- Introduce `LoginWithOptions` method to allow for customizable login flows, enabling overrides for scopes, token expiration, and refresh token issuance.
- Add `LoginOptions` struct to encapsulate optional parameters for login, improving flexibility in user authentication.
- Update token handling in `issueTokens` to accommodate new options, ensuring proper management of access and refresh tokens based on user preferences.
- Integrate OTP service initialization into the OpenAPI server setup for enhanced authentication capabilities.
- Update the `Authenticate` method in the OAuth guard to allow for token refresh when an access token is expired but still valid.
- Introduce `TryRefreshToken` method to handle the refresh token logic, including token rotation and cookie management.
- Implement `VerifyTokenAllowExpired` and `VerifyRefreshToken` methods to improve token verification processes.
- Adjust error handling to provide clearer responses for token refresh failures.
- Refactor token expiration strategies in the login process to ensure consistent handling of access and refresh tokens.
- Clean up the `guard.go` file by removing the `isAPIKey` and `getAccessTokenFromAPIKey` methods, which are no longer needed.
- Add comments to clarify the purpose of the API key authentication block, ensuring it remains intact for future implementation.
- This change streamlines the access token retrieval process and improves code clarity.
- Introduce `YaoAuthSource` and `OAuthEmail` fields in various structures to capture authentication source and OAuth email during user login and registration processes.
- Update `SignIDToken`, `GetInfo`, and `Map` functions to include new claims for Yao authentication source.
- Modify login context to preserve authentication source and OAuth email across different user flows.
- Enhance token issuance to include authentication source and OAuth email in claims for better tracking and user context.
- Ensure proper handling of OAuth email for third-party logins without affecting user profile email.
This change improves the user experience by providing clearer context on authentication methods used during login and registration processes.
- Add SecureCookie field to EntryConfig struct for frontend access
- Add GetCookieName helper to response package for dynamic cookie names
- Update guard.go to use GetCookieName instead of hardcoded __Host- prefix
- Pass secure_cookie setting to /user/entry API response
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add SecureCookie field to TempSecurityConfig and SecurityConfig for better cookie security management.
- Implement SetSecureCookieEnabled and IsSecureCookieEnabled functions to manage secure cookie settings globally.
- Update response handling to utilize secure cookie settings, ensuring compliance with security best practices.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Removed the synchronous preparation of the knowledge base (KB) collection from the InitializeConversation method, now initializing it asynchronously after user login.
- Introduced a new method, GetDocumentsContent, to retrieve content for multiple documents by their IDs, supporting text-based files and improving document handling.
- Updated the API interface to include the new GetDocumentsContent method, enhancing the document management capabilities.
- Enhanced locale handling in the login context to support user preferences during KB collection creation.
- Introduced support for OpenAPI mode, allowing dynamic routing and OAuth guards for API endpoints.
- Updated API root path handling to accommodate OpenAPI configurations, ensuring consistent URL structures.
- Added well-known routes for Yao metadata and OAuth discovery, improving API discoverability.
- Refactored middleware and guards to streamline OpenAPI integration, enhancing overall service functionality.
- Removed deprecated agent TypeScript file, simplifying the codebase and improving maintainability.
- Updated the `build` and `watch` commands to accept a single argument for `<sui>` and made the `<template>` argument optional, improving usability.
- Introduced a default template assignment for the `agent` SUI, ensuring a more intuitive setup for users.
- Enhanced error messages for command usage to provide clearer guidance on expected input format.
- Added new OpenAPI file to the bindata, improving the framework's capabilities for API integration.
- Removed references to Badger in the `utils.go` and `utils_test.go` files, replacing it with Xun as the primary data store.
- Updated test cases and comments to reflect the change in store preference, ensuring consistency across the codebase.
- Adjusted the testing guide to provide accurate information regarding store management and fallback options.
- Replaced Badger with Xun as the primary data store across various components, including OAuth, agent memory, and knowledge base stores, enhancing performance and flexibility.
- Updated the configuration files to reflect the new Xun store paths and removed obsolete Badger store files.
- Refactored test cases to utilize the new Xun store, ensuring compatibility and improved test reliability.
- Enhanced test setup functions to initialize the Xun store correctly, streamlining the testing process and ensuring a consistent environment.
- Added ExecuteWithAuthorized method to the Script struct, allowing scripts to be executed with user authorization information.
- Updated existing Execute method to utilize ExecuteWithAuthorized for improved authorization handling.
- Enhanced script execution tests to verify behavior with and without authorized information, ensuring accurate context management.
- Implemented authorized information conversion to a map for easier integration with runtime environments.
- Refactored context handling in script execution to ensure authorized data is correctly passed and utilized.
