fix(files): honor AWS fallbacks in Write File

[erichare]

Summary

• honor Write File's existing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment fallbacks
• keep the settings-backed S3 bucket and environment-backed region fallbacks intact
• remove redundant raw-component validation and unused S3 client construction
• add regression coverage and regenerate the packaged component index

Root cause

_save_to_aws resolved and validated fallback values locally, then called shared helpers that re-read the empty component inputs. The validator rejected environment-only credentials, and the client created by the helper was immediately overwritten by the client built from the resolved values.

Testing

• uv run pytest src/backend/tests/unit/components/processing/test_save_file_component.py -q (41 passed, 4 skipped)
• uv run pytest src/backend/tests/unit/components/data_source/test_s3_components.py::TestS3CompatibleComponents::test_save_file_component_s3_upload -q (1 passed)
• uv run ruff check src/lfx/src/lfx/components/files_and_knowledge/save_file.py src/backend/tests/unit/components/processing/test_save_file_component.py
• uv run ruff format --check src/lfx/src/lfx/components/files_and_knowledge/save_file.py src/backend/tests/unit/components/processing/test_save_file_component.py
• uv run --package lfx --no-sync pytest tests/unit/test_component_index.py -q (27 passed)
• LFX_DEV=1 uv run python scripts/build_component_index.py

Summary by CodeRabbit

• Bug Fixes
  • Improved AWS S3 file saving when component fields are left blank.
  • Credentials, bucket, and region settings can now be resolved from configured environment variables and application settings.
  • Added validation and clearer handling of missing required storage details.
  • S3 uploads now consistently use the resolved configuration for the destination and success reporting.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6105fec6-91db-4a52-b2ab-649ab6c6a5b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

SaveToFileComponent now resolves AWS S3 credentials, bucket, and region from inputs, environment variables, and settings before creating the client. The embedded component index was updated, and an asynchronous test verifies the fallback behavior.

Changes

AWS S3 fallback resolution

Layer / File(s)	Summary
Direct AWS resolution and validation src/lfx/src/lfx/components/files_and_knowledge/save_file.py, src/backend/tests/unit/components/processing/test_save_file_component.py	The component resolves AWS configuration directly, validates required values, creates the S3 client with boto3, and tests the resolved upload configuration and response.
Embedded component index synchronization src/lfx/src/lfx/_assets/component_index.json	The embedded component code and index hashes reflect the direct AWS client configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• langflow-ai/langflow#14237: Both PRs modify SaveToFileComponent and its tests, but this PR addresses AWS credential fallback and client creation.

Suggested labels: bug

Suggested reviewers: jordanrfrazier, himavarshavs

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: honoring AWS fallback values in the Write File component.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	The PR adds a named backend regression test that runs SaveToFileComponent and asserts environment/settings fallbacks, boto3 arguments, S3 upload path, and success text; existing S3 coverage also re...
Test Quality And Coverage	✅ Passed	New async test properly validates AWS fallback behavior. Uses correct pytest patterns (@pytest.mark.asyncio), covers main functionality (environment variable and settings-based fallbacks), includes...
Test File Naming And Structure	✅ Passed	Test file follows all required patterns: backend test_*.py structure, descriptive test names, proper pytest fixtures with setup/teardown, comprehensive error/edge case coverage with both positive a...
Excessive Mock Usage Warning	✅ Passed	The added test uses mocks only for external settings and boto3 dependencies. It asserts client arguments, upload path, and result, while exercising real component resolution and temporary-file logic.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/write-file-aws-env-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

src/backend/tests/unit/components/processing/test_save_file_component.py (1)

50-50: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the redundant async marker.

pytest-asyncio auto mode detects this async test. Remove @pytest.mark.asyncio to follow the repository test convention.

Proposed change

-    `@pytest.mark.asyncio`
     async def test_save_to_aws_uses_environment_and_settings_fallbacks(self, component_class, monkeypatch):

Based on learnings, asyncio_mode = "auto" makes explicit pytest.mark.asyncio markers unnecessary.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/tests/unit/components/processing/test_save_file_component.py` at
line 50, Remove the redundant `@pytest.mark.asyncio` decorator from the async test
in test_save_file_component.py, relying on pytest-asyncio auto mode while
leaving the test implementation unchanged.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lfx/src/lfx/_assets/component_index.json`:
- Line 9909: Update _save_to_aws so the synchronous boto3 s3_client.upload_file
call runs off the event loop via await asyncio.to_thread, passing the same
client and upload arguments; preserve the existing upload behavior and error
handling.
- Line 9909: Update the AWS client configuration in the cloud upload flow to
preserve temporary credential support: when constructing client_config with
aws_access_key_id and aws_secret_access_key, also include the AWS_SESSION_TOKEN
environment value when present. Keep the session-token field optional so
permanent credentials continue to work unchanged.

