ## Checklist - [x] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [x] I've updated the documentation accordingly. - [x] I ran `dev/reformat`(backend) and `cd web && npx lint-staged`(frontend) to appease the lint gods ### Additional Notes: - **Test Coverage**: 35 comprehensive unit tests ensuring robust functionality - **Security**: All authentication tokens are properly encrypted and validated - **Performance**: Efficient scope checking with minimal database queries - **Backward Compatibility**: No breaking changes to existing API endpoints - **Error Handling**: Comprehensive error handling with informative messages - **Code Quality**: All linting rules passed and code follows project standards
yindo added the pull-request label 2026-02-21 20:47:26 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#30407
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?