refactor(warm-registry): gate on LANGFLOW_DEPLOYMENT_PROFILE=prod (unify with preflight #14393) instead of LANGFLOW_PROD

Author: Janardan S Kavia

src/backend/base/langflow/api/router.py

@@ -147,13 +147,14 @@ def _include_agentic_router():
 # them (one handler per method+path). ``developer_api_guard=False`` because the
 # authenticated langflow v2 router has never carried a developer-api gate; the
 # default-off setting would otherwise 403 every authenticated request.
-# In PROD (``LANGFLOW_PROD``, execution-plane / ``--backend-only``) the warm host
-# serves deployed flows from the in-memory registry and skips per-flow RBAC. The
-# warm-vs-DB choice is made per ``settings.prod`` but DEFERRED to first use: this
-# module is imported before ``load_dotenv(--env-file)`` runs, so reading the env
-# (or the settings service) here would miss ``--env-file`` values. The route
-# structure is identical for both hosts, so binding the deferred proxy changes
-# nothing structurally — only which concrete host each request resolves to.
+# Under the production deployment profile (``LANGFLOW_DEPLOYMENT_PROFILE=prod``,
+# execution-plane / ``--backend-only``) the warm host serves deployed flows from the
+# in-memory registry and skips per-flow RBAC. The warm-vs-DB choice is made per that
+# profile but DEFERRED to first use: this module is imported before
+# ``load_dotenv(--env-file)`` runs, so reading the env (or the settings service) here
+# would miss ``--env-file`` values. The route structure is identical for both hosts,
+# so binding the deferred proxy changes nothing structurally — only which concrete
+# host each request resolves to.
 _workflow_host: WorkflowHost = DeferredWorkflowHost()
 assert isinstance(_workflow_host, WorkflowHost)  # noqa: S101
 router_v2.include_router(

src/backend/base/langflow/api/v2/host_selection.py

@@ -1,16 +1,19 @@
 """Deferred selection of the v2 workflow host (warm PROD registry vs DB-backed).
 
-Which host serves ``POST /api/v2/workflows`` depends on ``settings.prod``
-(``LANGFLOW_PROD``). The problem: ``langflow.__main__`` imports the router module
+Which host serves ``POST /api/v2/workflows`` depends on the deployment profile
+(``LANGFLOW_DEPLOYMENT_PROFILE=prod`` -> ``settings.deployment_profile``, the same
+umbrella flag whose prod value the deployment-profile preflight fail-fast-validates:
+enabling the warm/authz-lean host is gated behind that validated profile, not a
+standalone switch). The problem: ``langflow.__main__`` imports the router module
 (and therefore builds this router) *before* it runs ``load_dotenv(--env-file)``, so
 reading the env — or the settings service — at import time would miss any value
 supplied via ``--env-file``. That is exactly the ordering trap the extensions router
 documents for ``LANGFLOW_ENABLE_EXTENSION_RELOAD``.
 
 ``DeferredWorkflowHost`` defers the choice to first use. By the time any workflow
 route (or capability flag) is exercised, ``setup_app``/lifespan has initialized the
-settings service from the fully-loaded environment, so ``settings.prod`` is correct.
-The route *structure* is identical for both hosts (the shared router only reads
+settings service from the fully-loaded environment, so the profile is correct. The
+route *structure* is identical for both hosts (the shared router only reads
 ``supports_*`` at request time, and ``auto_register_job_routes=False`` neutralizes
 the one mount-time read), so binding this single proxy at import changes nothing
 structurally — only which concrete host each request lands on.
@@ -35,8 +38,21 @@
     from lfx.workflow.host import ResolvedFlow, WorkflowAction
 
 
+def is_prod_deployment(settings: Any) -> bool:
+    """True when the production deployment profile is active.
+
+    Consumes ``settings.deployment_profile`` (env ``LANGFLOW_DEPLOYMENT_PROFILE``) —
+    the umbrella flag owned by the deployment-profile preflight feature. Read
+    defensively via ``getattr`` so this code is safe on branches where that setting
+    does not exist yet: absent -> ``"dev"`` -> production behavior stays off. The
+    warm registry + authz-lean host therefore activate only under the same ``prod``
+    profile the preflight gate validates.
+    """
+    return getattr(settings, "deployment_profile", "dev") == "prod"
+
+
 class DeferredWorkflowHost(WorkflowHostBase):
-    """A ``WorkflowHost`` that picks the concrete host lazily from ``settings.prod``.
+    """A ``WorkflowHost`` that picks the concrete host lazily from the deployment profile.
 
