Initial commit

dify_0.15.3/api/controllers/web/__init__.py

@@ -0,0 +1,18 @@
+from flask import Blueprint
+
+from libs.external_api import ExternalApi
+
+from .files import FileApi
+from .remote_files import RemoteFileInfoApi, RemoteFileUploadApi
+
+bp = Blueprint("web", __name__, url_prefix="/api")
+api = ExternalApi(bp)
+
+# Files
+api.add_resource(FileApi, "/files/upload")
+
+# Remote files
+api.add_resource(RemoteFileInfoApi, "/remote-files/<path:url>")
+api.add_resource(RemoteFileUploadApi, "/remote-files/upload")
+
+from . import app, audio, completion, conversation, feature, message, passport, saved_message, site, workflow

dify_0.15.3/api/controllers/web/app.py

@@ -0,0 +1,46 @@
+from flask_restful import marshal_with  # type: ignore
+
+from controllers.common import fields
+from controllers.common import helpers as controller_helpers
+from controllers.web import api
+from controllers.web.error import AppUnavailableError
+from controllers.web.wraps import WebApiResource
+from models.model import App, AppMode
+from services.app_service import AppService
+
+
+class AppParameterApi(WebApiResource):
+    """Resource for app variables."""
+
+    @marshal_with(fields.parameters_fields)
+    def get(self, app_model: App, end_user):
+        """Retrieve app parameters."""
+        if app_model.mode in {AppMode.ADVANCED_CHAT.value, AppMode.WORKFLOW.value}:
+            workflow = app_model.workflow
+            if workflow is None:
+                raise AppUnavailableError()
+
+            features_dict = workflow.features_dict
+            user_input_form = workflow.user_input_form(to_old_structure=True)
+        else:
+            app_model_config = app_model.app_model_config
+            if app_model_config is None:
+                raise AppUnavailableError()
+
+            features_dict = app_model_config.to_dict()
+
+            user_input_form = features_dict.get("user_input_form", [])
+
+        return controller_helpers.get_parameters_from_feature_dict(
+            features_dict=features_dict, user_input_form=user_input_form
+        )
+
+
+class AppMeta(WebApiResource):
+    def get(self, app_model: App, end_user):
+        """Get app meta"""
+        return AppService().get_app_meta(app_model)
+
+
+api.add_resource(AppParameterApi, "/parameters")
+api.add_resource(AppMeta, "/meta")

dify_0.15.3/api/controllers/web/audio.py

@@ -0,0 +1,125 @@
+import logging
+
+from flask import request
+from werkzeug.exceptions import InternalServerError
+
+import services
+from controllers.web import api
+from controllers.web.error import (
+    AppUnavailableError,
+    AudioTooLargeError,
+    CompletionRequestError,
+    NoAudioUploadedError,
+    ProviderModelCurrentlyNotSupportError,
+    ProviderNotInitializeError,
+    ProviderNotSupportSpeechToTextError,
+    ProviderQuotaExceededError,
+    UnsupportedAudioTypeError,
+)
+from controllers.web.wraps import WebApiResource
+from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
+from core.model_runtime.errors.invoke import InvokeError
+from models.model import App, AppMode
+from services.audio_service import AudioService
+from services.errors.audio import (
+    AudioTooLargeServiceError,
+    NoAudioUploadedServiceError,
+    ProviderNotSupportSpeechToTextServiceError,
+    UnsupportedAudioTypeServiceError,
+)
+
+
+class AudioApi(WebApiResource):
+    def post(self, app_model: App, end_user):
+        file = request.files["file"]
+
+        try:
+            response = AudioService.transcript_asr(app_model=app_model, file=file, end_user=end_user)
+
+            return response
+        except services.errors.app_model_config.AppModelConfigBrokenError:
+            logging.exception("App model config broken.")
+            raise AppUnavailableError()
+        except NoAudioUploadedServiceError:
+            raise NoAudioUploadedError()
+        except AudioTooLargeServiceError as e:
+            raise AudioTooLargeError(str(e))
+        except UnsupportedAudioTypeServiceError:
+            raise UnsupportedAudioTypeError()
+        except ProviderNotSupportSpeechToTextServiceError:
+            raise ProviderNotSupportSpeechToTextError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception as e:
+            logging.exception("Failed to handle post request to AudioApi")
+            raise InternalServerError()
+
+
+class TextApi(WebApiResource):
+    def post(self, app_model: App, end_user):
+        from flask_restful import reqparse  # type: ignore
+
+        try:
+            parser = reqparse.RequestParser()
+            parser.add_argument("message_id", type=str, required=False, location="json")
+            parser.add_argument("voice", type=str, location="json")
+            parser.add_argument("text", type=str, location="json")
+            parser.add_argument("streaming", type=bool, location="json")
+            args = parser.parse_args()
+
+            message_id = args.get("message_id", None)
+            text = args.get("text", None)
+            if (
+                app_model.mode in {AppMode.ADVANCED_CHAT.value, AppMode.WORKFLOW.value}
+                and app_model.workflow
+                and app_model.workflow.features_dict
+            ):
+                text_to_speech = app_model.workflow.features_dict.get("text_to_speech", {})
+                voice = args.get("voice") or text_to_speech.get("voice")
+            else:
+                try:
+                    voice = args.get("voice") or app_model.app_model_config.text_to_speech_dict.get("voice")
+                except Exception:
+                    voice = None
+
+            response = AudioService.transcript_tts(
+                app_model=app_model, message_id=message_id, end_user=end_user.external_user_id, voice=voice, text=text
+            )
+
+            return response
+        except services.errors.app_model_config.AppModelConfigBrokenError:
+            logging.exception("App model config broken.")
+            raise AppUnavailableError()
+        except NoAudioUploadedServiceError:
+            raise NoAudioUploadedError()
+        except AudioTooLargeServiceError as e:
+            raise AudioTooLargeError(str(e))
+        except UnsupportedAudioTypeServiceError:
+            raise UnsupportedAudioTypeError()
+        except ProviderNotSupportSpeechToTextServiceError:
+            raise ProviderNotSupportSpeechToTextError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception as e:
+            logging.exception("Failed to handle post request to TextApi")
+            raise InternalServerError()
+
+
+api.add_resource(AudioApi, "/audio-to-text")
+api.add_resource(TextApi, "/text-to-audio")

