Skip to content

Commit 4f86736

Browse files
ogabrielluizautofix-ci[bot]
ogabrielluiz
and
autofix-ci[bot]
authored
fix(api): enforce sync-only output_ids across modes and correct documented auth status code (#14091)
* fix(api): reject sync-only output_ids in stream/background mode, correct documented auth status code output_ids only drives answer selection on the inline sync path; stream and background runs silently ignored it while data/files in sync mode already returned 422. Add the inverse guard so all mode-incompatible fields fail loudly, and fix the workflows API error table to document 403 (Langflow's convention for missing/invalid credentials) instead of 401. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
1 parent 887f2a5 commit 4f86736

30 files changed

Lines changed: 195 additions & 149 deletions

‎docs/docs/API-Reference/workflows-api.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -504,7 +504,7 @@ The API uses standard HTTP status codes to indicate success or failure:
504504
|-------------|-------------|
505505
| `200 OK` | Request successful. |
506506
| `400 Bad Request` | Invalid request parameters. |
507-
| `401 Unauthorized` | Invalid or missing API key. |
507+
| `403 Forbidden` | Invalid or missing API key. |
508508
| `404 Not Found` | Flow not found or developer API disabled. |
509509
| `422 Unprocessable Entity` | Unknown `stream_protocol` or unsupported field for the selected mode. |
510510
| `500 Internal Server Error` | Server error during execution. |

‎src/backend/base/langflow/api/v2/workflow.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@
7070
from langflow.api.v2.workflow_validation import (
7171
_enforce_flow_data_override_owner,
7272
_flow_not_found_privacy_exception,
73+
_reject_sync_only_fields,
7374
_reject_unsupported_sync_fields,
7475
_validate_flow_data_for_execution,
7576
)
@@ -223,6 +224,7 @@ async def authorize_flow_action(
223224
def _apply_execution_gates(parsed, flow, current_user: UserRead) -> None:
224225
"""The langflow request gates that run before a flow executes."""
225226
_reject_unsupported_sync_fields(parsed)
227+
_reject_sync_only_fields(parsed)
226228
try:
227229
_enforce_flow_data_override_owner(parsed, flow, current_user)
228230
except HTTPException as exc:

‎src/backend/base/langflow/api/v2/workflow_validation.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,27 @@ def _reject_unsupported_sync_fields(parsed: ParsedWorkflowRun) -> None:
5050
)
5151

5252

53+
def _reject_sync_only_fields(parsed: ParsedWorkflowRun) -> None:
54+
"""Reject sync-only request fields in stream/background mode.
55+
56+
``output_ids`` only drives answer selection on the inline sync path; other
57+
modes would silently ignore it, which reads as success to the caller.
58+
"""
59+
if parsed.mode == "sync" or not parsed.output_ids:
60+
return
61+
62+
raise HTTPException(
63+
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
64+
detail={
65+
"error": "Unsupported request fields for mode",
66+
"code": "MODE_UNSUPPORTED_FIELDS",
67+
"message": f"mode='{parsed.mode}' does not support request fields: output_ids. "
68+
"Output selection via output_ids only applies to mode='sync'.",
69+
"fields": ["output_ids"],
70+
},
71+
)
72+
73+
5374
def _enforce_flow_data_override_owner(parsed: ParsedWorkflowRun, flow: FlowRead, current_user: UserRead) -> None:
5475
"""Only the flow owner may execute caller-supplied graph data."""
5576
if parsed.data is None or flow.user_id == current_user.id:

‎src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -897,19 +897,19 @@
897897
"dependencies": [
898898
{
899899
"name": "langchain",
900-
"version": "1.3.11"
900+
"version": "1.3.13"
901901
},
902902
{
903903
"name": "langgraph",
904-
"version": "1.2.8"
904+
"version": "1.2.9"
905905
},
906906
{
907907
"name": "lfx",
908908
"version": null
909909
},
910910
{
911911
"name": "langchain_core",
912-
"version": "1.4.8"
912+
"version": "1.4.9"
913913
}
914914
],
915915
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Content Aggregator.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1467,19 +1467,19 @@
14671467
"dependencies": [
14681468
{
14691469
"name": "langchain",
1470-
"version": "1.3.11"
1470+
"version": "1.3.13"
14711471
},
14721472
{
14731473
"name": "langgraph",
1474-
"version": "1.2.8"
1474+
"version": "1.2.9"
14751475
},
14761476
{
14771477
"name": "lfx",
14781478
"version": null
14791479
},
14801480
{
14811481
"name": "langchain_core",
1482-
"version": "1.4.8"
1482+
"version": "1.4.9"
14831483
}
14841484
],
14851485
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -444,19 +444,19 @@
444444
"dependencies": [
445445
{
446446
"name": "langchain",
447-
"version": "1.3.11"
447+
"version": "1.3.13"
448448
},
449449
{
450450
"name": "langgraph",
451-
"version": "1.2.8"
451+
"version": "1.2.9"
452452
},
453453
{
454454
"name": "lfx",
455455
"version": null
456456
},
457457
{
458458
"name": "langchain_core",
459-
"version": "1.4.8"
459+
"version": "1.4.9"
460460
}
461461
],
462462
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Deep Research Agent.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1224,19 +1224,19 @@
12241224
"dependencies": [
12251225
{
12261226
"name": "langchain",
1227-
"version": "1.3.11"
1227+
"version": "1.3.13"
12281228
},
12291229
{
12301230
"name": "langgraph",
1231-
"version": "1.2.8"
1231+
"version": "1.2.9"
12321232
},
12331233
{
12341234
"name": "lfx",
12351235
"version": null
12361236
},
12371237
{
12381238
"name": "langchain_core",
1239-
"version": "1.4.8"
1239+
"version": "1.4.9"
12401240
}
12411241
],
12421242
"total_dependencies": 4
@@ -1966,19 +1966,19 @@
19661966
"dependencies": [
19671967
{
19681968
"name": "langchain",
1969-
"version": "1.3.11"
1969+
"version": "1.3.13"
19701970
},
19711971
{
19721972
"name": "langgraph",
1973-
"version": "1.2.8"
1973+
"version": "1.2.9"
19741974
},
19751975
{
19761976
"name": "lfx",
19771977
"version": null
19781978
},
19791979
{
19801980
"name": "langchain_core",
1981-
"version": "1.4.8"
1981+
"version": "1.4.9"
19821982
}
19831983
],
19841984
"total_dependencies": 4
@@ -2720,19 +2720,19 @@
27202720
"dependencies": [
27212721
{
27222722
"name": "langchain",
2723-
"version": "1.3.11"
2723+
"version": "1.3.13"
27242724
},
27252725
{
27262726
"name": "langgraph",
2727-
"version": "1.2.8"
2727+
"version": "1.2.9"
27282728
},
27292729
{
27302730
"name": "lfx",
27312731
"version": null
27322732
},
27332733
{
27342734
"name": "langchain_core",
2735-
"version": "1.4.8"
2735+
"version": "1.4.9"
27362736
}
27372737
],
27382738
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Document Q&A.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1358,19 +1358,19 @@
13581358
"dependencies": [
13591359
{
13601360
"name": "langchain",
1361-
"version": "1.3.11"
1361+
"version": "1.3.13"
13621362
},
13631363
{
13641364
"name": "langgraph",
1365-
"version": "1.2.8"
1365+
"version": "1.2.9"
13661366
},
13671367
{
13681368
"name": "lfx",
13691369
"version": null
13701370
},
13711371
{
13721372
"name": "langchain_core",
1373-
"version": "1.4.8"
1373+
"version": "1.4.9"
13741374
}
13751375
],
13761376
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Financial Report Parser.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -626,7 +626,7 @@
626626
},
627627
{
628628
"name": "langchain_core",
629-
"version": "1.4.8"
629+
"version": "1.4.9"
630630
},
631631
{
632632
"name": "pydantic",
@@ -1310,19 +1310,19 @@
13101310
"dependencies": [
13111311
{
13121312
"name": "langchain",
1313-
"version": "1.3.11"
1313+
"version": "1.3.13"
13141314
},
13151315
{
13161316
"name": "langgraph",
1317-
"version": "1.2.8"
1317+
"version": "1.2.9"
13181318
},
13191319
{
13201320
"name": "lfx",
13211321
"version": null
13221322
},
13231323
{
13241324
"name": "langchain_core",
1325-
"version": "1.4.8"
1325+
"version": "1.4.9"
13261326
}
13271327
],
13281328
"total_dependencies": 4

‎src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@
269269
},
270270
{
271271
"name": "langchain_core",
272-
"version": "1.4.8"
272+
"version": "1.4.9"
273273
},
274274
{
275275
"name": "pydantic",
@@ -1230,11 +1230,11 @@
12301230
"dependencies": [
12311231
{
12321232
"name": "astrapy",
1233-
"version": "2.3.0"
1233+
"version": "2.3.1"
12341234
},
12351235
{
12361236
"name": "langchain_core",
1237-
"version": "1.4.8"
1237+
"version": "1.4.9"
12381238
},
12391239
{
12401240
"name": "lfx_datastax",
@@ -2486,19 +2486,19 @@
24862486
"dependencies": [
24872487
{
24882488
"name": "langchain",
2489-
"version": "1.3.11"
2489+
"version": "1.3.13"
24902490
},
24912491
{
24922492
"name": "langgraph",
2493-
"version": "1.2.8"
2493+
"version": "1.2.9"
24942494
},
24952495
{
24962496
"name": "lfx",
24972497
"version": null
24982498
},
24992499
{
25002500
"name": "langchain_core",
2501-
"version": "1.4.8"
2501+
"version": "1.4.9"
25022502
}
25032503
],
25042504
"total_dependencies": 4
@@ -3246,11 +3246,11 @@
32463246
"dependencies": [
32473247
{
32483248
"name": "astrapy",
3249-
"version": "2.3.0"
3249+
"version": "2.3.1"
32503250
},
32513251
{
32523252
"name": "langchain_core",
3253-
"version": "1.4.8"
3253+
"version": "1.4.9"
32543254
},
32553255
{
32563256
"name": "lfx_datastax",

0 commit comments

Comments
 (0)