dify

dify/api/tests/integration_tests/controllers/console/app/test_chat_message_permissions.py

@@ -0,0 +1,219 @@
+"""Integration tests for ChatMessageApi permission verification."""
+
+import uuid
+from types import SimpleNamespace
+from unittest import mock
+
+import pytest
+from flask.testing import FlaskClient
+
+from controllers.console.app import completion as completion_api
+from controllers.console.app import message as message_api
+from controllers.console.app import wraps
+from libs.datetime_utils import naive_utc_now
+from models import App, Tenant
+from models.account import Account, TenantAccountJoin, TenantAccountRole
+from models.model import AppMode
+from services.app_generate_service import AppGenerateService
+
+
+class TestChatMessageApiPermissions:
+    """Test permission verification for ChatMessageApi endpoint."""
+
+    @pytest.fixture
+    def mock_app_model(self):
+        """Create a mock App model for testing."""
+        app = App()
+        app.id = str(uuid.uuid4())
+        app.mode = AppMode.CHAT
+        app.tenant_id = str(uuid.uuid4())
+        app.status = "normal"
+        return app
+
+    @pytest.fixture
+    def mock_account(self, monkeypatch: pytest.MonkeyPatch):
+        """Create a mock Account for testing."""
+
+        account = Account(
+            name="Test User",
+            email="test@example.com",
+        )
+        account.last_active_at = naive_utc_now()
+        account.created_at = naive_utc_now()
+        account.updated_at = naive_utc_now()
+        account.id = str(uuid.uuid4())
+
+        # Create mock tenant
+        tenant = Tenant(name="Test Tenant")
+        tenant.id = str(uuid.uuid4())
+
+        mock_session_instance = mock.Mock()
+
+        mock_tenant_join = TenantAccountJoin(role=TenantAccountRole.OWNER)
+        monkeypatch.setattr(mock_session_instance, "scalar", mock.Mock(return_value=mock_tenant_join))
+
+        mock_scalars_result = mock.Mock()
+        mock_scalars_result.one.return_value = tenant
+        monkeypatch.setattr(mock_session_instance, "scalars", mock.Mock(return_value=mock_scalars_result))
+
+        mock_session_context = mock.Mock()
+        mock_session_context.__enter__.return_value = mock_session_instance
+        monkeypatch.setattr("models.account.Session", lambda _, expire_on_commit: mock_session_context)
+
+        account.current_tenant = tenant
+        return account
+
+    @pytest.mark.parametrize(
+        ("role", "status"),
+        [
+            (TenantAccountRole.OWNER, 200),
+            (TenantAccountRole.ADMIN, 200),
+            (TenantAccountRole.EDITOR, 200),
+            (TenantAccountRole.NORMAL, 403),
+            (TenantAccountRole.DATASET_OPERATOR, 403),
+        ],
+    )
+    def test_post_with_owner_role_succeeds(
+        self,
+        test_client: FlaskClient,
+        auth_header,
+        monkeypatch,
+        mock_app_model,
+        mock_account,
+        role: TenantAccountRole,
+        status: int,
+    ):
+        """Test that OWNER role can access chat-messages endpoint."""
+
+        """Setup common mocks for testing."""
