{"record":{"id":"903947f7948ace3b","repo":"langflow-ai/langflow","slug":"flow-not-found-903947","errorCode":null,"errorMessage":"Flow not found","messagePattern":"Flow not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/api/v1/authz_route_dependencies.py","lineNumber":30,"sourceCode":"from langflow.services.authorization import FlowAction, ensure_flow_permission\nfrom langflow.services.authorization.fetch import deny_to_404\nfrom langflow.services.database.models.flow.model import Flow, FlowCreate\n\n_FLOW_WRITE_DENIED_DETAIL = \"You don't have permission to edit this flow.\"\n_FLOW_DELETE_DENIED_DETAIL = \"You don't have permission to delete this flow.\"\n\n\nasync def _get_authorized_flow(\n    act: FlowAction,\n    *,\n    flow_id: UUID,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n) -> Flow:\n    \"\"\"Load a flow (share-aware when the plugin supports it) and enforce *act*.\"\"\"\n    flow = await _read_flow(session, flow_id, current_user.id)\n    if flow is None:\n        raise HTTPException(status_code=404, detail=\"Flow not found\")\n    try:\n        await ensure_flow_permission(\n            current_user,\n            act,\n            flow_id=flow_id,\n            flow_user_id=flow.user_id,\n            workspace_id=flow.workspace_id,\n            folder_id=flow.folder_id,\n        )\n    except HTTPException as exc:\n        if act in (FlowAction.WRITE, FlowAction.DELETE) and exc.status_code == status.HTTP_403_FORBIDDEN:\n            try:\n                await ensure_flow_permission(\n                    current_user,\n                    FlowAction.READ,\n                    flow_id=flow_id,\n                    flow_user_id=flow.user_id,\n                    workspace_id=flow.workspace_id,","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_route_dependencies.py#L12-L48","documentation":"Raised by the share-aware flow route dependency (_get_authorized_flow in authz_route_dependencies.py) when _read_flow returns None, or when ensure_flow_permission denies access in a way converted to 404 via deny_to_404. It is a deliberate UUID-privacy 404: a missing flow and a flow you may not see are indistinguishable. For WRITE/DELETE denial the code first re-checks READ; only if READ is also denied does it collapse to this 404.","triggerScenarios":"GET/PATCH/DELETE a flow route guarded by get_authorized_flow_for_* with a non-existent flow_id, or with a valid flow_id the caller has no READ grant for (OSS default: any flow owned by another user).","commonSituations":"Sharing a flow URL with a user who lacks a share grant; stale flow id after the owner deleted it; enabling LANGFLOW_AUTHZ_ENABLED and expecting cross-user reads without a registered plugin (the OSS pass-through reports supports_cross_user_fetch=False, so owner-scoped queries are preserved).","solutions":["Verify the flow id exists in the same environment (owner: GET /api/v1/flows)","If accessing another user's flow, create a share grant via POST /api/v1/authz/shares or have the owner share it","If running a plugin with cross-user fetch, confirm LANGFLOW_AUTHZ_ENABLED=true and the plugin grants read on flow:{id}","Handle 404 idempotently in clients — do not retry, the resource is invisible or gone"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"async function flowVisible(flowId: string) {\n  const res = await fetch(`/api/v1/flows/${flowId}`);\n  return res.ok; // 404 => missing or not visible to this caller\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await getAuthorizedFlowForRead(flowId);\n} catch (e) {\n  if (e.status === 404) return null; // invisible or gone — do not retry\n  throw e;\n}","preventionTips":["Never hardcode flow ids across environments","Before touching another user's flow, ensure a share grant or plugin read grant exists","Remember the 404 is deliberate: missing and forbidden-read are indistinguishable"],"tags":["authz","api","flows","not-found","uuid-privacy"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}