Fix: cuga integration

[Adam-Aghili]

Summary by CodeRabbit

• New Features

  • Added MCP Streamable HTTP transport alongside existing SSE for improved messaging protocol support.
  • Extended model provider support including IBM watsonx.ai and Ollama integrations.

• Security & Authentication

  • Enforced authentication across multiple API endpoints for improved access control.
  • Enhanced file handling with path traversal protections for profile pictures and downloads.

• Bug Fixes

  • Improved session management in chat components with fallback logic.
  • Fixed API key access control to return consistent error responses.

• Chores

  • Updated dependencies including FastAPI and language model libraries.
  • Refined starter project components with updated documentation references.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Large multi-faceted update introducing MCP Streamable HTTP transport, authentication enforcement across API endpoints, session/message handling refinements in chat components, startup project template updates with component behavior changes and provider expansion, and miscellaneous dependency/configuration adjustments.

Changes

Cohort / File(s)	Summary
Configuration & Workflows .env.example, .github/workflows/cross-platform-test.yml, .github/workflows/nightly_build.yml, .github/workflows/release.yml, .github/workflows/release_nightly.yml	Added LANGFLOW_API_KEY_SOURCE and LANGFLOW_API_KEY environment variables; added --prerelease=allow flag to uv pip install commands; removed uv lock invocation from lfx directory in nightly build; switched release pre-release check to use inputs.release_tag instead of repository-derived version; added --no-sources flag to nightly base build command.
Dependency & Secrets pyproject.toml, .secrets.baseline	Updated cuga constraint to ~=0.2.5; updated agent-lifecycle-toolkit to ~=0.4.4; expanded secrets baseline with new Hex High Entropy String entries across starter projects and adjusted line number reference in auth utils.
API Authentication & Authorization src/backend/base/langflow/api/log_router.py, src/backend/base/langflow/api/v1/chat.py, src/backend/base/langflow/api/v1/endpoints.py, src/backend/base/langflow/api/v1/users.py, src/backend/base/langflow/api/v1/validate.py, src/backend/base/langflow/api/v2/registration.py, src/backend/base/langflow/api/v1/monitor.py	Added Depends(get_current_active_user) to log streaming/retrieval endpoints, build operation endpoints, config endpoint, user creation, validation endpoints, and monitor endpoints; implemented user-aware filtering for message sessions and messages.
File Handling & Security src/backend/base/langflow/api/v1/files.py, src/backend/base/langflow/api/v2/files.py, src/backend/base/langflow/api/utils/core.py	Enhanced profile picture path traversal protections; consolidated download/image endpoints to use Flow dependency; refactored download_file/download_image signatures; improved error handling with 404 for unauthorized access; added KeyError guard in remove_api_keys; fixed v2 file download with pre-flight existence check and streaming wrapper.
MCP Transport & Infrastructure src/backend/base/langflow/api/v1/mcp.py, src/backend/base/langflow/api/utils/mcp/__init__.py, src/backend/base/langflow/api/utils/mcp/config_utils.py	Introduced Streamable HTTP transport with ResponseNoOp wrapper and StreamableHTTP manager class; added lifecycle management (start/stop functions); exposed streamable URL builders (get_project_streamable_http_url, get_composer_streamable_http_url); refactored SSE URL generation to use base component helpers; updated MCP starter project auto-configuration to use streamable HTTP URLs.
MCP Projects & Session Management src/backend/base/langflow/api/v1/mcp_projects.py, src/backend/base/langflow/api/v1/projects.py, src/backend/base/langflow/api/v1/mcp_utils.py	Added per-project StreamableHTTPSessionManager and ProjectTaskGroup for lifecycle coordination; refactored project tools response to use internal _build_project_tools_response; updated get_project_composer_url to return ComposerUrlResponse with streamable/legacy URLs; replaced SSE URL matching with generalized server URL checking; added user-scoped resource listing with download endpoint path updates.
Schemas & Types src/backend/base/langflow/api/v1/schemas.py	Added ComposerUrlResponse model with project_id, uses_composer, streamable_http_url, legacy_sse_url, and error_message fields; extended MCPInstallRequest with optional transport field.
Flow Helpers src/backend/base/langflow/helpers/flow.py	Added list_flows_by_flow_folder, list_flows_by_folder_id, and get_flow_by_id_or_name functions with sortable parameters; introduced SORT_DISPATCHER mapping for asc/desc ordering.
Core Backend src/backend/base/langflow/__main__.py	Removed debug log statement in set_var_for_macos_issue.
Starter Projects src/backend/base/langflow/initial_setup/starter_projects/\*.json (13 files)	Comprehensive updates across all starter templates: updated code hashes and dependencies (fastapi 0.120.0 → 0.123.0, langchain_cohere 0.3.3 → 0.3.5); enhanced ChatInput/ChatOutput with improved session_id handling and source building; expanded LanguageModelComponent with fetch_ibm_models and IBM watsonx.ai/Ollama support; refactored FileComponent with Docling-based processing (subprocess, OCR, markdown output); extended Agent components with provider-specific UI metadata and new fields (override_skip, track_in_telemetry, external_options); updated documentation URLs.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant API Endpoint
    participant Auth Middleware
    participant Streamable HTTP Manager
    participant MCP Server
    
