Get feature flags from environment variables. Reads ENABLE_BILLING, HIDE_LLM_SETTINGS, ENABLE_JIRA, ENABLE_JIRA_DC, ENABLE_LINEAR, HIDE_USERS

Get a user-friendly session expired message. Used by integrations to notify users when their Keycloak offline session has expired. Args:

Webhook callback for when a conversation starts, pauses, resumes, or deletes. The ``ConversationInfo.agent`` field is an ``AgentBase`` discrimina

Search events matching the given filters.

Create a mock UserContext for testing.

Create a JWS (JSON Web Signature) token. Args: payload: The JWT payload key_id: The key ID to use for signing. If Non

Depends function suitable for use with FastAPI dependency injection.

Encode an integer page identifier as an opaque base64 string. This function exists to ensure that page IDs are opaque tokens that do not reve

Get repositories for the authenticated user

Return an async context manager yielding the request-scoped ``AsyncSession``.

Get all authorization rules that match the given email and provider. Args: email: The user's email address provider_t

Save an event. Internal method intended not be part of the REST api.

Create an async session maker bound to the async engine.

Decrypt and decode a JWE token. Args: token: The JWE token to decrypt key_id: The key ID to use for decryption. If No

Helper method to instantiate a service for a given provider

Get a user-friendly message when a user hasn't created an OpenHands account. Used by integrations to notify users when they try to use OpenHands

Retrieve workspace by name.

Resolve a user_id into a fully-populated :class:`AnalyticsContext`. Performs user lookup via the configured AnalyticsUserProvider, extracts c

URL-encode a component for use in Azure DevOps API URLs. Args: component: The string component to encode (e.g., repo name, projec

Make a request to the Bitbucket API. Args: url: The URL to request params: Optional parameters for the request

Helper to create a TokenEvent for testing.

Create an OrgResponse from an Org entity.

Get the OpenHands labels based on the web host. An explicit ``OH_RESOLVER_LABEL`` environment variable takes precedence and lets each deploym

Get role by ID.

Load settings; opt into the resolved Agent-Profile launch view. The default returns the PERSISTED (composed org + member) settings —

Determine the OpenHands org_id for a resolver conversation. If the repo's git organization is claimed by an OpenHands org, returns the claimi

Update organization with permission checks for LLM settings. Args: org_id: Organization UUID to update updat

Enter every patch in ``patches`` via an ``ExitStack``. Returning the stack lets the caller use ``with stack:`` to guarantee tear-down

Return a stack of patches as a list of context managers. Tests enter all of them via ``contextlib.ExitStack`` so each patch's mock ca

Create a role, org(s), user, and org_member rows in the in-memory DB. When ``super_role_name`` is provided, also seed a separate role row wit

Import and validate a named implementation of a base class. This function is an extensibility mechanism in OpenHands that allows runtime subs

Get all users in an organization.

Get the appropriate SharedEventServiceInjector based on configuration. Uses get_storage_provider() to determine the storage backend. See open

Pause the oldest sandboxes if there are more than max_num_sandboxes running. In a multi user environment, this will pause sandboxes only for t

Create a new user and add them to the caller's selected org. The target org is the API key org if an API key is used, otherwise it is taken f

Resolve the best available display name from Keycloak user_info claims. Fallback chain: name → given_name + family_name → None Does NOT fall

Store the start task object given. Return the stored task

Build the ``/onboarding`` redirect URL preserving ``returnTo``. The user's originally requested destination is preserved as a ``returnTo`` qu

Wire user_context and call _build_acp_start_conversation_request.

Load LLMProfiles from org row, defaulting to empty if not set.

A fake httpx streaming response: status/headers + async aiter_bytes().

Find the primary verified email from a list of GitHub email objects. GitHub's /user/emails endpoint returns a list of dicts, each with

AsyncMock httpx client whose .stream(...) yields a fake response. ``resp_or_map`` is a single fake response or a ``{format: response}`` map.

Check rate limit for requests, using user_id when available, falling back to IP address. Uses Redis to store rate limit keys with expiration

Context function suitable for use in async with clauses

Create a JWE (JSON Web Encryption) token. Args: payload: The JWT payload to encrypt key_id: The key ID to use for enc

Dependency that validates user has @openhands.dev email domain. This dependency can be used in place of get_user_id for endpoints that s

Get a shared asynchronous Redis client, lazily initialized. Note: This function is synchronous but returns an async client. Thread-safe initi

Get role by name.

Resolve a valid per-user Jira DC access token, refreshing if necessary. Raises JiraDcUserTokenError when no usable token is available.

Handle HTTP status errors and convert them to appropriate exceptions.

Check if the text contains an exact mention (not part of a larger word). Args: text: The text to check for mentions mention: The

Check if a role has a specific permission. Args: user_role: User's Role object permission: Permission to check is_su

Receive message from integration

Create or update an LLM profile. If ``llm`` is omitted, saves a copy of the current org LLM defaults.

Return specs from cache, or re-fetch from runtime-api if the TTL has expired.

Build a minimal AgentServerContext for the success path tests.

Create a mock AppConversationService for testing.

Seed roles required by ``UserStore.create_user``. ``owner`` is required for the user's personal-org membership, while ``admin`` is the first

Return the standard set of patches used by SaasUserAuth helpers.

Accept an organization invitation. This method: 1. Validates the token and invitation status 2. Checks expiration 3.

Create a new event callback.