fix: handle invalid session auth tokens (#13863)

* fix: handle invalid session auth tokens (#13823)

* fix: handle invalid session auth tokens

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
(cherry picked from commit cf5c37f)

* test: cover telemetry writer session warning (#13821)

Adapt the warning regression from #13821 for release-1.11.0, which already
uses SQLAlchemy AsyncSession via #13845.

(cherry picked from commit f5dd643)

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: erichare

.secrets.baseline

@@ -4882,15 +4882,15 @@
         "filename": "src/backend/tests/unit/test_login.py",
         "hashed_secret": "8bb6118f8fd6935ad0876a3be34a717d32708ffd",
         "is_verified": false,
-        "line_number": 97,
+        "line_number": 99,
         "is_secret": false
       },
       {
         "type": "Secret Keyword",
         "filename": "src/backend/tests/unit/test_login.py",
         "hashed_secret": "d8ecf7db8fc9ec9c31bc5c9ae2929cc599c75f8d",
         "is_verified": false,
-        "line_number": 113,
+        "line_number": 115,
         "is_secret": false
       }
     ],

src/backend/tests/unit/services/telemetry_writer/test_service.py

@@ -12,6 +12,7 @@
 import asyncio
 import shutil
 import tempfile
+import warnings
 from pathlib import Path
 from uuid import uuid4
 
@@ -342,6 +343,21 @@ async def test_flush_inserts_transactions_and_vertex_builds(writer_with_engine)
     assert str(flow_id) in writer._dirty_vb_flows
 
 
+async def test_flush_and_retention_do_not_emit_deprecated_session_execute_warning(writer_with_engine) -> None:
+    writer, _ = writer_with_engine
+    writer.settings_service.settings.max_transactions_to_keep = 1
+    writer.settings_service.settings.max_vertex_builds_to_keep = 1
+    flow_id = uuid4()
+
+    tx_batch = [_make_transaction_row(flow_id) for _ in range(3)]
+    vb_batch = [_make_vertex_build_row(flow_id, vertex_id="v1") for _ in range(3)]
+
+    with warnings.catch_warnings():
+        warnings.filterwarnings("error", message="(?s).*session\\.exec\\(\\).*", category=DeprecationWarning)
+        await writer._flush(tx_batch, vb_batch)
+        await writer._run_retention_pass()
+
+
 async def test_retention_sweep_caps_transactions_per_flow(writer_with_engine) -> None:
     writer, engine = writer_with_engine
     writer.settings_service.settings.max_transactions_to_keep = 3

src/backend/tests/unit/test_login.py

@@ -1,7 +1,9 @@
 from datetime import datetime, timedelta, timezone
+from unittest.mock import AsyncMock, patch
 
 import jwt
 import pytest
+from langflow.services.auth.exceptions import InvalidTokenError
 from langflow.services.database.models.auth import SSOUserProfile
 from langflow.services.database.models.user import User
 from langflow.services.deps import get_auth_service, get_settings_service, session_scope
@@ -125,6 +127,21 @@ async def test_session_endpoint_unauthenticated(client):
     assert data["store_api_key"] is None
 
 
+async def test_session_endpoint_invalid_token_returns_unauthenticated(client):
+    """Test /session endpoint handles invalid tokens as unauthenticated sessions."""
+    auth_service = AsyncMock()
+    auth_service.get_current_user_from_access_token.side_effect = InvalidTokenError("Invalid token")
+
+    with patch("langflow.api.v1.login.get_auth_service", return_value=auth_service):
+        response = await client.get("api/v1/session", headers={"Authorization": "Bearer invalid-token"})
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["authenticated"] is False
+    assert data["user"] is None
+    assert data["store_api_key"] is None
+
+
 async def test_session_endpoint_authenticated(client, logged_in_headers):
     """Test /session endpoint returns user info for authenticated requests."""
     response = await client.get("api/v1/session", headers=logged_in_headers)