    Client->>API Endpoint: /build/{flow_id}/vertices
    API Endpoint->>Auth Middleware: Depends(get_current_active_user)
    alt User Authenticated
        Auth Middleware-->>API Endpoint: CurrentUser
        API Endpoint->>Streamable HTTP Manager: ensure_session_manager_running()
        Streamable HTTP Manager->>MCP Server: POST /streamable (request)
        MCP Server-->>Streamable HTTP Manager: Response (protocol)
        Streamable HTTP Manager-->>API Endpoint: StreamableHTTPSessionManager active
        API Endpoint-->>Client: 200 Vertices
    else User Not Authenticated
        Auth Middleware-->>API Endpoint: HTTPException 401
        API Endpoint-->>Client: 401 Unauthorized
    end

Loading

sequenceDiagram
    participant Flow User
    participant Chat Endpoint
    participant ChatInput Component
    participant ChatOutput Component
    participant Message Store
    
    Flow User->>Chat Endpoint: POST message
    Chat Endpoint->>ChatInput Component: process input
    ChatInput Component->>ChatInput Component: derive session_id (local/graph context)
    ChatInput Component->>Message Store: create Message(session_id=derived_id)
    Message Store-->>ChatInput Component: Message stored
    ChatInput Component-->>Chat Endpoint: ChatInput.message_response
    Chat Endpoint->>ChatOutput Component: receive ChatInput output
    ChatOutput Component->>ChatOutput Component: preserve/derive session_id from context
    ChatOutput Component->>Message Store: create/update Message(session_id=derived_id)
    Message Store-->>ChatOutput Component: Message persisted
    ChatOutput Component-->>Chat Endpoint: ChatOutput.message_response
    Chat Endpoint-->>Flow User: Message response

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

• MCP transport architecture: New Streamable HTTP transport class, lifecycle managers, and session coordination across mcp.py, mcp_projects.py, config_utils.py require careful review of initialization, error handling, and interaction with existing SSE paths.
• Authentication wiring across endpoints: Multiple API files (chat.py, files.py, monitor.py, endpoints.py, users.py, validate.py) adding dependency-based auth; verify consistency and that authorization checks are not bypassed elsewhere.
• File security refactoring in v1/files.py: Path traversal protections, Flow dependency injection replacing direct flow_id parameters, profile picture folder validation—requires verification of all access paths.
• Starter project JSON updates: 13 files with complex interdependent changes to ChatInput/ChatOutput session handling, FileComponent Docling integration, and Agent provider ecosystem; substantial logic density in embedded code blocks.
• Session ID derivation logic: New fallback chains (self.session_id or graph.session_id or default) in multiple chat components and across files; verify consistency and no session ID losses in edge cases.

Possibly related PRs

• fix: Add authentication to various endpoints #10977: Adds authentication/dependency wiring to the same API endpoints (chat.py, files.py, endpoints.py, monitor.py, users.py, registration.py).
• feat: adds streamable http instead of sse on mcp client #10157: Both PRs migrate MCP transport from SSE to Streamable HTTP, replacing MCPSseClient with new Streamable HTTP handlers and updating routes/session management.
• fix: For every component that uses an LLM input, replace with the new LLM selector #9966: Both modify starter project JSONs (e.g., Instagram Copywriter) to add external_options/provider metadata and adjust agent_llm configurations.

Suggested labels

lgtm, backend, api-changes, security, mcp, chat-components

Suggested reviewers

• jordanrfrazier
• lucaseduoli

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch sami-cuga-fix

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 24dbc60 and b17adfa.

⛔ Files ignored due to path filters (2)

• src/frontend/package-lock.json is excluded by !**/package-lock.json
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (41)

• .env.example (1 hunks)
• .github/workflows/cross-platform-test.yml (5 hunks)
• .github/workflows/nightly_build.yml (0 hunks)
• .github/workflows/release.yml (1 hunks)
• .github/workflows/release_nightly.yml (1 hunks)
• .secrets.baseline (3 hunks)
• pyproject.toml (1 hunks)
• src/backend/base/langflow/__main__.py (0 hunks)
• src/backend/base/langflow/api/log_router.py (3 hunks)
• src/backend/base/langflow/api/utils/core.py (1 hunks)
• src/backend/base/langflow/api/utils/mcp/__init__.py (1 hunks)
• src/backend/base/langflow/api/utils/mcp/config_utils.py (6 hunks)
• src/backend/base/langflow/api/v1/chat.py (4 hunks)
• src/backend/base/langflow/api/v1/endpoints.py (2 hunks)
• src/backend/base/langflow/api/v1/files.py (7 hunks)
• src/backend/base/langflow/api/v1/mcp.py (4 hunks)
• src/backend/base/langflow/api/v1/mcp_projects.py (28 hunks)
• src/backend/base/langflow/api/v1/mcp_utils.py (6 hunks)
• src/backend/base/langflow/api/v1/monitor.py (6 hunks)
• src/backend/base/langflow/api/v1/projects.py (4 hunks)
• src/backend/base/langflow/api/v1/schemas.py (1 hunks)
• src/backend/base/langflow/api/v1/users.py (1 hunks)
• src/backend/base/langflow/api/v1/validate.py (2 hunks)
• src/backend/base/langflow/api/v2/files.py (3 hunks)
• src/backend/base/langflow/api/v2/registration.py (2 hunks)
• src/backend/base/langflow/helpers/flow.py (3 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json (5 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json (5 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json (9 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json (7 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Document Q&A.json (9 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Financial Report Parser.json (10 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Image Sentiment Analysis.json (8 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json (25 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json (23 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Knowledge Ingestion.json (5 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json (6 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json (13 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Memory Chatbot.json (7 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json (23 hunks)
• src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json (23 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}