fix: fixes auth check for auto_login

[jordanrfrazier]

Fixes auth check when AUTO_LOGIN is true.

Summary by CodeRabbit

• New Features

  • Updated application and package versions to 1.5.0 for improved compatibility.

• Bug Fixes

  • Improved authentication behavior to handle scenarios where auto-login is skipped and no API key is provided, resulting in more consistent user validation.

[coderabbitai]

Walkthrough

The changes update the version numbers for the "langflow" project and its "langflow-base" dependency in configuration files. Additionally, the api_key_security function in the backend is modified to immediately return a validated user when auto-login is enabled and no API key is provided, and its internal logic is simplified.

Changes

File(s)	Change Summary
pyproject.toml, src/frontend/package.json, src/backend/base/pyproject.toml	Updated project and dependency version numbers: "langflow" to 1.5.0, "langflow-base" to 0.5.0.
src/backend/base/langflow/services/auth/utils.py	Modified api_key_security to return early when auto-login is enabled and no API key is provided; simplified logic.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant api_key_security
    participant UserRead

    Client->>api_key_security: Request with/without API key
    alt skip_auth_auto_login enabled and no API key
        api_key_security-->>Client: Return validated UserRead
    else API key present
        api_key_security->>api_key_security: check_key(API key)
        alt Valid API key
            api_key_security-->>Client: Return validated UserRead
        else Invalid API key
            api_key_security-->>Client: Raise HTTPException
        end
    end

Loading

Possibly related PRs

• feat(auth): update AUTO_LOGIN authentication to enforce API key or JWT requirement #8513: Modifies the api_key_security function to change API key authentication and AUTO_LOGIN behavior, indicating a direct code-level connection.

Suggested labels

size:S, lgtm

Suggested reviewers

• ogabrielluiz

---

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ca613f5 and 9c5943a.

⛔ Files ignored due to path filters (2)

• src/frontend/package-lock.json is excluded by !**/package-lock.json
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• pyproject.toml (2 hunks)
• src/backend/base/langflow/services/auth/utils.py (2 hunks)
• src/backend/base/pyproject.toml (1 hunks)
• src/frontend/package.json (1 hunks)

🧰 Additional context used

📓 Path-based instructions (3)

`src/frontend/{package*.json,tsconfig.json,tailwind.config.*,vite.config.*}`: Fr...

src/frontend/{package*.json,tsconfig.json,tailwind.config.*,vite.config.*}: Frontend configuration files such as 'package.json', 'tsconfig.json', 'tailwind.config.', and 'vite.config.' must be present and properly maintained in 'src/frontend/'.

📄 Source: CodeRabbit Inference Engine (.cursor/rules/frontend_development.mdc)

List of files the instruction was applied to:

• src/frontend/package.json

`{uv.lock,pyproject.toml}`: Use uv (>=0.4) as the Python package manager for dependency management

{uv.lock,pyproject.toml}: Use uv (>=0.4) as the Python package manager for dependency management

📄 Source: CodeRabbit Inference Engine (.cursor/rules/backend_development.mdc)

List of files the instruction was applied to:

• pyproject.toml

`src/backend/**/*.py`: Run make format_backend to format Python code early and often Run make lint to check for linting issues in backend Python code

src/backend/**/*.py: Run make format_backend to format Python code early and often
Run make lint to check for linting issues in backend Python code

📄 Source: CodeRabbit Inference Engine (.cursor/rules/backend_development.mdc)

List of files the instruction was applied to:

• src/backend/base/langflow/services/auth/utils.py

🧠 Learnings (5)

📓 Common learnings

Learnt from: ogabrielluiz
PR: langflow-ai/langflow#0
File: :0-0
Timestamp: 2025-06-26T19:43:18.260Z
Learning: In langflow custom components, the `module_name` parameter is now propagated through template building functions to add module metadata and code hashes to frontend nodes for better component tracking and debugging.

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Starter project files are auto-formatted after langflow run; these changes can be committed or ignored

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/testing.mdc:0-0
Timestamp: 2025-06-30T14:41:58.837Z
Learning: Applies to {src/backend/tests/**/*.py,tests/**/*.py} : Test backward compatibility across Langflow versions by mapping component files to supported versions using 'VersionComponentMapping'.

src/backend/base/pyproject.toml (4)

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Applies to src/backend/base/langflow/components/**/__init__.py : Update __init__.py with alphabetical imports when adding new components

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/testing.mdc:0-0
Timestamp: 2025-06-30T14:41:58.837Z
Learning: Applies to {src/backend/tests/**/*.py,tests/**/*.py} : Test backward compatibility across Langflow versions by mapping component files to supported versions using 'VersionComponentMapping'.

