{"record":{"id":"f83009208c19430f","repo":"langflow-ai/langflow","slug":"cannot-change-folder-of-a-flow-you-do-not-own","errorCode":null,"errorMessage":"Cannot change folder of a flow you do not own.","messagePattern":"Cannot change folder of a flow you do not own\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/flows_helpers.py","lineNumber":415,"sourceCode":"    shared edit allowed by a registered authorization plugin — ownership-\n    bound state (folder, fs_path, ownership) must stay rooted at the owner,\n    otherwise the write silently retargets folders/storage that belong to the\n    actor. This mirrors the cross-user semantics already enforced by\n    ``_patch_flow``.\n    \"\"\"\n    await lock_flow_for_update(session, existing_flow)\n\n    settings_service = get_settings_service()\n    actor_user_id = current_user.id\n    owner_user_id: UUID = existing_flow.user_id\n    is_owner_edit = owner_user_id == actor_user_id\n\n    # Non-owner edits cannot relocate the flow into folders or storage they\n    # own, nor transfer ownership. Reject early so the failure is explicit\n    # rather than corrupting scope downstream.\n    if not is_owner_edit:\n        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change folder of a flow you do not own.\",\n            )\n        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change fs_path of a flow you do not own.\",\n            )\n        if flow.user_id is not None and flow.user_id != owner_user_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot transfer ownership of a flow you do not own.\",\n            )\n        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on\n        # model_fields_set to block only an explicit, differing change.\n        if \"a2a_enabled\" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:\n            raise HTTPException(\n                status_code=403,","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/flows_helpers.py#L397-L433","documentation":"HTTP 403 from _update_flow: the acting user is not the flow owner (actor_user_id != existing_flow.user_id) and the update payload attempts to change folder_id to a different value. Non-owner edits (possible when an authorization plugin grants cross-user write) are deliberately restricted from relocating the flow, because folder scope affects visibility and permissions.","triggerScenarios":"PATCH/PUT on a flow you can edit via a plugin-granted permission but do not own, with a folder_id differing from the stored one.","commonSituations":"Team deployments with an RBAC plugin where an editor tries to move a colleague's flow into their own folder; automation scripts authenticated as a service account updating user flows while also passing folder_id.","solutions":["Omit folder_id from the payload — only the owner may relocate the flow.","Ask the owner (or a superuser) to perform the folder move.","If your plugin's policy intends to allow relocation, that must be an explicit product decision; the OSS guard blocks it regardless of plugin grants."],"exampleFix":"# before (non-owner)\n{\"name\": \"renamed\", \"folder_id\": \"<other-folder>\"}\n# after\n{\"name\": \"renamed\"}","handlingStrategy":"validation","validationCode":"if (!isOwner && body.folder_id && body.folder_id !== currentFlow.folder_id) delete body.folder_id;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Non-owner edits should send only mutable content fields","Have the owner perform folder moves","Strip scope fields (folder_id/fs_path/user_id) in plugin-authorized editor clients"],"tags":["authorization","ownership","http-403","folders","rbac"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}