dify

dify/api/controllers/console/auth/activate.py

@@ -0,0 +1,108 @@
+from flask import request
+from flask_restx import Resource, fields, reqparse
+
+from constants.languages import supported_language
+from controllers.console import console_ns
+from controllers.console.error import AlreadyActivateError
+from extensions.ext_database import db
+from libs.datetime_utils import naive_utc_now
+from libs.helper import StrLen, email, extract_remote_ip, timezone
+from models import AccountStatus
+from services.account_service import AccountService, RegisterService
+
+active_check_parser = (
+    reqparse.RequestParser()
+    .add_argument("workspace_id", type=str, required=False, nullable=True, location="args", help="Workspace ID")
+    .add_argument("email", type=email, required=False, nullable=True, location="args", help="Email address")
+    .add_argument("token", type=str, required=True, nullable=False, location="args", help="Activation token")
+)
+
+
+@console_ns.route("/activate/check")
+class ActivateCheckApi(Resource):
+    @console_ns.doc("check_activation_token")
+    @console_ns.doc(description="Check if activation token is valid")
+    @console_ns.expect(active_check_parser)
+    @console_ns.response(
+        200,
+        "Success",
+        console_ns.model(
+            "ActivationCheckResponse",
+            {
+                "is_valid": fields.Boolean(description="Whether token is valid"),
+                "data": fields.Raw(description="Activation data if valid"),
+            },
+        ),
+    )
+    def get(self):
+        args = active_check_parser.parse_args()
+
+        workspaceId = args["workspace_id"]
+        reg_email = args["email"]
+        token = args["token"]
+
+        invitation = RegisterService.get_invitation_if_token_valid(workspaceId, reg_email, token)
+        if invitation:
+            data = invitation.get("data", {})
+            tenant = invitation.get("tenant", None)
+            workspace_name = tenant.name if tenant else None
+            workspace_id = tenant.id if tenant else None
+            invitee_email = data.get("email") if data else None
+            return {
+                "is_valid": invitation is not None,
+                "data": {"workspace_name": workspace_name, "workspace_id": workspace_id, "email": invitee_email},
+            }
+        else:
+            return {"is_valid": False}
+
+
+active_parser = (
+    reqparse.RequestParser()
+    .add_argument("workspace_id", type=str, required=False, nullable=True, location="json")
+    .add_argument("email", type=email, required=False, nullable=True, location="json")
+    .add_argument("token", type=str, required=True, nullable=False, location="json")
+    .add_argument("name", type=StrLen(30), required=True, nullable=False, location="json")
+    .add_argument("interface_language", type=supported_language, required=True, nullable=False, location="json")
+    .add_argument("timezone", type=timezone, required=True, nullable=False, location="json")
+)
+
+
+@console_ns.route("/activate")
+class ActivateApi(Resource):
+    @console_ns.doc("activate_account")
+    @console_ns.doc(description="Activate account with invitation token")
+    @console_ns.expect(active_parser)
+    @console_ns.response(
+        200,
+        "Account activated successfully",
+        console_ns.model(
+            "ActivationResponse",
+            {
+                "result": fields.String(description="Operation result"),
+                "data": fields.Raw(description="Login token data"),
+            },
+        ),
+    )
+    @console_ns.response(400, "Already activated or invalid token")
+    def post(self):
+        args = active_parser.parse_args()
+
+        invitation = RegisterService.get_invitation_if_token_valid(args["workspace_id"], args["email"], args["token"])
+        if invitation is None:
+            raise AlreadyActivateError()
+
+        RegisterService.revoke_token(args["workspace_id"], args["email"], args["token"])
+
+        account = invitation["account"]
+        account.name = args["name"]
+
+        account.interface_language = args["interface_language"]
+        account.timezone = args["timezone"]
+        account.interface_theme = "light"
+        account.status = AccountStatus.ACTIVE
+        account.initialized_at = naive_utc_now()
+        db.session.commit()
+
+        token_pair = AccountService.login(account, ip_address=extract_remote_ip(request))
+
+        return {"result": "success", "data": token_pair.model_dump()}

dify/api/controllers/console/auth/data_source_bearer_auth.py

@@ -0,0 +1,73 @@
+from flask_restx import Resource, reqparse
+
+from controllers.console import console_ns
+from controllers.console.auth.error import ApiKeyAuthFailedError
+from controllers.console.wraps import is_admin_or_owner_required
+from libs.login import current_account_with_tenant, login_required
+from services.auth.api_key_auth_service import ApiKeyAuthService
+
+from ..wraps import account_initialization_required, setup_required
+
+
+@console_ns.route("/api-key-auth/data-source")
+class ApiKeyAuthDataSource(Resource):
+    @setup_required
+    @login_required
+    @account_initialization_required
+    def get(self):
+        _, current_tenant_id = current_account_with_tenant()
+        data_source_api_key_bindings = ApiKeyAuthService.get_provider_auth_list(current_tenant_id)
+        if data_source_api_key_bindings:
+            return {
+                "sources": [
+                    {
+                        "id": data_source_api_key_binding.id,
+                        "category": data_source_api_key_binding.category,
+                        "provider": data_source_api_key_binding.provider,
+                        "disabled": data_source_api_key_binding.disabled,
+                        "created_at": int(data_source_api_key_binding.created_at.timestamp()),
+                        "updated_at": int(data_source_api_key_binding.updated_at.timestamp()),
+                    }
+                    for data_source_api_key_binding in data_source_api_key_bindings
+                ]
+            }
+        return {"sources": []}
+
+
+@console_ns.route("/api-key-auth/data-source/binding")
+class ApiKeyAuthDataSourceBinding(Resource):
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @is_admin_or_owner_required
+    def post(self):
+        # The role of the current user in the table must be admin or owner
+        _, current_tenant_id = current_account_with_tenant()
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("category", type=str, required=True, nullable=False, location="json")
+            .add_argument("provider", type=str, required=True, nullable=False, location="json")
+            .add_argument("credentials", type=dict, required=True, nullable=False, location="json")
+        )
+        args = parser.parse_args()
+        ApiKeyAuthService.validate_api_key_auth_args(args)
+        try:
+            ApiKeyAuthService.create_provider_auth(current_tenant_id, args)
+        except Exception as e:
+            raise ApiKeyAuthFailedError(str(e))
+        return {"result": "success"}, 200
+
+
+@console_ns.route("/api-key-auth/data-source/<uuid:binding_id>")
+class ApiKeyAuthDataSourceBindingDelete(Resource):
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @is_admin_or_owner_required
+    def delete(self, binding_id):
+        # The role of the current user in the table must be admin or owner
+        _, current_tenant_id = current_account_with_tenant()
+
+        ApiKeyAuthService.delete_provider_auth(current_tenant_id, binding_id)
+
+        return {"result": "success"}, 204

