refactor(core): migrate backend backbone from Quart to FastAPI and introduce more OpenAPI by Soulter · Pull Request #8688 · AstrBotDevs/AstrBot

Soulter · 2026-06-08T16:17:44Z

Migrate backend backbone from Quart to FastAPI
Introduce more OpenAPIs to boost AstrBot economy
Improve backend structures
This PR is not a break change PR

Modifications / 改动点

This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

Checklist / 检查清单

😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
/ 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。
👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
/ 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。
🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
/ 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到 requirements.txt 和 pyproject.toml 文件相应位置。
😮 My changes do not introduce malicious code.
/ 我的更改没有引入恶意代码。

sourcery-ai

Sorry, we are unable to review this pull request

The GitHub API does not allow us to fetch diffs exceeding 20000 lines

github-advanced-security

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

gemini-code-assist

Code Review

This pull request migrates the AstrBot dashboard and webhook servers from Quart to FastAPI, introducing a new ASGI runtime adapter, a unified FastAPI webhook server, and restructuring all dashboard API endpoints into FastAPI routers. The review feedback highlights several critical issues: FastAPIAppAdapter needs to register itself on the FastAPI application state to prevent authentication failures over HTTP in local development; the require_scope dependency must be updated to check cookies to support dashboard users; the close callback in open_api.py should be an asynchronous function to ensure the WebSocket close coroutine is properly awaited; and inspect.signature in the webhook server should be called once during route registration rather than on every request to avoid performance bottlenecks.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

- Updated API client configuration to use a dedicated HTTP client. - Introduced utility functions for generating options, queries, and form data for API requests. - Refactored multiple API methods to utilize the new utility functions for improved consistency and readability. - Renamed types for clarity and updated import statements accordingly. feat(docs): add script to update OpenAPI JSON from YAML spec - Created a Python script to convert OpenAPI YAML specification to JSON format. - The script supports customizable input and output paths. - Ensured the script handles directory creation for output paths and validates the YAML structure.

… request handling

…atibility - Changed all instances of dashboard_router to legacy_router across multiple API modules including platform, plugins, providers, sessions, skills, stats, subagents, t2i, tools, updates, and asgi_runtime. - Updated route definitions to ensure existing endpoints remain functional under the new router structure. - Introduced support for Quart request context in asgi_runtime to enhance compatibility with existing Quart-based plugins. - Added a test case to validate the functionality of the new Quart request context handling in plugin extensions.

Soulter · 2026-06-14T04:54:57Z

@gemini-code-assist /gemini review

gemini-code-assist

Code Review

This pull request transitions the dashboard HTTP API and service layer from Quart to FastAPI, introducing a new FastAPIWebhookServer and rewriting all dashboard API routes into FastAPI routers while maintaining legacy endpoints for backward compatibility. The review feedback highlights critical bugs, including an invalid multi_items() call on Starlette's FormData in multipart.py and an asynchronous property returning a coroutine instead of a dictionary in asgi_runtime.py. High-severity path traversal vulnerabilities were also identified in the static files and backups routes due to unvalidated path parameters. Additionally, the reviewer recommended refactoring duplicated UploadFileAdapter classes, optimizing StreamingResponse when wrapping BytesIO objects, and making user_id a required query parameter in conversation endpoints.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Soulter · 2026-06-14T05:26:16Z

@gemini-code-assist /gemini review

gemini-code-assist

Code Review

This pull request migrates the dashboard HTTP API and platform webhook servers from Quart to FastAPI/Starlette, introducing a modular API structure under astrbot/dashboard/api/ and an ASGI runtime adapter to bridge legacy request contexts. The review feedback highlights critical issues where Starlette's FormData is incorrectly accessed using multi_items() instead of items(), which will cause runtime AttributeErrors during form and file uploads. Additionally, a compatibility issue was identified in stats.py where the | union operator is used inside isinstance(), which will fail on Python versions older than 3.10.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-14T05:28:43Z

+        form = await self._request.form()
+        form_pairs: list[tuple[str, Any]] = []
+        file_pairs: list[tuple[str, Any]] = []
+        for key, value in form.multi_items():


Similar to the issue in multipart.py, Starlette's FormData does not have a multi_items() method. Using form.items() instead will correctly retrieve all key-value pairs. Leaving multi_items() here will cause an AttributeError whenever form data or files are accessed on the request.

