Merge branch 'main' into production

Author: maxtechera

.github/workflows/main.yml

@@ -26,14 +26,14 @@ jobs:
               uses: actions/setup-node@v4
               with:
                   node-version: ${{ matrix.node-version }}
-                  check-latest: false
                   cache: 'pnpm'
-            - run: npm i -g pnpm
+                  cache-dependency-path: 'pnpm-lock.yaml'
             - run: pnpm install
-            - run: ./node_modules/.bin/cypress install
             - run: pnpm lint
             - run: pnpm build
-            - name: Install dependencies
+            - name: Cypress install
+              run: pnpm cypress install
+            - name: Install dependencies (Cypress Action)
               uses: cypress-io/github-action@v6
               with:
                   working-directory: ./

CONTRIBUTING.md

@@ -137,11 +137,12 @@ Note: The TheAnswer package is currently under development and not yet published
 
 ### Docker Compose
 
-1. Go to `docker` folder at the root of the project
-2. Copy `.env.example` file, paste it into the same location, and rename to `.env`
-3. `docker compose up -d`
-4. Open [http://localhost:3000](http://localhost:3000)
-5. You can bring the containers down by `docker compose stop`
+1. Clone the Flowise project
+2. Go to `docker` folder at the root of the project
+3. Copy `.env.example` file, paste it into the same location, and rename to `.env` file
+4. `docker compose up -d`
+5. Open [http://localhost:3000](http://localhost:3000)
+6. You can bring the containers down by `docker compose stop`
 
 ### Docker Image
 
@@ -174,6 +175,7 @@ All packages inside `packages/*` are from the original Flowise project:
 -   `embed`: Embedding functionality
 -   `embed-react`: React components for embedding
 -   `flowise-configs`: Configuration files for Flowise
+-   `api-documentation`: Auto-generated swagger-ui API docs from express
 
 ### Packages-Answers (TheAnswer-specific)
 
@@ -272,29 +274,29 @@ TheAnswer supports different environment variables to configure your instance. Y
 
 Deploy TheAnswer self-hosted in your existing infrastructure. We support various [deployments](https://docs.theanswer.ai/configuration/deployment)
 
--   [Copilot](./DEPLOYMENT_COPILOT.md)
--   [AWS](https://docs.theanswer.ai/deployment/aws)
--   [Azure](https://docs.theanswer.ai/deployment/azure)
--   [Digital Ocean](https://docs.theanswer.ai/deployment/digital-ocean)
--   [GCP](https://docs.theanswer.ai/deployment/gcp)
+-   [AWS](https://docs.theanswer.ai/configuration/deployment/aws)
+-   [Azure](https://docs.theanswer.ai/configuration/deployment/azure)
+-   [Digital Ocean](https://docs.theanswer.ai/configuration/deployment/digital-ocean)
+-   [GCP](https://docs.theanswer.ai/configuration/deployment/gcp)
+-   [Alibaba Cloud](https://computenest.console.aliyun.com/service/instance/create/default?type=user&ServiceName=Flowise社区版)
 -   <details>
       <summary>Others</summary>
 
-    -   [Railway](https://docs.theanswer.ai/deployment/railway)
+    -   [Railway](https://docs.theanswer.ai/configuration/deployment/railway)
 
         [![Deploy on Railway](https://railway.app/button.svg)](https://railway.app/template/pn4G8S?referralCode=WVNPD9)
 
-    -   [Render](https://docs.theanswer.ai/deployment/render)
+    -   [Render](https://docs.theanswer.ai/configuration/deployment/render)
 
-        [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://docs.theanswer.ai/deployment/render)
+        [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://docs.theanswer.ai/configuration/deployment/render)
 
     -   [HuggingFace Spaces](https://docs.theanswer.ai/deployment/hugging-face)
 
         <a href="https://huggingface.co/spaces/TheAnswer/TheAnswer"><img src="https://huggingface.co/datasets/huggingface/badges/raw/main/open-in-hf-spaces-sm.svg" alt="HuggingFace Spaces"></a>
 
     -   [Elestio](https://elest.io/open-source/theanswer)
 