dify/api/controllers/console/auth/data_source_oauth.py

@@ -0,0 +1,159 @@
+import logging
+
+import httpx
+from flask import current_app, redirect, request
+from flask_restx import Resource, fields
+
+from configs import dify_config
+from controllers.console import console_ns
+from controllers.console.wraps import is_admin_or_owner_required
+from libs.login import login_required
+from libs.oauth_data_source import NotionOAuth
+
+from ..wraps import account_initialization_required, setup_required
+
+logger = logging.getLogger(__name__)
+
+
+def get_oauth_providers():
+    with current_app.app_context():
+        notion_oauth = NotionOAuth(
+            client_id=dify_config.NOTION_CLIENT_ID or "",
+            client_secret=dify_config.NOTION_CLIENT_SECRET or "",
+            redirect_uri=dify_config.CONSOLE_API_URL + "/console/api/oauth/data-source/callback/notion",
+        )
+
+        OAUTH_PROVIDERS = {"notion": notion_oauth}
+        return OAUTH_PROVIDERS
+
+
+@console_ns.route("/oauth/data-source/<string:provider>")
+class OAuthDataSource(Resource):
+    @console_ns.doc("oauth_data_source")
+    @console_ns.doc(description="Get OAuth authorization URL for data source provider")
+    @console_ns.doc(params={"provider": "Data source provider name (notion)"})
+    @console_ns.response(
+        200,
+        "Authorization URL or internal setup success",
+        console_ns.model(
+            "OAuthDataSourceResponse",
+            {"data": fields.Raw(description="Authorization URL or 'internal' for internal setup")},
+        ),
+    )
+    @console_ns.response(400, "Invalid provider")
+    @console_ns.response(403, "Admin privileges required")
+    @is_admin_or_owner_required
+    def get(self, provider: str):
+        # The role of the current user in the table must be admin or owner
+        OAUTH_DATASOURCE_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_DATASOURCE_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+        if dify_config.NOTION_INTEGRATION_TYPE == "internal":
+            internal_secret = dify_config.NOTION_INTERNAL_SECRET
+            if not internal_secret:
+                return ({"error": "Internal secret is not set"},)
+            oauth_provider.save_internal_access_token(internal_secret)
+            return {"data": "internal"}
+        else:
+            auth_url = oauth_provider.get_authorization_url()
+            return {"data": auth_url}, 200
+
+
+@console_ns.route("/oauth/data-source/callback/<string:provider>")
+class OAuthDataSourceCallback(Resource):
+    @console_ns.doc("oauth_data_source_callback")
+    @console_ns.doc(description="Handle OAuth callback from data source provider")
+    @console_ns.doc(
+        params={
+            "provider": "Data source provider name (notion)",
+            "code": "Authorization code from OAuth provider",
+            "error": "Error message from OAuth provider",
+        }
+    )
+    @console_ns.response(302, "Redirect to console with result")
+    @console_ns.response(400, "Invalid provider")
+    def get(self, provider: str):
+        OAUTH_DATASOURCE_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_DATASOURCE_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+        if "code" in request.args:
+            code = request.args.get("code")
+
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}?type=notion&code={code}")
+        elif "error" in request.args:
+            error = request.args.get("error")
+
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}?type=notion&error={error}")
+        else:
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}?type=notion&error=Access denied")
+
+
+@console_ns.route("/oauth/data-source/binding/<string:provider>")
+class OAuthDataSourceBinding(Resource):
+    @console_ns.doc("oauth_data_source_binding")
+    @console_ns.doc(description="Bind OAuth data source with authorization code")
+    @console_ns.doc(
+        params={"provider": "Data source provider name (notion)", "code": "Authorization code from OAuth provider"}
+    )
+    @console_ns.response(
+        200,
+        "Data source binding success",
+        console_ns.model("OAuthDataSourceBindingResponse", {"result": fields.String(description="Operation result")}),
+    )
+    @console_ns.response(400, "Invalid provider or code")
+    def get(self, provider: str):
+        OAUTH_DATASOURCE_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_DATASOURCE_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+        if "code" in request.args:
+            code = request.args.get("code", "")
+            if not code:
+                return {"error": "Invalid code"}, 400
+            try:
+                oauth_provider.get_access_token(code)
+            except httpx.HTTPStatusError as e:
+                logger.exception(
+                    "An error occurred during the OAuthCallback process with %s: %s", provider, e.response.text
+                )
+                return {"error": "OAuth data source process failed"}, 400
+
+            return {"result": "success"}, 200
+
+
+@console_ns.route("/oauth/data-source/<string:provider>/<uuid:binding_id>/sync")
+class OAuthDataSourceSync(Resource):
+    @console_ns.doc("oauth_data_source_sync")
+    @console_ns.doc(description="Sync data from OAuth data source")
+    @console_ns.doc(params={"provider": "Data source provider name (notion)", "binding_id": "Data source binding ID"})
+    @console_ns.response(
+        200,
+        "Data source sync success",
+        console_ns.model("OAuthDataSourceSyncResponse", {"result": fields.String(description="Operation result")}),
+    )
+    @console_ns.response(400, "Invalid provider or sync failed")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    def get(self, provider, binding_id):
+        provider = str(provider)
+        binding_id = str(binding_id)
+        OAUTH_DATASOURCE_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_DATASOURCE_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+        try:
+            oauth_provider.sync_data_source(binding_id)
+        except httpx.HTTPStatusError as e:
+            logger.exception(
+                "An error occurred during the OAuthCallback process with %s: %s", provider, e.response.text
+            )
+            return {"error": "OAuth data source process failed"}, 400
+
+        return {"result": "success"}, 200