dify_0.15.3/api/controllers/web/completion.py

@@ -0,0 +1,155 @@
+import logging
+
+from flask_restful import reqparse  # type: ignore
+from werkzeug.exceptions import InternalServerError, NotFound
+
+import services
+from controllers.web import api
+from controllers.web.error import (
+    AppUnavailableError,
+    CompletionRequestError,
+    ConversationCompletedError,
+    NotChatAppError,
+    NotCompletionAppError,
+    ProviderModelCurrentlyNotSupportError,
+    ProviderNotInitializeError,
+    ProviderQuotaExceededError,
+)
+from controllers.web.error import InvokeRateLimitError as InvokeRateLimitHttpError
+from controllers.web.wraps import WebApiResource
+from core.app.apps.base_app_queue_manager import AppQueueManager
+from core.app.entities.app_invoke_entities import InvokeFrom
+from core.errors.error import (
+    ModelCurrentlyNotSupportError,
+    ProviderTokenNotInitError,
+    QuotaExceededError,
+)
+from core.model_runtime.errors.invoke import InvokeError
+from libs import helper
+from libs.helper import uuid_value
+from models.model import AppMode
+from services.app_generate_service import AppGenerateService
+from services.errors.llm import InvokeRateLimitError
+
+
+# define completion api for user
+class CompletionApi(WebApiResource):
+    def post(self, app_model, end_user):
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("inputs", type=dict, required=True, location="json")
+        parser.add_argument("query", type=str, location="json", default="")
+        parser.add_argument("files", type=list, required=False, location="json")
+        parser.add_argument("response_mode", type=str, choices=["blocking", "streaming"], location="json")
+        parser.add_argument("retriever_from", type=str, required=False, default="web_app", location="json")
+
+        args = parser.parse_args()
+
+        streaming = args["response_mode"] == "streaming"
+        args["auto_generate_name"] = False
+
+        try:
+            response = AppGenerateService.generate(
+                app_model=app_model, user=end_user, args=args, invoke_from=InvokeFrom.WEB_APP, streaming=streaming
+            )
+
+            return helper.compact_generate_response(response)
+        except services.errors.conversation.ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+        except services.errors.conversation.ConversationCompletedError:
+            raise ConversationCompletedError()
+        except services.errors.app_model_config.AppModelConfigBrokenError:
+            logging.exception("App model config broken.")
+            raise AppUnavailableError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception as e:
+            logging.exception("internal server error.")
+            raise InternalServerError()
+
+
+class CompletionStopApi(WebApiResource):
+    def post(self, app_model, end_user, task_id):
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        AppQueueManager.set_stop_flag(task_id, InvokeFrom.WEB_APP, end_user.id)
+
+        return {"result": "success"}, 200
+
+
+class ChatApi(WebApiResource):
+    def post(self, app_model, end_user):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("inputs", type=dict, required=True, location="json")
+        parser.add_argument("query", type=str, required=True, location="json")
+        parser.add_argument("files", type=list, required=False, location="json")
+        parser.add_argument("response_mode", type=str, choices=["blocking", "streaming"], location="json")
+        parser.add_argument("conversation_id", type=uuid_value, location="json")
+        parser.add_argument("parent_message_id", type=uuid_value, required=False, location="json")
+        parser.add_argument("retriever_from", type=str, required=False, default="web_app", location="json")
+
+        args = parser.parse_args()
+
+        streaming = args["response_mode"] == "streaming"
+        args["auto_generate_name"] = False
+
+        try:
+            response = AppGenerateService.generate(
+                app_model=app_model, user=end_user, args=args, invoke_from=InvokeFrom.WEB_APP, streaming=streaming
+            )
+
+            return helper.compact_generate_response(response)
+        except services.errors.conversation.ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+        except services.errors.conversation.ConversationCompletedError:
+            raise ConversationCompletedError()
+        except services.errors.app_model_config.AppModelConfigBrokenError:
+            logging.exception("App model config broken.")
+            raise AppUnavailableError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeRateLimitError as ex:
+            raise InvokeRateLimitHttpError(ex.description)
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception as e:
+            logging.exception("internal server error.")
+            raise InternalServerError()
+
+
+class ChatStopApi(WebApiResource):
+    def post(self, app_model, end_user, task_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        AppQueueManager.set_stop_flag(task_id, InvokeFrom.WEB_APP, end_user.id)
+
+        return {"result": "success"}, 200
+
+
+api.add_resource(CompletionApi, "/completion-messages")
+api.add_resource(CompletionStopApi, "/completion-messages/<string:task_id>/stop")
+api.add_resource(ChatApi, "/chat-messages")
+api.add_resource(ChatStopApi, "/chat-messages/<string:task_id>/stop")