+        # Mock app loading
+
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        # Mock current user
+        monkeypatch.setattr(completion_api, "current_user", mock_account)
+
+        mock_generate = mock.Mock(return_value={"message": "Test response"})
+        monkeypatch.setattr(AppGenerateService, "generate", mock_generate)
+
+        # Set user role to OWNER
+        mock_account.role = role
+
+        response = test_client.post(
+            f"/console/api/apps/{mock_app_model.id}/chat-messages",
+            headers=auth_header,
+            json={
+                "inputs": {},
+                "query": "Hello, world!",
+                "model_config": {
+                    "model": {"provider": "openai", "name": "gpt-4", "mode": "chat", "completion_params": {}}
+                },
+                "response_mode": "blocking",
+            },
+        )
+
+        assert response.status_code == status
+
+    @pytest.mark.parametrize(
+        ("role", "status"),
+        [
+            (TenantAccountRole.OWNER, 200),
+            (TenantAccountRole.ADMIN, 200),
+            (TenantAccountRole.EDITOR, 200),
+            (TenantAccountRole.NORMAL, 403),
+            (TenantAccountRole.DATASET_OPERATOR, 403),
+        ],
+    )
+    def test_get_requires_edit_permission(
+        self,
+        test_client: FlaskClient,
+        auth_header,
+        monkeypatch,
+        mock_app_model,
+        mock_account,
+        role: TenantAccountRole,
+        status: int,
+    ):
+        """Ensure GET chat-messages endpoint enforces edit permissions."""
+
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        conversation_id = uuid.uuid4()
+        created_at = naive_utc_now()
+
+        mock_conversation = SimpleNamespace(id=str(conversation_id), app_id=str(mock_app_model.id))
+        mock_message = SimpleNamespace(
+            id=str(uuid.uuid4()),
+            conversation_id=str(conversation_id),
+            inputs=[],
+            query="hello",
+            message=[{"text": "hello"}],
+            message_tokens=0,
+            re_sign_file_url_answer="",
+            answer_tokens=0,
+            provider_response_latency=0.0,
+            from_source="console",
+            from_end_user_id=None,
+            from_account_id=mock_account.id,
+            feedbacks=[],
+            workflow_run_id=None,
+            annotation=None,
+            annotation_hit_history=None,
+            created_at=created_at,
+            agent_thoughts=[],
+            message_files=[],
+            message_metadata_dict={},
+            status="success",
+            error="",
+            parent_message_id=None,
+        )
+
+        class MockQuery:
+            def __init__(self, model):
+                self.model = model
+
+            def where(self, *args, **kwargs):
+                return self
+
+            def first(self):
+                if getattr(self.model, "__name__", "") == "Conversation":
+                    return mock_conversation
+                return None
+
+            def order_by(self, *args, **kwargs):
+                return self
+
+            def limit(self, *_):
+                return self
+
+            def all(self):
+                if getattr(self.model, "__name__", "") == "Message":
+                    return [mock_message]
+                return []
+
+        mock_session = mock.Mock()
+        mock_session.query.side_effect = MockQuery
+        mock_session.scalar.return_value = False
+
+        monkeypatch.setattr(message_api, "db", SimpleNamespace(session=mock_session))
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        class DummyPagination:
+            def __init__(self, data, limit, has_more):
+                self.data = data
+                self.limit = limit
+                self.has_more = has_more
+
+        monkeypatch.setattr(message_api, "InfiniteScrollPagination", DummyPagination)
+
+        mock_account.role = role
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/chat-messages",
+            headers=auth_header,
+            query_string={"conversation_id": str(conversation_id)},
+        )
+
+        assert response.status_code == status

dify/api/tests/integration_tests/controllers/console/app/test_description_validation.py

@@ -0,0 +1,131 @@
+"""
+Unit tests for App description validation functions.
+
+This test module validates the 400-character limit enforcement
+for App descriptions across all creation and editing endpoints.
+"""
+
+import os
+import sys
+
+import pytest
+
+# Add the API root to Python path for imports
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", ".."))