dify/api/controllers/console/auth/email_register.py

@@ -0,0 +1,159 @@
+from flask import request
+from flask_restx import Resource, reqparse
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from configs import dify_config
+from constants.languages import languages
+from controllers.console import console_ns
+from controllers.console.auth.error import (
+    EmailAlreadyInUseError,
+    EmailCodeError,
+    EmailRegisterLimitError,
+    InvalidEmailError,
+    InvalidTokenError,
+    PasswordMismatchError,
+)
+from controllers.console.error import AccountInFreezeError, EmailSendIpLimitError
+from controllers.console.wraps import email_password_login_enabled, email_register_enabled, setup_required
+from extensions.ext_database import db
+from libs.helper import email, extract_remote_ip
+from libs.password import valid_password
+from models import Account
+from services.account_service import AccountService
+from services.billing_service import BillingService
+from services.errors.account import AccountNotFoundError, AccountRegisterError
+
+
+@console_ns.route("/email-register/send-email")
+class EmailRegisterSendEmailApi(Resource):
+    @setup_required
+    @email_password_login_enabled
+    @email_register_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=email, required=True, location="json")
+            .add_argument("language", type=str, required=False, location="json")
+        )
+        args = parser.parse_args()
+
+        ip_address = extract_remote_ip(request)
+        if AccountService.is_email_send_ip_limit(ip_address):
+            raise EmailSendIpLimitError()
+        language = "en-US"
+        if args["language"] in languages:
+            language = args["language"]
+
+        if dify_config.BILLING_ENABLED and BillingService.is_email_in_freeze(args["email"]):
+            raise AccountInFreezeError()
+
+        with Session(db.engine) as session:
+            account = session.execute(select(Account).filter_by(email=args["email"])).scalar_one_or_none()
+        token = None
+        token = AccountService.send_email_register_email(email=args["email"], account=account, language=language)
+        return {"result": "success", "data": token}
+
+
+@console_ns.route("/email-register/validity")
+class EmailRegisterCheckApi(Resource):
+    @setup_required
+    @email_password_login_enabled
+    @email_register_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=str, required=True, location="json")
+            .add_argument("code", type=str, required=True, location="json")
+            .add_argument("token", type=str, required=True, nullable=False, location="json")
+        )
+        args = parser.parse_args()
+
+        user_email = args["email"]
+
+        is_email_register_error_rate_limit = AccountService.is_email_register_error_rate_limit(args["email"])
+        if is_email_register_error_rate_limit:
+            raise EmailRegisterLimitError()
+
+        token_data = AccountService.get_email_register_data(args["token"])
+        if token_data is None:
+            raise InvalidTokenError()
+
+        if user_email != token_data.get("email"):
+            raise InvalidEmailError()
+
+        if args["code"] != token_data.get("code"):
+            AccountService.add_email_register_error_rate_limit(args["email"])
+            raise EmailCodeError()
+
+        # Verified, revoke the first token
+        AccountService.revoke_email_register_token(args["token"])
+
+        # Refresh token data by generating a new token
+        _, new_token = AccountService.generate_email_register_token(
+            user_email, code=args["code"], additional_data={"phase": "register"}
+        )
+
+        AccountService.reset_email_register_error_rate_limit(args["email"])
+        return {"is_valid": True, "email": token_data.get("email"), "token": new_token}
+
+
+@console_ns.route("/email-register")
+class EmailRegisterResetApi(Resource):
+    @setup_required
+    @email_password_login_enabled
+    @email_register_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("token", type=str, required=True, nullable=False, location="json")
+            .add_argument("new_password", type=valid_password, required=True, nullable=False, location="json")
+            .add_argument("password_confirm", type=valid_password, required=True, nullable=False, location="json")
+        )
+        args = parser.parse_args()
+
+        # Validate passwords match
+        if args["new_password"] != args["password_confirm"]:
+            raise PasswordMismatchError()
+
+        # Validate token and get register data
+        register_data = AccountService.get_email_register_data(args["token"])
+        if not register_data:
+            raise InvalidTokenError()
+        # Must use token in reset phase
+        if register_data.get("phase", "") != "register":
+            raise InvalidTokenError()
+
+        # Revoke token to prevent reuse
+        AccountService.revoke_email_register_token(args["token"])
+
+        email = register_data.get("email", "")
+
+        with Session(db.engine) as session:
+            account = session.execute(select(Account).filter_by(email=email)).scalar_one_or_none()
+
+            if account:
+                raise EmailAlreadyInUseError()
+            else:
+                account = self._create_new_account(email, args["password_confirm"])
+                if not account:
+                    raise AccountNotFoundError()
+                token_pair = AccountService.login(account=account, ip_address=extract_remote_ip(request))
+                AccountService.reset_login_error_rate_limit(email)
+
+        return {"result": "success", "data": token_pair.model_dump()}
+
+    def _create_new_account(self, email, password) -> Account | None:
+        # Create new account if allowed
+        account = None
+        try:
+            account = AccountService.create_account_and_tenant(
+                email=email,
+                name=email,
+                password=password,
+                interface_language=languages[0],
+            )
+        except AccountRegisterError:
+            raise AccountInFreezeError()
+
+        return account

dify/api/controllers/console/auth/error.py

@@ -0,0 +1,157 @@
+from libs.exception import BaseHTTPException
+
+
+class ApiKeyAuthFailedError(BaseHTTPException):
+    error_code = "auth_failed"
+    description = "{message}"
+    code = 500
+
+
+class InvalidEmailError(BaseHTTPException):
+    error_code = "invalid_email"
+    description = "The email address is not valid."
+    code = 400
+
+
+class PasswordMismatchError(BaseHTTPException):
+    error_code = "password_mismatch"
+    description = "The passwords do not match."
+    code = 400
+
+
+class InvalidTokenError(BaseHTTPException):
+    error_code = "invalid_or_expired_token"
+    description = "The token is invalid or has expired."
+    code = 400
+
+
+class PasswordResetRateLimitExceededError(BaseHTTPException):
+    error_code = "password_reset_rate_limit_exceeded"
+    description = "Too many password reset emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 1):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class EmailRegisterRateLimitExceededError(BaseHTTPException):
+    error_code = "email_register_rate_limit_exceeded"
+    description = "Too many email register emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 1):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class EmailChangeRateLimitExceededError(BaseHTTPException):
+    error_code = "email_change_rate_limit_exceeded"
+    description = "Too many email change emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 1):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class OwnerTransferRateLimitExceededError(BaseHTTPException):
+    error_code = "owner_transfer_rate_limit_exceeded"
+    description = "Too many owner transfer emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 1):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class EmailCodeError(BaseHTTPException):
+    error_code = "email_code_error"
+    description = "Email code is invalid or expired."
+    code = 400
+
+
+class EmailOrPasswordMismatchError(BaseHTTPException):
+    error_code = "email_or_password_mismatch"
+    description = "The email or password is mismatched."
+    code = 400
+
+
+class AuthenticationFailedError(BaseHTTPException):
+    error_code = "authentication_failed"
+    description = "Invalid email or password."
+    code = 401
+
+
+class EmailPasswordLoginLimitError(BaseHTTPException):
+    error_code = "email_code_login_limit"
+    description = "Too many incorrect password attempts. Please try again later."
+    code = 429
+
+
+class EmailCodeLoginRateLimitExceededError(BaseHTTPException):
+    error_code = "email_code_login_rate_limit_exceeded"
+    description = "Too many login emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 5):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class EmailCodeAccountDeletionRateLimitExceededError(BaseHTTPException):
+    error_code = "email_code_account_deletion_rate_limit_exceeded"
+    description = "Too many account deletion emails have been sent. Please try again in {minutes} minutes."
+    code = 429
+
+    def __init__(self, minutes: int = 5):
+        description = self.description.format(minutes=int(minutes)) if self.description else None
+        super().__init__(description=description)
+
+
+class EmailPasswordResetLimitError(BaseHTTPException):
+    error_code = "email_password_reset_limit"
+    description = "Too many failed password reset attempts. Please try again in 24 hours."
+    code = 429
+
+
+class EmailRegisterLimitError(BaseHTTPException):
+    error_code = "email_register_limit"
+    description = "Too many failed email register attempts. Please try again in 24 hours."
+    code = 429
+
+
+class EmailChangeLimitError(BaseHTTPException):
+    error_code = "email_change_limit"
+    description = "Too many failed email change attempts. Please try again in 24 hours."
+    code = 429
+
+
+class EmailAlreadyInUseError(BaseHTTPException):
+    error_code = "email_already_in_use"
+    description = "A user with this email already exists."
+    code = 400
+
+
+class OwnerTransferLimitError(BaseHTTPException):
+    error_code = "owner_transfer_limit"
+    description = "Too many failed owner transfer attempts. Please try again in 24 hours."
+    code = 429
+
+
+class NotOwnerError(BaseHTTPException):
+    error_code = "not_owner"
+    description = "You are not the owner of the workspace."
+    code = 400
+
+
+class CannotTransferOwnerToSelfError(BaseHTTPException):
+    error_code = "cannot_transfer_owner_to_self"
+    description = "You cannot transfer ownership to yourself."
+    code = 400
+
+
+class MemberNotInTenantError(BaseHTTPException):
+    error_code = "member_not_in_tenant"
+    description = "The member is not in the workspace."
+    code = 400

