fix(kb): enforce server-owned folder connector limits

src/backend/tests/unit/components/vectorstores/test_chroma_vector_store_component.py

@@ -28,7 +28,12 @@ def embed_query(self, text: str) -> list[float]:
         return self._embed(text)
 
 
-def test_remote_chroma_server_uses_http_client() -> None:
+def test_remote_chroma_server_uses_http_client(monkeypatch: pytest.MonkeyPatch) -> None:
+    # This test asserts the remote HttpClient wiring (host/port/ssl), not SSRF behavior; the
+    # connector SSRF guard is covered separately (test_connector_ssrf.py / test_ssrf_protection.py).
+    # Disable connector SSRF validation so the fake ``chroma.example.com`` host is not DNS-resolved.
+    monkeypatch.setenv("LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED", "false")
+
     mock_client = MagicMock()
     mock_chroma = MagicMock()
     mock_chroma.get.return_value = {"ids": [], "documents": [], "metadatas": []}

src/backend/tests/unit/graph/test_execution_path_validation.py

@@ -142,19 +142,19 @@ async def test_flow_execution_equivalence(flow_name: str):
 
     graph_data = flow_data.get("data", flow_data)
 
-    # Create two independent copies - use valid UUIDs for flow_id
+    # Create two independent copies with valid UUIDs for persisted identifiers.
     graph_for_async_start = Graph.from_payload(
         deepcopy(graph_data),
         flow_id=str(uuid4()),
         flow_name=flow_name,
-        user_id="test-user-async",
+        user_id=str(uuid4()),
     )
 
     graph_for_arun = Graph.from_payload(
         deepcopy(graph_data),
         flow_id=str(uuid4()),
         flow_name=flow_name,
-        user_id="test-user-arun",
+        user_id=str(uuid4()),
     )
 
     # Run both paths with tracing

src/backend/tests/unit/test_openai_base_url_support.py

@@ -214,13 +214,15 @@ def test_validation_normalizes_base_url_like_runtime(self):
         with (
             patch("langchain_openai.ChatOpenAI", chat_openai),
             patch("lfx.utils.util.transform_localhost_url", return_value=self.TRANSFORMED),
+            patch("lfx.base.models.unified_models.credentials.validate_connector_url_for_ssrf") as ssrf_validator,
         ):
             validate_model_provider_key(
                 "OpenAI",
                 {"OPENAI_API_KEY": "sk-x", "OPENAI_BASE_URL": "http://localhost:11434/v1"},
                 model_name="gpt-oss:20b",
             )
 
+        ssrf_validator.assert_called_once_with(self.TRANSFORMED)
         assert chat_openai.call_args.kwargs.get("base_url") == self.TRANSFORMED
 
     def test_get_llm_normalizes_base_url(self):