+
+
+class TestAppDescriptionValidationUnit:
+    """Unit tests for description validation function"""
+
+    def test_validate_description_length_function(self):
+        """Test the validate_description_length function directly"""
+        from libs.validators import validate_description_length
+
+        # Test valid descriptions
+        assert validate_description_length("") == ""
+        assert validate_description_length("x" * 400) == "x" * 400
+        assert validate_description_length(None) is None
+
+        # Test invalid descriptions
+        with pytest.raises(ValueError) as exc_info:
+            validate_description_length("x" * 401)
+        assert "Description cannot exceed 400 characters." in str(exc_info.value)
+
+        with pytest.raises(ValueError) as exc_info:
+            validate_description_length("x" * 500)
+        assert "Description cannot exceed 400 characters." in str(exc_info.value)
+
+        with pytest.raises(ValueError) as exc_info:
+            validate_description_length("x" * 1000)
+        assert "Description cannot exceed 400 characters." in str(exc_info.value)
+
+    def test_boundary_values(self):
+        """Test boundary values for description validation"""
+        from libs.validators import validate_description_length
+
+        # Test exact boundary
+        exactly_400 = "x" * 400
+        assert validate_description_length(exactly_400) == exactly_400
+
+        # Test just over boundary
+        just_over_400 = "x" * 401
+        with pytest.raises(ValueError):
+            validate_description_length(just_over_400)
+
+        # Test just under boundary
+        just_under_400 = "x" * 399
+        assert validate_description_length(just_under_400) == just_under_400
+
+    def test_edge_cases(self):
+        """Test edge cases for description validation"""
+        from libs.validators import validate_description_length
+
+        # Test None input
+        assert validate_description_length(None) is None
+
+        # Test empty string
+        assert validate_description_length("") == ""
+
+        # Test single character
+        assert validate_description_length("a") == "a"
+
+        # Test unicode characters
+        unicode_desc = "测试" * 200  # 400 characters in Chinese
+        assert validate_description_length(unicode_desc) == unicode_desc
+
+        # Test unicode over limit
+        unicode_over = "测试" * 201  # 402 characters
+        with pytest.raises(ValueError):
+            validate_description_length(unicode_over)
+
+    def test_whitespace_handling(self):
+        """Test how validation handles whitespace"""
+        from libs.validators import validate_description_length
+
+        # Test description with spaces
+        spaces_400 = " " * 400
+        assert validate_description_length(spaces_400) == spaces_400
+
+        # Test description with spaces over limit
+        spaces_401 = " " * 401
+        with pytest.raises(ValueError):
+            validate_description_length(spaces_401)
+
+        # Test mixed content
+        mixed_400 = "a" * 200 + " " * 200
+        assert validate_description_length(mixed_400) == mixed_400
+
+        # Test mixed over limit
+        mixed_401 = "a" * 200 + " " * 201
+        with pytest.raises(ValueError):
+            validate_description_length(mixed_401)
+
+
+if __name__ == "__main__":
+    # Run tests directly
+    import traceback
+
+    test_instance = TestAppDescriptionValidationUnit()
+    test_methods = [method for method in dir(test_instance) if method.startswith("test_")]
+
+    passed = 0
+    failed = 0
+
+    for test_method in test_methods:
+        try:
+            print(f"Running {test_method}...")
+            getattr(test_instance, test_method)()
+            print(f"✅ {test_method} PASSED")
+            passed += 1
+        except Exception as e:
+            print(f"❌ {test_method} FAILED: {str(e)}")
+            traceback.print_exc()
+            failed += 1
+
+    print(f"\n📊 Test Results: {passed} passed, {failed} failed")
+
+    if failed == 0:
+        print("🎉 All tests passed!")
+    else:
+        print("💥 Some tests failed!")
+        sys.exit(1)

dify/api/tests/integration_tests/controllers/console/app/test_feedback_api_basic.py

@@ -0,0 +1,106 @@
+"""Basic integration tests for Feedback API endpoints."""
+
+import uuid
+
+from flask.testing import FlaskClient
+
+
+class TestFeedbackApiBasic:
+    """Basic tests for feedback API endpoints."""
+
+    def test_feedback_export_endpoint_exists(self, test_client: FlaskClient, auth_header):
+        """Test that feedback export endpoint exists and handles basic requests."""