dify/api/controllers/console/auth/forgot_password.py

@@ -0,0 +1,229 @@
+import base64
+import secrets
+
+from flask import request
+from flask_restx import Resource, fields, reqparse
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from controllers.console import console_ns
+from controllers.console.auth.error import (
+    EmailCodeError,
+    EmailPasswordResetLimitError,
+    InvalidEmailError,
+    InvalidTokenError,
+    PasswordMismatchError,
+)
+from controllers.console.error import AccountNotFound, EmailSendIpLimitError
+from controllers.console.wraps import email_password_login_enabled, setup_required
+from events.tenant_event import tenant_was_created
+from extensions.ext_database import db
+from libs.helper import email, extract_remote_ip
+from libs.password import hash_password, valid_password
+from models import Account
+from services.account_service import AccountService, TenantService
+from services.feature_service import FeatureService
+
+
+@console_ns.route("/forgot-password")
+class ForgotPasswordSendEmailApi(Resource):
+    @console_ns.doc("send_forgot_password_email")
+    @console_ns.doc(description="Send password reset email")
+    @console_ns.expect(
+        console_ns.model(
+            "ForgotPasswordEmailRequest",
+            {
+                "email": fields.String(required=True, description="Email address"),
+                "language": fields.String(description="Language for email (zh-Hans/en-US)"),
+            },
+        )
+    )
+    @console_ns.response(
+        200,
+        "Email sent successfully",
+        console_ns.model(
+            "ForgotPasswordEmailResponse",
+            {
+                "result": fields.String(description="Operation result"),
+                "data": fields.String(description="Reset token"),
+                "code": fields.String(description="Error code if account not found"),
+            },
+        ),
+    )
+    @console_ns.response(400, "Invalid email or rate limit exceeded")
+    @setup_required
+    @email_password_login_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=email, required=True, location="json")
+            .add_argument("language", type=str, required=False, location="json")
+        )
+        args = parser.parse_args()
+
+        ip_address = extract_remote_ip(request)
+        if AccountService.is_email_send_ip_limit(ip_address):
+            raise EmailSendIpLimitError()
+
+        if args["language"] is not None and args["language"] == "zh-Hans":
+            language = "zh-Hans"
+        else:
+            language = "en-US"
+
+        with Session(db.engine) as session:
+            account = session.execute(select(Account).filter_by(email=args["email"])).scalar_one_or_none()
+
+        token = AccountService.send_reset_password_email(
+            account=account,
+            email=args["email"],
+            language=language,
+            is_allow_register=FeatureService.get_system_features().is_allow_register,
+        )
+
+        return {"result": "success", "data": token}
+
+
+@console_ns.route("/forgot-password/validity")
+class ForgotPasswordCheckApi(Resource):
+    @console_ns.doc("check_forgot_password_code")
+    @console_ns.doc(description="Verify password reset code")
+    @console_ns.expect(
+        console_ns.model(
+            "ForgotPasswordCheckRequest",
+            {
+                "email": fields.String(required=True, description="Email address"),
+                "code": fields.String(required=True, description="Verification code"),
+                "token": fields.String(required=True, description="Reset token"),
+            },
+        )
+    )
+    @console_ns.response(
+        200,
+        "Code verified successfully",
+        console_ns.model(
+            "ForgotPasswordCheckResponse",
+            {
+                "is_valid": fields.Boolean(description="Whether code is valid"),
+                "email": fields.String(description="Email address"),
+                "token": fields.String(description="New reset token"),
+            },
+        ),
+    )
+    @console_ns.response(400, "Invalid code or token")
+    @setup_required
+    @email_password_login_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=str, required=True, location="json")
+            .add_argument("code", type=str, required=True, location="json")
+            .add_argument("token", type=str, required=True, nullable=False, location="json")
+        )
+        args = parser.parse_args()
+
+        user_email = args["email"]
+
+        is_forgot_password_error_rate_limit = AccountService.is_forgot_password_error_rate_limit(args["email"])
+        if is_forgot_password_error_rate_limit:
+            raise EmailPasswordResetLimitError()
+
+        token_data = AccountService.get_reset_password_data(args["token"])
+        if token_data is None:
+            raise InvalidTokenError()
+
+        if user_email != token_data.get("email"):
+            raise InvalidEmailError()
+
+        if args["code"] != token_data.get("code"):
+            AccountService.add_forgot_password_error_rate_limit(args["email"])
+            raise EmailCodeError()
+
+        # Verified, revoke the first token
+        AccountService.revoke_reset_password_token(args["token"])
+
+        # Refresh token data by generating a new token
+        _, new_token = AccountService.generate_reset_password_token(
+            user_email, code=args["code"], additional_data={"phase": "reset"}
+        )
+
+        AccountService.reset_forgot_password_error_rate_limit(args["email"])
+        return {"is_valid": True, "email": token_data.get("email"), "token": new_token}
+
+
+@console_ns.route("/forgot-password/resets")
+class ForgotPasswordResetApi(Resource):
+    @console_ns.doc("reset_password")
+    @console_ns.doc(description="Reset password with verification token")
+    @console_ns.expect(
+        console_ns.model(
+            "ForgotPasswordResetRequest",
+            {
+                "token": fields.String(required=True, description="Verification token"),
+                "new_password": fields.String(required=True, description="New password"),
+                "password_confirm": fields.String(required=True, description="Password confirmation"),
+            },
+        )
+    )
+    @console_ns.response(
+        200,
+        "Password reset successfully",
+        console_ns.model("ForgotPasswordResetResponse", {"result": fields.String(description="Operation result")}),
+    )
+    @console_ns.response(400, "Invalid token or password mismatch")
+    @setup_required
+    @email_password_login_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("token", type=str, required=True, nullable=False, location="json")
+            .add_argument("new_password", type=valid_password, required=True, nullable=False, location="json")
+            .add_argument("password_confirm", type=valid_password, required=True, nullable=False, location="json")
+        )
+        args = parser.parse_args()
+
+        # Validate passwords match
+        if args["new_password"] != args["password_confirm"]:
+            raise PasswordMismatchError()
+
+        # Validate token and get reset data
+        reset_data = AccountService.get_reset_password_data(args["token"])
+        if not reset_data:
+            raise InvalidTokenError()
+        # Must use token in reset phase
+        if reset_data.get("phase", "") != "reset":
+            raise InvalidTokenError()
+
+        # Revoke token to prevent reuse
+        AccountService.revoke_reset_password_token(args["token"])
+
+        # Generate secure salt and hash password
+        salt = secrets.token_bytes(16)
+        password_hashed = hash_password(args["new_password"], salt)
+
+        email = reset_data.get("email", "")
+
+        with Session(db.engine) as session:
+            account = session.execute(select(Account).filter_by(email=email)).scalar_one_or_none()
+
+            if account:
+                self._update_existing_account(account, password_hashed, salt, session)
+            else:
+                raise AccountNotFound()
+
+        return {"result": "success"}
+
+    def _update_existing_account(self, account, password_hashed, salt, session):
+        # Update existing account credentials
+        account.password = base64.b64encode(password_hashed).decode()
+        account.password_salt = base64.b64encode(salt).decode()
+        session.commit()
+
+        # Create workspace if needed
+        if (
+            not TenantService.get_join_tenants(account)
+            and FeatureService.get_system_features().is_allow_create_workspace
+        ):
+            tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
+            TenantService.create_tenant_member(tenant, account, role="owner")
+            account.current_tenant = tenant
+            tenant_was_created.send(tenant)

