merge fix

Author: Cristhianzl

docs/docs/API-Reference/workflows-api.mdx

@@ -504,7 +504,7 @@ The API uses standard HTTP status codes to indicate success or failure:
 |-------------|-------------|
 | `200 OK` | Request successful. |
 | `400 Bad Request` | Invalid request parameters. |
-| `401 Unauthorized` | Invalid or missing API key. |
+| `403 Forbidden` | Invalid or missing API key. |
 | `404 Not Found` | Flow not found or developer API disabled. |
 | `422 Unprocessable Entity` | Unknown `stream_protocol` or unsupported field for the selected mode. |
 | `500 Internal Server Error` | Server error during execution. |

src/backend/base/langflow/agentic/flows/LangflowAssistant.json

@@ -16,7 +16,13 @@
 from langflow.services.authorization import ShareAction, ensure_share_permission
 from langflow.services.authorization.invalidation import safe_invalidate_all, safe_invalidate_user
 from langflow.services.authorization.utils import audit_decision
-from langflow.services.database.models.auth import AuthzShare, AuthzTeamMember, SharePermissionLevel, ShareScope
+from langflow.services.database.models.auth import (
+    AuthzShare,
+    AuthzTeam,
+    AuthzTeamMember,
+    SharePermissionLevel,
+    ShareScope,
+)
 from langflow.services.database.models.deployment.model import Deployment
 from langflow.services.database.models.file.model import File as UserFile
 from langflow.services.database.models.flow.model import Flow
@@ -57,6 +63,38 @@ async def _resolve_resource_owner(
     return getattr(row, owner_attr, None)
 
 
+async def _serialize_shares(session: DbSession, rows: list[AuthzShare]) -> list[ShareRead]:
+    """Serialize shares with human-readable user and team target names.
+
+    ``target_id`` is polymorphic, so the database cannot expose a normal ORM
+    relationship. Resolve each target kind in one query and keep the name
+    optional for deleted or otherwise stale targets.
+    """
+    user_ids = {row.target_id for row in rows if row.scope == ShareScope.USER.value and row.target_id is not None}
+    team_ids = {row.target_id for row in rows if row.scope == ShareScope.TEAM.value and row.target_id is not None}
+
+    user_names: dict[UUID, str] = {}
+    if user_ids:
+        user_rows = await session.exec(select(User.id, User.username).where(User.id.in_(user_ids)))
+        user_names.update(dict(user_rows.all()))
+    team_names: dict[UUID, str] = {}
+    if team_ids:
+        team_rows = await session.exec(select(AuthzTeam.id, AuthzTeam.team_name).where(AuthzTeam.id.in_(team_ids)))
+        team_names.update(dict(team_rows.all()))
+
+    def target_name(row: AuthzShare) -> str | None:
+        if row.scope == ShareScope.USER.value:
+            return user_names.get(row.target_id)
+        if row.scope == ShareScope.TEAM.value:
+            return team_names.get(row.target_id)
+        return None
+
+    return [
+        ShareRead.model_validate(row, from_attributes=True).model_copy(update={"target_name": target_name(row)})
+        for row in rows
+    ]
+
+
 def _share_visible(
     *,
     row: AuthzShare,
@@ -210,7 +248,7 @@ async def create_share(
             detail="Share could not be created: it may already exist or conflict with an existing share.",
         ) from exc
     await session.refresh(row)
-    response = ShareRead.model_validate(row, from_attributes=True)
+    response = (await _serialize_shares(session, [row]))[0]
     await session.commit()
 
     # Refresh policy after commit so plugins using a separate DB connection see
@@ -277,14 +315,14 @@ async def list_shares(
 
     is_superuser = getattr(current_user, "is_superuser", False)
     if is_superuser:
-        return [ShareRead.model_validate(row, from_attributes=True) for row in rows]
+        return await _serialize_shares(session, rows)
 
     # Pre-fetch team memberships (avoid N+1 per row).
     team_membership_stmt = select(AuthzTeamMember.team_id).where(AuthzTeamMember.user_id == current_user.id)
     caller_team_ids: set[UUID] = set(await session.exec(team_membership_stmt))
 
     # Filter rows by visibility rules for non-superusers.
-    visible: list[ShareRead] = []
+    visible: list[AuthzShare] = []
     owner_cache: dict[tuple[str, UUID], UUID | None] = {}
     for row in rows:
         key = (row.resource_type, row.resource_id)
@@ -300,8 +338,8 @@ async def list_shares(
             resource_owner_id=owner_cache[key],
             caller_team_ids=caller_team_ids,
         ):
-            visible.append(ShareRead.model_validate(row, from_attributes=True))
-    return visible
+            visible.append(row)
+    return await _serialize_shares(session, visible)
 
 
 def _row_visible_to(
@@ -355,7 +393,7 @@ async def get_share(
         # UUID privacy: forbidden share → 404.
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Share not found")
 
-    return ShareRead.model_validate(row, from_attributes=True)
+    return (await _serialize_shares(session, [row]))[0]
 
 
 @router.patch("/{share_id}", response_model=ShareRead)
@@ -405,7 +443,7 @@ async def update_share(
             detail="Share could not be updated: it may conflict with an existing share.",
         ) from exc
     await session.refresh(row)
-    response = ShareRead.model_validate(row, from_attributes=True)
+    response = (await _serialize_shares(session, [row]))[0]
     await session.commit()
 
     await _refresh_policy_for_share(response.scope, response.target_id, op="share:update")

src/backend/base/langflow/agentic/flows/SystemMessageGen.json

@@ -104,9 +104,8 @@ async def create_memory_base(
     - Returns 422 if preprocessing=true but preproc_model is missing.
     """
     # Memory bases are knowledge-base-backed resources; guard via the KB family.
-    # Passing the actor as owner makes the owner-override path return early when
-    # no access ceiling is set, preserving existing behavior, while a deny-only
-    # external ceiling (e.g. a "viewer") is still enforced.
+    # The actor is only the prospective owner during CREATE, so the shared guard
+    # still evaluates policy instead of applying the existing-resource override.
     await ensure_knowledge_base_permission(
         current_user,
         KnowledgeBaseAction.CREATE,

src/backend/base/langflow/agentic/flows/TemplateAssistant.json

@@ -58,6 +58,7 @@ class ShareRead(BaseModel):
     resource_id: UUID
     scope: ShareScopeLiteral
     target_id: UUID | None
+    target_name: str | None = None
     permission_level: SharePermissionLiteral
     created_by: UUID | None
     created_at: datetime

src/backend/base/langflow/agentic/flows/TranslationFlow.json

@@ -70,6 +70,7 @@
 from langflow.api.v2.workflow_validation import (
     _enforce_flow_data_override_owner,
     _flow_not_found_privacy_exception,
+    _reject_sync_only_fields,
     _reject_unsupported_sync_fields,
     _validate_flow_data_for_execution,
 )
@@ -223,6 +224,7 @@ async def authorize_flow_action(
 def _apply_execution_gates(parsed, flow, current_user: UserRead) -> None:
     """The langflow request gates that run before a flow executes."""
     _reject_unsupported_sync_fields(parsed)
+    _reject_sync_only_fields(parsed)
     try:
         _enforce_flow_data_override_owner(parsed, flow, current_user)
     except HTTPException as exc:

src/backend/base/langflow/api/v1/authz_shares.py

@@ -50,6 +50,27 @@ def _reject_unsupported_sync_fields(parsed: ParsedWorkflowRun) -> None:
         )
 
 
+def _reject_sync_only_fields(parsed: ParsedWorkflowRun) -> None:
+    """Reject sync-only request fields in stream/background mode.
+
+    ``output_ids`` only drives answer selection on the inline sync path; other
+    modes would silently ignore it, which reads as success to the caller.
+    """
+    if parsed.mode == "sync" or not parsed.output_ids:
+        return
+
+    raise HTTPException(
+        status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+        detail={
+            "error": "Unsupported request fields for mode",
+            "code": "MODE_UNSUPPORTED_FIELDS",
+            "message": f"mode='{parsed.mode}' does not support request fields: output_ids. "
+            "Output selection via output_ids only applies to mode='sync'.",
+            "fields": ["output_ids"],
+        },
+    )
+
+
 def _enforce_flow_data_override_owner(parsed: ParsedWorkflowRun, flow: FlowRead, current_user: UserRead) -> None:
     """Only the flow owner may execute caller-supplied graph data."""
     if parsed.data is None or flow.user_id == current_user.id: