mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-23 22:15:24 +08:00
be7edcbda182fa121990976ecc71c7649decc0bc
17982 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| be7edcbda1 | chore: unconstrained lfx version for bundles (#13415) | |||
| dbe482c800 |
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions (#13413)
* fix(ci): lockstep langflow-nightly and langflow-base-nightly versions
The nightly pipeline computed each package's .devN number independently
(pypi_nightly_tag.py queried each package's own PyPI history and
incremented separately), while langflow-nightly pins an exact
langflow-base-nightly[complete]==X.Y.Z.devN dependency. Because
langflow-nightly publishes on more nights than langflow-base-nightly,
the two counters drift (live: dev54 vs dev48). Each time base lags a
publish while main succeeds, the newest langflow-nightly pins a base
dev that does not exist yet, so 'uv pip install langflow-nightly'
becomes unsatisfiable and silently falls back to a weeks-old version.
Fix: version the two packages in lockstep. pypi_nightly_tag.py now
derives a single shared dev number from max(dev across BOTH packages'
PyPI histories) + 1 (restricted to the root base_version), so main and
base always get the identical tag and main's exact pin always
references a base version built and published in the same run. The tag
is computed in a single invocation ('both' mode) so the release and
base tags cannot drift across separate calls.
Also hardens tag computation: 404 / network / malformed responses for
either package now contribute nothing instead of crashing, a
base-version bump resets the dev counter cleanly, and non-dev/final
releases never advance it.
Adds scripts/ci/test_pypi_nightly_tag.py (unit tests) and a
ci-scripts-test.yml workflow to run scripts/ci tests on PRs.
* fix(ci): fail closed on non-404 PyPI errors in nightly tag computation
_all_dev_numbers() previously returned [] for ANY failure (network error,
non-404 HTTP status, malformed 200), which is unsafe: _shared_nightly_version()
takes max(dev)+1 across both packages, so a transient lookup failure on the
higher-versioned package silently LOWERS the next tag. E.g. if the langflow-nightly
lookup fails while langflow-base-nightly reports dev48, the script would emit
v1.10.0.dev49 even though langflow-nightly already published through dev54 — the
workflow then force-recreates an old git tag and fails publishing an already-existing
PyPI version.
Fail closed: only a true 404 (package has no releases) contributes []; network
errors, 5xx/non-404 statuses, and malformed 200s now raise so the nightly job aborts
before mutating tags. Adds tests for malformed/5xx/network failures and a direct
regression test for the higher-package-lookup-failure scenario.
* Update scripts/ci/test_pypi_nightly_tag.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update test_pypi_nightly_tag.py
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
|||
| 58a75ffb0d |
feat(ci): reduce macOS Intel CI matrix and add macOS support documentation (#13328)
feat(ci): reduce macOS Intel CI matrix and add macOS support docs - Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only) - Add comprehensive macOS support documentation - Document Python 3.14 support status (limited on Intel, no PyTorch) - Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year) Implements LE-781 recommendations R2 and R3 from LE-265 investigation. Related: LE-265, PR #12477 |
|||
| 663fa5ed0a |
docs: fixes for consulting advantage (#13300)
* docs: lock mcp server management * docs: restrict custom components to superusers * docs: embedded mode to hide UI elements * docs: add custom component admin restriction |
|||
| d4013e30b8 |
feat(i18n): translate missing frontend strings across Memories, Knowledge Base, toasts, and notifications (#13279)
* feat(i18n): translate missing frontend strings for flow list and DB Providers page - Wrap "Edited X ago" timestamp in flow list with t() using new mainPage.editedAgo and mainPage.timeElapsed.* keys (plural forms) - Add settings.nav.dbProviders and settings.dbProviders.* keys covering page title, description, badges, button labels, and all toast messages - Wire useTranslation into DBProvidersPage, ProviderListItem, ProviderConfigurationPanel, TextFieldRow, BooleanFieldRow, and dbProviderInputComponent - Download updated translations for fr, ja, es, de, pt, zh-Hans Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(i18n): translate DB provider descriptions and config field labels Add translation keys for all provider descriptions (Chroma Local, Chroma Cloud, OpenSearch, Astra DB, MongoDB Atlas, Postgres pgvector) and all configField labels and helperTexts (API Key, Tenant, Database, Region, Cluster URL, Username, Password, index/vector/text fields, TLS toggles). Use dynamic key lookup with defaultValue fallback so new providers degrade gracefully. Download updated translations for all six locales. * [autofix.ci] apply automated fixes * feat(i18n): translate missing strings in Memories, Knowledge Base, toasts, and notifications - Translate untranslated strings in Knowledge Base upload modal (DB Provider label/description, Metadata section) - Translate all Memories feature strings (sidebar, create modal, detail header, chunk table, empty states) - Wire all hardcoded toast/notification strings through t() across 14 files (flow store, model provider, deployments, update components, shortcuts, file manager, dict/JSON editors, utils) - Delete orphaned alerts_constants.tsx (all imports already removed) - Add ~100 new keys to en.json across memory, errors, deployments, shortcuts, updateComponents, and files namespaces - Upload to GP and download all 6 translated locale files (fr, ja, es, de, pt, zh-Hans) * fix(i18n): translate Memories tooltip in left panel nav * fix(ui): left-align card description text on empty page * feat(i18n): translate hardcoded strings across UI components and update locale files Wraps ~100 hardcoded strings in t() calls across 45 source files covering voice assistant, deployments, flow build, playground, assistant panel, knowledge base ingestion, inspection panel, IO modal, and more. Adds corresponding keys to en.json and syncs all locale files (fr, de, es, pt, ja, zh-Hans) via the GP pipeline. Also fixes a React 19 RefObject<T | null> type mismatch in visual-variants.ts. * [autofix.ci] apply automated fixes * fix(i18n): translate shortcut success/error messages with proper name i18n Added shortcuts.successChanged and shortcuts.successReset keys so success toasts display the translated shortcut name via shortcuts.name.* lookup. Updated EditShortcutButton to use existing translated error keys and the new success keys with toCamelCase name resolution. * fix(i18n): translate "or visit" and "+N more" in file upload modal * fix(i18n): translate NoteNode context menu and fix missing vector store RAG note translations - Add t() calls to NoteNode select-items.tsx for Duplicate/Copy/Docs/Delete menu items - Fix docsUnavailable notice string in NoteToolbarComponent - Download missing fr/ja translations for template_notes.vector_store_rag keys from GP * fix(i18n): translate Delete label in edge context menu * fix(i18n): translate Version History Export/Delete menu and preview overlay strings - VersionListItem: replace hardcoded Export/Delete with t("flow.menu.*") - VersionPreviewOverlay: replace hardcoded Current Flow, Previewing, (Read-Only), Loading preview... with t("version.*") calls - Add 4 new keys to en.json; upload to GP and download all locale translations * fix(i18n): translate hardcoded strings in Update Components modal Replace Component/Update Type headers, Breaking label, and modal title with t() calls; add 5 new keys to en.json and sync all locale translations * fix(i18n): translate assistant panel hardcoded strings - model-selector: replace "Loading..." and "Select model" with t() calls - assistant-panel.constants: convert getAssistantPlaceholder() to use i18n.t() with 5 keyed placeholder variants - messages.ts: replace 48 hardcoded progress/thinking strings with i18n key arrays (8 thinking + 5 groups × 8 progress); VALIDATION_FAILED/RETRYING arrays were dead code and removed - Add 55 new keys to en.json; upload to GP and download all locale translations * [autofix.ci] apply automated fixes * fix(i18n): update sidebarSegmentedNav test to expect i18n key for memories The memories nav item was updated to use "memory.sidebarTitle" as its label/tooltip i18n key, but the test still expected the old hardcoded "Memories" string. * fix(i18n): replace deleted alerts_constants import with t() calls in PageComponent The release-1.10.0 merge re-introduced an import from alerts_constants which was deleted in Phase 1 of the i18n migration. This crashed the Vite dev server, causing all Playwright tests to fail on startup. Also fixes Biome import order in use-session-history.ts from the merge conflict resolution. * fix(i18n): restore ASSISTANT_PLACEHOLDERS export and translate formatDate fallback - Re-export ASSISTANT_PLACEHOLDERS as translated strings computed from keys so getAssistantPlaceholder() returns from the array (restores test contract) - formatDate() now returns i18n.t("memory.never") instead of "" for the empty-date fallback --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| fefa4262ae | docs: bump python version reqs to 3.14 and add release note (#13289) | |||
| 31b7a4cd05 |
fix: improve trace search functionality (#13383)
* improve trace search functionality * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4a700dc5d1 |
fix(playground): expand session checkbox click target to full row height (#13349)
* fix(playground): expand session checkbox click target to full row height The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the row is ``h-8`` (32 px). The 8 px band above and the 8 px band below the visible icon were dead zones that bubbled to the row's ``toggleVisibility`` and navigated to the session instead of toggling selection — exactly the accidental-navigation UX the bug ticket describes. Grow the wrapper to ``w-4 h-8`` so the click target captures the full row height. Width stays narrow so the text alignment is unchanged; the icon itself stays ``h-4 w-4``, centered via the existing ``flex items-center justify-center``. Visual position is identical. Adds ``__tests__/session-selector-checkbox-click-target.test.tsx`` (3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the wrapper outside the icon triggers selection without bubbling to toggleVisibility, and click on the inner icon still toggles selection. * test(playground): drop checkbox-click-target test file (not needed per review) * [autofix.ci] apply automated fixes * test: align session-selector checkbox assertions with full-height click target --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 2f682eb020 |
docs: agent improvements (#13269)
* docs: add structured output for agents * docs: add structured output note * docs: clarify both agent outputs and add release notes * docs: when langflow sends events to the playground and chat history |
|||
| 4e6981368c |
fix(traces): full-height trace panel, and status badge position (#13385)
* fix(traces): full-height trace panel, and status badge position * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 3f62caff8f |
test(e2e): Replace non-terminal waits to fix flaky Windows specs (#13407)
* fix assistant test on windows * improve slider component test |
|||
| 39bb3a12ca |
ci: isolate bundle installs from the core release gate; lazy-import ibm-db (#13402)
* ci: isolate bundle installs from the core release gate; lazy-import ibm-db
Two follow-ups to wiring lfx-ibm (and future native-dep bundles) into the
nightly/release pipeline.