-        [![Deploy](https://pub-da36157c854648669813f3f76c526c2b.r2.dev/deploy-on-elestio-black.png)](https://elest.io/open-source/theanswer)
+        [![Deploy on Elestio](https://elest.io/images/logos/deploy-to-elestio-btn.png)](https://elest.io/open-source/theanswer)
 
     -   [Sealos](https://cloud.sealos.io/?openapp=system-template%3Dtheanswer)
 
@@ -306,9 +308,9 @@ Deploy TheAnswer self-hosted in your existing infrastructure. We support various
 
       </details>
 
-## 💻 Cloud Hosted
+## ☁️ Flowise Cloud
 
-Visit [https://theanswer.ai/](https://theanswer.ai/) to learn more about our cloud-hosted solution.
+[Get Started with Flowise Cloud](https://theanswer.ai/)
 
 ## 🙋 Support
 
@@ -338,7 +340,7 @@ For detailed contribution guidelines, please refer to our [CONTRIBUTING.md](CONT
 
 ### Contribution to Flowise Core
 
-If your contribution is related to Flowise core functionality, consider submitting it to the [Flowise repository](https://github.com/FlowiseAI/Flowise) first. Once accepted, we can integrate it into TheAnswer.
+If your contribution is related to Flowise core functionality, consider submitting it to the [Flowise repository](https://github.com/theanswer/Flowise) first. Once accepted, we can integrate it into TheAnswer.
 
 Thanks go to these awesome contributors of both TheAnswer and the original Flowise project:
 

README.md

@@ -0,0 +1,40 @@
+### Responsible Disclosure Policy
+
+At Flowise, we prioritize security and continuously work to safeguard our systems. However, vulnerabilities can still exist. If you identify a security issue, please report it to us so we can address it promptly. Your cooperation helps us better protect our platform and users.
+
+### Vulnerabilities
+
+The following types of issues are some of the most common vulnerabilities:
+
+-   Clickjacking on pages without sensitive actions
+-   CSRF on unauthenticated/logout/login pages
+-   Attacks requiring MITM (Man-in-the-Middle) or physical device access
+-   Social engineering attacks
+-   Activities that cause service disruption (DoS)
+-   Content spoofing and text injection without a valid attack vector
+-   Email spoofing
+-   Absence of DNSSEC, CAA, CSP headers
+-   Missing Secure or HTTP-only flag on non-sensitive cookies
+-   Deadlinks
+-   User enumeration
+
+### Reporting Guidelines
+
+-   Submit your findings to https://github.com/FlowiseAI/Flowise/security
+-   Provide clear details to help us reproduce and fix the issue quickly.
+
+### Disclosure Guidelines
+
+-   Do not publicly disclose vulnerabilities until we have assessed, resolved, and notified affected users.
+-   If you plan to present your research (e.g., at a conference or in a blog), share a draft with us at least **30 days in advance** for review.
+-   Avoid including:
+    -   Data from any Flowise customer projects
+    -   Flowise user/customer information
+    -   Details about Flowise employees, contractors, or partners
+
+### Response to Reports
+
+-   We will acknowledge your report within **5 business days** and provide an estimated resolution timeline.
+-   Your report will be kept **confidential**, and your details will not be shared without your consent.
+
+We appreciate your efforts in helping us maintain a secure platform and look forward to working together to resolve any issues responsibly.

SECURITY.md

@@ -12,7 +12,8 @@
         "aai-embed": "workspace:*",
         "flowise-ui": "workspace:*",
         "jose": "^5.2.3",
-        "@auth0/nextjs-auth0": "^3.5.0",
+        "@auth0/nextjs-auth0": "3.5.0",
+        "@auth0/auth0-react": "2.2.4",
         "@aws-sdk/client-s3": "^3.374.0",
         "@aws-sdk/s3-request-presigner": "^3.374.0",
         "@aws-sdk/signature-v4-crt": "^3.357.0",

apps/web/package.json

@@ -1,68 +1,68 @@
 version: '3'
 