dify_0.15.3/api/controllers/web/conversation.py

@@ -0,0 +1,128 @@
+from flask_restful import marshal_with, reqparse  # type: ignore
+from flask_restful.inputs import int_range  # type: ignore
+from sqlalchemy.orm import Session
+from werkzeug.exceptions import NotFound
+
+from controllers.web import api
+from controllers.web.error import NotChatAppError
+from controllers.web.wraps import WebApiResource
+from core.app.entities.app_invoke_entities import InvokeFrom
+from extensions.ext_database import db
+from fields.conversation_fields import conversation_infinite_scroll_pagination_fields, simple_conversation_fields
+from libs.helper import uuid_value
+from models.model import AppMode
+from services.conversation_service import ConversationService
+from services.errors.conversation import ConversationNotExistsError, LastConversationNotExistsError
+from services.web_conversation_service import WebConversationService
+
+
+class ConversationListApi(WebApiResource):
+    @marshal_with(conversation_infinite_scroll_pagination_fields)
+    def get(self, app_model, end_user):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("last_id", type=uuid_value, location="args")
+        parser.add_argument("limit", type=int_range(1, 100), required=False, default=20, location="args")
+        parser.add_argument("pinned", type=str, choices=["true", "false", None], location="args")
+        parser.add_argument(
+            "sort_by",
+            type=str,
+            choices=["created_at", "-created_at", "updated_at", "-updated_at"],
+            required=False,
+            default="-updated_at",
+            location="args",
+        )
+        args = parser.parse_args()
+
+        pinned = None
+        if "pinned" in args and args["pinned"] is not None:
+            pinned = args["pinned"] == "true"
+
+        try:
+            with Session(db.engine) as session:
+                return WebConversationService.pagination_by_last_id(
+                    session=session,
+                    app_model=app_model,
+                    user=end_user,
+                    last_id=args["last_id"],
+                    limit=args["limit"],
+                    invoke_from=InvokeFrom.WEB_APP,
+                    pinned=pinned,
+                    sort_by=args["sort_by"],
+                )
+        except LastConversationNotExistsError:
+            raise NotFound("Last Conversation Not Exists.")
+
+
+class ConversationApi(WebApiResource):
+    def delete(self, app_model, end_user, c_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        conversation_id = str(c_id)
+        try:
+            ConversationService.delete(app_model, conversation_id, end_user)
+        except ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+        WebConversationService.unpin(app_model, conversation_id, end_user)
+
+        return {"result": "success"}, 204
+
+
+class ConversationRenameApi(WebApiResource):
+    @marshal_with(simple_conversation_fields)
+    def post(self, app_model, end_user, c_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        conversation_id = str(c_id)
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("name", type=str, required=False, location="json")
+        parser.add_argument("auto_generate", type=bool, required=False, default=False, location="json")
+        args = parser.parse_args()
+
+        try:
+            return ConversationService.rename(app_model, conversation_id, end_user, args["name"], args["auto_generate"])
+        except ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+
+
+class ConversationPinApi(WebApiResource):
+    def patch(self, app_model, end_user, c_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        conversation_id = str(c_id)
+
+        try:
+            WebConversationService.pin(app_model, conversation_id, end_user)
+        except ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+
+        return {"result": "success"}
+
+
+class ConversationUnPinApi(WebApiResource):
+    def patch(self, app_model, end_user, c_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        conversation_id = str(c_id)
+        WebConversationService.unpin(app_model, conversation_id, end_user)
+
+        return {"result": "success"}
+
+
+api.add_resource(ConversationRenameApi, "/conversations/<uuid:c_id>/name", endpoint="web_conversation_name")
+api.add_resource(ConversationListApi, "/conversations")
+api.add_resource(ConversationApi, "/conversations/<uuid:c_id>")
+api.add_resource(ConversationPinApi, "/conversations/<uuid:c_id>/pin")
+api.add_resource(ConversationUnPinApi, "/conversations/<uuid:c_id>/unpin")

dify_0.15.3/api/controllers/web/error.py

@@ -0,0 +1,135 @@
+from libs.exception import BaseHTTPException
+
+
+class AppUnavailableError(BaseHTTPException):
+    error_code = "app_unavailable"
+    description = "App unavailable, please check your app configurations."
+    code = 400
+
+
+class NotCompletionAppError(BaseHTTPException):
+    error_code = "not_completion_app"
+    description = "Please check if your Completion app mode matches the right API route."
+    code = 400
+
+
+class NotChatAppError(BaseHTTPException):
+    error_code = "not_chat_app"
+    description = "Please check if your app mode matches the right API route."
+    code = 400
+
+
+class NotWorkflowAppError(BaseHTTPException):
+    error_code = "not_workflow_app"
+    description = "Please check if your Workflow app mode matches the right API route."
+    code = 400
+
+
+class ConversationCompletedError(BaseHTTPException):
+    error_code = "conversation_completed"
+    description = "The conversation has ended. Please start a new conversation."
+    code = 400
+
+
+class ProviderNotInitializeError(BaseHTTPException):
+    error_code = "provider_not_initialize"
+    description = (
+        "No valid model provider credentials found. "
+        "Please go to Settings -> Model Provider to complete your provider credentials."
+    )
+    code = 400
+
+
+class ProviderQuotaExceededError(BaseHTTPException):
+    error_code = "provider_quota_exceeded"
+    description = (
+        "Your quota for Dify Hosted OpenAI has been exhausted. "
+        "Please go to Settings -> Model Provider to complete your own provider credentials."
+    )
+    code = 400
+
+
+class ProviderModelCurrentlyNotSupportError(BaseHTTPException):
+    error_code = "model_currently_not_support"
+    description = "Dify Hosted OpenAI trial currently not support the GPT-4 model."
+    code = 400
+
+
+class CompletionRequestError(BaseHTTPException):
+    error_code = "completion_request_error"
+    description = "Completion request failed."
+    code = 400
+
+
+class AppMoreLikeThisDisabledError(BaseHTTPException):
+    error_code = "app_more_like_this_disabled"
+    description = "The 'More like this' feature is disabled. Please refresh your page."
+    code = 403
+
+
+class AppSuggestedQuestionsAfterAnswerDisabledError(BaseHTTPException):
+    error_code = "app_suggested_questions_after_answer_disabled"
+    description = "The 'Suggested Questions After Answer' feature is disabled. Please refresh your page."
+    code = 403
+
+
+class NoAudioUploadedError(BaseHTTPException):
+    error_code = "no_audio_uploaded"
+    description = "Please upload your audio."
+    code = 400
+
+
+class AudioTooLargeError(BaseHTTPException):
+    error_code = "audio_too_large"
+    description = "Audio size exceeded. {message}"
+    code = 413
+
+
+class UnsupportedAudioTypeError(BaseHTTPException):
+    error_code = "unsupported_audio_type"
+    description = "Audio type not allowed."
+    code = 415
+
+
+class ProviderNotSupportSpeechToTextError(BaseHTTPException):
+    error_code = "provider_not_support_speech_to_text"
+    description = "Provider not support speech to text."
+    code = 400
+
+
+class NoFileUploadedError(BaseHTTPException):
+    error_code = "no_file_uploaded"
+    description = "Please upload your file."
+    code = 400
+
+
+class TooManyFilesError(BaseHTTPException):
+    error_code = "too_many_files"
+    description = "Only one file is allowed."
+    code = 400
+
+
+class FileTooLargeError(BaseHTTPException):
+    error_code = "file_too_large"
+    description = "File size exceeded. {message}"
+    code = 413
+
+
+class UnsupportedFileTypeError(BaseHTTPException):
+    error_code = "unsupported_file_type"
+    description = "File type not allowed."
+    code = 415
+
+
+class WebSSOAuthRequiredError(BaseHTTPException):
+    error_code = "web_sso_auth_required"
+    description = "Web SSO authentication required."
+    code = 401
+
+
+class InvokeRateLimitError(BaseHTTPException):
+    """Raised when the Invoke returns rate limit error."""
+
+    error_code = "rate_limit_error"
+    description = "Rate Limit Error"
+    code = 429