Suggested change

for key, value in form.multi_items():

for key, value in form.items():

gemini-code-assist · 2026-06-14T05:28:43Z

+def _parse_int(value: object, default: int, name: str) -> int:
+    if value is None:
+        return default
+    if not isinstance(value, int | float | str | bytes | bytearray):


Using the | union operator inside isinstance() is only supported in Python 3.10+. If the application is run on Python 3.9 or lower, this will raise a TypeError at runtime. To ensure backward compatibility, please use a tuple of types instead: isinstance(value, (int, float, str, bytes, bytearray)).

Suggested change

if not isinstance(value, int | float | str | bytes | bytearray):

if not isinstance(value, (int, float, str, bytes, bytearray)):

mrlubos · 2026-06-14T08:23:23Z

@@ -47,6 +50,7 @@
    "yup": "1.2.0"
  },
  "devDependencies": {
+    "@hey-api/openapi-ts": "0.60.0",


@Soulter why use such an old version?

…troduce more OpenAPI (AstrBotDevs#8688) * refactor: migrate to fastapi * structure refactor * fix: pyright fix * refactor: improve error handling and public messages in plugin services * feat(api): refactor API client integration and enhance request handling - Updated API client configuration to use a dedicated HTTP client. - Introduced utility functions for generating options, queries, and form data for API requests. - Refactored multiple API methods to utilize the new utility functions for improved consistency and readability. - Renamed types for clarity and updated import statements accordingly. feat(docs): add script to update OpenAPI JSON from YAML spec - Created a Python script to convert OpenAPI YAML specification to JSON format. - The script supports customizable input and output paths. - Ensured the script handles directory creation for output paths and validates the YAML structure. * fix * feat(auth): implement rate limiting for v1 login endpoint and enhance request handling * Refactor dashboard API routers to use legacy_router for backward compatibility - Changed all instances of dashboard_router to legacy_router across multiple API modules including platform, plugins, providers, sessions, skills, stats, subagents, t2i, tools, updates, and asgi_runtime. - Updated route definitions to ensure existing endpoints remain functional under the new router structure. - Introduced support for Quart request context in asgi_runtime to enhance compatibility with existing Quart-based plugins. - Added a test case to validate the functionality of the new Quart request context handling in plugin extensions. * chore: remove cli test * fix: update dashboard tests for fastapi migration * chore: satisfy ruff checks * fix: update openapi api key scopes * fix: sync config scope chip selection * fix: restore quart dependency * docs: clarify quart plugin api compatibility * docs: update openapi scope documentation * fix: use singular skill openapi scope * fix: hide update service exception details * fix: address fastapi review comments * fix: address dashboard review findings * docs: revert unrelated package deployment changes * docs: update agent api generation guidance * feat: add plugin page web api helpers * docs: add plugin page bridge demo * fix: type plugin upload files * fix: stabilize plugin page uploads * fix: type plugin web request proxy * docs: remove plugin page docs example * fix: authenticate plugin page SSE bridge

Resolve modify/delete conflict from the Quart->FastAPI dashboard migration (AstrBotDevs#8688): the old astrbot/dashboard/routes/config.py was removed upstream. Re-applied the Vertex AI provider-source normalization in the new service layer (astrbot/dashboard/services/config_service.py: upsert_provider_source). The model-list path already terminates instances via try/finally and normalizes configs in ProviderGoogleGenAI.__init__, so no extra hook is needed there. Restored the dropped 'from pathlib import Path' import in gemini_source.py.

…troduce more OpenAPI (AstrBotDevs#8688) * refactor: migrate to fastapi * structure refactor * fix: pyright fix * refactor: improve error handling and public messages in plugin services * feat(api): refactor API client integration and enhance request handling - Updated API client configuration to use a dedicated HTTP client. - Introduced utility functions for generating options, queries, and form data for API requests. - Refactored multiple API methods to utilize the new utility functions for improved consistency and readability. - Renamed types for clarity and updated import statements accordingly. feat(docs): add script to update OpenAPI JSON from YAML spec - Created a Python script to convert OpenAPI YAML specification to JSON format. - The script supports customizable input and output paths. - Ensured the script handles directory creation for output paths and validates the YAML structure. * fix * feat(auth): implement rate limiting for v1 login endpoint and enhance request handling * Refactor dashboard API routers to use legacy_router for backward compatibility - Changed all instances of dashboard_router to legacy_router across multiple API modules including platform, plugins, providers, sessions, skills, stats, subagents, t2i, tools, updates, and asgi_runtime. - Updated route definitions to ensure existing endpoints remain functional under the new router structure. - Introduced support for Quart request context in asgi_runtime to enhance compatibility with existing Quart-based plugins. - Added a test case to validate the functionality of the new Quart request context handling in plugin extensions. * chore: remove cli test * fix: update dashboard tests for fastapi migration * chore: satisfy ruff checks * fix: update openapi api key scopes * fix: sync config scope chip selection * fix: restore quart dependency * docs: clarify quart plugin api compatibility * docs: update openapi scope documentation * fix: use singular skill openapi scope * fix: hide update service exception details * fix: address fastapi review comments * fix: address dashboard review findings * docs: revert unrelated package deployment changes * docs: update agent api generation guidance * feat: add plugin page web api helpers * docs: add plugin page bridge demo * fix: type plugin upload files * fix: stabilize plugin page uploads * fix: type plugin web request proxy * docs: remove plugin page docs example * fix: authenticate plugin page SSE bridge

