Merge branch 'main' into docs-workflow-api

Author: mendonk

.secrets.baseline

@@ -871,6 +871,56 @@
         "is_secret": false
       }
     ],
+    "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "54ed260e3bc31bc77ee06754dff850981d39a66c",
+        "is_verified": false,
+        "line_number": 357,
+        "is_secret": false
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "35be14614e83fe56d9b2ca1c0e2c2a74890b6889",
+        "is_verified": false,
+        "line_number": 625,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
+        "is_verified": false,
+        "line_number": 1400,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "3f2df46921dd8e2c36e2ce85238705ac0774c74a",
+        "is_verified": false,
+        "line_number": 1535,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "d3d6fe3f7d33d0f4aa28c49544a865982a48a00a",
+        "is_verified": false,
+        "line_number": 1595,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
+        "hashed_secret": "d4c3d66fd0c38547a3c7a4c6bdc29c36911bc030",
+        "is_verified": false,
+        "line_number": 1660,
+        "is_secret": false
+      }
+    ],
     "src/backend/base/langflow/inputs/input_mixin.py": [
       {
         "type": "Secret Keyword",

src/backend/base/langflow/api/v1/login.py

@@ -138,9 +138,9 @@ async def auto_login(response: Response, db: DbSession):
         return tokens
 
     raise HTTPException(
-        status_code=status.HTTP_400_BAD_REQUEST,
+        status_code=status.HTTP_403_FORBIDDEN,
         detail={
-            "message": "Auto login is disabled. Please enable it in the settings",
+            "message": "Auto login is disabled.",
             "auto_login": False,
         },
     )

src/backend/base/langflow/api/v1/models.py

@@ -199,8 +199,9 @@ async def get_enabled_providers(
 ):
     """Get enabled providers for the current user.
 
-    Only providers with valid API keys are marked as enabled. This prevents
-    providers from appearing enabled when they have invalid credentials.
+    Providers are considered enabled if they have a credential variable stored.
+    API key validation is performed when credentials are saved, not on every read,
+    to avoid latency from external API calls.
     """
     variable_service = get_variable_service()
     try:
@@ -225,35 +226,12 @@ async def get_enabled_providers(
         # Get the provider-variable mapping
         provider_variable_map = get_model_provider_variable_mapping()
 
-        # Build credential_variables dict with objects that have encrypted values
-        # VariableRead sets value=None for CREDENTIAL_TYPE (via validator), but _validate_and_get_enabled_providers
-        # needs the encrypted value to decrypt and validate. So we create simple objects with the encrypted value.
-        credential_variables = {}
-
-        for var_name in credential_variable_names:
-            if var_name and var_name in provider_variable_map.values():
-                try:
-                    # Get the raw Variable object to access the encrypted value
-                    variable_obj = await variable_service.get_variable_object(
-                        user_id=current_user.id, name=var_name, session=session
-                    )
-                    if variable_obj and variable_obj.value:
-                        # Create a simple object with the encrypted value
-                        # _validate_and_get_enabled_providers only needs .value attribute
-                        class VarWithValue:
-                            def __init__(self, value):
-                                self.value = value
-
-                        credential_variables[var_name] = VarWithValue(variable_obj.value)
-                except (ValueError, Exception) as e:  # noqa: BLE001
-                    # Variable not found or error accessing it - skip
-                    logger.debug("Skipping variable %s due to error: %s", var_name, e)
-                    continue
-
-        # Use shared helper to validate and get enabled providers
-        from lfx.base.models.unified_models import _validate_and_get_enabled_providers
-
-        enabled_providers_set = _validate_and_get_enabled_providers(credential_variables, provider_variable_map)
+        # Check which providers have credentials stored (no validation - that happens on save)
+        enabled_providers_set = set()
+        for provider, var_name in provider_variable_map.items():
+            if var_name in credential_variable_names:
+                enabled_providers_set.add(provider)
+
         enabled_providers = list(enabled_providers_set)
 
         # Build provider_status dict for all providers

src/backend/base/langflow/api/v1/users.py

@@ -26,16 +26,18 @@
 async def add_user(
     user: UserCreate,
     session: DbSession,
-    current_user: Annotated[User, Depends(get_current_active_superuser)],  # noqa: ARG001
 ) -> User:
     """Add a new user to the database.
 
-    Requires superuser authentication to prevent unauthorized account creation.
+    This endpoint allows public user registration (sign up).
+    User activation is controlled by the NEW_USER_IS_ACTIVE setting.
     """
+    settings_service = get_settings_service()
+
     new_user = User.model_validate(user, from_attributes=True)
     try:
         new_user.password = get_password_hash(user.password)
-        new_user.is_active = get_settings_service().auth_settings.NEW_USER_IS_ACTIVE
+        new_user.is_active = settings_service.auth_settings.NEW_USER_IS_ACTIVE
         session.add(new_user)
         await session.flush()
         await session.refresh(new_user)

src/backend/base/langflow/api/v1/variable.py

@@ -14,7 +14,6 @@
     get_model_names_for_provider,
     get_provider_from_variable_name,
 )
-from langflow.services.auth import utils as auth_utils
 from langflow.services.database.models.variable.model import VariableCreate, VariableRead, VariableUpdate
 from langflow.services.deps import get_variable_service
 from langflow.services.variable.constants import CREDENTIAL_TYPE, GENERIC_TYPE
@@ -151,15 +150,10 @@ async def read_variables(
 ):
     """Read all variables.
 
