Merge remote-tracking branch 'origin/main' into scdeng/main

# Conflicts:
#	api/tests/unit_tests/controllers/console/app/test_message.py
#	api/tests/unit_tests/controllers/console/app/test_workflow_draft_variable.py
#	web/app/components/workflow/nodes/knowledge-retrieval/__tests__/integration.spec.tsx
#	web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-item.tsx

.github/actions/setup-web/action.yml

@@ -4,10 +4,9 @@ runs:
   using: composite
   steps:
     - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@4a524139920f87f9f7080d3b8545acac019e1852 # v1.0.0
+      uses: voidzero-dev/setup-vp@20553a7a7429c429a74894104a2835d7fed28a72 # v1.3.0
       with:
-        node-version-file: web/.nvmrc
+        working-directory: web
+        node-version-file: .nvmrc
         cache: true
-        cache-dependency-path: web/pnpm-lock.yaml
-        run-install: |
-          cwd: ./web
+        run-install: true

.github/workflows/style.yml

@@ -84,20 +84,20 @@ jobs:
         if: steps.changed-files.outputs.any_changed == 'true'
         uses: ./.github/actions/setup-web
 
+      - name: Restore ESLint cache
+        if: steps.changed-files.outputs.any_changed == 'true'
+        id: eslint-cache-restore
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: web/.eslintcache
+          key: ${{ runner.os }}-web-eslint-${{ hashFiles('web/package.json', 'web/pnpm-lock.yaml', 'web/eslint.config.mjs', 'web/eslint.constants.mjs', 'web/plugins/eslint/**') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-web-eslint-${{ hashFiles('web/package.json', 'web/pnpm-lock.yaml', 'web/eslint.config.mjs', 'web/eslint.constants.mjs', 'web/plugins/eslint/**') }}-
+
       - name: Web style check
         if: steps.changed-files.outputs.any_changed == 'true'
         working-directory: ./web
-        run: |
-          vp run lint:ci
-        # pnpm run lint:report
-        # continue-on-error: true
-
-      # - name: Annotate Code
-      #   if: steps.changed-files.outputs.any_changed == 'true' && github.event_name == 'pull_request'
-      #   uses: DerLev/eslint-annotations@51347b3a0abfb503fc8734d5ae31c4b151297fae
-      #   with:
-      #     eslint-report: web/eslint_report.json
-      #     github-token: ${{ secrets.GITHUB_TOKEN }}
+        run: vp run lint:ci
 
       - name: Web tsslint
         if: steps.changed-files.outputs.any_changed == 'true'
@@ -114,6 +114,13 @@ jobs:
         working-directory: ./web
         run: vp run knip
 
+      - name: Save ESLint cache
+        if: steps.changed-files.outputs.any_changed == 'true' && success() && steps.eslint-cache-restore.outputs.cache-hit != 'true'
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: web/.eslintcache
+          key: ${{ steps.eslint-cache-restore.outputs.cache-primary-key }}
+
   superlinter:
     name: SuperLinter
     runs-on: ubuntu-latest

.github/workflows/translate-i18n-claude.yml

@@ -120,7 +120,7 @@ jobs:
 
       - name: Run Claude Code for Translation Sync
         if: steps.detect_changes.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@6062f3709600659be5e47fcddf2cf76993c235c2 # v1.0.76
+        uses: anthropics/claude-code-action@ff9acae5886d41a99ed4ec14b7dc147d55834722 # v1.0.77
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

api/.env.example

@@ -353,6 +353,9 @@ BAIDU_VECTOR_DB_SHARD=1
 BAIDU_VECTOR_DB_REPLICAS=3
 BAIDU_VECTOR_DB_INVERTED_INDEX_ANALYZER=DEFAULT_ANALYZER
 BAIDU_VECTOR_DB_INVERTED_INDEX_PARSER_MODE=COARSE_MODE
+BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT=500
+BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT_RATIO=0.05
+BAIDU_VECTOR_DB_REBUILD_INDEX_TIMEOUT_IN_SECONDS=300
 
 # Upstash configuration
 UPSTASH_VECTOR_URL=your-server-url

api/commands/vector.py

@@ -10,6 +10,7 @@ from configs import dify_config
 from core.rag.datasource.vdb.vector_factory import Vector
 from core.rag.datasource.vdb.vector_type import VectorType
 from core.rag.index_processor.constant.built_in_field import BuiltInField
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.models.document import ChildDocument, Document
 from extensions.ext_database import db
 from models.dataset import Dataset, DatasetCollectionBinding, DatasetMetadata, DatasetMetadataBinding, DocumentSegment
@@ -269,7 +270,7 @@ def migrate_knowledge_vector_database():
                                 "dataset_id": segment.dataset_id,
                             },
                         )
-                        if dataset_document.doc_form == "hierarchical_model":
+                        if dataset_document.doc_form == IndexStructureType.PARENT_CHILD_INDEX:
                             child_chunks = segment.get_child_chunks()
                             if child_chunks:
                                 child_documents = []

api/configs/middleware/vdb/baidu_vector_config.py

@@ -51,3 +51,18 @@ class BaiduVectorDBConfig(BaseSettings):
         description="Parser mode for inverted index in Baidu Vector Database (default is COARSE_MODE)",
         default="COARSE_MODE",
     )
+
+    BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT: int = Field(
+        description="Auto build row count increment threshold (default is 500)",
+        default=500,
+    )
+
+    BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT_RATIO: float = Field(
+        description="Auto build row count increment ratio threshold (default is 0.05)",
+        default=0.05,
+    )
+
+    BAIDU_VECTOR_DB_REBUILD_INDEX_TIMEOUT_IN_SECONDS: int = Field(
+        description="Timeout in seconds for rebuilding the index in Baidu Vector Database (default is 3600 seconds)",
+        default=300,
+    )

api/controllers/console/apikey.py

@@ -9,6 +9,7 @@ from extensions.ext_database import db
 from libs.helper import TimestampField
 from libs.login import current_account_with_tenant, login_required
 from models.dataset import Dataset
+from models.enums import ApiTokenType
 from models.model import ApiToken, App
 from services.api_token_service import ApiTokenCache
 
@@ -47,7 +48,7 @@ def _get_resource(resource_id, tenant_id, resource_model):
 class BaseApiKeyListResource(Resource):
     method_decorators = [account_initialization_required, login_required, setup_required]
 
-    resource_type: str | None = None
+    resource_type: ApiTokenType | None = None
     resource_model: type | None = None
     resource_id_field: str | None = None
     token_prefix: str | None = None
@@ -91,6 +92,7 @@ class BaseApiKeyListResource(Resource):
             )
 
         key = ApiToken.generate_api_key(self.token_prefix or "", 24)
+        assert self.resource_type is not None, "resource_type must be set"
         api_token = ApiToken()
         setattr(api_token, self.resource_id_field, resource_id)
         api_token.tenant_id = current_tenant_id
@@ -104,7 +106,7 @@ class BaseApiKeyListResource(Resource):
 class BaseApiKeyResource(Resource):
     method_decorators = [account_initialization_required, login_required, setup_required]
 
-    resource_type: str | None = None
+    resource_type: ApiTokenType | None = None
     resource_model: type | None = None
     resource_id_field: str | None = None
 
@@ -159,7 +161,7 @@ class AppApiKeyListResource(BaseApiKeyListResource):
         """Create a new API key for an app"""
         return super().post(resource_id)
 
-    resource_type = "app"
+    resource_type = ApiTokenType.APP
     resource_model = App
     resource_id_field = "app_id"
     token_prefix = "app-"
@@ -175,7 +177,7 @@ class AppApiKeyResource(BaseApiKeyResource):
         """Delete an API key for an app"""
         return super().delete(resource_id, api_key_id)
 
-    resource_type = "app"
+    resource_type = ApiTokenType.APP
     resource_model = App
     resource_id_field = "app_id"
 
@@ -199,7 +201,7 @@ class DatasetApiKeyListResource(BaseApiKeyListResource):
         """Create a new API key for a dataset"""
         return super().post(resource_id)
 
-    resource_type = "dataset"
+    resource_type = ApiTokenType.DATASET
     resource_model = Dataset
     resource_id_field = "dataset_id"
     token_prefix = "ds-"
@@ -215,6 +217,6 @@ class DatasetApiKeyResource(BaseApiKeyResource):
         """Delete an API key for a dataset"""
         return super().delete(resource_id, api_key_id)
 
-    resource_type = "dataset"
+    resource_type = ApiTokenType.DATASET
     resource_model = Dataset
     resource_id_field = "dataset_id"

api/controllers/console/app/app.py

@@ -95,7 +95,7 @@ class CreateAppPayload(BaseModel):
     name: str = Field(..., min_length=1, description="App name")
     description: str | None = Field(default=None, description="App description (max 400 chars)", max_length=400)
     mode: Literal["chat", "agent-chat", "advanced-chat", "workflow", "completion"] = Field(..., description="App mode")
-    icon_type: str | None = Field(default=None, description="Icon type")
+    icon_type: IconType | None = Field(default=None, description="Icon type")
     icon: str | None = Field(default=None, description="Icon")
     icon_background: str | None = Field(default=None, description="Icon background color")
 
@@ -103,7 +103,7 @@ class CreateAppPayload(BaseModel):
 class UpdateAppPayload(BaseModel):
     name: str = Field(..., min_length=1, description="App name")
     description: str | None = Field(default=None, description="App description (max 400 chars)", max_length=400)
-    icon_type: str | None = Field(default=None, description="Icon type")
+    icon_type: IconType | None = Field(default=None, description="Icon type")
     icon: str | None = Field(default=None, description="Icon")
     icon_background: str | None = Field(default=None, description="Icon background color")
     use_icon_as_answer_icon: bool | None = Field(default=None, description="Use icon as answer icon")
@@ -113,7 +113,7 @@ class UpdateAppPayload(BaseModel):
 class CopyAppPayload(BaseModel):
     name: str | None = Field(default=None, description="Name for the copied app")
     description: str | None = Field(default=None, description="Description for the copied app", max_length=400)
-    icon_type: str | None = Field(default=None, description="Icon type")
+    icon_type: IconType | None = Field(default=None, description="Icon type")
     icon: str | None = Field(default=None, description="Icon")
     icon_background: str | None = Field(default=None, description="Icon background color")
 
@@ -594,7 +594,7 @@ class AppApi(Resource):
         args_dict: AppService.ArgsDict = {
             "name": args.name,
             "description": args.description or "",
-            "icon_type": args.icon_type or "",
+            "icon_type": args.icon_type,
             "icon": args.icon or "",
             "icon_background": args.icon_background or "",
             "use_icon_as_answer_icon": args.use_icon_as_answer_icon or False,

api/controllers/console/app/conversation.py

@@ -458,9 +458,7 @@ class ChatConversationApi(Resource):
         args = ChatConversationQuery.model_validate(request.args.to_dict(flat=True))  # type: ignore
 
         subquery = (
-            db.session.query(
-                Conversation.id.label("conversation_id"), EndUser.session_id.label("from_end_user_session_id")
-            )
+            sa.select(Conversation.id.label("conversation_id"), EndUser.session_id.label("from_end_user_session_id"))
             .outerjoin(EndUser, Conversation.from_end_user_id == EndUser.id)
             .subquery()
         )
@@ -595,10 +593,8 @@ class ChatConversationDetailApi(Resource):
 
 def _get_conversation(app_model, conversation_id):
     current_user, _ = current_account_with_tenant()
-    conversation = (
-        db.session.query(Conversation)
-        .where(Conversation.id == conversation_id, Conversation.app_id == app_model.id)
-        .first()
+    conversation = db.session.scalar(
+        sa.select(Conversation).where(Conversation.id == conversation_id, Conversation.app_id == app_model.id).limit(1)
     )
 
     if not conversation:

api/controllers/console/app/generator.py

@@ -168,7 +168,7 @@ class InstructionGenerateApi(Resource):
         try:
             # Generate from nothing for a workflow node
             if (args.current in (code_template, "")) and args.node_id != "":
-                app = db.session.query(App).where(App.id == args.flow_id).first()
+                app = db.session.get(App, args.flow_id)
                 if not app:
                     return {"error": f"app {args.flow_id} not found"}, 400
                 workflow = WorkflowService().get_draft_workflow(app_model=app)

api/controllers/console/app/mcp_server.py

@@ -2,6 +2,7 @@ import json
 
 from flask_restx import Resource, marshal_with
 from pydantic import BaseModel, Field
+from sqlalchemy import select
 from werkzeug.exceptions import NotFound
 
 from controllers.console import console_ns
@@ -47,7 +48,7 @@ class AppMCPServerController(Resource):
     @get_app_model
     @marshal_with(app_server_model)
     def get(self, app_model):
-        server = db.session.query(AppMCPServer).where(AppMCPServer.app_id == app_model.id).first()
+        server = db.session.scalar(select(AppMCPServer).where(AppMCPServer.app_id == app_model.id).limit(1))
         return server
 
     @console_ns.doc("create_app_mcp_server")
@@ -98,7 +99,7 @@ class AppMCPServerController(Resource):
     @edit_permission_required
     def put(self, app_model):
         payload = MCPServerUpdatePayload.model_validate(console_ns.payload or {})
-        server = db.session.query(AppMCPServer).where(AppMCPServer.id == payload.id).first()
+        server = db.session.get(AppMCPServer, payload.id)
         if not server:
             raise NotFound()
 
@@ -135,11 +136,10 @@ class AppMCPServerRefreshController(Resource):
     @edit_permission_required
     def get(self, server_id):
         _, current_tenant_id = current_account_with_tenant()
-        server = (
-            db.session.query(AppMCPServer)
-            .where(AppMCPServer.id == server_id)
-            .where(AppMCPServer.tenant_id == current_tenant_id)
-            .first()
+        server = db.session.scalar(
+            select(AppMCPServer)
+            .where(AppMCPServer.id == server_id, AppMCPServer.tenant_id == current_tenant_id)
+            .limit(1)
         )
         if not server:
             raise NotFound()

api/controllers/console/app/model_config.py

@@ -69,9 +69,7 @@ class ModelConfigResource(Resource):
 
         if app_model.mode == AppMode.AGENT_CHAT or app_model.is_agent:
             # get original app model config
-            original_app_model_config = (
-                db.session.query(AppModelConfig).where(AppModelConfig.id == app_model.app_model_config_id).first()
-            )
+            original_app_model_config = db.session.get(AppModelConfig, app_model.app_model_config_id)
             if original_app_model_config is None:
                 raise ValueError("Original app model config not found")
             agent_mode = original_app_model_config.agent_mode_dict

api/controllers/console/app/site.py

@@ -2,6 +2,7 @@ from typing import Literal
 
 from flask_restx import Resource, marshal_with
 from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
 from werkzeug.exceptions import NotFound
 
 from constants.languages import supported_language
@@ -75,7 +76,7 @@ class AppSite(Resource):
     def post(self, app_model):
         args = AppSiteUpdatePayload.model_validate(console_ns.payload or {})
         current_user, _ = current_account_with_tenant()
-        site = db.session.query(Site).where(Site.app_id == app_model.id).first()
+        site = db.session.scalar(select(Site).where(Site.app_id == app_model.id).limit(1))
         if not site:
             raise NotFound
 
@@ -124,7 +125,7 @@ class AppSiteAccessTokenReset(Resource):
     @marshal_with(app_site_model)
     def post(self, app_model):
         current_user, _ = current_account_with_tenant()
-        site = db.session.query(Site).where(Site.app_id == app_model.id).first()
+        site = db.session.scalar(select(Site).where(Site.app_id == app_model.id).limit(1))
 
         if not site:
             raise NotFound

api/controllers/console/app/wraps.py

@@ -2,6 +2,8 @@ from collections.abc import Callable
 from functools import wraps
 from typing import ParamSpec, TypeVar, Union
 
+from sqlalchemy import select
+
 from controllers.console.app.error import AppNotFoundError
 from extensions.ext_database import db
 from libs.login import current_account_with_tenant
@@ -15,16 +17,14 @@ R1 = TypeVar("R1")
 
 def _load_app_model(app_id: str) -> App | None:
     _, current_tenant_id = current_account_with_tenant()
-    app_model = (
-        db.session.query(App)
-        .where(App.id == app_id, App.tenant_id == current_tenant_id, App.status == "normal")
-        .first()
+    app_model = db.session.scalar(
+        select(App).where(App.id == app_id, App.tenant_id == current_tenant_id, App.status == "normal").limit(1)
     )
     return app_model
 
 
 def _load_app_model_with_trial(app_id: str) -> App | None:
-    app_model = db.session.query(App).where(App.id == app_id, App.status == "normal").first()
+    app_model = db.session.scalar(select(App).where(App.id == app_id, App.status == "normal").limit(1))
     return app_model
 
 

api/controllers/console/datasets/datasets.py

@@ -54,7 +54,7 @@ from fields.document_fields import document_status_fields
 from libs.login import current_account_with_tenant, login_required
 from models import ApiToken, Dataset, Document, DocumentSegment, UploadFile
 from models.dataset import DatasetPermission, DatasetPermissionEnum
-from models.enums import SegmentStatus
+from models.enums import ApiTokenType, SegmentStatus
 from models.provider_ids import ModelProviderID
 from services.api_token_service import ApiTokenCache
 from services.dataset_service import DatasetPermissionService, DatasetService, DocumentService
@@ -777,7 +777,7 @@ class DatasetIndexingStatusApi(Resource):
 class DatasetApiKeyApi(Resource):
     max_keys = 10
     token_prefix = "dataset-"
-    resource_type = "dataset"
+    resource_type = ApiTokenType.DATASET
 
     @console_ns.doc("get_dataset_api_keys")
     @console_ns.doc(description="Get dataset API keys")
@@ -826,7 +826,7 @@ class DatasetApiKeyApi(Resource):
 
 @console_ns.route("/datasets/api-keys/<uuid:api_key_id>")
 class DatasetApiDeleteApi(Resource):
-    resource_type = "dataset"
+    resource_type = ApiTokenType.DATASET
 
     @console_ns.doc("delete_dataset_api_key")
     @console_ns.doc(description="Delete dataset API key")

api/core/app/apps/workflow/generate_task_pipeline.py

@@ -705,7 +705,7 @@ class WorkflowAppGenerateTaskPipeline(GraphRuntimeStateSupport):
             app_id=self._application_generate_entity.app_config.app_id,
             workflow_id=self._workflow.id,
             workflow_run_id=workflow_run_id,
-            created_from=created_from.value,
+            created_from=created_from,
             created_by_role=self._created_by_role,
             created_by=self._user_id,
         )

api/core/app/features/rate_limiting/rate_limit.py

@@ -19,6 +19,7 @@ class RateLimit:
     _REQUEST_MAX_ALIVE_TIME = 10 * 60  # 10 minutes
     _ACTIVE_REQUESTS_COUNT_FLUSH_INTERVAL = 5 * 60  # recalculate request_count from request_detail every 5 minutes
     _instance_dict: dict[str, "RateLimit"] = {}
+    max_active_requests: int
 
     def __new__(cls, client_id: str, max_active_requests: int):
         if client_id not in cls._instance_dict:
@@ -27,7 +28,13 @@ class RateLimit:
         return cls._instance_dict[client_id]
 
     def __init__(self, client_id: str, max_active_requests: int):
+        flush_cache = hasattr(self, "max_active_requests") and self.max_active_requests != max_active_requests
         self.max_active_requests = max_active_requests
+        # Only flush here if this instance has already been fully initialized,
+        # i.e. the Redis key attributes exist. Otherwise, rely on the flush at
+        # the end of initialization below.
+        if flush_cache and hasattr(self, "active_requests_key") and hasattr(self, "max_active_requests_key"):
+            self.flush_cache(use_local_value=True)
         # must be called after max_active_requests is set
         if self.disabled():
             return
@@ -41,8 +48,6 @@ class RateLimit:
         self.flush_cache(use_local_value=True)
 
     def flush_cache(self, use_local_value=False):
-        if self.disabled():
-            return
         self.last_recalculate_time = time.time()
         # flush max active requests
         if use_local_value or not redis_client.exists(self.max_active_requests_key):
@@ -50,7 +55,8 @@ class RateLimit:
         else:
             self.max_active_requests = int(redis_client.get(self.max_active_requests_key).decode("utf-8"))
             redis_client.expire(self.max_active_requests_key, timedelta(days=1))
-
+        if self.disabled():
+            return
         # flush max active requests (in-transit request list)
         if not redis_client.exists(self.active_requests_key):
             return

api/core/provider_manager.py

@@ -918,11 +918,11 @@ class ProviderManager:
 
             trail_pool = CreditPoolService.get_pool(
                 tenant_id=tenant_id,
-                pool_type=ProviderQuotaType.TRIAL.value,
+                pool_type=ProviderQuotaType.TRIAL,
             )
             paid_pool = CreditPoolService.get_pool(
                 tenant_id=tenant_id,
-                pool_type=ProviderQuotaType.PAID.value,
+                pool_type=ProviderQuotaType.PAID,
             )
         else:
             trail_pool = None

api/core/rag/datasource/vdb/baidu/baidu_vector.py

@@ -13,6 +13,7 @@ from pymochow.exception import ServerError  # type: ignore
 from pymochow.model.database import Database
 from pymochow.model.enum import FieldType, IndexState, IndexType, MetricType, ServerErrCode, TableState  # type: ignore
 from pymochow.model.schema import (
+    AutoBuildRowCountIncrement,
     Field,
     FilteringIndex,
     HNSWParams,
@@ -51,6 +52,9 @@ class BaiduConfig(BaseModel):
     replicas: int = 3
     inverted_index_analyzer: str = "DEFAULT_ANALYZER"
     inverted_index_parser_mode: str = "COARSE_MODE"
+    auto_build_row_count_increment: int = 500
+    auto_build_row_count_increment_ratio: float = 0.05
+    rebuild_index_timeout_in_seconds: int = 300
 
     @model_validator(mode="before")
     @classmethod
@@ -107,18 +111,6 @@ class BaiduVector(BaseVector):
                 rows.append(row)
             table.upsert(rows=rows)
 
-        # rebuild vector index after upsert finished
-        table.rebuild_index(self.vector_index)
-        timeout = 3600  # 1 hour timeout
-        start_time = time.time()
-        while True:
-            time.sleep(1)
-            index = table.describe_index(self.vector_index)
-            if index.state == IndexState.NORMAL:
-                break
-            if time.time() - start_time > timeout:
-                raise TimeoutError(f"Index rebuild timeout after {timeout} seconds")
-
     def text_exists(self, id: str) -> bool:
         res = self._db.table(self._collection_name).query(primary_key={VDBField.PRIMARY_KEY: id})
         if res and res.code == 0:
@@ -232,8 +224,14 @@ class BaiduVector(BaseVector):
             return self._client.database(self._client_config.database)
 
     def _table_existed(self) -> bool:
-        tables = self._db.list_table()
-        return any(table.table_name == self._collection_name for table in tables)
+        try:
+            table = self._db.table(self._collection_name)
+        except ServerError as e:
+            if e.code == ServerErrCode.TABLE_NOT_EXIST:
+                return False
+            else:
+                raise
+        return True
 
     def _create_table(self, dimension: int):
         # Try to grab distributed lock and create table
@@ -287,6 +285,11 @@ class BaiduVector(BaseVector):
                     field=VDBField.VECTOR,
                     metric_type=metric_type,
                     params=HNSWParams(m=16, efconstruction=200),
+                    auto_build=True,
+                    auto_build_index_policy=AutoBuildRowCountIncrement(
+                        row_count_increment=self._client_config.auto_build_row_count_increment,
+                        row_count_increment_ratio=self._client_config.auto_build_row_count_increment_ratio,
+                    ),
                 )
             )
 
@@ -335,7 +338,7 @@ class BaiduVector(BaseVector):
             )
 
             # Wait for table created
-            timeout = 300  # 5 minutes timeout
+            timeout = self._client_config.rebuild_index_timeout_in_seconds  # default 5 minutes timeout
             start_time = time.time()
             while True:
                 time.sleep(1)
@@ -345,6 +348,20 @@ class BaiduVector(BaseVector):
                 if time.time() - start_time > timeout:
                     raise TimeoutError(f"Table creation timeout after {timeout} seconds")
             redis_client.set(table_exist_cache_key, 1, ex=3600)
+            # rebuild vector index immediately after table created, make sure index is ready
+            table.rebuild_index(self.vector_index)
+            timeout = 3600  # 1 hour timeout
+            self._wait_for_index_ready(table, timeout)
+
+    def _wait_for_index_ready(self, table, timeout: int = 3600):
+        start_time = time.time()
+        while True:
+            time.sleep(1)
+            index = table.describe_index(self.vector_index)
+            if index.state == IndexState.NORMAL:
+                break
+            if time.time() - start_time > timeout:
+                raise TimeoutError(f"Index rebuild timeout after {timeout} seconds")
 
 
 class BaiduVectorFactory(AbstractVectorFactory):
@@ -369,5 +386,8 @@ class BaiduVectorFactory(AbstractVectorFactory):
                 replicas=dify_config.BAIDU_VECTOR_DB_REPLICAS,
                 inverted_index_analyzer=dify_config.BAIDU_VECTOR_DB_INVERTED_INDEX_ANALYZER,
                 inverted_index_parser_mode=dify_config.BAIDU_VECTOR_DB_INVERTED_INDEX_PARSER_MODE,
+                auto_build_row_count_increment=dify_config.BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT,
+                auto_build_row_count_increment_ratio=dify_config.BAIDU_VECTOR_DB_AUTO_BUILD_ROW_COUNT_INCREMENT_RATIO,
+                rebuild_index_timeout_in_seconds=dify_config.BAIDU_VECTOR_DB_REBUILD_INDEX_TIMEOUT_IN_SECONDS,
             ),
         )

api/core/rag/datasource/vdb/tidb_on_qdrant/tidb_on_qdrant_vector.py

@@ -33,6 +33,7 @@ from core.rag.models.document import Document
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from models.dataset import Dataset, TidbAuthBinding
+from models.enums import TidbAuthBindingStatus
 
 if TYPE_CHECKING:
     from qdrant_client import grpc  # noqa
@@ -452,7 +453,7 @@ class TidbOnQdrantVectorFactory(AbstractVectorFactory):
                             password=new_cluster["password"],
                             tenant_id=dataset.tenant_id,
                             active=True,
-                            status="ACTIVE",
+                            status=TidbAuthBindingStatus.ACTIVE,
                         )
                         db.session.add(new_tidb_auth_binding)
                         db.session.commit()

api/core/rag/datasource/vdb/tidb_on_qdrant/tidb_service.py

@@ -9,6 +9,7 @@ from configs import dify_config
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from models.dataset import TidbAuthBinding
+from models.enums import TidbAuthBindingStatus
 
 
 class TidbService:
@@ -170,7 +171,7 @@ class TidbService:
                 userPrefix = item["userPrefix"]
                 if state == "ACTIVE" and len(userPrefix) > 0:
                     cluster_info = tidb_serverless_list_map[item["clusterId"]]
-                    cluster_info.status = "ACTIVE"
+                    cluster_info.status = TidbAuthBindingStatus.ACTIVE
                     cluster_info.account = f"{userPrefix}.root"
                     db.session.add(cluster_info)
             db.session.commit()

api/core/rag/extractor/firecrawl/firecrawl_app.py

@@ -95,15 +95,11 @@ class FirecrawlApp:
         if response.status_code == 200:
             crawl_status_response = response.json()
             if crawl_status_response.get("status") == "completed":
-                total = crawl_status_response.get("total", 0)
-                if total == 0:
+                # Normalize to avoid None bypassing the zero-guard when the API returns null.
+                total = crawl_status_response.get("total") or 0
+                if total <= 0:
                     raise Exception("Failed to check crawl status. Error: No page found")
-                data = crawl_status_response.get("data", [])
-                url_data_list: list[FirecrawlDocumentData] = []
-                for item in data:
-                    if isinstance(item, dict) and "metadata" in item and "markdown" in item:
-                        url_data = self._extract_common_fields(item)
-                        url_data_list.append(url_data)
+                url_data_list = self._collect_all_crawl_pages(crawl_status_response, headers)
                 if url_data_list:
                     file_key = "website_files/" + job_id + ".txt"
                     try:
@@ -120,6 +116,36 @@ class FirecrawlApp:
         self._handle_error(response, "check crawl status")
         raise RuntimeError("unreachable: _handle_error always raises")
 
+    def _collect_all_crawl_pages(
+        self, first_page: dict[str, Any], headers: dict[str, str]
+    ) -> list[FirecrawlDocumentData]:
+        """Collect all crawl result pages by following pagination links.
+
+        Raises an exception if any paginated request fails, to avoid returning
+        partial data that is inconsistent with the reported total.
+
+        The number of pages processed is capped at ``total`` (the
+        server-reported page count) to guard against infinite loops caused by
+        a misbehaving server that keeps returning a ``next`` URL.
+        """
+        total: int = first_page.get("total") or 0
+        url_data_list: list[FirecrawlDocumentData] = []
+        current_page = first_page
+        pages_processed = 0
+        while True:
+            for item in current_page.get("data", []):
+                if isinstance(item, dict) and "metadata" in item and "markdown" in item:
+                    url_data_list.append(self._extract_common_fields(item))
+            next_url: str | None = current_page.get("next")
+            pages_processed += 1
+            if not next_url or pages_processed >= total:
+                break
+            response = self._get_request(next_url, headers)
+            if response.status_code != 200:
+                self._handle_error(response, "fetch next crawl page")
+            current_page = response.json()
+        return url_data_list
+
     def _format_crawl_status_response(
         self,
         status: str,

api/models/dataset.py

@@ -43,7 +43,9 @@ from .enums import (
     IndexingStatus,
     ProcessRuleMode,
     SegmentStatus,
+    SegmentType,
     SummaryStatus,
+    TidbAuthBindingStatus,
 )
 from .model import App, Tag, TagBinding, UploadFile
 from .types import AdjustedJSON, BinaryData, EnumText, LongText, StringUUID, adjusted_json_index
@@ -494,7 +496,9 @@ class Document(Base):
     )
     doc_type = mapped_column(EnumText(DocumentDocType, length=40), nullable=True)
     doc_metadata = mapped_column(AdjustedJSON, nullable=True)
-    doc_form = mapped_column(String(255), nullable=False, server_default=sa.text("'text_model'"))
+    doc_form: Mapped[IndexStructureType] = mapped_column(
+        EnumText(IndexStructureType, length=255), nullable=False, server_default=sa.text("'text_model'")
+    )
     doc_language = mapped_column(String(255), nullable=True)
     need_summary: Mapped[bool] = mapped_column(sa.Boolean, nullable=False, server_default=sa.text("false"))
 