1. cross-platform-test.yml: split the monolithic "Install packages from
wheel" step (in both the stable and experimental jobs) into three:
- core install (SDK/LFX + langflow-base) -- release gate
- per-bundle bundle install -- NON-BLOCKING (continue-on-error), reports
per-bundle pass/fail to the GitHub step summary
- langflow main install -- release gate
A bundle whose dependency has no wheel on a tested platform is now reported
as "failed (non-blocking)" instead of failing the whole nightly/release
publish. Local bundle wheels are still installed before main, so langflow
resolves its bundle deps from the freshly-built wheels rather than PyPI.
NOTE: a bundle that langflow hard-depends on is still pulled (and thus
gated) by the main install; to make a bundle optional on a platform, also
add a PEP 508 marker to its dependency line in langflow's pyproject.toml.
2. lfx-ibm: import ibm_db_dbi lazily inside DB2VS.__init__ (db2vs.py) instead
of at module top level, mirroring db2_vector.build_vector_store. ibm-db
ships no linux/aarch64 wheel, so the bundle now imports on that arch (only
the DB2 vector store is inert there; the watsonx components keep working).
Guard the driver-dependent test modules (test_db2vs, test_db2_vector) with
a module-level skip when ibm_db_dbi is unavailable, matching the existing
watsonx test pattern so they no longer error at collection on linux/aarch64.
Verified locally: 59 DB2 tests pass with ibm-db present; with ibm-db absent
the bundle imports cleanly, DB2 use raises a clean ImportError, and the
guarded test modules skip (9 passed, 2 skipped, 0 errors). actionlint adds no
new shellcheck findings vs HEAD; ruff check/format clean.
* fix: Remove long comments for bundle deps (#13403)
* [autofix.ci] apply automated fixes
* ci: revert bundle-install restructure to blocking; add ibm-db import regression test
Addresses two review findings on the lfx-ibm bundle changes.
1. Revert the cross-platform-test.yml bundle-install restructure. The
non-blocking per-bundle step could let the main install satisfy a hard-dep
bundle from PyPI (the index was not disabled), masking a broken local build,
and it never actually protected hard-dep bundles -- main re-gates them
anyway. Restore the original blocking, install-by-path step (local bundle
wheels install before main, so the gate is reliable and PyPI cannot
substitute). Document the real isolation lever for a genuinely
platform-optional bundle -- a PEP 508 marker on its dependency line in the
root pyproject -- in src/bundles/PORTING.md.
2. The module-level skip hid the importability regression the lazy import was
meant to guard. Add test_optional_dependency.py: it simulates ibm-db's
absence and asserts db2vs + the bundle package import and that DB2 use
raises a clean ImportError -- it runs on every platform, including the
x86_64 CI runners. Replace the module-level skips in test_db2vs.py /
test_db2_vector.py with class-level skipif on the DB2-driver test classes
only, so the helper tests and the module-level imports still run (and assert
importability) where ibm-db is absent.
Verified: with ibm-db present, 112 bundle tests pass. With ibm-db uninstalled
(the real linux/aarch64 case, find_spec -> None), 67 pass / 45 skip / 0 errors
-- the regression tests and helper tests run, only the driver-dependent classes
skip. actionlint reports no new findings; ruff check/format clean.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 60e2ea874d |
feat: add MCP timeout configuration support (#12999)
* feat: add per-component MCP tool execution timeout override - Add mcp_tool_execution_timeout global setting (180s default) - Add FloatInput in MCP component for per-component timeout override - Update MCPStdioClient and MCPStreamableHttpClient to accept timeout parameter - Implement timeout fallback logic: component → global → 180s default - Add comprehensive unit tests for timeout configuration This complements the mcp_server_timeout setting (PR #12996) by allowing per-component customization of tool execution timeouts, supporting long-running MCP operations (>30s). Related to customer issue TS021996258 (Verizon). * fix: preserve client timeout and validate negative values - Only update client timeout when tool_execution_timeout is not None - Properly set timeout on mcp_sse_client when used as alias - Add validation to reject negative timeout values in MCP component - Add comprehensive tests for timeout preservation, SSE client, and validation Fixes issues where: 1. Passing None would overwrite existing client timeouts 2. mcp_sse_client wouldn't receive timeout updates 3. Negative timeout values were accepted without validation * feat: add configurable MCP tool execution timeout with backward compatibility - Add mcp_tool_execution_timeout setting (default: 180s) for long-running MCP tools - Implement 3-tier timeout fallback: component > global setting > max(mcp_server_timeout, 180) - Include timeout in cache keys to prevent stale cached tools from bypassing per-component timeouts - Add comprehensive test suite (33 tests) covering timeout configuration, backward compatibility, and cache behavior - Preserve existing deployments: when mcp_tool_execution_timeout is unset, falls back to max(mcp_server_timeout, 180) Fixes: TS021996258 (Verizon - long-running MCP tool timeouts) Co-authored-by: autofix.ci <autofix@autofix.ci> * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * [autofix.ci] apply automated fixes (attempt 2/3) * fix: align mcp timeout coverage and component validation * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * fix(mcp): resolve timeout execution bugs and add validation testing * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix.ci <autofix@autofix.ci> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f8ada15e2a |
feat(components): Add IBM DB2 Vector Store component (#13237)
* feat(ibm): add DB2 Vector Store component Add comprehensive IBM DB2 Vector Store integration for Langflow. Components Added: - DB2VectorStoreComponent: Main vector store component - DB2VS: LangChain-compatible vector store implementation - DB2 security validators: Input validation and sanitization Features: - Vector similarity search (Similarity, MMR, Similarity Score Threshold) - Secure connection handling with input validation - Metadata filtering for complex data types - Duplicate detection support - Batch document ingestion Test Coverage: - 41 unit tests (38 passing, 3 skipped) - Component integration tests - Security validation tests - DB2VS class tests Documentation: - Comprehensive developer guidelines * refactor(db2): simplify component to match Chroma patterns - Remove complex data ingestion (CSV, DataFrame, dict, Message handling) - Add _add_documents_to_vector_store() method matching Chroma - Add similarity_score_threshold search type - Simplify data ingestion from 220 to 45 lines (80% reduction) - Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering) - All 41 tests passing (38 passed, 3 skipped) BREAKING CHANGE: Component now only accepts Data objects for ingestion. * ci: fix CI failures - update component index and starter projects - Regenerate component_index.json with DB2 component - Update all starter projects with new component registry - Fix ruff formatting issues * ci: trigger CI re-run to fix merge issue * ci: add merge conflict resolution for component_index.json in autofix workflow Handle merge conflicts in the Update Component Index job by: - Automatically resolving component_index.json conflicts using --theirs strategy - Failing if non-generated files have conflicts (requires manual resolution) - Completing the merge after resolving generated file conflicts This prevents the workflow from failing when component_index.json has conflicts during PR updates, as this file is auto-generated and can be safely regenerated. * fix: Remove DB2SQLComponent reference from IBM components - Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist - This fixes the test_all_modules_importable test failure - Fixes CI failure in Unit Tests - Python 3.14 - Group 5 * revert: Remove unrelated starter project JSON changes * revert: Remove unrelated CI workflow and formatting changes * docs: add DB2 Vector Store .mdx documentation following Chroma DB structure * fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering - Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error - Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component - Implemented threshold filtering in similarity_score_threshold search mode - Filters results to only include documents with relevance scores >= threshold * chore: remove auto-generated and unnecessary files from PR - Remove uv.lock (dependency lock file - auto-generated) - Remove src/frontend/package-lock.json (frontend lock file - auto-generated) - Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI) - Remove .secrets.baseline (security baseline - auto-generated) - Remove starter_projects JSON (auto-generated example) - Remove tweaks_builder.py (unrelated test helper) Per DEVELOPMENT.md guidelines, these files should not be committed by contributors. * chore: restore auto-generated files to keep PR focused on DB2 component * fix(ci): update auto-generated files and fix docs build - Update component index with new IBM DB2 components (363 components, 97 modules) - Update frontend package-lock.json - Fix docs build by removing reference to missing image in bundles-db2.mdx Fixes CI failures: - Update Component Index - Update Starter Projects - Test Docs Build * feat(db2): add SSL/TLS support to DB2 Vector Store component - Add SSL/TLS encryption support for DB2 database connections - Add SSL certificate validation and download functionality - Support local certificate files (.crt, .pem, .cer) and URLs - Add optional certificate password support for encrypted keystores - Implement automatic cleanup of temporary downloaded certificates - Add comprehensive error handling and logging for SSL connections - Update component_index.json with new SSL configuration inputs - Update package-lock.json dependencies Security improvements: - Validate certificate paths and file permissions - Support system default CA certificates (recommended for IBM Cloud DB2) - Redact sensitive information in error messages - Clean up temporary files on connection failure This enhancement enables secure encrypted connections to DB2 databases, which is recommended for production environments. * [autofix.ci] apply automated fixes * refactor(db2): minimize metadata storage in DB2 vector store - Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.) - Return only text content during retrieval for cleaner results - Optimize list comprehension for better performance (PERF401, RET504) * test: remove skipped tests from DB2 vector store test suite - Removed version compatibility tests for versions where component didn't exist - Changed file_names_mapping to return empty list for new component - Overrode base class version tests to prevent skips - Fixed linting issues (hardcoded passwords, nested with statements) - All 40 tests now pass with 0 skipped tests * fix(tests): update DB2 vector store test description format Fixes test_component_metadata assertion to match the actual component description format. The test was failing due to line wrapping differences in the multi-line description string. Fixes CI failure in PR #13163 * [autofix.ci] apply automated fixes * chore: trigger CI re-run to resolve flaky test failures * fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures * restructure as new bundle package * [autofix.ci] apply automated fixes * fix(ibm): improve DB2 Vector Store component reliability and validation * fix: implement SSL/TLS toggle functionality for DB2 Vector Store - Add update_build_config method to dynamically show/hide SSL certificate fields - SSL certificate path and password fields now only visible when use_ssl is enabled - Improves UX by hiding irrelevant fields when SSL is disabled - Update component_index.json with new component configuration - All 38 existing tests pass --------- Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com> Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f400102088 |
ci: disable pip/venv DB migration test while langflow-nightly is pip-uninstallable
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate package name that cannot satisfy an lfx pin). So the pip/venv migration job fails at the install step. The Docker Compose migration job is unaffected (it runs the prebuilt nightly image) and stays enabled. Re-enable once either a stable lfx 0.5.x is published to PyPI or nightly bundle variants pinning lfx-nightly are published and langflow-nightly depends on them. |
|||
| fb4dfd49fd |
ci: sync workflow fixes from main into release-1.10.0 (fix broken nightly) (#13400)
ci: sync workflow fixes from main into release-1.10.0 Brings the latest CI/workflow fixes from main into release-1.10.0 so the nightly build is unblocked and the two branches share the same hardening. Most important fix: release_nightly.yml's "Verify Nightly Name and Version" step now uses the anchored grep '^langflow(-nightly)?[[:space:]]' instead of 'grep langflow | grep -v langflow-base | grep -v langflow-sdk'. The old filter started matching two packages once the langflow-stepflow workspace package was added, so the name became multi-line and the check failed (this is what broke the nightly build). Also carries main's fixes for cross-platform install (--prerelease=if-necessary-or-explicit), docker build workflows, db-migration-validation, and the backend test timeout bump (30 -> 40). 3-way merged from the common ancestor, so release-only changes are preserved; no release-only feature workflows are modified. |
|||
| b70acb9f9a |
test: cover cross-user cache pollution on deprecated vertices endpoint (supplied-data path) (#13398)
The deprecated POST /api/v1/build/{flow_id}/vertices endpoint was reported to let an
authenticated non-owner write attacker-controlled graph data into another flow's
server-side cache (cross-user graph cache pollution). On release-1.10.0 this is already
remediated: retrieve_vertices_order and build_vertex gained a current_user parameter, an
owner-or-public flow lookup, and ensure_flow_permission(EXECUTE) that run before the
build-and-cache branch (added in #13153). The modern /build/{flow_id}/flow consumer path
is owner-gated as well.