sourcery-ai Bot reviewed Jun 8, 2026

View reviewed changes

github-advanced-security AI found potential problems Jun 8, 2026

View reviewed changes

gemini-code-assist Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread astrbot/dashboard/asgi_runtime.py

Comment thread astrbot/dashboard/api/auth.py Outdated

Comment thread astrbot/core/platform/webhook_server.py

Comment thread astrbot/dashboard/api/open_api.py

dosubot Bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Jun 9, 2026

github-advanced-security AI found potential problems Jun 9, 2026

View reviewed changes

Comment thread astrbot/dashboard/api/updates.py Fixed

Soulter added 10 commits June 14, 2026 11:11

refactor: migrate to fastapi

f72b1c3

structure refactor

824f2d0

fix: pyright fix

8606dbc

refactor: improve error handling and public messages in plugin services

b64232f

fix

961d27f

feat(auth): implement rate limiting for v1 login endpoint and enhance…

d0be71d

… request handling

chore: remove cli test

1846591

fix: update dashboard tests for fastapi migration

9f92e5b

Soulter force-pushed the backend-refactor branch from ee83b2e to 9f92e5b Compare June 14, 2026 03:23

Soulter added 9 commits June 14, 2026 11:28

chore: satisfy ruff checks

eb94c09

fix: update openapi api key scopes

528ac16

fix: sync config scope chip selection

a4379d5

fix: restore quart dependency

64bc6ef

docs: clarify quart plugin api compatibility

b13c32d

docs: update openapi scope documentation

e037ab8

fix: use singular skill openapi scope

bed3db1

fix: hide update service exception details

1721e54

fix: address fastapi review comments

6fb7dc3

gemini-code-assist Bot reviewed Jun 14, 2026

View reviewed changes

Soulter changed the title ~~backend refactor~~ refactor(core): migrate backend backbone from Quart to FastAPI and introduce more OpenAPI Jun 14, 2026

fix: address dashboard review findings

575edfb

gemini-code-assist Bot reviewed Jun 14, 2026

View reviewed changes

Soulter added 9 commits June 14, 2026 13:32

docs: revert unrelated package deployment changes

defdc53

docs: update agent api generation guidance

399885e

feat: add plugin page web api helpers

e431bdf

docs: add plugin page bridge demo

28a8d13

fix: type plugin upload files

f3ad696

fix: stabilize plugin page uploads

10bb3fb

fix: type plugin web request proxy

36a89c8

docs: remove plugin page docs example

77210f7

fix: authenticate plugin page SSE bridge

7803be2

Soulter merged commit 0d8e868 into master Jun 14, 2026
20 checks passed

Soulter deleted the backend-refactor branch June 14, 2026 07:03

mrlubos reviewed Jun 14, 2026

View reviewed changes

he-yufeng mentioned this pull request Jun 14, 2026

fix: clear deleted knowledge bases from sessions #8259

Closed

dosubot Bot mentioned this pull request Jun 26, 2026

[Bug] QQ官方机器人提示处理 webhook 回调时发生错误 #9021

Closed

2 tasks

JosephTian876 mentioned this pull request Jul 31, 2026

fix(kb): resolve kb_id path parameter in dashboard retrieve endpoint #9485

Open

5 tasks

	for key, value in form.multi_items():
	for key, value in form.items():

	if not isinstance(value, int \| float \| str \| bytes \| bytearray):
	if not isinstance(value, (int, float, str, bytes, bytearray)):

Uh oh!

Uh oh!

Conversation

Soulter commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Modifications / 改动点

Screenshots or Test Results / 运行截图或测试结果

Checklist / 检查清单

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI left a comment

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Soulter commented Jun 14, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Soulter commented Jun 14, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist Bot Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mrlubos Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Soulter commented Jun 8, 2026 •

edited

Loading