@@ -998,7 +1002,9 @@ class ChildChunk(Base):
     # indexing fields
     index_node_id = mapped_column(String(255), nullable=True)
     index_node_hash = mapped_column(String(255), nullable=True)
-    type = mapped_column(String(255), nullable=False, server_default=sa.text("'automatic'"))
+    type: Mapped[SegmentType] = mapped_column(
+        EnumText(SegmentType, length=255), nullable=False, server_default=sa.text("'automatic'")
+    )
     created_by = mapped_column(StringUUID, nullable=False)
     created_at: Mapped[datetime] = mapped_column(DateTime, nullable=False, server_default=sa.func.current_timestamp())
     updated_by = mapped_column(StringUUID, nullable=True)
@@ -1239,7 +1245,9 @@ class TidbAuthBinding(TypeBase):
     cluster_id: Mapped[str] = mapped_column(String(255), nullable=False)
     cluster_name: Mapped[str] = mapped_column(String(255), nullable=False)
     active: Mapped[bool] = mapped_column(sa.Boolean, nullable=False, server_default=sa.text("false"))
-    status: Mapped[str] = mapped_column(sa.String(255), nullable=False, server_default=sa.text("'CREATING'"))
+    status: Mapped[TidbAuthBindingStatus] = mapped_column(
+        EnumText(TidbAuthBindingStatus, length=255), nullable=False, server_default=sa.text("'CREATING'")
+    )
     account: Mapped[str] = mapped_column(String(255), nullable=False)
     password: Mapped[str] = mapped_column(String(255), nullable=False)
     created_at: Mapped[datetime] = mapped_column(

api/models/enums.py

@@ -222,6 +222,13 @@ class DatasetMetadataType(StrEnum):
     TIME = "time"
 
 
+class SegmentType(StrEnum):
+    """Document segment type"""
+
+    AUTOMATIC = "automatic"
+    CUSTOMIZED = "customized"
+
+
 class SegmentStatus(StrEnum):
     """Document segment status"""
 
@@ -323,3 +330,10 @@ class ProviderQuotaType(StrEnum):
             if member.value == value:
                 return member
         raise ValueError(f"No matching enum found for value '{value}'")
+
+
+class ApiTokenType(StrEnum):
+    """API Token type"""
+
+    APP = "app"
+    DATASET = "dataset"

api/models/model.py

@@ -21,7 +21,7 @@ from configs import dify_config
 from constants import DEFAULT_FILE_NUMBER_LIMITS
 from core.tools.signature import sign_tool_file
 from dify_graph.enums import WorkflowExecutionStatus
-from dify_graph.file import FILE_MODEL_IDENTITY, File, FileTransferMethod
+from dify_graph.file import FILE_MODEL_IDENTITY, File, FileTransferMethod, FileType
 from dify_graph.file import helpers as file_helpers
 from extensions.storage.storage_type import StorageType
 from libs.helper import generate_string  # type: ignore[import-not-found]
@@ -31,6 +31,7 @@ from .account import Account, Tenant
 from .base import Base, TypeBase, gen_uuidv4_string
 from .engine import db
 from .enums import (
+    ApiTokenType,
     AppMCPServerStatus,
     AppStatus,
     BannerStatus,
@@ -43,6 +44,7 @@ from .enums import (
     MessageChainType,
     MessageFileBelongsTo,
     MessageStatus,
+    ProviderQuotaType,
     TagType,
 )
 from .provider_ids import GenericProviderID
@@ -1783,7 +1785,7 @@ class MessageFile(TypeBase):
         StringUUID, insert_default=lambda: str(uuid4()), default_factory=lambda: str(uuid4()), init=False
     )
     message_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
-    type: Mapped[str] = mapped_column(String(255), nullable=False)
+    type: Mapped[FileType] = mapped_column(EnumText(FileType, length=255), nullable=False)
     transfer_method: Mapped[FileTransferMethod] = mapped_column(
         EnumText(FileTransferMethod, length=255), nullable=False
     )
@@ -2095,7 +2097,7 @@ class ApiToken(Base):  # bug: this uses setattr so idk the field.
     id = mapped_column(StringUUID, default=lambda: str(uuid4()))
     app_id = mapped_column(StringUUID, nullable=True)
     tenant_id = mapped_column(StringUUID, nullable=True)
-    type = mapped_column(String(16), nullable=False)
+    type: Mapped[ApiTokenType] = mapped_column(EnumText(ApiTokenType, length=16), nullable=False)
     token: Mapped[str] = mapped_column(String(255), nullable=False)
     last_used_at = mapped_column(sa.DateTime, nullable=True)
     created_at = mapped_column(sa.DateTime, nullable=False, server_default=func.current_timestamp())
@@ -2490,7 +2492,9 @@ class TenantCreditPool(TypeBase):
         StringUUID, insert_default=lambda: str(uuid4()), default_factory=lambda: str(uuid4()), init=False
     )
     tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
-    pool_type: Mapped[str] = mapped_column(String(40), nullable=False, default="trial", server_default="trial")
+    pool_type: Mapped[ProviderQuotaType] = mapped_column(
+        EnumText(ProviderQuotaType, length=40), nullable=False, default=ProviderQuotaType.TRIAL, server_default="trial"
+    )
     quota_limit: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
     quota_used: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
     created_at: Mapped[datetime] = mapped_column(

api/models/tools.py

@@ -145,7 +145,9 @@ class ApiToolProvider(TypeBase):
     icon: Mapped[str] = mapped_column(String(255), nullable=False)
     # original schema
     schema: Mapped[str] = mapped_column(LongText, nullable=False)
-    schema_type_str: Mapped[str] = mapped_column(String(40), nullable=False)
+    schema_type_str: Mapped[ApiProviderSchemaType] = mapped_column(
+        EnumText(ApiProviderSchemaType, length=40), nullable=False
+    )
     # who created this tool
     user_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
     # tenant id

api/models/workflow.py

@@ -1221,7 +1221,9 @@ class WorkflowAppLog(TypeBase):
     app_id: Mapped[str] = mapped_column(StringUUID)
     workflow_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
     workflow_run_id: Mapped[str] = mapped_column(StringUUID)
-    created_from: Mapped[str] = mapped_column(String(255), nullable=False)
+    created_from: Mapped[WorkflowAppLogCreatedFrom] = mapped_column(
+        EnumText(WorkflowAppLogCreatedFrom, length=255), nullable=False
+    )
     created_by_role: Mapped[CreatorUserRole] = mapped_column(EnumText(CreatorUserRole, length=255), nullable=False)
     created_by: Mapped[str] = mapped_column(StringUUID, nullable=False)
     created_at: Mapped[datetime] = mapped_column(
@@ -1301,10 +1303,14 @@ class WorkflowArchiveLog(TypeBase):
 
     log_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
     log_created_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
-    log_created_from: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    log_created_from: Mapped[WorkflowAppLogCreatedFrom | None] = mapped_column(
+        EnumText(WorkflowAppLogCreatedFrom, length=255), nullable=True
+    )
 
     run_version: Mapped[str] = mapped_column(String(255), nullable=False)
-    run_status: Mapped[str] = mapped_column(String(255), nullable=False)
+    run_status: Mapped[WorkflowExecutionStatus] = mapped_column(
+        EnumText(WorkflowExecutionStatus, length=255), nullable=False
+    )
     run_triggered_from: Mapped[WorkflowRunTriggeredFrom] = mapped_column(
         EnumText(WorkflowRunTriggeredFrom, length=255), nullable=False
     )

api/schedule/create_tidb_serverless_task.py

@@ -8,6 +8,7 @@ from configs import dify_config
 from core.rag.datasource.vdb.tidb_on_qdrant.tidb_service import TidbService
 from extensions.ext_database import db
 from models.dataset import TidbAuthBinding
+from models.enums import TidbAuthBindingStatus
 
 
 @app.celery.task(queue="dataset")
@@ -57,7 +58,7 @@ def create_clusters(batch_size):
                 account=new_cluster["account"],
                 password=new_cluster["password"],
                 active=False,
-                status="CREATING",
+                status=TidbAuthBindingStatus.CREATING,
             )
             db.session.add(tidb_auth_binding)
         db.session.commit()

api/schedule/update_tidb_serverless_status_task.py

@@ -9,6 +9,7 @@ from configs import dify_config
 from core.rag.datasource.vdb.tidb_on_qdrant.tidb_service import TidbService
 from extensions.ext_database import db
 from models.dataset import TidbAuthBinding
+from models.enums import TidbAuthBindingStatus
 
 
 @app.celery.task(queue="dataset")
@@ -18,7 +19,10 @@ def update_tidb_serverless_status_task():
     try:
         # check the number of idle tidb serverless
         tidb_serverless_list = db.session.scalars(
-            select(TidbAuthBinding).where(TidbAuthBinding.active == False, TidbAuthBinding.status == "CREATING")
+            select(TidbAuthBinding).where(
+                TidbAuthBinding.active == False,
+                TidbAuthBinding.status == TidbAuthBindingStatus.CREATING,
+            )
         ).all()
         if len(tidb_serverless_list) == 0:
             return

api/services/app_service.py

@@ -241,7 +241,7 @@ class AppService:
     class ArgsDict(TypedDict):
         name: str
         description: str
-        icon_type: str
+        icon_type: IconType | str | None
         icon: str
         icon_background: str
         use_icon_as_answer_icon: bool
@@ -257,7 +257,13 @@ class AppService:
         assert current_user is not None
         app.name = args["name"]
         app.description = args["description"]
-        app.icon_type = IconType(args["icon_type"]) if args["icon_type"] else None
+        icon_type = args.get("icon_type")
+        if icon_type is None:
+            resolved_icon_type = app.icon_type
+        else:
+            resolved_icon_type = IconType(icon_type)
+
+        app.icon_type = resolved_icon_type
         app.icon = args["icon"]
         app.icon_background = args["icon_background"]
         app.use_icon_as_answer_icon = args.get("use_icon_as_answer_icon", False)

api/services/auth/api_key_auth_base.py

@@ -1,8 +1,16 @@
 from abc import ABC, abstractmethod
+from typing import Any
+
+from typing_extensions import TypedDict
+
+
+class AuthCredentials(TypedDict):
+    auth_type: str
+    config: dict[str, Any]
 
 
 class ApiKeyAuthBase(ABC):
-    def __init__(self, credentials: dict):
+    def __init__(self, credentials: AuthCredentials):
         self.credentials = credentials
 
     @abstractmethod

api/services/auth/api_key_auth_factory.py

@@ -1,9 +1,9 @@
-from services.auth.api_key_auth_base import ApiKeyAuthBase
+from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 from services.auth.auth_type import AuthType
 
 
 class ApiKeyAuthFactory:
-    def __init__(self, provider: str, credentials: dict):
+    def __init__(self, provider: str, credentials: AuthCredentials):
         auth_factory = self.get_apikey_auth_factory(provider)
         self.auth = auth_factory(credentials)
 

api/services/auth/firecrawl/firecrawl.py

@@ -2,11 +2,11 @@ import json
 
 import httpx
 
-from services.auth.api_key_auth_base import ApiKeyAuthBase
+from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 
 class FirecrawlAuth(ApiKeyAuthBase):
-    def __init__(self, credentials: dict):
+    def __init__(self, credentials: AuthCredentials):
         super().__init__(credentials)
         auth_type = credentials.get("auth_type")
         if auth_type != "bearer":

api/services/auth/jina.py

@@ -2,11 +2,11 @@ import json
 
 import httpx
 
-from services.auth.api_key_auth_base import ApiKeyAuthBase
+from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 
 class JinaAuth(ApiKeyAuthBase):
-    def __init__(self, credentials: dict):
+    def __init__(self, credentials: AuthCredentials):
         super().__init__(credentials)
         auth_type = credentials.get("auth_type")
         if auth_type != "bearer":

api/services/auth/jina/jina.py

@@ -2,11 +2,11 @@ import json
 
 import httpx
 
-from services.auth.api_key_auth_base import ApiKeyAuthBase
+from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 
 class JinaAuth(ApiKeyAuthBase):
-    def __init__(self, credentials: dict):
+    def __init__(self, credentials: AuthCredentials):
         super().__init__(credentials)
         auth_type = credentials.get("auth_type")
         if auth_type != "bearer":

api/services/auth/watercrawl/watercrawl.py

@@ -3,11 +3,11 @@ from urllib.parse import urljoin
 
 import httpx
 
-from services.auth.api_key_auth_base import ApiKeyAuthBase
+from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 
 class WatercrawlAuth(ApiKeyAuthBase):
-    def __init__(self, credentials: dict):
+    def __init__(self, credentials: AuthCredentials):
         super().__init__(credentials)
         auth_type = credentials.get("auth_type")
         if auth_type != "x-api-key":

api/services/credit_pool_service.py

@@ -7,6 +7,7 @@ from configs import dify_config
 from core.errors.error import QuotaExceededError
 from extensions.ext_database import db
 from models import TenantCreditPool
+from models.enums import ProviderQuotaType
 
 logger = logging.getLogger(__name__)
 
@@ -16,7 +17,10 @@ class CreditPoolService:
     def create_default_pool(cls, tenant_id: str) -> TenantCreditPool:
         """create default credit pool for new tenant"""
         credit_pool = TenantCreditPool(
-            tenant_id=tenant_id, quota_limit=dify_config.HOSTED_POOL_CREDITS, quota_used=0, pool_type="trial"
+            tenant_id=tenant_id,
+            quota_limit=dify_config.HOSTED_POOL_CREDITS,
+            quota_used=0,
+            pool_type=ProviderQuotaType.TRIAL,
         )
         db.session.add(credit_pool)
         db.session.commit()

api/services/dataset_service.py

@@ -58,6 +58,7 @@ from models.enums import (
     IndexingStatus,
     ProcessRuleMode,
     SegmentStatus,
+    SegmentType,
 )
 from models.model import UploadFile
 from models.provider_ids import ModelProviderID
@@ -1439,7 +1440,7 @@ class DocumentService:
                 .filter(
                     Document.id.in_(document_id_list),
                     Document.dataset_id == dataset_id,
-                    Document.doc_form != "qa_model",  # Skip qa_model documents
+                    Document.doc_form != IndexStructureType.QA_INDEX,  # Skip qa_model documents
                 )
                 .update({Document.need_summary: need_summary}, synchronize_session=False)
             )
@@ -2039,7 +2040,7 @@ class DocumentService:
                                 document.dataset_process_rule_id = dataset_process_rule.id
                                 document.updated_at = naive_utc_now()
                                 document.created_from = created_from
-                                document.doc_form = knowledge_config.doc_form
+                                document.doc_form = IndexStructureType(knowledge_config.doc_form)
                                 document.doc_language = knowledge_config.doc_language
                                 document.data_source_info = json.dumps(data_source_info)
                                 document.batch = batch
@@ -2639,7 +2640,7 @@ class DocumentService:
         document.splitting_completed_at = None
         document.updated_at = naive_utc_now()
         document.created_from = created_from
-        document.doc_form = document_data.doc_form
+        document.doc_form = IndexStructureType(document_data.doc_form)
         db.session.add(document)
         db.session.commit()
         # update document segment
@@ -3100,7 +3101,7 @@ class DocumentService:
 class SegmentService:
     @classmethod
     def segment_create_args_validate(cls, args: dict, document: Document):
-        if document.doc_form == "qa_model":
+        if document.doc_form == IndexStructureType.QA_INDEX:
             if "answer" not in args or not args["answer"]:
                 raise ValueError("Answer is required")
             if not args["answer"].strip():
@@ -3157,7 +3158,7 @@ class SegmentService:
                     completed_at=naive_utc_now(),
                     created_by=current_user.id,
                 )
-                if document.doc_form == "qa_model":
+                if document.doc_form == IndexStructureType.QA_INDEX:
                     segment_document.word_count += len(args["answer"])
                     segment_document.answer = args["answer"]
 
@@ -3231,7 +3232,7 @@ class SegmentService:
                     tokens = 0
                     if dataset.indexing_technique == "high_quality" and embedding_model:
                         # calc embedding use tokens
-                        if document.doc_form == "qa_model":
+                        if document.doc_form == IndexStructureType.QA_INDEX:
                             tokens = embedding_model.get_text_embedding_num_tokens(
                                 texts=[content + segment_item["answer"]]
                             )[0]
@@ -3254,7 +3255,7 @@ class SegmentService:
                         completed_at=naive_utc_now(),
                         created_by=current_user.id,
                     )
-                    if document.doc_form == "qa_model":
+                    if document.doc_form == IndexStructureType.QA_INDEX:
                         segment_document.answer = segment_item["answer"]
                         segment_document.word_count += len(segment_item["answer"])
                     increment_word_count += segment_document.word_count
@@ -3321,7 +3322,7 @@ class SegmentService:
             content = args.content or segment.content
             if segment.content == content:
                 segment.word_count = len(content)
-                if document.doc_form == "qa_model":
+                if document.doc_form == IndexStructureType.QA_INDEX:
                     segment.answer = args.answer
                     segment.word_count += len(args.answer) if args.answer else 0
                 word_count_change = segment.word_count - word_count_change
@@ -3418,7 +3419,7 @@ class SegmentService:
                     )
 
                     # calc embedding use tokens
-                    if document.doc_form == "qa_model":
+                    if document.doc_form == IndexStructureType.QA_INDEX:
                         segment.answer = args.answer
                         tokens = embedding_model.get_text_embedding_num_tokens(texts=[content + segment.answer])[0]  # type: ignore
                     else:
@@ -3435,7 +3436,7 @@ class SegmentService:
                 segment.enabled = True
                 segment.disabled_at = None
                 segment.disabled_by = None
-                if document.doc_form == "qa_model":
+                if document.doc_form == IndexStructureType.QA_INDEX:
                     segment.answer = args.answer
                     segment.word_count += len(args.answer) if args.answer else 0
                 word_count_change = segment.word_count - word_count_change
@@ -3786,7 +3787,7 @@ class SegmentService:
                         child_chunk.word_count = len(child_chunk.content)
                         child_chunk.updated_by = current_user.id
                         child_chunk.updated_at = naive_utc_now()
-                        child_chunk.type = "customized"
+                        child_chunk.type = SegmentType.CUSTOMIZED
                         update_child_chunks.append(child_chunk)
             else:
                 new_child_chunks_args.append(child_chunk_update_args)
@@ -3845,7 +3846,7 @@ class SegmentService:
             child_chunk.word_count = len(content)
             child_chunk.updated_by = current_user.id
             child_chunk.updated_at = naive_utc_now()
-            child_chunk.type = "customized"
+            child_chunk.type = SegmentType.CUSTOMIZED
             db.session.add(child_chunk)
             VectorService.update_child_chunk_vector([], [child_chunk], [], dataset)
             db.session.commit()

api/services/rag_pipeline/rag_pipeline_transform_service.py

@@ -9,6 +9,7 @@ from flask_login import current_user
 
 from constants import DOCUMENT_EXTENSIONS
 from core.plugin.impl.plugin import PluginInstaller
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.retrieval.retrieval_methods import RetrievalMethod
 from extensions.ext_database import db
 from factories import variable_factory
@@ -79,9 +80,9 @@ class RagPipelineTransformService:
         pipeline = self._create_pipeline(pipeline_yaml)
 
         # save chunk structure to dataset
-        if doc_form == "hierarchical_model":
+        if doc_form == IndexStructureType.PARENT_CHILD_INDEX:
             dataset.chunk_structure = "hierarchical_model"
-        elif doc_form == "text_model":
+        elif doc_form == IndexStructureType.PARAGRAPH_INDEX:
             dataset.chunk_structure = "text_model"
         else:
             raise ValueError("Unsupported doc form")
@@ -101,7 +102,7 @@ class RagPipelineTransformService:
 
     def _get_transform_yaml(self, doc_form: str, datasource_type: str, indexing_technique: str | None):
         pipeline_yaml = {}
-        if doc_form == "text_model":
+        if doc_form == IndexStructureType.PARAGRAPH_INDEX:
             match datasource_type:
                 case DataSourceType.UPLOAD_FILE:
                     if indexing_technique == "high_quality":
@@ -132,7 +133,7 @@ class RagPipelineTransformService:
                             pipeline_yaml = yaml.safe_load(f)
                 case _:
                     raise ValueError("Unsupported datasource type")
-        elif doc_form == "hierarchical_model":
+        elif doc_form == IndexStructureType.PARENT_CHILD_INDEX:
             match datasource_type:
                 case DataSourceType.UPLOAD_FILE:
                     # get graph from transform.file-parentchild.yml

api/tasks/batch_create_segment_to_index_task.py

@@ -11,6 +11,7 @@ from sqlalchemy import func
 
 from core.db.session_factory import session_factory
 from core.model_manager import ModelManager
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from dify_graph.model_runtime.entities.model_entities import ModelType
 from extensions.ext_redis import redis_client
 from extensions.ext_storage import storage
@@ -109,7 +110,7 @@ def batch_create_segment_to_index_task(
         df = pd.read_csv(file_path)
         content = []
         for _, row in df.iterrows():
-            if document_config["doc_form"] == "qa_model":
+            if document_config["doc_form"] == IndexStructureType.QA_INDEX:
                 data = {"content": row.iloc[0], "answer": row.iloc[1]}
             else:
                 data = {"content": row.iloc[0]}
@@ -159,7 +160,7 @@ def batch_create_segment_to_index_task(
                 status="completed",
                 completed_at=naive_utc_now(),
             )
-            if document_config["doc_form"] == "qa_model":
+            if document_config["doc_form"] == IndexStructureType.QA_INDEX:
                 segment_document.answer = segment["answer"]
                 segment_document.word_count += len(segment["answer"])
             word_count_change += segment_document.word_count

api/tasks/document_indexing_task.py

@@ -10,6 +10,7 @@ from configs import dify_config
 from core.db.session_factory import session_factory
 from core.entities.document_task import DocumentTask
 from core.indexing_runner import DocumentIsPausedError, IndexingRunner
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.pipeline.queue import TenantIsolatedTaskQueue
 from enums.cloud_plan import CloudPlan
 from libs.datetime_utils import naive_utc_now
@@ -150,7 +151,7 @@ def _document_indexing(dataset_id: str, document_ids: Sequence[str]):
                             )
                             if (
                                 document.indexing_status == IndexingStatus.COMPLETED
-                                and document.doc_form != "qa_model"
+                                and document.doc_form != IndexStructureType.QA_INDEX
                                 and document.need_summary is True
                             ):
                                 try:

api/tasks/regenerate_summary_index_task.py

@@ -9,6 +9,7 @@ from celery import shared_task
 from sqlalchemy import or_, select
 
 from core.db.session_factory import session_factory
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.dataset import Dataset, DocumentSegment, DocumentSegmentSummary
 from models.dataset import Document as DatasetDocument
 from services.summary_index_service import SummaryIndexService
@@ -106,7 +107,7 @@ def regenerate_summary_index_task(
                         ),
                         DatasetDocument.enabled == True,  # Document must be enabled
                         DatasetDocument.archived == False,  # Document must not be archived
-                        DatasetDocument.doc_form != "qa_model",  # Skip qa_model documents
+                        DatasetDocument.doc_form != IndexStructureType.QA_INDEX,  # Skip qa_model documents
                     )
                     .order_by(DocumentSegment.document_id.asc(), DocumentSegment.position.asc())
                     .all()
@@ -209,7 +210,7 @@ def regenerate_summary_index_task(
 
                 for dataset_document in dataset_documents:
                     # Skip qa_model documents
-                    if dataset_document.doc_form == "qa_model":
+                    if dataset_document.doc_form == IndexStructureType.QA_INDEX:
                         continue
 
                     try:

api/tasks/trigger_processing_tasks.py

@@ -179,7 +179,7 @@ def _record_trigger_failure_log(
         app_id=workflow.app_id,
         workflow_id=workflow.id,
         workflow_run_id=workflow_run.id,
-        created_from=WorkflowAppLogCreatedFrom.SERVICE_API.value,
+        created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
         created_by_role=created_by_role,
         created_by=created_by,
     )

api/tests/integration_tests/libs/test_api_token_cache_integration.py

@@ -13,6 +13,7 @@ from unittest.mock import patch
 import pytest
 
 from extensions.ext_redis import redis_client
+from models.enums import ApiTokenType
 from models.model import ApiToken
 from services.api_token_service import ApiTokenCache, CachedApiToken
 
@@ -279,7 +280,7 @@ class TestEndToEndCacheFlow:
         test_token = ApiToken()
         test_token.id = "test-e2e-id"
         test_token.token = test_token_value
-        test_token.type = test_scope
+        test_token.type = ApiTokenType.APP
         test_token.app_id = "test-app"
         test_token.tenant_id = "test-tenant"
         test_token.last_used_at = None

api/tests/test_containers_integration_tests/controllers/console/app/test_message.py

@@ -0,0 +1,342 @@
+"""Authenticated controller integration tests for console message APIs."""
+
+from datetime import timedelta
+from decimal import Decimal
+from unittest.mock import patch
+from uuid import uuid4
+
+import pytest
+from flask.testing import FlaskClient
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from controllers.console.app.message import ChatMessagesQuery, FeedbackExportQuery, MessageFeedbackPayload
+from controllers.console.app.message import attach_message_extra_contents as _attach_message_extra_contents
+from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
+from libs.datetime_utils import naive_utc_now
+from models.enums import ConversationFromSource, FeedbackRating
+from models.model import AppMode, Conversation, Message, MessageAnnotation, MessageFeedback
+from services.errors.conversation import ConversationNotExistsError
+from services.errors.message import MessageNotExistsError, SuggestedQuestionsAfterAnswerDisabledError
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+    create_console_app,
+)
+
+
+def _create_conversation(db_session: Session, app_id: str, account_id: str, mode: AppMode) -> Conversation:
+    conversation = Conversation(
+        app_id=app_id,
+        app_model_config_id=None,
+        model_provider=None,
+        model_id="",
+        override_model_configs=None,
+        mode=mode,
+        name="Test Conversation",
+        inputs={},
+        introduction="",
+        system_instruction="",
+        system_instruction_tokens=0,
+        status="normal",
+        from_source=ConversationFromSource.CONSOLE,
+        from_account_id=account_id,
+    )
+    db_session.add(conversation)
+    db_session.commit()
+    return conversation
+
+
+def _create_message(
+    db_session: Session,
+    app_id: str,
+    conversation_id: str,
+    account_id: str,
+    *,
+    created_at_offset_seconds: int = 0,
+) -> Message:
+    created_at = naive_utc_now() + timedelta(seconds=created_at_offset_seconds)
+    message = Message(
+        app_id=app_id,
+        model_provider=None,
+        model_id="",
+        override_model_configs=None,
+        conversation_id=conversation_id,
+        inputs={},
+        query="Hello",
+        message={"type": "text", "content": "Hello"},
+        message_tokens=1,
+        message_unit_price=Decimal("0.0001"),
+        message_price_unit=Decimal("0.001"),
+        answer="Hi there",
+        answer_tokens=1,
+        answer_unit_price=Decimal("0.0001"),
+        answer_price_unit=Decimal("0.001"),
+        parent_message_id=None,
+        provider_response_latency=0,
+        total_price=Decimal("0.0002"),
+        currency="USD",
+        from_source=ConversationFromSource.CONSOLE,
+        from_account_id=account_id,
+        created_at=created_at,
+        updated_at=created_at,
+        app_mode=AppMode.CHAT,
+    )
+    db_session.add(message)
+    db_session.commit()
+    return message
+
+
+class TestMessageValidators:
+    def test_chat_messages_query_validators(self) -> None:
+        assert ChatMessagesQuery.empty_to_none("") is None
+        assert ChatMessagesQuery.empty_to_none("val") == "val"
+        assert ChatMessagesQuery.validate_uuid(None) is None
+        assert (
+            ChatMessagesQuery.validate_uuid("123e4567-e89b-12d3-a456-426614174000")
+            == "123e4567-e89b-12d3-a456-426614174000"
+        )
+
+    def test_message_feedback_validators(self) -> None:
+        assert (
+            MessageFeedbackPayload.validate_message_id("123e4567-e89b-12d3-a456-426614174000")
+            == "123e4567-e89b-12d3-a456-426614174000"
+        )
+
+    def test_feedback_export_validators(self) -> None:
+        assert FeedbackExportQuery.parse_bool(None) is None
+        assert FeedbackExportQuery.parse_bool(True) is True
+        assert FeedbackExportQuery.parse_bool("1") is True
+        assert FeedbackExportQuery.parse_bool("0") is False
+        assert FeedbackExportQuery.parse_bool("off") is False
+
+        with pytest.raises(ValueError):
+            FeedbackExportQuery.parse_bool("invalid")
+
+
+def test_chat_message_list_not_found(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/chat-messages",
+        query_string={"conversation_id": str(uuid4())},
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 404
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "not_found"
+
+
+def test_chat_message_list_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, app.mode)
+    _create_message(db_session_with_containers, app.id, conversation.id, account.id, created_at_offset_seconds=0)
+    second = _create_message(
+        db_session_with_containers,
+        app.id,
+        conversation.id,
+        account.id,
+        created_at_offset_seconds=1,
+    )
+
+    with patch(
+        "controllers.console.app.message.attach_message_extra_contents",
+        side_effect=_attach_message_extra_contents,
+    ):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/chat-messages",
+            query_string={"conversation_id": conversation.id, "limit": 1},
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["limit"] == 1
+    assert payload["has_more"] is True
+    assert len(payload["data"]) == 1
+    assert payload["data"][0]["id"] == second.id
+
+
+def test_message_feedback_not_found(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+
+    response = test_client_with_containers.post(
+        f"/console/api/apps/{app.id}/feedbacks",
+        json={"message_id": str(uuid4()), "rating": "like"},
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 404
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "not_found"
+
+
+def test_message_feedback_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, app.mode)
+    message = _create_message(db_session_with_containers, app.id, conversation.id, account.id)
+
+    response = test_client_with_containers.post(
+        f"/console/api/apps/{app.id}/feedbacks",
+        json={"message_id": message.id, "rating": "like"},
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"result": "success"}
+
+    feedback = db_session_with_containers.scalar(
+        select(MessageFeedback).where(MessageFeedback.message_id == message.id)
+    )
+    assert feedback is not None
+    assert feedback.rating == FeedbackRating.LIKE
+    assert feedback.from_account_id == account.id
+
+
+def test_message_annotation_count(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, app.mode)
+    message = _create_message(db_session_with_containers, app.id, conversation.id, account.id)
+    db_session_with_containers.add(
+        MessageAnnotation(
+            app_id=app.id,
+            conversation_id=conversation.id,
+            message_id=message.id,
+            question="Q",
+            content="A",
+            account_id=account.id,
+        )
+    )
+    db_session_with_containers.commit()
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/annotations/count",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"count": 1}
+
+
+def test_message_suggested_questions_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    message_id = str(uuid4())
+
+    with patch(
+        "controllers.console.app.message.MessageService.get_suggested_questions_after_answer",
+        return_value=["q1", "q2"],
+    ):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/chat-messages/{message_id}/suggested-questions",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"data": ["q1", "q2"]}
+
+
+@pytest.mark.parametrize(
+    ("exc", "expected_status", "expected_code"),
+    [
+        (MessageNotExistsError(), 404, "not_found"),
+        (ConversationNotExistsError(), 404, "not_found"),
+        (ProviderTokenNotInitError(), 400, "provider_not_initialize"),
+        (QuotaExceededError(), 400, "provider_quota_exceeded"),
+        (ModelCurrentlyNotSupportError(), 400, "model_currently_not_support"),
+        (SuggestedQuestionsAfterAnswerDisabledError(), 403, "app_suggested_questions_after_answer_disabled"),
+        (Exception(), 500, "internal_server_error"),
+    ],
+)
+def test_message_suggested_questions_errors(
+    exc: Exception,
+    expected_status: int,
+    expected_code: str,
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    message_id = str(uuid4())
+
+    with patch(
+        "controllers.console.app.message.MessageService.get_suggested_questions_after_answer",
+        side_effect=exc,
+    ):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/chat-messages/{message_id}/suggested-questions",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == expected_status
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == expected_code
+
+
+def test_message_feedback_export_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+
+    with patch("services.feedback_service.FeedbackService.export_feedbacks", return_value={"exported": True}):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/feedbacks/export",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"exported": True}
+
+
+def test_message_api_get_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, app.mode)
+    message = _create_message(db_session_with_containers, app.id, conversation.id, account.id)
+
+    with patch(
+        "controllers.console.app.message.attach_message_extra_contents",
+        side_effect=_attach_message_extra_contents,
+    ):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/messages/{message.id}",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["id"] == message.id

api/tests/test_containers_integration_tests/controllers/console/app/test_statistic.py