Existing tests cover the cross-user no-data path. This adds explicit coverage for the
reported supplied-data path: a second user POSTing a schema-valid FlowDataRequest for
another user's private flow receives 404 because the ownership guard fires before
build_and_cache_graph_from_data / set_cache(str(flow_id), ...), so no graph is cached
under the victim flow id.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|||
| cb7b838d45 |
feat: Add DB migration validation workflow for nightly builds (#13249)
* feat: Add DB migration validation workflow for nightly builds (LE-1259) - Implements automated DB migration testing for nightly builds - Tests two scenarios: pip/venv and Docker Compose migrations - Validates migration from stable to nightly versions - Verifies data persistence (witness flows) across migrations - Integrated into nightly_build.yml workflow - Includes Slack notifications for migration test results This addresses the critical blocker identified by QA team for ensuring safe database migrations in production deployments. * docs: Add DB migration validation documentation - Comprehensive guide for LE-1259 implementation - Detailed test scenarios and execution details - Environment configuration and success criteria - Monitoring and troubleshooting guidelines - Placed in docs/docs/Deployment/ for easy access * fix: address PR review comments for DB migration validation - Use actual nightly tag from create-nightly-tag output instead of hardcoded :latest - Wire POSTGRES_VERSION env var into postgres service image tag - Remove unnecessary checkout steps from both migration jobs - Update step name from 'Create witness flow and credentials' to 'Create witness flow' - Add -f flag to curl commands for fail-fast behavior - Add flow creation verification with error handling - Fix version extraction logic to properly test nightly build instead of PyPI latest - Remove deprecated docker-compose version field - Remove duplicate Slack notification job (consolidated in nightly_build.yml) Addresses all 9 issues identified by @ogabrielluiz in PR review * docs: remove implementation summary from user-facing docs Per @ogabrielluiz review feedback, this file reads as an implementation summary (Jira ticket, branch name, 'Next Steps', 'Files Changed: 2') rather than user-facing documentation. The Deployment section is for end-user docs, and this content is better suited for the PR description. Also not added to sidebars.js, so would be an orphan page. * fix(workflows): address 6 issues from Gabriel's second review of DB migration validation Fixes all remaining issues identified in PR #13249 review: 1. Remove schedule trigger - only works on default branch, would cause duplicate runs 2. Fix postgres service image - hardcode to postgres:16 (env context not available in services) 3. Add curl fail-fast flags - use -fsSL for immediate failure on errors 4. Add flow ID verification - check witness data creation succeeded before proceeding 5. Remove orphaned Slack JSON - cleanup leftover from removed notify-results job 6. Fix version extraction - strip 'v' prefix for pip install (${VERSION#v}) 7. Fix Docker image reference in nightly_build.yml - pass full image path with tag 8. Fix success notification - check migration validation didn't fail All changes validated locally: - YAML syntax validation passed - Docker Compose config validated - Tag manipulation logic tested (v prefix handling) - Curl command structure verified - Test credentials marked with pragma allowlist secret comments Related: LE-1259, PR #13249 Depends on: PR #13212 (Docker volume permissions fix) * fix(ci): address all PR review blockers for DB migration validation workflow - Add auto_login token auth to all 4 API call sites (Create/Verify witness in both jobs) - Add credential witness (POST /api/v1/variables/ with type: Credential) to prove encrypted-column migrations ran correctly - Verify witness variable persists after upgrade in both jobs - Strip 'v' prefix from nightly Docker tag before docker-compose sed replacement - Fix langflow.__version__ crash - use importlib.metadata instead - Remove deprecated 'version: 3.8' from inline docker-compose YAML - Remove bogus LANGFLOW_SUPERUSER/LANGFLOW_SUPERUSER_PASSWORD env vars - Remove LANGFLOW_SKIP_AUTH_AUTO_LOGIN (only works on nightly, not stable images) - Fix shellcheck SC2016/SC2102 issues flagged by actionlint - Mark test credential values with pragma allowlist secret (false positives) - Update .secrets.baseline with known false positives in new workflow file * fix(ci): remove duplicate db-migration-validation job after merge * fix(ci): include default_fields in witness variable payloads * fix(ci): handle compressed API responses in witness verification * fix(ci): uninstall stable langflow before installing nightly in pip-venv job langflow and langflow-nightly both own the same site-packages/langflow/ namespace via a shared langflow-base dependency. Without an explicit uninstall, the stable copy wins at runtime and python -m langflow still boots the old version - meaning no nightly migration is exercised and the test produces a false positive. Explicitly uninstall langflow + langflow-base before the nightly install so the namespace is fully handed over to the nightly package. --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| 2bfa634dfb |
feat: flow builder assistant with real-time canvas updates (#12575)
* add agentic api backend
* [autofix.ci] apply automated fixes
* add docs to feature
* ruff and test fixes
* ruff fixes
* fix lfx tests
* fix ruff style
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* refactor code improvements
* add rate limit to tests
* [autofix.ci] apply automated fixes
* new canvas control
* chat UI skeleton v0
* add empty state when doesnt have model provider
* add generating code statuses
* assist panel doc
* add stop button to cancel flow generation
* view code dialog
* add translation json flow and stop button on inputchat
* add floating state of the chat
* refacator frontend codes
* assistant docs.
* add execution from .py file
* update docs
* fix verbose error
* improve disabled placeholder
* unify placeholder messages
* start chat state closed
* add canvas behavior
* fix model selection and position chat
* dialog z100
* [autofix.ci] apply automated fixes
* docs update
* change crypto to uuid regular
* fix inexistent assistant
* chore: removed old unused implmentation
remoced old FF and all it's UI components
* add memory to flow..
* add prompt on agent
* [autofix.ci] apply automated fixes
* cherry-pick first commit
* cherry pick commit changes canvas
* code improvements
* fix session id null and close button
* add tests suite
* fix await error
* ruff style and checker
* feat: add pure flow-builder utilities to lfx
Add flow_builder subpackage with pure functions for manipulating
flow JSON dicts — component ops, edge creation with ReactFlow
handle format, topological layout, and dynamic field detection.
* feat: add MCP server for operating Langflow via REST API
FastMCP server exposing 15 tools across auth, flow, component,
connection, and execution groups. Agents can create flows, add
and configure components, wire connections, and run flows against
a Langflow server through MCP tool calls.
* feat: add langflow-mcp-client console script entry point
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: use dict comprehension in setup.py to fix PERF403 lint
* fix: address PR review feedback on MCP client
- Add asyncio.Lock to prevent race condition in _client() under
concurrent access
- Handle 204 No Content responses in delete() instead of calling
resp.json() on empty body
- Fix weak assertion in test_default_values
* feat: auto-enable tool_mode when connecting component_as_tool
describe_component_type now shows component_as_tool as an output
for any component with tool_mode-capable outputs. When an agent
connects via component_as_tool, tool_mode is auto-enabled — no
extra step needed.
* refactor: move MCP server from langflow-base to lfx
The MCP server has no langflow dependencies — only httpx, mcp,
and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable
without installing langflow. Entry point: lfx-mcp.
