fix: remove authentication check on sign up endpoint (#11560)

* Remove authentication check on sign up endpoint

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

src/backend/base/langflow/api/v1/users.py

@@ -26,16 +26,18 @@ router = APIRouter(tags=["Users"], prefix="/users")
 async def add_user(
     user: UserCreate,
     session: DbSession,
-    current_user: Annotated[User, Depends(get_current_active_superuser)],  # noqa: ARG001
 ) -> User:
     """Add a new user to the database.
 
-    Requires superuser authentication to prevent unauthorized account creation.
+    This endpoint allows public user registration (sign up).
+    User activation is controlled by the NEW_USER_IS_ACTIVE setting.
     """
+    settings_service = get_settings_service()
+
     new_user = User.model_validate(user, from_attributes=True)
     try:
         new_user.password = get_password_hash(user.password)
-        new_user.is_active = get_settings_service().auth_settings.NEW_USER_IS_ACTIVE
+        new_user.is_active = settings_service.auth_settings.NEW_USER_IS_ACTIVE
         session.add(new_user)
         await session.flush()
         await session.refresh(new_user)

src/backend/tests/unit/api/v1/test_users.py

@@ -2,6 +2,39 @@ from fastapi import status
 from httpx import AsyncClient
 
 
+async def test_add_user_public_signup(client: AsyncClient):
+    """Test public user registration (sign up) without authentication."""
+    basic_case = {"username": "newuser", "password": "newpassword123"}
+    response = await client.post("api/v1/users/", json=basic_case)
+    result = response.json()
+
+    assert response.status_code == status.HTTP_201_CREATED
+    assert isinstance(result, dict), "The result must be a dictionary"
+    assert "id" in result, "The result must have an 'id' key"
+    assert "is_active" in result, "The result must have an 'is_active' key"
+    assert "is_superuser" in result, "The result must have an 'is_superuser' key"
+    assert "last_login_at" in result, "The result must have an 'last_login_at' key"
+    assert "profile_image" in result, "The result must have an 'profile_image' key"
+    assert "store_api_key" in result, "The result must have an 'store_api_key' key"
+    assert "updated_at" in result, "The result must have an 'updated_at' key"
+    assert "username" in result, "The result must have an 'username' key"
+    assert result["username"] == "newuser", "The username must match"
+    assert result["is_superuser"] is False, "New users should not be superusers"
+
+
+async def test_add_user_duplicate_username(client: AsyncClient):
+    """Test that duplicate usernames are rejected."""
+    basic_case = {"username": "duplicateuser", "password": "password123"}
+    # Create first user
+    response1 = await client.post("api/v1/users/", json=basic_case)
+    assert response1.status_code == status.HTTP_201_CREATED
+
+    # Try to create second user with same username
+    response2 = await client.post("api/v1/users/", json=basic_case)
+    assert response2.status_code == status.HTTP_400_BAD_REQUEST
+    assert "unavailable" in response2.json()["detail"].lower()
+
+
 async def test_add_user(client: AsyncClient, logged_in_headers_super_user):
     basic_case = {"username": "string", "password": "string"}
     response = await client.post("api/v1/users/", json=basic_case, headers=logged_in_headers_super_user)

src/lfx/src/lfx/_assets/component_index.json

@@ -4527,7 +4527,7 @@
                 },
                 {
                   "name": "anthropic",
-                  "version": "0.77.0"
+                  "version": "0.77.1"
                 }
               ],
               "total_dependencies": 5
@@ -116031,6 +116031,6 @@
     "num_components": 355,
     "num_modules": 95
   },
-  "sha256": "934b201e21494ae6e11f223683ad79494bd716412b8ad697bbc27f0bb05d95aa",
+  "sha256": "de6edd6bb4cd0773739964b5d3264020f6be439c16bdf11db9d5ef9f9d4765ca",
   "version": "0.3.0"
 }