fix: allow no-op updates to locked flows

Author: erichare

src/backend/base/langflow/services/database/models/flow/guards.py

@@ -30,19 +30,19 @@ def ensure_flow_unlocked(flow: Flow) -> None:
 
 
 def ensure_flow_update_allowed(flow: Flow, update_data: Mapping[str, Any]) -> None:
-    """Allow updates to unlocked flows and unlock-only updates to locked flows.
+    """Allow updates to unlocked flows and safe updates to locked flows.
 
     API clients commonly send the full current flow when toggling the lock. We
-    therefore compare payload values with the persisted row and allow the
-    request when ``locked=False`` is the only effective change.
+    therefore compare payload values with the persisted row and allow no-op
+    requests or requests where ``locked=False`` is the only effective change.
     """
     if getattr(flow, "locked", False) is not True:
         return
 
     changed_fields = {
         field_name for field_name, new_value in update_data.items() if getattr(flow, field_name, None) != new_value
     }
-    if changed_fields == {"locked"} and update_data.get("locked") is False:
+    if not changed_fields or (changed_fields == {"locked"} and update_data.get("locked") is False):
         return
 
     raise LockedFlowError(LOCKED_FLOW_DETAIL)

src/backend/tests/unit/api/v1/test_flows.py

@@ -218,6 +218,23 @@ async def test_locked_flow_rejects_api_updates_until_unlocked(client: AsyncClien
     created = create_response.json()
     flow_id = created["id"]
 
+    # Navigation can submit the full current flow even when nothing changed.
+    # A no-op save must succeed so the UI can leave a locked flow cleanly.
+    no_op_response = await client.patch(
+        f"api/v1/flows/{flow_id}",
+        json={
+            "name": created["name"],
+            "description": created["description"],
+            "data": created["data"],
+            "folder_id": created["folder_id"],
+            "endpoint_name": created["endpoint_name"],
+            "locked": True,
+        },
+        headers=logged_in_headers,
+    )
+    assert no_op_response.status_code == status.HTTP_200_OK
+    assert no_op_response.json()["locked"] is True
+
     patch_response = await client.patch(
         f"api/v1/flows/{flow_id}",
         json={"description": "changed via PATCH"},