fix: Add authentication to various endpoints

[erichare]

This pull request introduces several security and access control improvements across the API endpoints, primarily by enforcing user authentication and authorization checks. The changes ensure that sensitive operations and data are only accessible to authenticated users, and in some cases, to users with specific roles (e.g., superusers). Additionally, input validation has been strengthened to prevent security vulnerabilities such as path traversal attacks.

Authentication and Authorization Enforcement:

• Most API endpoints in chat.py, files.py, models.py, monitor.py, users.py, and registration.py now require a CurrentActiveUser or superuser for access, preventing unauthorized actions such as viewing configuration, accessing build events, downloading files/images, and creating users. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

Fine-Grained Access Control:

• File and image download endpoints in files.py now verify that the requesting user owns the flow before allowing access, returning appropriate HTTP errors if access is denied. [1] [2]

Input Validation and Security Hardening:

• The download_profile_picture endpoint in files.py adds strict validation to prevent path traversal attacks by checking for invalid folder and file names and ensuring resolved paths remain within allowed directories.

Role-Based Restrictions:

• The user creation endpoint in users.py now requires superuser authentication, restricting account creation to authorized personnel only.

General API Security Improvements:

• Endpoints for configuration retrieval, model provider listing, build monitoring, and registration now require authentication, reducing the risk of sensitive information exposure. [1] [2] [3] [4]

Summary by CodeRabbit

• Security
  • Strengthened authentication requirements across API endpoints
  • Added access controls to file download operations
  • Implemented path validation protections for file operations
  • Enforced superuser-only access for user management operations

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Authentication and authorization requirements are added across multiple API endpoints. The changes include adding authenticated user dependencies to endpoint signatures in chat, files, models, monitor, and registration modules, plus enforcing superuser-level access for user creation and implementing owner-based access control for file operations with path traversal prevention.

Changes

Cohort / File(s)	Summary
Chat endpoints src/backend/base/langflow/api/v1/chat.py	Added current_user: CurrentActiveUser parameter to retrieve_vertices_order, get_build_events, cancel_build, and build_vertex_stream endpoints for authentication.
Configuration endpoint src/backend/base/langflow/api/v1/endpoints.py	Added dependencies=[Depends(get_current_active_user)] to /config endpoint router decorator to enforce authentication.
File operations src/backend/base/langflow/api/v1/files.py	Enhanced download_file and download_image with access control requiring current user ownership validation; added path traversal prevention and input validation to download_profile_picture with resolved path checks.
Model providers endpoint src/backend/base/langflow/api/v1/models.py	Added current_user: CurrentActiveUser parameter to list_model_providers for authentication.
Monitor endpoints src/backend/base/langflow/api/v1/monitor.py	Added dependencies=[Depends(get_current_active_user)] to GET and DELETE /monitor/builds endpoints.
User creation endpoint src/backend/base/langflow/api/v1/users.py	Added current_user: Annotated[User, Depends(get_current_active_superuser)] parameter to add_user to enforce superuser-level access.
Registration endpoint src/backend/base/langflow/api/v2/registration.py	Added dependencies=[Depends(get_current_active_user)] to GET / endpoint router decorator.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

• Extra attention areas:
  • src/backend/base/langflow/api/v1/files.py — verify path traversal prevention logic and ownership validation are correct
  • src/backend/base/langflow/api/v1/users.py — confirm superuser requirement is appropriately enforced

Suggested labels

security, authentication, size:M

Suggested reviewers

• ogabrielluiz
• jordanrfrazier

Pre-merge checks and finishing touches

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Test Coverage For New Implementations	❌ Error	PR adds authentication to 7 API endpoints but existing test files contain no tests for new authentication functionality, 401/403 responses, or file ownership validation.	Add test cases verifying authentication requirements, 401/403 responses, file ownership validation, and superuser enforcement for modified endpoints.
Docstring Coverage	⚠️ Warning	Docstring coverage is 73.33% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.
Test Quality And Coverage	⚠️ Warning	PR adds critical authentication enforcement to seven API endpoints without any corresponding test coverage.	Add pytest test cases covering: unauthenticated requests return 401/403 errors; authenticated users can access endpoints; file/flow endpoints enforce ownership checks; add_user rejects non-superuser; path traversal prevention tested; proper async/await patterns used.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: Add authentication to various endpoints' directly and accurately describes the main focus of the pull request—adding authentication requirements across multiple API endpoints.
Test File Naming And Structure	✅ Passed	Repository demonstrates proper test file naming conventions, logical organization, and comprehensive test coverage across backend and frontend with appropriate pytest and Playwright structures.
Excessive Mock Usage Warning	✅ Passed	No test files are included in this PR. The changes only modify API endpoint files to add authentication, with no test file modifications or mock usage present.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 32.95%. Comparing base (9d57aa8) to head (e8c4095).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/backend/base/langflow/api/v1/files.py	72.54%	14 Missing ⚠️
src/backend/base/langflow/api/v2/files.py	0.00%	2 Missing ⚠️

❌ Your project status has failed because the head coverage (39.26%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10977      +/-   ##
==========================================
+ Coverage   32.92%   32.95%   +0.02%     
==========================================
  Files        1387     1387              
  Lines       65420    65452      +32     
  Branches     9680     9680              
==========================================
+ Hits        21540    21568      +28     
- Misses      42782    42787       +5     
+ Partials     1098     1097       -1     

Flag	Coverage Δ
backend	52.11% <78.94%> (+0.05%)	⬆️
frontend	15.16% <ø> (ø)
lfx	39.26% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/api/log_router.py	25.00% <100.00%> (+1.27%)	⬆️
src/backend/base/langflow/api/v1/chat.py	39.83% <100.00%> (+0.25%)	⬆️
src/backend/base/langflow/api/v1/endpoints.py	71.82% <100.00%> (ø)
src/backend/base/langflow/api/v1/models.py	29.61% <100.00%> (+0.22%)	⬆️
src/backend/base/langflow/api/v1/monitor.py	49.19% <100.00%> (ø)
src/backend/base/langflow/api/v1/users.py	66.66% <ø> (ø)
src/backend/base/langflow/api/v1/validate.py	75.00% <100.00%> (ø)
src/backend/base/langflow/api/v2/registration.py	91.46% <100.00%> (+0.10%)	⬆️
src/backend/base/langflow/api/v2/files.py	62.80% <0.00%> (ø)
src/backend/base/langflow/api/v1/files.py	66.86% <72.54%> (+3.09%)	⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	16.42% (4606/28041)	9.73% (2106/21644)	10.76% (664/6166)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
1803	0 💤	0 ❌	0 🔥	24.448s ⏱️

[ogabrielluiz]

I'm not sure this is allowed

[erichare]

I've updated this to not require auth - which i think is safe. Look good now @ogabrielluiz ?