fix: limit public flow endpoint from displaying private flow streams

[Jkavia]

Summary

• Fixes unauthenticated access to private-flow job streams via the
  build_public_tmp endpoints. GET /build_public_tmp/{job_id}/events and
  POST /build_public_tmp/{job_id}/cancel previously accepted any
  job_id without verifying it belonged to a public build — an attacker
  with a known or guessed job_id could read another user's live event
  stream (LLM output, API keys, internal data) or cancel an in-flight
  private build.
• Adds a public job registry: register_public_job(job_id) is called
  immediately after a job is started via build_public_tmp. Both public
  endpoints now call _assert_public_job(job_id, queue_service) first,
  which returns HTTP 404 "Job not found" (not 403, to avoid confirming
  the job exists under a different access tier) if the job was never
  registered as public.
• JobQueueService gets register_public_job / is_public_job (sync) /
  is_public_job_async (async, uniform interface for route handlers).
  RedisJobQueueService overrides register_public_job to also persist
  langflow:public_job:{job_id} to Redis, and is_public_job_async checks
  local memory first then falls back to Redis for cross-worker correctness.
  cleanup_job discards the registration (and deletes the Redis key) so
  finished jobs can't be queried after eviction.

Security

• Vulnerability: unauthenticated read access to private build event
  streams + unauthenticated denial-of-service via build cancellation.
• Fix: allow-list of job_ids registered through the public build path,
  enforced before any event/cancel handling on both unauthenticated routes.
• Manually verified via curl: a private (authenticated) job's job_id
  hits the public events endpoint and gets {"detail":"Job not found"}.

Test plan

• test_job_queue_service_register_and_check_public_job
• test_job_queue_service_unregistered_job_not_public
• test_job_queue_service_is_public_job_async_base
• test_job_queue_service_cleanup_removes_public_registration
• test_private_job_id_blocked_on_public_events_endpoint — adversarial,
  proves a private job_id is rejected (404) on the public events route
• test_private_job_id_blocked_on_public_cancel_endpoint — adversarial,
  proves a private job_id is rejected (404) on the public cancel route
• test_redis_public_job_cross_worker_fallback — Worker B with empty
  local memory falls back to Redis to confirm a job registered by Worker A
• test_redis_cleanup_removes_public_job_key — Redis public_job key is
  deleted on cleanup
• make format_backend + uv run ruff check clean on all changed files
• All 8 new/updated tests pass (uv run pytest ... — 0 failures)

Test with public Job Id

Test with private Job Id

Summary by CodeRabbit

• Bug Fixes

  • Enhanced security for public build endpoints to prevent unauthorized access to private builds via job ID guessing.
  • Public endpoints now return HTTP 404 when accessed with unregistered job IDs.

• Tests

  • Added security regression tests verifying private builds remain inaccessible through public endpoints.
  • Added tests for public job tracking and cross-worker validation.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40ffa4c9-9115-40e1-af52-a4f31855cf58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR secures unauthenticated build endpoints by implementing a public-job registry that tracks which jobs were created via the public API. Jobs are marked public only when built through the public endpoint, and both event streaming and cancellation are guarded to reject requests for private jobs with HTTP 404.

Changes

Public Build Job Access Control

Layer / File(s)	Summary
Public-job tracking service infrastructure src/backend/base/langflow/services/job_queue/service.py	Adds in-memory _public_jobs set and Redis key management to JobQueueService. Base class provides register_public_job, is_public_job, and is_public_job_async with synchronous set lookup. RedisJobQueueService overrides public-job methods to persist markers with TTL and fallback to Redis EXISTS for cross-worker consistency. Cleanup removes public registrations from both memory and Redis.
Public endpoint access control with job verification src/backend/base/langflow/api/v1/chat.py	Introduces _assert_public_job guard that rejects requests for unregistered job IDs with HTTP 404. build_public_tmp registers jobs as public after creation. Both get_build_events_public and cancel_build_public call the guard before proceeding.
Unit tests for public-job registration semantics src/backend/tests/unit/test_chat_endpoint.py (lines 1322–1381)	Tests JobQueueService public-job API: register/query behavior, unregistered jobs returning false, sync/async consistency, and cleanup removing public state.
Security regression tests for endpoint access control src/backend/tests/unit/test_chat_endpoint.py (lines 1382–1446)	Verifies private build jobs cannot be accessed via unauthenticated public endpoints (build_public_tmp/{job_id}/events and build_public_tmp/{job_id}/cancel), both returning HTTP 404.
Redis cross-worker public-job verification tests src/backend/tests/unit/test_redis_job_queue_service.py	Tests Redis-backed public-job semantics across simulated workers: in-memory fallback to Redis for correctness, and cleanup removing Redis public-job markers.

Sequence Diagram

sequenceDiagram
    participant Client
    participant build_public_tmp
    participant get_build_events_public
    participant _assert_public_job
    participant queue_service
    Client->>build_public_tmp: POST build request
    build_public_tmp->>queue_service: register_public_job(job_id)
    Client->>get_build_events_public: GET events for job_id
    get_build_events_public->>_assert_public_job: verify job_id
    _assert_public_job->>queue_service: is_public_job_async(job_id)
    alt Job is public
        queue_service-->>_assert_public_job: True
        _assert_public_job-->>get_build_events_public: OK
        get_build_events_public-->>Client: Build events
    else Job not public
        queue_service-->>_assert_public_job: False
        _assert_public_job-->>get_build_events_public: HTTPException 404
        get_build_events_public-->>Client: Job not found
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

bug, lgtm

Suggested reviewers

• ogabrielluiz
• Adam-Aghili

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Quality And Coverage	⚠️ Warning	Security tests lack client.cookies.clear() before public endpoint calls, so they don't validate true unauthenticated scenarios; missing test for successful public build access.	Add client.cookies.clear() in both security tests before public endpoint calls; add test validating public build successfully accesses public endpoints.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main security fix: preventing public flow endpoints from accessing private flow job streams through an unauthenticated path.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	PR includes 8 new tests covering JobQueueService methods, security regression tests, and cross-worker behavior. Tests follow naming conventions and invoke actual implementations, not placeholders.
Test File Naming And Structure	✅ Passed	All test files follow correct structure: test_*.py naming, pytest in unit tests, descriptive names, docstrings, fixtures, positive/negative scenarios, edge cases, and proper setup/teardown.
Excessive Mock Usage Warning	✅ Passed	New tests avoid excessive mocking. Unit tests use real service objects; integration tests use real client fixtures. FakeRedis (test double) enables cross-worker testing without mocks.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/tmp-build-missing-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (2)

src/backend/tests/unit/test_chat_endpoint.py (1)

1371-1376: ⚡ Quick win

Avoid binding test behavior to private _queues tuple internals

Line 1375 manually writes svc._queues[job_id] with a private tuple shape. Prefer seeding through JobQueueService.create_queue(job_id) so this contract test doesn’t break on unrelated internal tuple/layout refactors.

Suggested patch

-    svc._queues[job_id] = (asyncio.Queue(), None, None, None)  # type: ignore[arg-type]
+    svc.create_queue(job_id)
     await svc.cleanup_job(job_id)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/tests/unit/test_chat_endpoint.py` around lines 1371 - 1376, The
test seeds a queue by directly mutating the private svc._queues tuple shape
which couples the test to internal implementation; instead call the public queue
creation API (e.g. JobQueueService.create_queue or svc.create_queue(job_id)) to
create the minimal queue entry before invoking svc.cleanup_job(job_id), so the
test uses the public contract rather than writing to svc._queues and remains
resilient to internal tuple/layout changes while still reaching the
unconditional _public_jobs.discard path.

src/backend/tests/unit/test_redis_job_queue_service.py (1)

2473-2475: ⚡ Quick win

Avoid seeding svc._queues with a private tuple shape directly.

Line 2474 hard-codes an internal tuple contract and needs type: ignore, which makes this test fragile to service-internal refactors. Prefer creating the queue through the service API and then invoking cleanup.

Proposed refactor

-        # Seed a minimal queue entry so cleanup_job doesn't early-return
-        svc._queues[job_id] = (asyncio.Queue(), None, None, None)  # type: ignore[arg-type]
+        # Seed via service API so the test doesn't depend on private tuple shape
+        svc.create_queue(job_id)
         await svc.cleanup_job(job_id)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/tests/unit/test_redis_job_queue_service.py` around lines 2473 -
2475, The test seeds svc._queues[job_id] with a private tuple shape which
couples the test to implementation details; instead, create the minimal queue
via the service's public API (e.g., call whatever method exists to
create/open/enqueue for a job) so the queue entry is added by the service
itself, then call svc.cleanup_job(job_id); remove the direct assignment to
svc._queues and the type: ignore. Reference: replace the direct manipulation of
svc._queues and keep using svc.cleanup_job(job_id) with job_id.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/backend/base/langflow/services/job_queue/service.py`:
- Around line 1637-1639: The public-marker must be persisted to Redis
synchronously so other workers don't see a false 404; in register_public_job
replace the background write with a synchronous persistence step: instead of
calling self._spawn_background(self._set_public_job_key(job_id)), call the
Redis-write path directly (await or call the function
_set_public_job_key(job_id) synchronously) so the marker is stored before
register_public_job returns, keeping _assert_public_job semantics consistent
across workers.
- Around line 1641-1645: The public-job Redis marker is set once with
ex=self._ttl in _set_public_job_key but never renewed, so when long-running
builds refresh the stream/owner TTL the public marker should be refreshed too;
update the code to refresh the same key whenever you refresh the stream or owner
TTL (i.e., call _set_public_job_key(job_id) or call
self._client.expire(self._public_job_key(job_id), self._ttl) from the same
places that call _refresh_stream_ttl / _refresh_owner_key or where you currently
call expire on stream/owner keys) so the public marker stays alive for the
duration of the build.

---

Nitpick comments:
In `@src/backend/tests/unit/test_chat_endpoint.py`:
- Around line 1371-1376: The test seeds a queue by directly mutating the private
svc._queues tuple shape which couples the test to internal implementation;
instead call the public queue creation API (e.g. JobQueueService.create_queue or
svc.create_queue(job_id)) to create the minimal queue entry before invoking
svc.cleanup_job(job_id), so the test uses the public contract rather than
writing to svc._queues and remains resilient to internal tuple/layout changes
while still reaching the unconditional _public_jobs.discard path.

In `@src/backend/tests/unit/test_redis_job_queue_service.py`:
- Around line 2473-2475: The test seeds svc._queues[job_id] with a private tuple
shape which couples the test to implementation details; instead, create the
minimal queue via the service's public API (e.g., call whatever method exists to
create/open/enqueue for a job) so the queue entry is added by the service
itself, then call svc.cleanup_job(job_id); remove the direct assignment to
svc._queues and the type: ignore. Reference: replace the direct manipulation of
svc._queues and keep using svc.cleanup_job(job_id) with job_id.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5d075916-d21e-44a3-80e5-ab87b2a2931f

📥 Commits

Reviewing files that changed from the base of the PR and between 481cdd3 and a6da856.

📒 Files selected for processing (4)

• src/backend/base/langflow/api/v1/chat.py
• src/backend/base/langflow/services/job_queue/service.py
• src/backend/tests/unit/test_chat_endpoint.py
• src/backend/tests/unit/test_redis_job_queue_service.py

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Persist the public marker before returning the job_id.

This only updates local memory synchronously; the Redis marker is written later in a background task. In a multi-worker deployment, the first public /events or /cancel request can land on another worker before that task runs, so _assert_public_job returns a false 404 for a legitimate public build. The cross-worker test already has to drain svc_a._background_tasks before worker B can see the marker, but the HTTP path has no equivalent barrier.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/base/langflow/services/job_queue/service.py` around lines 1637 -
1639, The public-marker must be persisted to Redis synchronously so other
workers don't see a false 404; in register_public_job replace the background
write with a synchronous persistence step: instead of calling
self._spawn_background(self._set_public_job_key(job_id)), call the Redis-write
path directly (await or call the function _set_public_job_key(job_id)
synchronously) so the marker is stored before register_public_job returns,
keeping _assert_public_job semantics consistent across workers.

[codecov]

Codecov Report

❌ Patch coverage is 81.57895% with 7 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release-1.10.1@d6d1692). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...ackend/base/langflow/services/job_queue/service.py	78.12%	7 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##             release-1.10.1   #13602   +/-   ##
=================================================
  Coverage                  ?   58.60%           
=================================================
  Files                     ?     2302           
  Lines                     ?   219919           
  Branches                  ?    32365           
=================================================
  Hits                      ?   128875           
  Misses                    ?    89585           
  Partials                  ?     1459           

Flag	Coverage Δ
backend	65.11% <81.57%> (?)
frontend	58.00% <ø> (?)
lfx	54.34% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/api/v1/chat.py	51.00% <100.00%> (ø)
...ackend/base/langflow/services/job_queue/service.py	79.76% <78.12%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	43.28% (57622/133133)	69.22% (7829/11310)	41.49% (1291/3111)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4940	0 💤	0 ❌	0 🔥	11m 42s ⏱️

[dkaushik94]

Might be worth moving this to before the job is actually started..? @Jkavia

This might prove to be more of a nitpick rather than a significant improvement. The rationale being, what if a person triggers cancel while the flow is running and the flow has not been registered as public. There is a window of vulnerability. If we first register and mark the Id as public, we should be safe from there on out. Thoughts?

[Jkavia]

the thing is job_id doesn't exist before start_flow_build runs. also unless we return the job Id there would be no way to cancel and by that ordering this will always execute prior to cancel endpoint being invoked