mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-23 15:43:25 +08:00
d642f88adc
When a flow's folder requires apikey auth, the JSON-RPC route now requires a valid langflow API key in the x-api-key header whose owner is the flow owner, before any dispatch (covers message/send, message/stream, tasks/get, tasks/resubscribe). Flows in none folders stay public (the A2A public-agent model); the discovery card stays public by spec. Uses check_key directly rather than api_key_security, which under AUTO_LOGIN returns the superuser for a missing key and would bypass the gate. The key is scoped to flow.user_id since the flow runs as its owner. The auth_type read is extracted into a shared folder_auth_type helper so card-advertise and route-enforce can't drift.