Fix OAuth callback URL examples in docs — now use /api/v1/auth/oauth/<channel>/callback (was stale /v1/user/oauth/callback).
Co-authored-by: 谢金城 <xiejincheng@xgd.com>
Co-authored-by: Jin Hai <haijin.chn@gmail.com>
### Summary
GET /api/v1/files/{id} now sets attachment filename for both Python and
Go handlers so browsers can save downloads with the correct name.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Fix generate_nav tenant mismatch: wipe used dataset owner's tenant_id but rebuild used caller's. Team members could delete owner's navigation tree and rebuild into their own. Now both use kb.tenant_id.
### What problem does this PR solve?
Closes#18116.
Fix cross-KB document ID collision (#18116). Older ID derivation excluded kb_id, causing two KBs to fight over one row. Unified derivation to be KB-scoped, with fallback for existing rows. Stranded rows are reclaimed, dataset deletion now cleans up state, and upgraded instances update in place. Tests added.
### Summary
Fix add_message so API-key callers can pass user_id (previously ignored because Python checked a Go-only flag). Now uses g.auth_type == AUTH_API. JWT/session callers stay bound to the authenticated principal. Tests added; backward compatible.
### Summary
Closes#17848.
This replaces #17958 with a smaller implementation focused on the
original requirement. The previous PR gradually expanded beyond the
necessary scope; the optional custom endpoint extension is intentionally
excluded from this version.
- Add request-scoped Bedrock API key authentication to the Python
Bedrock adapters and Go chat runtime.
- Discover and persist models available to API key instances, so users
do not need to manually enter the model type, model name, or maximum
token count.
- Add API Key mode to the existing Bedrock settings UI and refresh the
model and default-model lists after instance changes.
- Preserve selected models during credential-only updates while keeping
the existing SigV4 authentication modes unchanged.
- Return a clear error for unsupported API-key reranking.
- Document instance-scoped authentication and short-term API key
guidance.
Two fixes not yet on main:
Pass picker-selected models into Verify – useVerifyProvider now includes modelInfoRef in the verify payload so the backend can verify the user's actual selection.
Guard model construction – Wrap EmbeddingModel/ChatModel init in try/except so failures are recorded as per-model FAIL instead of aborting the whole verify call.
Also: later failures now overwrite previous successes per review feedback.
## Summary
- route REST retrieval metadata conditions through the existing
metadata-index push-down service
- keep full metadata loading lazy and preserve the Python in-memory
filter as an exact fallback
- add focused coverage for successful and empty push-down results and
multi-valued fallback semantics
### Summary
OIDC discovery builds its URL as
`f"{issuer}/.well-known/openid-configuration"`. Providers whose issuer
carries a trailing slash therefore get asked for a URL with a double
slash in it, which 404s. authentik is one of them: its issuer is
`https://auth.example.com/application/o/<app>/`, so the request goes to
`.../o/<app>//.well-known/openid-configuration` and login fails right at
the start with `Failed to fetch OIDC metadata`.
Stripping trailing slashes off the issuer before joining the well-known
path is enough. The `issuer` used later for ID token validation still
comes from the discovery document itself, so nothing else about the flow
changes.
Co-authored-by: Krim <git@krim.dev>
### Summary
Providers whose static catalogue is empty discover their models by
calling the base URL the user typed. `verify_api_key` wrapped that call
in a bare `except Exception: pass` and then returned a flat `No models
found for provider 'X'`, so an unreachable host, a closed port, a wrong
scheme and a bad TLS setup all produced the same sentence, with the
actual error discarded and not even logged.
Lynn
buua436
mkaaadandcoderabbitai[bot]
Sbaaoui Idriss
Yingfeng
Wang Qi
MarMar Labs
天海蒼灆andCursor
Mpider-San
Ali Farhan
He Wang
Öndery
陈志谦andjindou
Elias Shieh
euvre
Loong
Christian UhlandKrim
zws202606
qinling0210