feat(workflow): harden dependency-aware YAML imports (#1623)

* feat(workflow): harden dependency-aware YAML imports

Signed-off-by: yjlu12 <1064690083@qq.com>

* fix(workflow): complete safe cross-environment imports

Signed-off-by: yjlu12 <1064690083@qq.com>

* refactor(workflow): satisfy import CI quality gates

Signed-off-by: yjlu12 <1064690083@qq.com>

* style(workflow): align import helper formatting

Signed-off-by: yjlu12 <1064690083@qq.com>

* refactor(workflow): extract YAML import parser

Signed-off-by: yjlu12 <1064690083@qq.com>

---------

Signed-off-by: yjlu12 <1064690083@qq.com>

Author: lyj715824

console/backend/commons/src/main/java/com/iflytek/astron/console/commons/constant/ResponseEnum.java

@@ -283,6 +283,7 @@ public enum ResponseEnum {
     WORKFLOW_MCP_SERVER_REGISTRY_FAILED(8126, "work.flow.mcp.server.registry.failed"),
     WORKFLOW_SKILL_API_NOT_READY(8127, "workflow.skill.api.not.ready"),
     WORKFLOW_SKILL_NAME_DESC_EMPTY(8128, "workflow.skill.name.desc.empty"),
+    WORKFLOW_IMPORT_DEPENDENCY_UNRESOLVED(8129, "workflow.import.dependency.unresolved"),
 
 
     // Plugins 8300 - 8500

console/backend/commons/src/main/resources/messages_en.properties

@@ -268,6 +268,7 @@ work.flow.dls.upload.failed=Your uploaded DSL file is incorrect, please retry
 work.flow.mcp.server.registry.failed=Mcp-server registration failed
 workflow.skill.api.not.ready=Please publish this workflow as an API and bind an app before exporting it as a Skill
 workflow.skill.name.desc.empty=Please complete the workflow name and description before exporting it as a Skill
+workflow.import.dependency.unresolved=Resolve imported workflow dependencies before debugging, building, or publishing
 failed.get.trace=Trace log retrieval failed
 
 # Plugin 8300+

console/backend/commons/src/main/resources/messages_zh.properties

@@ -280,6 +280,7 @@ work.flow.dls.upload.failed=您上传的DSL文件有误，请重试
 work.flow.mcp.server.registry.failed=Mcp-server 注册失败
 workflow.skill.api.not.ready=请先将该工作流发布为API并绑定应用成功后，再导出为Skill
 workflow.skill.name.desc.empty=请先补充工作流名称和描述后，再导出为Skill
+workflow.import.dependency.unresolved=请先解决导入工作流中未匹配的依赖，再进行调试、构建或发布
 failed.get.trace=Trace日志获取失败
 
 # 插件 8300+

console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/ReleaseManageClientService.java

@@ -8,5 +8,6 @@
 public interface ReleaseManageClientService {
     String getVersionNameByBotId(Long botId, Long spaceId, HttpServletRequest request);
 
-    void releaseBotApi(Integer botId, String flowId, String versionName, Long spaceId, HttpServletRequest request);
+    void releaseBotApi(Integer botId, String flowId, String versionName, String executionUid,
+            Long spaceId, HttpServletRequest request);
 }

console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/McpServiceImpl.java

@@ -144,6 +144,8 @@ private String getVersionName(Integer botId, String currentUid, Long spaceId) {
                 return generateDefaultVersion();
             }
 
+        } catch (BusinessException e) {
+            throw e;
         } catch (Exception e) {
             log.error("Exception occurred while getting version name for MCP: botId={}", botId, e);
             return generateDefaultVersion();

console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/PublishApiServiceImpl.java

