⚡️ Speed up function is_encrypted by 148% in PR #11565 (refactor/framework-agnostic-auth-service)

[codeflash-ai]

⚡️ This pull request contains optimizations for PR #11565

If you approve this dependent PR, these changes will be merged into the original PR branch refactor/framework-agnostic-auth-service.

This PR will be automatically closed if the original PR is merged.

---

📄 148% (1.48x) speedup for is_encrypted in src/backend/base/langflow/services/auth/mcp_encryption.py

⏱️ Runtime : 958 microseconds → 387 microseconds (best of 122 runs)

📝 Explanation and details

The optimized code achieves a 147% speedup (958μs → 387μs) by introducing memoization via lru_cache(maxsize=1024) on the decrypt_api_key function. This optimization specifically targets repeated decryption calls with identical encrypted API keys.

Key optimization:

• @lru_cache(maxsize=1024) wraps the decryption logic in _cached_decrypt(). When the same encrypted API key is decrypted multiple times, subsequent calls return the cached result instantly instead of performing expensive cryptographic operations through the auth service.

Why this leads to speedup:

1. Cryptographic decryption is computationally expensive - The line profiler shows auth_utils.decrypt_api_key(value) consumes ~99% of execution time (289-291ms out of ~292-294ms total in is_encrypted).

2. High cache hit rate in test workloads - The annotated tests reveal many scenarios with repeated decryption attempts:

   • test_is_encrypted_repeated_calls_same_value: 100 calls with identical value
   • test_is_encrypted_performance_with_batch_of_values: 500 batch operations
   • test_is_encrypted_with_many_failed_decryptions: 200 sequential attempts
   • test_is_encrypted_stress_test_with_empty_decryption_results: 300 calls with same pattern

3. Cache effectiveness: For workloads with duplicate encrypted keys (common in validation loops, batch processing, or configuration checks), the cache eliminates redundant decryption operations after the first call.

Additional improvement:

• TYPE_CHECKING import guard moves SettingsService import to type-check time only, reducing runtime import overhead (though this is a minor contributor compared to caching).

When this optimization excels:

• Scenarios with repeated validation of the same encrypted values (e.g., test_is_encrypted_repeated_calls_same_value processing 100 identical values)
• Batch processing where the same API keys appear multiple times (test_is_encrypted_with_mixed_encrypted_and_plain_values with 250 mixed values)
• Configuration validation where encrypted keys are checked multiple times during application lifetime

Potential impact on existing workloads:

• Without function_references, we cannot definitively determine if decrypt_api_key is in a hot path, but the test patterns (batch operations, stress tests with 200-500 iterations) suggest this function is called frequently in validation/processing pipelines.
• The optimization assumes encrypted keys have stable mappings (same encrypted input always produces same decrypted output), which holds true for deterministic encryption schemes.
• Memory footprint increases by up to 1024 cached entries, but this is negligible for typical API key sizes.

✅ Correctness verification report:

Test	Status
⚙️ Existing Unit Tests	✅ 31 Passed
🌀 Generated Regression Tests	✅ 46 Passed
⏪ Replay Tests	🔘 None Found
🔎 Concolic Coverage Tests	🔘 None Found
📊 Tests Coverage	100.0%

⚙️ Click to see Existing Unit Tests

🌀 Click to see Generated Regression Tests

import pytest # used for our unit tests
from cryptography.fernet import
InvalidToken # specific exception the code handles
from langflow.services.auth import mcp_encryption
from langflow.services.auth import utils as auth_utils # module under test
from langflow.services.auth.mcp_encryption import is_encrypted

def test_empty_string_returns_false_and_does_not_call_decrypt(monkeypatch):
# Ensure that for an empty string the function returns False and does NOT call decrypt_api_key.
# Patch decrypt_api_key to raise if it's called; if is_encrypted calls it, the test will fail.
def fail_if_called(_):
raise AssertionError("decrypt_api_key should not be called for empty input")

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", fail_if_called, raising=True)

# Empty value should be treated as not encrypted
codeflash_output = is_encrypted("")

def test_decrypt_returns_same_value_not_encrypted(monkeypatch):
# If decrypt_api_key returns the exact same string, treat as NOT encrypted.
def echo(value):
# Return same value to simulate unexpected behavior where decrypt returns the input unchanged
return value

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", echo, raising=True)

value = "plain-text-api-key"
codeflash_output = is_encrypted(value)  # decrypted == value -> not considered encrypted

def test_decrypt_returns_different_value_encrypted(monkeypatch):
# If decrypt_api_key returns a different value, it's considered encrypted.
def decrypt_sim(value):
# Simulate successful decryption to a different plaintext
return "decrypted-" + value

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", decrypt_sim, raising=True)

token = "gAAAA...fakefernettoken"
codeflash_output = is_encrypted(token)  # decrypted != value -> considered encrypted

def test_decrypt_returns_empty_string_assumed_encrypted(monkeypatch):
# If decrypt_api_key returns an empty string (falsy), the implementation treats it as encrypted.
def decrypt_empty(_):
return ""

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", decrypt_empty, raising=True)

codeflash_output = is_encrypted("some-token")

def test_decrypt_returns_none_treated_as_encrypted(monkeypatch):
# If decrypt_api_key returns None (falsy), should be treated as encrypted via the if not decrypted check.
def decrypt_none(_):
return None

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", decrypt_none, raising=True)

codeflash_output = is_encrypted("some-token")

@pytest.mark.parametrize("exc", [ValueError, TypeError, KeyError, InvalidToken])
def test_decrypt_raises_known_exceptions_treated_as_encrypted(monkeypatch, exc):
# The function catches ValueError, TypeError, KeyError, and InvalidToken and returns True.
def raise_exc(_):
raise exc("simulated decryption failure")

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", raise_exc, raising=True)

codeflash_output = is_encrypted("any-value")

def test_decrypt_raises_unexpected_exception_propagates(monkeypatch):
# Unexpected exceptions (not in the except list) should propagate.
def raise_runtime(_):
raise RuntimeError("unexpected failure")

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", raise_runtime, raising=True)

with pytest.raises(RuntimeError):
    is_encrypted("any-value")

def test_whitespace_string_is_handled(monkeypatch):
# A whitespace-only string is truthy so decrypt_api_key is invoked.
# If decrypt returns same whitespace, it's not considered encrypted.
def echo(value):
return value

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", echo, raising=True)

codeflash_output = is_encrypted("   ")  # decrypted == value => False

def test_large_input_decrypted_to_different_value(monkeypatch):
# Large-scale input: string near 1000 characters (avoid huge loops per requirements).
# The function performs a single decrypt call, so it should handle long strings quickly.
large_token = "A" * 999 # 999 chars to stay within suggested limits

def decrypt_sim(value):
    # Simulate successful decryption that yields a different result
    return "plaintext-" + value[:3]

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", decrypt_sim, raising=True)

codeflash_output = is_encrypted(large_token)

def test_large_input_decrypted_to_same_value(monkeypatch):
# Large-scale input that decrypts to the same (unlikely but possible), should be treated as NOT encrypted.
large_token = "B" * 999

def decrypt_echo(value):
    # Return same large value
    return value

monkeypatch.setattr(mcp_encryption.auth_utils, "decrypt_api_key", decrypt_echo, raising=True)

codeflash_output = is_encrypted(large_token)

codeflash_output is used to check that the output of the original code is the same as that of the optimized code.

