langflow-ai
diff --git a/‎.secrets.baseline‎
Lines changed: 0 additions & 8 deletions b/‎.secrets.baseline‎
Lines changed: 0 additions & 8 deletions
diff --git a/‎src/backend/base/langflow/api/v1/deployments.py‎
Lines changed: 1 addition & 1 deletion b/‎src/backend/base/langflow/api/v1/deployments.py‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎src/backend/base/langflow/api/v1/mappers/deployments/base.py‎
Lines changed: 107 additions & 21 deletions b/‎src/backend/base/langflow/api/v1/mappers/deployments/base.py‎
Lines changed: 107 additions & 21 deletions
diff --git a/‎src/backend/base/langflow/api/v1/mappers/deployments/helpers.py‎
Lines changed: 22 additions & 19 deletions b/‎src/backend/base/langflow/api/v1/mappers/deployments/helpers.py‎
Lines changed: 22 additions & 19 deletions
@@ -2936,14 +2936,6 @@
       }
     ],
     "src/backend/tests/unit/api/v1/test_deployment_schemas.py": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/backend/tests/unit/api/v1/test_deployment_schemas.py",
-        "hashed_secret": "99091d046a81493ef2545d8c3cd8e881e8702893",
-        "is_verified": false,
-        "line_number": 49,
-        "is_secret": false
-      },
       {
         "type": "Secret Keyword",
         "filename": "src/backend/tests/unit/api/v1/test_deployment_schemas.py",
 
@@ -1400,7 +1400,7 @@ async def get_deployment_status(
 )
 async def list_deployment_flow_versions(
     deployment_id: DeploymentIdPath,
-    session: DbSessionReadOnly,
+    session: DbSession,
     current_user: CurrentActiveUser,
     page: Annotated[int, Query(ge=1)] = 1,
     size: Annotated[int, Query(ge=1, le=50)] = 20,
 
@@ -679,26 +679,105 @@ async def resolve_rollback_update(
         _ = (user_id, deployment_db_id, deployment_resource_key, db)
         return None
 
+    def shape_deployment_update_result(
+        self,
+        *,
+        rows: list[tuple[FlowVersionDeploymentAttachment, FlowVersion, str | None]],
+        snapshot_result: SnapshotListResult | None,
+        page: int,
+        size: int,
+        total: int,
+    ) -> DeploymentFlowVersionListResponse:
+        _ = snapshot_result
+        flow_versions = [
+            DeploymentFlowVersionListItem(
+                id=flow_version.id,
+                flow_id=flow_version.flow_id,
+                flow_name=flow_name,
+                version_number=flow_version.version_number,
+                attached_at=attachment.created_at,
+                provider_snapshot_id=(attachment.provider_snapshot_id or "").strip() or None,
+                provider_data=None,
+            )
+            for attachment, flow_version, flow_name in rows
+        ]
+        return DeploymentFlowVersionListResponse(
+            flow_versions=flow_versions,
+            page=page,
+            size=size,
+            total=total,
+        )
+
+    def shape_deployment_create_result(
+        self,
+        result: DeploymentCreateResult,
+        deployment_row: Deployment,
+        *,
+        provider_key: str,
+    ) -> DeploymentCreateResponse:
+        provider_data = result.provider_result if isinstance(result.provider_result, dict) else None
+        return DeploymentCreateResponse(
+            id=deployment_row.id,
+            provider_id=deployment_row.deployment_provider_account_id,
+            provider_key=provider_key,
+            name=deployment_row.name,
+            description=deployment_row.description,
+            type=deployment_row.deployment_type,
+            created_at=deployment_row.created_at,
+            updated_at=deployment_row.updated_at,
+            resource_key=deployment_row.resource_key,
+            provider_data=provider_data,
+        )
+
     def shape_deployment_update_result(
         self,
         result: DeploymentUpdateResult,
         deployment_row: Deployment,
+        *,
+        provider_key: str,
     ) -> DeploymentUpdateResponse:
         provider_data = result.provider_result if isinstance(result.provider_result, dict) else None
         return DeploymentUpdateResponse(
             id=deployment_row.id,
+            provider_id=deployment_row.deployment_provider_account_id,
+            provider_key=provider_key,
             name=deployment_row.name,
             description=deployment_row.description,
             type=deployment_row.deployment_type,
             created_at=deployment_row.created_at,
             updated_at=deployment_row.updated_at,
+            resource_key=deployment_row.resource_key,
             provider_data=provider_data,
         )
 
-    def resolve_provider_tenant_id(self, *, provider_url: str, provider_tenant_id: str | None) -> str | None:
+    def resolve_provider_tenant_id(
+        self,
+        *,
+        provider_url: str,
+        provider_data: dict[str, Any],
+    ) -> str | None:
         """Resolve provider tenant id for provider-account create/update."""
         _ = provider_url
-        return provider_tenant_id
+        return self.resolve_provider_tenant_id_from_data(provider_data=provider_data)
+
+    def resolve_provider_tenant_id_from_data(self, *, provider_data: dict[str, Any]) -> str | None:
+        """Extract optional tenant/account identifier from provider_data."""
+        raw_tenant_id = provider_data.get("tenant_id")
+        if raw_tenant_id is None:
+            return None
+        if not isinstance(raw_tenant_id, str):
+            msg = "provider_data.tenant_id must be a string when provided."
+            raise ValueError(msg)  # noqa: TRY004 - route layer maps ValueError to HTTP 4xx
+        tenant_id = raw_tenant_id.strip()
+        return tenant_id or None
+
+    def format_conflict_detail(self, raw_message: str) -> str:
+        """Format provider conflict errors for API responses.
+
+        Provider-specific mappers may override this to map provider-native
+        conflict wording to clearer end-user guidance.
+        """
+        return f"A resource with this name already exists in the provider. {raw_message}"
 
     def resolve_credential_fields(
         self,
@@ -723,24 +802,19 @@ def resolve_provider_account_update(
         """Assemble DB column-value kwargs for a provider-account update.
 
         Only fields present in ``payload.model_fields_set`` are included so
-        the CRUD layer receives a minimal diff.  Provider mappers may override
-        to add cross-field logic (e.g. re-deriving tenant from URL).
+        the CRUD layer receives a minimal diff. Provider-account update fields
+        are intentionally limited to mutable values (display name and
+        credentials).
         """
+        _ = existing_account
         update_kwargs: dict[str, Any] = {}
         if "name" in payload.model_fields_set:
             update_kwargs["name"] = payload.name
-        if "provider_url" in payload.model_fields_set:
-            update_kwargs["provider_url"] = payload.provider_url
         if "provider_data" in payload.model_fields_set:
             if payload.provider_data is None:
                 msg = "'provider_data' cannot be null when provided."
                 raise ValueError(msg)
             update_kwargs.update(self.resolve_credential_fields(provider_data=payload.provider_data))
-        if "provider_tenant_id" in payload.model_fields_set:
-            update_kwargs["provider_tenant_id"] = self.resolve_provider_tenant_id(
-                provider_url=payload.provider_url or existing_account.provider_url,
-                provider_tenant_id=payload.provider_tenant_id,
-            )
         return update_kwargs
 
     def resolve_verify_credentials(
@@ -755,7 +829,7 @@ def resolve_verify_credentials(
         provider mapper overrides.
         """
         return VerifyCredentials(
-            base_url=payload.provider_url,
+            base_url=payload.url,
         )
 
     def resolve_verify_credentials_for_update(
@@ -766,12 +840,12 @@ def resolve_verify_credentials_for_update(
     ) -> VerifyCredentials | None:
         """Build adapter verify-credentials input for provider-account updates.
 
-        Returns ``None`` when the update does not touch credentials or URL.
+        Returns ``None`` when the update does not touch credentials.
         Provider-specific mappers must override this when update-time
         verification is supported.
         """
         _ = existing_account
-        if "provider_url" not in payload.model_fields_set and "provider_data" not in payload.model_fields_set:
+        if "provider_data" not in payload.model_fields_set:
             return None
         msg = "Credential verification for provider account updates is not implemented for this provider."
         raise NotImplementedError(msg)
@@ -783,13 +857,26 @@ def shape_provider_account_response(
         return DeploymentProviderAccountGetResponse(
             id=provider_account.id,
             name=provider_account.name,
-            provider_tenant_id=provider_account.provider_tenant_id,
             provider_key=provider_account.provider_key,
-            provider_url=provider_account.provider_url,
+            url=provider_account.provider_url,
+            provider_data=self.shape_provider_account_provider_data(provider_account),
             created_at=provider_account.created_at,
             updated_at=provider_account.updated_at,
         )
 