@@ -0,0 +1,334 @@
+"""Controller integration tests for console statistic routes."""
+
+from datetime import timedelta
+from decimal import Decimal
+from unittest.mock import patch
+from uuid import uuid4
+
+from flask.testing import FlaskClient
+from sqlalchemy.orm import Session
+
+from core.app.entities.app_invoke_entities import InvokeFrom
+from libs.datetime_utils import naive_utc_now
+from models.enums import ConversationFromSource, FeedbackFromSource, FeedbackRating
+from models.model import AppMode, Conversation, Message, MessageFeedback
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+    create_console_app,
+)
+
+
+def _create_conversation(
+    db_session: Session,
+    app_id: str,
+    account_id: str,
+    *,
+    mode: AppMode,
+    created_at_offset_days: int = 0,
+) -> Conversation:
+    created_at = naive_utc_now() + timedelta(days=created_at_offset_days)
+    conversation = Conversation(
+        app_id=app_id,
+        app_model_config_id=None,
+        model_provider=None,
+        model_id="",
+        override_model_configs=None,
+        mode=mode,
+        name="Stats Conversation",
+        inputs={},
+        introduction="",
+        system_instruction="",
+        system_instruction_tokens=0,
+        status="normal",
+        from_source=ConversationFromSource.CONSOLE,
+        from_account_id=account_id,
+        created_at=created_at,
+        updated_at=created_at,
+    )
+    db_session.add(conversation)
+    db_session.commit()
+    return conversation
+
+
+def _create_message(
+    db_session: Session,
+    app_id: str,
+    conversation_id: str,
+    *,
+    from_account_id: str | None,
+    from_end_user_id: str | None = None,
+    message_tokens: int = 1,
+    answer_tokens: int = 1,
+    total_price: Decimal = Decimal("0.01"),
+    provider_response_latency: float = 1.0,
+    created_at_offset_days: int = 0,
+) -> Message:
+    created_at = naive_utc_now() + timedelta(days=created_at_offset_days)
+    message = Message(
+        app_id=app_id,
+        model_provider=None,
+        model_id="",
+        override_model_configs=None,
+        conversation_id=conversation_id,
+        inputs={},
+        query="Hello",
+        message={"type": "text", "content": "Hello"},
+        message_tokens=message_tokens,
+        message_unit_price=Decimal("0.001"),
+        message_price_unit=Decimal("0.001"),
+        answer="Hi there",
+        answer_tokens=answer_tokens,
+        answer_unit_price=Decimal("0.001"),
+        answer_price_unit=Decimal("0.001"),
+        parent_message_id=None,
+        provider_response_latency=provider_response_latency,
+        total_price=total_price,
+        currency="USD",
+        invoke_from=InvokeFrom.EXPLORE,
+        from_source=ConversationFromSource.CONSOLE,
+        from_end_user_id=from_end_user_id,
+        from_account_id=from_account_id,
+        created_at=created_at,
+        updated_at=created_at,
+        app_mode=AppMode.CHAT,
+    )
+    db_session.add(message)
+    db_session.commit()
+    return message
+
+
+def _create_like_feedback(
+    db_session: Session,
+    app_id: str,
+    conversation_id: str,
+    message_id: str,
+    account_id: str,
+) -> None:
+    db_session.add(
+        MessageFeedback(
+            app_id=app_id,
+            conversation_id=conversation_id,
+            message_id=message_id,
+            rating=FeedbackRating.LIKE,
+            from_source=FeedbackFromSource.ADMIN,
+            from_account_id=account_id,
+        )
+    )
+    db_session.commit()
+
+
+def test_daily_message_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/daily-messages",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["message_count"] == 1
+
+
+def test_daily_conversation_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+    _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/daily-conversations",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["conversation_count"] == 1
+
+
+def test_daily_terminals_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(
+        db_session_with_containers,
+        app.id,
+        conversation.id,
+        from_account_id=None,
+        from_end_user_id=str(uuid4()),
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/daily-end-users",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["terminal_count"] == 1
+
+
+def test_daily_token_cost_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(
+        db_session_with_containers,
+        app.id,
+        conversation.id,
+        from_account_id=account.id,
+        message_tokens=40,
+        answer_tokens=60,
+        total_price=Decimal("0.02"),
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/token-costs",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload["data"][0]["token_count"] == 100
+    assert Decimal(payload["data"][0]["total_price"]) == Decimal("0.02")
+
+
+def test_average_session_interaction_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+    _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/average-session-interactions",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["interactions"] == 2.0
+
+
+def test_user_satisfaction_rate_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    first = _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+    for _ in range(9):
+        _create_message(db_session_with_containers, app.id, conversation.id, from_account_id=account.id)
+    _create_like_feedback(db_session_with_containers, app.id, conversation.id, first.id, account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/user-satisfaction-rate",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["rate"] == 100.0
+
+
+def test_average_response_time_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.COMPLETION)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(
+        db_session_with_containers,
+        app.id,
+        conversation.id,
+        from_account_id=account.id,
+        provider_response_latency=1.234,
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/average-response-time",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["latency"] == 1234.0
+
+
+def test_tokens_per_second_statistic(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    conversation = _create_conversation(db_session_with_containers, app.id, account.id, mode=app.mode)
+    _create_message(
+        db_session_with_containers,
+        app.id,
+        conversation.id,
+        from_account_id=account.id,
+        answer_tokens=31,
+        provider_response_latency=2.0,
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/statistics/tokens-per-second",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["data"][0]["tps"] == 15.5
+
+
+def test_invalid_time_range(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+
+    with patch("controllers.console.app.statistic.parse_time_range", side_effect=ValueError("Invalid time")):
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/statistics/daily-messages?start=invalid&end=invalid",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "Invalid time"
+
+
+def test_time_range_params_passed(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    import datetime
+
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.CHAT)
+    start = datetime.datetime.now()
+    end = datetime.datetime.now()
+
+    with patch("controllers.console.app.statistic.parse_time_range", return_value=(start, end)) as mock_parse:
+        response = test_client_with_containers.get(
+            f"/console/api/apps/{app.id}/statistics/daily-messages?start=something&end=something",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    mock_parse.assert_called_once_with("something", "something", "UTC")

api/tests/test_containers_integration_tests/controllers/console/app/test_workflow_draft_variable.py

@@ -0,0 +1,415 @@
+"""Authenticated controller integration tests for workflow draft variable APIs."""
+
+import uuid
+
+from flask.testing import FlaskClient
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from dify_graph.constants import CONVERSATION_VARIABLE_NODE_ID, ENVIRONMENT_VARIABLE_NODE_ID
+from dify_graph.variables.segments import StringSegment
+from factories.variable_factory import segment_to_variable
+from models import Workflow
+from models.model import AppMode
+from models.workflow import WorkflowDraftVariable
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+    create_console_app,
+)
+
+
+def _create_draft_workflow(
+    db_session: Session,
+    app_id: str,
+    tenant_id: str,
+    account_id: str,
+    *,
+    environment_variables: list | None = None,
+    conversation_variables: list | None = None,
+) -> Workflow:
+    workflow = Workflow.new(
+        tenant_id=tenant_id,
+        app_id=app_id,
+        type="workflow",
+        version=Workflow.VERSION_DRAFT,
+        graph='{"nodes": [], "edges": []}',
+        features="{}",
+        created_by=account_id,
+        environment_variables=environment_variables or [],
+        conversation_variables=conversation_variables or [],
+        rag_pipeline_variables=[],
+    )
+    db_session.add(workflow)
+    db_session.commit()
+    return workflow
+
+
+def _create_node_variable(
+    db_session: Session,
+    app_id: str,
+    user_id: str,
+    *,
+    node_id: str = "node_1",
+    name: str = "test_var",
+) -> WorkflowDraftVariable:
+    variable = WorkflowDraftVariable.new_node_variable(
+        app_id=app_id,
+        user_id=user_id,
+        node_id=node_id,
+        name=name,
+        value=StringSegment(value="test_value"),
+        node_execution_id=str(uuid.uuid4()),
+        visible=True,
+        editable=True,
+    )
+    db_session.add(variable)
+    db_session.commit()
+    return variable
+
+
+def _create_system_variable(
+    db_session: Session, app_id: str, user_id: str, name: str = "query"
+) -> WorkflowDraftVariable:
+    variable = WorkflowDraftVariable.new_sys_variable(
+        app_id=app_id,
+        user_id=user_id,
+        name=name,
+        value=StringSegment(value="system-value"),
+        node_execution_id=str(uuid.uuid4()),
+        editable=True,
+    )
+    db_session.add(variable)
+    db_session.commit()
+    return variable
+
+
+def _build_environment_variable(name: str, value: str):
+    return segment_to_variable(
+        segment=StringSegment(value=value),
+        selector=[ENVIRONMENT_VARIABLE_NODE_ID, name],
+        name=name,
+        description=f"Environment variable {name}",
+    )
+
+
+def _build_conversation_variable(name: str, value: str):
+    return segment_to_variable(
+        segment=StringSegment(value=value),
+        selector=[CONVERSATION_VARIABLE_NODE_ID, name],
+        name=name,
+        description=f"Conversation variable {name}",
+    )
+
+
+def test_workflow_variable_collection_get_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/variables?page=1&limit=20",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"items": [], "total": 0}
+
+
+def test_workflow_variable_collection_get_not_exist(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 404
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "draft_workflow_not_exist"
+
+
+def test_workflow_variable_collection_delete(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_node_variable(db_session_with_containers, app.id, account.id)
+    _create_node_variable(db_session_with_containers, app.id, account.id, node_id="node_2", name="other_var")
+
+    response = test_client_with_containers.delete(
+        f"/console/api/apps/{app.id}/workflows/draft/variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 204
+    remaining = db_session_with_containers.scalars(
+        select(WorkflowDraftVariable).where(
+            WorkflowDraftVariable.app_id == app.id,
+            WorkflowDraftVariable.user_id == account.id,
+        )
+    ).all()
+    assert remaining == []
+
+
+def test_node_variable_collection_get_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    node_variable = _create_node_variable(db_session_with_containers, app.id, account.id, node_id="node_123")
+    _create_node_variable(db_session_with_containers, app.id, account.id, node_id="node_456", name="other")
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/nodes/node_123/variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert [item["id"] for item in payload["items"]] == [node_variable.id]
+
+
+def test_node_variable_collection_get_invalid_node_id(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/nodes/sys/variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 400
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "invalid_param"
+
+
+def test_node_variable_collection_delete(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    target = _create_node_variable(db_session_with_containers, app.id, account.id, node_id="node_123")
+    untouched = _create_node_variable(db_session_with_containers, app.id, account.id, node_id="node_456")
+    target_id = target.id
+    untouched_id = untouched.id
+
+    response = test_client_with_containers.delete(
+        f"/console/api/apps/{app.id}/workflows/draft/nodes/node_123/variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 204
+    assert (
+        db_session_with_containers.scalar(select(WorkflowDraftVariable).where(WorkflowDraftVariable.id == target_id))
+        is None
+    )
+    assert (
+        db_session_with_containers.scalar(select(WorkflowDraftVariable).where(WorkflowDraftVariable.id == untouched_id))
+        is not None
+    )
+
+
+def test_variable_api_get_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+    variable = _create_node_variable(db_session_with_containers, app.id, account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/variables/{variable.id}",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["id"] == variable.id
+    assert payload["name"] == "test_var"
+
+
+def test_variable_api_get_not_found(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/variables/{uuid.uuid4()}",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 404
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "not_found"
+
+
+def test_variable_api_patch_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+    variable = _create_node_variable(db_session_with_containers, app.id, account.id)
+
+    response = test_client_with_containers.patch(
+        f"/console/api/apps/{app.id}/workflows/draft/variables/{variable.id}",
+        headers=authenticate_console_client(test_client_with_containers, account),
+        json={"name": "renamed_var"},
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["id"] == variable.id
+    assert payload["name"] == "renamed_var"
+
+    refreshed = db_session_with_containers.scalar(
+        select(WorkflowDraftVariable).where(WorkflowDraftVariable.id == variable.id)
+    )
+    assert refreshed is not None
+    assert refreshed.name == "renamed_var"
+
+
+def test_variable_api_delete_success(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+    variable = _create_node_variable(db_session_with_containers, app.id, account.id)
+
+    response = test_client_with_containers.delete(
+        f"/console/api/apps/{app.id}/workflows/draft/variables/{variable.id}",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 204
+    assert (
+        db_session_with_containers.scalar(select(WorkflowDraftVariable).where(WorkflowDraftVariable.id == variable.id))
+        is None
+    )
+
+
+def test_variable_reset_api_put_success_returns_no_content_without_execution(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(db_session_with_containers, app.id, tenant.id, account.id)
+    variable = _create_node_variable(db_session_with_containers, app.id, account.id)
+
+    response = test_client_with_containers.put(
+        f"/console/api/apps/{app.id}/workflows/draft/variables/{variable.id}/reset",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 204
+    assert (
+        db_session_with_containers.scalar(select(WorkflowDraftVariable).where(WorkflowDraftVariable.id == variable.id))
+        is None
+    )
+
+
+def test_conversation_variable_collection_get(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(
+        db_session_with_containers,
+        app.id,
+        tenant.id,
+        account.id,
+        conversation_variables=[_build_conversation_variable("session_name", "Alice")],
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/conversation-variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert [item["name"] for item in payload["items"]] == ["session_name"]
+
+    created = db_session_with_containers.scalars(
+        select(WorkflowDraftVariable).where(
+            WorkflowDraftVariable.app_id == app.id,
+            WorkflowDraftVariable.user_id == account.id,
+            WorkflowDraftVariable.node_id == CONVERSATION_VARIABLE_NODE_ID,
+        )
+    ).all()
+    assert len(created) == 1
+
+
+def test_system_variable_collection_get(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    variable = _create_system_variable(db_session_with_containers, app.id, account.id)
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/system-variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert [item["id"] for item in payload["items"]] == [variable.id]
+
+
+def test_environment_variable_collection_get(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    app = create_console_app(db_session_with_containers, tenant.id, account.id, AppMode.WORKFLOW)
+    _create_draft_workflow(
+        db_session_with_containers,
+        app.id,
+        tenant.id,
+        account.id,
+        environment_variables=[_build_environment_variable("api_key", "secret-value")],
+    )
+
+    response = test_client_with_containers.get(
+        f"/console/api/apps/{app.id}/workflows/draft/environment-variables",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["items"][0]["name"] == "api_key"
+    assert payload["items"][0]["value"] == "secret-value"

api/tests/test_containers_integration_tests/controllers/console/auth/test_data_source_bearer_auth.py

@@ -0,0 +1,131 @@
+"""Controller integration tests for API key data source auth routes."""
+
+import json
+from unittest.mock import patch
+
+from flask.testing import FlaskClient
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from models.source import DataSourceApiKeyAuthBinding
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+)
+
+
+def test_get_api_key_auth_data_source(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    binding = DataSourceApiKeyAuthBinding(
+        tenant_id=tenant.id,
+        category="api_key",
+        provider="custom_provider",
+        credentials=json.dumps({"auth_type": "api_key", "config": {"api_key": "encrypted"}}),
+        disabled=False,
+    )
+    db_session_with_containers.add(binding)
+    db_session_with_containers.commit()
+
+    response = test_client_with_containers.get(
+        "/console/api/api-key-auth/data-source",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert len(payload["sources"]) == 1
+    assert payload["sources"][0]["provider"] == "custom_provider"
+
+
+def test_get_api_key_auth_data_source_empty(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+
+    response = test_client_with_containers.get(
+        "/console/api/api-key-auth/data-source",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"sources": []}
+
+
+def test_create_binding_successful(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+
+    with (
+        patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.validate_api_key_auth_args"),
+        patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.create_provider_auth"),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/api-key-auth/data-source/binding",
+            json={"category": "api_key", "provider": "custom", "credentials": {"key": "value"}},
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"result": "success"}
+
+
+def test_create_binding_failure(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+
+    with (
+        patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.validate_api_key_auth_args"),
+        patch(
+            "controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.create_provider_auth",
+            side_effect=ValueError("Invalid structure"),
+        ),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/api-key-auth/data-source/binding",
+            json={"category": "api_key", "provider": "custom", "credentials": {"key": "value"}},
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 500
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["code"] == "auth_failed"
+    assert payload["message"] == "Invalid structure"
+
+
+def test_delete_binding_successful(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    binding = DataSourceApiKeyAuthBinding(
+        tenant_id=tenant.id,
+        category="api_key",
+        provider="custom_provider",
+        credentials=json.dumps({"auth_type": "api_key", "config": {"api_key": "encrypted"}}),
+        disabled=False,
+    )
+    db_session_with_containers.add(binding)
+    db_session_with_containers.commit()
+
+    response = test_client_with_containers.delete(
+        f"/console/api/api-key-auth/data-source/{binding.id}",
+        headers=authenticate_console_client(test_client_with_containers, account),
+    )
+
+    assert response.status_code == 204
+    assert (
+        db_session_with_containers.scalar(
+            select(DataSourceApiKeyAuthBinding).where(DataSourceApiKeyAuthBinding.id == binding.id)
+        )
+        is None
+    )

api/tests/test_containers_integration_tests/controllers/console/auth/test_data_source_oauth.py

@@ -0,0 +1,120 @@
+"""Controller integration tests for console OAuth data source routes."""
+
+from unittest.mock import MagicMock, patch
+
+from flask.testing import FlaskClient
+from sqlalchemy.orm import Session
+
+from models.source import DataSourceOauthBinding
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+)
+
+
+def test_get_oauth_url_successful(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    provider = MagicMock()
+    provider.get_authorization_url.return_value = "http://oauth.provider/auth"
+
+    with (
+        patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": provider}),
+        patch("controllers.console.auth.data_source_oauth.dify_config.NOTION_INTEGRATION_TYPE", None),
+    ):
+        response = test_client_with_containers.get(
+            "/console/api/oauth/data-source/notion",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert tenant.id == account.current_tenant_id
+    assert response.status_code == 200
+    assert response.get_json() == {"data": "http://oauth.provider/auth"}
+    provider.get_authorization_url.assert_called_once()
+
+
+def test_get_oauth_url_invalid_provider(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": MagicMock()}):
+        response = test_client_with_containers.get(
+            "/console/api/oauth/data-source/unknown_provider",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 400
+    assert response.get_json() == {"error": "Invalid provider"}
+
+
+def test_oauth_callback_successful(test_client_with_containers: FlaskClient) -> None:
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": MagicMock()}):
+        response = test_client_with_containers.get("/console/api/oauth/data-source/callback/notion?code=mock_code")
+
+    assert response.status_code == 302
+    assert "code=mock_code" in response.location
+
+
+def test_oauth_callback_missing_code(test_client_with_containers: FlaskClient) -> None:
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": MagicMock()}):
+        response = test_client_with_containers.get("/console/api/oauth/data-source/callback/notion")
+
+    assert response.status_code == 302
+    assert "error=Access%20denied" in response.location
+
+
+def test_oauth_callback_invalid_provider(test_client_with_containers: FlaskClient) -> None:
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": MagicMock()}):
+        response = test_client_with_containers.get("/console/api/oauth/data-source/callback/invalid?code=mock_code")
+
+    assert response.status_code == 400
+    assert response.get_json() == {"error": "Invalid provider"}
+
+
+def test_get_binding_successful(test_client_with_containers: FlaskClient) -> None:
+    provider = MagicMock()
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": provider}):
+        response = test_client_with_containers.get("/console/api/oauth/data-source/binding/notion?code=auth_code_123")
+
+    assert response.status_code == 200
+    assert response.get_json() == {"result": "success"}
+    provider.get_access_token.assert_called_once_with("auth_code_123")
+
+
+def test_get_binding_missing_code(test_client_with_containers: FlaskClient) -> None:
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": MagicMock()}):
+        response = test_client_with_containers.get("/console/api/oauth/data-source/binding/notion?code=")
+
+    assert response.status_code == 400
+    assert response.get_json() == {"error": "Invalid code"}
+
+
+def test_sync_successful(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, tenant = create_console_account_and_tenant(db_session_with_containers)
+    binding = DataSourceOauthBinding(
+        tenant_id=tenant.id,
+        access_token="test-access-token",
+        provider="notion",
+        source_info={"workspace_name": "Workspace", "workspace_icon": None, "workspace_id": tenant.id, "pages": []},
+        disabled=False,
+    )
+    db_session_with_containers.add(binding)
+    db_session_with_containers.commit()
+
+    provider = MagicMock()
+    with patch("controllers.console.auth.data_source_oauth.get_oauth_providers", return_value={"notion": provider}):
+        response = test_client_with_containers.get(
+            f"/console/api/oauth/data-source/notion/{binding.id}/sync",
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"result": "success"}
+    provider.sync_data_source.assert_called_once_with(binding.id)

api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth_server.py

@@ -0,0 +1,365 @@
+"""Controller integration tests for console OAuth server routes."""
+
+from unittest.mock import patch
+
+from flask.testing import FlaskClient
+from sqlalchemy.orm import Session
+
+from models.model import OAuthProviderApp
+from services.oauth_server import OAUTH_ACCESS_TOKEN_EXPIRES_IN
+from tests.test_containers_integration_tests.controllers.console.helpers import (
+    authenticate_console_client,
+    create_console_account_and_tenant,
+    ensure_dify_setup,
+)
+
+
+def _build_oauth_provider_app() -> OAuthProviderApp:
+    return OAuthProviderApp(
+        app_icon="icon_url",
+        client_id="test_client_id",
+        client_secret="test_secret",
+        app_label={"en-US": "Test App"},
+        redirect_uris=["http://localhost/callback"],
+        scope="read,write",
+    )
+
+
+def test_oauth_provider_successful_post(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider",
+            json={"client_id": "test_client_id", "redirect_uri": "http://localhost/callback"},
+        )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload is not None
+    assert payload["app_icon"] == "icon_url"
+    assert payload["app_label"] == {"en-US": "Test App"}
+    assert payload["scope"] == "read,write"
+
+
+def test_oauth_provider_invalid_redirect_uri(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider",
+            json={"client_id": "test_client_id", "redirect_uri": "http://invalid/callback"},
+        )
+
+    assert response.status_code == 400
+    payload = response.get_json()
+    assert payload is not None
+    assert "redirect_uri is invalid" in payload["message"]
+
+
+def test_oauth_provider_invalid_client_id(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    response = test_client_with_containers.post(
+        "/console/api/oauth/provider",
+        json={"client_id": "test_invalid_client_id", "redirect_uri": "http://localhost/callback"},
+    )
+
+    assert response.status_code == 404
+    payload = response.get_json()
+    assert payload is not None
+    assert "client_id is invalid" in payload["message"]
+
+
+def test_oauth_authorize_successful(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+
+    with (
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+            return_value=_build_oauth_provider_app(),
+        ),
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_authorization_code",
+            return_value="auth_code_123",
+        ) as mock_sign,
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/authorize",
+            json={"client_id": "test_client_id"},
+            headers=authenticate_console_client(test_client_with_containers, account),
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {"code": "auth_code_123"}
+    mock_sign.assert_called_once_with("test_client_id", account.id)
+
+
+def test_oauth_token_authorization_code_grant(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with (
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+            return_value=_build_oauth_provider_app(),
+        ),
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_access_token",
+            return_value=("access_123", "refresh_123"),
+        ),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={
+                "client_id": "test_client_id",
+                "grant_type": "authorization_code",
+                "code": "auth_code",
+                "client_secret": "test_secret",
+                "redirect_uri": "http://localhost/callback",
+            },
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {
+        "access_token": "access_123",
+        "token_type": "Bearer",
+        "expires_in": OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+        "refresh_token": "refresh_123",
+    }
+
+
+def test_oauth_token_authorization_code_grant_missing_code(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={
+                "client_id": "test_client_id",
+                "grant_type": "authorization_code",
+                "client_secret": "test_secret",
+                "redirect_uri": "http://localhost/callback",
+            },
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "code is required"
+
+
+def test_oauth_token_authorization_code_grant_invalid_secret(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={
+                "client_id": "test_client_id",
+                "grant_type": "authorization_code",
+                "code": "auth_code",
+                "client_secret": "invalid_secret",
+                "redirect_uri": "http://localhost/callback",
+            },
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "client_secret is invalid"
+
+
+def test_oauth_token_authorization_code_grant_invalid_redirect_uri(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={
+                "client_id": "test_client_id",
+                "grant_type": "authorization_code",
+                "code": "auth_code",
+                "client_secret": "test_secret",
+                "redirect_uri": "http://invalid/callback",
+            },
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "redirect_uri is invalid"
+
+
+def test_oauth_token_refresh_token_grant(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with (
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+            return_value=_build_oauth_provider_app(),
+        ),
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_access_token",
+            return_value=("new_access", "new_refresh"),
+        ),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={"client_id": "test_client_id", "grant_type": "refresh_token", "refresh_token": "refresh_123"},
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {
+        "access_token": "new_access",
+        "token_type": "Bearer",
+        "expires_in": OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+        "refresh_token": "new_refresh",
+    }
+
+
+def test_oauth_token_refresh_token_grant_missing_token(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={"client_id": "test_client_id", "grant_type": "refresh_token"},
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "refresh_token is required"
+
+
+def test_oauth_token_invalid_grant_type(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/token",
+            json={"client_id": "test_client_id", "grant_type": "invalid_grant"},
+        )
+
+    assert response.status_code == 400
+    assert response.get_json()["message"] == "invalid grant_type"
+
+
+def test_oauth_account_successful_retrieval(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+    account, _tenant = create_console_account_and_tenant(db_session_with_containers)
+    account.avatar = "avatar_url"
+    db_session_with_containers.commit()
+
+    with (
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+            return_value=_build_oauth_provider_app(),
+        ),
+        patch(
+            "controllers.console.auth.oauth_server.OAuthServerService.validate_oauth_access_token",
+            return_value=account,
+        ),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/account",
+            json={"client_id": "test_client_id"},
+            headers={"Authorization": "Bearer valid_access_token"},
+        )
+
+    assert response.status_code == 200
+    assert response.get_json() == {
+        "name": "Test User",
+        "email": account.email,
+        "avatar": "avatar_url",
+        "interface_language": "en-US",
+        "timezone": "UTC",
+    }
+
+
+def test_oauth_account_missing_authorization_header(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/account",
+            json={"client_id": "test_client_id"},
+        )
+
+    assert response.status_code == 401
+    assert response.get_json() == {"error": "Authorization header is required"}
+
+
+def test_oauth_account_invalid_authorization_header_format(
+    db_session_with_containers: Session,
+    test_client_with_containers: FlaskClient,
+) -> None:
+    ensure_dify_setup(db_session_with_containers)
+
+    with patch(
+        "controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app",
+        return_value=_build_oauth_provider_app(),
+    ):
+        response = test_client_with_containers.post(
+            "/console/api/oauth/provider/account",
+            json={"client_id": "test_client_id"},
+            headers={"Authorization": "InvalidFormat"},
+        )
+
+    assert response.status_code == 401
+    assert response.get_json() == {"error": "Invalid Authorization header format"}

api/tests/test_containers_integration_tests/controllers/console/auth/test_password_reset.py

@@ -1,17 +1,10 @@
-"""
-Test suite for password reset authentication flows.
+"""Testcontainers integration tests for password reset authentication flows."""
 
