fix: EndUser is not bound to a Session (#25010)

api/controllers/service_api/wraps.py

@@ -291,27 +291,28 @@ def create_or_update_end_user_for_user_id(app_model: App, user_id: Optional[str]
     if not user_id:
         user_id = "DEFAULT-USER"
 
-    end_user = (
+    with Session(db.engine, expire_on_commit=False) as session:
-        db.session.query(EndUser)
+        end_user = (
-        .where(
+            session.query(EndUser)
-            EndUser.tenant_id == app_model.tenant_id,
+            .where(
-            EndUser.app_id == app_model.id,
+                EndUser.tenant_id == app_model.tenant_id,
-            EndUser.session_id == user_id,
+                EndUser.app_id == app_model.id,
-            EndUser.type == "service_api",
+                EndUser.session_id == user_id,
+                EndUser.type == "service_api",
+            )
+            .first()
         )
-        .first()
-    )
 
-    if end_user is None:
+        if end_user is None:
-        end_user = EndUser(
+            end_user = EndUser(
-            tenant_id=app_model.tenant_id,
+                tenant_id=app_model.tenant_id,
-            app_id=app_model.id,
+                app_id=app_model.id,
-            type="service_api",
+                type="service_api",
-            is_anonymous=user_id == "DEFAULT-USER",
+                is_anonymous=user_id == "DEFAULT-USER",
-            session_id=user_id,
+                session_id=user_id,
-        )
+            )
-        db.session.add(end_user)
+            session.add(end_user)
-        db.session.commit()
+            session.commit()
 
     return end_user
 

api/controllers/web/wraps.py

@@ -4,6 +4,7 @@ from functools import wraps
 from flask import request
 from flask_restx import Resource
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 from werkzeug.exceptions import BadRequest, NotFound, Unauthorized
 
 from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError
@@ -49,18 +50,19 @@ def decode_jwt_token():
         decoded = PassportService().verify(tk)
         app_code = decoded.get("app_code")
         app_id = decoded.get("app_id")
-        app_model = db.session.scalar(select(App).where(App.id == app_id))
+        with Session(db.engine, expire_on_commit=False) as session:
-        site = db.session.scalar(select(Site).where(Site.code == app_code))
+            app_model = session.scalar(select(App).where(App.id == app_id))
-        if not app_model:
+            site = session.scalar(select(Site).where(Site.code == app_code))
-            raise NotFound()
+            if not app_model:
-        if not app_code or not site:
+                raise NotFound()
-            raise BadRequest("Site URL is no longer valid.")
+            if not app_code or not site:
-        if app_model.enable_site is False:
+                raise BadRequest("Site URL is no longer valid.")
-            raise BadRequest("Site is disabled.")
+            if app_model.enable_site is False:
-        end_user_id = decoded.get("end_user_id")
+                raise BadRequest("Site is disabled.")
-        end_user = db.session.scalar(select(EndUser).where(EndUser.id == end_user_id))
+            end_user_id = decoded.get("end_user_id")
-        if not end_user:
+            end_user = session.scalar(select(EndUser).where(EndUser.id == end_user_id))
-            raise NotFound()
+            if not end_user:
+                raise NotFound()
 
         # for enterprise webapp auth
         app_web_auth_enabled = False