jonas/kirche-einfach
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: authorize flow management, gate runs, token-gate callbacks, strict tenants

Browse source
This commit is contained in:
Jonas Miederer 2026-09-14 20:12:17 +02:00
parent cfcf0e8bd6
commit 94e5e53092
21 changed files with 662 additions and 160 deletions
Download patch file Download diff file Expand all files Collapse all files

16
backend/app/flows/schemas.py
View file

@ -52,16 +52,16 @@ class InputSchemaRead(BaseModel):
class RunRequest(BaseModel):
"""Start a flow run. `input` is the domain payload handed to the flow."""
"""Start a flow run. `input` is the domain payload handed to the flow.
Tenant, callback URL and continuation come from the server (session /
settings / task), never from the caller — they must not be
client-controllable (SSRF / cross-flow chaining).
"""
input: dict = Field(default_factory=dict)
version_no: int | None = None
tenant_id: str = Field(default="default", max_length=200)
session_id: str | None = None
# Base URL the flow uses for callbacks (e.g. approval tasks).
# Defaults to settings.callback_base_url; tests point it at a live server.
callback_base_url: str | None = None
continuation_flow_id: UUID | None = None
class RunRead(BaseModel):
@ -115,10 +115,10 @@ class FlowImportRead(BaseModel):
class DecisionRequest(BaseModel):
"""Decide a task. Identity comes from the session, not the body."""
decision: str = Field(pattern="^(approve|reject)$")
approver: str = Field(default="", max_length=200)
note: str = Field(default="", max_length=2000)
callback_base_url: str | None = None
class DecisionRead(BaseModel):