+
+        app_id = str(uuid.uuid4())
+
+        # Test endpoint exists (even if it fails, it should return 500 or 403, not 404)
+        response = test_client.get(
+            f"/console/api/apps/{app_id}/feedbacks/export", headers=auth_header, query_string={"format": "csv"}
+        )
+
+        # Should not return 404 (endpoint exists)
+        assert response.status_code != 404
+
+        # Should return authentication or permission error
+        assert response.status_code in [401, 403, 500]  # 500 if app doesn't exist, 403 if no permission
+
+    def test_feedback_summary_endpoint_exists(self, test_client: FlaskClient, auth_header):
+        """Test that feedback summary endpoint exists and handles basic requests."""
+
+        app_id = str(uuid.uuid4())
+
+        # Test endpoint exists
+        response = test_client.get(f"/console/api/apps/{app_id}/feedbacks/summary", headers=auth_header)
+
+        # Should not return 404 (endpoint exists)
+        assert response.status_code != 404
+
+        # Should return authentication or permission error
+        assert response.status_code in [401, 403, 500]
+
+    def test_feedback_export_invalid_format(self, test_client: FlaskClient, auth_header):
+        """Test feedback export endpoint with invalid format parameter."""
+
+        app_id = str(uuid.uuid4())
+
+        # Test with invalid format
+        response = test_client.get(
+            f"/console/api/apps/{app_id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"format": "invalid_format"},
+        )
+
+        # Should not return 404
+        assert response.status_code != 404
+
+    def test_feedback_export_with_filters(self, test_client: FlaskClient, auth_header):
+        """Test feedback export endpoint with various filter parameters."""
+
+        app_id = str(uuid.uuid4())
+
+        # Test with various filter combinations
+        filter_params = [
+            {"from_source": "user"},
+            {"rating": "like"},
+            {"has_comment": True},
+            {"start_date": "2024-01-01"},
+            {"end_date": "2024-12-31"},
+            {"format": "json"},
+            {
+                "from_source": "admin",
+                "rating": "dislike",
+                "has_comment": True,
+                "start_date": "2024-01-01",
+                "end_date": "2024-12-31",
+                "format": "csv",
+            },
+        ]
+
+        for params in filter_params:
+            response = test_client.get(
+                f"/console/api/apps/{app_id}/feedbacks/export", headers=auth_header, query_string=params
+            )
+
+            # Should not return 404
+            assert response.status_code != 404
+
+    def test_feedback_export_invalid_dates(self, test_client: FlaskClient, auth_header):
+        """Test feedback export endpoint with invalid date formats."""
+
+        app_id = str(uuid.uuid4())
+
+        # Test with invalid date formats
+        invalid_dates = [
+            {"start_date": "invalid-date"},
+            {"end_date": "not-a-date"},
+            {"start_date": "2024-13-01"},  # Invalid month
+            {"end_date": "2024-12-32"},  # Invalid day
+        ]
+
+        for params in invalid_dates:
+            response = test_client.get(
+                f"/console/api/apps/{app_id}/feedbacks/export", headers=auth_header, query_string=params
+            )
+
+            # Should not return 404
+            assert response.status_code != 404

dify/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py

@@ -0,0 +1,334 @@
+"""Integration tests for Feedback Export API endpoints."""
+
+import json
+import uuid
+from datetime import datetime
+from types import SimpleNamespace
+from unittest import mock
+
+import pytest
+from flask.testing import FlaskClient
+
+from controllers.console.app import message as message_api
+from controllers.console.app import wraps
+from libs.datetime_utils import naive_utc_now
+from models import App, Tenant
+from models.account import Account, TenantAccountJoin, TenantAccountRole
+from models.model import AppMode, MessageFeedback
+from services.feedback_service import FeedbackService
+
+
+class TestFeedbackExportApi:
+    """Test feedback export API endpoints."""
+
+    @pytest.fixture
+    def mock_app_model(self):
+        """Create a mock App model for testing."""
+        app = App()
+        app.id = str(uuid.uuid4())
+        app.mode = AppMode.CHAT
+        app.tenant_id = str(uuid.uuid4())
+        app.status = "normal"
+        app.name = "Test App"
+        return app
+
+    @pytest.fixture
+    def mock_account(self, monkeypatch: pytest.MonkeyPatch):
+        """Create a mock Account for testing."""
