feat[Go]: port agent attachment download, chatbot + agentbot completion/info endpoints from Python (#16405)

## Summary Ports five Python agent APIs to Go under the v1 Gin router: - `GET /api/v1/agents/attachments/<attachment_id>/download` - `POST /api/v1/chatbots/<dialog_id>/completions` (SSE) - `GET /api/v1/chatbots/<dialog_id>/info` - `POST /api/v1/agentbots/<agent_id>/completions` (SSE) - `GET /api/v1/agentbots/<agent_id>/inputs` Mirrors the existing Python wire shape (`{code, message, data:{answer,reference,...}}` per Python `canvas_service.completion`) so the iframe SDK and existing JS widgets keep working. ## Behavioural parity with Python | # | Concern | How it's met | |---|---------|--------------| | R0 | Bot routes must not require regular user session | Routes mount on `apiNoAuth` (router.go:198-202), with `BetaAuthMiddleware` only | | R3 | Two SSE formats in Go drift | F2: `AgentChatCompletions` and `AgentbotCompletion` share `service.WriteChatbotRunEvent` | | R7 | `GetBySessionID` returns `(nil, nil)` on miss | Defensive nil-check before `session.UserID != tenantID` | | R8 | Begin component name vs ID | `FindBeginComponentID` resolves name → ID first, then `ExtractComponentInputForm(dsl, beginID)` | | R9 | Defensive PromptConfig parsing | `stringFromMap` helper used for `prologue` and `tavily_api_key` | | R10 | `BetaAuthMiddleware` Bearer-prefix pre-filter | Removed — `GetUserByToken` is called unconditionally, falls back to `GetUserByBetaAPIToken` | | F8 | Multi-turn chatbot history | `ChatbotCompletion` reads prior turns from `session.Message`, appends user turn, calls LLM, persists new pair via new `API4ConversationDAO.Update` | | F9 | UUID gate stricter than plan | Removed — only `filepath.Base` + CR/LF/quote header sanitization remains | | H2 | Defence-in-depth IDOR | `AgentbotCompletion` calls `loadCanvas` before delegating to `RunAgent` | | M2 | SSE error leakage | `WriteChatbotFrame` emits generic `"an internal error occurred"`; real error logged via `common.Error` | ## Verification ```bash $ go vet ./... # clean (only pre-existing issues) $ go build ./... # success $ go test ./internal/handler/ ./internal/service/ ./internal/agent/dsl/ ./internal/common/ ./internal/dao/ ok ragflow/internal/handler 0.617s ok ragflow/internal/service 1.729s ok ragflow/internal/agent/dsl 0.008s ok ragflow/internal/common 0.087s ok ragflow/internal/dao 0.083s ``` 1199 tests pass across 5 packages. ## Known follow-ups (out of scope for this PR) - **F1**: token-level streaming in `ChatbotCompletion` (currently emits one frame per turn) - **F3**: per-route `auth_types` attribute in Go (currently applied via route group middleware) --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-07-27 02:42:00 +08:00 · 2026-06-27 16:52:21 +08:00
parent 5b09910d52
commit 5d7f0fda2b
20 changed files with 2786 additions and 102 deletions
--- a/internal/handler/bot.go
+++ b/internal/handler/bot.go
@@ -0,0 +1,260 @@
+//
+//  Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+package handler
+
+import (
+	"context"
+
+	"github.com/gin-gonic/gin"
+
+	"ragflow/internal/agent/canvas"
+	"ragflow/internal/common"
+	"ragflow/internal/service"
+)
+
+// BotHandler is the handler for the public chatbot/agentbot
+// endpoints mounted on /api/v1/chatbots/* and /api/v1/agentbots/*.
+// The two route groups share BetaAuthMiddleware (set up at
+// registration time via g.Use(mw)) and share the same handler
+// struct because they are wired to the same BotService.
+type BotHandler struct {
+	botService botService
+}
+
+// botService is the subset of BotService used by these handlers. It
+// is interface-typed so the test suite can inject a stub.
