{"record":{"id":"f3eb1042717915b8","repo":"langflow-ai/langflow","slug":"cannot-change-a2a-enabled-of-a-flow-you-do-not-own","errorCode":null,"errorMessage":"Cannot change a2a_enabled of a flow you do not own.","messagePattern":"Cannot change a2a_enabled of a flow you do not own\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/flows_helpers.py","lineNumber":432,"sourceCode":"        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change folder of a flow you do not own.\",\n            )\n        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change fs_path of a flow you do not own.\",\n            )\n        if flow.user_id is not None and flow.user_id != owner_user_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot transfer ownership of a flow you do not own.\",\n            )\n        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on\n        # model_fields_set to block only an explicit, differing change.\n        if \"a2a_enabled\" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change a2a_enabled of a flow you do not own.\",\n            )\n        if (\n            \"a2a_card_overrides\" in flow.model_fields_set\n            and flow.a2a_card_overrides != existing_flow.a2a_card_overrides\n        ):\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change a2a_card_overrides of a flow you do not own.\",\n            )\n\n    # Validate fs_path if provided (use `is not None` to catch empty strings).\n    # Path safety is scoped to the *owner* — fs_path lives under the owner's\n    # storage namespace, so we must not authorize it against the actor's.\n    if flow.fs_path is not None:\n        await _verify_fs_path(flow.fs_path, owner_user_id, storage_service)\n","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/flows_helpers.py#L414-L450","documentation":"HTTP 403 from _update_flow: a non-owner edit explicitly sets a2a_enabled to a value differing from the stored one. Because FlowCreate defaults a2a_enabled to False (not None), the guard keys on model_fields_set so only an explicit, differing change is blocked — echoing the current value is fine.","triggerScenarios":"PATCH/PUT by a non-owner whose body includes a2a_enabled with a value != existing_flow.a2a_enabled (e.g. enabling Agent-to-Agent exposure on someone else's flow).","commonSituations":"A teammate with edit-via-plugin rights toggling A2A exposure on flows they do not own; automation that flips a2a_enabled globally across many flows owned by different users.","solutions":["Omit a2a_enabled from non-owner updates.","Echo the current value if your client must send the full object (no error when equal).","Route A2A enablement requests to the flow owner."],"exampleFix":"# before\n{\"a2a_enabled\": true}   # non-owner on a flow where it is false\n# after\n{}                        # omit; owner enables A2A","handlingStrategy":"validation","validationCode":"if (!isOwner && 'a2a_enabled' in body && body.a2a_enabled !== currentFlow.a2a_enabled) delete body.a2a_enabled;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit a2a_enabled on non-owner edits","Only explicit differing changes are blocked — echoing the current value is safe","Centralise A2A enablement with the owner"],"tags":["authorization","ownership","http-403","a2a","rbac"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}