+        account = Account(
+            name="Test User",
+            email="test@example.com",
+        )
+        account.last_active_at = naive_utc_now()
+        account.created_at = naive_utc_now()
+        account.updated_at = naive_utc_now()
+        account.id = str(uuid.uuid4())
+
+        # Create mock tenant
+        tenant = Tenant(name="Test Tenant")
+        tenant.id = str(uuid.uuid4())
+
+        mock_session_instance = mock.Mock()
+
+        mock_tenant_join = TenantAccountJoin(role=TenantAccountRole.OWNER)
+        monkeypatch.setattr(mock_session_instance, "scalar", mock.Mock(return_value=mock_tenant_join))
+
+        mock_scalars_result = mock.Mock()
+        mock_scalars_result.one.return_value = tenant
+        monkeypatch.setattr(mock_session_instance, "scalars", mock.Mock(return_value=mock_scalars_result))
+
+        mock_session_context = mock.Mock()
+        mock_session_context.__enter__.return_value = mock_session_instance
+        monkeypatch.setattr("models.account.Session", lambda _, expire_on_commit: mock_session_context)
+
+        account.current_tenant = tenant
+        return account
+
+    @pytest.fixture
+    def sample_feedback_data(self):
+        """Create sample feedback data for testing."""
+        app_id = str(uuid.uuid4())
+        conversation_id = str(uuid.uuid4())
+        message_id = str(uuid.uuid4())
+
+        # Mock feedback data
+        user_feedback = MessageFeedback(
+            id=str(uuid.uuid4()),
+            app_id=app_id,
+            conversation_id=conversation_id,
+            message_id=message_id,
+            rating="like",
+            from_source="user",
+            content=None,
+            from_end_user_id=str(uuid.uuid4()),
+            from_account_id=None,
+            created_at=naive_utc_now(),
+        )
+
+        admin_feedback = MessageFeedback(
+            id=str(uuid.uuid4()),
+            app_id=app_id,
+            conversation_id=conversation_id,
+            message_id=message_id,
+            rating="dislike",
+            from_source="admin",
+            content="The response was not helpful",
+            from_end_user_id=None,
+            from_account_id=str(uuid.uuid4()),
+            created_at=naive_utc_now(),
+        )
+
+        # Mock message and conversation
+        mock_message = SimpleNamespace(
+            id=message_id,
+            conversation_id=conversation_id,
+            query="What is the weather today?",
+            answer="It's sunny and 25 degrees outside.",
+            inputs={"query": "What is the weather today?"},
+            created_at=naive_utc_now(),
+        )
+
+        mock_conversation = SimpleNamespace(id=conversation_id, name="Weather Conversation", app_id=app_id)
+
+        mock_app = SimpleNamespace(id=app_id, name="Weather App")
+
+        return {
+            "user_feedback": user_feedback,
+            "admin_feedback": admin_feedback,
+            "message": mock_message,
+            "conversation": mock_conversation,
+            "app": mock_app,
+        }
+
+    @pytest.mark.parametrize(
+        ("role", "status"),
+        [
+            (TenantAccountRole.OWNER, 200),
+            (TenantAccountRole.ADMIN, 200),
+            (TenantAccountRole.EDITOR, 200),
+            (TenantAccountRole.NORMAL, 403),
+            (TenantAccountRole.DATASET_OPERATOR, 403),
+        ],
+    )
+    def test_feedback_export_permissions(
+        self,
+        test_client: FlaskClient,
+        auth_header,
+        monkeypatch,
+        mock_app_model,
+        mock_account,
+        role: TenantAccountRole,
+        status: int,
+    ):
+        """Test feedback export endpoint permissions."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        mock_export_feedbacks = mock.Mock(return_value="mock csv response")
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        # Set user role
+        mock_account.role = role
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"format": "csv"},
+        )
+
+        assert response.status_code == status
+
+        if status == 200:
+            mock_export_feedbacks.assert_called_once()
+
+    def test_feedback_export_csv_format(
+        self, test_client: FlaskClient, auth_header, monkeypatch, mock_app_model, mock_account, sample_feedback_data
+    ):