dify_0.15.3/api/controllers/web/feature.py

@@ -0,0 +1,12 @@
+from flask_restful import Resource  # type: ignore
+
+from controllers.web import api
+from services.feature_service import FeatureService
+
+
+class SystemFeatureApi(Resource):
+    def get(self):
+        return FeatureService.get_system_features().model_dump()
+
+
+api.add_resource(SystemFeatureApi, "/system-features")

dify_0.15.3/api/controllers/web/files.py

@@ -0,0 +1,43 @@
+from flask import request
+from flask_restful import marshal_with  # type: ignore
+
+import services
+from controllers.common.errors import FilenameNotExistsError
+from controllers.web.error import FileTooLargeError, NoFileUploadedError, TooManyFilesError, UnsupportedFileTypeError
+from controllers.web.wraps import WebApiResource
+from fields.file_fields import file_fields
+from services.file_service import FileService
+
+
+class FileApi(WebApiResource):
+    @marshal_with(file_fields)
+    def post(self, app_model, end_user):
+        file = request.files["file"]
+        source = request.form.get("source")
+
+        if "file" not in request.files:
+            raise NoFileUploadedError()
+
+        if len(request.files) > 1:
+            raise TooManyFilesError()
+
+        if not file.filename:
+            raise FilenameNotExistsError
+
+        if source not in ("datasets", None):
+            source = None
+
+        try:
+            upload_file = FileService.upload_file(
+                filename=file.filename,
+                content=file.read(),
+                mimetype=file.mimetype,
+                user=end_user,
+                source="datasets" if source == "datasets" else None,
+            )
+        except services.errors.file.FileTooLargeError as file_too_large_error:
+            raise FileTooLargeError(file_too_large_error.description)
+        except services.errors.file.UnsupportedFileTypeError:
+            raise UnsupportedFileTypeError()
+
+        return upload_file, 201