-This module tests the password reset mechanism including:
-- Password reset email sending
-- Verification code validation
-- Password reset with token
-- Rate limiting and security checks
-"""
+from __future__ import annotations
 
 from unittest.mock import MagicMock, patch
 
 import pytest
-from flask import Flask
 
 from controllers.console.auth.error import (
     EmailCodeError,
@@ -28,31 +21,12 @@ from controllers.console.auth.forgot_password import (
 from controllers.console.error import AccountNotFound, EmailSendIpLimitError
 
 
-@pytest.fixture(autouse=True)
-def _mock_forgot_password_session():
-    with patch("controllers.console.auth.forgot_password.Session") as mock_session_cls:
-        mock_session = MagicMock()
-        mock_session_cls.return_value.__enter__.return_value = mock_session
-        mock_session_cls.return_value.__exit__.return_value = None
-        yield mock_session
-
-
-@pytest.fixture(autouse=True)
-def _mock_forgot_password_db():
-    with patch("controllers.console.auth.forgot_password.db") as mock_db:
-        mock_db.engine = MagicMock()
-        yield mock_db
-
-
 class TestForgotPasswordSendEmailApi:
     """Test cases for sending password reset emails."""
 
     @pytest.fixture
-    def app(self):
-        """Create Flask test application."""
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
+    def app(self, flask_app_with_containers):
+        return flask_app_with_containers
 
     @pytest.fixture
     def mock_account(self):
@@ -62,7 +36,6 @@ class TestForgotPasswordSendEmailApi:
         account.name = "Test User"
         return account
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_email_send_ip_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_account_by_email_with_case_fallback")
     @patch("controllers.console.auth.forgot_password.AccountService.send_reset_password_email")
@@ -73,20 +46,10 @@ class TestForgotPasswordSendEmailApi:
         mock_send_email,
         mock_get_account,
         mock_is_ip_limit,
-        mock_wraps_db,
         app,
         mock_account,
     ):
-        """
-        Test successful password reset email sending.
-
-        Verifies that:
-        - Email is sent to valid account
-        - Reset token is generated and returned
-        - IP rate limiting is checked
-        """
         # Arrange
-        mock_wraps_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_ip_limit.return_value = False
         mock_get_account.return_value = mock_account
         mock_send_email.return_value = "reset_token_123"
@@ -104,9 +67,8 @@ class TestForgotPasswordSendEmailApi:
         assert response["data"] == "reset_token_123"
         mock_send_email.assert_called_once()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_email_send_ip_limit")
-    def test_send_reset_email_ip_rate_limited(self, mock_is_ip_limit, mock_db, app):
+    def test_send_reset_email_ip_rate_limited(self, mock_is_ip_limit, app):
         """
         Test password reset email blocked by IP rate limit.
 
@@ -115,7 +77,6 @@ class TestForgotPasswordSendEmailApi:
         - No email is sent when rate limited
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_ip_limit.return_value = True
 
         # Act & Assert
@@ -133,7 +94,6 @@ class TestForgotPasswordSendEmailApi:
             (None, "en-US"),  # Defaults to en-US when not provided
         ],
     )
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_email_send_ip_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_account_by_email_with_case_fallback")
     @patch("controllers.console.auth.forgot_password.AccountService.send_reset_password_email")
@@ -144,7 +104,6 @@ class TestForgotPasswordSendEmailApi:
         mock_send_email,
         mock_get_account,
         mock_is_ip_limit,
-        mock_wraps_db,
         app,
         mock_account,
         language_input,
@@ -158,7 +117,6 @@ class TestForgotPasswordSendEmailApi:
         - Unsupported languages default to en-US
         """
         # Arrange
-        mock_wraps_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_ip_limit.return_value = False
         mock_get_account.return_value = mock_account
         mock_send_email.return_value = "token"
@@ -180,13 +138,9 @@ class TestForgotPasswordCheckApi:
     """Test cases for verifying password reset codes."""
 
     @pytest.fixture
-    def app(self):
-        """Create Flask test application."""
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
+    def app(self, flask_app_with_containers):
+        return flask_app_with_containers
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
     @patch("controllers.console.auth.forgot_password.AccountService.revoke_reset_password_token")
@@ -199,7 +153,6 @@ class TestForgotPasswordCheckApi:
         mock_revoke_token,
         mock_get_data,
         mock_is_rate_limit,
-        mock_db,
         app,
     ):
         """
@@ -212,7 +165,6 @@ class TestForgotPasswordCheckApi:
         - Rate limit is reset on success
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = False
         mock_get_data.return_value = {"email": "test@example.com", "code": "123456"}
         mock_generate_token.return_value = (None, "new_token")
@@ -236,7 +188,6 @@ class TestForgotPasswordCheckApi:
         )
         mock_reset_rate_limit.assert_called_once_with("test@example.com")
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
     @patch("controllers.console.auth.forgot_password.AccountService.revoke_reset_password_token")
@@ -249,10 +200,8 @@ class TestForgotPasswordCheckApi:
         mock_revoke_token,
         mock_get_data,
         mock_is_rate_limit,
-        mock_db,
         app,
     ):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = False
         mock_get_data.return_value = {"email": "User@Example.com", "code": "999888"}
         mock_generate_token.return_value = (None, "fresh-token")
@@ -271,9 +220,8 @@ class TestForgotPasswordCheckApi:
         mock_revoke_token.assert_called_once_with("upper_token")
         mock_reset_rate_limit.assert_called_once_with("user@example.com")
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
-    def test_verify_code_rate_limited(self, mock_is_rate_limit, mock_db, app):
+    def test_verify_code_rate_limited(self, mock_is_rate_limit, app):
         """
         Test code verification blocked by rate limit.
 
@@ -282,7 +230,6 @@ class TestForgotPasswordCheckApi:
         - Prevents brute force attacks on verification codes
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = True
 
         # Act & Assert
@@ -295,10 +242,9 @@ class TestForgotPasswordCheckApi:
             with pytest.raises(EmailPasswordResetLimitError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
-    def test_verify_code_invalid_token(self, mock_get_data, mock_is_rate_limit, mock_db, app):
+    def test_verify_code_invalid_token(self, mock_get_data, mock_is_rate_limit, app):
         """
         Test code verification with invalid token.
 
@@ -306,7 +252,6 @@ class TestForgotPasswordCheckApi:
         - InvalidTokenError is raised for invalid/expired tokens
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = False
         mock_get_data.return_value = None
 
@@ -320,10 +265,9 @@ class TestForgotPasswordCheckApi:
             with pytest.raises(InvalidTokenError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
-    def test_verify_code_email_mismatch(self, mock_get_data, mock_is_rate_limit, mock_db, app):
+    def test_verify_code_email_mismatch(self, mock_get_data, mock_is_rate_limit, app):
         """
         Test code verification with mismatched email.
 
@@ -332,7 +276,6 @@ class TestForgotPasswordCheckApi:
         - Prevents token abuse
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = False
         mock_get_data.return_value = {"email": "original@example.com", "code": "123456"}
 
@@ -346,11 +289,10 @@ class TestForgotPasswordCheckApi:
             with pytest.raises(InvalidEmailError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.is_forgot_password_error_rate_limit")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
     @patch("controllers.console.auth.forgot_password.AccountService.add_forgot_password_error_rate_limit")
-    def test_verify_code_wrong_code(self, mock_add_rate_limit, mock_get_data, mock_is_rate_limit, mock_db, app):
+    def test_verify_code_wrong_code(self, mock_add_rate_limit, mock_get_data, mock_is_rate_limit, app):
         """
         Test code verification with incorrect code.
 
@@ -359,7 +301,6 @@ class TestForgotPasswordCheckApi:
         - Rate limit counter is incremented
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_is_rate_limit.return_value = False
         mock_get_data.return_value = {"email": "test@example.com", "code": "123456"}
 
@@ -380,11 +321,8 @@ class TestForgotPasswordResetApi:
     """Test cases for resetting password with verified token."""
 
     @pytest.fixture
-    def app(self):
-        """Create Flask test application."""
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
+    def app(self, flask_app_with_containers):
+        return flask_app_with_containers
 
     @pytest.fixture
     def mock_account(self):
@@ -394,7 +332,6 @@ class TestForgotPasswordResetApi:
         account.name = "Test User"
         return account
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
     @patch("controllers.console.auth.forgot_password.AccountService.revoke_reset_password_token")
     @patch("controllers.console.auth.forgot_password.AccountService.get_account_by_email_with_case_fallback")
@@ -405,7 +342,6 @@ class TestForgotPasswordResetApi:
         mock_get_account,
         mock_revoke_token,
         mock_get_data,
-        mock_wraps_db,
         app,
         mock_account,
     ):
@@ -418,7 +354,6 @@ class TestForgotPasswordResetApi:
         - Success response is returned
         """
         # Arrange
-        mock_wraps_db.session.query.return_value.first.return_value = MagicMock()
         mock_get_data.return_value = {"email": "test@example.com", "phase": "reset"}
         mock_get_account.return_value = mock_account
         mock_get_tenants.return_value = [MagicMock()]
@@ -436,9 +371,8 @@ class TestForgotPasswordResetApi:
         assert response["result"] == "success"
         mock_revoke_token.assert_called_once_with("valid_token")
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
-    def test_reset_password_mismatch(self, mock_get_data, mock_db, app):
+    def test_reset_password_mismatch(self, mock_get_data, app):
         """
         Test password reset with mismatched passwords.
 
@@ -447,7 +381,6 @@ class TestForgotPasswordResetApi:
         - No password update occurs
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_get_data.return_value = {"email": "test@example.com", "phase": "reset"}
 
         # Act & Assert
@@ -460,9 +393,8 @@ class TestForgotPasswordResetApi:
             with pytest.raises(PasswordMismatchError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
-    def test_reset_password_invalid_token(self, mock_get_data, mock_db, app):
+    def test_reset_password_invalid_token(self, mock_get_data, app):
         """
         Test password reset with invalid token.
 
@@ -470,7 +402,6 @@ class TestForgotPasswordResetApi:
         - InvalidTokenError is raised for invalid/expired tokens
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_get_data.return_value = None
 
         # Act & Assert
@@ -483,9 +414,8 @@ class TestForgotPasswordResetApi:
             with pytest.raises(InvalidTokenError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
-    def test_reset_password_wrong_phase(self, mock_get_data, mock_db, app):
+    def test_reset_password_wrong_phase(self, mock_get_data, app):
         """
         Test password reset with token not in reset phase.
 
@@ -494,7 +424,6 @@ class TestForgotPasswordResetApi:
         - Prevents use of verification-phase tokens for reset
         """
         # Arrange
-        mock_db.session.query.return_value.first.return_value = MagicMock()
         mock_get_data.return_value = {"email": "test@example.com", "phase": "verify"}
 
         # Act & Assert
@@ -507,13 +436,10 @@ class TestForgotPasswordResetApi:
             with pytest.raises(InvalidTokenError):
                 api.post()
 
-    @patch("controllers.console.wraps.db")
     @patch("controllers.console.auth.forgot_password.AccountService.get_reset_password_data")
     @patch("controllers.console.auth.forgot_password.AccountService.revoke_reset_password_token")
     @patch("controllers.console.auth.forgot_password.AccountService.get_account_by_email_with_case_fallback")
-    def test_reset_password_account_not_found(
-        self, mock_get_account, mock_revoke_token, mock_get_data, mock_wraps_db, app
-    ):
+    def test_reset_password_account_not_found(self, mock_get_account, mock_revoke_token, mock_get_data, app):
         """
         Test password reset for non-existent account.
 
@@ -521,7 +447,6 @@ class TestForgotPasswordResetApi:
         - AccountNotFound is raised when account doesn't exist
         """
         # Arrange
-        mock_wraps_db.session.query.return_value.first.return_value = MagicMock()
         mock_get_data.return_value = {"email": "nonexistent@example.com", "phase": "reset"}
         mock_get_account.return_value = None
 

api/tests/test_containers_integration_tests/controllers/console/helpers.py

@@ -0,0 +1,85 @@
+"""Shared helpers for authenticated console controller integration tests."""
+
+import uuid
+
+from flask.testing import FlaskClient
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from configs import dify_config
+from constants import HEADER_NAME_CSRF_TOKEN
+from libs.datetime_utils import naive_utc_now
+from libs.token import _real_cookie_name, generate_csrf_token
+from models import Account, DifySetup, Tenant, TenantAccountJoin
+from models.account import AccountStatus, TenantAccountRole
+from models.model import App, AppMode
+from services.account_service import AccountService
+
+
+def ensure_dify_setup(db_session: Session) -> None:
+    """Create a setup marker once so setup-protected console routes can be exercised."""
+    if db_session.scalar(select(DifySetup).limit(1)) is not None:
+        return
+
+    db_session.add(DifySetup(version=dify_config.project.version))
+    db_session.commit()
+
+
+def create_console_account_and_tenant(db_session: Session) -> tuple[Account, Tenant]:
+    """Create an initialized owner account with a current tenant."""
+    account = Account(
+        email=f"test-{uuid.uuid4()}@example.com",
+        name="Test User",
+        interface_language="en-US",
+        status=AccountStatus.ACTIVE,
+    )
+    account.initialized_at = naive_utc_now()
+    db_session.add(account)
+    db_session.commit()
+
+    tenant = Tenant(name="Test Tenant", status="normal")
+    db_session.add(tenant)
+    db_session.commit()
+
+    db_session.add(
+        TenantAccountJoin(
+            tenant_id=tenant.id,
+            account_id=account.id,
+            role=TenantAccountRole.OWNER,
+            current=True,
+        )
+    )
+    db_session.commit()
+
+    account.set_tenant_id(tenant.id)
+    account.timezone = "UTC"
+    db_session.commit()
+
+    ensure_dify_setup(db_session)
+    return account, tenant
+
+
+def create_console_app(db_session: Session, tenant_id: str, account_id: str, mode: AppMode) -> App:
+    """Create a minimal app row that can be loaded by get_app_model."""
+    app = App(
+        tenant_id=tenant_id,
+        name="Test App",
+        mode=mode,
+        enable_site=True,
+        enable_api=True,
+        created_by=account_id,
+    )
+    db_session.add(app)
+    db_session.commit()
+    return app
+
+
+def authenticate_console_client(test_client: FlaskClient, account: Account) -> dict[str, str]:
+    """Attach console auth cookies/headers for endpoints guarded by login_required."""
+    access_token = AccountService.get_account_jwt_token(account)
+    csrf_token = generate_csrf_token(account.id)
+    test_client.set_cookie(_real_cookie_name("csrf_token"), csrf_token, domain="localhost")
+    return {
+        "Authorization": f"Bearer {access_token}",
+        HEADER_NAME_CSRF_TOKEN: csrf_token,
+    }

api/tests/test_containers_integration_tests/core/rag/retrieval/test_dataset_retrieval_integration.py

@@ -4,6 +4,7 @@ from unittest.mock import patch
 import pytest
 from faker import Faker
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
 from core.workflow.nodes.knowledge_retrieval.retrieval import KnowledgeRetrievalRequest
 from models.dataset import Dataset, Document
@@ -55,7 +56,7 @@ class TestGetAvailableDatasetsIntegration:
                 name=f"Document {i}",
                 created_from=DocumentCreatedFrom.WEB,
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 doc_language="en",
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
@@ -112,7 +113,7 @@ class TestGetAvailableDatasetsIntegration:
                 created_from=DocumentCreatedFrom.WEB,
                 name=f"Archived Document {i}",
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
                 archived=True,  # Archived
@@ -165,7 +166,7 @@ class TestGetAvailableDatasetsIntegration:
                 created_from=DocumentCreatedFrom.WEB,
                 name=f"Disabled Document {i}",
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=False,  # Disabled
                 archived=False,
@@ -218,7 +219,7 @@ class TestGetAvailableDatasetsIntegration:
                 created_from=DocumentCreatedFrom.WEB,
                 name=f"Document {status}",
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 indexing_status=status,  # Not completed
                 enabled=True,
                 archived=False,
@@ -336,7 +337,7 @@ class TestGetAvailableDatasetsIntegration:
                 created_from=DocumentCreatedFrom.WEB,
                 name=f"Document for {dataset.name}",
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
                 archived=False,
@@ -416,7 +417,7 @@ class TestGetAvailableDatasetsIntegration:
                 created_from=DocumentCreatedFrom.WEB,
                 name=f"Document {i}",
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
                 archived=False,
@@ -476,7 +477,7 @@ class TestKnowledgeRetrievalIntegration:
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
             archived=False,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         db_session_with_containers.add(document)
         db_session_with_containers.commit()

api/tests/test_containers_integration_tests/repositories/test_sqlalchemy_api_workflow_run_repository.py

@@ -27,7 +27,7 @@ from models.human_input import (
     HumanInputFormRecipient,
     RecipientType,
 )
-from models.workflow import WorkflowAppLog, WorkflowPause, WorkflowPauseReason, WorkflowRun
+from models.workflow import WorkflowAppLog, WorkflowAppLogCreatedFrom, WorkflowPause, WorkflowPauseReason, WorkflowRun
 from repositories.entities.workflow_pause import WorkflowPauseEntity
 from repositories.sqlalchemy_api_workflow_run_repository import (
     DifyAPISQLAlchemyWorkflowRunRepository,
@@ -218,7 +218,7 @@ class TestDeleteRunsWithRelated:
             app_id=test_scope.app_id,
             workflow_id=test_scope.workflow_id,
             workflow_run_id=workflow_run.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=test_scope.user_id,
         )
@@ -278,7 +278,7 @@ class TestCountRunsWithRelated:
             app_id=test_scope.app_id,
             workflow_id=test_scope.workflow_id,
             workflow_run_id=workflow_run.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=test_scope.user_id,
         )

api/tests/test_containers_integration_tests/services/document_service_status.py

@@ -13,6 +13,7 @@ from uuid import uuid4
 
 import pytest
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from models import Account
 from models.dataset import Dataset, Document
@@ -91,7 +92,7 @@ class DocumentStatusTestDataFactory:
             name=name,
             created_from=DocumentCreatedFrom.WEB,
             created_by=created_by,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         document.id = document_id
         document.indexing_status = indexing_status

api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py

@@ -525,3 +525,147 @@ class TestAPIBasedExtensionService:
         # Try to get extension with wrong tenant ID
         with pytest.raises(ValueError, match="API based extension is not found"):
             APIBasedExtensionService.get_with_tenant_id(tenant2.id, created_extension.id)
+
+    def test_save_extension_api_key_exactly_four_chars_rejected(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """API key with exactly 4 characters should be rejected (boundary)."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant is not None
+
+        extension_data = APIBasedExtension(
+            tenant_id=tenant.id,
+            name=fake.company(),
+            api_endpoint=f"https://{fake.domain_name()}/api",
+            api_key="1234",
+        )
+
+        with pytest.raises(ValueError, match="api_key must be at least 5 characters"):
+            APIBasedExtensionService.save(extension_data)
+
+    def test_save_extension_api_key_exactly_five_chars_accepted(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """API key with exactly 5 characters should be accepted (boundary)."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant is not None
+
+        extension_data = APIBasedExtension(
+            tenant_id=tenant.id,
+            name=fake.company(),
+            api_endpoint=f"https://{fake.domain_name()}/api",
+            api_key="12345",
+        )
+
+        saved = APIBasedExtensionService.save(extension_data)
+        assert saved.id is not None
+
+    def test_save_extension_requestor_constructor_error(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Exception raised by requestor constructor is wrapped in ValueError."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant is not None
+
+        mock_external_service_dependencies["requestor"].side_effect = RuntimeError("bad config")
+
+        extension_data = APIBasedExtension(
+            tenant_id=tenant.id,
+            name=fake.company(),
+            api_endpoint=f"https://{fake.domain_name()}/api",
+            api_key=fake.password(length=20),
+        )
+
+        with pytest.raises(ValueError, match="connection error: bad config"):
+            APIBasedExtensionService.save(extension_data)
+
+    def test_save_extension_network_exception(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Network exceptions during ping are wrapped in ValueError."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant is not None
+
+        mock_external_service_dependencies["requestor_instance"].request.side_effect = ConnectionError(
+            "network failure"
+        )
+
+        extension_data = APIBasedExtension(
+            tenant_id=tenant.id,
+            name=fake.company(),
+            api_endpoint=f"https://{fake.domain_name()}/api",
+            api_key=fake.password(length=20),
+        )
+
+        with pytest.raises(ValueError, match="connection error: network failure"):
+            APIBasedExtensionService.save(extension_data)
+
+    def test_save_extension_update_duplicate_name_rejected(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Updating an existing extension to use another extension's name should fail."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant is not None
+
+        ext1 = APIBasedExtensionService.save(
+            APIBasedExtension(
+                tenant_id=tenant.id,
+                name="Extension Alpha",
+                api_endpoint=f"https://{fake.domain_name()}/api",
+                api_key=fake.password(length=20),
+            )
+        )
+        ext2 = APIBasedExtensionService.save(
+            APIBasedExtension(
+                tenant_id=tenant.id,
+                name="Extension Beta",
+                api_endpoint=f"https://{fake.domain_name()}/api",
+                api_key=fake.password(length=20),
+            )
+        )
+
+        # Try to rename ext2 to ext1's name
+        ext2.name = "Extension Alpha"
+        with pytest.raises(ValueError, match="name must be unique, it is already existed"):
+            APIBasedExtensionService.save(ext2)
+
+    def test_get_all_returns_empty_for_different_tenant(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Extensions from one tenant should not be visible to another."""
+        fake = Faker()
+        _, tenant1 = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        _, tenant2 = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        assert tenant1 is not None
+
+        APIBasedExtensionService.save(
+            APIBasedExtension(
+                tenant_id=tenant1.id,
+                name=fake.company(),
+                api_endpoint=f"https://{fake.domain_name()}/api",
+                api_key=fake.password(length=20),
+            )
+        )
+
+        assert tenant2 is not None
+        result = APIBasedExtensionService.get_all_by_tenant_id(tenant2.id)
+        assert result == []

api/tests/test_containers_integration_tests/services/test_app_service.py

@@ -6,7 +6,7 @@ from sqlalchemy.orm import Session
 
 from constants.model_template import default_app_templates
 from models import Account
-from models.model import App, Site
+from models.model import App, IconType, Site
 from services.account_service import AccountService, TenantService
 from tests.test_containers_integration_tests.helpers import generate_valid_password
 
@@ -463,6 +463,109 @@ class TestAppService:
         assert updated_app.tenant_id == app.tenant_id
         assert updated_app.created_by == app.created_by
 
+    def test_update_app_should_preserve_icon_type_when_omitted(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """
+        Test update_app keeps the persisted icon_type when the update payload omits it.
+        """
+        fake = Faker()
+
+        account = AccountService.create_account(
+            email=fake.email(),
+            name=fake.name(),
+            interface_language="en-US",
+            password=generate_valid_password(fake),
+        )
+        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
+        tenant = account.current_tenant
+
+        from services.app_service import AppService
+
+        app_service = AppService()
+        app = app_service.create_app(
+            tenant.id,
+            {
+                "name": fake.company(),
+                "description": fake.text(max_nb_chars=100),
+                "mode": "chat",
+                "icon_type": "emoji",
+                "icon": "🎯",
+                "icon_background": "#45B7D1",
+            },
+            account,
+        )
+
+        mock_current_user = create_autospec(Account, instance=True)
+        mock_current_user.id = account.id
+        mock_current_user.current_tenant_id = account.current_tenant_id
+
+        with patch("services.app_service.current_user", mock_current_user):
+            updated_app = app_service.update_app(
+                app,
+                {
+                    "name": "Updated App Name",
+                    "description": "Updated app description",
+                    "icon_type": None,
+                    "icon": "🔄",
+                    "icon_background": "#FF8C42",
+                    "use_icon_as_answer_icon": True,
+                },
+            )
+
+        assert updated_app.icon_type == IconType.EMOJI
+
+    def test_update_app_should_reject_empty_icon_type(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """
+        Test update_app rejects an explicit empty icon_type.
+        """
+        fake = Faker()
+
+        account = AccountService.create_account(
+            email=fake.email(),
+            name=fake.name(),
+            interface_language="en-US",
+            password=generate_valid_password(fake),
+        )
+        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
+        tenant = account.current_tenant
+
+        from services.app_service import AppService
+
+        app_service = AppService()
+        app = app_service.create_app(
+            tenant.id,
+            {
+                "name": fake.company(),
+                "description": fake.text(max_nb_chars=100),
+                "mode": "chat",
+                "icon_type": "emoji",
+                "icon": "🎯",
+                "icon_background": "#45B7D1",
+            },
+            account,
+        )
+
+        mock_current_user = create_autospec(Account, instance=True)
+        mock_current_user.id = account.id
+        mock_current_user.current_tenant_id = account.current_tenant_id
+
+        with patch("services.app_service.current_user", mock_current_user):
+            with pytest.raises(ValueError):
+                app_service.update_app(
+                    app,
+                    {
+                        "name": "Updated App Name",
+                        "description": "Updated app description",
+                        "icon_type": "",
+                        "icon": "🔄",
+                        "icon_background": "#FF8C42",
+                        "use_icon_as_answer_icon": True,
+                    },
+                )
+
     def test_update_app_name_success(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
         Test successful app name update.

api/tests/test_containers_integration_tests/services/test_credit_pool_service.py

@@ -6,6 +6,7 @@ import pytest
 
 from core.errors.error import QuotaExceededError
 from models import TenantCreditPool
+from models.enums import ProviderQuotaType
 from services.credit_pool_service import CreditPoolService
 
 
@@ -20,7 +21,7 @@ class TestCreditPoolService:
 
         assert isinstance(pool, TenantCreditPool)
         assert pool.tenant_id == tenant_id
-        assert pool.pool_type == "trial"
+        assert pool.pool_type == ProviderQuotaType.TRIAL
         assert pool.quota_used == 0
         assert pool.quota_limit > 0
 
@@ -28,14 +29,14 @@ class TestCreditPoolService:
         tenant_id = self._create_tenant_id()
         CreditPoolService.create_default_pool(tenant_id)
 
-        result = CreditPoolService.get_pool(tenant_id=tenant_id, pool_type="trial")
+        result = CreditPoolService.get_pool(tenant_id=tenant_id, pool_type=ProviderQuotaType.TRIAL)
 
         assert result is not None
         assert result.tenant_id == tenant_id
-        assert result.pool_type == "trial"
+        assert result.pool_type == ProviderQuotaType.TRIAL
 
     def test_get_pool_returns_none_when_not_exists(self, db_session_with_containers):
-        result = CreditPoolService.get_pool(tenant_id=self._create_tenant_id(), pool_type="trial")
+        result = CreditPoolService.get_pool(tenant_id=self._create_tenant_id(), pool_type=ProviderQuotaType.TRIAL)
 
         assert result is None
 

api/tests/test_containers_integration_tests/services/test_dataset_service.py

@@ -11,6 +11,7 @@ from uuid import uuid4
 import pytest
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.retrieval.retrieval_methods import RetrievalMethod
 from dify_graph.model_runtime.entities.model_entities import ModelType
 from models.account import Account, Tenant, TenantAccountJoin, TenantAccountRole
@@ -106,7 +107,7 @@ class DatasetServiceIntegrationDataFactory:
             created_from=DocumentCreatedFrom.WEB,
             created_by=created_by,
             indexing_status=IndexingStatus.COMPLETED,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         db_session_with_containers.add(document)
         db_session_with_containers.flush()

api/tests/test_containers_integration_tests/services/test_dataset_service_batch_update_document_status.py

@@ -13,6 +13,7 @@ from uuid import uuid4
 import pytest
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.dataset import Dataset, Document
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus
 from services.dataset_service import DocumentService
@@ -79,7 +80,7 @@ class DocumentBatchUpdateIntegrationDataFactory:
             name=name,
             created_from=DocumentCreatedFrom.WEB,
             created_by=created_by or str(uuid4()),
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         document.id = document_id or str(uuid4())
         document.enabled = enabled
@@ -694,3 +695,19 @@ class TestDatasetServiceBatchUpdateDocumentStatus:
 
         patched_dependencies["redis_client"].setex.assert_called_once_with(f"document_{doc1.id}_indexing", 600, 1)
         patched_dependencies["add_task"].delay.assert_called_once_with(doc1.id)
+
+    def test_batch_update_invalid_action_raises_value_error(
+        self, db_session_with_containers: Session, patched_dependencies
+    ):
+        """Test that an invalid action raises ValueError."""
+        factory = DocumentBatchUpdateIntegrationDataFactory
+        dataset = factory.create_dataset(db_session_with_containers)
+        doc = factory.create_document(db_session_with_containers, dataset)
+        user = UserDouble(id=str(uuid4()))
+
+        patched_dependencies["redis_client"].get.return_value = None
+
+        with pytest.raises(ValueError, match="Invalid action"):
+            DocumentService.batch_update_document_status(
+                dataset=dataset, document_ids=[doc.id], action="invalid_action", user=user
+            )

api/tests/test_containers_integration_tests/services/test_dataset_service_create_dataset.py

