{"record":{"id":"b797dd6dfc6943e6","repo":"langflow-ai/langflow","slug":"you-don-t-have-permission-to-delete-this-flow","errorCode":null,"errorMessage":"You don't have permission to delete this flow.","messagePattern":"You don't have permission to delete this flow\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/authz_route_dependencies.py","lineNumber":54,"sourceCode":"            flow_user_id=flow.user_id,\n            workspace_id=flow.workspace_id,\n            folder_id=flow.folder_id,\n        )\n    except HTTPException as exc:\n        if act in (FlowAction.WRITE, FlowAction.DELETE) and exc.status_code == status.HTTP_403_FORBIDDEN:\n            try:\n                await ensure_flow_permission(\n                    current_user,\n                    FlowAction.READ,\n                    flow_id=flow_id,\n                    flow_user_id=flow.user_id,\n                    workspace_id=flow.workspace_id,\n                    folder_id=flow.folder_id,\n                )\n            except HTTPException as read_exc:\n                raise deny_to_404(read_exc, detail=\"Flow not found\") from read_exc\n            denied_detail = _FLOW_WRITE_DENIED_DETAIL if act == FlowAction.WRITE else _FLOW_DELETE_DENIED_DETAIL\n            raise HTTPException(status_code=403, detail=denied_detail) from exc\n        raise deny_to_404(exc, detail=\"Flow not found\") from exc\n    return flow\n\n\nasync def get_authorized_flow_for_read(\n    flow_id: UUID,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n) -> Flow:\n    \"\"\"Return a flow the caller may read (404 when denied or missing).\"\"\"\n    return await _get_authorized_flow(FlowAction.READ, flow_id=flow_id, current_user=current_user, session=session)\n\n\nasync def get_authorized_flow_for_write(\n    flow_id: UUID,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n) -> Flow:","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_route_dependencies.py#L36-L72","documentation":"Raised by _get_authorized_flow when the caller requests FlowAction.DELETE but ensure_flow_permission denies it, while a follow-up READ check succeeds — you can see the flow but not delete it. The route returns 403 with this message; if READ were also denied it would collapse to 404 instead.","triggerScenarios":"DELETE /api/v1/flows/{id} when the caller holds read but not delete permission (non-owner without a delete grant, or a plugin denying delete on flow:{id}).","commonSituations":"Editor-level collaborators trying to delete the owner's flow; plugin granting write but not delete; assuming write implies delete.","solutions":["Have the resource owner (or a superuser) perform the delete","Request a delete-capable grant from the authorization plugin administrator","In shared workflows, ask the owner to remove you from the share instead of deleting the flow yourself"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await deleteFlow(flowId);\n} catch (e) {\n  if (e.status === 403 && e.detail.includes('delete')) {\n    confirm('Only the owner can delete this flow — request deletion from the owner.');\n  } else throw e;\n}","preventionTips":["Only show the delete control for flows the caller owns or has delete rights on","Treat 403-with-detail on write/delete as a capability signal to adjust the UI, not a transient error"],"tags":["authz","api","flows","forbidden","rbac","delete"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}