fix: enforce locked flows in backend - #14192
Merged
Merged
Conversation
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughChangesFlow locking
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant flows_helpers
participant ensure_flow_update_allowed
Client->>flows_helpers: PUT or PATCH flow update
flows_helpers->>ensure_flow_update_allowed: validate flow and update data
ensure_flow_update_allowed-->>flows_helpers: LockedFlowError for blocked mutation
flows_helpers-->>Client: HTTP 423 LOCKED
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (7 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Migration Validation Passed All migrations follow the Expand-Contract pattern correctly. |
erichare
marked this pull request as ready for review
July 21, 2026 18:52
Contributor
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
github-actions
Bot
added
bug
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py (1)
162-162: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove redundant
@pytest.mark.asynciodecorators.
src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py#L162-L162: remove the marker.src/backend/tests/unit/agentic/utils/test_flow_component.py#L289-L289: remove the marker.Based on learnings, pytest-asyncio uses
asyncio_mode = auto, so async tests are auto-detected and should not use this marker.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py` at line 162, Remove the redundant `@pytest.mark.asyncio` decorator from the async test at src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py lines 162-162 and from the corresponding async test at src/backend/tests/unit/agentic/utils/test_flow_component.py lines 289-289; rely on pytest-asyncio’s asyncio_mode = auto without changing test behavior.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/backend/base/langflow/agentic/utils/assistant_runner.py`:
- Around line 213-217: Make flow mutation writes atomic with the lock state:
update the persistence logic around assistant_runner.py lines 213-217,
flow_component.py lines 281-284, and both flows_helpers.py sites at lines
506-507 and 555-556 to condition writes on locked=false at write time, using a
conditional update or row lock rather than relying on refresh/get followed by
flush/commit. Preserve unlock-only updates by allowing writes that set
locked=false even when the flow is currently locked.
In `@src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py`:
- Around line 178-191: Extend the tests around run_assistant_and_persist with a
changed-stream scenario where session.refresh() updates flow.locked to True
during assistant execution. Assert that the locked-flow path raises
LockedFlowError and that session.commit() and _save_flow_to_fs() are not called,
while preserving the existing pre-execution lock assertions.
---
Nitpick comments:
In `@src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py`:
- Line 162: Remove the redundant `@pytest.mark.asyncio` decorator from the async
test at src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py lines
162-162 and from the corresponding async test at
src/backend/tests/unit/agentic/utils/test_flow_component.py lines 289-289; rely
on pytest-asyncio’s asyncio_mode = auto without changing test behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 574d78fc-235f-47b9-8b51-2e9251c3c0a4
📒 Files selected for processing (7)
src/backend/base/langflow/agentic/utils/assistant_runner.pysrc/backend/base/langflow/agentic/utils/flow_component.pysrc/backend/base/langflow/api/v1/flows_helpers.pysrc/backend/base/langflow/services/database/models/flow/guards.pysrc/backend/tests/unit/agentic/mcp/test_run_assistant_tool.pysrc/backend/tests/unit/agentic/utils/test_flow_component.pysrc/backend/tests/unit/api/v1/test_flows.py
github-actions
Bot
added
bug
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## release-1.11.0 #14192 +/- ##
==================================================
- Coverage 61.21% 61.14% -0.07%
==================================================
Files 2440 2387 -53
Lines 238935 237299 -1636
Branches 34065 33535 -530
==================================================
- Hits 146270 145105 -1165
+ Misses 90909 90436 -473
- Partials 1756 1758 +2
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
github-actions
Bot
added
bug
github-actions
Bot
added
bug
github-actions
Bot
added
bug
github-actions
Bot
added
bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root cause
The
lockedflag was persisted, but flow update helpers never consulted it. Most MCP editing tools inherit that gap because they update flows throughPATCH /api/v1/flows/{id}; the agentic MCP component-field and assistant paths could also bypass the REST endpoint and write directly to the database.User impact
Locked flows are now read-only across backend API and MCP editing surfaces. Clients receive
423 Lockedwith guidance to unlock the flow before changing it. The existing UI unlock workflow remains compatible because full-payload requests are accepted whenlocked=falseis the only effective change.Validation
uv run pytest src/backend/tests/unit/api/v1/test_flows.py src/backend/tests/unit/api/v1/test_flows_helpers.py src/backend/tests/unit/agentic/utils/test_flow_component.py src/backend/tests/unit/agentic/mcp/test_run_assistant_tool.py -q(83 passed)Summary by CodeRabbit
New Features
423 Lockedresponse.Bug Fixes