chore: import upstream snapshot with attribution

application/app.py

@@ -0,0 +1,292 @@
+import logging
+import os
+import platform
+import uuid
+
+import dotenv
+from flask import Flask, Response, jsonify, redirect, request
+from jose import jwt
+
+from application.auth import handle_auth
+
+from application.core import log_context
+from application.core.logging_config import setup_logging
+
+setup_logging()
+
+from application.api import api  # noqa: E402
+from application.api.admin import admin_ns  # noqa: E402
+from application.api.answer import answer  # noqa: E402
+from application.api.devices import devices_bp  # noqa: E402
+from application.api.events.routes import events  # noqa: E402
+from application.api.internal.routes import internal  # noqa: E402
+from application.api.oidc import oidc_bp  # noqa: E402
+from application.api.oidc.denylist import is_denied as oidc_session_denied  # noqa: E402
+from application.api.scim import scim_bp  # noqa: E402
+from application.api.user.authz import resolve_roles  # noqa: E402
+from application.api.user.routes import user  # noqa: E402
+from application.api.connector.routes import connector  # noqa: E402
+from application.api.v1 import v1_bp  # noqa: E402
+from application.celery_init import celery  # noqa: E402
+from application.core.settings import settings  # noqa: E402
+from application.storage.db.bootstrap import ensure_database_ready  # noqa: E402
+from application.stt.upload_limits import (  # noqa: E402
+    build_stt_file_size_limit_message,
+    should_reject_stt_request,
+)
+
+
+if platform.system() == "Windows":
+    import pathlib
+
+    pathlib.PosixPath = pathlib.WindowsPath
+dotenv.load_dotenv()
+
+# Self-bootstrap the user-data Postgres DB. Runs before any blueprint or
+# repository touches the engine, so the first request can't race the
+# schema being created. Gated by AUTO_CREATE_DB / AUTO_MIGRATE settings
+# (default ON for dev; disable in prod if schema is managed out-of-band).
+ensure_database_ready(
+    settings.POSTGRES_URI,
+    create_db=settings.AUTO_CREATE_DB,
+    migrate=settings.AUTO_MIGRATE,
+    logger=logging.getLogger("application.app"),
+)
+
+from application.agents.default_tools import (  # noqa: E402
+    validate_default_chat_tools,
+)
+
+validate_default_chat_tools()
+
+app = Flask(__name__)
+app.register_blueprint(user)
+app.register_blueprint(answer)
+app.register_blueprint(events)
+app.register_blueprint(internal)
+app.register_blueprint(connector)
+app.register_blueprint(devices_bp)
+app.register_blueprint(oidc_bp)
+app.register_blueprint(scim_bp)
+app.register_blueprint(v1_bp)
+# Register the admin namespace once. The membership guard makes this idempotent
+# if application.app is re-imported (coverage tests reload the module): without
+# it, re-running add_namespace would re-register routes on the already-served
+# first app and raise "add_url_rule can no longer be called".
+if admin_ns not in api.namespaces:
+    api.add_namespace(admin_ns)
+app.config.update(
+    UPLOAD_FOLDER="inputs",
+    CELERY_BROKER_URL=settings.CELERY_BROKER_URL,
+    CELERY_RESULT_BACKEND=settings.CELERY_RESULT_BACKEND,
+    MONGO_URI=settings.MONGO_URI,
+)
+celery.config_from_object("application.celeryconfig")
+api.init_app(app)
+
+if settings.AUTH_TYPE in ("simple_jwt", "session_jwt", "oidc") and not settings.JWT_SECRET_KEY:
+    key_file = ".jwt_secret_key"
+    try:
+        with open(key_file, "r") as f:
+            settings.JWT_SECRET_KEY = f.read().strip()
+    except FileNotFoundError:
+        new_key = os.urandom(32).hex()
+        with open(key_file, "w") as f:
+            f.write(new_key)
+        settings.JWT_SECRET_KEY = new_key
+    except Exception as e:
+        raise RuntimeError(f"Failed to setup JWT_SECRET_KEY: {e}")
+if settings.AUTH_TYPE == "oidc":
+    _missing_oidc = [
+        name
+        for name in ("OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_FRONTEND_URL")
+        if not getattr(settings, name)
+    ]
+    if _missing_oidc:
+        raise RuntimeError(f"AUTH_TYPE=oidc requires settings: {', '.join(_missing_oidc)}")
+SIMPLE_JWT_TOKEN = None
+if settings.AUTH_TYPE == "simple_jwt":
+    payload = {"sub": "local"}
+    SIMPLE_JWT_TOKEN = jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm="HS256")
+    print(f"Generated Simple JWT Token: {SIMPLE_JWT_TOKEN}")
+
+
+@app.route("/")
+def home():
+    if request.remote_addr in ("0.0.0.0", "127.0.0.1", "localhost", "172.18.0.1"):
+        return redirect("http://localhost:5173")
+    else:
+        return "Welcome to DocsGPT Backend!"