- Deleted obsolete agent API files (agent.go, api.go, api_test.go, types.go) to streamline the codebase.
- Refactored the agent loading logic to initialize the API instance correctly, ensuring proper integration with the new structure.
- Updated context handling to improve clarity and maintainability across the agent's functionality.
- Enhanced error handling and cache management in the agent's initialization process.
- Updated context creation in handleChat, handleGenerateTitle, and handleGeneratePrompts to use the request context, improving context management.
- Commented out unused context settings for assistant ID, silent mode, history visibility, and client type to streamline the code.
- Refactored context handling in assistant methods to enhance clarity and maintainability.
- Removed deprecated functions and cleaned up the context structure for better performance and readability.
- Introduced new fields in the Job struct for Yao integration, including YaoCreatedBy, YaoUpdatedBy, YaoTeamID, and YaoTenantID.
- Updated the makeJob function to utilize YaoCreatedBy for setting the CreatedBy field.
- Enhanced permission checks in various functions to validate user access to collections, ensuring proper authorization handling.
- Implemented permission validation in document handling functions to restrict access based on user roles and collection settings.
- Introduced a new function to get first-level subdirectories in the scopes directory, enhancing the flexibility of scope definition loading.
- Updated the loadScopeDefinitions method to utilize this new function, replacing hardcoded subdirectory names with a dynamic approach.
- Improved the description of the invite verification scope in the user scope initialization for clarity.
- Reformatted the initialization of the EndpointInfo struct in the ScopeManager to enhance code clarity and maintainability.
- Ensured consistent alignment of struct fields for better visual organization.
- Implemented deep copy mechanisms for extra constraints and endpoint information to prevent shared state issues.
- Updated the `addEndpointRule` and `matchEndpoint` methods to utilize deep copies, ensuring data integrity during scope management.
- Added utility functions for deep copying maps and values, enhancing the robustness of the ACL system.
- Integrated authorization information retrieval in `ListCollections` and `ListDocuments` functions to enhance security.
- Implemented permission-based filtering to ensure users can only access collections and documents they are authorized to view.
- Refactored query parameter construction for improved readability and maintainability.
- Enhanced the ACL structure to include a new FeatureManager field, allowing for better management of feature-related permissions.
- Updated the New function to load the feature manager during ACL initialization, improving the overall functionality and logging success messages for better traceability.
- Enhanced the OIDC user info structure to include Yao member profile information, such as member ID, display name, bio, avatar, and email.
- Updated the SignIDToken and MakeOIDCUserInfo functions to incorporate member details if available, improving team context handling.
- Refactored the issueTokens function to accept a new IssueTokensParams structure, streamlining token issuance with team and member context.
- Adjusted login functions to retrieve and pass member profile data during token issuance, ensuring comprehensive user context in authentication flows.
- Added a new endpoint `PUT /teams/:team_id/members/:member_id/profile` to allow members to update their profile information, including display name, bio, avatar, and email.
- Introduced `UpdateMemberProfileRequest` structure to handle profile update requests.
- Enhanced the `GinMemberUpdateProfile` handler to process profile updates with appropriate validation and error handling.
- Implemented business logic in `memberUpdateProfile` to ensure only the member can update their own profile.
- Expanded test cases to validate the new profile update functionality, ensuring comprehensive coverage for various update scenarios.
- Added the `UpdateRobotMember` method to handle updates for robot members, including validation for member existence, type checks, and email uniqueness.
- Introduced a new `UpdateRobotMemberRequest` structure to facilitate updates via the API, allowing for modifications to various fields such as `robot_email`, `status`, and `autonomous_mode`.
- Enhanced the `GinMemberUpdateRobot` handler to process update requests, ensuring proper authentication and error handling for various scenarios.
- Expanded test coverage with new test cases for the robot member update functionality, validating successful updates, error conditions, and edge cases.
- Refactored existing member management logic to integrate the new update capabilities, improving overall system robustness and user experience.
- Introduced the `robot_email`, `authorized_senders`, and `email_filter_rules` fields to the robot member model, enhancing the configuration options for robot members.
- Updated the member creation and existence check logic to ensure the uniqueness of `robot_email` globally, improving data integrity.
- Refactored API endpoints and request/response structures to accommodate the new fields, ensuring consistency across the member management system.
- Enhanced test cases to validate the new robot member features, including scenarios for email uniqueness and configuration updates, improving overall test coverage and reliability.
- Added the is_owner field to the member model to indicate if a member is the team owner, improving clarity and performance for queries related to team ownership.
- Updated the team creation process to automatically set the is_owner field for the creator of the team, ensuring accurate member status upon creation.
- Refactored related tests to verify the correct assignment of the is_owner field, enhancing test coverage and reliability in team membership scenarios.
