chore(release): v6.13.8 (DO NOT MERGE)

docs/src/content/docs/features/Multi-User Mode/admin-guide.mdx

@@ -218,6 +218,34 @@ view the models previously installed, but cannot add or modify them.
 
 ## Security
 
+### Download URL Restrictions
+
+These restrictions apply to every download the server performs on your behalf —
+model installs from URLs are the main case. (The old general-purpose
+`/api/v1/download_queue` REST endpoint, which accepted an arbitrary URL and
+destination path, has been removed.)
+
+Downloads are refused when the URL resolves to a loopback, link-local or
+private-network address. This stops a download URL from being used to reach
+services that only the server can see, such as an admin interface bound to
+`127.0.0.1` or a cloud instance-metadata endpoint. Redirects are checked at
+every hop, so a public URL cannot bounce the server onto a private address.
+
+If you install models from a mirror on your own network, re-enable those
+addresses in `invokeai.yaml`:
+
+```yaml
+allow_private_download_urls: true
+```
+
+For security, the guarded downloader ignores ambient `HTTP_PROXY`, `HTTPS_PROXY`,
+and `ALL_PROXY` settings. It still honors `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`,
+and `.netrc`. If direct outbound access is unavailable, set `download_proxy` to an
+explicit proxy whose destination policy blocks private addresses; proxy-side DNS
+cannot be checked by InvokeAI. Do not enable `allow_private_download_urls` merely to
+make an untrusted proxy work. The two settings are independent: `download_proxy` is
+honored whether or not `allow_private_download_urls` is enabled.
+
 :::note[Strict Password Checking]
 It is recommended that you enable strict password checking.  This will
 force all users to select good passwords that follow the

docs/src/content/docs/index.mdx

@@ -118,8 +118,8 @@ Ready to unleash your creativity? Invoke is available for Windows, macOS, and Li
 
 ---
 
-:::note[About the Hosted Version]
-The Invoke hosted platform has been shut down as the founding team joined Adobe. However, Invoke lives on as a thriving open-source project maintained by the community.
+:::note[About the former officially-hosted version]
+The Invoke.ai hosted platform has been shut down as the founding team joined Adobe. However, Invoke lives on as a thriving open-source project maintained by the community.
 
 The open-source version offers the same powerful features you may have used in the hosted service, with the added benefit of complete control and privacy through self-hosting.
 

docs/src/generated/settings.json

@@ -696,6 +696,28 @@
       "type": "<class 'bool'>",
       "validation": {}
     },
+    {
+      "category": "MODEL INSTALL",
+      "default": false,
+      "description": "Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.",
+      "env_var": "INVOKEAI_ALLOW_PRIVATE_DOWNLOAD_URLS",
+      "literal_values": [],
+      "name": "allow_private_download_urls",
+      "required": false,
+      "type": "<class 'bool'>",
+      "validation": {}
+    },
+    {
+      "category": "MODEL INSTALL",
+      "default": null,
+      "description": "Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.",
+      "env_var": "INVOKEAI_DOWNLOAD_PROXY",
+      "literal_values": [],
+      "name": "download_proxy",
+      "required": false,
+      "type": "typing.Optional[str]",
+      "validation": {}
+    },
     {
       "category": "MODEL INSTALL",
       "default": false,

docs/src/lib/components/DownloadOptions.astro

@@ -1,5 +1,5 @@
 ---
-import { LinkCard, Icon, LinkButton } from '@astrojs/starlight/components';
+import { CardGrid, LinkCard, Icon, LinkButton } from '@astrojs/starlight/components';
 import { type StarlightIcon } from '@astrojs/starlight/types';
 import { withBase } from '../base-path';
 
@@ -49,6 +49,24 @@ const manualDownloadOptions = {
     href: withBase('/configuration/docker/', import.meta.env.BASE_URL),
   },
 };
+
+const hostedOptions = {
+  aibadgr: {
+     headline: 'Run on AI Badgr',
+     description: 'Run on the AI Badgr hosted GPU service',
+     href: 'https://aibadgr.com/gpu/launch?template=invokeai',
+   },
+  runpod: {
+     headline: 'Run on RunPod',
+     description: 'Run on the RunPod hosted GPU service',
+     href: 'https://www.runpod.io/blog/invoke-ai-stable-diffusion-runpod-nfz18',
+   },
+  railway: {
+     headline: 'Run on Railway',
+     description: 'Run on the Railway hosted GPU service',
+     href: 'https://railway.com/deploy/invokeai',
+   },
+};
 ---
 
 <div class="download-options">
@@ -92,6 +110,20 @@ const manualDownloadOptions = {
       ))
     }
   </div>
+
+  <!-- Hosted Options -->
+  <div class="download-options__hosted">
+    <h3>Hosted Options</h3>
+    <p>For users who want to run Invoke on a hosted GPU service instead of their own hardware.</p>
+
+    <CardGrid>
+      {
+        Object.entries(hostedOptions).map(([key, { headline, href, description }]) => (
+          <LinkCard title={headline} {href} {description} />
+        ))
+      }
+    </CardGrid>
+  </div>
 </div>
 
 <style is:global>
@@ -134,6 +166,23 @@ const manualDownloadOptions = {
     }
   }
 
+  .download-options__hosted {
+    margin: 0;
+    border-radius: var(--radius);
+    background: var(--sl-color-black);
+    border: 1px solid var(--sl-color-gray-5);
+    padding: 1.5rem;
+
+    h3 {
+      margin-top: 0;
+    }
+
+    > p {
+      margin-top: 0.5rem;
+      color: var(--sl-color-gray-2);
+    }
+  }
+
   .download-options--launcher {
     display: grid;
     gap: 1.5rem;

docs/src/styles/custom.css

@@ -342,6 +342,11 @@ article.card {
 
 /* Splash Page-specific styles */
 
+/* Make the default body font a bit smaller on the splash/home page. */
+[data-has-hero] .sl-markdown-content {
+  font-size: 0.9rem;
+}
+
 @keyframes splash-animate {
   0% { background-position: 0% 0%; }
   50% { background-position: 0% 100%; }

invokeai/app/api/routers/app_info.py

@@ -11,7 +11,7 @@
 from fastapi.routing import APIRouter
 from pydantic import BaseModel, Field, model_validator
 
-from invokeai.app.api.auth_dependencies import AdminUserOrDefault
+from invokeai.app.api.auth_dependencies import AdminUserOrDefault, CurrentUserOrDefault
 from invokeai.app.api.dependencies import ApiDependencies
 from invokeai.app.services.config.config_default import (
     EXTERNAL_PROVIDER_CONFIG_FIELDS,
@@ -55,7 +55,7 @@ async def get_version() -> AppVersion:
 
 
 @app_router.get("/app_deps", operation_id="get_app_deps", status_code=200, response_model=dict[str, str])
-async def get_app_deps() -> dict[str, str]:
+async def get_app_deps(current_user: CurrentUserOrDefault) -> dict[str, str]:
     deps: dict[str, str] = {dist.metadata["Name"]: dist.version for dist in distributions()}
     try:
         cuda = getattr(getattr(torch, "version", None), "cuda", None) or "N/A"  # pyright: ignore[reportAttributeAccessIssue]
@@ -70,7 +70,7 @@ async def get_app_deps() -> dict[str, str]:
 
 
 @app_router.get("/patchmatch_status", operation_id="get_patchmatch_status", status_code=200, response_model=bool)
-async def get_patchmatch_status() -> bool:
+async def get_patchmatch_status(current_user: CurrentUserOrDefault) -> bool:
     return PatchMatch.patchmatch_available()
 
 
@@ -139,12 +139,46 @@ def validate_explicit_nulls(self) -> "UpdateAppGenerationSettingsRequest":
         return self
 