* feat: improve MCP server UX for agents
- describe_component_type separates advanced fields from core ones
- search_component_types accepts output_type filter
- list_flows accepts query filter and includes ASCII graph repr
- get_flow_info includes ASCII graph repr
- add duplicate_flow tool
- add list_starter_projects tool
* feat: add use_starter_project tool and tests for new features
- use_starter_project creates a flow from a starter template by name
(starter projects aren't fetchable by ID via /flows/)
- Tests for duplicate_flow, starter projects, graph repr, advanced
fields, and output_type search
* docs: improve MCP tool descriptions for agent clarity
- Add server-level instructions with typical workflow guide
- Remove internal implementation details from tool descriptions
- Add cross-references between related tools
- Mention component_as_tool and graph diagrams where relevant
* docs: address subagent review feedback on tool descriptions
- Document return values for create_flow, add_component
- Clarify empty-query behavior for search_component_types
- Distinguish get_component_info (instance) vs describe_component_type (type)
- Explain connection type compatibility in instructions
- Clarify configure_component trigger field behavior
- State disconnect_components default when filters omitted
* feat: add batch tool for multi-action requests
Execute multiple actions in one call with $N.field references
to chain results. An agent can build a complete flow in a single
request instead of 6+ round trips.
* improvements UIUX
* change css canvas controls
* feat: add create_flow_from_spec tool for compact text-based flow creation
Accepts a compact text spec with nodes, edges (using real port names),
and config sections. Agents generate a simple string instead of
constructing nested JSON. Tool mode auto-enabled for component_as_tool.
Handles Prompt Template dynamic variables by parsing {var} from
template text and creating input fields. Cleans up flows on failure.
Type coercion for numeric/boolean config values.
* feat: add build_flow validation and create_flow_from_spec
build_flow validates flows by building the graph server-side.
create_flow_from_spec accepts a compact text spec with nodes,
edges, and config. Validates by default (optional).
Handles Prompt Template dynamic {variables}, auto-enables tool_mode
for component_as_tool, cleans up on failure, coerces config types.
* fix: isolate session state and harden MCP server
* pannel execution
* [autofix.ci] apply automated fixes
* fix: move test_flow_builder into tests/unit so CI collects coverage
* improve code gen
* [autofix.ci] apply automated fixes
* fix: address PR review feedback
- Fix test fixture to use contextvars instead of stale module attributes
- Raise ValueError on malformed spec lines instead of silently dropping
- Disambiguate duplicate component types in flow_graph_repr
- Narrow except Exception to ImportError in flow_graph_repr
- Add action-index context to batch error messages
- Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow)
- Mention create_flow_from_spec in MCP instructions
* feat: stream run_flow events via MCP progress notifications
run_flow now consumes Langflow's SSE stream and relays token events
to the MCP client via report_progress. Falls back to a regular POST
if the stream yields no result.
* test: add streaming integration tests for run_flow and stream_post
* chore: rebuild component index
* fix: Remove code execution from assistant validation path (#12244)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [autofix.ci] apply automated fixes
* fix: handle Message dicts in str field param processing
param_handler's str case called unescape_string on each list element
without checking if the element was a string. On subsequent agent calls,
chat history stores Message dicts in the list, causing
'dict' object has no attribute 'replace'.
Added _coerce_str_value helper that extracts .text from Message/Data/dict
objects before unescaping. Includes 4 regression tests.
* feat: add flow builder tools and propose_field_edit with JSON Patch
- builder.py: builds flow dicts from text specs using local component registry
- flow_builder_tools.py: 9 Langflow components for agent tooling
- propose_field_edit generates validated JSON Patches with dry-run verification
- flow_to_spec_summary converts flow dicts to compact summaries with IDs
- Module-level event queue for real-time UI updates during streaming
* feat: flow builder assistant with intent routing
- flow_builder_assistant.py: Python-based agent flow with 9 tools
- model_config.py: shared model config extracted from translation_flow
- Intent classifier recognizes build_flow, edit, and inspect requests
- Updated LangflowAssistant.json prompt to mention flow building
- 18 tests including graph construction and intent classification
* feat: SSE event pipeline for flow building and editing
- New SSE events: flow_update, flow_preview, flow_action (edit_field)
- assistant_service drains tool events during streaming for real-time updates
- Current flow context injected into all agent requests from DB
- Event consumer forwards flow_preview events through the pipeline
- extract_flow_json for text-based flow detection (fallback path)
* feat: frontend flow preview, edit cards, and real-time canvas updates
- FlowAction type for edit_field proposals with JSON Patch
- FlowEditCarousel: paginated Accept/Dismiss cards for field edits
- AssistantFlowPreview: mini ReactFlow canvas for new flow previews
- SSE handler dispatches flow_update and flow_preview events
- Chat hook applies flow_update events to canvas via setNodes/setEdges
- edit_field events stored as flowActions on messages for user review
- Strips flow_json blocks from visible chat content
* chore: add lfx logger to MCP server, log streaming fallback
* fix: resolve merge issues and harden flow builder state management
- Restore build_flow intent in translation prompt and LangflowAssistant system prompt
- Remove duplicate TYPE_CHECKING block from assistant_service.py (merge artifact)
- Add build_flow to intent classification plaintext fallback
- Add reset_working_flow to streaming finally block (lifecycle leak)
- Replace module-level globals with contextvars for concurrency safety
in both components/tools and mcp flow_builder_tools
- Remove dead _save_working_flow (ThreadPoolExecutor in async antipattern)
- Handle remove_component and configure flow_update actions in frontend
- Log warning when flow JSON fallback triggers instead of tool events
- Add tests for build_flow/off_topic plaintext fallback and contextvar isolation
* feat: improve flow builder UX and consolidate tool implementations
- Add worked examples to flow builder prompt (new flow + edit flow)
- Add build_flow guardrail: returns error when canvas already has components
- Change ConfigureComponent to accept JSON params dict (batch updates)
- Remove duplicate flow_builder_tools.py from components/tools
(was breaking test_get_all); single source in lfx.mcp.flow_builder_tools
- Update prompt to explicitly guide build vs edit tool selection
* fix: set_flow replaces canvas instead of appending, Python 3.10 compat
set_flow was using paste() which appends nodes with new IDs, causing
duplicates. Now uses setNodes/setEdges to replace canvas contents.
Also fixes asyncio.Barrier usage (3.11+) in concurrency test and
makes ConfigureComponent accept params as dict or JSON string since
tool frameworks may pass either.
* fix: soften build_flow guardrail and harden intent fallback parser
build_flow no longer hard-blocks on non-empty canvas. Users can now
create new flows while an existing one is open -- the prompt already
guides the agent to prefer edit tools when components exist.
Intent classification fallback now uses a strict regex pattern matching
quoted JSON values ("intent": "build_flow") instead of bare substring
matching, preventing prompt-echo misroutes on weaker models.
* feat: lock canvas while assistant is processing
Syncs the assistant panel's isProcessing state to the
assistantManagerStore so the canvas locks (effectiveLocked) while the
assistant is building or modifying the flow, preventing the user from
dragging nodes during real-time updates.
* feat: flow builder assistant with real-time canvas updates
Add flow builder assistant that builds and modifies flows directly on
the user's canvas via agent tools. SSE event pipeline streams
flow_update and flow_preview events for real-time canvas rendering.
- Flow builder tools: search, describe, add, remove, connect, configure,
build_flow, propose_field_edit with JSON Patch
- Intent classification with build_flow routing
- Per-request state isolation via contextvars
- Strict regex fallback parser for intent classification
- Canvas lock while assistant is processing
- Frontend handles add, remove, connect, configure, set_flow actions
- Flow preview and edit card components
* fix connection llm mcp
* [autofix.ci] apply automated fixes
* add flow visualization on assistant
* add manage files to assistant
* [autofix.ci] apply automated fixes
* update documentation about file
* [autofix.ci] apply automated fixes (attempt 2/3)
* reasoning thinking v0
* flow builder improvement
* [autofix.ci] apply automated fixes
* add patch to canvas, improve cache and harness
* ruff style and checker fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix tests
* fix jest tests
* UI ux improvements
* [autofix.ci] apply automated fixes
* ruff style and checker
* improve sec and harness
* ux warning banner tag assistant
* improve flow builder UI UX
* json updates
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* disable preview for many component
* fix message preview
* MCP and agent improvements
* ruff style and chceker
* fix ux display on generating artifacts
* guard rails and deterministic results improvements
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* split flow_builder_tools, force per-user file isolation, add timeouts and guard rails
* ruff style and checker
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* add model alert
* add padding on warning text
* [autofix.ci] apply automated fixes
* fix frontend tests
* fix credentials detection
* refactor playwright tests: remove duplicate tests and add good practices
* add send playground rule
* fix import dotenv
* fix fe tests
* fix light mode
* fix run flow test
* fix tests failing
* fix folder deletion test
* fix e2e tests
* constant text on tests
* fix publish test
* fix publish tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* test: standardize new-project-flow helper into utils/flow
Follow-up to the cz/playwright-tests-refactor merge — align the
new-project-flow helper our branch added with the refactor's directory
and constants conventions:
- Move tests/utils/new-project-flow.ts -> tests/utils/flow/, next to the
refactor's open-blank-flow / open-starter-project helpers; update the
15 import sites.
- Use TID / TIMEOUTS constants inside the helper instead of raw
test-id strings and literal 30000 timeouts, matching open-blank-flow.
- Drop an unused zoomOut import in auto-login-off.spec.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test: assert New Flow button by test-id, not substring text match
The merge resolution kept the refactor's `expect(...).toBeVisible()`
assertion but on `getByText("New Flow")`, which is a substring match —
it also matches flow cards named "New Flow (N)" and throws a strict-mode
violation once such flows exist. Our previous side used a no-op
`.isVisible()` that silently masked it.
Assert on `getByTestId(TID.newProjectBtn)` instead: unambiguous,
DB-state independent, and consistent with the refactor's test-id-first
convention. Verified — actionsMainPage-shard-1 (3/3) and run-flow now
pass against a populated database.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix windows utf open
* assistant message fixes
* [autofix.ci] apply automated fixes
* add tests to validate
* [autofix.ci] apply automated fixes
* bugfixes round 2
* ruff style and checker
* qa fixes
* parse serialized model
* improvement on agent tool usage
* [autofix.ci] apply automated fixes
* ruff style and checker
* [autofix.ci] apply automated fixes
* fix sidebar nav test
* backend tests fixes
* fix tests and change model provider to open dialog
* performance improvements
* [autofix.ci] apply automated fixes
* ruff style and checker fix
* tests fixes
* fix error handling test
* test user overlay
* fix test tool mixin
* last improvements
* ruff style fix
* [autofix.ci] apply automated fixes
* fix user test agentic
* QA fixes round 7
* fix assistant gpt 5.4
* [autofix.ci] apply automated fixes
---------
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Rodrigo Nader <rodrigonader@MacBook-Pro-de-Rodrigo.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|||
| 23e6e8ebba |
feat(authz): add DI dependencies and permission decorators (#13368)
* feat(authz): add DI dependencies and permission decorators Address PR #13153 feedback by introducing FastAPI authorized-flow dependencies for route handlers and requires_flow_permission for non-HTTP paths such as helpers.load_flow. * feat(authz): add RequireFlowCreate dependency for POST /flows/ Move create_flow CREATE authorization into a FastAPI Depends so the route signature declares protection like read/update/delete. * [autofix.ci] apply automated fixes * fix(authz): resolve ruff lint failures on route-pattern branch Fix undefined User type, unused decorator assignment, FAST003 path params, and related test lint issues so the Ruff style check passes in CI. * [autofix.ci] apply automated fixes * fix: couple small nits * chore: drop unrelated component_index.json drift from PR * [autofix.ci] apply automated fixes * refactor(authz): drop OptionalAuthorizedReadFlow; note_translations returns 404 GET /flows/{id}/note_translations now uses AuthorizedReadFlow, so a missing or inaccessible flow yields 404 instead of 200 {} — matching GET /flows/{id} and the rest of the flow API. The owner-scoped uniform 404 is itself UUID-privacy-preserving, so the special-cased empty body added no real privacy over the existing posture. The sole frontend caller (NoteNode) already treats an error as "no translations" and renders the original text. Removes get_optional_authorized_flow_for_read and the OptionalAuthorizedReadFlow alias, and updates the i18n + route-guard tests to assert the 404. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: Debojit Kaushik <Kaushik.debojit@gmail.com> |
|||
| e3dc9d966f |
fix: bundle event inconsistency and other fixes (#13374)
* Bug fixes for events toasts inconsistency, keyspace argument silent failure, API_KEY expiry timestamp being timezone unaware. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| ca63f9099d |
fix: Respect OpenAI embeddings API base for Knowledge Base (#13380)
* fix: respect OpenAI embeddings API base * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 5ca53ef994 |
fix: Add defense in depth user_id filter to handle list tools MCP handler (#13373)
* feat(mcp): add defense-in-depth user_id filter to handle_list_tools for consistency with other MCP handlers * [autofix.ci] apply automated fixes --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| c9fe220d63 |
feat(memory): add inline docs link to preprocessing instructions tooltip (#13352)
* feat(memory): add inline docs link to preprocessing instructions tooltip * add tooltip link for example * remove duplicate key --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> |
|||
| c0b4b05d41 |
docs: update database tables (#13254)
update-database-tables |
|||
| aafce557aa |
feat(authz): admin APIs, share-aware build_flow, and base service additions (#13371)
* feat(authz): add roles, role-assignments, teams, and me/permissions APIs
Completes the OSS admin surface for RBAC: full CRUD on authz_role,
authz_role_assignment, authz_team, and authz_team_member tables, plus a
per-user effective-permissions endpoint backing the frontend permission gate.
Plugin (enterprise Casbin) is invalidated on every write so the next enforce
sees the change.
New endpoints:
* GET/POST/PATCH/DELETE /api/v1/authz/roles -- custom-role CRUD with parent
cycle detection, system-role protection, and FK-aware delete (409 when
assignments still reference the role).
* GET/POST/DELETE /api/v1/authz/role-assignments -- list filterable by
user/role/domain; superuser-only for write, self-read allowed.
* GET/POST/PATCH/DELETE /api/v1/authz/teams + GET/POST/DELETE
/api/v1/authz/teams/{id}/members -- backs the share-with-team flow and
the team admin UI.
* POST /api/v1/authz/me/permissions -- returns per-resource allowed actions
for the current user (capped at 500 ids), backs the FE permission gate.
Base service additions (lfx.services.authorization.base):
* list_visible_resource_ids -- plugin SQL prefilter for list endpoints; OSS
returns None ("no prefilter, fall through to filter_visible_resources").
* get_effective_permissions -- default impl uses batch_enforce so plugins
inherit it for free; Casbin plugin can override for a tighter query.
* fix(authz): make build_flow share-aware so shared flows can be run by non-owners
The build_flow handler was loading flows with an owner-OR-public SQL filter,
short-circuiting the ensure_flow_permission(EXECUTE) check on private flows
shared with the current user. The existing in-code comment flagged this as a
Phase 3 prerequisite for cross-user build support.
Switch to the share-aware load helper (_read_flow / authorized_or_owner_scoped):
* When the registered authorization plugin signals SUPPORTS_CROSS_USER_FETCH
(enterprise Casbin), the row loads by id alone and the plugin decides via
enforce(). OSS pass-through keeps the historical owner-only behavior.
* PUBLIC flows are still buildable by any authenticated user in both modes
(preserved via the explicit access_type=PUBLIC fallback).
* Plugin deny is translated to 404 (not 403) via deny_to_404 so the response
is indistinguishable from "flow does not exist" and the caller cannot
enumerate UUIDs by probing for 403 vs 404.
* test(authz): cover new admin routes and share-aware build_flow
Pins the security floor and validation behavior added in the prior commits so
they don't silently regress. Uses the existing fake async session + stub authz
service pattern from test_authz_share_routes.py.
test_authz_admin_routes.py (17 tests):
* /authz/roles -- superuser gate on create, persist + invalidate_all, 409 on
name conflict, system-role protection on update + delete, self-parent and
parent-cycle rejection, 409 when deleting a role with active assignments.
* /authz/role-assignments -- non-superuser blocked from listing other users'
assignments; self-list allowed; 404 when user_id is unknown; create
invokes invalidate_user(target).
* /authz/teams -- superuser gate on create, add_member invokes
invalidate_user(target), duplicate add returns 409.
* /authz/me/permissions -- correct per-resource shape, 400 when over 500
ids, empty request returns empty.
test_chat_build_flow_authz.py (5 tests):
* Owner happy path preserved.
* Plugin 403 deny converted to 404 (UUID privacy).
* Unknown flow + no PUBLIC fallback -> 404.
* Share-aware load miss + PUBLIC fallback hits -> success.
* Non-403 errors (e.g. 500) pass through with status preserved.
Total: 22 new tests, all passing locally.
* fix(authz): normalize, dedupe, and cap the actions list on /authz/me/permissions
The resource_ids cap (500) bounded one side of the cartesian product, but the
actions list was unbounded. A client could submit actions=["read"] * 100000
and trigger a 50M-entry batch_enforce, plus the same action in different
casings ("READ", "read") would have been treated as distinct entries.
Add a field_validator on EffectivePermissionsRequest.actions that:
* strips whitespace and lowercases each entry
* de-duplicates while preserving order
* caps the result at 10 unique actions (headroom over the 6 known actions:
read, write, execute, delete, create, manage)
* returns None when the normalized list is empty so the handler still falls
back to _DEFAULT_ACTIONS
Over-cap requests raise ValidationError (HTTP 422 at the request boundary),
which matches Pydantic conventions for input shape problems and differs from
the resource_ids cap (HTTP 400 in the handler) by design -- bound-violation
on list size is structurally a validation error, not application logic.
6 new tests: normalization+dedupe, empty-collapses-to-None, over-cap rejection,
50-entry dedupe stays under cap, None stays None, handler sees normalized list.
* fix(authz): default /authz/role-assignments list to caller's own assignments
The gate `if user_id is None or user_id != current_user.id` required superuser
whenever user_id was omitted, so any non-superuser calling
GET /authz/role-assignments with no query params got 403 even though the
docstring promised "Users may query their own assignments".
Resolve user_id to current_user.id when omitted, then only gate superuser when
the resolved id differs from the caller. The query is now always filtered by
the resolved user_id, so admins doing cross-user lookups make one call per
user instead of relying on an unscoped see-all.
Adds test_list_assignments_no_user_id_defaults_to_self pinning the new
behavior. The other two assignment-list tests (self with explicit user_id,
non-superuser blocked from another user) remain unchanged and still pass.
* fix(authz): use model_fields_set so PATCH /authz/roles can clear nullable fields
The "if payload.<field> is not None" guards made it impossible to clear
description or parent_role_id via PATCH -- an explicit "description": null
in the body was indistinguishable from omitting the field, leaving the old
value in place.
Switch to presence checks via payload.model_fields_set:
* description: nullable on the DB side, so an explicit null clears the field.
* parent_role_id: nullable + SET NULL on cascade; null removes the parent.
* name: NOT NULL + unique on the DB side. The presence check applies, but
an explicit null is rejected at the boundary with HTTP 400 so the caller
sees a clear error instead of an opaque 409 "Name conflict" from the
IntegrityError catch block below.
* permissions: nullable=False (default_factory=list) on the DB side. An
empty list is the natural "clear"; null is rejected with HTTP 400.
6 new tests: clear description via null, clear parent via null, omitted
fields untouched, reject null name, clear permissions via empty list,
reject null permissions.