dify/api/controllers/console/auth/login.py

@@ -0,0 +1,291 @@
+import flask_login
+from flask import make_response, request
+from flask_restx import Resource, reqparse
+
+import services
+from configs import dify_config
+from constants.languages import get_valid_language
+from controllers.console import console_ns
+from controllers.console.auth.error import (
+    AuthenticationFailedError,
+    EmailCodeError,
+    EmailPasswordLoginLimitError,
+    InvalidEmailError,
+    InvalidTokenError,
+)
+from controllers.console.error import (
+    AccountBannedError,
+    AccountInFreezeError,
+    AccountNotFound,
+    EmailSendIpLimitError,
+    NotAllowedCreateWorkspace,
+    WorkspacesLimitExceeded,
+)
+from controllers.console.wraps import email_password_login_enabled, setup_required
+from events.tenant_event import tenant_was_created
+from libs.helper import email, extract_remote_ip
+from libs.login import current_account_with_tenant
+from libs.token import (
+    clear_access_token_from_cookie,
+    clear_csrf_token_from_cookie,
+    clear_refresh_token_from_cookie,
+    extract_refresh_token,
+    set_access_token_to_cookie,
+    set_csrf_token_to_cookie,
+    set_refresh_token_to_cookie,
+)
+from services.account_service import AccountService, RegisterService, TenantService
+from services.billing_service import BillingService
+from services.errors.account import AccountRegisterError
+from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
+from services.feature_service import FeatureService
+
+
+@console_ns.route("/login")
+class LoginApi(Resource):
+    """Resource for user login."""
+
+    @setup_required
+    @email_password_login_enabled
+    def post(self):
+        """Authenticate user and login."""
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=email, required=True, location="json")
+            .add_argument("password", type=str, required=True, location="json")
+            .add_argument("remember_me", type=bool, required=False, default=False, location="json")
+            .add_argument("invite_token", type=str, required=False, default=None, location="json")
+        )
+        args = parser.parse_args()
+
+        if dify_config.BILLING_ENABLED and BillingService.is_email_in_freeze(args["email"]):
+            raise AccountInFreezeError()
+
+        is_login_error_rate_limit = AccountService.is_login_error_rate_limit(args["email"])
+        if is_login_error_rate_limit:
+            raise EmailPasswordLoginLimitError()
+
+        invitation = args["invite_token"]
+        if invitation:
+            invitation = RegisterService.get_invitation_if_token_valid(None, args["email"], invitation)
+
+        try:
+            if invitation:
+                data = invitation.get("data", {})
+                invitee_email = data.get("email") if data else None
+                if invitee_email != args["email"]:
+                    raise InvalidEmailError()
+                account = AccountService.authenticate(args["email"], args["password"], args["invite_token"])
+            else:
+                account = AccountService.authenticate(args["email"], args["password"])
+        except services.errors.account.AccountLoginError:
+            raise AccountBannedError()
+        except services.errors.account.AccountPasswordError:
+            AccountService.add_login_error_rate_limit(args["email"])
+            raise AuthenticationFailedError()
+        # SELF_HOSTED only have one workspace
+        tenants = TenantService.get_join_tenants(account)
+        if len(tenants) == 0:
+            system_features = FeatureService.get_system_features()
+
+            if system_features.is_allow_create_workspace and not system_features.license.workspaces.is_available():
+                raise WorkspacesLimitExceeded()
+            else:
+                return {
+                    "result": "fail",
+                    "data": "workspace not found, please contact system admin to invite you to join in a workspace",
+                }
+
+        token_pair = AccountService.login(account=account, ip_address=extract_remote_ip(request))
+        AccountService.reset_login_error_rate_limit(args["email"])
+
+        # Create response with cookies instead of returning tokens in body
+        response = make_response({"result": "success"})
+
+        set_access_token_to_cookie(request, response, token_pair.access_token)
+        set_refresh_token_to_cookie(request, response, token_pair.refresh_token)
+        set_csrf_token_to_cookie(request, response, token_pair.csrf_token)
+
+        return response
+
+
+@console_ns.route("/logout")
+class LogoutApi(Resource):
+    @setup_required
+    def post(self):
+        current_user, _ = current_account_with_tenant()
+        account = current_user
+        if isinstance(account, flask_login.AnonymousUserMixin):
+            response = make_response({"result": "success"})
+        else:
+            AccountService.logout(account=account)
+            flask_login.logout_user()
+            response = make_response({"result": "success"})
+
+        # Clear cookies on logout
+        clear_access_token_from_cookie(response)
+        clear_refresh_token_from_cookie(response)
+        clear_csrf_token_from_cookie(response)
+
+        return response
+
+
+@console_ns.route("/reset-password")
+class ResetPasswordSendEmailApi(Resource):
+    @setup_required
+    @email_password_login_enabled
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=email, required=True, location="json")
+            .add_argument("language", type=str, required=False, location="json")
+        )
+        args = parser.parse_args()
+
+        if args["language"] is not None and args["language"] == "zh-Hans":
+            language = "zh-Hans"
+        else:
+            language = "en-US"