+    def shape_provider_account_provider_data(
+        self,
+        provider_account: DeploymentProviderAccount,
+    ) -> dict[str, Any] | None:
+        """Return non-sensitive provider metadata for provider-account responses."""
+        raw_tenant_id = provider_account.provider_tenant_id
+        if raw_tenant_id is None:
+            return None
+        tenant_id = str(raw_tenant_id).strip()
+        if not tenant_id:
+            return None
+        return {"tenant_id": tenant_id}
+
     def util_create_flow_artifact_provider_data(
         self,
         *,
@@ -805,7 +892,8 @@ def util_create_flow_artifact_provider_data(
 
     def util_create_flow_version_ids(self, payload: DeploymentCreateRequest) -> list[UUID]:
         """Resolve flow-version ids referenced by create payload."""
-        return list(payload.flow_version_ids or [])
+        _ = payload
+        return []
 
     def util_existing_deployment_resource_key_for_create(
         self,
@@ -893,10 +981,8 @@ def util_flow_version_patch(self, payload: DeploymentUpdateRequest) -> FlowVersi
 
         Contract schema: ``FlowVersionPatch``.
         """
-        return FlowVersionPatch(
-            add_flow_version_ids=list(payload.add_flow_version_ids or []),
-            remove_flow_version_ids=list(payload.remove_flow_version_ids or []),
-        )
+        _ = payload
+        return FlowVersionPatch()
 
     def util_snapshot_ids_to_verify(
         self,
 
@@ -303,25 +303,6 @@ def raise_http_for_value_error(exc: ValueError) -> None:
     raise HTTPException(status_code=status_code, detail=str(exc)) from exc
 
 
-def _friendly_conflict_message(raw_message: str) -> str:
-    """Rewrite provider conflict errors into user-friendly messages."""
-    lower = raw_message.lower()
-    if "agent" in lower and ("already exists" in lower or "conflict" in lower):
-        return (
-            "An agent with this name already exists in the provider. "
-            "Please choose a different name or delete the existing agent first."
-        )
-    if "connection" in lower or "app_id" in lower:
-        return (
-            "A connection referenced in this request already exists in the provider. "
-            "Reference it as an existing connection instead of creating a new one."
-        )
-    if "tool" in lower and ("already exists" in lower or "conflict" in lower):
-        return "A tool with this name already exists in the provider. Please choose a different name."
-    # Fall back to a cleaned-up version of the raw message.
-    return f"A resource with this name already exists in the provider. {raw_message}"
-
-
 @contextmanager
 def handle_adapter_errors(*, mapper: BaseDeploymentMapper | None = None):
     """Map deployment adapter exceptions to appropriate HTTP responses.
@@ -378,6 +359,28 @@ async def flow_version_ids_for_flows(db, *, flow_ids: list[UUID], user_id: UUID)
     return list((await db.exec(stmt)).all())
 
 
+def normalize_flow_ids_query(flow_ids: list[UUID] | None) -> list[UUID]:
+    """Return a deduplicated list from an already-validated ``flow_ids`` query param.
+
+    ``FlowIdsQuery`` (Pydantic) handles UUID parsing and max-length
+    validation, so this is intentionally thin.
+    """
+    if not flow_ids:
+        return []
+    return list(dict.fromkeys(flow_ids))
+
+
+async def flow_version_ids_for_flows(db, *, flow_ids: list[UUID], user_id: UUID) -> list[UUID]:
+    """Return all flow-version IDs belonging to the given flows and user."""
+    if not flow_ids:
+        return []
+    stmt = select(FlowVersion.id).where(
+        col(FlowVersion.flow_id).in_(flow_ids),
+        FlowVersion.user_id == user_id,
+    )
+    return list((await db.exec(stmt)).all())
+
+
 async def get_owned_provider_account_or_404(
     *,
     provider_id: UUID,
Original file line number	Diff line number	Diff line change
`@@ -1400,7 +1400,7 @@ async def get_deployment_status(`
`1400`	`1400`	`)`
`1401`	`1401`	`async def list_deployment_flow_versions(`
`1402`	`1402`	`deployment_id: DeploymentIdPath,`
`1403`		`- session: DbSessionReadOnly,`
	`1403`	`+ session: DbSession,`
`1404`	`1404`	`current_user: CurrentActiveUser,`
`1405`	`1405`	`page: Annotated[int, Query(ge=1)] = 1,`
`1406`	`1406`	`size: Annotated[int, Query(ge=1, le=50)] = 20,`