Adds _make_role_row helper so SimpleNamespace fakes carry every field
that RoleRead.model_validate expects (workspace_id, created_at, created_by).
* fix(authz): use model_fields_set so PATCH /authz/teams can clear description
The "if payload.description is not None" guard made the description field
unclearable via PATCH -- an explicit "description": null was indistinguishable
from omitting the field, leaving the old value in place.
Switch to a presence check via payload.model_fields_set so null clears the
field, while omission still leaves the row alone. The DB column is nullable,
so None is a legitimate value here.
Scope intentionally narrow: team_name and adom_name are NOT NULL on the DB
side (null would crash on commit) and is_active is bool (null doesn't model
any state), so they keep the existing is-not-None guards.
Adds 2 tests: clear via explicit null, omission leaves value untouched.
Adds _make_team_row helper for parity with _make_role_row.
* fix(authz): validate batch_enforce result length in get_effective_permissions
The default get_effective_permissions impl built `requests` as a cartesian
product of resource_ids x actions, called batch_enforce, then sliced the
flat result back into per-resource action lists. If a plugin's batch_enforce
returned the wrong number of results -- contract violation -- the slicing
silently produced incorrect mappings:
* too-short flat: later resources got `[]` (out-of-bounds slice returns empty
in Python) instead of their real permissions
* too-long flat: tail entries silently dropped
The inner `zip(..., strict=True)` only caught the per-slice mismatch when a
slice happened to be too short, not the global length mismatch.
Validate `len(flat) == len(requests)` immediately after the call and raise
ValueError with expected/actual counts so plugin authors find the contract
break at the first wrong call, not via mysteriously-empty permission lists.
Adds two lfx tests:
* default impl returns full action list per resource (no enforcement)
* mocked batch_enforce returning a wrong-sized list raises ValueError
* fix: remove EE references
* fix: harden authz admin APIs based on PR review
- Pin permission slug format to canonical <resource>:<action> and validate
RoleCreate/RoleUpdate at the API boundary so bad slugs cannot land in
authz_role.permissions and silently fail policy sync.
- Tighten RoleAssignmentCreate: domain_type is a Literal and a model
validator enforces domain_id consistency (required for org/workspace/
project, forbidden for global).
- Restore _resolve_casbin_domain re-export for plugin backward compat.
- Audit-log policy-changing admin writes (role CRUD, role-assignment
create/delete, team CRUD, team membership add/remove) so privilege
grants are visible alongside enforcement decisions.
- Invalidate authorization cache when a team's adom_name or is_active
changes; pure display edits still skip the flush.
* review feedback
* [autofix.ci] apply automated fixes
* fix(authz): harden build_flow and expose authz_enabled on config
Block non-owners from overriding flow graph data on shared builds,
revert unrelated component_index.json churn, and surface
LANGFLOW_AUTHZ_ENABLED on public and authenticated config responses
for EE UI gating.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
|
|||
| e2ef18104b |
chore(frontend): Clean up biome violations on release-1.10.0 (#13375)
fix biome lint |
|||
| b63e98ba06 |
feat(memory): default session filter to All Sessions and add it as a selectable dropdown option (#13350)
* feat(memory): default session filter to All Sessions and add it as a selectable dropdown option * [autofix.ci] apply automated fixes * add translation * [autofix.ci] apply automated fixes * improve translations * [autofix.ci] apply automated fixes * improve translations * [autofix.ci] apply automated fixes * fix testcase * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> |
|||
| 2b8ded4664 |
fix(chat): align message card surfaces (#13354)
* fix(chat): align message card surfaces * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| e4d5190be4 |
chore(ci): Fix 403 in DB migration validation witness flow (#13376)
fix auto login migration validation |
|||
| 6b2ca4bcd8 | fix: restore qdrant deps and migration workflow | |||
| ebb20c58b0 |
fix: Restore custom Agent prompts in starter projects (#13282)
* fix templates prompts * add regression test * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 1e75a269c8 |
fix: Run Flow mutable state leak (#13340)
* fix: isolate Run Flow component state * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * chore: wake ci * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: tune component template copying * [autofix.ci] apply automated fixes * fix: preserve explicit load-from-db state * fix: file component error in run flow * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 104a83c83c |
docs: lfx bundles (#13142)
* docs-initial-overview-bundles-content * fix-broken-link * remove-production-page * docs: check bundles against code and cleanup * docs: fix links |
|||
| a7b8170d53 |
fix: Force streaming on AgentComponent regardless of toggle (#13358)
* fix streaming default true on release * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * add robust tests around streaming to avoid any future errors * [autofix.ci] apply automated fixes * improve fe flaky tests * fix outdated action test * fix flaky outdated action tst --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 1bb95275a5 |
docs: openrouter promoted to global provider (#13271)
docs: check openrouter content and add global |
|||
| e694bbcdff |
docs: troubleshooting for container mismatch (#13217)
* add-troubleshooting-for-container-mismatch * grep-for-volume-name * fix-spacing * danger-admonition |
|||
| 9b7486efe8 |
docs: macos support matrix (#13363)
* docs: macos support matrix * docs: fix linking errors and clarify limitations * cleanup |
|||
| 5e86ab6c5f |
feat: accept v2 workflow globals in request body (#13351)
* fix: accept v2 workflow globals in request body * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * review feedback --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| fb3d6ec90b |
feat: OSS authorization foundations for enterprise RBAC (#13153)
* feat: add OSS authorization foundations for enterprise RBAC
Introduce pluggable AuthorizationService, authz plugin tables, and flow
API enforcement hooks. Disabled by default (LANGFLOW_AUTHZ_ENABLED=false);
enterprise Casbin plugin can override via lfx.services entry point.
* fix(authz): allow non-superusers when OSS authorization service is active
OSS LangflowAuthorizationService is a pass-through until enterprise Casbin
replaces it; the previous fail-closed superuser-only check caused 403 on flow APIs.
* fix(authz): harden OSS authorization foundations (bug + tests + docs) (#13216)
* fix: harden OSS authorization foundations (PR (a) — bug + lint + tests)
Hardening pass for #13153 to clear pre-merge checks and raise unit-test
coverage on the new authorization surface before broader feature work.
- Fix read_public_flow: query the flow directly and return when
access_type == PUBLIC; remove user-impersonation via
get_user_by_flow_id_or_endpoint_name and the read_flow delegation
(public means public — no authz call).
- Fix _token_alias_candidates ordering so the _access_token branch is
reachable (previously shadowed by the _token check).
- Register BaseAuthorizationService in import_all_services_into_a_dict so
AuthorizationServiceFactory can resolve its create() return annotation
at startup (mirrors the BaseAuthService pattern).
- Rename test_non_wxo_access_token_does_not_create_bearer_alias to
test_generic_access_token_exposes_bearer_alias; body asserts the alias
IS created.
- Uppercase env-var literals in test_minimal_services to clear
Ruff SIM112/S105; per-line noqa only for the lowercased global header
name x-langflow-global-var-access-token.
- Add unit coverage for batch_enforce (enabled/disabled/empty),
get_allowed_actions, ensure_permission, ensure_flow_permission,
AuthorizationServiceFactory.create, and the LFX no-op default
AuthorizationService.
- Persist+read tests for the seven previously-untested authz models
(AuthzRoleAssignment, AuthzTeam, AuthzTeamMember, AuthzShare,
AuthzEditLock, AuthzAuditLog).
- One-line docstrings on undocumented public symbols across the new
authorization modules and authz database models.
* fix(authz): align authz_role.permissions model nullability with migration
Migration f7a8b9c0d1e2 declares ``permissions`` as ``nullable=False`` but
the model used the default ``Column(sa.JSON)`` (nullable=True), which made
``test_no_phantom_migrations`` detect a phantom modify_nullable diff after
upgrading to head. Explicitly set ``nullable=False`` so the model matches
the migration.
* feat(authz): finish Phase 1 OSS — FlowAction enum, audit, owner override, project domain (#13220)
PR (b) of the OSS authz rollout. Lands every piece the enterprise Casbin
plugin needs to enforce RBAC on flows end-to-end:
- New FlowAction(str, Enum) — canonical action vocabulary (read/write/
create/delete/execute/deploy). Re-used by enterprise PolicySync when
compiling roles + shares into casbin_rule.
- ensure_flow_permission now accepts FlowAction|str, computes domain
from folder_id ('project:{folder_id}' or '*'), and applies an owner
override: when current_user.id == flow.user_id, the call short-circuits
before contacting the plugin (so solo installs keep working with
LANGFLOW_AUTHZ_ENABLED=true). Owner-override is audited too, with
result='owner_override'.
- Guards wired on all 9 flow CRUD routes (was 4): create, read, patch,
delete, put-upsert (write|create branches), batch-create, upload,
bulk-delete, bulk-download. /public_flow/{id} stays unguarded by
design (public means public), and GET /flows/ list-filtering is
deferred to a follow-up PR.
- audit_decision() schedules an AuthzAuditLog row via asyncio.create_task
on every allow/deny/owner_override decision. Failures inside the task
are logged and swallowed so audit never blocks a request. Gated on a
new AUTHZ_AUDIT_ENABLED setting (defaults True; ignored when AUTHZ is
off).
- filter_visible_resources() helper — generic batch_enforce-based filter
for list endpoints. No-op when AUTHZ disabled. Plumbing for PR (c);
GET /flows/ rewrite is intentionally NOT in this PR.
- BaseAuthorizationService gains invalidate_user / invalidate_role /
invalidate_all hooks (no-op default bodies). Enterprise plugin
overrides these for L1/L2 cache invalidation when roles or shares
change.
OSS LangflowAuthorizationService remains a pass-through; enforcement is
entirely the enterprise plugin's job. Tests use a stub fail-closed
service via monkeypatch to verify guards forward the right tuple, and
source-level checks on flows.py ensure no route silently regresses to
a bare-string action or loses its guard.
