{"record":{"id":"ee20b8d6401c9e96","repo":"langflow-ai/langflow","slug":"actions-capped-at-max-actions-unique-entries","errorCode":null,"errorMessage":"actions capped at {_MAX_ACTIONS} unique entries","messagePattern":"actions capped at (.+?) unique entries","errorType":"validation","errorClass":"ValueError","httpStatus":422,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/authz_me.py","lineNumber":112,"sourceCode":"        \"\"\"\n        if value is None:\n            return None\n        seen: set[str] = set()\n        normalized: list[str] = []\n        for raw in value:\n            if not isinstance(raw, str):\n                # Pydantic field_validators must raise ValueError (not TypeError)\n                # to be wrapped into a ValidationError -> HTTP 422 response.\n                msg = \"actions must be strings\"\n                raise ValueError(msg)  # noqa: TRY004\n            cleaned = raw.strip().lower()\n            if not cleaned or cleaned in seen:\n                continue\n            seen.add(cleaned)\n            normalized.append(cleaned)\n        if len(normalized) > _MAX_ACTIONS:\n            msg = f\"actions capped at {_MAX_ACTIONS} unique entries\"\n            raise ValueError(msg)\n        return normalized or None\n\n\nclass EffectivePermissionsResponse(BaseModel):\n    \"\"\"Response: ``{resource_id: [allowed_actions]}``.\"\"\"\n\n    resource_type: ResourceTypeLiteral\n    permissions: dict[UUID, list[str]]\n\n\nasync def _owned_resource_ids(\n    *,\n    session: AsyncSession,\n    resource_type: str,\n    resource_ids: list[UUID],\n    user_id: UUID,\n) -> set[UUID]:\n    \"\"\"Return requested resource IDs owned by ``user_id``.\"\"\"","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_me.py#L94-L130","documentation":"Pydantic validator cap on the /authz/me effective-permissions request: after normalization (strip, lowercase, dedupe) the actions list must not exceed _MAX_ACTIONS unique entries, otherwise ValueError is raised and FastAPI returns HTTP 422.","triggerScenarios":"POST with more than _MAX_ACTIONS distinct action strings after cleaning — e.g. programmatically enumerating every resource:action permutation from the permission catalog instead of the handful of UI-relevant actions.","commonSituations":"Frontends that build the actions list from a full permission-slug catalog (which grows as resources are added) and eventually cross the cap, or code that concatenates multiple action lists without dedupe awareness (duplicates are fine, unique count is what's capped).","solutions":["Request only the actions the UI actually gates on (typically read/write/execute/delete)","Deduplicate and cap client-side before sending","Omit actions to fall back to _DEFAULT_ACTIONS","If you legitimately need more, batch requests per resource group rather than raising the server cap"],"exampleFix":"// before\nconst actions = allPermissionSlugs; // hundreds of entries\n\n// after\nconst actions = [...new Set(needed)].slice(0, 20); // e.g. cap at known limit","handlingStrategy":"validation","validationCode":"const MAX_ACTIONS = 32; // keep in sync with server _MAX_ACTIONS\nconst actions = [...new Set(raw.map(a => a.trim().toLowerCase()))].slice(0, MAX_ACTIONS);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not enumerate the full permission catalog into the actions list","Dedupe and cap client-side using a shared constant","Omit actions to use the server default set when unsure"],"tags":["authz","validation","http-422","rate-limits"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}