feat: Complete RBAC and distribution contracts - #14230
Merged
Merged
Conversation
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThis PR adds authorization mutation lifecycle contracts and integrates them into identity and authorization CRUD flows, adds provider-account and voice permission guards, expands A2A and voice enforcement, introduces an endpoint authorization matrix validator, adds core release inventory checks, and documents Docker image profiles. ChangesAuthorization lifecycle pipeline
Resource and endpoint authorization
Authorization endpoint matrix
Release inventory and Docker documentation
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant A2AEndpoint
participant APIKeyAuthentication
participant AuthorizationGuard
participant AgentVisibility
Client->>A2AEndpoint: request agent or message/send
A2AEndpoint->>APIKeyAuthentication: authenticate API key
APIKeyAuthentication-->>A2AEndpoint: authenticated user
A2AEndpoint->>AuthorizationGuard: enforce flow execute permission
A2AEndpoint->>AgentVisibility: compute visible agent flows
AgentVisibility-->>Client: authorized agent response
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 8 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
erichare
marked this pull request as ready for review
July 23, 2026 17:05
Contributor
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
erichare
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
src/backend/tests/unit/api/v1/test_authz_lifecycle_contract.py (1)
40-40: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRedundant
@pytest.mark.asynciodecorators. This repo runs pytest-asyncio inasyncio_mode = 'auto', so async tests undertests/are auto-detected; the explicit markers throughout this file can be dropped for consistency with the convention.Based on learnings: pytest-asyncio is configured with
asyncio_mode = 'auto'in pyproject.toml, so@pytest.mark.asynciodecorators are unnecessary for tests undertests/paths.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/tests/unit/api/v1/test_authz_lifecycle_contract.py` at line 40, Remove the redundant `@pytest.mark.asyncio` decorators from the async tests in this file, including the test identified by the surrounding lifecycle contract test definitions. Rely on the repository’s asyncio_mode = "auto" configuration while preserving each test’s async behavior and other decorators.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-inventory-gate.yml:
- Around line 88-91: Update the release contract checkout step using
actions/checkout@v6 to disable GitHub token persistence via its
credential-persistence option. Keep the existing inputs.ref checkout behavior
unchanged and apply the change only to this checkout step.
In `@docs/docs/Deployment/docker-image-profiles.mdx`:
- Around line 33-36: Update the moving-tag examples in the deployment
documentation to use complete, consistent image references:
langflowai/langflow:core-latest, langflowai/langflow:latest, and
langflowai/langflow-all:latest. Preserve the surrounding guidance about pinning
version tags and registry digests.
In `@scripts/ci/check_authz_endpoint_matrix.py`:
- Around line 86-98: Update _parse_matrix_route to validate the parsed action
against the script’s known action vocabulary, rejecting unknown values with a
source- and handler-specific ValueError like the existing access validation.
Preserve the current incomplete-entry and access-mode checks, and return only
validated action values.
In `@src/backend/base/langflow/api/v1/a2a.py`:
- Around line 694-708: Update the flow query using
restrict_to_owned_or_visible_scope so owned_clause is passed only when
should_apply_owner_override() allows the owner override. Preserve
visibility-only filtering for scoped API keys, matching the behavior of
filter_visible_resources and preventing unrestricted enumeration of the current
user’s flows.
In `@src/backend/base/langflow/api/v1/users.py`:
- Around line 211-223: Update the user update flow around update_user so await
session.commit() executes for every successful user patch, not only when
lifecycle_mutation is present. Keep lifecycle staging, committed notification,
and audit_decision within the lifecycle_mutation branch, while placing the
commit after that branch so password, role, and profile updates are persisted as
well.
---
Nitpick comments:
In `@src/backend/tests/unit/api/v1/test_authz_lifecycle_contract.py`:
- Line 40: Remove the redundant `@pytest.mark.asyncio` decorators from the async
tests in this file, including the test identified by the surrounding lifecycle
contract test definitions. Rely on the repository’s asyncio_mode = "auto"
configuration while preserving each test’s async behavior and other decorators.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6c1ba488-a045-487d-b01c-897e1e813131
📒 Files selected for processing (33)
.github/workflows/release-inventory-gate.ymldocs/docs/Deployment/deployment-docker.mdxdocs/docs/Deployment/docker-image-profiles.mdxdocs/sidebars.jsscripts/ci/authz_endpoint_matrix.jsonscripts/ci/check_authz_endpoint_matrix.pyscripts/ci/test_authz_endpoint_matrix.pyscripts/ci/test_release_inventory.pysrc/backend/base/langflow/api/v1/a2a.pysrc/backend/base/langflow/api/v1/api_key.pysrc/backend/base/langflow/api/v1/authz_role_assignments.pysrc/backend/base/langflow/api/v1/authz_roles.pysrc/backend/base/langflow/api/v1/authz_teams.pysrc/backend/base/langflow/api/v1/deployments.pysrc/backend/base/langflow/api/v1/schemas/authz_roles.pysrc/backend/base/langflow/api/v1/users.pysrc/backend/base/langflow/api/v1/voice_mode.pysrc/backend/base/langflow/services/authorization/__init__.pysrc/backend/base/langflow/services/authorization/actions.pysrc/backend/base/langflow/services/authorization/guards.pysrc/backend/base/langflow/services/authorization/lifecycle.pysrc/backend/base/langflow/services/authorization/utils.pysrc/backend/tests/unit/api/v1/test_a2a.pysrc/backend/tests/unit/api/v1/test_authz_admin_routes.pysrc/backend/tests/unit/api/v1/test_authz_lifecycle_contract.pysrc/backend/tests/unit/api/v1/test_deployment_route_handlers.pysrc/backend/tests/unit/api/v1/test_voice_mode_flow_authz.pysrc/backend/tests/unit/services/authorization/_policy_double.pysrc/backend/tests/unit/services/authorization/test_guards.pysrc/backend/tests/unit/test_voice_mode_client_scoping.pysrc/lfx/src/lfx/services/authorization/__init__.pysrc/lfx/src/lfx/services/authorization/base.pysrc/lfx/tests/unit/services/authorization/test_default_authorization_service.py
github-actions
Bot
added
enhancement
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## release-1.12.0 #14230 +/- ##
==================================================
- Coverage 61.47% 61.45% -0.03%
==================================================
Files 2339 2402 +63
Lines 237145 239005 +1860
Branches 35410 36984 +1574
==================================================
+ Hits 145787 146874 +1087
- Misses 89561 90317 +756
- Partials 1797 1814 +17
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This comment has been minimized.
This comment has been minimized.
Contributor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
github-actions
Bot
added
enhancement
Contributor
|
Build successful! ✅ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this completes
Closes the remaining OSS implementation gaps for LE-1913, LE-1914, LE-1869, and the LE-192 umbrella on
release-1.12.0:Scope boundary
LE-1828 is intentionally excluded. Deployment RBAC for that ticket is handled by #14104. This PR only adds provider-account authorization where needed for LE-1913.
Validation
git diff --checkEnterprise pairing
Companion EE draft: https://github.ibm.com/WatsonOrchestrate/Langflow-Enterprise/pull/116
The EE PR pins this exact OSS commit and validates the lifecycle, endpoint-matrix, frontend-vocabulary, and hardened-bundle contracts.
Generated with OpenAI Codex.
Summary by CodeRabbit