mirror of
https://github.com/microsoft/agent-framework.git
synced 2026-06-16 21:04:09 +08:00
Evan Mattson
e3875f2c91
* .NET: DevUI: add configurable access controls for the DevUI HTTP surface * .NET: DevUI: address review and fix dotnet format - Restore parameterless AddDevUI overloads for binary compatibility on IServiceCollection and IHostApplicationBuilder. - Keep /meta outside the auth-filtered group so the frontend can discover whether a bearer token is required before prompting for one. Surface the actual requirement via MetaResponse.auth_required. - Invoke DevUIOptions.ConfigureEndpoints before mapping protected endpoints so RouteGroupBuilder conventions (RequireAuthorization, rate limiting) reliably apply. - Treat a null RemoteIpAddress as non-loopback in DevUIAuthFilter; tests now set IPAddress.Loopback explicitly when exercising the loopback path. - Add a DEVUI_AUTH_TOKEN env-var fallback test and a /meta-public test. - Fix dotnet format: add UTF-8 BOM to new files, simplify a cref in DevUIOptions, and drop an unused using in the new test. * .NET: DevUI: add missing authRequired param XML tag * .NET: DevUI tests: set loopback/AllowRemoteAccess for null-RemoteIp default DevUIIntegrationTests use the default TestServer which leaves RemoteIpAddress null. With the new conservative loopback default those tests now hit 403; set AllowRemoteAccess on the option since those tests are not exercising access control. Also add the missing SimulateRemoteIp call in the wrong-bearer test. * .NET: DevUI tests: capture DEVUI_AUTH_TOKEN before parallel tests can see it The env-var test was leaking DEVUI_AUTH_TOKEN into parallel DevUIIntegrationTests, intermittently causing their requests to be rejected as 401. Eagerly resolve the singleton DevUIAuthFilter so its constructor captures the token, then restore the env var before any HTTP requests run.
60 lines
2.6 KiB
C#
60 lines
2.6 KiB
C#
// Copyright (c) Microsoft. All rights reserved.
|
|
|
|
namespace Microsoft.Agents.AI.DevUI;
|
|
|
|
/// <summary>
|
|
/// Options that control the security posture of the DevUI HTTP surface.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// DevUI exposes agent metadata that is sensitive in production contexts:
|
|
/// system instructions, tool definitions, model identifiers, and workflow
|
|
/// structure. By default, DevUI rejects any request whose remote endpoint
|
|
/// is not a loopback address. Hosts that intentionally expose DevUI on a
|
|
/// non-loopback interface must opt in via <see cref="AllowRemoteAccess"/>
|
|
/// and should also configure <see cref="AuthToken"/> or
|
|
/// <see cref="ConfigureEndpoints"/> to attach an authorization policy.
|
|
/// </remarks>
|
|
public sealed class DevUIOptions
|
|
{
|
|
/// <summary>
|
|
/// Environment variable inspected for a default bearer token when
|
|
/// <see cref="AuthToken"/> is not explicitly set.
|
|
/// </summary>
|
|
public const string AuthTokenEnvironmentVariable = "DEVUI_AUTH_TOKEN";
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether DevUI may be served to
|
|
/// non-loopback callers. Defaults to <see langword="false"/>.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// When <see langword="false"/>, any request whose
|
|
/// <see cref="ConnectionInfo.RemoteIpAddress"/> is
|
|
/// not a loopback address (or is missing) is rejected with HTTP 403 before
|
|
/// reaching the DevUI handlers. Enable only when the host is responsible
|
|
/// for fronting DevUI with its own authentication, network policy, or both.
|
|
/// </remarks>
|
|
public bool AllowRemoteAccess { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a shared bearer token required on every DevUI request.
|
|
/// When <see langword="null"/> or empty, the value of the
|
|
/// <c>DEVUI_AUTH_TOKEN</c> environment variable is used instead.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// When a token is configured, requests must include the header
|
|
/// <c>Authorization: Bearer <token></c>. Comparison is performed
|
|
/// in constant time. This is a convenience for development scenarios.
|
|
/// Production hosts should prefer a real ASP.NET Core authentication
|
|
/// scheme attached via <see cref="ConfigureEndpoints"/>.
|
|
/// </remarks>
|
|
public string? AuthToken { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a callback invoked with the DevUI endpoint group so the
|
|
/// host can attach authorization, rate limiting, or other endpoint
|
|
/// conventions (for example
|
|
/// <c>group.RequireAuthorization("DevUIPolicy")</c>).
|
|
/// </summary>
|
|
public Action<IEndpointConventionBuilder>? ConfigureEndpoints { get; set; }
|
|
}
|