[zyssyz123]

Summary

• replace the old workspace scope-policy BFF with tenant reusable network access group APIs
• add group list/create/get/update/delete under the current workspace
• add per-app group binding GET/PUT, including explicit group_id: null unbind
• inject the authenticated tenant and actor; require persisted owner/admin membership and tenant-scoped app lookup
• preserve safe SaaS error reasons so name conflict, group limit/version conflict, bound deletion, and internal-secret failures produce actionable Console errors
• support ProtoJSON camel/snake aliases, int64 strings, timestamps, omitted optional fields, and regenerated OpenAPI/oRPC/Zod/TypeScript contracts

Console APIs

• GET|POST /console/api/workspaces/current/network-access-groups
• GET|PUT|DELETE /console/api/workspaces/current/network-access-groups/{group_id}
• GET|PUT /console/api/apps/{app_id}/network-access-group

Validation

• 38 focused BFF/controller/client tests
• 64 Swagger/schema/response-contract tests
• 12 generated contracts tests and TypeScript type-check
• Ruff, Pyrefly, and target Mypy: clean
• GitHub API unit/integration, Web, CLI, CodeQL, DB migration, browser and full-stack E2E checks
• dev BFF route authentication checks plus complete control-plane/Gateway E2E

Dependency

• SaaS control plane and Gateway: https://github.com/langgenius/dify-saas/pull/152

Linear: SNP-682

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	75.77%	75.98%	+0.21%
Strict coverage	75.44%	75.66%	+0.22%
Typed symbols	63,292	64,080	+788
Untyped symbols	20,330	20,343	+13
Modules	3814	3833	+19

[codecov]

Codecov Report

❌ Patch coverage is 97.13922% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.64%. Comparing base (5b3b7cd) to head (109cbdd).

Files with missing lines	Patch %	Lines
...trollers/console/workspace/network_access_group.py	95.12%	11 Missing and 3 partials ⚠️
...pi/repositories/network_access_group_repository.py	86.36%	4 Missing and 2 partials ⚠️
.../header/account-setting/ip-policies-page/index.tsx	96.29%	5 Missing ⚠️
api/controllers/common/access_response.py	95.40%	3 Missing and 1 partial ⚠️
web/app/(shareLayout)/components/splash.tsx	92.10%	3 Missing ⚠️
api/core/network_access/client_ip.py	96.82%	1 Missing and 1 partial ⚠️
api/tasks/remove_app_and_related_data_task.py	90.90%	1 Missing and 1 partial ⚠️
web/app/components/base/chat/chat/hooks.ts	92.59%	2 Missing ⚠️
web/app/components/explore/try-app/index.tsx	93.10%	2 Missing ⚠️
...b/app/components/header/account-dropdown/index.tsx	93.93%	2 Missing ⚠️
... and 2 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #41025      +/-   ##
==========================================
+ Coverage   88.55%   88.64%   +0.08%     
==========================================
  Files        5522     5567      +45     
  Lines      331163   333939    +2776     
  Branches    66215    67064     +849     
==========================================
+ Hits       293256   296005    +2749     
- Misses      32725    32751      +26     
- Partials     5182     5183       +1     