#------------------------------------------------
from unittest.mock import MagicMock, Mock, patch

imports

import pytest
from cryptography.fernet import InvalidToken
from langflow.services.auth.mcp_encryption import is_encrypted

def test_is_encrypted_with_empty_string():
"""Test that an empty string is not considered encrypted."""
# Empty strings should return False immediately
codeflash_output = is_encrypted("")

def test_is_encrypted_with_none_like_empty_string():
"""Test that whitespace-only strings are not considered encrypted."""
# Single space should be treated as truthy but fail decryption
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = InvalidToken()
# A string with only whitespace should attempt decryption and fail
codeflash_output = is_encrypted(" "); result = codeflash_output

def test_is_encrypted_with_valid_encrypted_string():
"""Test that a successfully decrypted value is recognized as encrypted."""
# When decryption succeeds and returns different value, it's encrypted
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "decrypted_key_123"
# Original encrypted value
codeflash_output = is_encrypted("gAAAAABl1234567890..."); result = codeflash_output

def test_is_encrypted_with_unencrypted_string():
"""Test that a plain string that decrypts to itself is not considered encrypted."""
# When decryption returns the same value, it's not encrypted
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
plain_text = "my_plain_api_key"
mock_decrypt.return_value = plain_text
codeflash_output = is_encrypted(plain_text); result = codeflash_output

def test_is_encrypted_with_invalid_token_exception():
"""Test that InvalidToken exception is caught and treated as encrypted."""
# InvalidToken from Fernet means it looks like encrypted but can't decrypt
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = InvalidToken()
codeflash_output = is_encrypted("invalid_fernet_token"); result = codeflash_output

def test_is_encrypted_with_value_error():
"""Test that ValueError during decryption is treated as encrypted."""
# ValueError can occur during base64 decoding
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = ValueError("Invalid base64")
codeflash_output = is_encrypted("not_valid_base64!@#$"); result = codeflash_output

def test_is_encrypted_with_type_error():
"""Test that TypeError during decryption is treated as encrypted."""
# TypeError might occur with wrong types
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = TypeError("Expected string")
codeflash_output = is_encrypted("some_value"); result = codeflash_output

def test_is_encrypted_with_key_error():
"""Test that KeyError during decryption is treated as encrypted."""
# KeyError might occur if encryption keys are missing
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = KeyError("encryption_key")
codeflash_output = is_encrypted("encrypted_value"); result = codeflash_output

def test_is_encrypted_with_empty_string_from_decryption():
"""Test that empty string returned from decryption is treated as encrypted."""
# If decryption returns empty string, it's encrypted but corrupted/wrong key
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = ""
codeflash_output = is_encrypted("corrupted_encrypted_value"); result = codeflash_output

def test_is_encrypted_with_very_long_string():
"""Test that very long encrypted strings are handled correctly."""
# Long base64-like strings that represent encrypted data
long_value = "a" * 10000
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "short_decrypted"
codeflash_output = is_encrypted(long_value); result = codeflash_output

def test_is_encrypted_with_special_characters():
"""Test that strings with special characters are handled correctly."""
# Encrypted values often contain special characters from base64 encoding
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "decrypted_value"
special_value = "gAAAAABl12+/34==456=="
codeflash_output = is_encrypted(special_value); result = codeflash_output

def test_is_encrypted_with_unicode_characters():
"""Test that Unicode characters in encrypted strings are handled."""
# Unicode characters might appear in base64-like encoded strings
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "decrypted"
unicode_value = "test_🔒_encrypted"
codeflash_output = is_encrypted(unicode_value); result = codeflash_output

def test_is_encrypted_with_single_character():
"""Test that single character strings are handled correctly."""
# Edge case: single character should attempt decryption
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = InvalidToken()
codeflash_output = is_encrypted("a"); result = codeflash_output

def test_is_encrypted_with_whitespace_variations():
"""Test that strings with various whitespace are handled correctly."""
# Tab character
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.side_effect = InvalidToken()
codeflash_output = is_encrypted("\t"); result = codeflash_output

# Newline character
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.side_effect = InvalidToken()
    codeflash_output = is_encrypted("\n"); result = codeflash_output