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Applies to src/backend/base/langflow/components/**/*.py : Add new backend components to the appropriate subdirectory under src/backend/base/langflow/components/

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/testing.mdc:0-0
Timestamp: 2025-06-30T14:41:58.837Z
Learning: Applies to {src/backend/tests/**/*.py,tests/**/*.py} : Test Langflow's REST API endpoints using the async 'client' fixture and assert correct status codes and response structure.

src/frontend/package.json (5)

Learnt from: ogabrielluiz
PR: langflow-ai/langflow#0
File: :0-0
Timestamp: 2025-06-26T19:43:18.260Z
Learning: In langflow custom components, the `module_name` parameter is now propagated through template building functions to add module metadata and code hashes to frontend nodes for better component tracking and debugging.

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/frontend_development.mdc:0-0
Timestamp: 2025-06-30T14:40:29.494Z
Learning: Applies to src/frontend/{package*.json,tsconfig.json,tailwind.config.*,vite.config.*} : Frontend configuration files such as 'package.json', 'tsconfig.json', 'tailwind.config.*', and 'vite.config.*' must be present and properly maintained in 'src/frontend/'.

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/frontend_development.mdc:0-0
Timestamp: 2025-06-30T14:40:29.494Z
Learning: Applies to src/frontend/src/components/**/*FlowGraph.tsx : Use React Flow for flow graph visualization components.

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Starter project files are auto-formatted after langflow run; these changes can be committed or ignored

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/docs_development.mdc:0-0
Timestamp: 2025-06-30T14:40:02.667Z
Learning: Applies to docs/docs/**/*.{md,mdx} : Use consistent terminology: always capitalize 'Langflow', 'Component', and 'Flow' when referring to Langflow concepts; always uppercase 'API' and 'JSON'.

pyproject.toml (2)

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Applies to src/backend/base/langflow/components/**/__init__.py : Update __init__.py with alphabetical imports when adding new components

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/testing.mdc:0-0
Timestamp: 2025-06-30T14:41:58.837Z
Learning: Applies to {src/backend/tests/**/*.py,tests/**/*.py} : Test backward compatibility across Langflow versions by mapping component files to supported versions using 'VersionComponentMapping'.

src/backend/base/langflow/services/auth/utils.py (1)

Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-30T14:39:17.428Z
Learning: Applies to src/backend/tests/unit/components/**/*.py : Test authenticated FastAPI endpoints using logged_in_headers in tests

🧬 Code Graph Analysis (1)

src/backend/base/langflow/services/auth/utils.py (2)

src/backend/base/langflow/services/database/models/user/model.py (2)

• UserRead (62-72)
• User (25-51)

src/backend/base/langflow/services/database/models/api_key/crud.py (1)

• check_key (52-61)

⏰ Context from checks skipped due to timeout of 90000ms (4)

• GitHub Check: Optimize new Python code in this PR
• GitHub Check: Ruff Style Check (3.13)
• GitHub Check: Run Ruff Check and Format
• GitHub Check: Update Starter Projects

🔇 Additional comments (7)

src/frontend/package.json (1)

3-3: Version update looks good.

The frontend version bump from 1.4.3 to 1.5.0 is consistent with the backend changes and reflects the authentication improvements in this release.

src/backend/base/pyproject.toml (1)

3-3: Version update is consistent.

The langflow-base package version bump from 0.4.3 to 0.5.0 correctly aligns with the main project version update and the dependency reference in the root pyproject.toml.

pyproject.toml (2)

3-3: Project version update is appropriate.

The main project version bump from 1.4.3 to 1.5.0 correctly reflects the inclusion of the authentication fix and aligns with the backend package versions.

---

20-20: Dependency version is correctly synchronized.

The langflow-base dependency update from 0.4.3 to 0.5.0 maintains consistency with the updated backend base package version.

src/backend/base/langflow/services/auth/utils.py (3)

62-62: Good fix for auto-login flow.

The immediate return of UserRead.model_validate(result, from_attributes=True) correctly addresses the auto-login bug where the function previously continued execution instead of returning the authenticated user when skip_auth_auto_login is enabled.

---

77-77: Logic simplification improves maintainability.

The consolidated check_key(db, query_param or header_param) call eliminates redundant conditional branching and ensures consistent API key validation regardless of whether the key comes from query parameters or headers.

---

84-87: Code structure is clean after the logic improvements.

The final validation and type conversion logic remains robust, properly handling the User-to-UserRead conversion and maintaining appropriate error handling for unexpected result types.

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate Unit Tests

• Create PR with Unit Tests
• Post Copyable Unit Tests in Comment
• Commit Unit Tests in branch fix-auth-superuser

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai auto-generate unit tests to generate unit tests for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.