Flag	Coverage Δ
api	88.84% <97.41%> (+0.06%)	⬆️
cli	94.06% <ø> (ø)
dify-ui	91.67% <ø> (ø)
web	88.06% <96.22%> (+0.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-10-20 05:46:21.559716831 +0000
+++ /tmp/pyrefly_pr.txt	2026-10-20 05:46:12.443596989 +0000
@@ -1625,7 +1625,7 @@
 ERROR Argument `SimpleNamespace` is not assignable to parameter `form` with type `Form` in function `controllers.console.human_input_form.ConsoleHumanInputFormApi._ensure_console_access` [bad-argument-type]
   --> tests/unit_tests/controllers/console/test_human_input_form.py:96:57
 ERROR Type `Response` is not iterable [not-iterable]
-   --> tests/unit_tests/controllers/console/test_wraps.py:304:17
+   --> tests/unit_tests/controllers/console/test_wraps.py:305:17
 ERROR Argument value `Literal[0]` violates Pydantic `ge` constraint `Literal[1]` for field `page` [bad-argument-type]
    --> tests/unit_tests/controllers/console/workspace/test_endpoint.py:235:47
 ERROR Missing argument `plugin_id` in function `controllers.console.workspace.endpoint.EndpointListForPluginQuery.__init__` [missing-argument]
@@ -1677,9 +1677,9 @@
 ERROR Missing argument `payload` in function `protected_view` [missing-argument]
    --> tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py:394:36
 ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
-  --> tests/unit_tests/controllers/mcp/test_mcp.py:39:13
+  --> tests/unit_tests/controllers/mcp/test_mcp.py:41:13
 ERROR Attribute `payload` of class `Namespace` is a read-only property and cannot be set [read-only]
-  --> tests/unit_tests/controllers/mcp/test_mcp.py:58:5
+  --> tests/unit_tests/controllers/mcp/test_mcp.py:61:5
 ERROR Object of class `FunctionType` has no attribute `__handler__` [missing-attribute]
   --> tests/unit_tests/controllers/openapi/test_account.py:36:13
 ERROR Object of class `FunctionType` has no attribute `__handler__` [missing-attribute]
@@ -1813,19 +1813,19 @@
 ERROR Argument `() -> Session` is not assignable to parameter `session_factory` with type `sessionmaker[@_]` in function `sqlalchemy.orm.scoping.scoped_session.__init__` [bad-argument-type]
    --> tests/unit_tests/controllers/service_api/test_wraps.py:101:27
 ERROR Missing argument `app_model` in function `protected_view` [missing-argument]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:263:36
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:273:36
 ERROR Missing argument `app_model` in function `protected_view` [missing-argument]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:338:61
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:348:61
 ERROR Missing argument `end_user` in function `protected_view` [missing-argument]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:338:61
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:348:61
 ERROR Missing argument `app_model` in function `protected_view` [missing-argument]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:399:36
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:409:36
 ERROR Object of class `NoneType` has no attribute `last_used_at` [missing-attribute]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:403:16
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:413:16
 ERROR Argument `Literal['abnormal']` is not assignable to parameter `value` with type `AppStatus | SQLCoreOperations[AppStatus]` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:438:28
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:448:28
 ERROR Object of class `NoneType` has no attribute `last_used_at` [missing-attribute]
-   --> tests/unit_tests/controllers/service_api/test_wraps.py:937:16
+   --> tests/unit_tests/controllers/service_api/test_wraps.py:947:16
 ERROR Cannot index into `object` [bad-index]
    --> tests/unit_tests/controllers/test_swagger.py:151:20
 ERROR Cannot index into `object` [bad-index]
@@ -1863,7 +1863,25 @@
 ERROR Cannot index into `object` [bad-index]
    --> tests/unit_tests/controllers/test_swagger.py:672:12
 ERROR `object` is not assignable to attribute `request` with type `Request` [bad-assignment]
-  --> tests/unit_tests/controllers/trigger/test_trigger.py:12:22
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:11:22
+ERROR Object of class `tuple` has no attribute `status_code` [missing-attribute]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:26:16
+ERROR Object of class `tuple` has no attribute `data` [missing-attribute]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:27:16
+ERROR Object of class `tuple` has no attribute `status_code` [missing-attribute]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:57:16
+ERROR Object of class `tuple` has no attribute `data` [missing-attribute]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:58:16
+ERROR Type `Response` is not iterable [not-iterable]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:62:9
+ERROR Cannot index into `Response` [bad-index]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:65:16
+ERROR Cannot index into `Response` [bad-index]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:66:16
+ERROR Type `Response` is not iterable [not-iterable]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:70:9
+ERROR Cannot index into `Response` [bad-index]
+  --> tests/unit_tests/controllers/trigger/test_trigger.py:73:16
 ERROR `_RequestStub` is not assignable to attribute `request` with type `Request` [bad-assignment]
   --> tests/unit_tests/controllers/trigger/test_webhook.py:32:22
 ERROR Object of class `Exception` has no attribute `data` [missing-attribute]
@@ -1907,9 +1925,9 @@
 ERROR Missing argument `inputs` in function `controllers.common.controller_schemas.WorkflowRunPayload.__init__` [missing-argument]
    --> tests/unit_tests/controllers/web/test_pydantic_models.py:337:31
 ERROR Expected 1 more positional argument [bad-argument-count]
-  --> tests/unit_tests/controllers/web/test_wraps.py:33:32
+  --> tests/unit_tests/controllers/web/test_wraps.py:36:32
 ERROR Expected 1 more positional argument [bad-argument-count]
-  --> tests/unit_tests/controllers/web/test_wraps.py:51:23
+  --> tests/unit_tests/controllers/web/test_wraps.py:54:23
 ERROR Argument `list[Unknown]` is not assignable to parameter `llm_response` with type `Generator[LLMResultChunk]` in function `core.agent.output_parser.cot_output_parser.CotAgentOutputParser.handle_react_stream_output` [bad-argument-type]
   --> tests/unit_tests/core/agent/output_parser/test_cot_output_parser.py:56:71
 ERROR No matching overload found for function `str.join` called with arguments: (list[AgentScratchpadUnit.Action | str]) [no-matching-overload]

[CodingOnStar]

LGTM

[dosubot]

📄 Knowledge review

✏️ Documentation updates

1 page was updated by changes in this PR.