+        try:
+            account = AccountService.get_user_through_email(args["email"])
+        except AccountRegisterError:
+            raise AccountInFreezeError()
+
+        token = AccountService.send_reset_password_email(
+            email=args["email"],
+            account=account,
+            language=language,
+            is_allow_register=FeatureService.get_system_features().is_allow_register,
+        )
+
+        return {"result": "success", "data": token}
+
+
+@console_ns.route("/email-code-login")
+class EmailCodeLoginSendEmailApi(Resource):
+    @setup_required
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=email, required=True, location="json")
+            .add_argument("language", type=str, required=False, location="json")
+        )
+        args = parser.parse_args()
+
+        ip_address = extract_remote_ip(request)
+        if AccountService.is_email_send_ip_limit(ip_address):
+            raise EmailSendIpLimitError()
+
+        if args["language"] is not None and args["language"] == "zh-Hans":
+            language = "zh-Hans"
+        else:
+            language = "en-US"
+        try:
+            account = AccountService.get_user_through_email(args["email"])
+        except AccountRegisterError:
+            raise AccountInFreezeError()
+
+        if account is None:
+            if FeatureService.get_system_features().is_allow_register:
+                token = AccountService.send_email_code_login_email(email=args["email"], language=language)
+            else:
+                raise AccountNotFound()
+        else:
+            token = AccountService.send_email_code_login_email(account=account, language=language)
+
+        return {"result": "success", "data": token}
+
+
+@console_ns.route("/email-code-login/validity")
+class EmailCodeLoginApi(Resource):
+    @setup_required
+    def post(self):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("email", type=str, required=True, location="json")
+            .add_argument("code", type=str, required=True, location="json")
+            .add_argument("token", type=str, required=True, location="json")
+            .add_argument("language", type=str, required=False, location="json")
+        )
+        args = parser.parse_args()
+
+        user_email = args["email"]
+        language = args["language"]
+
+        token_data = AccountService.get_email_code_login_data(args["token"])
+        if token_data is None:
+            raise InvalidTokenError()
+
+        if token_data["email"] != args["email"]:
+            raise InvalidEmailError()
+
+        if token_data["code"] != args["code"]:
+            raise EmailCodeError()
+
+        AccountService.revoke_email_code_login_token(args["token"])
+        try:
+            account = AccountService.get_user_through_email(user_email)
+        except AccountRegisterError:
+            raise AccountInFreezeError()
+        if account:
+            tenants = TenantService.get_join_tenants(account)
+            if not tenants:
+                workspaces = FeatureService.get_system_features().license.workspaces
+                if not workspaces.is_available():
+                    raise WorkspacesLimitExceeded()
+                if not FeatureService.get_system_features().is_allow_create_workspace:
+                    raise NotAllowedCreateWorkspace()
+                else:
+                    new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
+                    TenantService.create_tenant_member(new_tenant, account, role="owner")
+                    account.current_tenant = new_tenant
+                    tenant_was_created.send(new_tenant)
+
+        if account is None:
+            try:
+                account = AccountService.create_account_and_tenant(
+                    email=user_email,
+                    name=user_email,
+                    interface_language=get_valid_language(language),
+                )
+            except WorkSpaceNotAllowedCreateError:
+                raise NotAllowedCreateWorkspace()
+            except AccountRegisterError:
+                raise AccountInFreezeError()
+            except WorkspacesLimitExceededError:
+                raise WorkspacesLimitExceeded()
+        token_pair = AccountService.login(account, ip_address=extract_remote_ip(request))
+        AccountService.reset_login_error_rate_limit(args["email"])
+
+        # Create response with cookies instead of returning tokens in body
+        response = make_response({"result": "success"})
+
+        set_csrf_token_to_cookie(request, response, token_pair.csrf_token)
+        # Set HTTP-only secure cookies for tokens
+        set_access_token_to_cookie(request, response, token_pair.access_token)
+        set_refresh_token_to_cookie(request, response, token_pair.refresh_token)
+        return response
+
+
+@console_ns.route("/refresh-token")
+class RefreshTokenApi(Resource):
+    def post(self):
+        # Get refresh token from cookie instead of request body
+        refresh_token = extract_refresh_token(request)
+
+        if not refresh_token:
+            return {"result": "fail", "message": "No refresh token provided"}, 401
+
+        try:
+            new_token_pair = AccountService.refresh_token(refresh_token)
+
+            # Create response with new cookies
+            response = make_response({"result": "success"})
+
+            # Update cookies with new tokens
+            set_csrf_token_to_cookie(request, response, new_token_pair.csrf_token)
+            set_access_token_to_cookie(request, response, new_token_pair.access_token)
+            set_refresh_token_to_cookie(request, response, new_token_pair.refresh_token)
+            return response
+        except Exception as e:
+            return {"result": "fail", "message": str(e)}, 401