- Removed redundant permission and restriction fields from the member model to streamline the data structure and improve maintainability.
- Added new fields to the robot member creation process, including permissions, restrictions, notes, and metadata, to improve the flexibility and detail of robot member configurations.
- Updated the AddMember function to include tracking of the user who invited the member and the team ID, enhancing member management and accountability.
- These changes improve the overall functionality and usability of the member management system.
- Added functions to check the existence of invitation codes, members, OAuth accounts, roles, teams, and user types before performing updates, enhancing error handling and user feedback.
- Updated relevant update functions to utilize these existence checks, ensuring accurate error messages when no changes are made or when entities do not exist.
- Refactored tests to validate the new existence check logic, improving overall test coverage and reliability.
- Introduced member_id as a unique identifier for members, improving data integrity and consistency across member operations.
- Updated member-related functions to utilize member_id instead of internal IDs, enhancing API usability and clarity.
- Implemented email existence checks for team members, allowing for better validation during member creation and updates.
- Refactored existing tests to accommodate changes in member identification and email validation, ensuring comprehensive coverage and reliability.
- Added new API endpoint for checking if an email exists within a team, improving user experience during member management.
- Introduced a new endpoint for creating robot members, enhancing the member model to include fields specific to robots such as email, system prompt, and autonomous mode.
- Refactored existing member creation logic to accommodate robot-specific requirements and ensure email uniqueness within teams.
- Updated request and response structures to support the new robot member functionality, improving API consistency.
- Added comprehensive test cases to validate the new robot member creation process, including scenarios for required fields, duplicate emails, and invalid inputs.
- Enhanced the member model by adding 'avatar' and updating 'display_name' and 'bio' fields for improved identity representation.
- Refactored robot member creation and validation to utilize the new fields, ensuring consistency across user and robot profiles.
- Updated test cases to reflect changes in member data structure, improving coverage and accuracy in robot member operations.
- Adjusted database indices and constraints to accommodate new fields and ensure efficient querying.
- Added display_name, bio, and email fields to the member model for improved team-specific identity.
- Updated team invitation creation and acceptance logic to handle new profile fields, ensuring proper data management and user experience.
- Implemented logic to copy user profile fields when creating or updating members, enhancing data consistency.
- Refactored the team invitation creation function to utilize the new authorized package for improved user authentication checks.
- Enhanced the invitation acceptance logic to include the user ID of the person who updated the invitation, improving tracking and accountability.
- Adjusted the invitation data preparation to incorporate user-specific scopes, ensuring proper permissions are applied during invitation processing.
- Adjusted the formatting of the test case struct in scope_test.go for improved readability.
- No functional changes were made; this commit focuses on code style consistency.
- Implemented path normalization in the ACL enforcement logic to ensure consistent matching by removing trailing slashes from request paths.
- Introduced a new utility function, normalizePath, to handle path normalization across various components.
- Updated endpoint matching and public endpoint checks to utilize the normalized paths, improving access decision accuracy.
- Enhanced team and member creation logic to include a new field, __yao_team_id, for better data management.
- Updated ACL configuration to include a PathPrefix field, allowing for dynamic path stripping from request URLs.
- Enhanced ACL enforcement logic to log the configured path prefix and adjust request paths accordingly during access checks.
- Improved logging throughout the enforcement process to provide clearer insights into access decisions and scope matching.
- Registered built-in scopes for temporary access tokens, enhancing flexibility in access control for specific endpoints.
- Updated scope management to support constraints for matched scopes, improving granularity in access control configurations.
- Added detailed logging for ACL enforcement failures in the OAuth guard, providing clearer insights into permission issues.
- Updated error messages in the ACL enforcement logic to include contextual information such as client and user IDs, enhancing debugging capabilities.
- Introduced new constraints (CreatorOnly, EditorOnly) in the data access model, allowing for more granular control over data visibility based on user roles.
- Enhanced scope definitions to support additional constraints, improving flexibility in access control configurations.
- Updated documentation to reflect changes in data constraints and their usage in API handlers.
- Refactored the ACL enforcement process to include a comprehensive chain of permission checks for clients, users, teams, and members.
- Introduced data access constraints (OwnerOnly, TeamOnly) to enhance access control based on endpoint requirements.
- Updated the Error struct to include the stage of permission checks where failures occur, improving error reporting.
- Enhanced scope management with wildcard matching capabilities and added checks for restricted scopes.
- Implemented tests to validate the enforcement logic and ensure correct handling of data access constraints.
- Updated ACL configuration to include Cache and Provider fields for improved role management.
- Initialized Role Manager within the ACL setup, ensuring proper role handling and cache management.
