Alex
a3d09e8890
Address the high/medium correctness findings on the OIDC/SCIM PR: - Login CSRF / session fixation: bind `state` to a Secure/HttpOnly/SameSite=Lax cookie at login and require the callback to echo it, so a code+state captured from another browser can't silently sign a victim into the attacker's account. - Require `exp` on session JWTs under AUTH_TYPE=oidc (require_exp), so an exp-less HS256 token signed with JWT_SECRET_KEY can't authenticate forever or outlive the denylist. - Denylist now keys revocation on an `iat` watermark instead of a deletable flag: a fresh login (newer iat) self-supersedes a revocation without clearing it, so sessions revoked on other devices stay revoked. Drops the login/SCIM-reactivation denylist-clearing paths (allow_user/allow_idp_sub). - Refresh: gate the disabled-account check on the post-grant identity (not just the old sub); attempt the IdP grant before consuming the refresh token and return a retryable 503 (restoring the token) on transient IdP errors instead of force-logging-out a live session. - Gate the oidc blueprint at request time on AUTH_TYPE=oidc, so non-oidc deployments cleanly 404 these routes instead of 500-ing on an unset OIDC_ISSUER (mirrors SCIM_ENABLED). - Surface revocation write failures: back-channel logout returns 502, and SCIM deactivation rolls back and returns 503, when the denylist write fails — so the IdP retries instead of recording a logout/deprovision that didn't revoke. - Back-channel logout: require `jti`, run the replay check unconditionally, and reject stale `iat` beyond the replay-cache window. - Make migration 0017 idempotent (IF NOT EXISTS) so re-apply can't wedge startup. - SCIM userName matching is case-insensitive (caseExact=false) for the list filter and create-dedup. Tests added/updated across test_oidc.py, test_scim.py, test_auth.py, test_app_routes.py and the SCIM integration test.
DocsGPT 🦖
Private AI for agents, assistants and enterprise search
DocsGPT is an open-source AI platform for building intelligent agents and assistants. Features Agent Builder, deep research tools, document analysis (PDF, Office, web content, and audio), Multi-model support (choose your provider or run locally), and rich API connectivity for agents with actionable tools and integrations. Deploy anywhere with complete privacy control.
Key Features:
- 🗂️ Wide Format Support: Reads PDF, DOCX, CSV, XLSX, EPUB, MD, RST, HTML, MDX, JSON, PPTX, images, and audio files such as MP3, WAV, M4A, OGG, and WebM.
- 🎙️ Speech Workflows: Record voice input into chat, transcribe audio on the backend, and ingest meeting recordings or voice notes as searchable knowledge.
- 🌐 Web & Data Integration: Ingests from URLs, sitemaps, Reddit, GitHub and web crawlers.
- ✅ Reliable Answers: Get accurate, hallucination-free responses with source citations viewable in a clean UI.
- 🔑 Streamlined API Keys: Generate keys linked to your settings, documents, and models, simplifying chatbot and integration setup.
- 🔗 Actionable Tooling: Connect to APIs, tools, and other services to enable LLM actions.
- 🧩 Pre-built Integrations: Use readily available HTML/React chat widgets, search tools, Discord/Telegram bots, and more.
- 🔌 Flexible Deployment: Works with major LLMs (OpenAI, Google, Anthropic) and local models (Ollama, llama_cpp).
- 🏢 Secure & Scalable: Run privately and securely with Kubernetes support, designed for enterprise-grade reliability.
Roadmap
- Agent Workflow Builder with conditional nodes ( February 2026 )
- SharePoint & Confluence connectors ( March – April 2026 )
- Research mode ( March 2026 )
- Postgres migration for user data ( April 2026 )
- OpenTelemetry observability ( April 2026 )
- Bring Your Own Model (BYOM) ( April 2026 )
- Agent scheduling (RedBeat-backed) ( Q2 2026 )
You can find our full roadmap here. Please don't hesitate to contribute or create issues, it helps us improve DocsGPT!
Production Support / Help for Companies:
We're eager to provide personalized assistance when deploying your DocsGPT to a live environment.
Join the Lighthouse Program 🌟
Calling all developers and GenAI innovators! The DocsGPT Lighthouse Program connects technical leaders actively deploying or extending DocsGPT in real-world scenarios. Collaborate directly with our team to shape the roadmap, access priority support, and build enterprise-ready solutions with exclusive community insights.
QuickStart
Note
Make sure you have Docker installed
A more detailed Quickstart is available in our documentation
-
Clone the repository:
git clone https://github.com/arc53/DocsGPT.git cd DocsGPT
For macOS and Linux:
-
Run the setup script:
./setup.sh
For Windows:
-
Run the PowerShell setup script:
PowerShell -ExecutionPolicy Bypass -File .\setup.ps1
Either script will guide you through setting up DocsGPT. Five options available: using the public API, running locally, connecting to a local inference engine, using a cloud API provider, or build the docker image locally. Scripts will automatically configure your .env file and handle necessary downloads and installations based on your chosen option.
Navigate to http://localhost:5173/
To stop DocsGPT, open a terminal in the DocsGPT directory and run:
docker compose -f deployment/docker-compose.yaml down
(or use the specific docker compose down command shown after running the setup script).
Note
For development environment setup instructions, please refer to the Development Environment Guide.
Contributing
Please refer to the CONTRIBUTING.md file for information about how to get involved. We welcome issues, questions, and pull requests.
Architecture
Project Structure
-
Application - Flask app (main application).
-
Extensions - Extensions, like react widget or discord bot.
-
Scripts - Miscellaneous scripts.
Code Of Conduct
We as members, contributors, and leaders, pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Please refer to the CODE_OF_CONDUCT.md file for more information about contributing.
Many Thanks To Our Contributors⚡
License
The source code license is MIT, as described in the LICENSE file.
This project is supported by:
