Merge branch 'feat/a11y' into a11y/auth-regression-coverage

Author: viktoravelino

.github/workflows/lint-js.yml

@@ -90,12 +90,16 @@ jobs:
           RELATIVE_FILES=$(echo "$CHANGED_FILES" | sed 's|^src/frontend/||')
 
           cd src/frontend
+          # NUL-delimit so paths containing spaces (e.g. starter-project
+          # specs like "Basic Prompting.spec.ts") aren't split by xargs.
           if ${{ inputs.allow-failure || 'false' }}; then
-            echo "$RELATIVE_FILES" | xargs npx @biomejs/biome check \
-              --files-ignore-unknown=true \
-              --diagnostic-level=error || echo "Biome found errors (non-blocking for this run)."
+            printf '%s\n' "$RELATIVE_FILES" | tr '\n' '\0' \
+              | xargs -0 npx @biomejs/biome check \
+                --files-ignore-unknown=true \
+                --diagnostic-level=error || echo "Biome found errors (non-blocking for this run)."
           else
-            echo "$RELATIVE_FILES" | xargs npx @biomejs/biome check \
-              --files-ignore-unknown=true \
-              --diagnostic-level=error
+            printf '%s\n' "$RELATIVE_FILES" | tr '\n' '\0' \
+              | xargs -0 npx @biomejs/biome check \
+                --files-ignore-unknown=true \
+                --diagnostic-level=error
           fi

.secrets.baseline

@@ -2817,7 +2817,7 @@
         "filename": "src/backend/base/langflow/services/auth/utils.py",
         "hashed_secret": "b894b81be94cf8fa8d7536475aaec876addf05c8",
         "is_verified": false,
-        "line_number": 59,
+        "line_number": 75,
         "is_secret": false
       }
     ],
@@ -2827,7 +2827,7 @@
         "filename": "src/backend/base/langflow/services/database/models/api_key/crud.py",
         "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
         "is_verified": false,
-        "line_number": 112,
+        "line_number": 134,
         "is_secret": false
       }
     ],
@@ -4007,15 +4007,15 @@
         "filename": "src/backend/tests/unit/test_login.py",
         "hashed_secret": "8bb6118f8fd6935ad0876a3be34a717d32708ffd",
         "is_verified": false,
-        "line_number": 26,
+        "line_number": 97,
         "is_secret": false
       },
       {
         "type": "Secret Keyword",
         "filename": "src/backend/tests/unit/test_login.py",
         "hashed_secret": "d8ecf7db8fc9ec9c31bc5c9ae2929cc599c75f8d",
         "is_verified": false,
-        "line_number": 42,
+        "line_number": 113,
         "is_secret": false
       }
     ],
@@ -9287,5 +9287,5 @@
       }
     ]
   },
-  "generated_at": "2026-06-10T18:13:35Z"
+  "generated_at": "2026-06-17T19:13:55Z"
 }

src/backend/base/langflow/api/v1/api_key.py

@@ -36,6 +36,8 @@ async def create_api_key_route(
     try:
         user_id = current_user.id
         return await create_api_key(db, req, user_id=user_id)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     except Exception as e:
         raise HTTPException(status_code=400, detail=str(e)) from e
 

src/backend/base/langflow/api/v1/authz_me.py

@@ -17,6 +17,8 @@
 from pydantic import BaseModel, Field, field_validator
 
 from langflow.api.utils import CurrentActiveUser
+from langflow.services.auth.context import current_auth_context_for_authz
+from langflow.services.authorization.access_ceiling import filter_actions_by_external_access_ceiling
 from langflow.services.deps import get_authorization_service
 