Page	Library	Status
MCP Protocol Integration for Dify Workflows	dify	✅ Updated

📝 MCP Protocol Integration for Dify Workflows — changes

@@ -48,12 +48,13 @@
 
 When a POST arrives at `/mcp/server/<server_code>/mcp`, the controller:
 
-1. Parses the JSON-RPC payload and validates it against `MCPRequestPayload` [[7]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L67-L69).
-2. Resolves the negotiated protocol version from the `MCP-Protocol-Version` request header (added in PR #37892 — see [Protocol Version Negotiation](#protocol-version-negotiation)).
-3. Looks up the `AppMCPServer` and associated `App` by `server_code`, then checks the server status is `active` [[8]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L82-L97).
-4. Extracts the app's `user_input_form` to build the tool's `inputSchema` [[9]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L142-L159).
-5. Routes **notifications** (e.g. `notifications/initialized`) to a lightweight handler that returns HTTP 202 with an empty body, and routes **requests** to the full handler pipeline [[10]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L109-L120).
-6. For requests, retrieves or lazily creates an `EndUser` record scoped to the MCP server [[11]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L234-L242), then dispatches to `handle_mcp_request` in `core/mcp/server/streamable_http.py`.
+1. Resolves identity **before** the request body is parsed, in a short read database session: it looks up the `AppMCPServer` by `server_code`, looks up the backing `App` scoped by `App.tenant_id == mcp_server.tenant_id`, and checks the server status is `active` [[8]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L82-L97). Only scalar IDs (server id, app id, tenant id) leave this session, never ORM objects. Any failure is a single opaque `MCPServerNotFoundError` — see [Error Responses](#error-responses). The route's `expect` decorator uses `validate=False`, so malformed or oversized JSON bodies reach this step and get the same response.
+2. Parses the JSON-RPC payload and validates it against `MCPRequestPayload` [[7]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L67-L69). Allowed requests use the full body and protocol parser; the 64 KiB cap applies only to opaque error responses.
+3. Resolves the negotiated protocol version from the `MCP-Protocol-Version` request header (added in PR #37892 — see [Protocol Version Negotiation](#protocol-version-negotiation)).
+4. Re-validates identity in the execution transaction with fresh, attached ORM records. The server, app, and tenant IDs must match the preflight identity; a `server_code` reassigned to a different server, app, or tenant yields the same "Server Not Found" response.
+5. Extracts the app's `user_input_form` to build the tool's `inputSchema` [[9]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L142-L159).
+6. Routes **notifications** (e.g. `notifications/initialized`) to a lightweight handler that returns HTTP 202 with an empty body, and routes **requests** to the full handler pipeline [[10]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L109-L120).
+7. For requests, retrieves or lazily creates an `EndUser` record scoped to the MCP server [[11]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L234-L242), then dispatches to `handle_mcp_request` in `core/mcp/server/streamable_http.py`.
 
 ### Supported App Modes
 
@@ -409,12 +410,14 @@
 
 | Error | Code | Trigger |
 |---|---|---|
-| `INVALID_REQUEST` | `-32600` | Server not found, server not active, unsupported `MCP-Protocol-Version` header, or trigger-entry workflow invoked via MCP (manual runs not supported for trigger workflows) |
+| `INVALID_REQUEST` | `-32600` | Server not found, backing app not found (or in a different tenant), server not active (all returned as one opaque `"Server Not Found"` error with HTTP 404), unsupported `MCP-Protocol-Version` header, or trigger-entry workflow invoked via MCP (manual runs not supported for trigger workflows) |
 | `INVALID_PARAMS` | `-32602` | Malformed request payload, invalid input form variable types |
 | `METHOD_NOT_FOUND` | `-32601` | Unrecognized JSON-RPC method sent with an `id` (returned with HTTP 400) |
 | `INTERNAL_ERROR` | `-32603` | Unexpected server-side failure |
 
-All JSON-RPC errors follow the standard JSON-RPC 2.0 error envelope. The `id` field echoes the request's `id` [[17]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L20-L26).
+All JSON-RPC errors follow the standard JSON-RPC 2.0 error envelope. The `id` field echoes the request's `id`, which may be an int, float, string, or `null` [[17]](https://github.com/langgenius/dify/blob/451faa0e68fe51d5960d184e5dd234d9926a3848/api/controllers/mcp/mcp.py#L20-L26).
+
+Identity failures are deliberately indistinguishable. A missing server, a missing or tenant-mismatched backing app, an inactive server, and a `server_code` reassigned between the preflight check and execution all return HTTP 404 with code `-32600` and the message `"Server Not Found"`. Because identity is resolved before the body is parsed, this also applies to malformed or oversized JSON bodies; in that case the response echoes a bounded string or number `id` from the request, or `null`.
 
 #### Unrecognized Methods
 

---