{"record":{"id":"5a3e5bc7a5b27532","repo":"langflow-ai/langflow","slug":"resource-ids-capped-at-max-resource-ids","errorCode":null,"errorMessage":"resource_ids capped at {_MAX_RESOURCE_IDS}","messagePattern":"resource_ids capped at (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/authz_me.py","lineNumber":184,"sourceCode":"    return normalized\n\n\n@router.post(\"/permissions\", response_model=EffectivePermissionsResponse)\nasync def get_effective_permissions(\n    body: EffectivePermissionsRequest,\n    current_user: CurrentActiveUser,\n    session: DbSessionReadOnly,\n) -> EffectivePermissionsResponse:\n    \"\"\"Return per-resource allowed actions for the current user.\n\n    Use this to render the UI permission gate (greyed-out buttons etc.) without\n    flooding the audit log with denied probes. Empty list for a resource_id\n    means the user cannot perform any of the requested actions on that resource.\n    \"\"\"\n    if not body.resource_ids:\n        return EffectivePermissionsResponse(resource_type=body.resource_type, permissions={})\n    if len(body.resource_ids) > _MAX_RESOURCE_IDS:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=f\"resource_ids capped at {_MAX_RESOURCE_IDS}\",\n        )\n\n    authz = get_authorization_service()\n    actions = tuple(body.actions) if body.actions else _DEFAULT_ACTIONS\n    permissions = await authz.get_effective_permissions(\n        user_id=current_user.id,\n        resource_type=body.resource_type,\n        resource_ids=body.resource_ids,\n        actions=actions,\n        domain=body.domain,\n        context={\n            **current_auth_context_for_authz(),\n            \"is_superuser\": current_user.is_superuser,\n        },\n    )\n    permissions = await _apply_owner_permissions(","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_me.py#L166-L202","documentation":"Route-level guard on the /authz/me effective-permissions endpoint: the resource_ids list in the request body is capped at _MAX_RESOURCE_IDS entries. Exceeding it raises HTTP 400 with detail 'resource_ids capped at {_MAX_RESOURCE_IDS}'.","triggerScenarios":"POST /authz/me/effective-permissions with a resource_ids array longer than _MAX_RESOURCE_IDS — e.g. a dashboard that loads every flow in a workspace and asks permissions for all of them in one call.","commonSituations":"Workspaces that grew past the cap over time, 'select all' UI actions, or clients that page through resource lists and then batch the entire accumulated set into one permissions call.","solutions":["Chunk resource_ids into batches of at most _MAX_RESOURCE_IDS and merge the responses","Filter the list first to only resources actually being rendered","If the UI shows paginated results, request permissions only for the current page's ids","Persist batch size in one client constant so it can be tuned alongside the server cap"],"exampleFix":"// before\nconst res = await api.post('/authz/me/effective-permissions', { resource_type, resource_ids: allIds });\n\n// after\nconst chunks = [];\nfor (let i = 0; i < allIds.length; i += 100) chunks.push(allIds.slice(i, i + 100));\nconst results = await Promise.all(chunks.map(c => api.post('/authz/me/effective-permissions', { resource_type, resource_ids: c })));\nconst permissions = Object.assign({}, ...results.map(r => r.permissions));","handlingStrategy":"validation","validationCode":"const MAX_RESOURCE_IDS = 100; // keep in sync with _MAX_RESOURCE_IDS\nfunction chunk<T>(arr: T[], n: number): T[][] {\n  const out: T[][] = [];\n  for (let i = 0; i < arr.length; i += n) out.push(arr.slice(i, i + n));\n  return out;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Request permissions only for resources visible on the current page","Chunk large id lists and merge responses","Store the cap as one shared client constant and bump it with the server"],"tags":["authz","validation","http-400","pagination"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}