dify_0.15.3/api/controllers/web/message.py

@@ -0,0 +1,205 @@
+import logging
+
+from flask_restful import fields, marshal_with, reqparse  # type: ignore
+from flask_restful.inputs import int_range  # type: ignore
+from werkzeug.exceptions import InternalServerError, NotFound
+
+import services
+from controllers.web import api
+from controllers.web.error import (
+    AppMoreLikeThisDisabledError,
+    AppSuggestedQuestionsAfterAnswerDisabledError,
+    CompletionRequestError,
+    NotChatAppError,
+    NotCompletionAppError,
+    ProviderModelCurrentlyNotSupportError,
+    ProviderNotInitializeError,
+    ProviderQuotaExceededError,
+)
+from controllers.web.wraps import WebApiResource
+from core.app.entities.app_invoke_entities import InvokeFrom
+from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
+from core.model_runtime.errors.invoke import InvokeError
+from fields.conversation_fields import message_file_fields
+from fields.message_fields import agent_thought_fields
+from fields.raws import FilesContainedField
+from libs import helper
+from libs.helper import TimestampField, uuid_value
+from models.model import AppMode
+from services.app_generate_service import AppGenerateService
+from services.errors.app import MoreLikeThisDisabledError
+from services.errors.conversation import ConversationNotExistsError
+from services.errors.message import MessageNotExistsError, SuggestedQuestionsAfterAnswerDisabledError
+from services.message_service import MessageService
+
+
+class MessageListApi(WebApiResource):
+    feedback_fields = {"rating": fields.String}
+
+    retriever_resource_fields = {
+        "id": fields.String,
+        "message_id": fields.String,
+        "position": fields.Integer,
+        "dataset_id": fields.String,
+        "dataset_name": fields.String,
+        "document_id": fields.String,
+        "document_name": fields.String,
+        "data_source_type": fields.String,
+        "segment_id": fields.String,
+        "score": fields.Float,
+        "hit_count": fields.Integer,
+        "word_count": fields.Integer,
+        "segment_position": fields.Integer,
+        "index_node_hash": fields.String,
+        "content": fields.String,
+        "created_at": TimestampField,
+    }
+
+    message_fields = {
+        "id": fields.String,
+        "conversation_id": fields.String,
+        "parent_message_id": fields.String,
+        "inputs": FilesContainedField,
+        "query": fields.String,
+        "answer": fields.String(attribute="re_sign_file_url_answer"),
+        "message_files": fields.List(fields.Nested(message_file_fields)),
+        "feedback": fields.Nested(feedback_fields, attribute="user_feedback", allow_null=True),
+        "retriever_resources": fields.List(fields.Nested(retriever_resource_fields)),
+        "created_at": TimestampField,
+        "agent_thoughts": fields.List(fields.Nested(agent_thought_fields)),
+        "status": fields.String,
+        "error": fields.String,
+    }
+
+    message_infinite_scroll_pagination_fields = {
+        "limit": fields.Integer,
+        "has_more": fields.Boolean,
+        "data": fields.List(fields.Nested(message_fields)),
+    }
+
+    @marshal_with(message_infinite_scroll_pagination_fields)
+    def get(self, app_model, end_user):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotChatAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("conversation_id", required=True, type=uuid_value, location="args")
+        parser.add_argument("first_id", type=uuid_value, location="args")
+        parser.add_argument("limit", type=int_range(1, 100), required=False, default=20, location="args")
+        args = parser.parse_args()
+
+        try:
+            return MessageService.pagination_by_first_id(
+                app_model, end_user, args["conversation_id"], args["first_id"], args["limit"]
+            )
+        except services.errors.conversation.ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+        except services.errors.message.FirstMessageNotExistsError:
+            raise NotFound("First Message Not Exists.")
+
+
+class MessageFeedbackApi(WebApiResource):
+    def post(self, app_model, end_user, message_id):
+        message_id = str(message_id)
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("rating", type=str, choices=["like", "dislike", None], location="json")
+        parser.add_argument("content", type=str, location="json", default=None)
+        args = parser.parse_args()
+
+        try:
+            MessageService.create_feedback(
+                app_model=app_model,
+                message_id=message_id,
+                user=end_user,
+                rating=args.get("rating"),
+                content=args.get("content"),
+            )
+        except services.errors.message.MessageNotExistsError:
+            raise NotFound("Message Not Exists.")
+
+        return {"result": "success"}
+
+
+class MessageMoreLikeThisApi(WebApiResource):
+    def get(self, app_model, end_user, message_id):
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        message_id = str(message_id)
+
+        parser = reqparse.RequestParser()
+        parser.add_argument(
+            "response_mode", type=str, required=True, choices=["blocking", "streaming"], location="args"
+        )
+        args = parser.parse_args()
+
+        streaming = args["response_mode"] == "streaming"
+
+        try:
+            response = AppGenerateService.generate_more_like_this(
+                app_model=app_model,
+                user=end_user,
+                message_id=message_id,
+                invoke_from=InvokeFrom.WEB_APP,
+                streaming=streaming,
+            )
+
+            return helper.compact_generate_response(response)
+        except MessageNotExistsError:
+            raise NotFound("Message Not Exists.")
+        except MoreLikeThisDisabledError:
+            raise AppMoreLikeThisDisabledError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception:
+            logging.exception("internal server error.")
+            raise InternalServerError()
+
+
+class MessageSuggestedQuestionApi(WebApiResource):
+    def get(self, app_model, end_user, message_id):
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
+            raise NotCompletionAppError()
+
+        message_id = str(message_id)
+
+        try:
+            questions = MessageService.get_suggested_questions_after_answer(
+                app_model=app_model, user=end_user, message_id=message_id, invoke_from=InvokeFrom.WEB_APP
+            )
+        except MessageNotExistsError:
+            raise NotFound("Message not found")
+        except ConversationNotExistsError:
+            raise NotFound("Conversation not found")
+        except SuggestedQuestionsAfterAnswerDisabledError:
+            raise AppSuggestedQuestionsAfterAnswerDisabledError()
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except Exception:
+            logging.exception("internal server error.")
+            raise InternalServerError()
+
+        return {"data": questions}
+
+
+api.add_resource(MessageListApi, "/messages")
+api.add_resource(MessageFeedbackApi, "/messages/<uuid:message_id>/feedbacks")
+api.add_resource(MessageMoreLikeThisApi, "/messages/<uuid:message_id>/more-like-this")
+api.add_resource(MessageSuggestedQuestionApi, "/messages/<uuid:message_id>/suggested-questions")