+        """Test feedback export in CSV format."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        # Create mock CSV response
+        mock_csv_content = (
+            "feedback_id,app_name,conversation_id,user_query,ai_response,feedback_rating,feedback_comment\n"
+        )
+        mock_csv_content += f"{sample_feedback_data['user_feedback'].id},{sample_feedback_data['app'].name},"
+        mock_csv_content += f"{sample_feedback_data['conversation'].id},{sample_feedback_data['message'].query},"
+        mock_csv_content += f"{sample_feedback_data['message'].answer},👍,\n"
+
+        mock_response = mock.Mock()
+        mock_response.headers = {"Content-Type": "text/csv; charset=utf-8-sig"}
+        mock_response.data = mock_csv_content.encode("utf-8")
+
+        mock_export_feedbacks = mock.Mock(return_value=mock_response)
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"format": "csv", "from_source": "user"},
+        )
+
+        assert response.status_code == 200
+        assert "text/csv" in response.content_type
+
+    def test_feedback_export_json_format(
+        self, test_client: FlaskClient, auth_header, monkeypatch, mock_app_model, mock_account, sample_feedback_data
+    ):
+        """Test feedback export in JSON format."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        mock_json_response = {
+            "export_info": {
+                "app_id": mock_app_model.id,
+                "export_date": datetime.now().isoformat(),
+                "total_records": 2,
+                "data_source": "dify_feedback_export",
+            },
+            "feedback_data": [
+                {
+                    "feedback_id": sample_feedback_data["user_feedback"].id,
+                    "feedback_rating": "👍",
+                    "feedback_rating_raw": "like",
+                    "feedback_comment": "",
+                }
+            ],
+        }
+
+        mock_response = mock.Mock()
+        mock_response.headers = {"Content-Type": "application/json; charset=utf-8"}
+        mock_response.data = json.dumps(mock_json_response).encode("utf-8")
+
+        mock_export_feedbacks = mock.Mock(return_value=mock_response)
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"format": "json"},
+        )
+
+        assert response.status_code == 200
+        assert "application/json" in response.content_type
+
+    def test_feedback_export_with_filters(
+        self, test_client: FlaskClient, auth_header, monkeypatch, mock_app_model, mock_account
+    ):
+        """Test feedback export with various filters."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        mock_export_feedbacks = mock.Mock(return_value="mock filtered response")
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        # Test with multiple filters
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={
+                "from_source": "user",
+                "rating": "dislike",
+                "has_comment": True,
+                "start_date": "2024-01-01",
+                "end_date": "2024-12-31",
+                "format": "csv",
+            },
+        )
+
+        assert response.status_code == 200
+
+        # Verify service was called with correct parameters
+        mock_export_feedbacks.assert_called_once_with(
+            app_id=mock_app_model.id,
+            from_source="user",
+            rating="dislike",
+            has_comment=True,
+            start_date="2024-01-01",
+            end_date="2024-12-31",
+            format_type="csv",
+        )
+
+    def test_feedback_export_invalid_date_format(
+        self, test_client: FlaskClient, auth_header, monkeypatch, mock_app_model, mock_account
+    ):
+        """Test feedback export with invalid date format."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        # Mock the service to raise ValueError for invalid date
+        mock_export_feedbacks = mock.Mock(side_effect=ValueError("Invalid date format"))
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"start_date": "invalid-date", "format": "csv"},
+        )
+
+        assert response.status_code == 400
+        response_json = response.get_json()
+        assert "Parameter validation error" in response_json["error"]
+
+    def test_feedback_export_server_error(
+        self, test_client: FlaskClient, auth_header, monkeypatch, mock_app_model, mock_account
+    ):
+        """Test feedback export with server error."""
+
+        # Setup mocks
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        # Mock the service to raise an exception
+        mock_export_feedbacks = mock.Mock(side_effect=Exception("Database connection failed"))
+        monkeypatch.setattr(FeedbackService, "export_feedbacks", mock_export_feedbacks)
+
+        monkeypatch.setattr(message_api, "current_user", mock_account)
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/feedbacks/export",
+            headers=auth_header,
+            query_string={"format": "csv"},
+        )
+
+        assert response.status_code == 500

dify/api/tests/integration_tests/controllers/console/app/test_model_config_permissions.py

@@ -0,0 +1,139 @@
+"""Integration tests for ModelConfigResource permission verification."""
+
+import uuid
+from unittest import mock
+
+import pytest
+from flask.testing import FlaskClient
+
+from controllers.console.app import model_config as model_config_api
+from controllers.console.app import wraps
+from libs.datetime_utils import naive_utc_now
+from models import App, Tenant
+from models.account import Account, TenantAccountJoin, TenantAccountRole
+from models.model import AppMode
+from services.app_model_config_service import AppModelConfigService
+
+
+class TestModelConfigResourcePermissions:
+    """Test permission verification for ModelConfigResource endpoint."""
+
+    @pytest.fixture
+    def mock_app_model(self):
+        """Create a mock App model for testing."""
+        app = App()
+        app.id = str(uuid.uuid4())
+        app.mode = AppMode.CHAT
+        app.tenant_id = str(uuid.uuid4())
+        app.status = "normal"
+        app.app_model_config_id = str(uuid.uuid4())
+        return app
+
+    @pytest.fixture
+    def mock_account(self, monkeypatch: pytest.MonkeyPatch):
+        """Create a mock Account for testing."""
+
+        account = Account(name="Test User", email="test@example.com")
+        account.id = str(uuid.uuid4())
+        account.last_active_at = naive_utc_now()
+        account.created_at = naive_utc_now()
+        account.updated_at = naive_utc_now()
+
+        # Create mock tenant
+        tenant = Tenant(name="Test Tenant")
+        tenant.id = str(uuid.uuid4())
+
+        mock_session_instance = mock.Mock()
+
+        mock_tenant_join = TenantAccountJoin(role=TenantAccountRole.OWNER)
+        monkeypatch.setattr(mock_session_instance, "scalar", mock.Mock(return_value=mock_tenant_join))
+
+        mock_scalars_result = mock.Mock()
+        mock_scalars_result.one.return_value = tenant
+        monkeypatch.setattr(mock_session_instance, "scalars", mock.Mock(return_value=mock_scalars_result))
+
+        mock_session_context = mock.Mock()
+        mock_session_context.__enter__.return_value = mock_session_instance
+        monkeypatch.setattr("models.account.Session", lambda _, expire_on_commit: mock_session_context)
+
+        account.current_tenant = tenant
+        return account
+
+    @pytest.mark.parametrize(
+        ("role", "status"),
+        [
+            (TenantAccountRole.OWNER, 200),
+            (TenantAccountRole.ADMIN, 200),
+            (TenantAccountRole.EDITOR, 200),
+            (TenantAccountRole.NORMAL, 403),
+            (TenantAccountRole.DATASET_OPERATOR, 403),
+        ],
+    )
+    def test_post_with_owner_role_succeeds(
+        self,
+        test_client: FlaskClient,
+        auth_header,
+        monkeypatch,
+        mock_app_model,
+        mock_account,
+        role: TenantAccountRole,
+        status: int,
+    ):
+        """Test that OWNER role can access model-config endpoint."""
+        # Set user role to OWNER
+        mock_account.role = role
+
+        # Mock app loading
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        # Mock current user
+        monkeypatch.setattr(model_config_api, "current_user", mock_account)
+
+        # Mock AccountService.load_user to prevent authentication issues
+        from services.account_service import AccountService
+
+        mock_load_user = mock.Mock(return_value=mock_account)
+        monkeypatch.setattr(AccountService, "load_user", mock_load_user)
+
+        mock_validate_config = mock.Mock(
+            return_value={
+                "model": {"provider": "openai", "name": "gpt-4", "mode": "chat", "completion_params": {}},
+                "pre_prompt": "You are a helpful assistant.",
+                "user_input_form": [],
+                "dataset_query_variable": "",
+                "agent_mode": {"enabled": False, "tools": []},
+            }
+        )
+        monkeypatch.setattr(AppModelConfigService, "validate_configuration", mock_validate_config)
+
+        # Mock database operations
+        mock_db_session = mock.Mock()
+        mock_db_session.add = mock.Mock()
+        mock_db_session.flush = mock.Mock()
+        mock_db_session.commit = mock.Mock()
+        monkeypatch.setattr(model_config_api.db, "session", mock_db_session)
+
+        # Mock app_model_config_was_updated event
+        mock_event = mock.Mock()
+        mock_event.send = mock.Mock()
+        monkeypatch.setattr(model_config_api, "app_model_config_was_updated", mock_event)
+
+        response = test_client.post(
+            f"/console/api/apps/{mock_app_model.id}/model-config",
+            headers=auth_header,
+            json={
+                "model": {
+                    "provider": "openai",
+                    "name": "gpt-4",
+                    "mode": "chat",
+                    "completion_params": {"temperature": 0.7, "max_tokens": 1000},
+                },
+                "user_input_form": [],
+                "dataset_query_variable": "",
+                "pre_prompt": "You are a helpful assistant.",
+                "agent_mode": {"enabled": False, "tools": []},
+            },
+        )
+
+        assert response.status_code == status

dify/api/tests/integration_tests/controllers/console/app/test_workflow_draft_variable.py

@@ -0,0 +1,47 @@
+import uuid
+from unittest import mock
+
+from controllers.console.app import workflow_draft_variable as draft_variable_api
+from controllers.console.app import wraps
+from factories.variable_factory import build_segment
+from models import App, AppMode
+from models.workflow import WorkflowDraftVariable
+from services.workflow_draft_variable_service import WorkflowDraftVariableList, WorkflowDraftVariableService
+
+
+def _get_mock_srv_class() -> type[WorkflowDraftVariableService]:
+    return mock.create_autospec(WorkflowDraftVariableService)
+
+
+class TestWorkflowDraftNodeVariableListApi:
+    def test_get(self, test_client, auth_header, monkeypatch):
+        srv_class = _get_mock_srv_class()
+        mock_app_model: App = App()
+        mock_app_model.id = str(uuid.uuid4())
+        test_node_id = "test_node_id"
+        mock_app_model.mode = AppMode.ADVANCED_CHAT
+        mock_load_app_model = mock.Mock(return_value=mock_app_model)
+
+        monkeypatch.setattr(draft_variable_api, "WorkflowDraftVariableService", srv_class)
+        monkeypatch.setattr(wraps, "_load_app_model", mock_load_app_model)
+
+        var1 = WorkflowDraftVariable.new_node_variable(
+            app_id="test_app_1",
+            node_id="test_node_1",
+            name="str_var",
+            value=build_segment("str_value"),
+            node_execution_id=str(uuid.uuid4()),
+        )
+        srv_instance = mock.create_autospec(WorkflowDraftVariableService, instance=True)
+        srv_class.return_value = srv_instance
+        srv_instance.list_node_variables.return_value = WorkflowDraftVariableList(variables=[var1])
+
+        response = test_client.get(
+            f"/console/api/apps/{mock_app_model.id}/workflows/draft/nodes/{test_node_id}/variables",
+            headers=auth_header,
+        )
+        assert response.status_code == 200
+        response_dict = response.json
+        assert isinstance(response_dict, dict)
+        assert "items" in response_dict
+        assert len(response_dict["items"]) == 1