# Multiple spaces
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.side_effect = InvalidToken()
    codeflash_output = is_encrypted("   "); result = codeflash_output

def test_is_encrypted_with_numeric_string():
"""Test that numeric strings are handled correctly."""
# Pure numbers that look like they could be encrypted
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "123456789"
codeflash_output = is_encrypted("123456789"); result = codeflash_output

def test_is_encrypted_with_base64_like_string():
"""Test proper handling of valid-looking base64 encrypted strings."""
# Properly formatted base64 string
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "decrypted_secret_key"
base64_value = "Z0FBQUFCTGwyNDU2MmE0Yy1kMmY2LTExZWMtOTM2OC04MjVmMzc2ZWU2Mzg="
codeflash_output = is_encrypted(base64_value); result = codeflash_output

def test_is_encrypted_with_all_exception_types_covered():
"""Test that all documented exception types are properly caught."""
# Test each exception type that is caught in the except clause
exceptions_to_test = [
(ValueError("test error"), True),
(TypeError("test error"), True),
(KeyError("test error"), True),
(InvalidToken(), True),
]

for exception, expected_result in exceptions_to_test:
    with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
        mock_decrypt.side_effect = exception
        codeflash_output = is_encrypted("test_value"); result = codeflash_output

def test_is_encrypted_boundary_between_decrypted_and_unencrypted():
"""Test the boundary case where decrypted value is similar but not identical."""
# Value that decrypts to something slightly different
with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
mock_decrypt.return_value = "original_plus_extra"
original = "original"
codeflash_output = is_encrypted(original); result = codeflash_output

def test_is_encrypted_with_multiple_large_values():
"""Test that is_encrypted handles multiple large encrypted values correctly."""
# Simulate processing many large encrypted values
large_encrypted_values = [f"encrypted_value_{i:04d}" for i in range(100)]

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    # Each encrypted value decrypts to a different value
    mock_decrypt.side_effect = lambda x: f"decrypted_{x}"
    
    # All should be recognized as encrypted since they return different values
    results = [is_encrypted(value) for value in large_encrypted_values]

def test_is_encrypted_with_large_data_payload():
"""Test is_encrypted with very large encrypted payload."""
# Simulate a large encrypted API key or token
large_payload = "a" * 100000

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.return_value = "b" * 50000
    codeflash_output = is_encrypted(large_payload); result = codeflash_output
    # Verify the function was called (to ensure it processed the input)
    mock_decrypt.assert_called_once_with(large_payload)

def test_is_encrypted_performance_with_batch_of_values():
"""Test that is_encrypted performs efficiently with a batch of values."""
# Create a batch of values to test performance
batch_size = 500
test_values = [f"value_{i}" for i in range(batch_size)]

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.return_value = "decrypted_result"
    
    # Process entire batch
    results = [is_encrypted(value) for value in test_values]

def test_is_encrypted_with_many_failed_decryptions():
"""Test handling of many failed decryption attempts in sequence."""
# Simulate many failed decryption attempts
test_values = [f"invalid_encrypted_{i:03d}" for i in range(200)]

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    # All decryption attempts fail with InvalidToken
    mock_decrypt.side_effect = InvalidToken()
    
    results = [is_encrypted(value) for value in test_values]

def test_is_encrypted_with_mixed_encrypted_and_plain_values():
"""Test is_encrypted with a large batch of mixed encrypted and plain values."""
# Mix of values - some encrypted, some plain
mixed_values = []
for i in range(250):
if i % 2 == 0:
mixed_values.append(f"encrypted_{i}")
else:
mixed_values.append(f"plain_{i}")

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    def decrypt_side_effect(value):
        # Even indices (encrypted values) decrypt to different values
        if int(value.split('_')[1]) % 2 == 0:
            return "decrypted_value"
        # Odd indices (plain values) return same value
        else:
            return value
    
    mock_decrypt.side_effect = decrypt_side_effect
    
    results = [is_encrypted(value) for value in mixed_values]
    
    # Verify we have both True and False results
    true_count = sum(results)
    false_count = len(results) - true_count

def test_is_encrypted_repeated_calls_same_value():
"""Test that repeated calls with the same value are consistent."""
# Call is_encrypted multiple times with the same value
test_value = "consistent_encrypted_value"