@@ -0,0 +1,60 @@
+"""Testcontainers integration tests for DatasetService.create_empty_rag_pipeline_dataset."""
+
+from __future__ import annotations
+
+from unittest.mock import Mock, patch
+from uuid import uuid4
+
+import pytest
+
+from models.account import Account, Tenant, TenantAccountJoin
+from services.dataset_service import DatasetService
+from services.entities.knowledge_entities.rag_pipeline_entities import IconInfo, RagPipelineDatasetCreateEntity
+
+
+class TestDatasetServiceCreateRagPipelineDataset:
+    def _create_tenant_and_account(self, db_session_with_containers) -> tuple[Tenant, Account]:
+        tenant = Tenant(name=f"Tenant {uuid4()}")
+        db_session_with_containers.add(tenant)
+        db_session_with_containers.flush()
+
+        account = Account(
+            name=f"Account {uuid4()}",
+            email=f"ds_create_{uuid4()}@example.com",
+            password="hashed",
+            password_salt="salt",
+            interface_language="en-US",
+            timezone="UTC",
+        )
+        db_session_with_containers.add(account)
+        db_session_with_containers.flush()
+
+        join = TenantAccountJoin(
+            tenant_id=tenant.id,
+            account_id=account.id,
+            role="owner",
+            current=True,
+        )
+        db_session_with_containers.add(join)
+        db_session_with_containers.commit()
+        return tenant, account
+
+    def _build_entity(self, name: str = "Test Dataset") -> RagPipelineDatasetCreateEntity:
+        icon_info = IconInfo(icon="\U0001f4d9", icon_background="#FFF4ED", icon_type="emoji")
+        return RagPipelineDatasetCreateEntity(
+            name=name,
+            description="",
+            icon_info=icon_info,
+            permission="only_me",
+        )
+
+    def test_create_rag_pipeline_dataset_raises_when_current_user_id_is_none(self, db_session_with_containers):
+        tenant, _ = self._create_tenant_and_account(db_session_with_containers)
+
+        mock_user = Mock(id=None)
+        with patch("services.dataset_service.current_user", mock_user):
+            with pytest.raises(ValueError, match="Current user or current user id not found"):
+                DatasetService.create_empty_rag_pipeline_dataset(
+                    tenant_id=tenant.id,
+                    rag_pipeline_dataset_create_entity=self._build_entity(),
+                )

api/tests/test_containers_integration_tests/services/test_dataset_service_delete_dataset.py

@@ -3,6 +3,7 @@
 from unittest.mock import patch
 from uuid import uuid4
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.account import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document
 from models.enums import DataSourceType, DocumentCreatedFrom
@@ -78,7 +79,7 @@ class DatasetDeleteIntegrationDataFactory:
         tenant_id: str,
         dataset_id: str,
         created_by: str,
-        doc_form: str = "text_model",
+        doc_form: str = IndexStructureType.PARAGRAPH_INDEX,
     ) -> Document:
         """Persist a document so dataset.doc_form resolves through the real document path."""
         document = Document(
@@ -119,7 +120,7 @@ class TestDatasetServiceDeleteDataset:
             tenant_id=tenant.id,
             dataset_id=dataset.id,
             created_by=owner.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
 
         # Act

api/tests/test_containers_integration_tests/services/test_document_service_display_status.py

@@ -3,6 +3,7 @@ from uuid import uuid4
 
 from sqlalchemy import select
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.dataset import Dataset, Document
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus
 from services.dataset_service import DocumentService
@@ -42,7 +43,7 @@ def _create_document(
         name=f"doc-{uuid4()}",
         created_from=DocumentCreatedFrom.WEB,
         created_by=str(uuid4()),
-        doc_form="text_model",
+        doc_form=IndexStructureType.PARAGRAPH_INDEX,
     )
     document.id = str(uuid4())
     document.indexing_status = indexing_status
@@ -142,3 +143,11 @@ def test_apply_display_status_filter_returns_same_when_invalid(db_session_with_c
 
     rows = db_session_with_containers.scalars(filtered).all()
     assert {row.id for row in rows} == {doc1.id, doc2.id}
+
+
+def test_normalize_display_status_alias_mapping():
+    """Test that normalize_display_status maps aliases correctly."""
+    assert DocumentService.normalize_display_status("ACTIVE") == "available"
+    assert DocumentService.normalize_display_status("enabled") == "available"
+    assert DocumentService.normalize_display_status("archived") == "archived"
+    assert DocumentService.normalize_display_status("unknown") is None

api/tests/test_containers_integration_tests/services/test_document_service_rename_document.py

@@ -7,6 +7,7 @@ from uuid import uuid4
 
 import pytest
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from models import Account
 from models.dataset import Dataset, Document
@@ -69,7 +70,7 @@ def make_document(
         name=name,
         created_from=DocumentCreatedFrom.WEB,
         created_by=str(uuid4()),
-        doc_form="text_model",
+        doc_form=IndexStructureType.PARAGRAPH_INDEX,
     )
     doc.id = document_id
     doc.indexing_status = "completed"

api/tests/test_containers_integration_tests/services/test_end_user_service.py

@@ -414,3 +414,144 @@ class TestEndUserServiceGetEndUserById:
         )
 
         assert result is None
+
+
+class TestEndUserServiceCreateBatch:
+    """Integration tests for EndUserService.create_end_user_batch."""
+
+    @pytest.fixture
+    def factory(self):
+        return TestEndUserServiceFactory()
+
+    def _create_multiple_apps(self, db_session_with_containers, factory, count: int = 3):
+        """Create multiple apps under the same tenant."""
+        first_app = factory.create_app_and_account(db_session_with_containers)
+        tenant_id = first_app.tenant_id
+        apps = [first_app]
+        for _ in range(count - 1):
+            app = App(
+                tenant_id=tenant_id,
+                name=f"App {uuid4()}",
+                description="",
+                mode="chat",
+                icon_type="emoji",
+                icon="bot",
+                icon_background="#FFFFFF",
+                enable_site=False,
+                enable_api=True,
+                api_rpm=100,
+                api_rph=100,
+                is_demo=False,
+                is_public=False,
+                is_universal=False,
+                created_by=first_app.created_by,
+                updated_by=first_app.updated_by,
+            )
+            db_session_with_containers.add(app)
+        db_session_with_containers.commit()
+        all_apps = db_session_with_containers.query(App).filter(App.tenant_id == tenant_id).all()
+        return tenant_id, all_apps
+
+    def test_create_batch_empty_app_ids(self, db_session_with_containers):
+        result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=str(uuid4()), app_ids=[], user_id="user-1"
+        )
+        assert result == {}
+
+    def test_create_batch_creates_users_for_all_apps(self, db_session_with_containers, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=3)
+        app_ids = [a.id for a in apps]
+        user_id = f"user-{uuid4()}"
+
+        result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+        )
+
+        assert len(result) == 3
+        for app_id in app_ids:
+            assert app_id in result
+            assert result[app_id].session_id == user_id
+            assert result[app_id].type == InvokeFrom.SERVICE_API
+
+    def test_create_batch_default_session_id(self, db_session_with_containers, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=2)
+        app_ids = [a.id for a in apps]
+
+        result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=""
+        )
+
+        assert len(result) == 2
+        for end_user in result.values():
+            assert end_user.session_id == DefaultEndUserSessionID.DEFAULT_SESSION_ID
+            assert end_user._is_anonymous is True
+
+    def test_create_batch_deduplicate_app_ids(self, db_session_with_containers, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=2)
+        app_ids = [apps[0].id, apps[1].id, apps[0].id, apps[1].id]
+        user_id = f"user-{uuid4()}"
+
+        result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+        )
+
+        assert len(result) == 2
+
+    def test_create_batch_returns_existing_users(self, db_session_with_containers, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=2)
+        app_ids = [a.id for a in apps]
+        user_id = f"user-{uuid4()}"
+
+        # Create batch first time
+        first_result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+        )
+
+        # Create batch second time — should return existing users
+        second_result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+        )
+
+        assert len(second_result) == 2
+        for app_id in app_ids:
+            assert first_result[app_id].id == second_result[app_id].id
+
+    def test_create_batch_partial_existing_users(self, db_session_with_containers, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=3)
+        user_id = f"user-{uuid4()}"
+
+        # Create for first 2 apps
+        first_result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API,
+            tenant_id=tenant_id,
+            app_ids=[apps[0].id, apps[1].id],
+            user_id=user_id,
+        )
+
+        # Create for all 3 apps — should reuse first 2, create 3rd
+        all_result = EndUserService.create_end_user_batch(
+            type=InvokeFrom.SERVICE_API,
+            tenant_id=tenant_id,
+            app_ids=[a.id for a in apps],
+            user_id=user_id,
+        )
+
+        assert len(all_result) == 3
+        assert all_result[apps[0].id].id == first_result[apps[0].id].id
+        assert all_result[apps[1].id].id == first_result[apps[1].id].id
+        assert all_result[apps[2].id].session_id == user_id
+
+    @pytest.mark.parametrize(
+        "invoke_type",
+        [InvokeFrom.SERVICE_API, InvokeFrom.WEB_APP, InvokeFrom.EXPLORE, InvokeFrom.DEBUGGER],
+    )
+    def test_create_batch_all_invoke_types(self, db_session_with_containers, invoke_type, factory):
+        tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=1)
+        user_id = f"user-{uuid4()}"
+
+        result = EndUserService.create_end_user_batch(
+            type=invoke_type, tenant_id=tenant_id, app_ids=[apps[0].id], user_id=user_id
+        )
+
+        assert len(result) == 1
+        assert result[apps[0].id].type == invoke_type

api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py

@@ -0,0 +1,96 @@
+"""
+Testcontainers integration tests for FileService helpers.
+
+Covers:
+- ZIP tempfile building (sanitization + deduplication + content writes)
+- tenant-scoped batch lookup behavior (get_upload_files_by_ids)
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from types import SimpleNamespace
+from typing import Any
+from uuid import uuid4
+from zipfile import ZipFile
+
+import pytest
+
+import services.file_service as file_service_module
+from extensions.storage.storage_type import StorageType
+from models.enums import CreatorUserRole
+from models.model import UploadFile
+from services.file_service import FileService
+
+
+def _create_upload_file(db_session, *, tenant_id: str, key: str, name: str) -> UploadFile:
+    upload_file = UploadFile(
+        tenant_id=tenant_id,
+        storage_type=StorageType.OPENDAL,
+        key=key,
+        name=name,
+        size=100,
+        extension="txt",
+        mime_type="text/plain",
+        created_by_role=CreatorUserRole.ACCOUNT,
+        created_by=str(uuid4()),
+        created_at=datetime.now(UTC),
+        used=False,
+    )
+    db_session.add(upload_file)
+    db_session.commit()
+    return upload_file
+
+
+def test_build_upload_files_zip_tempfile_sanitizes_and_dedupes_names(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Ensure ZIP entry names are safe and unique while preserving extensions."""
+    upload_files: list[Any] = [
+        SimpleNamespace(name="a/b.txt", key="k1"),
+        SimpleNamespace(name="c/b.txt", key="k2"),
+        SimpleNamespace(name="../b.txt", key="k3"),
+    ]
+
+    data_by_key: dict[str, list[bytes]] = {"k1": [b"one"], "k2": [b"two"], "k3": [b"three"]}
+
+    def _load(key: str, stream: bool = True) -> list[bytes]:
+        assert stream is True
+        return data_by_key[key]
+
+    monkeypatch.setattr(file_service_module.storage, "load", _load)
+
+    with FileService.build_upload_files_zip_tempfile(upload_files=upload_files) as tmp:
+        with ZipFile(tmp, mode="r") as zf:
+            assert zf.namelist() == ["b.txt", "b (1).txt", "b (2).txt"]
+            assert zf.read("b.txt") == b"one"
+            assert zf.read("b (1).txt") == b"two"
+            assert zf.read("b (2).txt") == b"three"
+
+
+def test_get_upload_files_by_ids_returns_empty_when_no_ids(db_session_with_containers) -> None:
+    """Ensure empty input returns an empty mapping without hitting the database."""
+    assert FileService.get_upload_files_by_ids(str(uuid4()), []) == {}
+
+
+def test_get_upload_files_by_ids_returns_id_keyed_mapping(db_session_with_containers) -> None:
+    """Ensure batch lookup returns a dict keyed by stringified UploadFile ids."""
+    tenant_id = str(uuid4())
+    file1 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k1", name="file1.txt")
+    file2 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k2", name="file2.txt")
+
+    result = FileService.get_upload_files_by_ids(tenant_id, [file1.id, file1.id, file2.id])
+
+    assert set(result.keys()) == {file1.id, file2.id}
+    assert result[file1.id].id == file1.id
+    assert result[file2.id].id == file2.id
+
+
+def test_get_upload_files_by_ids_filters_by_tenant(db_session_with_containers) -> None:
+    """Ensure files from other tenants are not returned."""
+    tenant_a = str(uuid4())
+    tenant_b = str(uuid4())
+    file_a = _create_upload_file(db_session_with_containers, tenant_id=tenant_a, key="ka", name="a.txt")
+    _create_upload_file(db_session_with_containers, tenant_id=tenant_b, key="kb", name="b.txt")
+
+    result = FileService.get_upload_files_by_ids(tenant_a, [file_a.id])
+
+    assert set(result.keys()) == {file_a.id}

api/tests/test_containers_integration_tests/services/test_messages_clean_service.py

@@ -8,6 +8,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from dify_graph.file.enums import FileType
 from enums.cloud_plan import CloudPlan
 from extensions.ext_redis import redis_client
 from models.account import Account, Tenant, TenantAccountJoin, TenantAccountRole
@@ -253,7 +254,7 @@ class TestMessagesCleanServiceIntegration:
         # MessageFile
         file = MessageFile(
             message_id=message.id,
-            type="image",
+            type=FileType.IMAGE,
             transfer_method="local_file",
             url="http://example.com/test.jpg",
             belongs_to=MessageFileBelongsTo.USER,

api/tests/test_containers_integration_tests/services/test_metadata_service.py

@@ -5,6 +5,7 @@ from faker import Faker
 from sqlalchemy.orm import Session
 
 from core.rag.index_processor.constant.built_in_field import BuiltInField
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, DatasetMetadata, DatasetMetadataBinding, Document
 from models.enums import DatasetMetadataType, DataSourceType, DocumentCreatedFrom
@@ -139,7 +140,7 @@ class TestMetadataService:
             name=fake.file_name(),
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
         )
 

api/tests/test_containers_integration_tests/services/test_oauth_server_service.py

@@ -0,0 +1,174 @@
+"""Testcontainers integration tests for OAuthServerService."""
+
+from __future__ import annotations
+
+import uuid
+from typing import cast
+from unittest.mock import MagicMock, patch
+from uuid import uuid4
+
+import pytest
+from werkzeug.exceptions import BadRequest
+
+from models.model import OAuthProviderApp
+from services.oauth_server import (
+    OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+    OAUTH_ACCESS_TOKEN_REDIS_KEY,
+    OAUTH_AUTHORIZATION_CODE_REDIS_KEY,
+    OAUTH_REFRESH_TOKEN_EXPIRES_IN,
+    OAUTH_REFRESH_TOKEN_REDIS_KEY,
+    OAuthGrantType,
+    OAuthServerService,
+)
+
+
+class TestOAuthServerServiceGetProviderApp:
+    """DB-backed tests for get_oauth_provider_app."""
+
+    def _create_oauth_provider_app(self, db_session_with_containers, *, client_id: str) -> OAuthProviderApp:
+        app = OAuthProviderApp(
+            app_icon="icon.png",
+            client_id=client_id,
+            client_secret=str(uuid4()),
+            app_label={"en-US": "Test OAuth App"},
+            redirect_uris=["https://example.com/callback"],
+            scope="read",
+        )
+        db_session_with_containers.add(app)
+        db_session_with_containers.commit()
+        return app
+
+    def test_get_oauth_provider_app_returns_app_when_exists(self, db_session_with_containers):
+        client_id = f"client-{uuid4()}"
+        created = self._create_oauth_provider_app(db_session_with_containers, client_id=client_id)
+
+        result = OAuthServerService.get_oauth_provider_app(client_id)
+
+        assert result is not None
+        assert result.client_id == client_id
+        assert result.id == created.id
+
+    def test_get_oauth_provider_app_returns_none_when_not_exists(self, db_session_with_containers):
+        result = OAuthServerService.get_oauth_provider_app(f"nonexistent-{uuid4()}")
+
+        assert result is None
+
+
+class TestOAuthServerServiceTokenOperations:
+    """Redis-backed tests for token sign/validate operations."""
+
+    @pytest.fixture
+    def mock_redis(self):
+        with patch("services.oauth_server.redis_client") as mock:
+            yield mock
+
+    def test_sign_authorization_code_stores_and_returns_code(self, mock_redis):
+        deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000111")
+        with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
+            code = OAuthServerService.sign_oauth_authorization_code("client-1", "user-1")
+
+        assert code == str(deterministic_uuid)
+        mock_redis.set.assert_called_once_with(
+            OAUTH_AUTHORIZATION_CODE_REDIS_KEY.format(client_id="client-1", code=code),
+            "user-1",
+            ex=600,
+        )
+
+    def test_sign_access_token_raises_bad_request_for_invalid_code(self, mock_redis):
+        mock_redis.get.return_value = None
+
+        with pytest.raises(BadRequest, match="invalid code"):
+            OAuthServerService.sign_oauth_access_token(
+                grant_type=OAuthGrantType.AUTHORIZATION_CODE,
+                code="bad-code",
+                client_id="client-1",
+            )
+
+    def test_sign_access_token_issues_tokens_for_valid_code(self, mock_redis):
+        token_uuids = [
+            uuid.UUID("00000000-0000-0000-0000-000000000201"),
+            uuid.UUID("00000000-0000-0000-0000-000000000202"),
+        ]
+        with patch("services.oauth_server.uuid.uuid4", side_effect=token_uuids):
+            mock_redis.get.return_value = b"user-1"
+
+            access_token, refresh_token = OAuthServerService.sign_oauth_access_token(
+                grant_type=OAuthGrantType.AUTHORIZATION_CODE,
+                code="code-1",
+                client_id="client-1",
+            )
+
+        assert access_token == str(token_uuids[0])
+        assert refresh_token == str(token_uuids[1])
+        code_key = OAUTH_AUTHORIZATION_CODE_REDIS_KEY.format(client_id="client-1", code="code-1")
+        mock_redis.delete.assert_called_once_with(code_key)
+        mock_redis.set.assert_any_call(
+            OAUTH_ACCESS_TOKEN_REDIS_KEY.format(client_id="client-1", token=access_token),
+            b"user-1",
+            ex=OAUTH_ACCESS_TOKEN_EXPIRES_IN,
+        )
+        mock_redis.set.assert_any_call(
+            OAUTH_REFRESH_TOKEN_REDIS_KEY.format(client_id="client-1", token=refresh_token),
+            b"user-1",
+            ex=OAUTH_REFRESH_TOKEN_EXPIRES_IN,
+        )
+
+    def test_sign_access_token_raises_bad_request_for_invalid_refresh_token(self, mock_redis):
+        mock_redis.get.return_value = None
+
+        with pytest.raises(BadRequest, match="invalid refresh token"):
+            OAuthServerService.sign_oauth_access_token(
+                grant_type=OAuthGrantType.REFRESH_TOKEN,
+                refresh_token="stale-token",
+                client_id="client-1",
+            )
+
+    def test_sign_access_token_issues_new_token_for_valid_refresh(self, mock_redis):
+        deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000301")
+        with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
+            mock_redis.get.return_value = b"user-1"
+
+            access_token, returned_refresh = OAuthServerService.sign_oauth_access_token(
+                grant_type=OAuthGrantType.REFRESH_TOKEN,
+                refresh_token="refresh-1",
+                client_id="client-1",
+            )
+
+        assert access_token == str(deterministic_uuid)
+        assert returned_refresh == "refresh-1"
+
+    def test_sign_access_token_returns_none_for_unknown_grant_type(self, mock_redis):
+        grant_type = cast(OAuthGrantType, "invalid-grant-type")
+
+        result = OAuthServerService.sign_oauth_access_token(grant_type=grant_type, client_id="client-1")
+
+        assert result is None
+
+    def test_sign_refresh_token_stores_with_expected_expiry(self, mock_redis):
+        deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000401")
+        with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
+            refresh_token = OAuthServerService._sign_oauth_refresh_token("client-2", "user-2")
+
+        assert refresh_token == str(deterministic_uuid)
+        mock_redis.set.assert_called_once_with(
+            OAUTH_REFRESH_TOKEN_REDIS_KEY.format(client_id="client-2", token=refresh_token),
+            "user-2",
+            ex=OAUTH_REFRESH_TOKEN_EXPIRES_IN,
+        )
+
+    def test_validate_access_token_returns_none_when_not_found(self, mock_redis):
+        mock_redis.get.return_value = None
+
+        result = OAuthServerService.validate_oauth_access_token("client-1", "missing-token")
+
+        assert result is None
+
+    def test_validate_access_token_loads_user_when_exists(self, mock_redis):
+        mock_redis.get.return_value = b"user-88"
+        expected_user = MagicMock()
+
+        with patch("services.oauth_server.AccountService.load_user", return_value=expected_user) as mock_load:
+            result = OAuthServerService.validate_oauth_access_token("client-1", "access-token")
+
+        assert result is expected_user
+        mock_load.assert_called_once_with("user-88")

api/tests/test_containers_integration_tests/services/test_saved_message_service.py

@@ -396,11 +396,6 @@ class TestSavedMessageService:
 
         assert "User is required" in str(exc_info.value)
 
-        # Verify no database operations were performed
-
-        saved_messages = db_session_with_containers.query(SavedMessage).all()
-        assert len(saved_messages) == 0
-
     def test_save_error_no_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
         Test error handling when saving message with no user.
@@ -497,124 +492,140 @@ class TestSavedMessageService:
         # The message should still exist, only the saved_message should be deleted
         assert db_session_with_containers.query(Message).where(Message.id == message.id).first() is not None
 
-    def test_pagination_by_last_id_error_no_user(
-        self, db_session_with_containers: Session, mock_external_service_dependencies
-    ):
-        """
-        Test error handling when no user is provided.
-
-        This test verifies:
-        - Proper error handling for missing user
-        - ValueError is raised when user is None
-        - No database operations are performed
-        """
-        # Arrange: Create test data
-        fake = Faker()
+    def test_save_for_end_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
+        """Test saving a message for an EndUser."""
         app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
+        end_user = self._create_test_end_user(db_session_with_containers, app)
+        message = self._create_test_message(db_session_with_containers, app, end_user)
 
-        # Act & Assert: Verify proper error handling
-        with pytest.raises(ValueError) as exc_info:
-            SavedMessageService.pagination_by_last_id(app_model=app, user=None, last_id=None, limit=10)
+        mock_external_service_dependencies["message_service"].get_message.return_value = message
 
-        assert "User is required" in str(exc_info.value)
+        SavedMessageService.save(app_model=app, user=end_user, message_id=message.id)
 
-        # Verify no database operations were performed for this specific test
-        # Note: We don't check total count as other tests may have created data
-        # Instead, we verify that the error was properly raised
-        pass
-
-    def test_save_error_no_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
-        """
-        Test error handling when saving message with no user.
-
-        This test verifies:
-        - Method returns early when user is None
-        - No database operations are performed
-        - No exceptions are raised
-        """
-        # Arrange: Create test data
-        fake = Faker()
-        app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
-        message = self._create_test_message(db_session_with_containers, app, account)
-
-        # Act: Execute the method under test with None user
-        result = SavedMessageService.save(app_model=app, user=None, message_id=message.id)
-
-        # Assert: Verify the expected outcomes
-        assert result is None
-
-        # Verify no saved message was created
-
-        saved_message = (
+        saved = (
             db_session_with_containers.query(SavedMessage)
-            .where(
-                SavedMessage.app_id == app.id,
-                SavedMessage.message_id == message.id,
-            )
+            .where(SavedMessage.app_id == app.id, SavedMessage.message_id == message.id)
             .first()
         )
+        assert saved is not None
+        assert saved.created_by == end_user.id
+        assert saved.created_by_role == "end_user"
 
-        assert saved_message is None
-
-    def test_delete_success_existing_message(
+    def test_save_duplicate_is_idempotent(
         self, db_session_with_containers: Session, mock_external_service_dependencies
     ):
-        """
-        Test successful deletion of an existing saved message.
-
-        This test verifies:
-        - Proper deletion of existing saved message
-        - Correct database state after deletion
-        - No errors during deletion process
-        """
-        # Arrange: Create test data
-        fake = Faker()
+        """Test that saving an already-saved message does not create a duplicate."""
         app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
         message = self._create_test_message(db_session_with_containers, app, account)
 
-        # Create a saved message first
-        saved_message = SavedMessage(
-            app_id=app.id,
-            message_id=message.id,
-            created_by_role="account",
-            created_by=account.id,
-        )
+        mock_external_service_dependencies["message_service"].get_message.return_value = message
 
-        db_session_with_containers.add(saved_message)
+        # Save once
+        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        # Save again
+        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+
+        count = (
+            db_session_with_containers.query(SavedMessage)
+            .where(SavedMessage.app_id == app.id, SavedMessage.message_id == message.id)
+            .count()
+        )
+        assert count == 1
+
+    def test_delete_without_user_does_nothing(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that deleting without a user is a no-op."""
+        app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
+        message = self._create_test_message(db_session_with_containers, app, account)
+
+        # Pre-create a saved message
+        saved = SavedMessage(app_id=app.id, message_id=message.id, created_by_role="account", created_by=account.id)
+        db_session_with_containers.add(saved)
         db_session_with_containers.commit()
 
-        # Verify saved message exists
+        SavedMessageService.delete(app_model=app, user=None, message_id=message.id)
+
+        # Should still exist
+        assert (
+            db_session_with_containers.query(SavedMessage)
+            .where(SavedMessage.app_id == app.id, SavedMessage.message_id == message.id)
+            .first()
+            is not None
+        )
+
+    def test_delete_non_existent_does_nothing(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that deleting a non-existent saved message is a no-op."""
+        app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
+
+        # Should not raise — use a valid UUID that doesn't exist in DB
+        from uuid import uuid4
+
+        SavedMessageService.delete(app_model=app, user=account, message_id=str(uuid4()))
+
+    def test_delete_for_end_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
+        """Test deleting a saved message for an EndUser."""
+        app, account = self._create_test_app_and_account(db_session_with_containers, mock_external_service_dependencies)
+        end_user = self._create_test_end_user(db_session_with_containers, app)
+        message = self._create_test_message(db_session_with_containers, app, end_user)
+
+        saved = SavedMessage(app_id=app.id, message_id=message.id, created_by_role="end_user", created_by=end_user.id)
+        db_session_with_containers.add(saved)
+        db_session_with_containers.commit()
+
+        SavedMessageService.delete(app_model=app, user=end_user, message_id=message.id)
+
+        assert (
+            db_session_with_containers.query(SavedMessage)
+            .where(SavedMessage.app_id == app.id, SavedMessage.message_id == message.id)
+            .first()
+            is None
+        )
+
+    def test_delete_only_affects_own_saved_messages(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that delete only removes the requesting user's saved message."""
+        app, account1 = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        end_user = self._create_test_end_user(db_session_with_containers, app)
+        message = self._create_test_message(db_session_with_containers, app, account1)
+
+        # Both users save the same message
+        saved_account = SavedMessage(
+            app_id=app.id, message_id=message.id, created_by_role="account", created_by=account1.id
+        )
+        saved_end_user = SavedMessage(
+            app_id=app.id, message_id=message.id, created_by_role="end_user", created_by=end_user.id
+        )
+        db_session_with_containers.add_all([saved_account, saved_end_user])
+        db_session_with_containers.commit()
+
+        # Delete only account1's saved message
+        SavedMessageService.delete(app_model=app, user=account1, message_id=message.id)
+
+        # Account's saved message should be gone
         assert (
             db_session_with_containers.query(SavedMessage)
             .where(
                 SavedMessage.app_id == app.id,
                 SavedMessage.message_id == message.id,
-                SavedMessage.created_by_role == "account",
-                SavedMessage.created_by == account.id,
+                SavedMessage.created_by == account1.id,
             )
             .first()
-            is not None
+            is None
         )
-
-        # Act: Execute the method under test
-        SavedMessageService.delete(app_model=app, user=account, message_id=message.id)
-
-        # Assert: Verify the expected outcomes
-        # Check if saved message was deleted from database
-        deleted_saved_message = (
+        # End user's saved message should still exist
+        assert (
             db_session_with_containers.query(SavedMessage)
             .where(
                 SavedMessage.app_id == app.id,
                 SavedMessage.message_id == message.id,
-                SavedMessage.created_by_role == "account",
-                SavedMessage.created_by == account.id,
+                SavedMessage.created_by == end_user.id,
             )
             .first()
+            is not None
         )
-
-        assert deleted_saved_message is None
-
-        # Verify database state
-        db_session_with_containers.commit()
-        # The message should still exist, only the saved_message should be deleted
-        assert db_session_with_containers.query(Message).where(Message.id == message.id).first() is not None

api/tests/test_containers_integration_tests/services/test_workflow_app_service.py

@@ -10,6 +10,7 @@ from sqlalchemy.orm import Session
 from dify_graph.entities.workflow_execution import WorkflowExecutionStatus
 from models import EndUser, Workflow, WorkflowAppLog, WorkflowRun
 from models.enums import CreatorUserRole
+from models.workflow import WorkflowAppLogCreatedFrom
 from services.account_service import AccountService, TenantService
 