+type botService interface {
+	ChatbotInfo(ctx context.Context, tenantID, dialogID string) (
+		title, avatar, prologue, llmID string, hasTavilyKey bool, ec common.ErrorCode, err error)
+	AgentbotInputs(ctx context.Context, tenantID, agentID string) (
+		title, avatar, prologue, mode string, inputs map[string]any,
+		ec common.ErrorCode, err error)
+	AgentbotCompletion(ctx context.Context, tenantID, agentID string, req service.AgentbotCompletionRequest) (
+		<-chan canvas.RunEvent, common.ErrorCode, error)
+	ChatbotCompletion(ctx context.Context, tenantID, dialogID string, req service.ChatbotCompletionRequest) (
+		<-chan service.ChatbotSSEFrame, common.ErrorCode, error)
+}
+
+// NewBotHandler wires a BotHandler with the production BotService.
+func NewBotHandler(svc *service.BotService) *BotHandler {
+	return &BotHandler{botService: svc}
+}
+
+// ChatbotInfo GET /api/v1/chatbots/<dialog_id>/info
+//
+// Mirrors python bot_api.py:126-154. Returns the public metadata of
+// a chatbot dialog (title, avatar, prologue, tavily key flag, llm_id).
+func (h *BotHandler) ChatbotInfo(c *gin.Context) {
+	user, code, msg := GetUser(c)
+	if code != common.CodeSuccess {
+		jsonError(c, code, msg)
+		return
+	}
+	dialogID := c.Param("dialog_id")
+	if dialogID == "" {
+		jsonError(c, common.CodeArgumentError, "`dialog_id` is required.")
+		return
+	}
+	title, avatar, prologue, llmID, hasTavily, ec, err := h.botService.ChatbotInfo(
+		c.Request.Context(), user.ID, dialogID)
+	if err != nil {
+		jsonError(c, ec, err.Error())
+		return
+	}
+	c.JSON(200, gin.H{
+		"code": common.CodeSuccess,
+		"data": gin.H{
+			"title":          title,
+			"avatar":         avatar,
+			"prologue":       prologue,
+			"has_tavily_key": hasTavily,
+			"llm_id":         llmID,
+		},
+		"message": "success",
+	})
+}
+
+// AgentbotInputs GET /api/v1/agentbots/<agent_id>/inputs
+//
+// Mirrors python bot_api.py:239-250. Returns the public metadata of
+// an agentbot canvas (title, avatar, inputs, prologue, mode).
+func (h *BotHandler) AgentbotInputs(c *gin.Context) {
+	user, code, msg := GetUser(c)
+	if code != common.CodeSuccess {
+		jsonError(c, code, msg)
+		return
+	}
+	agentID := c.Param("agent_id")
+	if agentID == "" {
+		jsonError(c, common.CodeArgumentError, "`agent_id` is required.")
+		return
+	}
+	title, avatar, prologue, mode, inputs, ec, err := h.botService.AgentbotInputs(
+		c.Request.Context(), user.ID, agentID)
+	if err != nil {
+		jsonError(c, ec, err.Error())
+		return
+	}
+	c.JSON(200, gin.H{
+		"code": common.CodeSuccess,
+		"data": gin.H{
+			"title":    title,
+			"avatar":   avatar,
+			"inputs":   inputs,
+			"prologue": prologue,
+			"mode":     mode,
+		},
+		"message": "success",
+	})
+}
+
+// AgentbotCompletion POST /api/v1/agentbots/<agent_id>/completions
+//
+// Mirrors python bot_api.py:157 (canvas_service.completion wrapper).
+// Streams SSE frames in the Python envelope shape. The URL-bound
+// agent_id is authoritative — the body must NOT override it.
+//
+// Each canvas.RunEvent is re-formatted into the Python
+// {code, message, data} envelope: a "message" event's Data string is
+// treated as the assistant text, "message_end" terminates the
+// stream with the python completion marker.
+func (h *BotHandler) AgentbotCompletion(c *gin.Context) {
+	user, code, msg := GetUser(c)
+	if code != common.CodeSuccess {
+		jsonError(c, code, msg)
+		return
+	}
+	agentID := c.Param("agent_id")
+	if agentID == "" {
+		jsonError(c, common.CodeArgumentError, "`agent_id` is required.")
+		return
+	}
+	var body service.AgentbotCompletionRequest
+	// ContentLength != 0 (not > 0) so chunked requests carrying a
+	// valid JSON body with ContentLength == -1 still bind. The old
+	// `> 0` guard silently dropped those payloads and the canvas
+	// then ran with empty inputs.
