feat: add var to block custom component execution (#11893)

* add var to block custom component execution

* [autofix.ci] apply automated fixes

* swaps generic check for a specific legacy name check for prompt

* [autofix.ci] apply automated fixes

* Add missing endpoint checks

* fix language

* Add flow validation and tests

* [autofix.ci] apply automated fixes

* Add a few more tests and validation to other endpoints

* clean up test and import logic

* [autofix.ci] apply automated fixes

* ensure flow is saved after upgrade

* Use hash instead of code

* Fix review issues: type safety, error handling, and test coverage

- Change ComponentCache hash fields to None default (was {}) to make
  "not yet loaded" explicit in the type system and eliminate the error-prone
  `or None` pattern at 8+ callsites
- Narrow frontend 403 suppression to only match custom component errors,
  preventing unrelated auth/permission 403s from being swallowed
- Add console.warn logging to waitForNodeUpdates timeout, saveFlow catch,
  and 403 suppression paths for debuggability
- Document security invariants (build_vertex cache-hit, nodes-without-code)
- Add server-side logging to MCP validation failures
- Add TestBuildCodeHashLookups test class (9 tests) for _build_code_hash_lookups

* remove divider when new cust comp button is removed

* syntax fix in ui

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* DRY

* [autofix.ci] apply automated fixes

* fix imports

* add field order to script updates

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: harden custom component lockdown across api, lfx, and editor

- enforce custom-component validation before lfx and backend flow execution
- normalize legacy built-in aliases like Prompt and URL during validation and refresh
- surface blocked custom nodes in the editor without mutating persisted edited state
- prevent empty-flow save/build hangs when custom components are disabled
- add regression coverage for api, lfx, starter project refresh, and frontend guards

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Add legacy type mapping back for prompt component

* Fix missing import and add real run tests

* fix(flow): Centralize custom component validation

Route payload and prebuilt graph checks through one shared validator so
backend and lfx execution surfaces enforce the same custom-component
policy.

Keep Graph.from_payload as the fresh-build guard, revalidate cached and
script-loaded graphs before execution, and extend coverage for MCP,
workflow reconstruction, agentic flows, and real lfx runs.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* remove useless function

* remove double validation cases

* remove outdated hash history refs

* fix(frontend): preserve custom component recovery paths

Clear dismissed state after successful bulk restores and make the toolbar Code entrypoint follow config transitions.

Add regressions for bulk restore cleanup, toolbar config changes, and single-node restore of dismissed outdated components.

* fix(frontend): Block uploaded custom components in editor

Surface uploaded CustomComponent nodes as blocked when custom
components are disabled so the editor warns before build
and refresh paths hit backend rejections.

Recompute component warnings when config loads and tighten
the disabled-mode guard so allowed custom components are
not treated as blocked.

* Add parser to legacy type analysis

* fix: update components on render consolidate config reads

Replace scattered useGetConfig reads with useUtilityStore
for a single source of truth.

- chat.py: use elif so request data validation skips stale DB flow;
  reorder build_public_tmp to check public access before validation
- flow_validation.py: surface loader failures instead of swallowing them
- use-get-types.ts: recompute componentsToUpdate after templates load
- Frontend: read allowCustomComponents from utilityStore in code area,
  sidebar, and node toolbar components

* Add tiny guard to not update on zero length nodes

* DRY ref for compute update function

* Remove redundant validations (for now)

* refactor: replace string-matching error classification with CustomComponentValidationError

Introduce CustomComponentValidationError(ValueError) so API handlers can
catch validation errors by type instead of matching error message strings.
This eliminates the fragile is_custom_component_validation_error_message
function and makes error routing explicit across all endpoints.

- Add CustomComponentValidationError in flow_validation.py
- check_flow_and_raise now raises CustomComponentValidationError
- Replace all is_custom_component_validation_error_message call sites
  with except CustomComponentValidationError in chat.py, endpoints.py,
  openai_responses.py, mcp_utils.py, and flow_executor.py
- Add except RuntimeError -> 503 in build_flow for startup race
- Remove redundant validation in session/service.py load_session
- Update all test assertions to use the new exception type

* Add beta flag to env var

* Use raw graph data to extract and better exc handling

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* obfuscate exceptoin details

* log error message

* ruff

* fix be test

* [autofix.ci] apply automated fixes

* fix tests

* [autofix.ci] apply automated fixes

* tests

* [autofix.ci] apply automated fixes

* enhance hash checks to allow cust components to run

* Add comment

* Add comment

* [autofix.ci] apply automated fixes

* ruff

* Update more tests

* [autofix.ci] apply automated fixes

* be tests

* be tests

* [autofix.ci] apply automated fixes

* revert changes to fe tests that were causing failures'

* comp index?

* comp index?

* comp index?

* changes FE tests to expect 5 necessary updates after prompt comp was added to checks

* update one more fe test with new error message

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>

Author: 3 people

src/backend/base/langflow/api/v1/chat.py

@@ -703,6 +703,13 @@ async def build_public_tmp(
             authenticated_user_id=authenticated_user_id,
         )
 
+        # Validate the stored flow data after the public-access boundary.
+        # Public flows never accept client-supplied data.
+        async with session_scope() as session:
+            flow = await session.get(Flow, flow_id)
+            if flow and flow.data:
+                validate_flow_for_current_settings(flow.data)
+
         # Validate the stored flow data after the public-access boundary.
         # Public flows never accept client-supplied data.
         async with session_scope() as session:

src/frontend/src/pages/FlowPage/components/PageComponent/index.tsx

@@ -33,6 +33,7 @@ import CustomLoader from "@/customization/components/custom-loader";
 import { track } from "@/customization/utils/analytics";
 import useApplyFlowToCanvas from "@/hooks/flows/use-apply-flow-to-canvas";
 import useAutoSaveFlow from "@/hooks/flows/use-autosave-flow";
+
 import { useFlowEvents } from "@/hooks/flows/use-flow-events";
 import useUploadFlow from "@/hooks/flows/use-upload-flow";
 import { useAddComponent } from "@/hooks/use-add-component";