 # Delay import of AppService to avoid circular dependency
@@ -221,7 +222,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -357,7 +358,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run_1.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -399,7 +400,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run_2.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -441,7 +442,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run_4.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -521,7 +522,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -627,7 +628,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -732,7 +733,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -860,7 +861,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -902,7 +903,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="web-app",
+                created_from=WorkflowAppLogCreatedFrom.WEB_APP,
                 created_by_role=CreatorUserRole.END_USER,
                 created_by=end_user.id,
             )
@@ -1037,7 +1038,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -1125,7 +1126,7 @@ class TestWorkflowAppService:
             app_id=app.id,
             workflow_id=workflow.id,
             workflow_run_id=workflow_run.id,
-            created_from="service-api",
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
             created_by_role=CreatorUserRole.ACCOUNT,
             created_by=account.id,
         )
@@ -1279,7 +1280,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -1379,7 +1380,7 @@ class TestWorkflowAppService:
                 app_id=app.id,
                 workflow_id=workflow.id,
                 workflow_run_id=workflow_run.id,
-                created_from="service-api",
+                created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
@@ -1481,7 +1482,7 @@ class TestWorkflowAppService:
                     app_id=app.id,
                     workflow_id=workflow.id,
                     workflow_run_id=workflow_run.id,
-                    created_from="service-api",
+                    created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
                     created_by_role=CreatorUserRole.ACCOUNT,
                     created_by=account.id,
                 )

api/tests/test_containers_integration_tests/services/tools/test_api_tools_manage_service.py

@@ -536,3 +536,151 @@ class TestApiToolManageService:
         # Verify mock interactions
         mock_external_service_dependencies["encrypter"].assert_called_once()
         mock_external_service_dependencies["provider_controller"].from_db.assert_called_once()
+
+    def test_delete_api_tool_provider_success(
+        self, flask_req_ctx_with_containers, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test successful deletion of an API tool provider."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        schema = self._create_test_openapi_schema()
+        provider_name = fake.unique.word()
+
+        ApiToolManageService.create_api_tool_provider(
+            user_id=account.id,
+            tenant_id=tenant.id,
+            provider_name=provider_name,
+            icon={"content": "🔧", "background": "#FFF"},
+            credentials={"auth_type": "none"},
+            schema_type=ApiProviderSchemaType.OPENAPI,
+            schema=schema,
+            privacy_policy="",
+            custom_disclaimer="",
+            labels=[],
+        )
+
+        provider = (
+            db_session_with_containers.query(ApiToolProvider)
+            .filter(ApiToolProvider.tenant_id == tenant.id, ApiToolProvider.name == provider_name)
+            .first()
+        )
+        assert provider is not None
+
+        result = ApiToolManageService.delete_api_tool_provider(account.id, tenant.id, provider_name)
+
+        assert result == {"result": "success"}
+        deleted = (
+            db_session_with_containers.query(ApiToolProvider)
+            .filter(ApiToolProvider.tenant_id == tenant.id, ApiToolProvider.name == provider_name)
+            .first()
+        )
+        assert deleted is None
+
+    def test_delete_api_tool_provider_not_found(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test deletion raises ValueError when provider not found."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="you have not added provider"):
+            ApiToolManageService.delete_api_tool_provider(account.id, tenant.id, "nonexistent")
+
+    def test_update_api_tool_provider_not_found(
+        self, flask_req_ctx_with_containers, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test update raises ValueError when original provider not found."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="does not exists"):
+            ApiToolManageService.update_api_tool_provider(
+                user_id=account.id,
+                tenant_id=tenant.id,
+                provider_name="new-name",
+                original_provider="nonexistent",
+                icon={},
+                credentials={"auth_type": "none"},
+                _schema_type=ApiProviderSchemaType.OPENAPI,
+                schema=self._create_test_openapi_schema(),
+                privacy_policy=None,
+                custom_disclaimer="",
+                labels=[],
+            )
+
+    def test_update_api_tool_provider_missing_auth_type(
+        self, flask_req_ctx_with_containers, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test update raises ValueError when auth_type is missing from credentials."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        schema = self._create_test_openapi_schema()
+        provider_name = fake.unique.word()
+
+        ApiToolManageService.create_api_tool_provider(
+            user_id=account.id,
+            tenant_id=tenant.id,
+            provider_name=provider_name,
+            icon={"content": "🔧", "background": "#FFF"},
+            credentials={"auth_type": "none"},
+            schema_type=ApiProviderSchemaType.OPENAPI,
+            schema=schema,
+            privacy_policy="",
+            custom_disclaimer="",
+            labels=[],
+        )
+
+        with pytest.raises(ValueError, match="auth_type is required"):
+            ApiToolManageService.update_api_tool_provider(
+                user_id=account.id,
+                tenant_id=tenant.id,
+                provider_name=provider_name,
+                original_provider=provider_name,
+                icon={},
+                credentials={},
+                _schema_type=ApiProviderSchemaType.OPENAPI,
+                schema=schema,
+                privacy_policy=None,
+                custom_disclaimer="",
+                labels=[],
+            )
+
+    def test_list_api_tool_provider_tools_not_found(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test listing tools raises ValueError when provider not found."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="you have not added provider"):
+            ApiToolManageService.list_api_tool_provider_tools(account.id, tenant.id, "nonexistent")
+
+    def test_test_api_tool_preview_invalid_schema_type(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test preview raises ValueError for invalid schema type."""
+        fake = Faker()
+        account, tenant = self._create_test_account_and_tenant(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="invalid schema type"):
+            ApiToolManageService.test_api_tool_preview(
+                tenant_id=tenant.id,
+                provider_name="provider-a",
+                tool_name="tool-a",
+                credentials={"auth_type": "none"},
+                parameters={},
+                schema_type="bad-schema-type",
+                schema="schema",
+            )

api/tests/test_containers_integration_tests/services/tools/test_tools_transform_service.py

@@ -6,7 +6,7 @@ from sqlalchemy.orm import Session
 
 from core.tools.entities.api_entities import ToolProviderApiEntity
 from core.tools.entities.common_entities import I18nObject
-from core.tools.entities.tool_entities import ToolProviderType
+from core.tools.entities.tool_entities import ApiProviderSchemaType, ToolProviderType
 from models.tools import ApiToolProvider, BuiltinToolProvider, MCPToolProvider, WorkflowToolProvider
 from services.plugin.plugin_service import PluginService
 from services.tools.tools_transform_service import ToolTransformService
@@ -52,7 +52,7 @@ class TestToolTransformService:
                 user_id="test_user_id",
                 credentials_str='{"auth_type": "api_key_header", "api_key": "test_key"}',
                 schema="{}",
-                schema_type_str="openapi",
+                schema_type_str=ApiProviderSchemaType.OPENAPI,
                 tools_str="[]",
             )
         elif provider_type == "builtin":
@@ -659,7 +659,7 @@ class TestToolTransformService:
             user_id=fake.uuid4(),
             credentials_str='{"auth_type": "api_key_header", "api_key": "test_key"}',
             schema="{}",
-            schema_type_str="openapi",
+            schema_type_str=ApiProviderSchemaType.OPENAPI,
             tools_str="[]",
         )
 
@@ -695,7 +695,7 @@ class TestToolTransformService:
             user_id=fake.uuid4(),
             credentials_str='{"auth_type": "api_key_query", "api_key": "test_key"}',
             schema="{}",
-            schema_type_str="openapi",
+            schema_type_str=ApiProviderSchemaType.OPENAPI,
             tools_str="[]",
         )
 
@@ -731,7 +731,7 @@ class TestToolTransformService:
             user_id=fake.uuid4(),
             credentials_str='{"auth_type": "api_key", "api_key": "test_key"}',
             schema="{}",
-            schema_type_str="openapi",
+            schema_type_str=ApiProviderSchemaType.OPENAPI,
             tools_str="[]",
         )
 

api/tests/test_containers_integration_tests/services/tools/test_workflow_tools_manage_service.py

@@ -1043,3 +1043,112 @@ class TestWorkflowToolManageService:
         # After the fix, this should always be 0
         # For now, we document that the record may exist, demonstrating the bug
         # assert tool_count == 0  # Expected after fix
+
+    def test_delete_workflow_tool_success(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test successful deletion of a workflow tool."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+        tool_name = fake.unique.word()
+
+        WorkflowToolManageService.create_workflow_tool(
+            user_id=account.id,
+            tenant_id=account.current_tenant.id,
+            workflow_app_id=app.id,
+            name=tool_name,
+            label=fake.word(),
+            icon={"type": "emoji", "emoji": "🔧"},
+            description=fake.text(max_nb_chars=200),
+            parameters=self._create_test_workflow_tool_parameters(),
+        )
+
+        tool = (
+            db_session_with_containers.query(WorkflowToolProvider)
+            .where(WorkflowToolProvider.tenant_id == account.current_tenant.id, WorkflowToolProvider.name == tool_name)
+            .first()
+        )
+        assert tool is not None
+
+        result = WorkflowToolManageService.delete_workflow_tool(account.id, account.current_tenant.id, tool.id)
+
+        assert result == {"result": "success"}
+        deleted = (
+            db_session_with_containers.query(WorkflowToolProvider).where(WorkflowToolProvider.id == tool.id).first()
+        )
+        assert deleted is None
+
+    def test_list_tenant_workflow_tools_empty(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test listing workflow tools when none exist returns empty list."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        result = WorkflowToolManageService.list_tenant_workflow_tools(account.id, account.current_tenant.id)
+
+        assert result == []
+
+    def test_get_workflow_tool_by_tool_id_not_found(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that get_workflow_tool_by_tool_id raises ValueError when tool not found."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="Tool not found"):
+            WorkflowToolManageService.get_workflow_tool_by_tool_id(account.id, account.current_tenant.id, fake.uuid4())
+
+    def test_get_workflow_tool_by_app_id_not_found(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that get_workflow_tool_by_app_id raises ValueError when tool not found."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="Tool not found"):
+            WorkflowToolManageService.get_workflow_tool_by_app_id(account.id, account.current_tenant.id, fake.uuid4())
+
+    def test_list_single_workflow_tools_not_found(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that list_single_workflow_tools raises ValueError when tool not found."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        with pytest.raises(ValueError, match="not found"):
+            WorkflowToolManageService.list_single_workflow_tools(account.id, account.current_tenant.id, fake.uuid4())
+
+    def test_create_workflow_tool_with_labels(
+        self, db_session_with_containers: Session, mock_external_service_dependencies
+    ):
+        """Test that labels are forwarded to ToolLabelManager when provided."""
+        fake = Faker()
+        app, account, workflow = self._create_test_app_and_account(
+            db_session_with_containers, mock_external_service_dependencies
+        )
+
+        result = WorkflowToolManageService.create_workflow_tool(
+            user_id=account.id,
+            tenant_id=account.current_tenant.id,
+            workflow_app_id=app.id,
+            name=fake.unique.word(),
+            label=fake.word(),
+            icon={"type": "emoji", "emoji": "🔧"},
+            description=fake.text(max_nb_chars=200),
+            parameters=self._create_test_workflow_tool_parameters(),
+            labels=["label-1", "label-2"],
+        )
+
+        assert result == {"result": "success"}
+        mock_external_service_dependencies["tool_label_manager"].update_tool_labels.assert_called_once()

api/tests/test_containers_integration_tests/tasks/test_batch_clean_document_task.py

@@ -13,6 +13,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from libs.datetime_utils import naive_utc_now
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
@@ -152,7 +153,7 @@ class TestBatchCleanDocumentTask:
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
             indexing_status=IndexingStatus.COMPLETED,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
 
         db_session_with_containers.add(document)
@@ -392,7 +393,12 @@ class TestBatchCleanDocumentTask:
         db_session_with_containers.commit()
 
         # Execute the task with non-existent dataset
-        batch_clean_document_task(document_ids=[document_id], dataset_id=dataset_id, doc_form="text_model", file_ids=[])
+        batch_clean_document_task(
+            document_ids=[document_id],
+            dataset_id=dataset_id,
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
+            file_ids=[],
+        )
 
         # Verify that no index processing occurred
         mock_external_service_dependencies["index_processor"].clean.assert_not_called()
@@ -525,7 +531,11 @@ class TestBatchCleanDocumentTask:
         account = self._create_test_account(db_session_with_containers)
 
         # Test different doc_form types
-        doc_forms = ["text_model", "qa_model", "hierarchical_model"]
+        doc_forms = [
+            IndexStructureType.PARAGRAPH_INDEX,
+            IndexStructureType.QA_INDEX,
+            IndexStructureType.PARENT_CHILD_INDEX,
+        ]
 
         for doc_form in doc_forms:
             dataset = self._create_test_dataset(db_session_with_containers, account)

api/tests/test_containers_integration_tests/tasks/test_batch_create_segment_to_index_task.py

@@ -19,6 +19,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
@@ -179,7 +180,7 @@ class TestBatchCreateSegmentToIndexTask:
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
             archived=False,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             word_count=0,
         )
 
@@ -221,17 +222,17 @@ class TestBatchCreateSegmentToIndexTask:
 
         return upload_file
 
-    def _create_test_csv_content(self, content_type="text_model"):
+    def _create_test_csv_content(self, content_type=IndexStructureType.PARAGRAPH_INDEX):
         """
         Helper method to create test CSV content.
 
         Args:
-            content_type: Type of content to create ("text_model" or "qa_model")
+            content_type: Type of content to create (IndexStructureType.PARAGRAPH_INDEX or IndexStructureType.QA_INDEX)
 
         Returns:
             str: CSV content as string
         """
-        if content_type == "qa_model":
+        if content_type == IndexStructureType.QA_INDEX:
             csv_content = "content,answer\n"
             csv_content += "This is the first segment content,This is the first answer\n"
             csv_content += "This is the second segment content,This is the second answer\n"
@@ -264,7 +265,7 @@ class TestBatchCreateSegmentToIndexTask:
         upload_file = self._create_test_upload_file(db_session_with_containers, account, tenant)
 
         # Create CSV content
-        csv_content = self._create_test_csv_content("text_model")
+        csv_content = self._create_test_csv_content(IndexStructureType.PARAGRAPH_INDEX)
 
         # Mock storage to return our CSV content
         mock_storage = mock_external_service_dependencies["storage"]
@@ -451,7 +452,7 @@ class TestBatchCreateSegmentToIndexTask:
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=False,  # Document is disabled
                 archived=False,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 word_count=0,
             ),
             # Archived document
@@ -467,7 +468,7 @@ class TestBatchCreateSegmentToIndexTask:
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
                 archived=True,  # Document is archived
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 word_count=0,
             ),
             # Document with incomplete indexing
@@ -483,7 +484,7 @@ class TestBatchCreateSegmentToIndexTask:
                 indexing_status=IndexingStatus.INDEXING,  # Not completed
                 enabled=True,
                 archived=False,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 word_count=0,
             ),
         ]
@@ -655,7 +656,7 @@ class TestBatchCreateSegmentToIndexTask:
         db_session_with_containers.commit()
 
         # Create CSV content
-        csv_content = self._create_test_csv_content("text_model")
+        csv_content = self._create_test_csv_content(IndexStructureType.PARAGRAPH_INDEX)
 
         # Mock storage to return our CSV content
         mock_storage = mock_external_service_dependencies["storage"]

api/tests/test_containers_integration_tests/tasks/test_clean_dataset_task.py

@@ -18,6 +18,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import (
@@ -192,7 +193,7 @@ class TestCleanDatasetTask:
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
             archived=False,
-            doc_form="paragraph_index",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             word_count=100,
             created_at=datetime.now(),
             updated_at=datetime.now(),

api/tests/test_containers_integration_tests/tasks/test_clean_notion_document_task.py

@@ -12,6 +12,7 @@ from unittest.mock import Mock, patch
 import pytest
 from faker import Faker
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.dataset import Dataset, Document, DocumentSegment
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus, SegmentStatus
 from services.account_service import AccountService, TenantService
@@ -114,7 +115,7 @@ class TestCleanNotionDocumentTask:
                 name=f"Notion Page {i}",
                 created_from=DocumentCreatedFrom.WEB,
                 created_by=account.id,
-                doc_form="text_model",  # Set doc_form to ensure dataset.doc_form works
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,  # Set doc_form to ensure dataset.doc_form works
                 doc_language="en",
                 indexing_status=IndexingStatus.COMPLETED,
             )
@@ -261,7 +262,7 @@ class TestCleanNotionDocumentTask:
 
         # Test different index types
         # Note: Only testing text_model to avoid dependency on external services
-        index_types = ["text_model"]
+        index_types = [IndexStructureType.PARAGRAPH_INDEX]
 
         for index_type in index_types:
             # Create dataset (doc_form will be set via document creation)

api/tests/test_containers_integration_tests/tasks/test_create_segment_to_index_task.py

@@ -12,6 +12,7 @@ from uuid import uuid4
 import pytest
 from faker import Faker
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.ext_redis import redis_client
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
@@ -141,7 +142,7 @@ class TestCreateSegmentToIndexTask:
             enabled=True,
             archived=False,
             indexing_status=IndexingStatus.COMPLETED,
-            doc_form="qa_model",
+            doc_form=IndexStructureType.QA_INDEX,
         )
         db_session_with_containers.add(document)
         db_session_with_containers.commit()
@@ -301,7 +302,7 @@ class TestCreateSegmentToIndexTask:
             enabled=True,
             archived=False,
             indexing_status=IndexingStatus.COMPLETED,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         db_session_with_containers.add(document)
         db_session_with_containers.commit()
@@ -552,7 +553,11 @@ class TestCreateSegmentToIndexTask:
         - Processing completes successfully for different forms
         """
         # Arrange: Test different doc_forms
-        doc_forms = ["qa_model", "text_model", "web_model"]
+        doc_forms = [
+            IndexStructureType.QA_INDEX,
+            IndexStructureType.PARAGRAPH_INDEX,
+            IndexStructureType.PARAGRAPH_INDEX,
+        ]
 
         for doc_form in doc_forms:
             # Create fresh test data for each form

api/tests/test_containers_integration_tests/tasks/test_deal_dataset_vector_index_task.py

@@ -12,6 +12,7 @@ from unittest.mock import ANY, Mock, patch
 import pytest
 from faker import Faker
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.dataset import Dataset, Document, DocumentSegment
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus, SegmentStatus
 from services.account_service import AccountService, TenantService
@@ -107,7 +108,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -167,7 +168,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -187,7 +188,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -268,7 +269,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="parent_child_index",
+            doc_form=IndexStructureType.PARENT_CHILD_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -288,7 +289,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="parent_child_index",
+            doc_form=IndexStructureType.PARENT_CHILD_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -416,7 +417,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -505,7 +506,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -525,7 +526,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -601,7 +602,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="qa_index",
+            doc_form=IndexStructureType.QA_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -638,7 +639,7 @@ class TestDealDatasetVectorIndexTask:
         assert updated_document.indexing_status == IndexingStatus.COMPLETED
 
         # Verify index processor was initialized with custom index type
-        mock_index_processor_factory.assert_called_once_with("qa_index")
+        mock_index_processor_factory.assert_called_once_with(IndexStructureType.QA_INDEX)
         mock_factory = mock_index_processor_factory.return_value
         mock_processor = mock_factory.init_index_processor.return_value
         mock_processor.load.assert_called_once()
@@ -677,7 +678,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -714,7 +715,7 @@ class TestDealDatasetVectorIndexTask:
         assert updated_document.indexing_status == IndexingStatus.COMPLETED
 
         # Verify index processor was initialized with the document's index type
-        mock_index_processor_factory.assert_called_once_with("text_model")
+        mock_index_processor_factory.assert_called_once_with(IndexStructureType.PARAGRAPH_INDEX)
         mock_factory = mock_index_processor_factory.return_value
         mock_processor = mock_factory.init_index_processor.return_value
         mock_processor.load.assert_called_once()
@@ -753,7 +754,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -775,7 +776,7 @@ class TestDealDatasetVectorIndexTask:
                 name=f"Test Document {i}",
                 created_from=DocumentCreatedFrom.WEB,
                 created_by=account.id,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
                 doc_language="en",
                 indexing_status=IndexingStatus.COMPLETED,
                 enabled=True,
@@ -856,7 +857,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -876,7 +877,7 @@ class TestDealDatasetVectorIndexTask:
             name="Test Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -953,7 +954,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -973,7 +974,7 @@ class TestDealDatasetVectorIndexTask:
             name="Enabled Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -992,7 +993,7 @@ class TestDealDatasetVectorIndexTask:
             name="Disabled Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=False,  # This document should be skipped
@@ -1074,7 +1075,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -1094,7 +1095,7 @@ class TestDealDatasetVectorIndexTask:
             name="Active Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -1113,7 +1114,7 @@ class TestDealDatasetVectorIndexTask:
             name="Archived Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -1195,7 +1196,7 @@ class TestDealDatasetVectorIndexTask:
             name="Document for doc_form",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -1215,7 +1216,7 @@ class TestDealDatasetVectorIndexTask:
             name="Completed Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.COMPLETED,
             enabled=True,
@@ -1234,7 +1235,7 @@ class TestDealDatasetVectorIndexTask:
             name="Incomplete Document",
             created_from=DocumentCreatedFrom.WEB,
             created_by=account.id,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
             indexing_status=IndexingStatus.INDEXING,  # This document should be skipped
             enabled=True,

api/tests/test_containers_integration_tests/tasks/test_disable_segment_from_index_task.py

@@ -15,6 +15,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.ext_redis import redis_client
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
@@ -113,7 +114,7 @@ class TestDisableSegmentFromIndexTask:
         dataset: Dataset,
         tenant: Tenant,
         account: Account,
-        doc_form: str = "text_model",
+        doc_form: str = IndexStructureType.PARAGRAPH_INDEX,
     ) -> Document:
         """
         Helper method to create a test document.
@@ -476,7 +477,11 @@ class TestDisableSegmentFromIndexTask:
         - Index processor clean method is called correctly
         """
         # Test different document forms
-        doc_forms = ["text_model", "qa_model", "table_model"]
+        doc_forms = [
+            IndexStructureType.PARAGRAPH_INDEX,
+            IndexStructureType.QA_INDEX,
+            IndexStructureType.PARENT_CHILD_INDEX,
+        ]
 
         for doc_form in doc_forms:
             # Arrange: Create test data for each form

api/tests/test_containers_integration_tests/tasks/test_disable_segments_from_index_task.py

@@ -11,6 +11,7 @@ from unittest.mock import MagicMock, patch
 from faker import Faker
 from sqlalchemy.orm import Session
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models import Account, Dataset, DocumentSegment
 from models import Document as DatasetDocument
 from models.dataset import DatasetProcessRule
@@ -153,7 +154,7 @@ class TestDisableSegmentsFromIndexTask:
         document.indexing_status = "completed"
         document.enabled = True
         document.archived = False
-        document.doc_form = "text_model"  # Use text_model form for testing
+        document.doc_form = IndexStructureType.PARAGRAPH_INDEX  # Use text_model form for testing
         document.doc_language = "en"
         db_session_with_containers.add(document)
         db_session_with_containers.commit()
@@ -500,7 +501,11 @@ class TestDisableSegmentsFromIndexTask:
         segment_ids = [segment.id for segment in segments]
 
         # Test different document forms
-        doc_forms = ["text_model", "qa_model", "hierarchical_model"]
+        doc_forms = [
+            IndexStructureType.PARAGRAPH_INDEX,
+            IndexStructureType.QA_INDEX,
+            IndexStructureType.PARENT_CHILD_INDEX,
+        ]
 
         for doc_form in doc_forms:
             # Update document form

api/tests/test_containers_integration_tests/tasks/test_document_indexing_sync_task.py

@@ -14,6 +14,7 @@ from uuid import uuid4
 import pytest
 
 from core.indexing_runner import DocumentIsPausedError, IndexingRunner
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus, SegmentStatus
@@ -85,7 +86,7 @@ class DocumentIndexingSyncTaskTestDataFactory:
             created_by=created_by,
             indexing_status=indexing_status,
             enabled=True,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             doc_language="en",
         )
         db_session_with_containers.add(document)

api/tests/test_containers_integration_tests/tasks/test_document_indexing_update_task.py

@@ -3,6 +3,7 @@ from unittest.mock import MagicMock, patch
 import pytest
 from faker import Faker
 
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus, SegmentStatus
@@ -80,7 +81,7 @@ class TestDocumentIndexingUpdateTask:
             created_by=account.id,
             indexing_status=IndexingStatus.WAITING,
             enabled=True,
-            doc_form="text_model",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
         db_session_with_containers.add(document)
         db_session_with_containers.commit()

api/tests/test_containers_integration_tests/tasks/test_duplicate_document_indexing_task.py

@@ -4,6 +4,7 @@ import pytest
 from faker import Faker
 
 from core.indexing_runner import DocumentIsPausedError
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from enums.cloud_plan import CloudPlan
 from models import Account, Tenant, TenantAccountJoin, TenantAccountRole
 from models.dataset import Dataset, Document, DocumentSegment
@@ -130,7 +131,7 @@ class TestDuplicateDocumentIndexingTasks:
                 created_by=account.id,
                 indexing_status=IndexingStatus.WAITING,
                 enabled=True,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
             )
             db_session_with_containers.add(document)
             documents.append(document)
@@ -265,7 +266,7 @@ class TestDuplicateDocumentIndexingTasks:
                 created_by=account.id,
                 indexing_status=IndexingStatus.WAITING,
                 enabled=True,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
             )
             db_session_with_containers.add(document)
             documents.append(document)
@@ -524,7 +525,7 @@ class TestDuplicateDocumentIndexingTasks:
                 created_by=dataset.created_by,
                 indexing_status=IndexingStatus.WAITING,
                 enabled=True,
-                doc_form="text_model",
+                doc_form=IndexStructureType.PARAGRAPH_INDEX,
             )
             db_session_with_containers.add(document)
             extra_documents.append(document)

api/tests/unit_tests/controllers/console/app/test_app_apis.py

@@ -7,14 +7,19 @@ from __future__ import annotations
 
 import uuid
 from types import SimpleNamespace
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
 
 import pytest
+from pydantic import ValidationError
 from werkzeug.exceptions import BadRequest, NotFound
 
+from controllers.console import console_ns
 from controllers.console.app import (
     annotation as annotation_module,
 )
+from controllers.console.app import (
+    app as app_module,
+)
 from controllers.console.app import (
     completion as completion_module,
 )
@@ -203,6 +208,48 @@ class TestCompletionEndpoints:
                 method(app_model=MagicMock(id="app-1"))
 
 
+class TestAppEndpoints:
+    """Tests for app endpoints."""
+
+    def test_app_put_should_preserve_icon_type_when_payload_omits_it(self, app, monkeypatch):
+        api = app_module.AppApi()
+        method = _unwrap(api.put)
+        payload = {
+            "name": "Updated App",
+            "description": "Updated description",
+            "icon": "🤖",
+            "icon_background": "#FFFFFF",
+        }
+        app_service = MagicMock()
+        app_service.update_app.return_value = SimpleNamespace()
+        response_model = MagicMock()
+        response_model.model_dump.return_value = {"id": "app-1"}
+
+        monkeypatch.setattr(app_module, "AppService", lambda: app_service)
+        monkeypatch.setattr(app_module.AppDetailWithSite, "model_validate", MagicMock(return_value=response_model))
+
+        with (
+            app.test_request_context("/console/api/apps/app-1", method="PUT", json=payload),
+            patch.object(type(console_ns), "payload", payload),
+        ):
+            response = method(app_model=SimpleNamespace(icon_type=app_module.IconType.EMOJI))
+
+        assert response == {"id": "app-1"}
+        assert app_service.update_app.call_args.args[1]["icon_type"] is None
+
+    def test_update_app_payload_should_reject_empty_icon_type(self):
+        with pytest.raises(ValidationError):
+            app_module.UpdateAppPayload.model_validate(
+                {
+                    "name": "Updated App",
+                    "description": "Updated description",
+                    "icon_type": "",
+                    "icon": "🤖",
+                    "icon_background": "#FFFFFF",
+                }
+            )
+
+
 # ========== OpsTrace Tests ==========
 class TestOpsTraceEndpoints:
     """Tests for ops_trace endpoint."""
@@ -281,12 +328,10 @@ class TestSiteEndpoints:
         method = _unwrap(api.post)
 
         site = MagicMock()
-        query = MagicMock()
-        query.where.return_value.first.return_value = site
         monkeypatch.setattr(
             site_module.db,
             "session",
-            MagicMock(query=lambda *_args, **_kwargs: query, commit=lambda: None),
+            MagicMock(scalar=lambda *_args, **_kwargs: site, commit=lambda: None),
         )
         monkeypatch.setattr(
             site_module,
@@ -305,12 +350,10 @@ class TestSiteEndpoints:
         method = _unwrap(api.post)
 
         site = MagicMock()
-        query = MagicMock()
-        query.where.return_value.first.return_value = site
         monkeypatch.setattr(
             site_module.db,
             "session",
-            MagicMock(query=lambda *_args, **_kwargs: query, commit=lambda: None),
+            MagicMock(scalar=lambda *_args, **_kwargs: site, commit=lambda: None),
         )
         monkeypatch.setattr(site_module.Site, "generate_code", lambda *_args, **_kwargs: "code")
         monkeypatch.setattr(

api/tests/unit_tests/controllers/console/app/test_conversation_api.py

@@ -82,12 +82,8 @@ def test_chat_conversation_list_advanced_chat_calls_paginate(app, monkeypatch: p
 def test_get_conversation_updates_read_at(monkeypatch: pytest.MonkeyPatch) -> None:
     conversation = SimpleNamespace(id="c1", app_id="app-1")
 