 
+REDACTED_SECRET = "**********"
+
+
+def _redact_config_secrets(config: InvokeAIAppConfig) -> InvokeAIAppConfig:
+    """Return a copy of the config with credential fields masked.
+
+    The runtime config carries provider API keys and model-download bearer tokens. The route is admin-only, but no
+    client - not even an admin's browser - has any use for the raw values; the UI only cares whether a credential is
+    configured.
+
+    NOTE: coverage is by convention, not automatic. Only `*_api_key` fields listed in
+    EXTERNAL_PROVIDER_CONFIG_FIELDS plus `remote_api_tokens` and credentials embedded in
+    `download_proxy` are masked. If you add a credential to InvokeAIAppConfig under any other
+    name, you must extend this function or it will be served verbatim.
+    """
+    updates: dict[str, Any] = {}
+
+    for field_name in EXTERNAL_PROVIDER_CONFIG_FIELDS:
+        if not field_name.endswith("_api_key"):
+            continue
+        if getattr(config, field_name, None):
+            updates[field_name] = REDACTED_SECRET
+
+    if config.remote_api_tokens:
+        updates["remote_api_tokens"] = [
+            pair.model_copy(update={"token": REDACTED_SECRET}) for pair in config.remote_api_tokens
+        ]
+
+    if config.download_proxy and "@" in config.download_proxy:
+        updates["download_proxy"] = REDACTED_SECRET
+
+    return config.model_copy(update=updates) if updates else config
+
+
 @app_router.get(
     "/runtime_config", operation_id="get_runtime_config", status_code=200, response_model=InvokeAIAppConfigWithSetFields
 )
-async def get_runtime_config() -> InvokeAIAppConfigWithSetFields:
+async def get_runtime_config(current_admin: AdminUserOrDefault) -> InvokeAIAppConfigWithSetFields:
     config = get_config()
-    return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=config)
+    return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=_redact_config_secrets(config))
 
 
 @app_router.patch(
@@ -169,7 +203,7 @@ async def update_runtime_config(
 
         persisted_config.update_config(update_dict)
         persisted_config.write_file(config.config_file_path)
-        return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=config)
+        return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=_redact_config_secrets(config))
 
 
 @app_router.get(
@@ -178,7 +212,7 @@ async def update_runtime_config(
     status_code=200,
     response_model=list[ExternalProviderStatusModel],
 )
-async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
+async def get_external_provider_statuses(current_user: CurrentUserOrDefault) -> list[ExternalProviderStatusModel]:
     statuses = ApiDependencies.invoker.services.external_generation.get_provider_statuses()
     return [status_to_model(status) for status in statuses.values()]
 
@@ -189,7 +223,7 @@ async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
     status_code=200,
     response_model=list[ExternalProviderConfigModel],
 )
-async def get_external_provider_configs() -> list[ExternalProviderConfigModel]:
+async def get_external_provider_configs(current_admin: AdminUserOrDefault) -> list[ExternalProviderConfigModel]:
     config = get_config()
     return [_build_external_provider_config(provider_id, config) for provider_id in EXTERNAL_PROVIDER_FIELDS]
 
@@ -340,7 +374,7 @@ def _remove_external_models_for_provider(provider_id: str) -> None:
     responses={200: {"description": "The operation was successful"}},
     response_model=LogLevel,
 )
-async def get_log_level() -> LogLevel:
+async def get_log_level(current_admin: AdminUserOrDefault) -> LogLevel:
     """Returns the log level"""
     return LogLevel(ApiDependencies.invoker.services.logger.level)
 
@@ -352,6 +386,7 @@ async def get_log_level() -> LogLevel:
     response_model=LogLevel,
 )
 async def set_log_level(
+    current_admin: AdminUserOrDefault,
     level: LogLevel = Body(description="New log verbosity level"),
 ) -> LogLevel:
     """Sets the log verbosity level"""
@@ -364,7 +399,7 @@ async def set_log_level(
     operation_id="clear_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def clear_invocation_cache() -> None:
+async def clear_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.clear()
 
@@ -374,7 +409,7 @@ async def clear_invocation_cache() -> None:
     operation_id="enable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def enable_invocation_cache() -> None:
+async def enable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.enable()
 
@@ -384,7 +419,7 @@ async def enable_invocation_cache() -> None:
     operation_id="disable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def disable_invocation_cache() -> None:
+async def disable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.disable()
 
@@ -394,6 +429,6 @@ async def disable_invocation_cache() -> None:
     operation_id="get_invocation_cache_status",
     responses={200: {"model": InvocationCacheStatus}},
 )
-async def get_invocation_cache_status() -> InvocationCacheStatus:
+async def get_invocation_cache_status(current_admin: AdminUserOrDefault) -> InvocationCacheStatus:
     """Clears the invocation cache"""
     return ApiDependencies.invoker.services.invocation_cache.get_status()