Pr@main@fix embedded security vulnerabilities

backend/apps/system/api/assistant.py

@@ -313,13 +313,13 @@ async def update(request: Request, session: SessionDep, editor: AssistantDTO):
     dynamic_upgrade_cors(request=request, session=session)
 
 
-@router.get("/{id}", response_model=AssistantModel, summary=f"{PLACEHOLDER_PREFIX}assistant_query_api", description=f"{PLACEHOLDER_PREFIX}assistant_query_api")
+""" @router.get("/{id}", response_model=AssistantModel, summary=f"{PLACEHOLDER_PREFIX}assistant_query_api", description=f"{PLACEHOLDER_PREFIX}assistant_query_api")
 async def get_one(session: SessionDep, id: int = Path(description="ID")):
     db_model = await get_assistant_info(session=session, assistant_id=id)
     if not db_model:
         raise ValueError(f"AssistantModel with id {id} not found")
     db_model = AssistantModel.model_validate(db_model)
-    return db_model
+    return db_model """
 
 
 @router.delete("/{id}", summary=f"{PLACEHOLDER_PREFIX}assistant_del_api", description=f"{PLACEHOLDER_PREFIX}assistant_del_api")

frontend/src/api/assistant.ts

@@ -6,6 +6,6 @@ export const assistantApi = {
   add: (data: any) => request.post('/system/assistant', data),
   edit: (data: any) => request.put('/system/assistant', data),
   delete: (id: number) => request.delete(`/system/assistant/${id}`),
-  query: (id: number) => request.get(`/system/assistant/${id}`),
+  // query: (id: number) => request.get(`/system/assistant/${id}`),
   validate: (data: any) => request.get('/system/assistant/validator', { params: data }),
 }

frontend/src/api/embedded.ts

@@ -5,7 +5,7 @@ export const getAdvancedApplicationList = () =>
   request.get('/system/assistant/advanced_application')
 export const updateAssistant = (data: any) => request.put('/system/assistant', data)
 export const saveAssistant = (data: any) => request.post('/system/assistant', data)
-export const getOne = (id: any) => request.get(`/system/assistant/${id}`)
+// export const getOne = (id: any) => request.get(`/system/assistant/${id}`)
 export const delOne = (id: any) => request.delete(`/system/assistant/${id}`)
 export const dsApi = (id: any) => request.get(`/datasource/ws/${id}`)
 

frontend/src/views/embedded/index.vue

@@ -42,7 +42,6 @@ import {
   watch,
 } from 'vue'
 import ChatComponent from '@/views/chat/index.vue'
-import { request } from '@/utils/request'
 import LOGO from '@/assets/svg/logo-custom_small.svg'
 import icon_new_chat_outlined from '@/assets/svg/icon_new_chat_outlined.svg'
 import { useAppearanceStoreWithOut } from '@/stores/appearance'
@@ -83,8 +82,8 @@ const loading = ref(true)
 const tokenReady = ref(false)
 const eventName = 'sqlbot_assistant_event'
 
-let resolveTokenReady: (() => void) | null = null
-const tokenReadyPromise = new Promise<void>((resolve) => {
+let resolveTokenReady: ((data: any) => any) | null = null
+const tokenReadyPromise = new Promise<any>((resolve) => {
   resolveTokenReady = resolve
 })
 const communicationCb = async (event: any) => {
@@ -94,8 +93,8 @@ const communicationCb = async (event: any) => {
     }
     if (event.data['sqlbot_embedded_token']) {
       assistantStore.setToken(event.data['sqlbot_embedded_token'])
-      resolveTokenReady?.()
-      tokenReady.value = true
+      const originData = event.data['sqlbot_origin_data']
+      resolveTokenReady?.(originData)
     }
     if (event.data?.busi == 'certificate') {
       const certificate = event.data['certificate']
@@ -220,8 +219,6 @@ onBeforeMount(async () => {
   validator.value = await assistantApi.validate(param)
   assistantStore.setToken(validator.value.token) */
   assistantStore.setAssistant(true)
-  loading.value = false
-
   window.addEventListener('message', communicationCb)
   const readyData = {
     eventName: 'sqlbot_assistant_event',
@@ -231,46 +228,44 @@ onBeforeMount(async () => {
   }
   window.parent.postMessage(readyData, '*')
 
-  await tokenReadyPromise
-
-  request.get(`/system/assistant/${assistantId}`).then((res) => {
-    if (res.name) {
-      appName.value = res.name
+  const res = await tokenReadyPromise
+  loading.value = false
+  if (res?.name) {
+    appName.value = res.name
+  }
+  if (res?.configuration) {
+    const rawData = JSON.parse(res?.configuration)
+    assistantStore.setAutoDs(rawData?.auto_ds)
+    if (rawData.logo) {
+      logo.value = baseUrl + rawData.logo
     }
-    if (res?.configuration) {
-      const rawData = JSON.parse(res?.configuration)
-      assistantStore.setAutoDs(rawData?.auto_ds)
-      if (rawData.logo) {
-        logo.value = baseUrl + rawData.logo
-      }
 
-      for (const key in customSet) {
-        if (
-          Object.prototype.hasOwnProperty.call(customSet, key) &&
-          ![null, undefined].includes(rawData[key])
-        ) {
-          customSet[key] = rawData[key]
-          configuredKeys.add(key)
-        }
-      }
-
-      if (!rawData.theme) {
-        const { customColor, themeColor } = appearanceStore
-        const currentColor =
-          themeColor === 'custom' && customColor
-            ? customColor
-            : themeColor === 'blue'
-              ? '#3370ff'
-              : '#1CBA90'
-        customSet.theme = currentColor || customSet.theme
+    for (const key in customSet) {
+      if (
+        Object.prototype.hasOwnProperty.call(customSet, key) &&
+        ![null, undefined].includes(rawData[key])
+      ) {
+        customSet[key] = rawData[key]
+        configuredKeys.add(key)
       }
+    }
 
-      nextTick(() => {
-        setPageCustomColor(customSet.theme)
-        setPageHeaderFontColor(customSet.header_font_color)
-      })
+    if (!rawData.theme) {
+      const { customColor, themeColor } = appearanceStore
+      const currentColor =
+        themeColor === 'custom' && customColor
+          ? customColor
+          : themeColor === 'blue'
+            ? '#3370ff'
+            : '#1CBA90'
+      customSet.theme = currentColor || customSet.theme
     }
-  })
+
+    nextTick(() => {
+      setPageCustomColor(customSet.theme)
+      setPageHeaderFontColor(customSet.header_font_color)
+    })
+  }
 })
 
 onBeforeUnmount(() => {

frontend/src/views/embedded/page.vue

@@ -23,7 +23,6 @@ import { useAssistantStore } from '@/stores/assistant'
 import { useAppearanceStoreWithOut } from '@/stores/appearance'
 import { useI18n } from 'vue-i18n'
 import { i18n } from '@/i18n'
-import { request } from '@/utils/request'
 import { setCurrentColor } from '@/utils/utils'
 import { useUserStore } from '@/stores/user'
 const userStore = useUserStore()
@@ -74,22 +73,25 @@ const divLoading = ref(true)
 const tokenReady = ref(false)
 const eventName = 'sqlbot_embedded_event'
 
-let resolveTokenReady: (() => void) | null = null
-const tokenReadyPromise = new Promise<void>((resolve) => {
+let resolveTokenReady: ((data: any) => void) | null = null
+const tokenReadyPromise = new Promise<any>((resolve) => {
   resolveTokenReady = resolve
 })
 const communicationCb = async (event: any) => {
   if (event.data?.eventName === eventName) {
     if (event.data?.messageId !== route.query.id) {
       return
     }
+    const assistantTypeObj = event.data['type']
     if (
-      event.data['type'] &&
+      assistantTypeObj !== null &&
+      assistantTypeObj !== undefined &&
       parseInt(event.data['type']) !== 4 &&
       event.data['sqlbot_embedded_token']
     ) {
       assistantStore.setToken(event.data['sqlbot_embedded_token'])
-      resolveTokenReady?.()
+      const originData = event.data['sqlbot_origin_data']
+      resolveTokenReady?.(originData)
       tokenReady.value = true
     }
     if (event.data?.busi == 'certificate') {
@@ -228,42 +230,41 @@ onBeforeMount(async () => {
 
   registerReady(assistantId)
 
-  await tokenReadyPromise
+  const res = await tokenReadyPromise
   loading.value = false
-  request.get(`/system/assistant/${assistantId}`).then((res) => {
-    if (res?.configuration) {
-      const rawData = JSON.parse(res?.configuration)
-      assistantStore.setAutoDs(rawData?.auto_ds)
-      if (rawData.logo) {
-        logo.value = baseUrl + rawData.logo
-      }
-      rawData['name'] = rawData['name'] || res['name']
-      for (const key in customSet) {
-        if (
-          Object.prototype.hasOwnProperty.call(customSet, key) &&
-          ![null, undefined].includes(rawData[key])
-        ) {
-          customSet[key] = rawData[key]
-          configuredKeys.add(key)
-        }
-      }
 
-      if (!rawData.theme) {
-        const { customColor, themeColor } = appearanceStore
-        const currentColor =
-          themeColor === 'custom' && customColor
-            ? customColor
-            : themeColor === 'blue'
-              ? '#3370ff'
-              : '#1CBA90'
-        customSet.theme = currentColor || customSet.theme
+  if (res?.configuration) {
+    const rawData = JSON.parse(res?.configuration)
+    assistantStore.setAutoDs(rawData?.auto_ds)
+    if (rawData.logo) {
+      logo.value = baseUrl + rawData.logo
+    }
+    rawData['name'] = rawData['name'] || res['name']
+    for (const key in customSet) {
+      if (
+        Object.prototype.hasOwnProperty.call(customSet, key) &&
+        ![null, undefined].includes(rawData[key])
+      ) {
+        customSet[key] = rawData[key]
+        configuredKeys.add(key)
       }
+    }
 
-      nextTick(() => {
-        setPageCustomColor(customSet.theme)
-      })
+    if (!rawData.theme) {
+      const { customColor, themeColor } = appearanceStore
+      const currentColor =
+        themeColor === 'custom' && customColor
+          ? customColor
+          : themeColor === 'blue'
+            ? '#3370ff'
+            : '#1CBA90'
+      customSet.theme = currentColor || customSet.theme
     }
-  })
+
+    nextTick(() => {
+      setPageCustomColor(customSet.theme)
+    })
+  }
 })
 
 onBeforeUnmount(() => {