+
+
+@app.route("/api/health")
+def health():
+    return jsonify({"status": "ok"})
+
+
+@app.route("/api/config")
+def get_config():
+    from application.graphrag import graphrag_available
+
+    response = {
+        "auth_type": settings.AUTH_TYPE,
+        "requires_auth": settings.AUTH_TYPE in ["simple_jwt", "session_jwt", "oidc"],
+        "graphrag_available": graphrag_available(),
+        "hybrid_available": settings.VECTOR_STORE == "pgvector",
+    }
+    if settings.AUTH_TYPE == "oidc":
+        response["oidc"] = {
+            "login_path": "/api/auth/oidc/login",
+            "logout_path": "/api/auth/oidc/logout",
+            "provider_name": settings.OIDC_PROVIDER_NAME,
+        }
+    return jsonify(response)
+
+
+@app.route("/api/generate_token")
+def generate_token():
+    if settings.AUTH_TYPE == "session_jwt":
+        new_user_id = str(uuid.uuid4())
+        token = jwt.encode(
+            {"sub": new_user_id}, settings.JWT_SECRET_KEY, algorithm="HS256"
+        )
+        return jsonify({"token": token})
+    return jsonify({"error": "Token generation not allowed in current auth mode"}), 400
+
+
+_LOG_CTX_TOKEN_ATTR = "_log_ctx_token"
+
+
+@app.before_request
+def _bind_log_context():
+    """Bind activity_id + endpoint for the duration of this request.
+
+    Runs before ``authenticate_request``; ``user_id`` is overlaid in a
+    follow-up handler once the JWT has been decoded.
+    """
+    if request.method == "OPTIONS":
+        return None
+    activity_id = str(uuid.uuid4())
+    request.activity_id = activity_id
+    token = log_context.bind(
+        activity_id=activity_id,
+        endpoint=request.endpoint,
+    )
+    setattr(request, _LOG_CTX_TOKEN_ATTR, token)
+    return None
+
+
+@app.teardown_request
+def _reset_log_context(_exc):
+    # SSE streams keep yielding after teardown fires, but a2wsgi runs each
+    # request inside ``copy_context().run(...)``, so this reset doesn't
+    # leak into the stream's view of the context.
+    token = getattr(request, _LOG_CTX_TOKEN_ATTR, None)
+    if token is not None:
+        log_context.reset(token)
+
+
+@app.before_request
+def enforce_stt_request_size_limits():
+    if request.method == "OPTIONS":
+        return None
+    if should_reject_stt_request(request.path, request.content_length):
+        return (
+            jsonify(
+                {
+                    "success": False,
+                    "message": build_stt_file_size_limit_message(),
+                }
+            ),
+            413,
+        )
+    return None
+
+
+@app.before_request
+def authenticate_request():
+    if request.method == "OPTIONS":
+        return "", 200
+    # OpenAI-compatible routes authenticate via opaque agent API keys in the
+    # Authorization header, which the JWT decoder below would reject. Defer
+    # auth to the route handlers (see application/api/v1/routes.py).
+    if request.path.startswith("/v1/"):
+        request.decoded_token = None
+        return None
+    # Remote-device CLI endpoints carry opaque ``tok_…`` session tokens
+    # (not JWTs); ``verify_device_session`` runs inside the route handler.
+    # The redeem endpoint is tokenless — it authenticates via the one-time
+    # ``user_code`` inside ``redeem_pairing`` — so it's exempt too. Pairing
+    # create + status stay JWT-protected (UI calls).
+    if (
+        request.path.startswith("/api/devices/poll")
+        or request.path.startswith("/api/devices/sessions/")
+        or request.path == "/api/devices/me"
+        or request.path == "/api/devices/pairings/redeem"
+    ):
+        request.decoded_token = None
+        return None
+    # OIDC login/callback/token endpoints must stay reachable even when the
+    # browser still carries a stale or expired Bearer token — otherwise the
+    # 401 below would lock the user out of the only path to a fresh session.
+    if request.path.startswith("/api/auth/oidc/"):
+        request.decoded_token = None
+        return None
+    # SCIM provisioning authenticates with its own bearer token (SCIM_TOKEN),
+    # validated inside the blueprint.
+    if request.path.startswith("/scim/"):
+        request.decoded_token = None
+        return None
+    decoded_token = handle_auth(request)
+    if not decoded_token:
+        request.decoded_token = None
+    elif "error" in decoded_token:
+        return jsonify(decoded_token), 401
+    elif settings.AUTH_TYPE == "oidc" and oidc_session_denied(decoded_token):
+        # Back-channel logout / SCIM deactivation revoked this session.
+        return (
+            jsonify(
+                {
+                    "message": "Authentication error: session revoked",
+                    "error": "token_revoked",
+                }
+            ),
+            401,
+        )
+    else:
+        # Resolve roles once here, the single authenticated chokepoint. Roles
+        # are computed (never read from the JWT) and overwrite any inbound
+        # 'roles' claim. /v1, device, oidc, and scim paths set decoded_token
+        # above and never reach here, so they stay role-less by design.
+        decoded_token["roles"] = resolve_roles(decoded_token)
+        request.decoded_token = decoded_token
+
+
+@app.before_request
+def _bind_user_id_to_log_context():
+    # Registered after ``authenticate_request`` (Flask runs before_request
+    # handlers in registration order), so ``request.decoded_token`` is
+    # populated by the time we read it. ``teardown_request`` unwinds the
+    # whole request-level bind, so no separate reset token is needed here.
+    if request.method == "OPTIONS":
+        return None
+    decoded_token = getattr(request, "decoded_token", None)
+    user_id = decoded_token.get("sub") if isinstance(decoded_token, dict) else None
+    if user_id:
+        log_context.bind(user_id=user_id)
+    return None
+
+
+@app.after_request
+def after_request(response: Response) -> Response:
+    """Add CORS headers for the pure Flask development entrypoint."""
+    response.headers["Access-Control-Allow-Origin"] = "*"
+    response.headers["Access-Control-Allow-Headers"] = (
+        "Content-Type, Authorization, Idempotency-Key"
+    )
+    response.headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+    return response
+
+
+if __name__ == "__main__":
+    app.run(debug=settings.FLASK_DEBUG_MODE, port=7091)