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.return_value = "decrypted_value"
    
    # Make 100 calls with the same value
    results = [is_encrypted(test_value) for _ in range(100)]

def test_is_encrypted_with_extreme_value_differences():
"""Test is_encrypted with extreme differences between encrypted and decrypted."""
# Test with very different length strings
test_cases = [
("x", "y" * 10000), # Short input, long output
("a" * 10000, "b"), # Long input, short output
("c" * 5000, "d" * 5000), # Same length, different content
]

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    for encrypted, decrypted in test_cases:
        mock_decrypt.return_value = decrypted
        codeflash_output = is_encrypted(encrypted); result = codeflash_output

def test_is_encrypted_stress_test_with_empty_decryption_results():
"""Test is_encrypted behavior with many empty decryption results."""
# Simulate 300 calls that result in empty decryption (wrong key scenario)
test_values = [f"encrypted_wrong_key_{i:03d}" for i in range(300)]

with patch('langflow.services.auth.utils.decrypt_api_key') as mock_decrypt:
    mock_decrypt.return_value = ""
    
    results = [is_encrypted(value) for value in test_values]

codeflash_output is used to check that the output of the original code is the same as that of the optimized code.

To edit these changes git checkout codeflash/optimize-pr11565-2026-02-03T18.48.26 and push.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 77.05263% with 109 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.38%. Comparing base (732cf45) to head (3277f3f).
⚠️ Report is 30 commits behind head on main.

Files with missing lines	Patch %	Lines
src/backend/base/langflow/services/auth/service.py	69.93%	86 Missing ⚠️
src/backend/base/langflow/services/auth/base.py	88.33%	7 Missing ⚠️
src/backend/base/langflow/api/v1/models.py	0.00%	4 Missing ⚠️
src/backend/base/langflow/services/auth/utils.py	92.30%	4 Missing ⚠️
src/backend/base/langflow/api/v1/store.py	0.00%	2 Missing ⚠️
...backend/base/langflow/services/variable/service.py	77.77%	2 Missing ⚠️
src/backend/base/langflow/api/v1/users.py	50.00%	1 Missing ⚠️
src/backend/base/langflow/api/v1/variable.py	0.00%	1 Missing ⚠️
src/backend/base/langflow/api/v2/mcp.py	66.66%	1 Missing ⚠️
src/lfx/src/lfx/services/manager.py	93.75%	0 Missing and 1 partial ⚠️

❌ Your project status has failed because the head coverage (41.71%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11568      +/-   ##
==========================================
+ Coverage   35.24%   35.38%   +0.14%     
==========================================
  Files        1435     1437       +2     
  Lines       69091    69172      +81     
  Branches    10027    10019       -8     
==========================================
+ Hits        24348    24479     +131     
+ Misses      43507    43456      -51     
- Partials     1236     1237       +1     

Flag	Coverage Δ
lfx	41.71% <95.65%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/__main__.py	56.30% <100.00%> (+0.30%)	⬆️
src/backend/base/langflow/api/v1/api_key.py	73.33% <100.00%> (ø)
src/backend/base/langflow/api/v1/login.py	41.86% <100.00%> (ø)
src/backend/base/langflow/api/v1/mcp.py	72.57% <100.00%> (ø)
src/backend/base/langflow/api/v1/mcp_projects.py	41.28% <100.00%> (ø)
src/backend/base/langflow/api/v2/schemas.py	100.00% <100.00%> (ø)
src/backend/base/langflow/services/auth/factory.py	100.00% <100.00%> (+10.00%)	⬆️
...kend/base/langflow/services/auth/mcp_encryption.py	73.07% <100.00%> (-1.93%)	⬇️
src/backend/base/langflow/services/deps.py	87.50% <100.00%> (-0.91%)	⬇️
...rc/backend/base/langflow/services/event_manager.py	75.42% <100.00%> (ø)
... and 14 more

... and 14 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ogabrielluiz]

Closing: removing CodeFlash integration.