47 backend + 12 lfx new/extended tests. Migration regression suite
still green.
* feat(authz): add deployment API guards aligned with Phase 1 flow authz
Wire ensure_deployment_permission on deployment CRUD and run routes using
DeploymentAction, project/workspace domain resolution, owner override, and
audit logging consistent with Eric's flow authorization helpers.
* feat(authz): add `langflow authz dry-run` CLI for policy simulation (#13224)
Adds a self-contained subcommand that simulates every flow-CRUD guard
site under a configurable stub policy and prints what *would* happen —
the Casbin tuple (user, domain, obj, act), the audit row that would be
written, and the resulting HTTP outcome. No network, no DB writes.
Useful for:
- validating an upcoming Casbin policy before shipping it
- showing operators what the audit log will look like
- smoke-testing the guard wiring after a refactor
Built-in policies:
- allow-all (matches the OSS default)
- deny-non-owner (owners + superusers allowed)
- deny-writes (read/execute allowed; write/create/delete denied)
- owner-only (only the flow owner; no superuser bypass)
Usage:
langflow authz dry-run
langflow authz dry-run --policy deny-writes
langflow authz dry-run --policy deny-non-owner --json --output report.json
Implementation: monkey-patches the three helpers in
langflow.services.authorization.utils (get_settings_service,
get_authorization_service, audit_decision) for the duration of the run,
walks _FLOW_GUARDS x three actors (owner / non-owner / superuser), and
renders a Rich table or JSON document with per-row decision + summary
footer.
Tests: 18 cases covering each stub policy, the runner output shape, JSON
serialisation, and CLI integration via typer.testing.CliRunner.
* fix(authz): keep user-derived is_superuser authoritative in ensure_permission
Caller-supplied context was merged after `_auth_context(user)`, which let a
caller forge `context={"is_superuser": True}` and bypass intent of the guard.
Flip the merge order so user-derived auth fields always win, and add a
regression test that asserts a malicious caller cannot override the flag.
* fix(authz): per-flow CREATE checks in batch and upload paths
The batch (POST /flows/batch/) and upload (POST /flows/upload/) handlers were
calling ensure_flow_permission once at the route boundary without per-flow
scope. Because the FlowCreate payload carries caller-supplied workspace_id and
folder_id, a single coarse check let payloads target workspaces/folders the
caller has no create permission on — invisible under OSS pass-through but a
real bypass once an enterprise plugin enforces workspace-scoped roles.
Both handlers now iterate flow_list.flows and call ensure_flow_permission with
the flow's own workspace_id and the effective folder_id (the query parameter
wins on upload, matching _upsert_flow_list's actual write behavior).
Adds two AST-level regression tests that assert each route calls
ensure_flow_permission inside a `for ... in flow_list.flows` loop with the
flow's destination kwargs.
* fix(authz): authorize destination scope when PATCH/PUT moves a flow
update_flow (PATCH) and upsert_flow's update branch (PUT) only checked WRITE
permission against the existing flow's workspace_id/folder_id. Because
_patch_flow and _update_existing_flow apply payload workspace_id/folder_id via
model_dump(exclude_unset=True, exclude_none=True), a caller authorized to
write a flow in scope A could move it into scope B without ever being checked
against B — invisible under OSS pass-through but a real bypass once an
enterprise plugin enforces workspace/share-scoped roles.
Both handlers now compute the effective destination (payload wins when
non-None, else existing) and, when it differs from the existing scope, run a
second ensure_flow_permission(WRITE, ...) call against the destination. No
extra DB hits — the audit row already captures move attempts.
Adds two AST-level regression tests asserting each route makes the
destination check using target_workspace_id/target_folder_id kwargs.
* fix(authz): partial unique indexes on authz_role_assignment for NULL domain_id
The original UNIQUE(user_id, role_id, domain_type, domain_id) constraint on
authz_role_assignment allowed duplicate global role assignments because SQL
treats NULL domain_id values as never-equal. Two ("global", NULL) rows for the
same (user, role) pair both passed.
Replaces the broken constraint with two partial unique indexes:
- uq_authz_role_assignment_scoped: unique on (user_id, role_id, domain_type,
domain_id) WHERE domain_id IS NOT NULL — covers workspace/org assignments.
- uq_authz_role_assignment_global: unique on (user_id, role_id, domain_type)
WHERE domain_type='global' AND domain_id IS NULL — covers global assignments
without relying on NULL equality.
Postgres and SQLite both support partial unique indexes via WHERE clauses.
New Alembic migration (Phase: EXPAND) drops the broken constraint and creates
the two indexes, using batch_alter_table so SQLite recreates the table cleanly.
Three new DB-level regression tests in test_authz_models.py:
- test_authz_role_assignment_blocks_duplicate_global
- test_authz_role_assignment_blocks_duplicate_scoped
- test_authz_role_assignment_allows_distinct_workspaces
* test(lfx): remove redundant @pytest.mark.asyncio decorators
src/lfx/pyproject.toml has asyncio_mode = "auto", so pytest-asyncio
auto-detects async test functions. The decorators on the seven async tests in
test_default_authorization_service.py are no-ops. Removed for clarity; tests
continue to pass via auto-detect (mode=Mode.AUTO confirmed in pytest output).
import pytest stays for the @pytest.fixture decorator on `service`.
* test(authz): complete DeploymentAction enum coverage in test_actions
test_deployment_action_values_match_casbin_strings only asserted READ, CREATE,
EXECUTE — WRITE and DELETE were missing despite being members of the enum.
Mirrored the FlowAction test structure: full value coverage plus a new
test_deployment_action_is_iterable_and_complete that enumerates members.
DeploymentAction has no DEPLOY (deploy is a flow-level action that mints a
deployment), so the expected set is five values.
* fix(authz): partial unique indexes on authz_share for NULL target_id
The original UNIQUE(resource_type, resource_id, scope, target_id) constraint
on authz_share did not prevent duplicate PRIVATE/PUBLIC shares because
target_id is NULL for those scopes and SQL treats NULL values as never-equal.
Replaces the constraint with two partial unique indexes:
- uq_authz_share_targeted: unique on (resource_type, resource_id, scope,
target_id) WHERE target_id IS NOT NULL — covers TEAM/USER scopes.
- uq_authz_share_untargeted: unique on (resource_type, resource_id, scope)
WHERE target_id IS NULL — covers PRIVATE/PUBLIC scopes without relying on
NULL equality.
Chose partial indexes over CodeRabbit's sentinel-UUID suggestion to keep
target_id genuinely nullable (sentinel values leak into every read path that
filters by target_id, and any future FK on target_id would break).
Consistent with the d9e8f7a6b5c4 fix for authz_role_assignment.
New Alembic migration (Phase: EXPAND, validator: ✅) drops the broken
constraint via batch_alter_table and creates both partial indexes.
Three new DB-level regression tests in test_authz_models.py:
- test_authz_share_blocks_duplicate_targeted (USER scope dup → IntegrityError)
- test_authz_share_blocks_duplicate_untargeted (PUBLIC dup → IntegrityError)
- test_authz_share_allows_distinct_targets (sanity: different users OK)
* fix(authz): prefer project over workspace in _resolve_flow_domain
Casbin g2 inheritance is directional: a child resource inherits from its
parent, not the other way round. Declaring `g2, project:xyz, workspace:abc`
lets a workspace-scoped grant flow down to checks made against project:xyz,
but a project-scoped grant does NOT flow up to checks made against
workspace:abc.
The original precedence picked workspace whenever it was set, which made
project-scoped grants invisible to the enforcer the moment a workspace was
also known. Flip the precedence so the more specific domain (project) wins —
project-scoped grants now match directly, and workspace-scoped grants still
match via g2 inheritance. Both ids stay in the enforce context for ABAC.
- _resolve_flow_domain returns project first, then workspace, then "*".
- Docstrings on both _resolve_flow_domain and its callers updated.
- test_ensure_flow_permission_workspace_beats_project renamed to
test_ensure_flow_permission_project_beats_workspace with inverted assertion
and an explanation of g2 directionality.
- test_resolve_flow_domain_precedence updated accordingly.
Deployment helper uses the same function but only one deployment test passes
both ids; deployment behavior is unchanged in tests that pass project_id only.
* feat(authz): Phase 2 — list filtering, execute guards, project routes (#13255)
* feat(authz): Phase 2 — list filtering, execute guards, project routes
Extends the Phase 1 authorization foundations (#13153) with the route coverage
the IBM RBAC design note flags as "Not hooked yet" under §4.1 and the Phase 2
deliverables under §5.3 (workspace/project domain, list/filter APIs).
List filtering
- GET /flows/ now calls filter_visible_resources(FlowAction.READ) on the loaded
list. OSS pass-through returns the input unchanged; the enterprise plugin
uses batch_enforce to honor role + share grants.
- GET /projects/ applies the same filter against ProjectAction.READ.
Execute guards (FlowAction.EXECUTE)
- POST /build/{flow_id}/flow (chat.py): authorizes after loading the flow row.
- POST /run/{flow_id_or_name} (endpoints.py, api-key auth).
- POST /run/session/{flow_id_or_name} (endpoints.py, session auth).
- POST /webhook/{flow_id_or_name} (endpoints.py, webhook auth).
Project (folder) authorization
- New ProjectAction enum (READ/WRITE/CREATE/DELETE).
- New ensure_project_permission helper with workspace domain + owner override,
mirroring the flow/deployment helpers.
- Guards wired into create_project, read_project, update_project,
delete_project, download_file, upload_file.
Tests
- 7 new ensure_project_permission tests in test_utils.py (enum coercion,
workspace domain, owner override, wildcard create object).
- 4 new test_execute_surfaces_guard_with_flow_execute parametrized cases.
- 6 new test_project_routes_guarded parametrized cases.
- test_read_flows_list_unchanged_in_this_pr renamed to
test_read_flows_list_uses_filter_visible_resources; it now asserts the
filter is called exactly once.
Docs
- Added an "Authorization (RBAC)" section to AGENTS.md describing the plugin
model, route helpers, Casbin request shape, and the dry-run CLI.
Out of scope for Phase 2 (per design note §5.3):
- Knowledge bases and global variables (Phase 4: deployments, components,
secrets, audit UI).
- Deployment list filtering (paginated + shaped items; needs SQL-level
prefiltering once authz_share lands in Phase 3).
- authz_share CRUD APIs and UI (Phase 3 — required for full RBAC).
* docs(authz): correct domain precedence note in AGENTS.md
Follows the upstream _resolve_flow_domain fix on the parent branch — project
wins over workspace so project-scoped grants match directly and workspace
grants still flow down via Casbin g2.
* fix(authz): align dry-run CLI with project-over-workspace domain precedence
The _resolve_flow_domain flip (project wins over workspace,
|
|||
| 2d375b2784 | Merge release-1.9.4 into release-1.10.0 | |||
| e248f4f854 |
fix(api-keys): add expiration date support for API keys (#13330)
* Added is_active check to API Keys, expiresAt field that tracks API Key expiry, UI elements to surface this to the Langflow user. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 8e5dd71c0f |
fix(tracing): isolate Langfuse OTel tracer to stop HTTP span pollution (#13344)
* fix(tracing): isolate Langfuse OTel tracer to stop HTTP span pollution Pass an explicit `TracerProvider` to `Langfuse(...)` so the SDK does not register itself as the global OpenTelemetry tracer provider. Without this, `FastAPIInstrumentor.instrument_app` (which uses the global provider) exports every HTTP request span to Langfuse, flooding traces with health checks, flow list calls, and other unrelated routes. Adds regression tests verifying: - the shared Langfuse client is constructed with an explicit `tracer_provider`, and - initializing the client does not swap out the process-wide OTel `TracerProvider`. Fixes #13319 * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 6901cf68e9 |
fix(mcp): fix validation, session isolation, and update_flow_from_spec parity (#12528)
* fix(mcp): fix validation, session isolation, and update_flow_from_spec parity
- create_flow_from_spec now calls validate_flow (polls for completion)
instead of fire-and-forget build_flow
- validate_flow filters poll results by job_id to avoid stale builds
- update_flow_from_spec uses server-side tools (configure_component,
connect_components) for feature parity with create_flow_from_spec,
with rollback on failure
- login() only closes the current session's client and registry,
no longer disrupts other concurrent SSE sessions
- _set_client invalidates _shared_registry when the client changes
to prevent stale registries after server switch
- validate_flow returns consistent "errors" list format
* test(mcp): add unit tests for validation, session isolation, and rollback fixes
* test(mcp): remove obsolete validate_flow job_id polling tests
The polling-by-job_id approach was superseded by streaming validation
in release-1.9.0 (event_delivery=direct). Remove the 4 tests that
exercised the removed polling code path.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(mcp): coerce primitive config values to declared field types
create_flow_from_spec parses YAML config blocks, so numeric / boolean
inputs naturally land as int / float / bool primitives. The flat
configure_component path wrote those into the template as-is and the
downstream build then choked: e.g. ChatInput.input_value is a str-typed
MultilineInput, but YAML 'A.input_value: 42' delivered int 42 and the
Message constructor refused ("The message does not have the required
fields (text, sender, sender_name).") -> RuntimeError 'Flow validation
failed: Build error' rolled the whole spec back.
Adds _coerce_param_value that reads each field's declared 'type' from
the template and coerces str/int/float/bool primitives accordingly.
Containers, code, and unknown shapes pass through unchanged so existing
non-primitive call sites are unaffected. None passes through too --
clearing a field is a valid intent.
bool->str converts to lowercase 'true'/'false' to match the YAML spec
convention (str(True) would give 'True'/'False' capitalized).
Test test_create_flow_from_spec_coerces_numeric_config now passes; the
assertion was tightened to compare against the coerced string form
"42" since the coercion target for input_value is str.
Pre-existing test_create_flow_from_spec_with_tool_mode failure (the
Agent component requires a model + API key to build) is unrelated to
this change -- it fails the same way against the parent commit and is
left for a separate fix.
* [autofix.ci] apply automated fixes
* test(mcp): skip build validation in tool_mode wiring test
Agent requires a model + API key to build, but this test only verifies
that URLComponent.component_as_tool -> Agent.tools wiring round-trips
through the spec parser. Pass validate=False so the test no longer
depends on a buildable graph.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| aea4dd05be |
fix(server): refuse to start with multiple workers and the default in-memory job queue (#13202)
* fix(server): refuse to start with multiple workers and the default in-memory job queue The default JobQueueService keeps build queues in process-local memory. With workers > 1, Gunicorn round-robins POST /api/v1/build/<flow>/flow and the follow-up GET /api/v1/build/<job>/events across workers, so the polling worker finds no queue and returns "Job queue not found for job_id" roughly 45-66% of the time under load. Refuse to start in that config rather than letting operators discover it in production. The RuntimeError lists the two operator-actionable workarounds (configure a Redis-backed shared queue, or run --workers 1) and notes that event_delivery=direct also works since the POST endpoint streams events back inline on the same worker — but the server cannot enforce that at startup because it does not know which delivery mode every future client will pick. Only triggered on the Gunicorn (Linux) path; the direct-uvicorn path on Windows and macOS already clamps workers to 1. * fix(server): skip the multi-worker refusal when LANGFLOW_JOB_QUEUE_TYPE=redis Addresses review feedback on PR #13202: the function listed the redis queue as one of the operator-actionable workarounds but still refused to start even when LANGFLOW_JOB_QUEUE_TYPE=redis was configured, so the workaround was undocumented broken. ensure_multi_worker_safe now reads settings.job_queue_type and returns silently when redis is configured. Redis-backed queues share state across workers and support every event_delivery mode, so the race the check guards against cannot occur. Add a positive test covering the redis case; switch the existing refusal tests to patch the settings service explicitly so they are deterministic regardless of the surrounding environment. |
|||
| 61baba9499 |
fix(traces): bypass impl result_processor in _LegacyCaseEnum so legacy uppercase rows load (#13346)
* fix(traces): bypass impl result_processor in _LegacyCaseEnum to load legacy uppercase rows
The previous attempt at normalising legacy uppercase enum values failed
because ``TypeDecorator.result_processor`` chains the impl's
``result_processor`` *before* ``process_result_value``:
impl (SQLEnum) -> process_result_value
SQLEnum's processor calls ``_object_value_for_elem`` which raises
``LookupError`` for any raw DB string not in the lowercase values list.
Pre-v1.9.2 trace/span rows persist the enum *names* (``'OK'``,
``'ERROR'``, ``'CHAIN'``...), so the impl's processor blew up before
``_LegacyCaseEnum.process_result_value`` had a chance to normalise the
value. The traces panel hit this on every read, returning 500 from the
backend with ``LookupError: 'OK' is not among the defined enum values``.
Override ``result_processor`` to skip the impl's processor entirely and
run only ``process_result_value`` against the raw DB string. Old rows
(uppercase names) and new rows (lowercase values) both round-trip
cleanly.
Adds an end-to-end ORM regression test that seeds a row through the
ORM, rewrites the enum column to the legacy uppercase form via raw SQL,
and asserts the ORM SELECT decodes it back to the right enum member.
The existing ``TestLegacyCaseEnumResultProcessor`` tests called
``process_result_value`` directly and missed this bug — the new tests
exercise the full SQLAlchemy result_processor pipeline.
Fixes #13318
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 27ba63c1d7 |
fix: set graph inputs by component type (#13343)
* fix: set graph inputs by component type Fixes #10796 Co-authored-by: Yuri Chukhlib <yuri.v.chu@gmail.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: Yuri Chukhlib <yuri.v.chu@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| b95d309c46 |
fix(tracing): surface Langfuse setup failures, pin pydantic>=2.13 (Py3.14) (#13341)
* fix(tracing): surface Langfuse setup failures and pin pydantic>=2.13 for Py3.14 Docker v1.9.3 silently dropped Langfuse traces because the Docker image was bumped to Python 3.14 while the lockfile still resolved pydantic 2.12.x. Langfuse v3 imports `pydantic.v1.BaseModel`, which only gained Python 3.14 support in pydantic 2.13. On the user's Docker container, `from langfuse import Langfuse` raised `pydantic.v1.errors.ConfigError`, the broad `except Exception` in `_setup_langfuse` logged at debug level, and the tracer initialized with `_ready = False` — no error in default logs, no traces in Langfuse. PyPI installs worked because users tend to run Python 3.10-3.13 where pydantic.v1 is still happy. Two changes: - Replace `logger.debug` with `logger.warning`/`logger.exception` in `_setup_langfuse` so future failures (network, auth, dependency conflicts) surface in logs by default instead of vanishing silently. - Add `pydantic>=2.13.0` to the `langfuse` extra in `src/backend/base/pyproject.toml` so the Python 3.14 import path is guaranteed to work whenever the extra is installed, regardless of what other deps resolve transitively. Adds regression tests asserting `_setup_langfuse` calls `logger.warning`/`logger.exception` on the three failure modes (auth check returning False, auth check raising, post-auth setup exception). Fixes #13317 * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| e24b265482 |
fix(frontend): Safari Selected Components (#13283)
* refactor(frontend): rename useShiftDragSelectFix → useCanvasDragSelectFix * add testcases * ruff changes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> |
|||
| 1e138141e0 |
feat: LE-1017 Event bus for bundle events (#13253)
* Adding lfx bundle lifecycle events. Routed the useExtensionService to poll for bundle extension updates. Added reload event deduplication to bundles. Make bundle events user scoped. Aligned bundle schemas between BE and FE. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
