{"record":{"id":"6fde2df373216460","repo":"langflow-ai/langflow","slug":"project-owner-not-found","errorCode":null,"errorMessage":"Project owner not found","messagePattern":"Project owner not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":134,"sourceCode":"    if not project:\n        raise HTTPException(status_code=404, detail=\"Project not found\")\n\n    auth_settings: AuthSettings | None = None\n    # Check if this project requires API key only authentication\n    if project.auth_settings:\n        auth_settings = AuthSettings(**project.auth_settings)\n\n    project_auth_type = auth_settings.auth_type if auth_settings else None\n    if project_auth_type == \"oauth\" and composer_backend_token:\n        mcp_composer_service: MCPComposerService = cast(\n            MCPComposerService, get_service(ServiceType.MCP_COMPOSER_SERVICE)\n        )\n        if mcp_composer_service.validate_backend_auth_token(str(project_id), composer_backend_token):\n            if project.user_id:\n                project_user = await db.get(User, project.user_id)\n                if project_user:\n                    return project_user\n            raise HTTPException(status_code=404, detail=\"Project owner not found\")\n\n    # ``none`` intentionally publishes this project's MCP surface without a\n    # credential. Keep that behavior, but never represent the anonymous caller\n    # as the instance-wide superuser: tool execution must stay within the\n    # published project's owning principal.\n    if project_auth_type == \"none\":\n        if project.user_id:\n            project_user = await db.get(User, project.user_id)\n            if project_user:\n                return project_user\n        raise HTTPException(status_code=404, detail=\"Project owner not found\")\n\n    # OAuth projects must present a valid API key at the Langflow transport endpoint: network-level\n    # trust (loopback / same-host proxy) is unsafe because it cannot distinguish the local MCP\n    # Composer subprocess from another loopback peer behind a reverse proxy or sidecar. The\n    # composer-to-Langflow hop should be authenticated explicitly once mcp-composer can forward\n    # a project-scoped backend credential; until then, direct backend access requires a key.\n    requires_api_key = (not auth_settings and not settings_service.auth_settings.AUTO_LOGIN) or (","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L116-L152","documentation":"In the MCP project auth helper, the project exists, its auth_settings.auth_type is 'oauth', and a valid composer backend token was presented — but the project has no user_id, or no User row exists for that user_id. The owner lookup is mandatory on this path because the composer token fast path authenticates AS the project owner; with no resolvable owner there is no principal to run tools as, so it 404s.","triggerScenarios":"OAuth-published MCP project reached via MCP Composer with a valid backend token, where folder.user_id is NULL (orphaned project) or points at a deleted user.","commonSituations":"Projects orphaned by user deletion without cascade; manual DB edits or imports that dropped user_id; test fixtures creating folders without an owner.","solutions":["Re-assign the project to an existing user (update Folder.user_id) or re-create the project under a valid account.","If a user was deleted, restore it or transfer ownership of the folder before publishing MCP.","Add a migration/consistency check that no published (oauth) folder has NULL user_id.","Verify with: SELECT id, user_id FROM folder WHERE id = '<project_id>';"],"exampleFix":"-- before: orphaned project\n-- folder.user_id IS NULL\n\n-- after: reassign owner\nUPDATE folder SET user_id = (SELECT id FROM \"user\" WHERE username = 'owner') WHERE id = '<project_uuid>';","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"except HTTPException(404, 'Project owner not found') on the oauth+composer path: alert an admin to fix folder.user_id; not retryable.","preventionTips":["Enforce FK/consistency so folders always have an existing owner user.","When deleting users, transfer or delete their published projects first."],"tags":["mcp","http-404","oauth","data-integrity","project-owner"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}