- Enhanced tests to verify access denial and error handling for unmatched endpoints, improving overall test coverage and clarity in error responses.
- Added role_id field to the team model for specifying team owner roles.
- Enhanced team creation logic to set default role_id based on team configuration if not provided.
- Updated tests to reflect changes in team type and role handling, ensuring accurate assertions.
- Improved documentation for team configuration to clarify default role settings for team creators.
- Updated the OAuth guard to utilize a standardized response format for error handling, enhancing consistency across error responses.
- Integrated detailed error information for insufficient scope and permission denied scenarios, providing clearer insights into access issues.
- Modified the ACL enforcement logic to return structured error details, allowing for better handling of permission-related errors.
- Enhanced the ErrorResponse struct to include optional fields for reason, required scopes, and missing scopes, following OAuth 2.0 extensibility guidelines.
- Updated the OAuth guard to set authorized information in the context using the new authorized package.
- Refactored the GetAuthorizedInfo function to utilize the authorized.GetInfo method, improving clarity and maintainability.
- Enhanced the ACL implementation by adding scope resolution logic in the Enforce method, ensuring proper access control based on user roles and scopes.
- Improved error handling and logging during ACL operations, providing better insights into access decisions.
- Integrated ACL (Access Control List) functionality into the OAuth guard, enabling permission checks and rate limiting based on ACL configurations.
- Updated error responses for token validation and refresh token handling to use standardized error types.
- Enhanced error handling for ACL-related issues, providing detailed HTTP responses based on specific ACL error types.
- Improved overall security and user experience by ensuring proper authorization checks are enforced during API requests.
- Added Remember Me flag to LoginContext and AuthorizedInfo structures to support extended session management.
- Updated GetAuthorizedInfo function to retrieve Remember Me state from the context.
- Modified token issuance logic to accommodate Remember Me settings, adjusting token expiration durations accordingly.
- Preserved Remember Me state during login and team selection processes, improving user experience and session persistence.
- Introduced the invitation model in bindata.go, including the new invitation.mod.yao file.
- Updated system models to include the invitation model for better integration.
- Added invitation code related error handling in default.go, enhancing user experience during invitation processes.
- Implemented invitation code management methods in the user provider interface, allowing for creation, usage, and deletion of invitation codes.
- Enhanced entry configuration to support invitation code verification, improving the user registration flow.
- Added a new endpoint for verifying invitation codes in user routing, streamlining the invitation redemption process.
- Implemented GinLogout function to handle user logout, including revoking access and refresh tokens, clearing authentication cookies, and returning a success response.
- Added public method GetRefreshToken to retrieve the refresh token from the request, enhancing token management.
- Updated user routing to link the logout endpoint to the new GinLogout function, improving the user authentication flow.
- Updated modification times for various asset files in bindata.go to reflect recent changes.
- Enhanced user authentication by adding support for custom claims in the context during authorization, improving flexibility in handling user data.
- Refactored entry verification logic to generate and send OTPs for user registration, streamlining the registration process and improving user experience.
- Introduced new status handling for user accounts, ensuring proper feedback for pending, unverified, and disabled accounts during login attempts.
- Modified the AcceptInvitation method to accept an optional user ID parameter, allowing for updates to the user ID when accepting invitations without an existing user ID.
- Adjusted related tests to include the new user ID parameter, ensuring comprehensive coverage of invitation acceptance scenarios.
- Updated the team invitation acceptance logic to utilize the new parameter, enhancing the invitation flow and user management capabilities.
- Updated the AcceptInvitation method to require both invitation ID and token, improving the invitation acceptance process.
- Modified related tests to accommodate the new invitation ID parameter, ensuring comprehensive coverage of acceptance scenarios.
- Enhanced the invitation acceptance endpoint to validate invitation ID, providing clearer error handling for invalid or expired invitations.
- Refactored tests to include detailed scenarios for accepting invitations, including success and failure cases, ensuring robust testing of the invitation flow.
- Enhanced the SignIDToken method to include the original Yao user ID in the token claims, improving user identification.
- Updated the MakeOIDCUserInfo function to extract and set the Yao user ID from the user map, ensuring consistency in user information.
- Modified the OIDCUserInfo structure to include a field for Yao user ID, facilitating better integration with Yao-specific features.
- Adjusted the team invitation response to include the inviter's user ID, enhancing the invitation context.
- Enhanced the OIDCUserInfo structure to include YaoTypeID and YaoType fields for better user type management.
- Updated SignIDToken method to incorporate YaoTypeID and YaoType claims, ensuring comprehensive user type information in ID tokens.
- Modified team creation logic to set default type_id based on team configuration, improving team management capabilities.
- Refactored token generation methods to support additional type information in access and refresh tokens, enhancing overall token customization.