     Every member delegates to the resolved host. Resolution is cached only once the
     settings service is initialized, so an access during module import (before
@@ -60,7 +76,9 @@ def _resolve(self) -> WorkflowHostBase:
         # real choice is still made on the first post-startup call.
         if not is_settings_service_initialized():
             return LangflowWorkflowHost()
-        host: WorkflowHostBase = WarmWorkflowHost() if get_settings_service().settings.prod else LangflowWorkflowHost()
+        host: WorkflowHostBase = (
+            WarmWorkflowHost() if is_prod_deployment(get_settings_service().settings) else LangflowWorkflowHost()
+        )
         self._host = host
         return host
 

src/backend/base/langflow/main.py

@@ -29,6 +29,7 @@
 from langflow.api import health_check_router, log_router
 from langflow.api.router import router
 from langflow.api.v1.mcp_projects import init_mcp_servers
+from langflow.api.v2.host_selection import is_prod_deployment
 from langflow.initial_setup.setup import (
     copy_profile_pictures,
     create_or_update_starter_projects,
@@ -452,7 +453,7 @@ async def lifespan(_app: FastAPI):
             # build). Warming and the loop are launched INDEPENDENTLY: a failed eager warm
             # must not stop the reconcile loop, which self-heals on its next pass. Runs
             # once per worker (app "lifespan"); the settings service is safe here.
-            if get_settings_service().settings.prod:
+            if is_prod_deployment(get_settings_service().settings):
                 from langflow.services.warm_registry.reconcile import reconcile_loop, warm_all
 
                 try:

src/backend/tests/unit/services/warm_registry/test_warm_registry_reconcile.py

@@ -240,23 +240,26 @@ async def _fake_once():
 
 
 async def test_prod_lifespan_warms_and_cancels_loop(monkeypatch, tmp_path):
-    """Boot the app with LANGFLOW_PROD=true to cover the main.py prod wiring.
+    """Boot the app under the prod deployment profile to cover the main.py prod wiring.
 
     Startup runs the warm block; shutdown cancels the reconcile loop.
     """
+    import langflow.main as main_mod
     from asgi_lifespan import LifespanManager
     from langflow.main import create_app
     from langflow.services.deps import get_db_service
     from lfx.services.manager import get_service_manager
 
     db_path = tmp_path / "prod.db"
-    monkeypatch.setenv("LANGFLOW_PROD", "true")
+    # ``deployment_profile`` is owned by the preflight PR and not present on this branch,
+    # so drive the prod branch by patching the profile check the lifespan calls.
+    monkeypatch.setattr(main_mod, "is_prod_deployment", lambda _settings: True)
     monkeypatch.setenv("LANGFLOW_DATABASE_URL", f"sqlite:///{db_path}")
     monkeypatch.setenv("LANGFLOW_AUTO_LOGIN", "true")
     monkeypatch.setenv("DO_NOT_TRACK", "true")
 
     def _init():
-        # Fresh service stack so settings.prod is re-read from the env above.
+        # Fresh service stack booted from the env above.
         get_service_manager().factories.clear()
         get_service_manager().services.clear()
         app = create_app()
@@ -279,6 +282,7 @@ def _init():
 