-    Model provider credentials are validated when reading from the database.
-    If a provider key is invalid, its default_fields are cleared to prevent
-    the provider from appearing enabled.
+    Model provider credentials are validated when they are created or updated,
+    not on every read. This avoids latency from external API calls on read operations.
 
-    Each variable in the response includes:
-    - is_valid: bool | None - True if valid, False if invalid, None if not a provider credential
-    - validation_error: str | None - Error message if validation failed
-
-    Returns a list of variables with validation status for model provider credentials.
+    Returns a list of variables.
     """
     variable_service = get_variable_service()
     if not isinstance(variable_service, DatabaseVariableService):
@@ -173,113 +167,18 @@ async def read_variables(
             var for var in all_variables if not (var.name and var.name.startswith("__") and var.name.endswith("__"))
         ]
 
-        # Validate model provider credentials and clear default_fields if invalid
-        # Build dict of credential variables for validation
-        credential_variables = {var.name: var for var in filtered_variables if var.type == CREDENTIAL_TYPE}
-        provider_variable_map = get_model_provider_variable_mapping()
-
-        # Create reverse mapping: variable_name -> provider
-        var_to_provider = {var_name: provider for provider, var_name in provider_variable_map.items()}
-
-        # Validate each provider credential once and capture both enabled status and error messages
-        validation_results: dict[
-            str, tuple[bool, str | None, list[str] | None]
-        ] = {}  # var_name -> (is_valid, error, default_fields)
-
-        for var_name in provider_variable_map.values():
-            if var_name in credential_variables:
-                is_valid = False
-                error_message = None
-                variable_obj = None
-
-                try:
-                    # Get the raw Variable object to access the encrypted value
-                    variable_obj = await variable_service.get_variable_object(
-                        user_id=current_user.id, name=var_name, session=session
-                    )
-                    if variable_obj and variable_obj.value:
-                        # Decrypt the API key value
-                        from langflow.services.deps import get_settings_service
-
-                        settings_service = get_settings_service()
-                        decrypted_value = auth_utils.decrypt_api_key(
-                            variable_obj.value, settings_service=settings_service
-                        )
-                        if decrypted_value and decrypted_value.strip():
-                            # Validate the key (this will raise ValueError if invalid)
-                            await asyncio.to_thread(validate_model_provider_key, var_name, decrypted_value)
-                            # Validation passed
-                            is_valid = True
-                            error_message = None
-                        else:
-                            error_message = "API key is empty"
-                    else:
-                        error_message = "Variable value is empty"
-                except ValueError as e:
-                    # Validation failed - get the error message
-                    error_message = str(e)
-                except Exception as e:  # noqa: BLE001
-                    error_message = f"Validation error: {e!s}"
-
-                # Update default_fields based on validation result
-                updated_default_fields = None
-                if variable_obj and variable_obj.id:
-                    try:
-                        if is_valid:
-                            # Key is valid - ensure default_fields are set (important for migration)
-                            provider_name = var_to_provider.get(var_name)
-                            expected_default_fields = [provider_name, "api_key"] if provider_name else []
-                            if variable_obj.default_fields != expected_default_fields:
-                                await variable_service.update_variable_fields(
-                                    user_id=current_user.id,
-                                    variable_id=variable_obj.id,
-                                    variable=VariableUpdate(
-                                        id=variable_obj.id,
-                                        default_fields=expected_default_fields,
-                                    ),
-                                    session=session,
-                                )
-                            updated_default_fields = expected_default_fields
-                        else:
-                            # Key is invalid - clear default_fields
-                            if variable_obj.default_fields:
-                                await variable_service.update_variable_fields(
-                                    user_id=current_user.id,
-                                    variable_id=variable_obj.id,
-                                    variable=VariableUpdate(
-                                        id=variable_obj.id,
-                                        default_fields=[],
-                                    ),
-                                    session=session,
-                                )
-                            updated_default_fields = []
-                    except Exception:  # noqa: BLE001
-                        # Log but don't fail if we can't update
-                        # Use current default_fields if update failed
-                        updated_default_fields = variable_obj.default_fields if variable_obj else None
-
-                validation_results[var_name] = (is_valid, error_message, updated_default_fields)
-
-        # Set validation status on each variable and update default_fields in response
+        # Mark model provider credentials - validation status is based on existence
+        # (actual validation happens on create/update)
         for var in filtered_variables:
             if var.name and var.name in model_provider_variable_mapping.values() and var.type == CREDENTIAL_TYPE:
-                result = validation_results.get(var.name)
-                if result:
-                    is_valid, error_message, updated_default_fields = result
-                    var.is_valid = is_valid
-                    var.validation_error = error_message
-                    # Update default_fields in response to reflect what we set in database
-                    # This is important for migration - valid keys will have default_fields set
-                    if updated_default_fields is not None:
-                        var.default_fields = updated_default_fields
-                else:
-                    # Variable not found in validation results
-                    var.is_valid = False
-                    var.validation_error = "Variable not found"
+                # Credential exists and was validated on save
+                var.is_valid = True
+                var.validation_error = None
             else:
-                # Not a model provider credential, validation fields remain None
+                # Not a model provider credential
                 var.is_valid = None
                 var.validation_error = None
+
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e)) from e
     else: