mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-05-21 15:36:48 +00:00
feat(auth): authentication module with multi-tenant isolation (RFC-001)
Introduce an always-on auth layer with auto-created admin on first boot, multi-tenant isolation for threads/stores, and a full setup/login flow. Backend - JWT access tokens with `ver` field for stale-token rejection; bump on password/email change - Password hashing, HttpOnly+Secure cookies (Secure derived from request scheme at runtime) - CSRF middleware covering both REST and LangGraph routes - IP-based login rate limiting (5 attempts / 5-min lockout) with bounded dict growth and X-Forwarded-For bypass fix - Multi-worker-safe admin auto-creation (single DB write, WAL once) - needs_setup + token_version on User model; SQLite schema migration - Thread/store isolation by owner; orphan thread migration on first admin registration - thread_id validated as UUID to prevent log injection - CLI tool to reset admin password - Decorator-based authz module extracted from auth core Frontend - Login and setup pages with SSR guard for needs_setup flow - Account settings page (change password / email) - AuthProvider + route guards; skips redirect when no users registered - i18n (en-US / zh-CN) for auth surfaces - Typed auth API client; parseAuthError unwraps FastAPI detail envelope Infra & tooling - Unified `serve.sh` with gateway mode + auto dep install - Public PyPI uv.toml pin for CI compatibility - Regenerated uv.lock with public index Tests - HTTP vs HTTPS cookie security tests - Auth middleware, rate limiter, CSRF, setup flow coverage
This commit is contained in:
greatmengqi
@@ -19,8 +19,6 @@ services:
|
||||
# cluster via the K8s API.
|
||||
# Backend accesses sandboxes directly via host.docker.internal:{NodePort}.
|
||||
provisioner:
|
||||
profiles:
|
||||
- provisioner
|
||||
build:
|
||||
context: ./provisioner
|
||||
dockerfile: Dockerfile
|
||||
@@ -59,20 +57,25 @@ services:
|
||||
|
||||
# ── Reverse Proxy ──────────────────────────────────────────────────────
|
||||
# Routes API traffic to gateway/langgraph and (optionally) provisioner.
|
||||
# Select nginx config via NGINX_CONF:
|
||||
# - nginx.local.conf (default): no provisioner route (local/aio modes)
|
||||
# - nginx.conf: includes provisioner route (provisioner mode)
|
||||
# LANGGRAPH_UPSTREAM and LANGGRAPH_REWRITE control gateway vs standard
|
||||
# routing (processed by envsubst at container start).
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
container_name: deer-flow-nginx
|
||||
ports:
|
||||
- "2026:2026"
|
||||
volumes:
|
||||
- ./nginx/${NGINX_CONF:-nginx.conf}:/etc/nginx/nginx.conf:ro
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf.template:ro
|
||||
environment:
|