 services:
-  # dev-inngest:
-  #   image: node:18
-  #   working_dir: /app/packages/db
-  #   volumes:
-  #     - .:/app
-  #   ports:
-  #     - '8288:8288'
-  #   command: npx inngest-cli@latest dev -u http://127.0.0.1:3000/api/inngest
-  # studio:
-  #   image: node:18
-  #   working_dir: /app/packages/db
-  #   volumes:
-  #     - .:/app
-  #   ports:
-  #     - '5555:5555'
-  #   command: npx prisma studio
-  #   environment:
-  #     - DATABASE_URL=postgresql://example_user:example_password@postgres:5432/example_db?schema=public
-  #   depends_on:
-  #     - postgres
-  redis:
-    image: redis:latest
-    ports:
-      - '6379:6379'
-    volumes:
-      - redis_data:/data
-  postgres:
-    image: postgres:latest
-    ports:
-      - '5432:5432'
-    volumes:
-      - postgres_data:/var/lib/postgresql/data/
-    environment:
-      POSTGRES_PORT: 5432
-      POSTGRES_USER: example_user
-      POSTGRES_PASSWORD: example_password
-      POSTGRES_DB: example_db
-  # langchain-frontend:
-  #   image: notlangchain/langchainplus-frontend:latest
-  #   ports:
-  #     - 4173:4173
-  #   environment:
-  #     - BACKEND_URL=http://langchain-backend:8000
-  #     - PUBLIC_BASE_URL=http://localhost:8000
-  #     - PUBLIC_DEV_MODE=true
-  #   depends_on:
-  #     - langchain-backend
-  # langchain-backend:
-  #   image: notlangchain/langchainplus:latest
-  #   environment:
-  #     - PORT=8000
-  #     - LANGCHAIN_ENV=local
-  #   ports:
-  #     - 8000:8000
-  #   depends_on:
-  #     - langchain-db
-  # langchain-db:
-  #   image: postgres:14.1
-  #   environment:
-  #     - POSTGRES_PASSWORD=postgres
-  #     - POSTGRES_USER=postgres
-  #     - POSTGRES_DB=postgres
+    # dev-inngest:
+    #   image: node:18
+    #   working_dir: /app/packages/db
+    #   volumes:
+    #     - .:/app
+    #   ports:
+    #     - '8288:8288'
+    #   command: npx inngest-cli@latest dev -u http://127.0.0.1:3000/api/inngest
+    # studio:
+    #   image: node:18
+    #   working_dir: /app/packages/db
+    #   volumes:
+    #     - .:/app
+    #   ports:
+    #     - '5555:5555'
+    #   command: npx prisma studio
+    #   environment:
+    #     - DATABASE_URL=postgresql://example_user:example_password@postgres:5432/example_db?schema=public
+    #   depends_on:
+    #     - postgres
+    redis:
+        image: redis:latest
+        ports:
+            - '6379:6379'
+        volumes:
+            - redis_data:/data
+    postgres:
+        image: postgres:16
+        ports:
+            - '5432:5432'
+        volumes:
+            - postgres_data:/var/lib/postgresql/data/
+        environment:
+            POSTGRES_PORT: 5432
+            POSTGRES_USER: example_user
+            POSTGRES_PASSWORD: example_password
+            POSTGRES_DB: example_db
+    # langchain-frontend:
+    #   image: notlangchain/langchainplus-frontend:latest
+    #   ports:
+    #     - 4173:4173
+    #   environment:
+    #     - BACKEND_URL=http://langchain-backend:8000
+    #     - PUBLIC_BASE_URL=http://localhost:8000
+    #     - PUBLIC_DEV_MODE=true
+    #   depends_on:
+    #     - langchain-backend
+    # langchain-backend:
+    #   image: notlangchain/langchainplus:latest
+    #   environment:
+    #     - PORT=8000
+    #     - LANGCHAIN_ENV=local
+    #   ports:
+    #     - 8000:8000
+    #   depends_on:
+    #     - langchain-db
+    # langchain-db:
+    #   image: postgres:14.1
+    #   environment:
+    #     - POSTGRES_PASSWORD=postgres
+    #     - POSTGRES_USER=postgres
+    #     - POSTGRES_DB=postgres
 volumes:
-  postgres_data:
-  redis_data:
+    postgres_data:
+    redis_data:

docker-compose.dev.yml

@@ -5,6 +5,8 @@ SECRETKEY_PATH=/root/.flowise
 LOG_PATH=/root/.flowise/logs
 BLOB_STORAGE_PATH=/root/.flowise/storage
 