 router = APIRouter(prefix="/authz/me", tags=["Authorization"])
@@ -127,8 +129,15 @@ async def get_effective_permissions(
         resource_ids=body.resource_ids,
         actions=actions,
         domain=body.domain,
-        context={"is_superuser": getattr(current_user, "is_superuser", False)},
+        context={
+            **current_auth_context_for_authz(),
+            "is_superuser": current_user.is_superuser,
+        },
     )
+    permissions = {
+        resource_id: filter_actions_by_external_access_ceiling(allowed_actions)
+        for resource_id, allowed_actions in permissions.items()
+    }
     return EffectivePermissionsResponse(
         resource_type=body.resource_type,
         permissions=permissions,

src/backend/base/langflow/api/v1/chat.py

@@ -887,9 +887,26 @@ async def build_public_tmp(
             queue_service=queue_service,
             flow_name=flow_name or f"{authenticated_user_id or client_id}_{flow_id}",
         )
+        # Gate the public events/cancel endpoints to jobs that were actually
+        # started through this public build path, preventing unauthenticated
+        # callers from reading or cancelling private-flow builds by job_id.
+        await queue_service.register_public_job(job_id)
     except CustomComponentValidationError as exc:
         await logger.awarning(f"Public flow validation failed: {exc}")
         raise HTTPException(status_code=400, detail="This flow cannot be executed.") from exc
+    except JobQueueBackendUnavailableError as exc:
+        # The public marker could not be persisted to the shared (Redis) backend.
+        # Returning the job_id anyway would hand back an un-shareable id: on a
+        # multi-worker deployment every other worker's public events/cancel
+        # endpoints would 404 it. Cancel the just-started build (best-effort) and
+        # surface a clean 503 instead of a 500 / an unusable job_id.
+        try:
+            await queue_service.cancel_job(job_id)
+        except Exception as cancel_exc:  # noqa: BLE001
+            await logger.awarning(
+                f"Failed to cancel public job {job_id} after marker persistence failed: {cancel_exc!r}"
+            )
+        raise HTTPException(status_code=503, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
     except Exception as exc:
@@ -906,6 +923,20 @@ async def build_public_tmp(
     )
 
 
+async def _assert_public_job(job_id: str, queue_service: JobQueueService) -> None:
+    """Raise HTTP 404 if job_id was not registered through the public build endpoint.
+
+    Prevents unauthenticated callers from reading or cancelling private-flow
+    builds by guessing or leaking a job_id.
+
+    Why 404 not 403: returning 403 would confirm the job exists under a different
+    access tier, leaking information about private builds. 404 is neutral.
+    """
+    if not await queue_service.is_public_job_async(job_id):
+        # Static detail — do not reflect job_id back; avoid confirming which IDs exist.
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Job not found")
+
+
 @router.get("/build_public_tmp/{job_id}/events")
 async def get_build_events_public(
     job_id: str,
@@ -918,6 +949,7 @@ async def get_build_events_public(
     This endpoint does not require authentication, matching the public build endpoint.
     It is used by the shareable playground to consume build events.
     """
+    await _assert_public_job(job_id, queue_service)
     return await get_flow_events_response(
         job_id=job_id,
         queue_service=queue_service,
@@ -938,6 +970,7 @@ async def cancel_build_public(
     This endpoint does not require authentication, matching the public build endpoint.
     It is used by the shareable playground to cancel builds.
     """
+    await _assert_public_job(job_id, queue_service)
     try:
         cancellation_success = await cancel_flow_build(job_id=job_id, queue_service=queue_service)
 

src/backend/base/langflow/api/v1/endpoints.py

@@ -61,6 +61,10 @@
     get_optional_user,
 )
 from langflow.services.authorization import FlowAction, ensure_flow_permission
+from langflow.services.authorization.access_ceiling import (
+    external_access_allows,
+    get_current_external_access_context,
+)
 from langflow.services.cache.utils import save_uploaded_file
 from langflow.services.database.models.flow.model import Flow, FlowRead
 from langflow.services.database.models.flow.utils import get_all_webhook_components_in_flow
@@ -1226,6 +1230,7 @@ async def get_task_status(_task_id: str) -> TaskStatusResponse:
 async def create_upload_file(
     file: UploadFile,
     flow: Annotated[Flow, Depends(get_flow)],
+    current_user: CurrentActiveUser,
     settings_service: Annotated[SettingsService, Depends(get_settings_service)],
 ) -> UploadFileResponse:
     """Upload a file for a specific flow (Deprecated).
@@ -1237,6 +1242,17 @@ async def create_upload_file(
     ``/api/v1/files/upload/{flow_id}`` so authenticated callers can't fill
     disk through this route either.
     """
+    # Writing a file to a flow's storage is a flow mutation: enforce WRITE so
+    # the external access ceiling (e.g. a "viewer") cannot upload via this
+    # deprecated route. Mirrors the non-deprecated twin in files.py.
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.WRITE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
     try:
         max_file_size_upload = settings_service.settings.max_file_size_upload
     except Exception as exc:
@@ -1273,6 +1289,19 @@ async def custom_component(
     user: CurrentActiveUser,
     request: Request,
 ) -> CustomComponentResponse:
+    # Building a custom component instantiates (and partially executes) posted
+    # code. That is a create/write-class action, so enforce the external access
+    # ceiling directly: a "viewer" external identity is denied while
+    # editor/admin (and all non-external users) pass unchanged. This route is
+    # not tied to a single owned resource, so the deny-only primitive is used
+    # instead of an ``ensure_*_permission`` guard.
+    external_context = get_current_external_access_context()
+    if external_context is not None and not external_access_allows("create", external_context):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="External credentials do not allow this action",
+        )
+
     settings_service = get_settings_service()
     settings = settings_service.settings
     all_known = None
@@ -1348,6 +1377,17 @@ async def custom_component_update(
         HTTPException: If an error occurs during component building or updating.
         SerializationError: If serialization of the updated component node fails.
     """
+    # Updating a custom component instantiates (and partially executes) posted
+    # code, a create/write-class action. Enforce the external access ceiling
+    # directly so a "viewer" external identity is denied; editor/admin (and all
+    # non-external users) pass unchanged. Same action string as ``custom_component``.
+    external_context = get_current_external_access_context()
+    if external_context is not None and not external_access_allows("create", external_context):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="External credentials do not allow this action",
+        )
+
     settings_service = get_settings_service()
     all_known = None
     if _requires_component_hash_lookups(settings_service.settings, user):

src/backend/base/langflow/api/v1/files.py

@@ -21,6 +21,7 @@
     build_content_disposition,
 )
 from langflow.api.v1.schemas import UploadFileResponse
+from langflow.services.authorization import FlowAction, ensure_flow_permission
 from langflow.services.database.models.flow.model import Flow
 from langflow.services.deps import get_settings_service, get_storage_service
 from langflow.services.storage.service import StorageService
@@ -84,9 +85,20 @@ async def upload_file(
     *,
     file: UploadFile,
     flow: Annotated[Flow, Depends(get_flow)],
+    current_user: CurrentActiveUser,
     storage_service: Annotated[StorageService, Depends(get_storage_service)],
     settings_service: Annotated[SettingsService, Depends(get_settings_service)],
 ) -> UploadFileResponse:
+    # Writing a file to a flow's storage is a flow mutation: enforce WRITE so
+    # the external access ceiling (e.g. a "viewer") cannot upload via this route.
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.WRITE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
     try:
         max_file_size_upload = settings_service.settings.max_file_size_upload
     except Exception as e:
@@ -290,8 +302,19 @@ async def list_files(
 async def delete_file(
     file_name: ValidatedFileName,
     flow: Annotated[Flow, Depends(get_flow)],
+    current_user: CurrentActiveUser,
     storage_service: Annotated[StorageService, Depends(get_storage_service)],
 ):
+    # Deleting a file from a flow's storage mutates the flow's attachments;
+    # enforce WRITE so the external access ceiling (e.g. a "viewer") is honored.
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.WRITE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
     try:
         await storage_service.delete_file(flow_id=str(flow.id), file_name=file_name)
     except Exception as e:

src/backend/base/langflow/api/v1/flow_version.py

@@ -14,6 +14,7 @@
 from langflow.api.utils.core import remove_api_keys
 from langflow.api.v1.mappers.deployments.helpers import get_owned_provider_account_or_404
 from langflow.api.v1.mappers.deployments.sync import sync_flow_version_attachments
+from langflow.services.authorization import FlowAction, ensure_flow_permission
 from langflow.services.database.models.flow.model import Flow, FlowRead
 from langflow.services.database.models.flow_version.crud import (
     create_flow_version_entry,
@@ -201,6 +202,14 @@ async def create_snapshot(
     body: FlowVersionCreate | None = None,
 ) -> FlowVersionRead:
     flow = await _get_user_flow(session, flow_id, current_user.id)
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.WRITE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
     description = body.description if body else None
 
     try:
@@ -234,6 +243,14 @@ async def activate_version(
     save_draft: Annotated[bool, Query()] = True,
 ) -> FlowRead:
     flow = await _get_user_flow(session, flow_id, current_user.id)
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.WRITE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
 
     # Verify version entry belongs to this flow
     try:
@@ -299,7 +316,15 @@ async def delete_version_entry(
     current_user: CurrentActiveUser,
     session: DbSession,
 ) -> None:
-    await _get_user_flow(session, flow_id, current_user.id)
+    flow = await _get_user_flow(session, flow_id, current_user.id)
+    await ensure_flow_permission(
+        current_user,
+        FlowAction.DELETE,
+        flow_id=flow.id,
+        flow_user_id=flow.user_id,
+        workspace_id=flow.workspace_id,
+        folder_id=flow.folder_id,
+    )
 
     # Verify entry belongs to this flow, then delete
     try:

src/backend/base/langflow/api/v1/login.py

@@ -12,6 +12,7 @@
 from langflow.api.utils import DbSession
 from langflow.api.v1.schemas import Token
 from langflow.initial_setup.setup import get_or_create_default_folder
+from langflow.services.auth.exceptions import AuthenticationError
 from langflow.services.database.models.user.crud import get_user_by_id
 from langflow.services.database.models.user.model import UserRead
 from langflow.services.deps import get_auth_service, get_settings_service, get_variable_service
@@ -235,24 +236,30 @@ async def get_session(
     It does not raise an error if unauthenticated, allowing the frontend to gracefully
     handle the session state.
     """
-    from langflow.services.auth.utils import oauth2_login
+    from langflow.services.auth.utils import _get_external_token, oauth2_login
 
     # Try to get the token from the request (cookie or Authorization header)
     try:
         token = await oauth2_login(request)
-        if not token:
+        # Extract the external credential separately so a present-but-invalid
+        # native cookie can't shadow a valid external one (mirrors get_current_user
+        # and the WS/SSE paths). oauth2_login may already have collapsed to the
+        # external credential, in which case the service's dedup guard makes the
+        # fallback a no-op.
+        external_token = _get_external_token(request.headers, request.cookies)
+        if not token and not external_token:
             return SessionResponse(authenticated=False)
 
         # Validate the token and get user
-        user = await get_auth_service().get_current_user_from_access_token(token, db)
+        user = await get_auth_service().get_current_user_from_access_token(token, db, external_token=external_token)
         if not user or not user.is_active:
             return SessionResponse(authenticated=False)
 
         return SessionResponse(
             authenticated=True,
             user=UserRead.model_validate(user, from_attributes=True),
         )
-    except (HTTPException, ValueError) as _:
+    except (AuthenticationError, HTTPException, ValueError) as _:
         # Any authentication error means not authenticated
         return SessionResponse(authenticated=False)