dify_0.15.3/api/controllers/web/passport.py

@@ -0,0 +1,76 @@
+import uuid
+
+from flask import request
+from flask_restful import Resource  # type: ignore
+from werkzeug.exceptions import NotFound, Unauthorized
+
+from controllers.web import api
+from controllers.web.error import WebSSOAuthRequiredError
+from extensions.ext_database import db
+from libs.passport import PassportService
+from models.model import App, EndUser, Site
+from services.enterprise.enterprise_service import EnterpriseService
+from services.feature_service import FeatureService
+
+
+class PassportResource(Resource):
+    """Base resource for passport."""
+
+    def get(self):
+        system_features = FeatureService.get_system_features()
+        app_code = request.headers.get("X-App-Code")
+        if app_code is None:
+            raise Unauthorized("X-App-Code header is missing.")
+
+        if system_features.sso_enforced_for_web:
+            app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+            if app_web_sso_enabled:
+                raise WebSSOAuthRequiredError()
+
+        # get site from db and check if it is normal
+        site = db.session.query(Site).filter(Site.code == app_code, Site.status == "normal").first()
+        if not site:
+            raise NotFound()
+        # get app from db and check if it is normal and enable_site
+        app_model = db.session.query(App).filter(App.id == site.app_id).first()
+        if not app_model or app_model.status != "normal" or not app_model.enable_site:
+            raise NotFound()
+
+        end_user = EndUser(
+            tenant_id=app_model.tenant_id,
+            app_id=app_model.id,
+            type="browser",
+            is_anonymous=True,
+            session_id=generate_session_id(),
+        )
+
+        db.session.add(end_user)
+        db.session.commit()
+
+        payload = {
+            "iss": site.app_id,
+            "sub": "Web API Passport",
+            "app_id": site.app_id,
+            "app_code": app_code,
+            "end_user_id": end_user.id,
+        }
+
+        tk = PassportService().issue(payload)
+
+        return {
+            "access_token": tk,
+        }
+
+
+api.add_resource(PassportResource, "/passport")
+
+
+def generate_session_id():
+    """
+    Generate a unique session ID.
+    """
+    while True:
+        session_id = str(uuid.uuid4())
+        existing_count = db.session.query(EndUser).filter(EndUser.session_id == session_id).count()
+        if existing_count == 0:
+            return session_id

dify_0.15.3/api/controllers/web/remote_files.py

@@ -0,0 +1,80 @@
+import urllib.parse
+
+import httpx
+from flask_restful import marshal_with, reqparse  # type: ignore
+
+import services
+from controllers.common import helpers
+from controllers.common.errors import RemoteFileUploadError
+from controllers.web.wraps import WebApiResource
+from core.file import helpers as file_helpers
+from core.helper import ssrf_proxy
+from fields.file_fields import file_fields_with_signed_url, remote_file_info_fields
+from services.file_service import FileService
+
+from .error import FileTooLargeError, UnsupportedFileTypeError
+
+
+class RemoteFileInfoApi(WebApiResource):
+    @marshal_with(remote_file_info_fields)
+    def get(self, app_model, end_user, url):
+        decoded_url = urllib.parse.unquote(url)
+        resp = ssrf_proxy.head(decoded_url)
+        if resp.status_code != httpx.codes.OK:
+            # failed back to get method
+            resp = ssrf_proxy.get(decoded_url, timeout=3)
+        resp.raise_for_status()
+        return {
+            "file_type": resp.headers.get("Content-Type", "application/octet-stream"),
+            "file_length": int(resp.headers.get("Content-Length", -1)),
+        }
+
+
+class RemoteFileUploadApi(WebApiResource):
+    @marshal_with(file_fields_with_signed_url)
+    def post(self, app_model, end_user):  # Add app_model and end_user parameters
+        parser = reqparse.RequestParser()
+        parser.add_argument("url", type=str, required=True, help="URL is required")
+        args = parser.parse_args()
+
+        url = args["url"]
+
+        try:
+            resp = ssrf_proxy.head(url=url)
+            if resp.status_code != httpx.codes.OK:
+                resp = ssrf_proxy.get(url=url, timeout=3, follow_redirects=True)
+            if resp.status_code != httpx.codes.OK:
+                raise RemoteFileUploadError(f"Failed to fetch file from {url}: {resp.text}")
+        except httpx.RequestError as e:
+            raise RemoteFileUploadError(f"Failed to fetch file from {url}: {str(e)}")
+
+        file_info = helpers.guess_file_info_from_response(resp)
+
+        if not FileService.is_file_size_within_limit(extension=file_info.extension, file_size=file_info.size):
+            raise FileTooLargeError
+
+        content = resp.content if resp.request.method == "GET" else ssrf_proxy.get(url).content
+
+        try:
+            upload_file = FileService.upload_file(
+                filename=file_info.filename,
+                content=content,
+                mimetype=file_info.mimetype,
+                user=end_user,
+                source_url=url,
+            )
+        except services.errors.file.FileTooLargeError as file_too_large_error:
+            raise FileTooLargeError(file_too_large_error.description)
+        except services.errors.file.UnsupportedFileTypeError:
+            raise UnsupportedFileTypeError
+
+        return {
+            "id": upload_file.id,
+            "name": upload_file.name,
+            "size": upload_file.size,
+            "extension": upload_file.extension,
+            "url": file_helpers.get_signed_file_url(upload_file_id=upload_file.id),
+            "mime_type": upload_file.mime_type,
+            "created_by": upload_file.created_by,
+            "created_at": upload_file.created_at,
+        }, 201

dify_0.15.3/api/controllers/web/saved_message.py

@@ -0,0 +1,74 @@
+from flask_restful import fields, marshal_with, reqparse  # type: ignore
+from flask_restful.inputs import int_range  # type: ignore
+from werkzeug.exceptions import NotFound
+
+from controllers.web import api
+from controllers.web.error import NotCompletionAppError
+from controllers.web.wraps import WebApiResource
+from fields.conversation_fields import message_file_fields
+from libs.helper import TimestampField, uuid_value
+from services.errors.message import MessageNotExistsError
+from services.saved_message_service import SavedMessageService
+
+feedback_fields = {"rating": fields.String}
+
+message_fields = {
+    "id": fields.String,
+    "inputs": fields.Raw,
+    "query": fields.String,
+    "answer": fields.String,
+    "message_files": fields.List(fields.Nested(message_file_fields)),
+    "feedback": fields.Nested(feedback_fields, attribute="user_feedback", allow_null=True),
+    "created_at": TimestampField,
+}
+
+
+class SavedMessageListApi(WebApiResource):
+    saved_message_infinite_scroll_pagination_fields = {
+        "limit": fields.Integer,
+        "has_more": fields.Boolean,
+        "data": fields.List(fields.Nested(message_fields)),
+    }
+
+    @marshal_with(saved_message_infinite_scroll_pagination_fields)
+    def get(self, app_model, end_user):
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("last_id", type=uuid_value, location="args")
+        parser.add_argument("limit", type=int_range(1, 100), required=False, default=20, location="args")
+        args = parser.parse_args()
+
+        return SavedMessageService.pagination_by_last_id(app_model, end_user, args["last_id"], args["limit"])
+
+    def post(self, app_model, end_user):
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("message_id", type=uuid_value, required=True, location="json")
+        args = parser.parse_args()
+
+        try:
+            SavedMessageService.save(app_model, end_user, args["message_id"])
+        except MessageNotExistsError:
+            raise NotFound("Message Not Exists.")
+
+        return {"result": "success"}
+
+
+class SavedMessageApi(WebApiResource):
+    def delete(self, app_model, end_user, message_id):
+        message_id = str(message_id)
+
+        if app_model.mode != "completion":
+            raise NotCompletionAppError()
+
+        SavedMessageService.delete(app_model, end_user, message_id)
+
+        return {"result": "success"}
+
+
+api.add_resource(SavedMessageListApi, "/saved-messages")
+api.add_resource(SavedMessageApi, "/saved-messages/<uuid:message_id>")

dify_0.15.3/api/controllers/web/site.py

@@ -0,0 +1,100 @@
+from flask_restful import fields, marshal_with  # type: ignore
+from werkzeug.exceptions import Forbidden
+
+from configs import dify_config
+from controllers.web import api
+from controllers.web.wraps import WebApiResource
+from extensions.ext_database import db
+from libs.helper import AppIconUrlField
+from models.account import TenantStatus
+from models.model import Site
+from services.feature_service import FeatureService
+
+
+class AppSiteApi(WebApiResource):
+    """Resource for app sites."""
+
+    model_config_fields = {
+        "opening_statement": fields.String,
+        "suggested_questions": fields.Raw(attribute="suggested_questions_list"),
+        "suggested_questions_after_answer": fields.Raw(attribute="suggested_questions_after_answer_dict"),
+        "more_like_this": fields.Raw(attribute="more_like_this_dict"),
+        "model": fields.Raw(attribute="model_dict"),
+        "user_input_form": fields.Raw(attribute="user_input_form_list"),
+        "pre_prompt": fields.String,
+    }
+
+    site_fields = {
+        "title": fields.String,
+        "chat_color_theme": fields.String,
+        "chat_color_theme_inverted": fields.Boolean,
+        "icon_type": fields.String,
+        "icon": fields.String,
+        "icon_background": fields.String,
+        "icon_url": AppIconUrlField,
+        "description": fields.String,
+        "copyright": fields.String,
+        "privacy_policy": fields.String,
+        "custom_disclaimer": fields.String,
+        "default_language": fields.String,
+        "prompt_public": fields.Boolean,
+        "show_workflow_steps": fields.Boolean,
+        "use_icon_as_answer_icon": fields.Boolean,
+    }
+
+    app_fields = {
+        "app_id": fields.String,
+        "end_user_id": fields.String,
+        "enable_site": fields.Boolean,
+        "site": fields.Nested(site_fields),
+        "model_config": fields.Nested(model_config_fields, allow_null=True),
+        "plan": fields.String,
+        "can_replace_logo": fields.Boolean,
+        "custom_config": fields.Raw(attribute="custom_config"),
+    }
+
+    @marshal_with(app_fields)
+    def get(self, app_model, end_user):
+        """Retrieve app site info."""
+        # get site
+        site = db.session.query(Site).filter(Site.app_id == app_model.id).first()
+
+        if not site:
+            raise Forbidden()
+
+        if app_model.tenant.status == TenantStatus.ARCHIVE:
+            raise Forbidden()
+
+        can_replace_logo = FeatureService.get_features(app_model.tenant_id).can_replace_logo
+
+        return AppSiteInfo(app_model.tenant, app_model, site, end_user.id, can_replace_logo)
+
+
+api.add_resource(AppSiteApi, "/site")
+
+
+class AppSiteInfo:
+    """Class to store site information."""
+
+    def __init__(self, tenant, app, site, end_user, can_replace_logo):
+        """Initialize AppSiteInfo instance."""
+        self.app_id = app.id
+        self.end_user_id = end_user
+        self.enable_site = app.enable_site
+        self.site = site
+        self.model_config = None
+        self.plan = tenant.plan
+        self.can_replace_logo = can_replace_logo
+
+        if can_replace_logo:
+            base_url = dify_config.FILES_URL
+            remove_webapp_brand = tenant.custom_config_dict.get("remove_webapp_brand", False)
+            replace_webapp_logo = (
+                f"{base_url}/files/workspaces/{tenant.id}/webapp-logo"
+                if tenant.custom_config_dict.get("replace_webapp_logo")
+                else None
+            )
+            self.custom_config = {
+                "remove_webapp_brand": remove_webapp_brand,
+                "replace_webapp_logo": replace_webapp_logo,
+            }