||||
- LANGGRAPH_UPSTREAM=${LANGGRAPH_UPSTREAM:-langgraph:2024}
|
||||
- LANGGRAPH_REWRITE=${LANGGRAPH_REWRITE:-/}
|
||||
command: >
|
||||
sh -c "envsubst '$$LANGGRAPH_UPSTREAM $$LANGGRAPH_REWRITE'
|
||||
< /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
|
||||
&& nginx -g 'daemon off;'"
|
||||
depends_on:
|
||||
- frontend
|
||||
- gateway
|
||||
- langgraph
|
||||
networks:
|
||||
- deer-flow-dev
|
||||
restart: unless-stopped
|
||||
@@ -102,6 +105,7 @@ services:
|
||||
- CI=true
|
||||
- DEER_FLOW_INTERNAL_GATEWAY_BASE_URL=http://gateway:8001
|
||||
- DEER_FLOW_INTERNAL_LANGGRAPH_BASE_URL=http://langgraph:2024
|
||||
- NEXT_PUBLIC_LANGGRAPH_BASE_URL=${NEXT_PUBLIC_LANGGRAPH_BASE_URL:-}
|
||||
env_file:
|
||||
- ../frontend/.env
|
||||
networks:
|
||||
@@ -113,6 +117,7 @@ services:
|
||||
build:
|
||||
context: ../
|
||||
dockerfile: backend/Dockerfile
|
||||
target: dev
|
||||
# cache_from disabled - requires manual setup: mkdir -p /tmp/docker-cache-gateway
|
||||
args:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
@@ -169,13 +174,14 @@ services:
|
||||
build:
|
||||
context: ../
|
||||
dockerfile: backend/Dockerfile
|
||||
target: dev
|
||||
# cache_from disabled - requires manual setup: mkdir -p /tmp/docker-cache-langgraph
|
||||
args:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
UV_IMAGE: ${UV_IMAGE:-ghcr.io/astral-sh/uv:0.7.20}
|
||||
UV_INDEX_URL: ${UV_INDEX_URL:-https://pypi.org/simple}
|
||||
container_name: deer-flow-langgraph
|
||||
command: sh -c "cd backend && uv sync && uv run langgraph dev --no-browser --allow-blocking --host 0.0.0.0 --port 2024 --n-jobs-per-worker 10 > /app/logs/langgraph.log 2>&1"
|
||||
command: sh -c "cd backend && uv sync && allow_blocking='' && if [ \"\${LANGGRAPH_ALLOW_BLOCKING:-0}\" = '1' ]; then allow_blocking='--allow-blocking'; fi && uv run langgraph dev --no-browser \${allow_blocking} --host 0.0.0.0 --port 2024 --n-jobs-per-worker \${LANGGRAPH_JOBS_PER_WORKER:-10} > /app/logs/langgraph.log 2>&1"
|
||||
volumes:
|
||||
- ../backend/:/app/backend/
|
||||
# Preserve the .venv built during Docker image build — mounting the full backend/
|
||||
|
||||
@@ -29,11 +29,17 @@ services:
|
||||
ports:
|
||||
- "${PORT:-2026}:2026"
|
||||
volumes:
|
||||
- ./nginx/${NGINX_CONF:-nginx.conf}:/etc/nginx/nginx.conf:ro
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf.template:ro
|
||||
environment:
|
||||
- LANGGRAPH_UPSTREAM=${LANGGRAPH_UPSTREAM:-langgraph:2024}
|
||||
- LANGGRAPH_REWRITE=${LANGGRAPH_REWRITE:-/}
|
||||
command: >
|
||||
sh -c "envsubst '$$LANGGRAPH_UPSTREAM $$LANGGRAPH_REWRITE'
|
||||
< /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
|
||||
&& nginx -g 'daemon off;'"
|
||||
depends_on:
|
||||
- frontend
|
||||
- gateway
|
||||
- langgraph
|
||||
networks:
|
||||
- deer-flow
|
||||
restart: unless-stopped
|
||||
@@ -52,6 +58,7 @@ services:
|
||||
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
|
||||
- DEER_FLOW_INTERNAL_GATEWAY_BASE_URL=http://gateway:8001
|
||||
- DEER_FLOW_INTERNAL_LANGGRAPH_BASE_URL=http://langgraph:2024
|
||||
- NEXT_PUBLIC_LANGGRAPH_BASE_URL=${NEXT_PUBLIC_LANGGRAPH_BASE_URL:-}
|
||||
env_file:
|
||||
- ../frontend/.env
|
||||
networks:
|
||||
@@ -67,8 +74,10 @@ services:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
UV_IMAGE: ${UV_IMAGE:-ghcr.io/astral-sh/uv:0.7.20}
|
||||
UV_INDEX_URL: ${UV_INDEX_URL:-https://pypi.org/simple}
|
||||
NODE_DIST_URL: ${NODE_DIST_URL:-}
|
||||
NODE_VERSION: ${NODE_VERSION:-22.16.0}
|
||||
container_name: deer-flow-gateway
|
||||
command: sh -c "cd backend && PYTHONPATH=. uv run uvicorn app.gateway.app:app --host 0.0.0.0 --port 8001 --workers 2"
|
||||
command: sh -c "cd backend && PYTHONPATH=. uv run uvicorn app.gateway.app:app --host 0.0.0.0 --port 8001 --workers ${GATEWAY_WORKERS:-4}"
|
||||
volumes:
|
||||
- ${DEER_FLOW_CONFIG_PATH}:/app/backend/config.yaml:ro
|
||||
- ${DEER_FLOW_EXTENSIONS_CONFIG_PATH}:/app/backend/extensions_config.json:ro
|
||||
@@ -118,8 +127,10 @@ services:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
UV_IMAGE: ${UV_IMAGE:-ghcr.io/astral-sh/uv:0.7.20}
|
||||
UV_INDEX_URL: ${UV_INDEX_URL:-https://pypi.org/simple}
|
||||
NODE_DIST_URL: ${NODE_DIST_URL:-}
|
||||
NODE_VERSION: ${NODE_VERSION:-22.16.0}
|
||||
container_name: deer-flow-langgraph
|
||||
command: sh -c "cd /app/backend && uv run langgraph dev --no-browser --allow-blocking --no-reload --host 0.0.0.0 --port 2024 --n-jobs-per-worker 10"
|
||||
command: sh -c 'cd /app/backend && allow_blocking_flag="" && if [ "${LANGGRAPH_ALLOW_BLOCKING:-0}" = "1" ]; then allow_blocking_flag="--allow-blocking"; fi && uv run langgraph dev --no-browser ${allow_blocking_flag} --no-reload --host 0.0.0.0 --port 2024 --n-jobs-per-worker ${LANGGRAPH_JOBS_PER_WORKER:-10}'
|
||||
volumes:
|
||||
- ${DEER_FLOW_CONFIG_PATH}:/app/backend/config.yaml:ro
|
||||
- ${DEER_FLOW_EXTENSIONS_CONFIG_PATH}:/app/backend/extensions_config.json:ro
|
||||
@@ -160,13 +171,12 @@ services:
|
||||
|
||||
# ── Sandbox Provisioner (optional, Kubernetes mode) ────────────────────────
|
||||
provisioner:
|
||||
profiles:
|
||||
- provisioner
|
||||
build:
|
||||
context: ./provisioner
|
||||
dockerfile: Dockerfile
|
||||
args:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
PIP_INDEX_URL: ${PIP_INDEX_URL:-}
|
||||
container_name: deer-flow-provisioner
|
||||
volumes:
|
||||
- ~/.kube/config:/root/.kube/config:ro
|
||||
|
||||
+21
-38
@@ -18,21 +18,20 @@ http {
|
||||
resolver 127.0.0.11 valid=10s ipv6=off;
