fix: complete shared resource access (LE-1828)

[erichare]

Summary

• resolve Memory Base shares through the existing knowledge_base authorization resource type
• include shared files, knowledge bases, Memory Bases, and variables in SQL-scoped list queries before pagination
• consume LE-1826's structured ResourceVisibilityScope for those lists so global wildcard and concrete-ID grants work without materializing every UUID
• fail closed for workspace/project-only scopes on files, knowledge bases, Memory Bases, and variables because those models do not have canonical domain columns
• allow explicitly shared variables at runtime while redacting all shared values from administrative list responses
• preserve the resource owner's namespace for shared project downloads and deployment attachment/delete operations
• keep cross-user fetches gated by the registered authorization service and convert denied lookups to 404s

Dependency / merge order

• Depends on feat: add scoped authorization visibility prefilter #14102 (LE-1826); this branch carries the LE-1826 commits rebased onto the latest release-1.11.0 so this stacked PR remains mergeable against its OSS release base.
• Both OSS PRs keep release-1.11.0 as their GitHub base.
• Merge feat: add scoped authorization visibility prefilter #14102 first, then fix: complete shared resource access (LE-1828) #14101. Rebase/refresh fix: complete shared resource access (LE-1828) #14101 again if feat: add scoped authorization visibility prefilter #14102's merged history changes before this PR is merged.

Validation

• repository affected-file pre-commit hooks passed, including ruff, format, route-trust, and detect-secrets
• combined LE-1826/LE-1828 focused suite: 351 passed
• post-release-rebase seam/share/guard/deployment suite: 28 passed
• scope regressions cover all_resources, concrete resource_ids, and owner-only fail-closed behavior for workspace/project-only scopes on models without domain columns

Follow-up

• component-palette visibility for shared dependencies remains a separate product-policy/UI follow-up; this PR completes the backend resource and owner-namespace seams in LE-1828

Jira: LE-1828

Summary by CodeRabbit

• New Features

  • Improved visibility controls for shared flows, projects, deployments, files, variables, knowledge bases, and memory bases.
  • Added support for workspace- and project-scoped access.
  • Shared variables remain available while sensitive values are hidden from unauthorized viewers.

• Bug Fixes

  • Corrected owner-aware project downloads and deployment cleanup.
  • Standardized unavailable or unauthorized memory base responses.
  • Improved access handling for shared memory bases and knowledge bases.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1a2ad2c1-5e20-45bc-964c-c43c521f93fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Introduces structured resource visibility scopes, replaces ID-based authorization prefilters, and propagates scoped authorization through resource listings, deployment queries, Memory Base operations, variables, files, project downloads, and related tests.

Changes

Structured visibility authorization

Layer / File(s)	Summary
Visibility scope contract and predicates src/lfx/src/lfx/services/authorization/*, src/backend/base/langflow/services/authorization/*, src/backend/tests/unit/services/authorization/test_visibility_scope_prefilter.py	Adds ResourceVisibilityScope, scope-aware authorization hooks, SQL predicates, loaded-resource checks, and public exports.
Database visibility query pipeline src/backend/base/langflow/services/database/models/deployment/*, src/backend/base/langflow/services/memory_base/*, src/backend/base/langflow/services/variable/*, src/backend/base/langflow/api/utils/knowledge_base_service.py	Applies visibility scopes to deployment pages/counts, Memory Base and knowledge-base listings, and variable lookup/listing with shared-value redaction.
API listing and route prefilter wiring src/backend/base/langflow/api/v1/{flows,projects,deployments,knowledge_bases,variable}.py, src/backend/base/langflow/api/v2/files.py, src/backend/tests/unit/services/authorization/*	Replaces visible-ID prefilters with structured scopes and forwards them into resource queries and route handlers.
Memory-base authorization and owner-aware operations src/backend/base/langflow/api/v1/memories.py, src/backend/base/langflow/api/v1/authz_shares.py, src/backend/base/langflow/api/v1/projects*.py	Centralizes Memory Base authorization, resolves memory-backed resource owners, and uses resolved owners for project downloads and deployment cleanup.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant API route
  participant AuthorizationService
  participant ScopeQuery
  participant Database
  API route->>AuthorizationService: request resource visibility
  AuthorizationService-->>API route: return ResourceVisibilityScope
  API route->>ScopeQuery: apply owner and visibility predicates
  ScopeQuery->>Database: execute scoped query
  Database-->>API route: return authorized resources

Loading

Possibly related PRs

• langflow-ai/langflow#13371: Adds the base authorization hook used by structured visibility prefiltering.
• langflow-ai/langflow#13541: Changes the same list endpoints from visible-ID authorization toward scope-based filtering.
• langflow-ai/langflow#13741: Modifies DatabaseVariableService.get_all in the same variable-service path.

Suggested labels: bug

Suggested reviewers: himavarshavs

🚥 Pre-merge checks | ✅ 7 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Quality And Coverage	⚠️ Warning	Tests cover many happy/error paths, but miss key security branches: scope-native variable resolution, MemoryBase all_resources/domain-only cases, and cross-owner MCP filtering.	Add branch tests for those paths, including ResourceVisibilityScope runtime lookup and SQL assertions for MemoryBase/file filtering.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	Added direct/unit and route-level pytest coverage for the new visibility-scope helpers and updated APIs/services; test files are properly named and assert real behavior.
Test File Naming And Structure	✅ Passed	All changed test files are backend test_*.py in pytest-style dirs, use fixtures/marks and descriptive names, and include positive/negative/error coverage.
Excessive Mock Usage Warning	✅ Passed	The changed tests use a few boundary mocks, but most assertions hit real DB/SQL or custom fakes/stubs; no file is overwhelmingly mock-driven.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: completing shared resource access across the affected resources.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/backend/base/langflow/api/v1/mappers/deployments/helpers.py (1)

889-922: 🗄️ Data Integrity & Integration | 🔴 Critical | 🏗️ Heavy lift

Use the deployment owner’s namespace during shared-list synchronization.

visibility_scope can now return foreign-owned deployments, but provider lookup and attachment synchronization still use the requesting user_id. On owner-namespaced providers, this can report valid owner resources as missing and trigger the stale-row deletion at Line 951.

Thread the provider/resource owner separately—or group rows by owner—and use it for provider lookup, attachment cleanup, and recounting. Add a regression test where actor and deployment owner differ.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/base/langflow/api/v1/mappers/deployments/helpers.py` around lines
889 - 922, Update the shared deployment synchronization flow around
list_deployments_page so provider operations use each deployment’s owner
namespace rather than the requesting user_id. Group rows by owner or carry the
owner through provider lookup, attachment cleanup, stale-row deletion, and
recounting, while preserving actor-based authorization via allowed_ids. Add a
regression test covering an actor listing a deployment owned by a different
user.

Source: Coding guidelines

🧹 Nitpick comments (1)

src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py (1)

167-167: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the redundant asyncio markers.

The repository uses pytest-asyncio auto mode, so these decorators add unnecessary per-test configuration.

• src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py#L167-L167: remove @pytest.mark.asyncio.
• src/backend/tests/unit/test_memory_bases.py#L560-L560: remove @pytest.mark.asyncio.
• src/backend/tests/unit/api/v1/test_authz_share_routes.py#L154-L154: remove @pytest.mark.asyncio.

Based on learnings, async tests under tests/ should rely on automatic detection.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py`
at line 167, Remove the redundant `@pytest.mark.asyncio` decorators from
src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py:167-167,
src/backend/tests/unit/test_memory_bases.py:560-560, and
src/backend/tests/unit/api/v1/test_authz_share_routes.py:154-154; rely on
pytest-asyncio auto mode for async test detection.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/backend/base/langflow/api/v2/files.py`:
- Around line 487-503: Update the UserFile query’s post-visibility filtering to
exclude reserved internal MCP filenames derived from each row’s owner, rather
than only the current actor’s `_mcp_servers_<actor-id>` name. Apply this
owner-based exclusion after restrict_to_owned_or_visible_scope while preserving
access to ordinary files.

In `@src/backend/base/langflow/services/variable/service.py`:
- Around line 213-242: Update the shared-variable resolution block around
get_authorization_service and list_visible_resource_ids to use
get_resource_visibility instead. Permit all_resources scopes, constrain queries
to concrete resource_ids, and fail closed for workspace/project-only scopes
because variables lack canonical domain columns. Add a runtime test covering a
scope-native visibility provider alongside the existing legacy-adapter test.

In `@src/backend/tests/unit/test_memory_bases.py`:
- Around line 598-611: Expand
test_list_statement_unions_owned_and_visible_memory_bases to cover
workspace/project-only visibility scopes and assert they remain restricted to
actor_id, plus an all_resources=True scope that omits the owner restriction.
Include positive, negative, and edge-case SQL assertions while preserving the
existing concrete-resource-ID coverage.

---

Outside diff comments:
In `@src/backend/base/langflow/api/v1/mappers/deployments/helpers.py`:
- Around line 889-922: Update the shared deployment synchronization flow around
list_deployments_page so provider operations use each deployment’s owner
namespace rather than the requesting user_id. Group rows by owner or carry the
owner through provider lookup, attachment cleanup, stale-row deletion, and
recounting, while preserving actor-based authorization via allowed_ids. Add a
regression test covering an actor listing a deployment owned by a different
user.

---

Nitpick comments:
In
`@src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py`:
- Line 167: Remove the redundant `@pytest.mark.asyncio` decorators from
src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py:167-167,
src/backend/tests/unit/test_memory_bases.py:560-560, and
src/backend/tests/unit/api/v1/test_authz_share_routes.py:154-154; rely on
pytest-asyncio auto mode for async test detection.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2eb65bcf-4c6d-48ab-857d-f95aa9ff6cd1

📥 Commits

Reviewing files that changed from the base of the PR and between b00de32 and 0fd9d14.

📒 Files selected for processing (30)

• .secrets.baseline
• src/backend/base/langflow/api/utils/knowledge_base_service.py
• src/backend/base/langflow/api/v1/authz_shares.py
• src/backend/base/langflow/api/v1/deployments.py
• src/backend/base/langflow/api/v1/flows.py
• src/backend/base/langflow/api/v1/knowledge_bases.py
• src/backend/base/langflow/api/v1/mappers/deployments/helpers.py
• src/backend/base/langflow/api/v1/memories.py
• src/backend/base/langflow/api/v1/projects.py
• src/backend/base/langflow/api/v1/projects_files.py
• src/backend/base/langflow/api/v1/variable.py
• src/backend/base/langflow/api/v2/files.py
• src/backend/base/langflow/services/authorization/__init__.py
• src/backend/base/langflow/services/authorization/listing.py
• src/backend/base/langflow/services/database/models/deployment/crud.py
• src/backend/base/langflow/services/memory_base/service.py
• src/backend/base/langflow/services/variable/service.py
• src/backend/base/langflow/tests/services/database/models/deployment/test_crud.py
• src/backend/tests/unit/api/v1/test_authz_share_routes.py
• src/backend/tests/unit/api/v1/test_deployment_route_handlers.py
• src/backend/tests/unit/api/v1/test_projects.py
• src/backend/tests/unit/services/authorization/test_route_ceiling_guards.py
• src/backend/tests/unit/services/authorization/test_route_guard_regressions.py
• src/backend/tests/unit/services/authorization/test_unscoped_list_visibility.py
• src/backend/tests/unit/services/authorization/test_visibility_scope_prefilter.py
• src/backend/tests/unit/services/database/test_deployment_crud_authz_prefilter.py
• src/backend/tests/unit/services/variable/test_service.py
• src/backend/tests/unit/test_memory_bases.py
• src/lfx/src/lfx/services/authorization/__init__.py
• src/lfx/src/lfx/services/authorization/base.py

[erichare]

Addressed the remaining review-body items in 34712bd as well: deployment synchronization now keeps the requesting actor for DB visibility while using the provider-account owner for provider and attachment namespaces; the shared project ZIP path applies per-flow READ authorization; and the three redundant async markers were removed. Validation on the current release-1.12.0 head: 411 passed, 3 skipped; Ruff, formatting, diff checks, and detect-secrets all pass.