Files
ragflow/internal/router/agent_routes.go
Zhichang Yu dfe2dc346d feat[Go]: port agent attachment download, chatbot + agentbot completion/info endpoints from Python (#16405)
## Summary

Ports five Python agent APIs to Go under the v1 Gin router:

- `GET  /api/v1/agents/attachments/<attachment_id>/download`
- `POST /api/v1/chatbots/<dialog_id>/completions`  (SSE)
- `GET  /api/v1/chatbots/<dialog_id>/info`
- `POST /api/v1/agentbots/<agent_id>/completions` (SSE)
- `GET  /api/v1/agentbots/<agent_id>/inputs`

Mirrors the existing Python wire shape (`{code, message,
data:{answer,reference,...}}` per Python `canvas_service.completion`) so
the iframe SDK and existing JS widgets keep working.

## Behavioural parity with Python

| # | Concern | How it's met |
|---|---------|--------------|
| R0 | Bot routes must not require regular user session | Routes mount
on `apiNoAuth` (router.go:198-202), with `BetaAuthMiddleware` only |
| R3 | Two SSE formats in Go drift | F2: `AgentChatCompletions` and
`AgentbotCompletion` share `service.WriteChatbotRunEvent` |
| R7 | `GetBySessionID` returns `(nil, nil)` on miss | Defensive
nil-check before `session.UserID != tenantID` |
| R8 | Begin component name vs ID | `FindBeginComponentID` resolves name
→ ID first, then `ExtractComponentInputForm(dsl, beginID)` |
| R9 | Defensive PromptConfig parsing | `stringFromMap` helper used for
`prologue` and `tavily_api_key` |
| R10 | `BetaAuthMiddleware` Bearer-prefix pre-filter | Removed —
`GetUserByToken` is called unconditionally, falls back to
`GetUserByBetaAPIToken` |
| F8 | Multi-turn chatbot history | `ChatbotCompletion` reads prior
turns from `session.Message`, appends user turn, calls LLM, persists new
pair via new `API4ConversationDAO.Update` |
| F9 | UUID gate stricter than plan | Removed — only `filepath.Base` +
CR/LF/quote header sanitization remains |
| H2 | Defence-in-depth IDOR | `AgentbotCompletion` calls `loadCanvas`
before delegating to `RunAgent` |
| M2 | SSE error leakage | `WriteChatbotFrame` emits generic `"an
internal error occurred"`; real error logged via `common.Error` |

## Verification

```bash
$ go vet ./...                                     # clean (only pre-existing issues)
$ go build ./...                                   # success
$ go test ./internal/handler/ ./internal/service/ ./internal/agent/dsl/ ./internal/common/ ./internal/dao/
ok  ragflow/internal/handler     0.617s
ok  ragflow/internal/service     1.729s
ok  ragflow/internal/agent/dsl   0.008s
ok  ragflow/internal/common      0.087s
ok  ragflow/internal/dao         0.083s
```

1199 tests pass across 5 packages.

## Known follow-ups (out of scope for this PR)

- **F1**: token-level streaming in `ChatbotCompletion` (currently emits
one frame per turn)
- **F3**: per-route `auth_types` attribute in Go (currently applied via
route group middleware)

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-06-29 09:45:16 +08:00

123 lines
4.6 KiB
Go

//
// Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// Package router contains the HTTP route registration helpers used by
// cmd/ragflow. This file is the dedicated registration site for the
// agent canvas endpoints described in plan §4.8.
package router
import (
"github.com/gin-gonic/gin"
"ragflow/internal/handler"
)
// RegisterAgentRoutes wires the Phase 5 agent endpoints onto an
// existing /agents RouterGroup. The orchestrator passes the v1 group's
// "/agents" sub-group here, so the function does not know about the
// v1 prefix itself.
//
// The existing GET /api/v1/agents (added in commit 0a7662cf3) is replaced
// by this registration so the route count, ordering and middleware all
// live in one place. The original GET is preserved verbatim at
// router.go:349 until the orchestrator swaps it for a call to this
// function.
func RegisterAgentRoutes(g *gin.RouterGroup, h *handler.AgentHandler) {
if g == nil || h == nil {
return
}
// Discovery / metadata.
g.GET("/templates", h.ListAgentTemplates)
g.GET("/prompts", h.Prompts)
g.GET("/tags", h.ListAgentTags)
// Agent CRUD.
g.GET("", h.ListAgents)
g.POST("", h.CreateAgent)
g.GET("/:canvas_id", h.GetAgent)
g.PUT("/:canvas_id", h.UpdateAgent)
g.DELETE("/:canvas_id", h.DeleteAgent)
g.POST("/:canvas_id/run", h.RunAgent)
g.DELETE("/:canvas_id/run", h.CancelAgent)
g.POST("/:canvas_id/publish", h.PublishAgent)
g.PUT("/:canvas_id/tags", h.UpdateAgentTags)
g.POST("/:canvas_id/reset", h.ResetAgent)
// File operations.
g.GET("/download", h.DownloadAgentFile)
g.GET("/attachments/:attachment_id/download", h.DownloadAttachment)
g.POST("/:canvas_id/upload", h.UploadAgentFile)
// Component introspection + debug.
g.GET("/:canvas_id/components/:component_id/input-form", h.GetComponentInputForm)
g.POST("/:canvas_id/components/:component_id/debug", h.DebugComponent)
// Versions.
g.GET("/:canvas_id/versions", h.ListVersions)
g.GET("/:canvas_id/versions/:version_id", h.GetVersion)
g.DELETE("/:canvas_id/versions/:version_id", h.DeleteVersion)
// Sessions.
g.GET("/:canvas_id/sessions", h.ListAgentSessions)
g.POST("/:canvas_id/sessions", h.CreateAgentSession)
g.GET("/:canvas_id/sessions/:session_id", h.GetAgentSession)
g.DELETE("/:canvas_id/sessions", h.DeleteAgentSession)
g.DELETE("/:canvas_id/sessions/:session_id", h.DeleteAgentSession)
// Logs and webhook.
g.GET("/:canvas_id/logs/:message_id", h.GetAgentLogs)
g.GET("/:canvas_id/webhook/logs", h.GetAgentWebhookLogs)
// Webhook trigger endpoints. The Python agent API
// (api/apps/restful_apis/agent_api.py:1563-1564) registers six
// HTTP methods on a single path. Gin has no Match() helper, so we
// register each verb explicitly via registerAnyMethod. The handler
// is identical for all six; semantics differ only by
// c.Request.Method.
registerAnyMethod(g, "/:canvas_id/webhook", h.Webhook)
registerAnyMethod(g, "/:canvas_id/webhook/test", h.Webhook)
// Top-level actions (no canvas id in path).
// NOTE: `/chat/completion` (singular) is intentionally NOT registered.
// The singular form was a historical typo in earlier Python releases —
// no client, SDK, or doc ever called it, and the Python side
// (api/apps/restful_apis/agent_api.py) has since removed the route.
// See plan: .claude/plans/agent-api-gaps-go-port.md §Gap E.
g.POST("/chat/completions", h.AgentChatCompletions)
g.POST("/rerun", h.RerunAgent)
g.POST("/test_db_connection", h.TestDBConnection)
}
// registerAnyMethod mirrors the Python
// `@manager.route(path, methods=["POST","GET","PUT","PATCH","DELETE","HEAD"])`
// pattern. Gin has no Match() helper, so we register each verb
// explicitly. The handler is identical for all six — semantics differ
// only by c.Request.Method.
//
// Centralising the registration here keeps RegisterAgentRoutes readable
// when both the production trigger and the test trigger share the same
// six-method shape.
func registerAnyMethod(g *gin.RouterGroup, path string, h gin.HandlerFunc) {
if g == nil || h == nil {
return
}
g.POST(path, h)
g.GET(path, h)
g.PUT(path, h)
g.PATCH(path, h)
g.DELETE(path, h)
g.HEAD(path, h)
}