mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-04-08 03:00:28 -04:00
5b9a4c52c9
## Summary Reverts the invite system PRs due to security gaps identified during review: - The move from Supabase-native `allowed_users` gating to application-level gating allows orphaned Supabase auth accounts (valid JWT without a platform `User`) - The auth middleware never verifies `User` existence, so orphaned users get 500s instead of clean 403s - OAuth/Google SSO signup completely bypasses the invite gate - The DB trigger that atomically created `User` + `Profile` on signup was dropped in favor of a client-initiated API call, introducing a failure window ### Reverted PRs - Reverts #12347 — Foundation: InvitedUser model, invite-gated signup, admin UI - Reverts #12374 — Tally enrichment: personalized prompts from form submissions - Reverts #12451 — Pre-check: POST /auth/check-invite endpoint - Reverts #12452 (collateral) — Themed prompt categories / SuggestionThemes UI. This PR built on top of #12374's `suggested_prompts` backend field and `/chat/suggested-prompts` endpoint, so it cannot remain without #12374. The copilot empty session falls back to hardcoded default prompts. ### Migration Includes a new migration (`20260319120000_revert_invite_system`) that: - Drops the `InvitedUser` table and its enums (`InvitedUserStatus`, `TallyComputationStatus`) - Restores the `add_user_and_profile_to_platform()` trigger on `auth.users` - Backfills `User` + `Profile` rows for any auth accounts created during the invite-gate window ### What's NOT reverted - The `generate_username()` function (never dropped, still used by backfill migration) - The old `add_user_to_platform()` function (superseded by `add_user_and_profile_to_platform()`) - PR #12471 (admin UX improvements) — was never merged, no action needed ## Test plan - [x] Verify migration: `InvitedUser` table dropped, enums dropped, trigger restored - [x] Verify backfill: no orphaned auth users, no users without Profile - [x] Verify existing users can still log in (email + OAuth) - [x] Verify CoPilot chat page loads with default prompts - [ ] Verify new user signup creates `User` + `Profile` via the restored trigger - [ ] Verify admin `/admin/users` page loads without crashing - [ ] Run backend tests: `poetry run test` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Zamil Majdy <zamil.majdy@agpt.co>
198 lines
6.2 KiB
Plaintext
198 lines
6.2 KiB
Plaintext
# Backend Configuration
|
|
# This file contains environment variables that MUST be set for the AutoGPT platform
|
|
# Variables with working defaults in settings.py are not included here
|
|
|
|
## ===== REQUIRED DATABASE CONFIGURATION ===== ##
|
|
# PostgreSQL Database Connection
|
|
DB_USER=postgres
|
|
DB_PASS=your-super-secret-and-long-postgres-password
|
|
DB_NAME=postgres
|
|
DB_PORT=5432
|
|
DB_HOST=localhost
|
|
DB_CONNECTION_LIMIT=12
|
|
DB_CONNECT_TIMEOUT=60
|
|
DB_POOL_TIMEOUT=300
|
|
DB_SCHEMA=platform
|
|
DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
DIRECT_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
PRISMA_SCHEMA="postgres/schema.prisma"
|
|
|
|
## ===== REQUIRED SERVICE CREDENTIALS ===== ##
|
|
# Redis Configuration
|
|
REDIS_HOST=localhost
|
|
REDIS_PORT=6379
|
|
# REDIS_PASSWORD=
|
|
|
|
# RabbitMQ Credentials
|
|
RABBITMQ_DEFAULT_USER=rabbitmq_user_default
|
|
RABBITMQ_DEFAULT_PASS=k0VMxyIJF9S35f3x2uaw5IWAl6Y536O7
|
|
|
|
# Supabase Authentication
|
|
SUPABASE_URL=http://localhost:8000
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
|
|
JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long
|
|
|
|
## ===== REQUIRED SECURITY KEYS ===== ##
|
|
# Generate using: from cryptography.fernet import Fernet;Fernet.generate_key().decode()
|
|
ENCRYPTION_KEY=dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=
|
|
UNSUBSCRIBE_SECRET_KEY=HlP8ivStJjmbf6NKi78m_3FnOogut0t5ckzjsIqeaio=
|
|
|
|
## ===== IMPORTANT OPTIONAL CONFIGURATION ===== ##
|
|
# Platform URLs (set these for webhooks and OAuth to work)
|
|
PLATFORM_BASE_URL=http://localhost:8000
|
|
FRONTEND_BASE_URL=http://localhost:3000
|
|
|
|
# Media Storage (required for marketplace and library functionality)
|
|
MEDIA_GCS_BUCKET_NAME=
|
|
|
|
## ===== API KEYS AND OAUTH CREDENTIALS ===== ##
|
|
# All API keys below are optional - only add what you need
|
|
|
|
# AI/LLM Services
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GROQ_API_KEY=
|
|
LLAMA_API_KEY=
|
|
AIML_API_KEY=
|
|
V0_API_KEY=
|
|
OPEN_ROUTER_API_KEY=
|
|
NVIDIA_API_KEY=
|
|
|
|
# Langfuse Prompt Management
|
|
# Used for managing the CoPilot system prompt externally
|