-    query = MagicMock()
-    query.where.return_value = query
-    query.first.return_value = conversation
-
     session = MagicMock()
-    session.query.return_value = query
+    session.scalar.return_value = conversation
 
     monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (_make_account(), "t1"))
     monkeypatch.setattr(conversation_module.db, "session", session)
@@ -101,12 +97,8 @@ def test_get_conversation_updates_read_at(monkeypatch: pytest.MonkeyPatch) -> No
 
 
 def test_get_conversation_missing_raises_not_found(monkeypatch: pytest.MonkeyPatch) -> None:
-    query = MagicMock()
-    query.where.return_value = query
-    query.first.return_value = None
-
     session = MagicMock()
-    session.query.return_value = query
+    session.scalar.return_value = None
 
     monkeypatch.setattr(conversation_module, "current_account_with_tenant", lambda: (_make_account(), "t1"))
     monkeypatch.setattr(conversation_module.db, "session", session)

api/tests/unit_tests/controllers/console/app/test_conversation_read_timestamp.py

@@ -24,7 +24,7 @@ def test_get_conversation_mark_read_keeps_updated_at_unchanged():
         ),
         patch("controllers.console.app.conversation.db.session", autospec=True) as mock_session,
     ):
-        mock_session.query.return_value.where.return_value.first.return_value = conversation
+        mock_session.scalar.return_value = conversation
 
         _get_conversation(app_model, "conversation-id")
 

api/tests/unit_tests/controllers/console/app/test_generator_api.py

@@ -73,8 +73,7 @@ def test_instruction_generate_app_not_found(app, monkeypatch: pytest.MonkeyPatch
 
     monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
 
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: None)
-    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(get=lambda *_args, **_kwargs: None))
 
     with app.test_request_context(
         "/console/api/instruction-generate",
@@ -99,8 +98,7 @@ def test_instruction_generate_workflow_not_found(app, monkeypatch: pytest.Monkey
     monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
 
     app_model = SimpleNamespace(id="app-1")
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
-    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(get=lambda *_args, **_kwargs: app_model))
     _install_workflow_service(monkeypatch, workflow=None)
 
     with app.test_request_context(
@@ -126,8 +124,7 @@ def test_instruction_generate_node_missing(app, monkeypatch: pytest.MonkeyPatch)
     monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
 
     app_model = SimpleNamespace(id="app-1")
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
-    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(get=lambda *_args, **_kwargs: app_model))
 
     workflow = SimpleNamespace(graph_dict={"nodes": []})
     _install_workflow_service(monkeypatch, workflow=workflow)
@@ -155,8 +152,7 @@ def test_instruction_generate_code_node(app, monkeypatch: pytest.MonkeyPatch) ->
     monkeypatch.setattr(generator_module, "current_account_with_tenant", lambda: (None, "t1"))
 
     app_model = SimpleNamespace(id="app-1")
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
-    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(generator_module.db, "session", SimpleNamespace(get=lambda *_args, **_kwargs: app_model))
 
     workflow = SimpleNamespace(
         graph_dict={

api/tests/unit_tests/controllers/console/app/test_message.py

@@ -1,320 +0,0 @@
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask, request
-from werkzeug.exceptions import InternalServerError, NotFound
-from werkzeug.local import LocalProxy
-
-from controllers.console.app.error import (
-    ProviderModelCurrentlyNotSupportError,
-    ProviderNotInitializeError,
-    ProviderQuotaExceededError,
-)
-from controllers.console.app.message import (
-    ChatMessageListApi,
-    ChatMessagesQuery,
-    FeedbackExportQuery,
-    MessageAnnotationCountApi,
-    MessageApi,
-    MessageFeedbackApi,
-    MessageFeedbackExportApi,
-    MessageFeedbackPayload,
-    MessageSuggestedQuestionApi,
-)
-from controllers.console.explore.error import AppSuggestedQuestionsAfterAnswerDisabledError
-from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
-from models import App, AppMode
-from services.errors.conversation import ConversationNotExistsError
-from services.errors.message import MessageNotExistsError, SuggestedQuestionsAfterAnswerDisabledError
-
-
-@pytest.fixture
-def app():
-    flask_app = Flask(__name__)
-    flask_app.config["TESTING"] = True
-    flask_app.config["RESTX_MASK_HEADER"] = "X-Fields"
-    return flask_app
-
-
-@pytest.fixture
-def mock_account():
-    from models.account import Account, AccountStatus
-
-    account = MagicMock(spec=Account)
-    account.id = "user_123"
-    account.timezone = "UTC"
-    account.status = AccountStatus.ACTIVE
-    account.is_admin_or_owner = True
-    account.current_tenant.current_role = "owner"
-    account.has_edit_permission = True
-    return account
-
-
-@pytest.fixture
-def mock_app_model():
-    app_model = MagicMock(spec=App)
-    app_model.id = "app_123"
-    app_model.mode = AppMode.CHAT
-    app_model.tenant_id = "tenant_123"
-    return app_model
-
-
-@pytest.fixture(autouse=True)
-def mock_csrf():
-    with patch("libs.login.check_csrf_token") as mock:
-        yield mock
-
-
-import contextlib
-
-
-@contextlib.contextmanager
-def setup_test_context(
-    test_app, endpoint_class, route_path, method, mock_account, mock_app_model, payload=None, qs=None
-):
-    with (
-        patch("extensions.ext_database.db") as mock_db,
-        patch("controllers.console.app.wraps.db", mock_db),
-        patch("controllers.console.wraps.db", mock_db),
-        patch("controllers.console.app.message.db", mock_db),
-        patch("controllers.console.app.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-        patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-        patch("controllers.console.app.message.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-    ):
-        # Set up a generic query mock that usually returns mock_app_model when getting app
-        app_query_mock = MagicMock()
-        app_query_mock.filter.return_value.first.return_value = mock_app_model
-        app_query_mock.filter.return_value.filter.return_value.first.return_value = mock_app_model
-        app_query_mock.where.return_value.first.return_value = mock_app_model
-        app_query_mock.where.return_value.where.return_value.first.return_value = mock_app_model
-
-        data_query_mock = MagicMock()
-
-        def query_side_effect(*args, **kwargs):
-            if args and hasattr(args[0], "__name__") and args[0].__name__ == "App":
-                return app_query_mock
-            return data_query_mock
-
-        mock_db.session.query.side_effect = query_side_effect
-        mock_db.data_query = data_query_mock
-
-        # Let the caller override the stat db query logic
-        proxy_mock = LocalProxy(lambda: mock_account)
-
-        query_string = "&".join([f"{k}={v}" for k, v in (qs or {}).items()])
-        full_path = f"{route_path}?{query_string}" if qs else route_path
-
-        with (
-            patch("libs.login.current_user", proxy_mock),
-            patch("flask_login.current_user", proxy_mock),
-            patch("controllers.console.app.message.attach_message_extra_contents", return_value=None),
-        ):
-            with test_app.test_request_context(full_path, method=method, json=payload):
-                request.view_args = {"app_id": "app_123"}
-
-                if "suggested-questions" in route_path:
-                    # simplistic extraction for message_id
-                    parts = route_path.split("chat-messages/")
-                    if len(parts) > 1:
-                        request.view_args["message_id"] = parts[1].split("/")[0]
-                elif "messages/" in route_path and "chat-messages" not in route_path:
-                    parts = route_path.split("messages/")
-                    if len(parts) > 1:
-                        request.view_args["message_id"] = parts[1].split("/")[0]
-
-                api_instance = endpoint_class()
-
-                # Check if it has a dispatch_request or method
-                if hasattr(api_instance, method.lower()):
-                    yield api_instance, mock_db, request.view_args
-
-
-class TestMessageValidators:
-    def test_chat_messages_query_validators(self):
-        # Test empty_to_none
-        assert ChatMessagesQuery.empty_to_none("") is None
-        assert ChatMessagesQuery.empty_to_none("val") == "val"
-
-        # Test validate_uuid
-        assert ChatMessagesQuery.validate_uuid(None) is None
-        assert (
-            ChatMessagesQuery.validate_uuid("123e4567-e89b-12d3-a456-426614174000")
-            == "123e4567-e89b-12d3-a456-426614174000"
-        )
-
-    def test_message_feedback_validators(self):
-        assert (
-            MessageFeedbackPayload.validate_message_id("123e4567-e89b-12d3-a456-426614174000")
-            == "123e4567-e89b-12d3-a456-426614174000"
-        )
-
-    def test_feedback_export_validators(self):
-        assert FeedbackExportQuery.parse_bool(None) is None
-        assert FeedbackExportQuery.parse_bool(True) is True
-        assert FeedbackExportQuery.parse_bool("1") is True
-        assert FeedbackExportQuery.parse_bool("0") is False
-        assert FeedbackExportQuery.parse_bool("off") is False
-
-        with pytest.raises(ValueError):
-            FeedbackExportQuery.parse_bool("invalid")
-
-
-class TestMessageEndpoints:
-    def test_chat_message_list_not_found(self, app, mock_account, mock_app_model):
-        with setup_test_context(
-            app,
-            ChatMessageListApi,
-            "/apps/app_123/chat-messages",
-            "GET",
-            mock_account,
-            mock_app_model,
-            qs={"conversation_id": "123e4567-e89b-12d3-a456-426614174000"},
-        ) as (api, mock_db, v_args):
-            mock_db.session.scalar.side_effect = [True, None]
-
-            with pytest.raises(NotFound):
-                api.get(**v_args)
-
-    def test_chat_message_list_success(self, app, mock_account, mock_app_model):
-        with setup_test_context(
-            app,
-            ChatMessageListApi,
-            "/apps/app_123/chat-messages",
-            "GET",
-            mock_account,
-            mock_app_model,
-            qs={"conversation_id": "123e4567-e89b-12d3-a456-426614174000", "limit": 1},
-        ) as (api, mock_db, v_args):
-            mock_conv = MagicMock()
-            mock_conv.id = "123e4567-e89b-12d3-a456-426614174000"
-            mock_msg = MagicMock()
-            mock_msg.id = "msg_123"
-            mock_msg.feedbacks = []
-            mock_msg.annotation = None
-            mock_msg.annotation_hit_history = None
-            mock_msg.agent_thoughts = []
-            mock_msg.message_files = []
-            mock_msg.extra_contents = []
-            mock_msg.message = {}
-            mock_msg.message_metadata_dict = {}
-
-            # scalar() is called twice: first for conversation lookup, second for has_more check
-            mock_db.session.scalar.side_effect = [True, mock_conv, False]
-            scalars_result = MagicMock()
-            scalars_result.all.return_value = [mock_msg]
-            mock_db.session.scalars.return_value = scalars_result
-
-            resp = api.get(**v_args)
-            assert resp["limit"] == 1
-            assert resp["has_more"] is False
-            assert len(resp["data"]) == 1
-
-    def test_message_feedback_not_found(self, app, mock_account, mock_app_model):
-        with setup_test_context(
-            app,
-            MessageFeedbackApi,
-            "/apps/app_123/feedbacks",
-            "POST",
-            mock_account,
-            mock_app_model,
-            payload={"message_id": "123e4567-e89b-12d3-a456-426614174000"},
-        ) as (api, mock_db, v_args):
-            mock_db.session.scalar.side_effect = [True, None]
-
-            with pytest.raises(NotFound):
-                api.post(**v_args)
-
-    def test_message_feedback_success(self, app, mock_account, mock_app_model):
-        payload = {"message_id": "123e4567-e89b-12d3-a456-426614174000", "rating": "like"}
-        with setup_test_context(
-            app, MessageFeedbackApi, "/apps/app_123/feedbacks", "POST", mock_account, mock_app_model, payload=payload
-        ) as (api, mock_db, v_args):
-            mock_msg = MagicMock()
-            mock_msg.admin_feedback = None
-            mock_db.session.scalar.return_value = mock_msg
-
-            resp = api.post(**v_args)
-            assert resp == {"result": "success"}
-
-    def test_message_annotation_count(self, app, mock_account, mock_app_model):
-        with setup_test_context(
-            app, MessageAnnotationCountApi, "/apps/app_123/annotations/count", "GET", mock_account, mock_app_model
-        ) as (api, mock_db, v_args):
-            mock_db.session.scalar.return_value = 5
-
-            resp = api.get(**v_args)
-            assert resp == {"count": 5}
-
-    @patch("controllers.console.app.message.MessageService")
-    def test_message_suggested_questions_success(self, mock_msg_srv, app, mock_account, mock_app_model):
-        mock_msg_srv.get_suggested_questions_after_answer.return_value = ["q1", "q2"]
-
-        with setup_test_context(
-            app,
-            MessageSuggestedQuestionApi,
-            "/apps/app_123/chat-messages/msg_123/suggested-questions",
-            "GET",
-            mock_account,
-            mock_app_model,
-        ) as (api, mock_db, v_args):
-            resp = api.get(**v_args)
-            assert resp == {"data": ["q1", "q2"]}
-
-    @pytest.mark.parametrize(
-        ("exc", "expected_exc"),
-        [
-            (MessageNotExistsError, NotFound),
-            (ConversationNotExistsError, NotFound),
-            (ProviderTokenNotInitError, ProviderNotInitializeError),
-            (QuotaExceededError, ProviderQuotaExceededError),
-            (ModelCurrentlyNotSupportError, ProviderModelCurrentlyNotSupportError),
-            (SuggestedQuestionsAfterAnswerDisabledError, AppSuggestedQuestionsAfterAnswerDisabledError),
-            (Exception, InternalServerError),
-        ],
-    )
-    @patch("controllers.console.app.message.MessageService")
-    def test_message_suggested_questions_errors(
-        self, mock_msg_srv, exc, expected_exc, app, mock_account, mock_app_model
-    ):
-        mock_msg_srv.get_suggested_questions_after_answer.side_effect = exc()
-
-        with setup_test_context(
-            app,
-            MessageSuggestedQuestionApi,
-            "/apps/app_123/chat-messages/msg_123/suggested-questions",
-            "GET",
-            mock_account,
-            mock_app_model,
-        ) as (api, mock_db, v_args):
-            with pytest.raises(expected_exc):
-                api.get(**v_args)
-
-    @patch("services.feedback_service.FeedbackService.export_feedbacks")
-    def test_message_feedback_export_success(self, mock_export, app, mock_account, mock_app_model):
-        mock_export.return_value = {"exported": True}
-
-        with setup_test_context(
-            app, MessageFeedbackExportApi, "/apps/app_123/feedbacks/export", "GET", mock_account, mock_app_model
-        ) as (api, mock_db, v_args):
-            resp = api.get(**v_args)
-            assert resp == {"exported": True}
-
-    def test_message_api_get_success(self, app, mock_account, mock_app_model):
-        with setup_test_context(
-            app, MessageApi, "/apps/app_123/messages/msg_123", "GET", mock_account, mock_app_model
-        ) as (api, mock_db, v_args):
-            mock_msg = MagicMock()
-            mock_msg.id = "msg_123"
-            mock_msg.feedbacks = []
-            mock_msg.annotation = None
-            mock_msg.annotation_hit_history = None
-            mock_msg.agent_thoughts = []
-            mock_msg.message_files = []
-            mock_msg.extra_contents = []
-            mock_msg.message = {}
-            mock_msg.message_metadata_dict = {}
-
-            mock_db.session.scalar.return_value = mock_msg
-
-            resp = api.get(**v_args)
-            assert resp["id"] == "msg_123"

api/tests/unit_tests/controllers/console/app/test_model_config_api.py

@@ -92,10 +92,7 @@ def test_post_encrypts_agent_tool_parameters(app, monkeypatch: pytest.MonkeyPatc
     )
 
     session = MagicMock()
-    query = MagicMock()
-    query.where.return_value = query
-    query.first.return_value = original_config
-    session.query.return_value = query
+    session.get.return_value = original_config
     monkeypatch.setattr(model_config_module.db, "session", session)
 
     monkeypatch.setattr(

api/tests/unit_tests/controllers/console/app/test_statistic.py

@@ -1,275 +0,0 @@
-from decimal import Decimal
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask, request
-from werkzeug.local import LocalProxy
-
-from controllers.console.app.statistic import (
-    AverageResponseTimeStatistic,
-    AverageSessionInteractionStatistic,
-    DailyConversationStatistic,
-    DailyMessageStatistic,
-    DailyTerminalsStatistic,
-    DailyTokenCostStatistic,
-    TokensPerSecondStatistic,
-    UserSatisfactionRateStatistic,
-)
-from models import App, AppMode
-
-
-@pytest.fixture
-def app():
-    flask_app = Flask(__name__)
-    flask_app.config["TESTING"] = True
-    return flask_app
-
-
-@pytest.fixture
-def mock_account():
-    from models.account import Account, AccountStatus
-
-    account = MagicMock(spec=Account)
-    account.id = "user_123"
-    account.timezone = "UTC"
-    account.status = AccountStatus.ACTIVE
-    account.is_admin_or_owner = True
-    account.current_tenant.current_role = "owner"
-    account.has_edit_permission = True
-    return account
-
-
-@pytest.fixture
-def mock_app_model():
-    app_model = MagicMock(spec=App)
-    app_model.id = "app_123"
-    app_model.mode = AppMode.CHAT
-    app_model.tenant_id = "tenant_123"
-    return app_model
-
-
-@pytest.fixture(autouse=True)
-def mock_csrf():
-    with patch("libs.login.check_csrf_token") as mock:
-        yield mock
-
-
-def setup_test_context(
-    test_app, endpoint_class, route_path, mock_account, mock_app_model, mock_rs, mock_parse_ret=(None, None)
-):
-    with (
-        patch("controllers.console.app.statistic.db") as mock_db_stat,
-        patch("controllers.console.app.wraps.db") as mock_db_wraps,
-        patch("controllers.console.wraps.db", mock_db_wraps),
-        patch(
-            "controllers.console.app.statistic.current_account_with_tenant", return_value=(mock_account, "tenant_123")
-        ),
-        patch("controllers.console.app.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-        patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-    ):
-        mock_conn = MagicMock()
-        mock_conn.execute.return_value = mock_rs
-
-        mock_begin = MagicMock()
-        mock_begin.__enter__.return_value = mock_conn
-        mock_db_stat.engine.begin.return_value = mock_begin
-
-        mock_query = MagicMock()
-        mock_query.filter.return_value.first.return_value = mock_app_model
-        mock_query.filter.return_value.filter.return_value.first.return_value = mock_app_model
-        mock_query.where.return_value.first.return_value = mock_app_model
-        mock_query.where.return_value.where.return_value.first.return_value = mock_app_model
-        mock_db_wraps.session.query.return_value = mock_query
-
-        proxy_mock = LocalProxy(lambda: mock_account)
-
-        with patch("libs.login.current_user", proxy_mock), patch("flask_login.current_user", proxy_mock):
-            with test_app.test_request_context(route_path, method="GET"):
-                request.view_args = {"app_id": "app_123"}
-                api_instance = endpoint_class()
-                response = api_instance.get(app_id="app_123")
-                return response
-
-
-class TestStatisticEndpoints:
-    def test_daily_message_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.message_count = 10
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                DailyMessageStatistic,
-                "/apps/app_123/statistics/daily-messages?start=2023-01-01 00:00&end=2023-01-02 00:00",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["message_count"] == 10
-
-    def test_daily_conversation_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.conversation_count = 5
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                DailyConversationStatistic,
-                "/apps/app_123/statistics/daily-conversations",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["conversation_count"] == 5
-
-    def test_daily_terminals_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.terminal_count = 2
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                DailyTerminalsStatistic,
-                "/apps/app_123/statistics/daily-end-users",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["terminal_count"] == 2
-
-    def test_daily_token_cost_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.token_count = 100
-        mock_row.total_price = Decimal("0.02")
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                DailyTokenCostStatistic,
-                "/apps/app_123/statistics/token-costs",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["token_count"] == 100
-        assert response.json["data"][0]["total_price"] == "0.02"
-
-    def test_average_session_interaction_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.interactions = Decimal("3.523")
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                AverageSessionInteractionStatistic,
-                "/apps/app_123/statistics/average-session-interactions",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["interactions"] == 3.52
-
-    def test_user_satisfaction_rate_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.message_count = 100
-        mock_row.feedback_count = 10
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                UserSatisfactionRateStatistic,
-                "/apps/app_123/statistics/user-satisfaction-rate",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["rate"] == 100.0
-
-    def test_average_response_time_statistic(self, app, mock_account, mock_app_model):
-        mock_app_model.mode = AppMode.COMPLETION
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.latency = 1.234
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                AverageResponseTimeStatistic,
-                "/apps/app_123/statistics/average-response-time",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["latency"] == 1234.0
-
-    def test_tokens_per_second_statistic(self, app, mock_account, mock_app_model):
-        mock_row = MagicMock()
-        mock_row.date = "2023-01-01"
-        mock_row.tokens_per_second = 15.5
-        mock_row.interactions = Decimal(0)
-
-        with patch("controllers.console.app.statistic.parse_time_range", return_value=(None, None)):
-            response = setup_test_context(
-                app,
-                TokensPerSecondStatistic,
-                "/apps/app_123/statistics/tokens-per-second",
-                mock_account,
-                mock_app_model,
-                [mock_row],
-            )
-        assert response.status_code == 200
-        assert response.json["data"][0]["tps"] == 15.5
-
-    @patch("controllers.console.app.statistic.parse_time_range")
-    def test_invalid_time_range(self, mock_parse, app, mock_account, mock_app_model):
-        mock_parse.side_effect = ValueError("Invalid time")
-
-        from werkzeug.exceptions import BadRequest
-
-        with pytest.raises(BadRequest):
-            setup_test_context(
-                app,
-                DailyMessageStatistic,
-                "/apps/app_123/statistics/daily-messages?start=invalid&end=invalid",
-                mock_account,
-                mock_app_model,
-                [],
-            )
-
-    @patch("controllers.console.app.statistic.parse_time_range")
-    def test_time_range_params_passed(self, mock_parse, app, mock_account, mock_app_model):
-        import datetime
-
-        start = datetime.datetime.now()
-        end = datetime.datetime.now()
-        mock_parse.return_value = (start, end)
-
-        response = setup_test_context(
-            app,
-            DailyMessageStatistic,
-            "/apps/app_123/statistics/daily-messages?start=something&end=something",
-            mock_account,
-            mock_app_model,
-            [],
-        )
-        assert response.status_code == 200
-        mock_parse.assert_called_once()

api/tests/unit_tests/controllers/console/app/test_workflow_draft_variable.py

@@ -1,314 +0,0 @@
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask, request
-from werkzeug.local import LocalProxy
-
-from controllers.console.app.error import DraftWorkflowNotExist
-from controllers.console.app.workflow_draft_variable import (
-    ConversationVariableCollectionApi,
-    EnvironmentVariableCollectionApi,
-    NodeVariableCollectionApi,
-    SystemVariableCollectionApi,
-    VariableApi,
-    VariableResetApi,
-    WorkflowVariableCollectionApi,
-)
-from controllers.web.error import InvalidArgumentError, NotFoundError
-from models import App, AppMode
-from models.enums import DraftVariableType
-
-
-@pytest.fixture
-def app():
-    flask_app = Flask(__name__)
-    flask_app.config["TESTING"] = True
-    flask_app.config["RESTX_MASK_HEADER"] = "X-Fields"
-    return flask_app
-
-
-@pytest.fixture
-def mock_account():
-    from models.account import Account, AccountStatus
-
-    account = MagicMock(spec=Account)
-    account.id = "user_123"
-    account.timezone = "UTC"
-    account.status = AccountStatus.ACTIVE
-    account.is_admin_or_owner = True
-    account.current_tenant.current_role = "owner"
-    account.has_edit_permission = True
-    return account
-
-
-@pytest.fixture
-def mock_app_model():
-    app_model = MagicMock(spec=App)
-    app_model.id = "app_123"
-    app_model.mode = AppMode.WORKFLOW
-    app_model.tenant_id = "tenant_123"
-    return app_model
-
-
-@pytest.fixture(autouse=True)
-def mock_csrf():
-    with patch("libs.login.check_csrf_token") as mock:
-        yield mock
-
-
-def setup_test_context(test_app, endpoint_class, route_path, method, mock_account, mock_app_model, payload=None):
-    with (
-        patch("controllers.console.app.wraps.db") as mock_db_wraps,
-        patch("controllers.console.wraps.db", mock_db_wraps),
-        patch("controllers.console.app.workflow_draft_variable.db"),
-        patch("controllers.console.app.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-        patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-    ):
-        mock_query = MagicMock()
-        mock_query.filter.return_value.first.return_value = mock_app_model
-        mock_query.filter.return_value.filter.return_value.first.return_value = mock_app_model
-        mock_query.where.return_value.first.return_value = mock_app_model
-        mock_query.where.return_value.where.return_value.first.return_value = mock_app_model
-        mock_db_wraps.session.query.return_value = mock_query
-
-        proxy_mock = LocalProxy(lambda: mock_account)
-
-        with patch("libs.login.current_user", proxy_mock), patch("flask_login.current_user", proxy_mock):
-            with test_app.test_request_context(route_path, method=method, json=payload):
-                request.view_args = {"app_id": "app_123"}
-                # extract node_id or variable_id from path manually since view_args overrides
-                if "nodes/" in route_path:
-                    request.view_args["node_id"] = route_path.split("nodes/")[1].split("/")[0]
-                if "variables/" in route_path:
-                    # simplistic extraction
-                    parts = route_path.split("variables/")
-                    if len(parts) > 1 and parts[1] and parts[1] != "reset":
-                        request.view_args["variable_id"] = parts[1].split("/")[0]
-
-                api_instance = endpoint_class()
-                # we just call dispatch_request to avoid manual argument passing
-                if hasattr(api_instance, method.lower()):
-                    func = getattr(api_instance, method.lower())
-                    return func(**request.view_args)
-
-
-class TestWorkflowDraftVariableEndpoints:
-    @staticmethod
-    def _mock_workflow_variable(variable_type: DraftVariableType = DraftVariableType.NODE) -> MagicMock:
-        class DummyValueType:
-            def exposed_type(self):
-                return DraftVariableType.NODE
-
-        mock_var = MagicMock()
-        mock_var.app_id = "app_123"
-        mock_var.id = "var_123"
-        mock_var.user_id = "user_123"
-        mock_var.name = "test_var"
-        mock_var.description = ""
-        mock_var.get_variable_type.return_value = variable_type
-        mock_var.get_selector.return_value = []
-        mock_var.value_type = DummyValueType()
-        mock_var.edited = False
-        mock_var.visible = True
-        mock_var.file_id = None
-        mock_var.variable_file = None
-        mock_var.is_truncated.return_value = False
-        mock_var.get_value.return_value.model_copy.return_value.value = "test_value"
-        return mock_var
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowService")
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_workflow_variable_collection_get_success(
-        self, mock_draft_srv, mock_wf_srv, app, mock_account, mock_app_model
-    ):
-        mock_wf_srv.return_value.is_workflow_exist.return_value = True
-        from services.workflow_draft_variable_service import WorkflowDraftVariableList
-
-        mock_draft_srv.return_value.list_variables_without_values.return_value = WorkflowDraftVariableList(
-            variables=[], total=0
-        )
-
-        resp = setup_test_context(
-            app,
-            WorkflowVariableCollectionApi,
-            "/apps/app_123/workflows/draft/variables?page=1&limit=20",
-            "GET",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp == {"items": [], "total": 0}
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowService")
-    def test_workflow_variable_collection_get_not_exist(self, mock_wf_srv, app, mock_account, mock_app_model):
-        mock_wf_srv.return_value.is_workflow_exist.return_value = False
-
-        with pytest.raises(DraftWorkflowNotExist):
-            setup_test_context(
-                app,
-                WorkflowVariableCollectionApi,
-                "/apps/app_123/workflows/draft/variables",
-                "GET",
-                mock_account,
-                mock_app_model,
-            )
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_workflow_variable_collection_delete(self, mock_draft_srv, app, mock_account, mock_app_model):
-        resp = setup_test_context(
-            app,
-            WorkflowVariableCollectionApi,
-            "/apps/app_123/workflows/draft/variables",
-            "DELETE",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp.status_code == 204
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_node_variable_collection_get_success(self, mock_draft_srv, app, mock_account, mock_app_model):
-        from services.workflow_draft_variable_service import WorkflowDraftVariableList
-
-        mock_draft_srv.return_value.list_node_variables.return_value = WorkflowDraftVariableList(variables=[])
-        resp = setup_test_context(
-            app,
-            NodeVariableCollectionApi,
-            "/apps/app_123/workflows/draft/nodes/node_123/variables",
-            "GET",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp == {"items": []}
-
-    def test_node_variable_collection_get_invalid_node_id(self, app, mock_account, mock_app_model):
-        with pytest.raises(InvalidArgumentError):
-            setup_test_context(
-                app,
-                NodeVariableCollectionApi,
-                "/apps/app_123/workflows/draft/nodes/sys/variables",
-                "GET",
-                mock_account,
-                mock_app_model,
-            )
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_node_variable_collection_delete(self, mock_draft_srv, app, mock_account, mock_app_model):
-        resp = setup_test_context(
-            app,
-            NodeVariableCollectionApi,
-            "/apps/app_123/workflows/draft/nodes/node_123/variables",
-            "DELETE",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp.status_code == 204
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_variable_api_get_success(self, mock_draft_srv, app, mock_account, mock_app_model):
-        mock_draft_srv.return_value.get_variable.return_value = self._mock_workflow_variable()
-
-        resp = setup_test_context(
-            app, VariableApi, "/apps/app_123/workflows/draft/variables/var_123", "GET", mock_account, mock_app_model
-        )
-        assert resp["id"] == "var_123"
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_variable_api_get_not_found(self, mock_draft_srv, app, mock_account, mock_app_model):
-        mock_draft_srv.return_value.get_variable.return_value = None
-
-        with pytest.raises(NotFoundError):
-            setup_test_context(
-                app, VariableApi, "/apps/app_123/workflows/draft/variables/var_123", "GET", mock_account, mock_app_model
-            )
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_variable_api_patch_success(self, mock_draft_srv, app, mock_account, mock_app_model):
-        mock_draft_srv.return_value.get_variable.return_value = self._mock_workflow_variable()
-
-        resp = setup_test_context(
-            app,
-            VariableApi,
-            "/apps/app_123/workflows/draft/variables/var_123",
-            "PATCH",
-            mock_account,
-            mock_app_model,
-            payload={"name": "new_name"},
-        )
-        assert resp["id"] == "var_123"
-        mock_draft_srv.return_value.update_variable.assert_called_once()
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_variable_api_delete_success(self, mock_draft_srv, app, mock_account, mock_app_model):
-        mock_draft_srv.return_value.get_variable.return_value = self._mock_workflow_variable()
-
-        resp = setup_test_context(
-            app, VariableApi, "/apps/app_123/workflows/draft/variables/var_123", "DELETE", mock_account, mock_app_model
-        )
-        assert resp.status_code == 204
-        mock_draft_srv.return_value.delete_variable.assert_called_once()
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowService")
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_variable_reset_api_put_success(self, mock_draft_srv, mock_wf_srv, app, mock_account, mock_app_model):
-        mock_wf_srv.return_value.get_draft_workflow.return_value = MagicMock()
-        mock_draft_srv.return_value.get_variable.return_value = self._mock_workflow_variable()
-        mock_draft_srv.return_value.reset_variable.return_value = None  # means no content
-
-        resp = setup_test_context(
-            app,
-            VariableResetApi,
-            "/apps/app_123/workflows/draft/variables/var_123/reset",
-            "PUT",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp.status_code == 204
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowService")
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_conversation_variable_collection_get(self, mock_draft_srv, mock_wf_srv, app, mock_account, mock_app_model):
-        mock_wf_srv.return_value.get_draft_workflow.return_value = MagicMock()
-        from services.workflow_draft_variable_service import WorkflowDraftVariableList
-
-        mock_draft_srv.return_value.list_conversation_variables.return_value = WorkflowDraftVariableList(variables=[])
-
-        resp = setup_test_context(
-            app,
-            ConversationVariableCollectionApi,
-            "/apps/app_123/workflows/draft/conversation-variables",
-            "GET",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp == {"items": []}
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowDraftVariableService")
-    def test_system_variable_collection_get(self, mock_draft_srv, app, mock_account, mock_app_model):
-        from services.workflow_draft_variable_service import WorkflowDraftVariableList
-
-        mock_draft_srv.return_value.list_system_variables.return_value = WorkflowDraftVariableList(variables=[])
-
-        resp = setup_test_context(
-            app,
-            SystemVariableCollectionApi,
-            "/apps/app_123/workflows/draft/system-variables",
-            "GET",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp == {"items": []}
-
-    @patch("controllers.console.app.workflow_draft_variable.WorkflowService")
-    def test_environment_variable_collection_get(self, mock_wf_srv, app, mock_account, mock_app_model):
-        mock_wf = MagicMock()
-        mock_wf.environment_variables = []
-        mock_wf_srv.return_value.get_draft_workflow.return_value = mock_wf
-
-        resp = setup_test_context(
-            app,
-            EnvironmentVariableCollectionApi,
-            "/apps/app_123/workflows/draft/environment-variables",
-            "GET",
-            mock_account,
-            mock_app_model,
-        )
-        assert resp == {"items": []}

api/tests/unit_tests/controllers/console/app/test_wraps.py

@@ -11,10 +11,8 @@ from models.model import AppMode
 
 def test_get_app_model_injects_model(monkeypatch: pytest.MonkeyPatch) -> None:
     app_model = SimpleNamespace(id="app-1", mode=AppMode.CHAT.value, status="normal", tenant_id="t1")
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
-
     monkeypatch.setattr(wraps_module, "current_account_with_tenant", lambda: (None, "t1"))
-    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(scalar=lambda *_args, **_kwargs: app_model))
 