 async def test_prod_lifespan_survives_warm_failure(monkeypatch, tmp_path):
     """A failure in warm_all during prod startup is logged, not fatal (except branch)."""
+    import langflow.main as main_mod
     from asgi_lifespan import LifespanManager
     from langflow.main import create_app
     from langflow.services.deps import get_db_service
@@ -293,7 +297,8 @@ async def _boom_warm() -> None:
     monkeypatch.setattr(reconcile_mod, "warm_all", _boom_warm)
 
     db_path = tmp_path / "prod_fail.db"
-    monkeypatch.setenv("LANGFLOW_PROD", "true")
+    # Drive the prod branch via the profile check (see the sibling lifespan test).
+    monkeypatch.setattr(main_mod, "is_prod_deployment", lambda _settings: True)
     monkeypatch.setenv("LANGFLOW_DATABASE_URL", f"sqlite:///{db_path}")
     monkeypatch.setenv("LANGFLOW_AUTO_LOGIN", "true")
     monkeypatch.setenv("DO_NOT_TRACK", "true")
@@ -517,7 +522,9 @@ def test_deferred_host_resolves_db_when_not_prod(monkeypatch):
     from langflow.services import deps
 
     monkeypatch.setattr(deps, "is_settings_service_initialized", lambda: True)
-    monkeypatch.setattr(deps, "get_settings_service", lambda: SimpleNamespace(settings=SimpleNamespace(prod=False)))
+    monkeypatch.setattr(
+        deps, "get_settings_service", lambda: SimpleNamespace(settings=SimpleNamespace(deployment_profile="dev"))
+    )
     host = DeferredWorkflowHost()
     assert isinstance(host._resolve(), LangflowWorkflowHost)
 
@@ -531,7 +538,9 @@ def test_deferred_host_resolves_warm_when_prod(monkeypatch):
     from langflow.services import deps
 
     monkeypatch.setattr(deps, "is_settings_service_initialized", lambda: True)
-    monkeypatch.setattr(deps, "get_settings_service", lambda: SimpleNamespace(settings=SimpleNamespace(prod=True)))
+    monkeypatch.setattr(
+        deps, "get_settings_service", lambda: SimpleNamespace(settings=SimpleNamespace(deployment_profile="prod"))
+    )
     host = DeferredWorkflowHost()
     resolved = host._resolve()
     assert isinstance(resolved, WarmWorkflowHost)

src/lfx/src/lfx/services/settings/groups/runtime.py

@@ -16,22 +16,14 @@ class RuntimeSettings(BaseModel):
     dev: bool = False
     """If True, Langflow will run in development mode."""
 
-    prod: bool = False
-    """If True, run in production execution-plane mode (LANGFLOW_PROD).
-
-    Serves deployed flows from a warm in-memory registry instead of rebuilding the
-    graph from the DB on every request, and skips per-flow RBAC on the workflow run
-    path (single-tenant trust model: any authenticated caller may run any deployed
-    flow). Intended for ``--backend-only`` execution machines. The prod preflight
-    fail-fast gate (Postgres/S3/SECRET_KEY checks) is a separate feature."""
-
     warm_reconcile_interval: float = Field(default=20.0, gt=0)
     """Seconds between warm-registry reconcile passes (LANGFLOW_WARM_RECONCILE_INTERVAL).
 
     Each execution machine independently diffs its in-memory registry against the
     shared ``flow`` table every ``interval`` seconds, so a deploy or delete takes up
     to this long to propagate across the fleet. Lower for faster convergence at the
-    cost of more manifest queries. Only used when ``prod`` is True. Must be > 0."""
+    cost of more manifest queries. Only used under the production deployment profile
+    (``LANGFLOW_DEPLOYMENT_PROFILE=prod``). Must be > 0."""
 
     # Job Queue
     job_queue_type: Literal["asyncio", "redis"] = "asyncio"

src/lfx/tests/unit/services/settings/test_settings_composition.py

@@ -157,7 +157,6 @@ def import_without_openai(name, *args, **kwargs):
     "like_webhook_url",
     # RuntimeSettings
     "dev",
-    "prod",
     "warm_reconcile_interval",
     "event_delivery",
     "worker_timeout",