---

Nitpick comments:
In `@src/backend/tests/unit/components/processing/test_save_file_component.py`:
- Line 50: Remove the redundant `@pytest.mark.asyncio` decorator from the async
test in test_save_file_component.py, relying on pytest-asyncio auto mode while
leaving the test implementation unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bcaac57-23d1-4533-82a7-c35029660c7a

📥 Commits

Reviewing files that changed from the base of the PR and between 73629e2 and 92f1df6.

📒 Files selected for processing (3)

• src/backend/tests/unit/components/processing/test_save_file_component.py
• src/lfx/src/lfx/_assets/component_index.json
• src/lfx/src/lfx/components/files_and_knowledge/save_file.py

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== file existence and relevant section =="
wc -l src/lfx/src/lfx/_assets/component_index.json || true
sed -n '9850,10170p' src/lfx/src/lfx/_assets/component_index.json | nl -ba -v9850

echo "== event loop import usages in file =="
rg -n "asyncio|to_thread|RunInExecutor|upload_file|s3_client|boto3|object_storage_bucket_name|UploadFile" src/lfx/src/lfx/_assets/component_index.json

echo "== component file name =="
find . -path '*/lfx/custom.py' -o -path '*/components/*' -o -path '*SaveToFile*' 2>/dev/null | head -50 || true

Repository: langflow-ai/langflow

Length of output: 291

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant section =="
sed -n '9850,10170p' src/lfx/src/lfx/_assets/component_index.json | awk '{printf "%7d\t%s\n", NR+9849, $0}'

echo "== event loop import usages in file =="
rg -n "asyncio|to_thread|RunInExecutor|upload_file|s3_client|boto3|object_storage_bucket_name|UploadFile" src/lfx/src/lfx/_assets/component_index.json

echo "== nearby asyncio imports and async methods using asyncio =="
rg -n "async import asyncio|import asyncio|await asyncio|asyncio|to_thread|RunInExecutor" src/lfx/src/lfx/_assets/component_index.json

Repository: langflow-ai/langflow

Length of output: 50377

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== exact SaveToFileComponent section around AWS upload =="
rg -n -C 4 'class SaveToFileComponent|async def _save_to_aws|s3_client\.upload_file|asyncio\.to_thread' src/lfx/src/lfx/_assets/component_index.json

echo "== boto3 upload_file call context with line numbers =="
python3 - <<'PY'
from pathlib import Path
p = Path("src/lfx/src/lfx/_assets/component_index.json")
text = p.read_text()
lines = text.splitlines()
for i, line in enumerate(lines, 1):
    if "async def _save_to_aws" in line:
        print(f"-- async def _save_to_aws at line {i}")
        for j in range(i, min(i+90, len(lines)+1)):
            print(f"{j:5d}: {lines[j-1]}")
        break
PY

Repository: langflow-ai/langflow

Length of output: 50377

---

Move the S3 upload off the event loop.

_save_to_aws awaits work before calling s3_client.upload_file, but that boto3 call is synchronous network I/O and retries. Run it with await asyncio.to_thread(...) or switch to an async S3 client.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lfx/src/lfx/_assets/component_index.json` at line 9909, Update
_save_to_aws so the synchronous boto3 s3_client.upload_file call runs off the
event loop via await asyncio.to_thread, passing the same client and upload
arguments; preserve the existing upload behavior and error handling.

---

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate files =="
fd -a 'component_index\.json$|\.py$' . | sed 's#^\./##' | rg 'lfx/custom|custom[_A-Z]|SaveToFileComponent|component_index' | head -100

echo
echo "== search AWS session token references =="
rg -n "AWS_SESSION_TOKEN|client_config|SecretStrInput\\(\n            name=\"aws_access_key_id\"" . -g '*.py' -g '*.json' | head -200

echo
echo "== inspect component_index token/client_config context =="
python3 - <<'PY'
from pathlib import Path
p=Path('src/lfx/src/lfx/_assets/component_index.json')
if not p.exists():
    print('missing component_index.json')
    raise SystemExit
text=p.read_text()
idx=text.find('client_config')
print('has client_config', idx>=0)
if idx>=0:
    print(text[max(0,idx-600):idx+1800])
else:
    idx=text.find('Access Key ID')
    print('idx Access Key ID', idx)
PY

echo
echo "== inspect all AWS credential reads in repository =="
rg -n "AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|SecretStrInput|get_secret_value|client_config" . -g '*.py' -g '*.json' | head -400

Repository: langflow-ai/langflow

Length of output: 3573

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== inspect AWS credential handling in component_index.json =="
python3 - <<'PY'
from pathlib import Path
from textwrap import indent
p = Path("src/lfx/src/lfx/_assets/component_index.json")
s = p.read_text()

for needle in [
    "client_config",
    "client_config: {",
    "AWS_SESSION_TOKEN",
    'name="service_account_key"',
    'name="aws_access_key_id"',
]:
    i = s.find(needle)
    print(f"\n--- {needle!r} at {i} ---")
    if i < 0:
        continue
    start = max(0, s.rfind('', 0, i - 500) or (i - 1000))
    end = min(len(s), i + 1500)
    for j, line in enumerate(s[start:end].splitlines(), start=max(1, s[:i].count('\n'))):
        print(f"{j}: {line}")

# Print all AWS credential reads in the JSON string as raw keys around relevant literals.
for needle in [
    'aws_access_key_id',
    'aws_secret_access_key',
    'AWS_ACCESS_KEY_ID',
    'AWS_SECRET_ACCESS_KEY',
    'AWS_SESSION_TOKEN',
]:
    print(f"\n--- occurrences of {needle!r} ---")
    count = s.count(needle)
    print("count", count)

# Extract the AWS S3 client configuration block by locating boto3.client("s3", **client_config).
import re
m = re.search(r'boto3\.client\(\Q"S3"\E,\s*\*\*client_config\)', s)
if m:
    print("\n--- S3 client call block ---")
    start_before = max(0, s.rfind("client_config", 0, m.start()))
    start = max(0, s.rfind("{", start_before, m.start()) + 1)
    # naive balanced brace not needed; just print enough source around client_config
    print(s[s.find("client_config", start_before):m.end()+50])
else:
    print("\n--- boto3.client(\"s3\", **client_config) not found ---")

# Source files under src/lfx/src/lfx/custom for live save-file-like implementations.
print("\n--- source files refs ---")
import glob, os
for path in sorted(glob.glob("src/lfx/src/lfx/custom/**/*.py", recursive=True)):
    with open(path, "r", encoding="utf-8", errors="ignore") as f:
        text = f.read()
    for term in ["AWS_SESSION_TOKEN", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "boto3.client"]:
        if term in text:
            print(path, "contains", term)
PY

Repository: langflow-ai/langflow

Length of output: 3596

---

🌐 Web query:

boto3 client temporary credentials AWS_SESSION_TOKEN environment variable SessionCredentials

💡 Result:

To use temporary credentials with the Boto3 library, you must provide three components: an access key ID, a secret access key, and a session token [1][2]. The AWS_SESSION_TOKEN environment variable is the standard way to provide this session token when using temporary credentials [1][3]. There are three primary ways to utilize temporary credentials in Boto3: 1. Environment Variables (Recommended for CLI/scripting): By setting the following environment variables, Boto3 will automatically detect and use them without requiring code changes [4][5]: - AWS_ACCESS_KEY_ID - AWS_SECRET_ACCESS_KEY - AWS_SESSION_TOKEN [1][2] Note: The environment variable AWS_SECURITY_TOKEN is supported only for backward compatibility and should be avoided in favor of AWS_SESSION_TOKEN [1][3]. 2. Programmatic Injection (Explicitly in code): If you need to pass credentials manually (e.g., after calling an STS operation like assume_role or get_session_token), you can provide them when initializing a client or session [1][6]: import boto3 client = boto3.client( 's3', aws_access_key_id='YOUR_ACCESS_KEY', aws_secret_access_key='YOUR_SECRET_KEY', aws_session_token='YOUR_SESSION_TOKEN') 3. Shared Credentials File: You can also store these values in your ~/.aws/credentials file under a specific profile [1][2]: [default] aws_access_key_id=... aws_secret_access_key=... aws_session_token=... Boto3 does not use an object named "SessionCredentials" as a required parameter. Instead, it accepts the credentials as individual arguments (aws_access_key_id, aws_secret_access_key, and aws_session_token) when creating a Session or Client object [6][7]. If you are working with the AWS SDK for Java, you might encounter a BasicSessionCredentials object [8], but this is not applicable to the Python Boto3 library.

Citations:

• 1: https://docs.aws.amazon.com/boto3/latest/guide/credentials.html
• 2: https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html
• 3: https://docs.aws.amazon.com/boto3/latest/guide/configuration.html
• 4: https://stackoverflow.com/questions/51266120/boto3-sessions-and-aws-session-token-management
• 5: https://docs.aws.amazon.com/sdkref/latest/guide/environment-variables.html
• 6: https://docs.aws.amazon.com/boto3/latest/reference/core/session.html
• 7: https://docs.aws.amazon.com/boto3/latest/guide/session.html
• 8: https://docs.aws.amazon.com/AmazonS3/latest/developerguide/AuthUsingTempSessionToken.html

---

Preserve AWS_SESSION_TOKEN for temporary AWS credentials.

client_config only sets aws_access_key_id and aws_secret_access_key, so temporary STS credentials fail authentication when the access key and secret are read from environment variables. Include aws_session_token from AWS_SESSION_TOKEN when it is present.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lfx/src/lfx/_assets/component_index.json` at line 9909, Update the AWS
client configuration in the cloud upload flow to preserve temporary credential
support: when constructing client_config with aws_access_key_id and
aws_secret_access_key, also include the AWS_SESSION_TOKEN environment value when
present. Keep the session-token field optional so permanent credentials continue
to work unchanged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.72%. Comparing base (73629e2) to head (5c8f10f).

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.11.3   #14446      +/-   ##
==================================================
+ Coverage           61.40%   61.72%   +0.31%     
==================================================
  Files                2398     2398              
  Lines              238302   238302              
  Branches            35840    33795    -2045     
==================================================
+ Hits               146336   147086     +750     
+ Misses              90158    89408     -750     
  Partials             1808     1808              

Flag	Coverage Δ
backend	68.94% <ø> (+1.27%)	⬆️
frontend	59.99% <ø> (+0.13%)	⬆️
lfx	60.76% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 209 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	47.4% (67712/142846)	70.44% (9579/13598)	45.85% (1558/3398)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
5422	0 💤	0 ❌	0 🔥	17m 1s ⏱️

[rafaelgiln]

QA verified on b5cd6036e5 against base release-1.11.3 (73629e2df6). Source build, macOS/SQLite, S3 exercised against a moto mock via AWS_ENDPOINT_URL_S3.

The fix works end to end. With AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in the server environment and both credential fields left empty, the component now uploads from the canvas: POST /api/v2/workflows fires and the object lands at s3://<bucket>/<prefix>/<name>.txt. On the base commit the same flow fails with AWS Access Key ID is required for S3 storage, so the new regression test is a genuine one.

What I checked:

• test_save_file_component.py: 43 passed / 4 skipped. test_save_to_aws_uses_environment_and_settings_fallbacks fails on base, passes here.
• Fallback matrix via API and UI: env-only creds, component-only creds, mixed (key from input + secret from env), bucket from LANGFLOW_OBJECT_STORAGE_BUCKET_NAME, region from AWS_DEFAULT_REGION — all upload correctly.
• Negative paths still raise the long, fallback-aware messages.
• AWS_SESSION_TOKEN is forwarded only when key and secret both came from the environment; uploads still succeed with it set.
• Local storage mode unaffected (canvas + API).
• component_index.json and the two starter projects are in sync: regenerating the index produces zero drift and the previous code_hash is gone from the tree, so no "Update available" badge.
• Read File (file.py) still has no environment fallback — out of scope for this PR, just noting the asymmetry.

One non-blocking observation, same function, worth a one-line follow-up rather than holding the merge:

Now that bucket_name is required=False, leaving S3 Bucket Name blank is reachable from the canvas. On a default install (LANGFLOW_OBJECT_STORAGE_BUCKET_NAME unset), settings.object_storage_bucket_name still returns its hardcoded default "langflow-bucket" (src/lfx/src/lfx/services/settings/groups/storage.py:9), so the guard at save_file.py:723-727 can never fire and the upload targets a bucket the user never typed:

An error occurred (NoSuchBucket) when calling the PutObject operation: The specified bucket does not exist
  -> langflow-bucket/<prefix>/<name>.txt

The base commit returned the actionable S3 Bucket Name is required for S3 storage here. The new field help ("Optional. Falls back to the configured object storage bucket") also promises a configured bucket that a default install does not have. This predates the canvas commit — it arrived with the settings fallback in 92f1df62f7 — and is not a regression of the fix itself.

CI note: the red checks on this PR are cancelled jobs from the superseded 5c8f10f0b8 run, not failures.

Approving.