+	if c.Request.ContentLength != 0 {
+		if err := c.ShouldBindJSON(&body); err != nil {
+			jsonError(c, common.CodeArgumentError, "Invalid request: "+err.Error())
+			return
+		}
+	}
+	events, ec, err := h.botService.AgentbotCompletion(
+		c.Request.Context(), user.ID, agentID, body)
+	if err != nil {
+		jsonError(c, ec, err.Error())
+		return
+	}
+	c.Writer.Header().Set("Content-Type", "text/event-stream")
+	c.Writer.Header().Set("Cache-Control", "no-cache")
+	c.Writer.Header().Set("Connection", "keep-alive")
+	for ev := range events {
+		switch ev.Type {
+		case "message":
+			// The python iframe_completion wrapper flattens each
+			// message chunk into a {code:0, data:{answer:...}}
+			// frame. We forward the message Data as the assistant
+			// text payload so the iframe SDK's `data.answer`
+			// parser keeps working. The agentbot path uses
+			// WriteAgentbotFrame (a thin alias for
+			// WriteChatbotFrame) to keep the two paths visually
+			// distinct in the handler.
+			frame := service.ChatbotSSEFrame{
+				Data:      ev.Data,
+				Reference: map[string]any{},
+				SessionID: ev.SessionID,
+			}
+			if err := service.WriteAgentbotFrame(c.Writer, frame); err != nil {
+				return
+			}
+		case "message_end", "done":
+			// Terminator events. message_end occasionally carries
+			// a final payload (e.g. structured output); forward
+			// it as a final answer frame when present, then close
+			// the stream with the standard python completion
+			// marker. A bare `done` event closes the stream
+			// directly.
+			if ev.Data != "" {
+				frame := service.ChatbotSSEFrame{
+					Data:      ev.Data,
+					Reference: map[string]any{},
+					SessionID: ev.SessionID,
+				}
+				_ = service.WriteAgentbotFrame(c.Writer, frame)
+			}
+			_ = service.WriteDoneFrame(c.Writer)
+			return
+		default:
+			// Non-message events (node_started, node_finished, …)
+			// are silently dropped on the agentbot path. The
+			// python canvas_service.completion wrapper only
+			// forwards the assistant text frames, not the run
+			// telemetry; we mirror that behaviour so external
+			// widgets see the same wire shape.
+		}
+	}
+}
+
+// ChatbotCompletion POST /api/v1/chatbots/<dialog_id>/completions
+//
+// Mirrors python bot_api.py:55 (async_iframe_completion). Streams
+// SSE frames in the Python envelope shape. The streaming helper
+// lives in service/bot_completion.go.
+func (h *BotHandler) ChatbotCompletion(c *gin.Context) {
+	user, code, msg := GetUser(c)
+	if code != common.CodeSuccess {
+		jsonError(c, code, msg)
+		return
+	}
+	dialogID := c.Param("dialog_id")
+	if dialogID == "" {
+		jsonError(c, common.CodeArgumentError, "`dialog_id` is required.")
+		return
+	}
+	var body service.ChatbotCompletionRequest
+	// ContentLength != 0 (not > 0) so chunked requests carrying a
+	// valid JSON body with ContentLength == -1 still bind. The old
+	// `> 0` guard silently dropped those payloads and the chatbot
+	// then ran with empty session_id/question.
+	if c.Request.ContentLength != 0 {
+		if err := c.ShouldBindJSON(&body); err != nil {
+			jsonError(c, common.CodeArgumentError, "Invalid request: "+err.Error())
+			return
+		}
+	}
+	frames, ec, err := h.botService.ChatbotCompletion(
+		c.Request.Context(), user.ID, dialogID, body)
+	if err != nil {
+		jsonError(c, ec, err.Error())
+		return
+	}
+	c.Writer.Header().Set("Content-Type", "text/event-stream")
+	c.Writer.Header().Set("Cache-Control", "no-cache")
+	c.Writer.Header().Set("Connection", "keep-alive")
+	for f := range frames {
+		if f.Done {
+			if err := service.WriteDoneFrame(c.Writer); err != nil {
+				return
+			}
+			continue
+		}
+		if err := service.WriteChatbotFrame(c.Writer, f); err != nil {
+			return
+		}
+	}
+}