dify/api/controllers/console/auth/oauth.py

@@ -0,0 +1,223 @@
+import logging
+
+import httpx
+from flask import current_app, redirect, request
+from flask_restx import Resource
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+from werkzeug.exceptions import Unauthorized
+
+from configs import dify_config
+from constants.languages import languages
+from events.tenant_event import tenant_was_created
+from extensions.ext_database import db
+from libs.datetime_utils import naive_utc_now
+from libs.helper import extract_remote_ip
+from libs.oauth import GitHubOAuth, GoogleOAuth, OAuthUserInfo
+from libs.token import (
+    set_access_token_to_cookie,
+    set_csrf_token_to_cookie,
+    set_refresh_token_to_cookie,
+)
+from models import Account, AccountStatus
+from services.account_service import AccountService, RegisterService, TenantService
+from services.billing_service import BillingService
+from services.errors.account import AccountNotFoundError, AccountRegisterError
+from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkSpaceNotFoundError
+from services.feature_service import FeatureService
+
+from .. import console_ns
+
+logger = logging.getLogger(__name__)
+
+
+def get_oauth_providers():
+    with current_app.app_context():
+        if not dify_config.GITHUB_CLIENT_ID or not dify_config.GITHUB_CLIENT_SECRET:
+            github_oauth = None
+        else:
+            github_oauth = GitHubOAuth(
+                client_id=dify_config.GITHUB_CLIENT_ID,
+                client_secret=dify_config.GITHUB_CLIENT_SECRET,
+                redirect_uri=dify_config.CONSOLE_API_URL + "/console/api/oauth/authorize/github",
+            )
+        if not dify_config.GOOGLE_CLIENT_ID or not dify_config.GOOGLE_CLIENT_SECRET:
+            google_oauth = None
+        else:
+            google_oauth = GoogleOAuth(
+                client_id=dify_config.GOOGLE_CLIENT_ID,
+                client_secret=dify_config.GOOGLE_CLIENT_SECRET,
+                redirect_uri=dify_config.CONSOLE_API_URL + "/console/api/oauth/authorize/google",
+            )
+
+        OAUTH_PROVIDERS = {"github": github_oauth, "google": google_oauth}
+        return OAUTH_PROVIDERS
+
+
+@console_ns.route("/oauth/login/<provider>")
+class OAuthLogin(Resource):
+    @console_ns.doc("oauth_login")
+    @console_ns.doc(description="Initiate OAuth login process")
+    @console_ns.doc(
+        params={"provider": "OAuth provider name (github/google)", "invite_token": "Optional invitation token"}
+    )
+    @console_ns.response(302, "Redirect to OAuth authorization URL")
+    @console_ns.response(400, "Invalid provider")
+    def get(self, provider: str):
+        invite_token = request.args.get("invite_token") or None
+        OAUTH_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+
+        auth_url = oauth_provider.get_authorization_url(invite_token=invite_token)
+        return redirect(auth_url)
+
+
+@console_ns.route("/oauth/authorize/<provider>")
+class OAuthCallback(Resource):
+    @console_ns.doc("oauth_callback")
+    @console_ns.doc(description="Handle OAuth callback and complete login process")
+    @console_ns.doc(
+        params={
+            "provider": "OAuth provider name (github/google)",
+            "code": "Authorization code from OAuth provider",
+            "state": "Optional state parameter (used for invite token)",
+        }
+    )
+    @console_ns.response(302, "Redirect to console with access token")
+    @console_ns.response(400, "OAuth process failed")
+    def get(self, provider: str):
+        OAUTH_PROVIDERS = get_oauth_providers()
+        with current_app.app_context():
+            oauth_provider = OAUTH_PROVIDERS.get(provider)
+        if not oauth_provider:
+            return {"error": "Invalid provider"}, 400
+
+        code = request.args.get("code")
+        state = request.args.get("state")
+        invite_token = None
+        if state:
+            invite_token = state
+
+        if not code:
+            return {"error": "Authorization code is required"}, 400
+
+        try:
+            token = oauth_provider.get_access_token(code)
+            user_info = oauth_provider.get_user_info(token)
+        except httpx.RequestError as e:
+            error_text = str(e)
+            if isinstance(e, httpx.HTTPStatusError):
+                error_text = e.response.text
+            logger.exception("An error occurred during the OAuth process with %s: %s", provider, error_text)
+            return {"error": "OAuth process failed"}, 400
+
+        if invite_token and RegisterService.is_valid_invite_token(invite_token):
+            invitation = RegisterService.get_invitation_by_token(token=invite_token)
+            if invitation:
+                invitation_email = invitation.get("email", None)
+                if invitation_email != user_info.email:
+                    return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin?message=Invalid invitation token.")
+
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin/invite-settings?invite_token={invite_token}")
+
+        try:
+            account = _generate_account(provider, user_info)
+        except AccountNotFoundError:
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin?message=Account not found.")
+        except (WorkSpaceNotFoundError, WorkSpaceNotAllowedCreateError):
+            return redirect(
+                f"{dify_config.CONSOLE_WEB_URL}/signin"
+                "?message=Workspace not found, please contact system admin to invite you to join in a workspace."
+            )
+        except AccountRegisterError as e:
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin?message={e.description}")
+
+        # Check account status
+        if account.status == AccountStatus.BANNED:
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin?message=Account is banned.")
+
+        if account.status == AccountStatus.PENDING:
+            account.status = AccountStatus.ACTIVE
+            account.initialized_at = naive_utc_now()
+            db.session.commit()
+
+        try:
+            TenantService.create_owner_tenant_if_not_exist(account)
+        except Unauthorized:
+            return redirect(f"{dify_config.CONSOLE_WEB_URL}/signin?message=Workspace not found.")
+        except WorkSpaceNotAllowedCreateError:
+            return redirect(
+                f"{dify_config.CONSOLE_WEB_URL}/signin"
+                "?message=Workspace not found, please contact system admin to invite you to join in a workspace."
+            )
+
+        token_pair = AccountService.login(
+            account=account,
+            ip_address=extract_remote_ip(request),
+        )
+
+        response = redirect(f"{dify_config.CONSOLE_WEB_URL}")
+
+        set_access_token_to_cookie(request, response, token_pair.access_token)
+        set_refresh_token_to_cookie(request, response, token_pair.refresh_token)
+        set_csrf_token_to_cookie(request, response, token_pair.csrf_token)
+        return response
+
+
+def _get_account_by_openid_or_email(provider: str, user_info: OAuthUserInfo) -> Account | None:
+    account: Account | None = Account.get_by_openid(provider, user_info.id)
+
+    if not account:
+        with Session(db.engine) as session:
+            account = session.execute(select(Account).filter_by(email=user_info.email)).scalar_one_or_none()
+
+    return account
+
+
+def _generate_account(provider: str, user_info: OAuthUserInfo):
+    # Get account by openid or email.
+    account = _get_account_by_openid_or_email(provider, user_info)
+
+    if account:
+        tenants = TenantService.get_join_tenants(account)
+        if not tenants:
+            if not FeatureService.get_system_features().is_allow_create_workspace:
+                raise WorkSpaceNotAllowedCreateError()
+            else:
+                new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
+                TenantService.create_tenant_member(new_tenant, account, role="owner")
+                account.current_tenant = new_tenant
+                tenant_was_created.send(new_tenant)
+
+    if not account:
+        if not FeatureService.get_system_features().is_allow_register:
+            if dify_config.BILLING_ENABLED and BillingService.is_email_in_freeze(user_info.email):
+                raise AccountRegisterError(
+                    description=(
+                        "This email account has been deleted within the past "
+                        "30 days and is temporarily unavailable for new account registration"
+                    )
+                )
+            else:
+                raise AccountRegisterError(description=("Invalid email or password"))
+        account_name = user_info.name or "Dify"
+        account = RegisterService.register(
+            email=user_info.email, name=account_name, password=None, open_id=user_info.id, provider=provider
+        )
+
+        # Set interface language
+        preferred_lang = request.accept_languages.best_match(languages)
+        if preferred_lang and preferred_lang in languages:
+            interface_language = preferred_lang
+        else:
+            interface_language = languages[0]
+        account.interface_language = interface_language
+        db.session.commit()
+
+    # Link account
+    AccountService.link_account_integrate(provider, user_info.id, account)
+
+    return account