@@ -149,6 +149,8 @@ public BotApiInfoDTO createBotApi(CreateBotApiVo createBotApiVo, HttpServletRequ
             } else {
                 throw new BusinessException(ResponseEnum.BOT_TYPE_NOT_SUPPORT);
             }
+        } catch (BusinessException e) {
+            throw e;
         } catch (Exception e) {
             log.error("PublishApiServiceImpl.createBotApi : create Bot api error, request: {}", createBotApiVo, e);
             throw new BusinessException(ResponseEnum.BOT_API_CREATE_ERROR);
@@ -203,7 +205,7 @@ private BotApiInfoDTO createMaasApi(
         String flowId = userLangChainInfo.getFlowId();
         // Synchronize with Maas service
         String versionName = releaseManageClientService.getVersionNameByBotId(Long.valueOf(botId), spaceId, request);
-        releaseManageClientService.releaseBotApi(botId, flowId, versionName, spaceId, request);
+        releaseManageClientService.releaseBotApi(botId, flowId, versionName, uid, spaceId, request);
         maasUtil.createApi(flowId, appMst.getAppId(), versionName);
 
         ChatBotApi chatBotApi = ChatBotApi.builder()

console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/ReleaseManageClientServiceImpl.java

@@ -51,7 +51,8 @@ public String getVersionNameByBotId(Long botId, Long spaceId, HttpServletRequest
     }
 
     @Override
-    public void releaseBotApi(Integer botId, String flowId, String versionName, Long spaceId, HttpServletRequest request) {
+    public void releaseBotApi(Integer botId, String flowId, String versionName, String executionUid,
+            Long spaceId, HttpServletRequest request) {
         if (botId == null || StrUtil.isBlank(flowId) || StrUtil.isBlank(versionName)) {
             throw new BusinessException(ResponseEnum.WORKFLOW_VERSION_PUBLISH_FAILED);
         }
@@ -70,7 +71,8 @@ public void releaseBotApi(Integer botId, String flowId, String versionName, Long
         workflowVersion.setDescription("");
         workflowVersion.setName(versionName);
 
-        ApiResult<JSONObject> response = versionService.createForBoundBotPublish(workflowVersion);
+        ApiResult<JSONObject> response = versionService.createForBoundBotPublish(
+                workflowVersion, executionUid, spaceId);
         if (response == null || response.code() != 0 || response.data() == null) {
             log.error("releaseBotApi - Failed to create workflow version, botId={}, flowId={}, versionName={}, spaceId={}",
                     botId, flowId, versionName, spaceId);

console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/workflow/impl/WorkflowReleaseServiceImpl.java

@@ -4,6 +4,7 @@
 import com.iflytek.astron.console.commons.service.data.UserLangChainDataService;
 import com.iflytek.astron.console.commons.mapper.bot.ChatBotApiMapper;
 import com.iflytek.astron.console.commons.dto.bot.ChatBotApi;
+import com.iflytek.astron.console.commons.exception.BusinessException;
 import com.iflytek.astron.console.commons.util.MaasUtil;
 import com.iflytek.astron.console.toolkit.common.constant.WorkflowConst;
 import com.iflytek.astron.console.toolkit.entity.table.workflow.WorkflowVersion;
@@ -82,7 +83,7 @@ public WorkflowReleaseResponseDto publishWorkflow(Integer botId, String uid, Lon
             request.setDescription("");
             request.setName(versionName);
 
-            WorkflowReleaseResponseDto response = createWorkflowVersion(request);
+            WorkflowReleaseResponseDto response = createWorkflowVersion(request, uid, spaceId);
             if (!response.getSuccess()) {
                 return response;
             }
@@ -104,6 +105,8 @@ public WorkflowReleaseResponseDto publishWorkflow(Integer botId, String uid, Lon
 
             return response;
 
+        } catch (BusinessException e) {
+            throw e;
         } catch (Exception e) {
             log.error("Workflow bot publish failed: botId={}, uid={}, spaceId={}", botId, uid, spaceId, e);
             return createErrorResponse("Publish failed: " + e.getMessage());
@@ -166,7 +169,8 @@ private boolean isVersionExists(Integer botId, String versionName) {
         }
     }
 
-    private WorkflowReleaseResponseDto createWorkflowVersion(WorkflowReleaseRequestDto request) {
+    private WorkflowReleaseResponseDto createWorkflowVersion(
+            WorkflowReleaseRequestDto request, String executionUid, Long executionSpaceId) {
         log.info("Creating workflow version: request={}", request);
 
         try {
@@ -178,7 +182,8 @@ private WorkflowReleaseResponseDto createWorkflowVersion(WorkflowReleaseRequestD
             workflowVersion.setDescription(request.getDescription());
             workflowVersion.setName(request.getName());
 
-            var response = versionService.createForBoundBotPublish(workflowVersion);
+            var response = versionService.createForBoundBotPublish(
+                    workflowVersion, executionUid, executionSpaceId);
             JSONObject data = response == null ? null : response.data();
             if (response == null || response.code() != 0 || data == null) {
                 return createErrorResponse("Invalid response data format");
@@ -196,6 +201,8 @@ private WorkflowReleaseResponseDto createWorkflowVersion(WorkflowReleaseRequestD
                     result.getWorkflowVersionId(), result.getWorkflowVersionName());
             return result;
 
+        } catch (BusinessException e) {
+            throw e;
         } catch (Exception e) {
             log.error("Exception occurred while creating workflow version: request={}", request, e);
             return createErrorResponse("Exception occurred while creating version: " + e.getMessage());

console/backend/hub/src/main/resources/db/migration/V1.45__add_workflow_import_permission.sql

@@ -0,0 +1,4 @@
+INSERT IGNORE INTO `agent_space_permission`
+(`module`, `point`, `description`, `permission_key`, `owner`, `admin`, `member`, `available_expired`, `create_time`, `update_time`)
+VALUES
+('Workflow', 'Import Workflow', 'Import Workflow', 'WorkflowController_importWorkflow_POST', 1, 1, 1, 0, NOW(), NOW());

console/backend/hub/src/test/java/com/iflytek/astron/console/hub/listener/WorkflowBotPublishListenerTest.java

@@ -16,6 +16,7 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
@@ -89,4 +90,27 @@ void handleBotPublishStatusChangedShouldFailWhenWorkflowBotHasNoFlowId() {
                 .extracting("responseEnum")
                 .isEqualTo(ResponseEnum.WORKFLOW_VERSION_PUBLISH_FAILED);
     }
+
+    @Test
+    void handleBotPublishStatusChangedShouldPreserveUnresolvedDependencyError() {
+        ChatBotBase botBase = new ChatBotBase();
+        botBase.setId(25);
+        botBase.setVersion(BotTypeEnum.WORKFLOW_BOT.getType());
+        when(chatBotBaseMapper.selectById(25)).thenReturn(botBase);
+        when(userLangChainDataService.findFlowIdByBotId(25)).thenReturn("flow-1");
+        BusinessException unresolved =
+                new BusinessException(ResponseEnum.WORKFLOW_IMPORT_DEPENDENCY_UNRESOLVED);
+        when(workflowReleaseService.publishWorkflow(25, "requester-uid", 1L, "MARKET"))
+                .thenThrow(unresolved);
+
+        BotPublishStatusChangedEvent event = new BotPublishStatusChangedEvent(
+                this, 25, "requester-uid", 1L, "PUBLISH", null, 1, "MARKET");
+
+        assertThatThrownBy(() -> listener.handleBotPublishStatusChanged(event))
+                .isSameAs(unresolved)
+                .extracting("code")
+                .isEqualTo(ResponseEnum.WORKFLOW_IMPORT_DEPENDENCY_UNRESOLVED.getCode());
+
+        verify(workflowReleaseService).publishWorkflow(25, "requester-uid", 1L, "MARKET");
+    }
 }