{"record":{"id":"4ddf836296f03f75","repo":"langflow-ai/langflow","slug":"resource-not-found","errorCode":null,"errorMessage":"Resource not found","messagePattern":"Resource not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/api/v1/authz_shares.py","lineNumber":217,"sourceCode":"    )\n\n\n@router.post(\"\", response_model=ShareRead, status_code=status.HTTP_201_CREATED)\n@router.post(\"/\", response_model=ShareRead, status_code=status.HTTP_201_CREATED)\nasync def create_share(\n    payload: ShareCreate,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n) -> ShareRead:\n    \"\"\"Create an authz_share row for a resource.\"\"\"\n    owner_id = await _resolve_resource_owner(\n        session,\n        resource_type=payload.resource_type,\n        resource_id=payload.resource_id,\n    )\n    if owner_id is None:\n        # UUID privacy: missing resource → 404.\n        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=\"Resource not found\")\n    await _ensure_can_administer_share(user=current_user, owner_id=owner_id)\n    # SECURITY: pass the *resource* owner (not the caller) so the owner-override\n    # in ensure_share_permission only fast-paths the real resource owner. With\n    # share_user_id=current_user.id the override would always trip and the\n    # authorization plugin's enforce() would never run for non-owner creators\n    # when the OSS floor is bypassed (cross_user_fetch + AUTHZ_ENABLED).\n    await ensure_share_permission(\n        current_user,\n        ShareAction.CREATE,\n        share_user_id=owner_id,\n    )\n\n    row = AuthzShare(\n        resource_type=payload.resource_type,\n        resource_id=payload.resource_id,\n        scope=payload.scope,\n        target_id=payload.target_id,\n        permission_level=payload.permission_level,","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_shares.py#L199-L235","documentation":"Raised by POST /api/v1/authz/shares when _resolve_resource_owner cannot find the target resource (flow/knowledge base/etc. named by resource_type + resource_id) — the owner lookup returns None and the route returns 404 to avoid leaking whether the resource exists (UUID privacy).","triggerScenarios":"POST /authz/shares with a resource_id that does not exist for the given resource_type; wrong resource_type for the id; resource deleted between fetching its id and creating the share.","commonSituations":"Sharing a flow id copied from another environment; typo in the UUID; sharing a resource that was just deleted; passing a deployment id with resource_type='flow'.","solutions":["Verify the resource exists first (e.g. GET /api/v1/flows/{id}) and use the id from that response","Check resource_type matches the actual resource kind in your payload","If the resource was deleted, abandon the share creation — nothing to share"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"async function resourceExists(resourceType: string, resourceId: string) {\n  const res = await fetch(`/api/v1/${resourceType}s/${resourceId}`);\n  return res.ok;\n}","typeGuard":"const isUuid = (s: string): boolean =>\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);","tryCatchPattern":null,"preventionTips":["Always share using ids obtained from a fresh GET in the same environment","Validate resource_type matches the id's kind before POSTing a share"],"tags":["authz","api","shares","not-found","validation"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}