dify/api/controllers/console/auth/oauth_server.py

@@ -0,0 +1,200 @@
+from collections.abc import Callable
+from functools import wraps
+from typing import Concatenate, ParamSpec, TypeVar
+
+from flask import jsonify, request
+from flask_restx import Resource, reqparse
+from werkzeug.exceptions import BadRequest, NotFound
+
+from controllers.console.wraps import account_initialization_required, setup_required
+from core.model_runtime.utils.encoders import jsonable_encoder
+from libs.login import current_account_with_tenant, login_required
+from models import Account
+from models.model import OAuthProviderApp
+from services.oauth_server import OAUTH_ACCESS_TOKEN_EXPIRES_IN, OAuthGrantType, OAuthServerService
+
+from .. import console_ns
+
+P = ParamSpec("P")
+R = TypeVar("R")
+T = TypeVar("T")
+
+
+def oauth_server_client_id_required(view: Callable[Concatenate[T, OAuthProviderApp, P], R]):
+    @wraps(view)
+    def decorated(self: T, *args: P.args, **kwargs: P.kwargs):
+        parser = reqparse.RequestParser().add_argument("client_id", type=str, required=True, location="json")
+        parsed_args = parser.parse_args()
+        client_id = parsed_args.get("client_id")
+        if not client_id:
+            raise BadRequest("client_id is required")
+
+        oauth_provider_app = OAuthServerService.get_oauth_provider_app(client_id)
+        if not oauth_provider_app:
+            raise NotFound("client_id is invalid")
+
+        return view(self, oauth_provider_app, *args, **kwargs)
+
+    return decorated
+
+
+def oauth_server_access_token_required(view: Callable[Concatenate[T, OAuthProviderApp, Account, P], R]):
+    @wraps(view)
+    def decorated(self: T, oauth_provider_app: OAuthProviderApp, *args: P.args, **kwargs: P.kwargs):
+        if not isinstance(oauth_provider_app, OAuthProviderApp):
+            raise BadRequest("Invalid oauth_provider_app")
+
+        authorization_header = request.headers.get("Authorization")
+        if not authorization_header:
+            response = jsonify({"error": "Authorization header is required"})
+            response.status_code = 401
+            response.headers["WWW-Authenticate"] = "Bearer"
+            return response
+
+        parts = authorization_header.strip().split(None, 1)
+        if len(parts) != 2:
+            response = jsonify({"error": "Invalid Authorization header format"})
+            response.status_code = 401
+            response.headers["WWW-Authenticate"] = "Bearer"
+            return response
+
+        token_type = parts[0].strip()
+        if token_type.lower() != "bearer":
+            response = jsonify({"error": "token_type is invalid"})
+            response.status_code = 401
+            response.headers["WWW-Authenticate"] = "Bearer"
+            return response
+
+        access_token = parts[1].strip()
+        if not access_token:
+            response = jsonify({"error": "access_token is required"})
+            response.status_code = 401
+            response.headers["WWW-Authenticate"] = "Bearer"
+            return response
+
+        account = OAuthServerService.validate_oauth_access_token(oauth_provider_app.client_id, access_token)
+        if not account:
+            response = jsonify({"error": "access_token or client_id is invalid"})
+            response.status_code = 401
+            response.headers["WWW-Authenticate"] = "Bearer"
+            return response
+
+        return view(self, oauth_provider_app, account, *args, **kwargs)
+
+    return decorated
+
+
+@console_ns.route("/oauth/provider")
+class OAuthServerAppApi(Resource):
+    @setup_required
+    @oauth_server_client_id_required
+    def post(self, oauth_provider_app: OAuthProviderApp):
+        parser = reqparse.RequestParser().add_argument("redirect_uri", type=str, required=True, location="json")
+        parsed_args = parser.parse_args()
+        redirect_uri = parsed_args.get("redirect_uri")
+
+        # check if redirect_uri is valid
+        if redirect_uri not in oauth_provider_app.redirect_uris:
+            raise BadRequest("redirect_uri is invalid")
+
+        return jsonable_encoder(
+            {
+                "app_icon": oauth_provider_app.app_icon,
+                "app_label": oauth_provider_app.app_label,
+                "scope": oauth_provider_app.scope,
+            }
+        )
+
+
+@console_ns.route("/oauth/provider/authorize")
+class OAuthServerUserAuthorizeApi(Resource):
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @oauth_server_client_id_required
+    def post(self, oauth_provider_app: OAuthProviderApp):
+        current_user, _ = current_account_with_tenant()
+        account = current_user
+        user_account_id = account.id
+
+        code = OAuthServerService.sign_oauth_authorization_code(oauth_provider_app.client_id, user_account_id)
+        return jsonable_encoder(
+            {
+                "code": code,
+            }
+        )
+
+
+@console_ns.route("/oauth/provider/token")
+class OAuthServerUserTokenApi(Resource):
+    @setup_required
+    @oauth_server_client_id_required
+    def post(self, oauth_provider_app: OAuthProviderApp):
+        parser = (
+            reqparse.RequestParser()
+            .add_argument("grant_type", type=str, required=True, location="json")
+            .add_argument("code", type=str, required=False, location="json")
+            .add_argument("client_secret", type=str, required=False, location="json")
+            .add_argument("redirect_uri", type=str, required=False, location="json")
+            .add_argument("refresh_token", type=str, required=False, location="json")
+        )
+        parsed_args = parser.parse_args()
+
+        try:
+            grant_type = OAuthGrantType(parsed_args["grant_type"])
+        except ValueError:
+            raise BadRequest("invalid grant_type")
+
+        if grant_type == OAuthGrantType.AUTHORIZATION_CODE:
+            if not parsed_args["code"]:
+                raise BadRequest("code is required")
+
+            if parsed_args["client_secret"] != oauth_provider_app.client_secret:
+                raise BadRequest("client_secret is invalid")
+
+            if parsed_args["redirect_uri"] not in oauth_provider_app.redirect_uris:
+                raise BadRequest("redirect_uri is invalid")
+
+            access_token, refresh_token = OAuthServerService.sign_oauth_access_token(
+                grant_type, code=parsed_args["code"], client_id=oauth_provider_app.client_id
+            )
+            return jsonable_encoder(
+                {
+                    "access_token": access_token,
+                    "token_type": "Bearer",
+                    "expires_in": OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+                    "refresh_token": refresh_token,
+                }
+            )
+        elif grant_type == OAuthGrantType.REFRESH_TOKEN:
+            if not parsed_args["refresh_token"]:
+                raise BadRequest("refresh_token is required")
+
+            access_token, refresh_token = OAuthServerService.sign_oauth_access_token(
+                grant_type, refresh_token=parsed_args["refresh_token"], client_id=oauth_provider_app.client_id
+            )
+            return jsonable_encoder(
+                {
+                    "access_token": access_token,
+                    "token_type": "Bearer",
+                    "expires_in": OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+                    "refresh_token": refresh_token,
+                }
+            )
+
+
+@console_ns.route("/oauth/provider/account")
+class OAuthServerUserAccountApi(Resource):
+    @setup_required
+    @oauth_server_client_id_required
+    @oauth_server_access_token_required
+    def post(self, oauth_provider_app: OAuthProviderApp, account: Account):
+        return jsonable_encoder(
+            {
+                "name": account.name,
+                "email": account.email,
+                "avatar": account.avatar,
+                "interface_language": account.interface_language,
+                "timezone": account.timezone,
+            }
+        )