|
# Get credentials from https://cloud.langfuse.com or your self-hosted instance
|
|
LANGFUSE_PUBLIC_KEY=
|
|
LANGFUSE_SECRET_KEY=
|
|
LANGFUSE_HOST=https://cloud.langfuse.com
|
|
|
|
# OAuth Credentials
|
|
# For the OAuth callback URL, use <your_frontend_url>/auth/integrations/oauth_callback,
|
|
# e.g. http://localhost:3000/auth/integrations/oauth_callback
|
|
|
|
# GitHub OAuth App server credentials - https://github.com/settings/developers
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
|
|
# Notion OAuth App server credentials - https://developers.notion.com/docs/authorization
|
|
# Configure a public integration
|
|
NOTION_CLIENT_ID=
|
|
NOTION_CLIENT_SECRET=
|
|
|
|
# Google OAuth App server credentials - https://console.cloud.google.com/apis/credentials, and enable gmail api and set scopes
|
|
# https://console.cloud.google.com/apis/credentials/consent ?project=<your_project_id>
|
|
# You'll need to add/enable the following scopes (minimum):
|
|
# https://console.developers.google.com/apis/api/gmail.googleapis.com/overview ?project=<your_project_id>
|
|
# https://console.cloud.google.com/apis/library/sheets.googleapis.com/ ?project=<your_project_id>
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Twitter (X) OAuth 2.0 with PKCE Configuration
|
|
# 1. Create a Twitter Developer Account:
|
|
# - Visit https://developer.x.com/en and sign up
|
|
# 2. Set up your application:
|
|
# - Navigate to Developer Portal > Projects > Create Project
|
|
# - Add a new app to your project
|
|
# 3. Configure app settings:
|
|
# - App Permissions: Read + Write + Direct Messages
|
|
# - App Type: Web App, Automated App or Bot
|
|
# - OAuth 2.0 Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
# - Save your Client ID and Client Secret below
|
|
TWITTER_CLIENT_ID=
|
|
TWITTER_CLIENT_SECRET=
|
|
|
|
# Linear App
|
|
# Make a new workspace for your OAuth APP -- trust me
|
|
# https://linear.app/settings/api/applications/new
|
|
# Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
LINEAR_API_KEY=
|
|
# Linear project and team IDs for the feature request tracker.
|
|
# Find these in your Linear workspace URL: linear.app/<workspace>/project/<project-id>
|
|
# and in team settings. Used by the chat copilot to file and search feature requests.
|
|
LINEAR_FEATURE_REQUEST_PROJECT_ID=
|
|
LINEAR_FEATURE_REQUEST_TEAM_ID=
|
|
LINEAR_CLIENT_ID=
|
|
LINEAR_CLIENT_SECRET=
|
|
|
|
# To obtain Todoist API credentials:
|
|
# 1. Create a Todoist account at todoist.com
|
|
# 2. Visit the Developer Console: https://developer.todoist.com/appconsole.html
|
|
# 3. Click "Create new app"
|
|
# 4. Once created, copy your Client ID and Client Secret below
|
|
TODOIST_CLIENT_ID=
|
|
TODOIST_CLIENT_SECRET=
|
|
|
|
NOTION_CLIENT_ID=
|
|
NOTION_CLIENT_SECRET=
|
|
|
|
# Discord OAuth App credentials
|
|
# 1. Go to https://discord.com/developers/applications
|
|
# 2. Create a new application
|
|
# 3. Go to OAuth2 section and add redirect URI: http://localhost:3000/auth/integrations/oauth_callback
|
|
# 4. Copy Client ID and Client Secret below
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
|
|
REDDIT_CLIENT_ID=
|
|
REDDIT_CLIENT_SECRET=
|
|
|
|
# Payment Processing
|
|
STRIPE_API_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
|
|
# Email Service (for sending notifications and confirmations)
|
|
POSTMARK_SERVER_API_TOKEN=
|
|
POSTMARK_SENDER_EMAIL=invalid@invalid.com
|
|
POSTMARK_WEBHOOK_TOKEN=
|
|
|
|
# Error Tracking
|
|
SENTRY_DSN=
|
|
|
|
# Feature Flags
|
|
LAUNCH_DARKLY_SDK_KEY=
|
|
|
|
# Content Generation & Media
|
|
DID_API_KEY=
|
|
FAL_API_KEY=
|
|
IDEOGRAM_API_KEY=
|
|
REPLICATE_API_KEY=
|
|
REVID_API_KEY=
|
|
SCREENSHOTONE_API_KEY=
|
|
UNREAL_SPEECH_API_KEY=
|
|
ELEVENLABS_API_KEY=
|
|
|
|
# Data & Search Services
|
|
E2B_API_KEY=
|
|
EXA_API_KEY=
|
|
JINA_API_KEY=
|
|
MEM0_API_KEY=
|
|
OPENWEATHERMAP_API_KEY=
|
|
GOOGLE_MAPS_API_KEY=
|
|
|
|
# Communication Services
|
|
DISCORD_BOT_TOKEN=
|
|
MEDIUM_API_KEY=
|
|
MEDIUM_AUTHOR_ID=
|
|
SMTP_SERVER=
|
|
SMTP_PORT=
|
|
SMTP_USERNAME=
|
|
SMTP_PASSWORD=
|
|
|
|
# Business & Marketing Tools
|
|
APOLLO_API_KEY=
|
|
ENRICHLAYER_API_KEY=
|
|
AYRSHARE_API_KEY=
|
|
AYRSHARE_JWT_KEY=
|
|
SMARTLEAD_API_KEY=
|
|
ZEROBOUNCE_API_KEY=
|
|
|
|
# PostHog Analytics
|
|
# Get API key from https://posthog.com - Project Settings > Project API Key
|
|
POSTHOG_API_KEY=
|
|
POSTHOG_HOST=https://eu.i.posthog.com
|
|
|
|
# Tally Form Integration (pre-populate business understanding on signup)
|
|
TALLY_API_KEY=
|
|
|
|
# Other Services
|
|
AUTOMOD_API_KEY=
|