fix(api): harden trial apps access for recommended apps (#38970)

api/services/recommended_app_service.py

@@ -4,12 +4,23 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from configs import dify_config
-from models.model import AccountTrialAppRecord, TrialApp
+from models.model import AccountTrialAppRecord, App, TrialApp
 from services.feature_service import FeatureService
 from services.recommend_app.recommend_app_factory import RecommendAppRetrievalFactory
 
 
 class RecommendedAppService:
+    @classmethod
+    def get_app(cls, app_id: str, *, session: Session) -> App | None:
+        """Return a normal app only when it belongs to the recommended catalog."""
+        mode = dify_config.HOSTED_FETCH_APP_TEMPLATES_MODE
+        retrieval_instance = RecommendAppRetrievalFactory.get_recommend_app_factory(mode)()
+        recommended_app_detail = retrieval_instance.get_recommend_app_detail(app_id, session=session)
+        if recommended_app_detail is None:
+            return None
+
+        return session.scalar(select(App).where(App.id == app_id, App.status == "normal").limit(1))
+
     @classmethod
     def get_recommended_apps_and_categories(cls, language: str, *, session: Session):
         """