|
||||
|
||||
# Upstream servers (using Docker service names)
|
||||
# NOTE: add `resolve` so nginx re-resolves container IPs after restarts.
|
||||
# Otherwise nginx may keep stale DNS results and proxy to the wrong container.
|
||||
# NOTE: `zone` and `resolve` are nginx Plus-only features and are not
|
||||
# available in the standard nginx:alpine image. Docker's internal DNS
|
||||
# (127.0.0.11) handles service discovery; upstreams are resolved at
|
||||
# nginx startup and remain valid for the lifetime of the deployment.
|
||||
upstream gateway {
|
||||
zone gateway 64k;
|
||||
server gateway:8001 resolve;
|
||||
server gateway:8001;
|
||||
}
|
||||
|
||||
upstream langgraph {
|
||||
zone langgraph 64k;
|
||||
server langgraph:2024 resolve;
|
||||
server ${LANGGRAPH_UPSTREAM};
|
||||
}
|
||||
|
||||
upstream frontend {
|
||||
zone frontend 64k;
|
||||
server frontend:3000 resolve;
|
||||
server frontend:3000;
|
||||
}
|
||||
|
||||
# ── Main server (path-based routing) ─────────────────────────────────
|
||||
@@ -58,9 +57,11 @@ http {
|
||||
}
|
||||
|
||||
# LangGraph API routes
|
||||
# Rewrites /api/langgraph/* to /* before proxying
|
||||
# In standard mode: /api/langgraph/* → langgraph:2024 (rewrite to /*)
|
||||
# In gateway mode: /api/langgraph/* → gateway:8001 (rewrite to /api/*)
|
||||
# Controlled by LANGGRAPH_UPSTREAM and LANGGRAPH_REWRITE env vars.
|
||||
location /api/langgraph/ {
|
||||
rewrite ^/api/langgraph/(.*) /$1 break;
|
||||
rewrite ^/api/langgraph/(.*) ${LANGGRAPH_REWRITE}$1 break;
|
||||
proxy_pass http://langgraph;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
@@ -85,34 +86,6 @@ http {
|
||||
chunked_transfer_encoding on;
|
||||
}
|
||||
|
||||
# Experimental: Gateway-backed LangGraph-compatible API
|
||||
# Frontend can opt-in via NEXT_PUBLIC_LANGGRAPH_BASE_URL=/api/langgraph-compat
|
||||
location /api/langgraph-compat/ {
|
||||
rewrite ^/api/langgraph-compat/(.*) /api/$1 break;
|
||||
proxy_pass http://gateway;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# Headers
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Connection '';
|
||||
|
||||
# SSE/Streaming support
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_set_header X-Accel-Buffering no;
|
||||
|
||||
# Timeouts for long-running requests
|
||||
proxy_connect_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
proxy_read_timeout 600s;
|
||||
|
||||
# Chunked transfer encoding
|
||||
chunked_transfer_encoding on;
|
||||
}
|
||||
|
||||
# Custom API: Models endpoint
|
||||
location /api/models {
|
||||
proxy_pass http://gateway;
|
||||
@@ -217,6 +190,16 @@ http {
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Auth API (gateway)
|
||||
location /api/v1/auth/ {
|
||||
proxy_pass http://gateway;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Health check endpoint (gateway)
|
||||
location /health {
|
||||
proxy_pass http://gateway;
|
||||
|
||||
@@ -144,6 +144,16 @@ http {
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Auth API routes (served by gateway)
|
||||
location /api/v1/auth/ {
|
||||
proxy_pass http://gateway;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Custom API: Agents endpoint
|
||||
location /api/agents {
|
||||
proxy_pass http://gateway;
|
||||
@@ -179,8 +189,8 @@ http {
|
||||
}
|
||||
|
||||
# API Documentation: Swagger UI
|
||||
location /docs {
|
||||
proxy_pass http://gateway;
|
||||
location /api/docs {
|
||||
proxy_pass http://gateway/docs ;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
@@ -189,8 +199,8 @@ http {
|
||||
}
|
||||
|
||||
# API Documentation: ReDoc
|
||||
location /redoc {
|
||||
proxy_pass http://gateway;
|
||||
location /api/redoc {
|
||||
proxy_pass http://gateway/redoc;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
FROM python:3.12-slim-bookworm
|
||||
|
||||
ARG APT_MIRROR
|
||||
ARG PIP_INDEX_URL
|
||||
|
||||
# Optionally override apt mirror for restricted networks (e.g. APT_MIRROR=mirrors.aliyun.com)
|
||||
RUN if [ -n "${APT_MIRROR}" ]; then \
|
||||
@@ -15,6 +16,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
|
||||
# Install Python dependencies
|
||||
RUN pip install --no-cache-dir \
|
||||
${PIP_INDEX_URL:+--index-url "$PIP_INDEX_URL"} \
|
||||
fastapi \
|
||||
"uvicorn[standard]" \
|
||||
kubernetes
|
||||
|
||||
Reference in New Issue
Block a user