dify_0.15.3/api/controllers/web/workflow.py

@@ -0,0 +1,80 @@
+import logging
+
+from flask_restful import reqparse  # type: ignore
+from werkzeug.exceptions import InternalServerError
+
+from controllers.web import api
+from controllers.web.error import (
+    CompletionRequestError,
+    NotWorkflowAppError,
+    ProviderModelCurrentlyNotSupportError,
+    ProviderNotInitializeError,
+    ProviderQuotaExceededError,
+)
+from controllers.web.wraps import WebApiResource
+from core.app.apps.base_app_queue_manager import AppQueueManager
+from core.app.entities.app_invoke_entities import InvokeFrom
+from core.errors.error import (
+    ModelCurrentlyNotSupportError,
+    ProviderTokenNotInitError,
+    QuotaExceededError,
+)
+from core.model_runtime.errors.invoke import InvokeError
+from libs import helper
+from models.model import App, AppMode, EndUser
+from services.app_generate_service import AppGenerateService
+
+logger = logging.getLogger(__name__)
+
+
+class WorkflowRunApi(WebApiResource):
+    def post(self, app_model: App, end_user: EndUser):
+        """
+        Run workflow
+        """
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode != AppMode.WORKFLOW:
+            raise NotWorkflowAppError()
+
+        parser = reqparse.RequestParser()
+        parser.add_argument("inputs", type=dict, required=True, nullable=False, location="json")
+        parser.add_argument("files", type=list, required=False, location="json")
+        args = parser.parse_args()
+
+        try:
+            response = AppGenerateService.generate(
+                app_model=app_model, user=end_user, args=args, invoke_from=InvokeFrom.WEB_APP, streaming=True
+            )
+
+            return helper.compact_generate_response(response)
+        except ProviderTokenNotInitError as ex:
+            raise ProviderNotInitializeError(ex.description)
+        except QuotaExceededError:
+            raise ProviderQuotaExceededError()
+        except ModelCurrentlyNotSupportError:
+            raise ProviderModelCurrentlyNotSupportError()
+        except InvokeError as e:
+            raise CompletionRequestError(e.description)
+        except ValueError as e:
+            raise e
+        except Exception as e:
+            logging.exception("internal server error.")
+            raise InternalServerError()
+
+
+class WorkflowTaskStopApi(WebApiResource):
+    def post(self, app_model: App, end_user: EndUser, task_id: str):
+        """
+        Stop workflow task
+        """
+        app_mode = AppMode.value_of(app_model.mode)
+        if app_mode != AppMode.WORKFLOW:
+            raise NotWorkflowAppError()
+
+        AppQueueManager.set_stop_flag(task_id, InvokeFrom.WEB_APP, end_user.id)
+
+        return {"result": "success"}
+
+
+api.add_resource(WorkflowRunApi, "/workflows/run")
+api.add_resource(WorkflowTaskStopApi, "/workflows/tasks/<string:task_id>/stop")

dify_0.15.3/api/controllers/web/wraps.py

@@ -0,0 +1,92 @@
+from functools import wraps
+
+from flask import request
+from flask_restful import Resource  # type: ignore
+from werkzeug.exceptions import BadRequest, NotFound, Unauthorized
+
+from controllers.web.error import WebSSOAuthRequiredError
+from extensions.ext_database import db
+from libs.passport import PassportService
+from models.model import App, EndUser, Site
+from services.enterprise.enterprise_service import EnterpriseService
+from services.feature_service import FeatureService
+
+
+def validate_jwt_token(view=None):
+    def decorator(view):
+        @wraps(view)
+        def decorated(*args, **kwargs):
+            app_model, end_user = decode_jwt_token()
+
+            return view(app_model, end_user, *args, **kwargs)
+
+        return decorated
+
+    if view:
+        return decorator(view)
+    return decorator
+
+
+def decode_jwt_token():
+    system_features = FeatureService.get_system_features()
+    app_code = request.headers.get("X-App-Code")
+    try:
+        auth_header = request.headers.get("Authorization")
+        if auth_header is None:
+            raise Unauthorized("Authorization header is missing.")
+
+        if " " not in auth_header:
+            raise Unauthorized("Invalid Authorization header format. Expected 'Bearer <api-key>' format.")
+
+        auth_scheme, tk = auth_header.split(None, 1)
+        auth_scheme = auth_scheme.lower()
+
+        if auth_scheme != "bearer":
+            raise Unauthorized("Invalid Authorization header format. Expected 'Bearer <api-key>' format.")
+        decoded = PassportService().verify(tk)
+        app_code = decoded.get("app_code")
+        app_model = db.session.query(App).filter(App.id == decoded["app_id"]).first()
+        site = db.session.query(Site).filter(Site.code == app_code).first()
+        if not app_model:
+            raise NotFound()
+        if not app_code or not site:
+            raise BadRequest("Site URL is no longer valid.")
+        if app_model.enable_site is False:
+            raise BadRequest("Site is disabled.")
+        end_user = db.session.query(EndUser).filter(EndUser.id == decoded["end_user_id"]).first()
+        if not end_user:
+            raise NotFound()
+
+        _validate_web_sso_token(decoded, system_features, app_code)
+
+        return app_model, end_user
+    except Unauthorized as e:
+        if system_features.sso_enforced_for_web:
+            app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+            if app_web_sso_enabled:
+                raise WebSSOAuthRequiredError()
+
+        raise Unauthorized(e.description)
+
+
+def _validate_web_sso_token(decoded, system_features, app_code):
+    app_web_sso_enabled = False
+
+    # Check if SSO is enforced for web, and if the token source is not SSO, raise an error and redirect to SSO login
+    if system_features.sso_enforced_for_web:
+        app_web_sso_enabled = EnterpriseService.get_app_web_sso_enabled(app_code).get("enabled", False)
+        if app_web_sso_enabled:
+            source = decoded.get("token_source")
+            if not source or source != "sso":
+                raise WebSSOAuthRequiredError()
+
+    # Check if SSO is not enforced for web, and if the token source is SSO,
+    # raise an error and redirect to normal passport login
+    if not system_features.sso_enforced_for_web or not app_web_sso_enabled:
+        source = decoded.get("token_source")
+        if source and source == "sso":
+            raise Unauthorized("sso token expired.")
+
+
+class WebApiResource(Resource):
+    method_decorators = [validate_jwt_token]