     @wraps_module.get_app_model
     def handler(app_model):
@@ -25,10 +23,8 @@ def test_get_app_model_injects_model(monkeypatch: pytest.MonkeyPatch) -> None:
 
 def test_get_app_model_rejects_wrong_mode(monkeypatch: pytest.MonkeyPatch) -> None:
     app_model = SimpleNamespace(id="app-1", mode=AppMode.CHAT.value, status="normal", tenant_id="t1")
-    query = SimpleNamespace(where=lambda *_args, **_kwargs: query, first=lambda: app_model)
-
     monkeypatch.setattr(wraps_module, "current_account_with_tenant", lambda: (None, "t1"))
-    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(query=lambda *_args, **_kwargs: query))
+    monkeypatch.setattr(wraps_module.db, "session", SimpleNamespace(scalar=lambda *_args, **_kwargs: app_model))
 
     @wraps_module.get_app_model(mode=[AppMode.COMPLETION])
     def handler(app_model):

api/tests/unit_tests/controllers/console/auth/test_data_source_bearer_auth.py

@@ -1,209 +0,0 @@
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask
-
-from controllers.console.auth.data_source_bearer_auth import (
-    ApiKeyAuthDataSource,
-    ApiKeyAuthDataSourceBinding,
-    ApiKeyAuthDataSourceBindingDelete,
-)
-from controllers.console.auth.error import ApiKeyAuthFailedError
-
-
-class TestApiKeyAuthDataSource:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        app.config["WTF_CSRF_ENABLED"] = False
-        return app
-
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.get_provider_auth_list")
-    def test_get_api_key_auth_data_source(self, mock_get_list, mock_db, mock_csrf, app):
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        mock_binding = MagicMock()
-        mock_binding.id = "bind_123"
-        mock_binding.category = "api_key"
-        mock_binding.provider = "custom_provider"
-        mock_binding.disabled = False
-        mock_binding.created_at.timestamp.return_value = 1620000000
-        mock_binding.updated_at.timestamp.return_value = 1620000001
-
-        mock_get_list.return_value = [mock_binding]
-
-        with (
-            patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-            patch(
-                "controllers.console.auth.data_source_bearer_auth.current_account_with_tenant",
-                return_value=(mock_account, "tenant_123"),
-            ),
-        ):
-            with app.test_request_context("/console/api/api-key-auth/data-source", method="GET"):
-                proxy_mock = MagicMock()
-                proxy_mock._get_current_object.return_value = mock_account
-                with patch("libs.login.current_user", proxy_mock):
-                    api_instance = ApiKeyAuthDataSource()
-                    response = api_instance.get()
-
-        assert "sources" in response
-        assert len(response["sources"]) == 1
-        assert response["sources"][0]["provider"] == "custom_provider"
-
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.get_provider_auth_list")
-    def test_get_api_key_auth_data_source_empty(self, mock_get_list, mock_db, mock_csrf, app):
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        mock_get_list.return_value = None
-
-        with (
-            patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-            patch(
-                "controllers.console.auth.data_source_bearer_auth.current_account_with_tenant",
-                return_value=(mock_account, "tenant_123"),
-            ),
-        ):
-            with app.test_request_context("/console/api/api-key-auth/data-source", method="GET"):
-                proxy_mock = MagicMock()
-                proxy_mock._get_current_object.return_value = mock_account
-                with patch("libs.login.current_user", proxy_mock):
-                    api_instance = ApiKeyAuthDataSource()
-                    response = api_instance.get()
-
-        assert "sources" in response
-        assert len(response["sources"]) == 0
-
-
-class TestApiKeyAuthDataSourceBinding:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        app.config["WTF_CSRF_ENABLED"] = False
-        return app
-
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.create_provider_auth")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.validate_api_key_auth_args")
-    def test_create_binding_successful(self, mock_validate, mock_create, mock_db, mock_csrf, app):
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        with (
-            patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-            patch(
-                "controllers.console.auth.data_source_bearer_auth.current_account_with_tenant",
-                return_value=(mock_account, "tenant_123"),
-            ),
-        ):
-            with app.test_request_context(
-                "/console/api/api-key-auth/data-source/binding",
-                method="POST",
-                json={"category": "api_key", "provider": "custom", "credentials": {"key": "value"}},
-            ):
-                proxy_mock = MagicMock()
-                proxy_mock._get_current_object.return_value = mock_account
-                with patch("libs.login.current_user", proxy_mock), patch("flask_login.current_user", proxy_mock):
-                    api_instance = ApiKeyAuthDataSourceBinding()
-                    response = api_instance.post()
-
-        assert response[0]["result"] == "success"
-        assert response[1] == 200
-        mock_validate.assert_called_once()
-        mock_create.assert_called_once()
-
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.create_provider_auth")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.validate_api_key_auth_args")
-    def test_create_binding_failure(self, mock_validate, mock_create, mock_db, mock_csrf, app):
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        mock_create.side_effect = ValueError("Invalid structure")
-
-        with (
-            patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-            patch(
-                "controllers.console.auth.data_source_bearer_auth.current_account_with_tenant",
-                return_value=(mock_account, "tenant_123"),
-            ),
-        ):
-            with app.test_request_context(
-                "/console/api/api-key-auth/data-source/binding",
-                method="POST",
-                json={"category": "api_key", "provider": "custom", "credentials": {"key": "value"}},
-            ):
-                proxy_mock = MagicMock()
-                proxy_mock._get_current_object.return_value = mock_account
-                with patch("libs.login.current_user", proxy_mock), patch("flask_login.current_user", proxy_mock):
-                    api_instance = ApiKeyAuthDataSourceBinding()
-                    with pytest.raises(ApiKeyAuthFailedError, match="Invalid structure"):
-                        api_instance.post()
-
-
-class TestApiKeyAuthDataSourceBindingDelete:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        app.config["WTF_CSRF_ENABLED"] = False
-        return app
-
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_bearer_auth.ApiKeyAuthService.delete_provider_auth")
-    def test_delete_binding_successful(self, mock_delete, mock_db, mock_csrf, app):
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        with (
-            patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, "tenant_123")),
-            patch(
-                "controllers.console.auth.data_source_bearer_auth.current_account_with_tenant",
-                return_value=(mock_account, "tenant_123"),
-            ),
-        ):
-            with app.test_request_context("/console/api/api-key-auth/data-source/binding_123", method="DELETE"):
-                proxy_mock = MagicMock()
-                proxy_mock._get_current_object.return_value = mock_account
-                with patch("libs.login.current_user", proxy_mock), patch("flask_login.current_user", proxy_mock):
-                    api_instance = ApiKeyAuthDataSourceBindingDelete()
-                    response = api_instance.delete("binding_123")
-
-        assert response[0]["result"] == "success"
-        assert response[1] == 204
-        mock_delete.assert_called_once_with("tenant_123", "binding_123")

api/tests/unit_tests/controllers/console/auth/test_data_source_oauth.py

@@ -1,192 +0,0 @@
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask
-from werkzeug.local import LocalProxy
-
-from controllers.console.auth.data_source_oauth import (
-    OAuthDataSource,
-    OAuthDataSourceBinding,
-    OAuthDataSourceCallback,
-    OAuthDataSourceSync,
-)
-
-
-class TestOAuthDataSource:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    @patch("flask_login.current_user")
-    @patch("libs.login.current_user")
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.data_source_oauth.dify_config.NOTION_INTEGRATION_TYPE", None)
-    def test_get_oauth_url_successful(
-        self, mock_db, mock_csrf, mock_libs_user, mock_flask_user, mock_get_providers, app
-    ):
-        mock_oauth_provider = MagicMock()
-        mock_oauth_provider.get_authorization_url.return_value = "http://oauth.provider/auth"
-        mock_get_providers.return_value = {"notion": mock_oauth_provider}
-
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-        mock_libs_user.return_value = mock_account
-        mock_flask_user.return_value = mock_account
-
-        # also patch current_account_with_tenant
-        with patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, MagicMock())):
-            with app.test_request_context("/console/api/oauth/data-source/notion", method="GET"):
-                proxy_mock = LocalProxy(lambda: mock_account)
-                with patch("libs.login.current_user", proxy_mock):
-                    api_instance = OAuthDataSource()
-                    response = api_instance.get("notion")
-
-        assert response[0]["data"] == "http://oauth.provider/auth"
-        assert response[1] == 200
-        mock_oauth_provider.get_authorization_url.assert_called_once()
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    @patch("flask_login.current_user")
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    def test_get_oauth_url_invalid_provider(self, mock_db, mock_csrf, mock_flask_user, mock_get_providers, app):
-        mock_get_providers.return_value = {"notion": MagicMock()}
-
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        with patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, MagicMock())):
-            with app.test_request_context("/console/api/oauth/data-source/unknown_provider", method="GET"):
-                proxy_mock = LocalProxy(lambda: mock_account)
-                with patch("libs.login.current_user", proxy_mock):
-                    api_instance = OAuthDataSource()
-                    response = api_instance.get("unknown_provider")
-
-        assert response[0]["error"] == "Invalid provider"
-        assert response[1] == 400
-
-
-class TestOAuthDataSourceCallback:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    def test_oauth_callback_successful(self, mock_get_providers, app):
-        provider_mock = MagicMock()
-        mock_get_providers.return_value = {"notion": provider_mock}
-
-        with app.test_request_context("/console/api/oauth/data-source/notion/callback?code=mock_code", method="GET"):
-            api_instance = OAuthDataSourceCallback()
-            response = api_instance.get("notion")
-
-        assert response.status_code == 302
-        assert "code=mock_code" in response.location
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    def test_oauth_callback_missing_code(self, mock_get_providers, app):
-        provider_mock = MagicMock()
-        mock_get_providers.return_value = {"notion": provider_mock}
-
-        with app.test_request_context("/console/api/oauth/data-source/notion/callback", method="GET"):
-            api_instance = OAuthDataSourceCallback()
-            response = api_instance.get("notion")
-
-        assert response.status_code == 302
-        assert "error=Access denied" in response.location
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    def test_oauth_callback_invalid_provider(self, mock_get_providers, app):
-        mock_get_providers.return_value = {"notion": MagicMock()}
-
-        with app.test_request_context("/console/api/oauth/data-source/invalid/callback?code=mock_code", method="GET"):
-            api_instance = OAuthDataSourceCallback()
-            response = api_instance.get("invalid")
-
-        assert response[0]["error"] == "Invalid provider"
-        assert response[1] == 400
-
-
-class TestOAuthDataSourceBinding:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    def test_get_binding_successful(self, mock_get_providers, app):
-        mock_provider = MagicMock()
-        mock_provider.get_access_token.return_value = None
-        mock_get_providers.return_value = {"notion": mock_provider}
-
-        with app.test_request_context("/console/api/oauth/data-source/notion/binding?code=auth_code_123", method="GET"):
-            api_instance = OAuthDataSourceBinding()
-            response = api_instance.get("notion")
-
-        assert response[0]["result"] == "success"
-        assert response[1] == 200
-        mock_provider.get_access_token.assert_called_once_with("auth_code_123")
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    def test_get_binding_missing_code(self, mock_get_providers, app):
-        mock_get_providers.return_value = {"notion": MagicMock()}
-
-        with app.test_request_context("/console/api/oauth/data-source/notion/binding?code=", method="GET"):
-            api_instance = OAuthDataSourceBinding()
-            response = api_instance.get("notion")
-
-        assert response[0]["error"] == "Invalid code"
-        assert response[1] == 400
-
-
-class TestOAuthDataSourceSync:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @patch("controllers.console.auth.data_source_oauth.get_oauth_providers")
-    @patch("libs.login.check_csrf_token")
-    @patch("controllers.console.wraps.db")
-    def test_sync_successful(self, mock_db, mock_csrf, mock_get_providers, app):
-        mock_provider = MagicMock()
-        mock_provider.sync_data_source.return_value = None
-        mock_get_providers.return_value = {"notion": mock_provider}
-
-        from models.account import Account, AccountStatus
-
-        mock_account = MagicMock(spec=Account)
-        mock_account.id = "user_123"
-        mock_account.status = AccountStatus.ACTIVE
-        mock_account.is_admin_or_owner = True
-        mock_account.current_tenant.current_role = "owner"
-
-        with patch("controllers.console.wraps.current_account_with_tenant", return_value=(mock_account, MagicMock())):
-            with app.test_request_context("/console/api/oauth/data-source/notion/binding_123/sync", method="GET"):
-                proxy_mock = LocalProxy(lambda: mock_account)
-                with patch("libs.login.current_user", proxy_mock):
-                    api_instance = OAuthDataSourceSync()
-                    # The route pattern uses <uuid:binding_id>, so we just pass a string for unit testing
-                    response = api_instance.get("notion", "binding_123")
-
-        assert response[0]["result"] == "success"
-        assert response[1] == 200
-        mock_provider.sync_data_source.assert_called_once_with("binding_123")

api/tests/unit_tests/controllers/console/auth/test_oauth_server.py

@@ -1,417 +0,0 @@
-from unittest.mock import MagicMock, patch
-
-import pytest
-from flask import Flask
-from werkzeug.exceptions import BadRequest, NotFound
-
-from controllers.console.auth.oauth_server import (
-    OAuthServerAppApi,
-    OAuthServerUserAccountApi,
-    OAuthServerUserAuthorizeApi,
-    OAuthServerUserTokenApi,
-)
-
-
-class TestOAuthServerAppApi:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @pytest.fixture
-    def mock_oauth_provider_app(self):
-        from models.model import OAuthProviderApp
-
-        oauth_app = MagicMock(spec=OAuthProviderApp)
-        oauth_app.client_id = "test_client_id"
-        oauth_app.redirect_uris = ["http://localhost/callback"]
-        oauth_app.app_icon = "icon_url"
-        oauth_app.app_label = "Test App"
-        oauth_app.scope = "read,write"
-        return oauth_app
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_successful_post(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider",
-            method="POST",
-            json={"client_id": "test_client_id", "redirect_uri": "http://localhost/callback"},
-        ):
-            api_instance = OAuthServerAppApi()
-            response = api_instance.post()
-
-        assert response["app_icon"] == "icon_url"
-        assert response["app_label"] == "Test App"
-        assert response["scope"] == "read,write"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_invalid_redirect_uri(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider",
-            method="POST",
-            json={"client_id": "test_client_id", "redirect_uri": "http://invalid/callback"},
-        ):
-            api_instance = OAuthServerAppApi()
-            with pytest.raises(BadRequest, match="redirect_uri is invalid"):
-                api_instance.post()
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_invalid_client_id(self, mock_get_app, mock_db, app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = None
-
-        with app.test_request_context(
-            "/oauth/provider",
-            method="POST",
-            json={"client_id": "test_invalid_client_id", "redirect_uri": "http://localhost/callback"},
-        ):
-            api_instance = OAuthServerAppApi()
-            with pytest.raises(NotFound, match="client_id is invalid"):
-                api_instance.post()
-
-
-class TestOAuthServerUserAuthorizeApi:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @pytest.fixture
-    def mock_oauth_provider_app(self):
-        oauth_app = MagicMock()
-        oauth_app.client_id = "test_client_id"
-        return oauth_app
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    @patch("controllers.console.auth.oauth_server.current_account_with_tenant")
-    @patch("controllers.console.wraps.current_account_with_tenant")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_authorization_code")
-    @patch("libs.login.check_csrf_token")
-    def test_successful_authorize(
-        self, mock_csrf, mock_sign, mock_wrap_current, mock_current, mock_get_app, mock_db, app, mock_oauth_provider_app
-    ):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        mock_account = MagicMock()
-        mock_account.id = "user_123"
-        from models.account import AccountStatus
-
-        mock_account.status = AccountStatus.ACTIVE
-
-        mock_current.return_value = (mock_account, MagicMock())
-        mock_wrap_current.return_value = (mock_account, MagicMock())
-
-        mock_sign.return_value = "auth_code_123"
-
-        with app.test_request_context("/oauth/provider/authorize", method="POST", json={"client_id": "test_client_id"}):
-            with patch("libs.login.current_user", mock_account):
-                api_instance = OAuthServerUserAuthorizeApi()
-                response = api_instance.post()
-
-        assert response["code"] == "auth_code_123"
-        mock_sign.assert_called_once_with("test_client_id", "user_123")
-
-
-class TestOAuthServerUserTokenApi:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @pytest.fixture
-    def mock_oauth_provider_app(self):
-        from models.model import OAuthProviderApp
-
-        oauth_app = MagicMock(spec=OAuthProviderApp)
-        oauth_app.client_id = "test_client_id"
-        oauth_app.client_secret = "test_secret"
-        oauth_app.redirect_uris = ["http://localhost/callback"]
-        return oauth_app
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_access_token")
-    def test_authorization_code_grant(self, mock_sign, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-        mock_sign.return_value = ("access_123", "refresh_123")
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "authorization_code",
-                "code": "auth_code",
-                "client_secret": "test_secret",
-                "redirect_uri": "http://localhost/callback",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            response = api_instance.post()
-
-        assert response["access_token"] == "access_123"
-        assert response["refresh_token"] == "refresh_123"
-        assert response["token_type"] == "Bearer"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_authorization_code_grant_missing_code(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "authorization_code",
-                "client_secret": "test_secret",
-                "redirect_uri": "http://localhost/callback",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            with pytest.raises(BadRequest, match="code is required"):
-                api_instance.post()
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_authorization_code_grant_invalid_secret(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "authorization_code",
-                "code": "auth_code",
-                "client_secret": "invalid_secret",
-                "redirect_uri": "http://localhost/callback",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            with pytest.raises(BadRequest, match="client_secret is invalid"):
-                api_instance.post()
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_authorization_code_grant_invalid_redirect_uri(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "authorization_code",
-                "code": "auth_code",
-                "client_secret": "test_secret",
-                "redirect_uri": "http://invalid/callback",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            with pytest.raises(BadRequest, match="redirect_uri is invalid"):
-                api_instance.post()
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.sign_oauth_access_token")
-    def test_refresh_token_grant(self, mock_sign, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-        mock_sign.return_value = ("new_access", "new_refresh")
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={"client_id": "test_client_id", "grant_type": "refresh_token", "refresh_token": "refresh_123"},
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            response = api_instance.post()
-
-        assert response["access_token"] == "new_access"
-        assert response["refresh_token"] == "new_refresh"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_refresh_token_grant_missing_token(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "refresh_token",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            with pytest.raises(BadRequest, match="refresh_token is required"):
-                api_instance.post()
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_invalid_grant_type(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/token",
-            method="POST",
-            json={
-                "client_id": "test_client_id",
-                "grant_type": "invalid_grant",
-            },
-        ):
-            api_instance = OAuthServerUserTokenApi()
-            with pytest.raises(BadRequest, match="invalid grant_type"):
-                api_instance.post()
-
-
-class TestOAuthServerUserAccountApi:
-    @pytest.fixture
-    def app(self):
-        app = Flask(__name__)
-        app.config["TESTING"] = True
-        return app
-
-    @pytest.fixture
-    def mock_oauth_provider_app(self):
-        from models.model import OAuthProviderApp
-
-        oauth_app = MagicMock(spec=OAuthProviderApp)
-        oauth_app.client_id = "test_client_id"
-        return oauth_app
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.validate_oauth_access_token")
-    def test_successful_account_retrieval(self, mock_validate, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        mock_account = MagicMock()
-        mock_account.name = "Test User"
-        mock_account.email = "test@example.com"
-        mock_account.avatar = "avatar_url"
-        mock_account.interface_language = "en-US"
-        mock_account.timezone = "UTC"
-        mock_validate.return_value = mock_account
-
-        with app.test_request_context(
-            "/oauth/provider/account",
-            method="POST",
-            json={"client_id": "test_client_id"},
-            headers={"Authorization": "Bearer valid_access_token"},
-        ):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response["name"] == "Test User"
-        assert response["email"] == "test@example.com"
-        assert response["avatar"] == "avatar_url"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_missing_authorization_header(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context("/oauth/provider/account", method="POST", json={"client_id": "test_client_id"}):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response.status_code == 401
-        assert response.json["error"] == "Authorization header is required"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_invalid_authorization_header_format(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/account",
-            method="POST",
-            json={"client_id": "test_client_id"},
-            headers={"Authorization": "InvalidFormat"},
-        ):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response.status_code == 401
-        assert response.json["error"] == "Invalid Authorization header format"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_invalid_token_type(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/account",
-            method="POST",
-            json={"client_id": "test_client_id"},
-            headers={"Authorization": "Basic something"},
-        ):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response.status_code == 401
-        assert response.json["error"] == "token_type is invalid"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    def test_missing_access_token(self, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-
-        with app.test_request_context(
-            "/oauth/provider/account",
-            method="POST",
-            json={"client_id": "test_client_id"},
-            headers={"Authorization": "Bearer   "},
-        ):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response.status_code == 401
-        assert response.json["error"] == "Invalid Authorization header format"
-
-    @patch("controllers.console.wraps.db")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.get_oauth_provider_app")
-    @patch("controllers.console.auth.oauth_server.OAuthServerService.validate_oauth_access_token")
-    def test_invalid_access_token(self, mock_validate, mock_get_app, mock_db, app, mock_oauth_provider_app):
-        mock_db.session.query.return_value.first.return_value = MagicMock()
-        mock_get_app.return_value = mock_oauth_provider_app
-        mock_validate.return_value = None
-
-        with app.test_request_context(
-            "/oauth/provider/account",
-            method="POST",
-            json={"client_id": "test_client_id"},
-            headers={"Authorization": "Bearer invalid_token"},
-        ):
-            api_instance = OAuthServerUserAccountApi()
-            response = api_instance.post()
-
-        assert response.status_code == 401
-        assert response.json["error"] == "access_token or client_id is invalid"

api/tests/unit_tests/controllers/console/datasets/test_data_source.py

@@ -11,6 +11,7 @@ from controllers.console.datasets.data_source import (
     DataSourceNotionDocumentSyncApi,
     DataSourceNotionListApi,
 )
+from core.rag.index_processor.constant.index_type import IndexStructureType
 
 
 def unwrap(func):
@@ -343,7 +344,7 @@ class TestDataSourceNotionApi:
                 }
             ],
             "process_rule": {"rules": {}},
-            "doc_form": "text_model",
+            "doc_form": IndexStructureType.PARAGRAPH_INDEX,
             "doc_language": "English",
         }
 

api/tests/unit_tests/controllers/console/datasets/test_datasets.py

@@ -28,6 +28,7 @@ from controllers.console.datasets.datasets import (
 from controllers.console.datasets.error import DatasetInUseError, DatasetNameDuplicateError, IndexingEstimateError
 from core.errors.error import LLMBadRequestError, ProviderTokenNotInitError
 from core.provider_manager import ProviderManager
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from extensions.storage.storage_type import StorageType
 from models.enums import CreatorUserRole
 from models.model import ApiToken, UploadFile
@@ -1146,7 +1147,7 @@ class TestDatasetIndexingEstimateApi:
             },
             "process_rule": {"chunk_size": 100},
             "indexing_technique": "high_quality",
-            "doc_form": "text_model",
+            "doc_form": IndexStructureType.PARAGRAPH_INDEX,
             "doc_language": "English",
             "dataset_id": None,
         }

api/tests/unit_tests/controllers/console/datasets/test_datasets_document.py

@@ -30,6 +30,7 @@ from controllers.console.datasets.error import (
     InvalidActionError,
     InvalidMetadataError,
 )
+from core.rag.index_processor.constant.index_type import IndexStructureType
 from models.enums import DataSourceType, IndexingStatus
 
 
@@ -66,7 +67,7 @@ def document():
         indexing_status=IndexingStatus.INDEXING,
         data_source_type=DataSourceType.UPLOAD_FILE,
         data_source_info_dict={"upload_file_id": "file-1"},
-        doc_form="text",
+        doc_form=IndexStructureType.PARAGRAPH_INDEX,
         archived=False,
         is_paused=False,
         dataset_process_rule=None,
@@ -765,8 +766,8 @@ class TestDocumentGenerateSummaryApi:
             summary_index_setting={"enable": True},
         )
 
-        doc1 = MagicMock(id="doc-1", doc_form="qa_model")
-        doc2 = MagicMock(id="doc-2", doc_form="text")
+        doc1 = MagicMock(id="doc-1", doc_form=IndexStructureType.QA_INDEX)
+        doc2 = MagicMock(id="doc-2", doc_form=IndexStructureType.PARAGRAPH_INDEX)
 
         payload = {"document_list": ["doc-1", "doc-2"]}
 
@@ -822,7 +823,7 @@ class TestDocumentIndexingEstimateApi:
             data_source_type=DataSourceType.UPLOAD_FILE,
             data_source_info_dict={"upload_file_id": "file-1"},
             tenant_id="tenant-1",
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             dataset_process_rule=None,
         )
 
@@ -849,7 +850,7 @@ class TestDocumentIndexingEstimateApi:
             data_source_type=DataSourceType.UPLOAD_FILE,
             data_source_info_dict={"upload_file_id": "file-1"},
             tenant_id="tenant-1",
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             dataset_process_rule=None,
         )
 
@@ -973,7 +974,7 @@ class TestDocumentBatchIndexingEstimateApi:
                 "mode": "single",
                 "only_main_content": True,
             },
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
 
         with (
@@ -1001,7 +1002,7 @@ class TestDocumentBatchIndexingEstimateApi:
                 "notion_page_id": "p1",
                 "type": "page",
             },
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
 
         with (
@@ -1024,7 +1025,7 @@ class TestDocumentBatchIndexingEstimateApi:
             indexing_status=IndexingStatus.INDEXING,
             data_source_type="unknown",
             data_source_info_dict={},
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
         )
 
         with app.test_request_context("/"), patch.object(api, "get_batch_documents", return_value=[document]):
@@ -1353,7 +1354,7 @@ class TestDocumentIndexingEdgeCases:
             data_source_type=DataSourceType.UPLOAD_FILE,
             data_source_info_dict={"upload_file_id": "file-1"},
             tenant_id="tenant-1",
-            doc_form="text",
+            doc_form=IndexStructureType.PARAGRAPH_INDEX,
             dataset_process_rule=None,
         )