+# APIKEY_STORAGE_TYPE=json (json | db)
+
 # NUMBER_OF_PROXIES= 1
 # CORS_ORIGINS=*
 # IFRAME_ORIGINS=*
@@ -18,13 +20,18 @@ BLOB_STORAGE_PATH=/root/.flowise/storage
 # DATABASE_SSL=true
 # DATABASE_SSL_KEY_BASE64=<Self signed certificate in BASE64>
 
+# SECRETKEY_STORAGE_TYPE=local #(local | aws)
+# SECRETKEY_PATH=/your_api_key_path/.flowise
+# FLOWISE_SECRETKEY_OVERWRITE=myencryptionkey
+# SECRETKEY_AWS_ACCESS_KEY=<your-access-key>
+# SECRETKEY_AWS_SECRET_KEY=<your-secret-key>
+# SECRETKEY_AWS_REGION=us-west-2
+
 # FLOWISE_USERNAME=user
 # FLOWISE_PASSWORD=1234
 # FLOWISE_SECRETKEY_OVERWRITE=myencryptionkey
 # FLOWISE_FILE_SIZE_LIMIT=50mb
 
-# DISABLE_CHATFLOW_REUSE=true
-
 # DEBUG=true
 # LOG_LEVEL=info (error | warn | info | verbose | debug)
 # TOOL_FUNCTION_BUILTIN_DEP=crypto,fs
@@ -48,6 +55,43 @@ BLOB_STORAGE_PATH=/root/.flowise/storage
 # S3_STORAGE_SECRET_ACCESS_KEY=<your-secret-key>
 # S3_STORAGE_REGION=us-west-2
 # S3_ENDPOINT_URL=<custom-s3-endpoint-url>
+# S3_FORCE_PATH_STYLE=false
 
-# APIKEY_STORAGE_TYPE=json (json | db)
-# SHOW_COMMUNITY_NODES=true
+# SHOW_COMMUNITY_NODES=true
+# DISABLED_NODES=bufferMemory,chatOpenAI (comma separated list of node names to disable)
+
+######################
+# METRICS COLLECTION
+#######################
+# ENABLE_METRICS=false
+# METRICS_PROVIDER=prometheus # prometheus | open_telemetry
+# METRICS_INCLUDE_NODE_METRICS=true  # default is true
+# METRICS_SERVICE_NAME=FlowiseAI
+
+# ONLY NEEDED if METRICS_PROVIDER=open_telemetry
+# METRICS_OPEN_TELEMETRY_METRIC_ENDPOINT=http://localhost:4318/v1/metrics
+# METRICS_OPEN_TELEMETRY_PROTOCOL=http # http | grpc | proto (default is http)
+# METRICS_OPEN_TELEMETRY_DEBUG=true # default is false
+
+# Uncomment the following lines to enable global agent proxy
+# see https://www.npmjs.com/package/global-agent for more details
+# GLOBAL_AGENT_HTTP_PROXY=CorporateHttpProxyUrl
+# GLOBAL_AGENT_HTTPS_PROXY=CorporateHttpsProxyUrl
+# GLOBAL_AGENT_NO_PROXY=ExceptionHostsToBypassProxyIfNeeded
+
+######################
+# QUEUE CONFIGURATION
+#######################
+# MODE=queue #(queue | main)
+# QUEUE_NAME=flowise-queue
+# QUEUE_REDIS_EVENT_STREAM_MAX_LEN=100000
+# WORKER_CONCURRENCY=100000
+# REDIS_URL=
+# REDIS_HOST=localhost
+# REDIS_PORT=6379
+# REDIS_USERNAME=
+# REDIS_PASSWORD=
+# REDIS_TLS=
+# REDIS_CERT=
+# REDIS_KEY=
+# REDIS_CA=

docker/.env.example

@@ -1,5 +1,5 @@
 # Stage 1: Build stage
-FROM node:20-alpine as build
+FROM node:20-alpine AS build
 
 USER root