fix(voice): enforce flow authorization on websocket

[erichare]

Summary

• authorize voice-mode flow execution before reading flow metadata or opening external connections
• preserve owner, public, and share-aware access paths
• return a generic not-found response for denied or missing flows

Testing

• 43 focused voice authorization tests passed
• Ruff, formatting, and pre-commit passed

Summary by CodeRabbit

• Bug Fixes

  • Improved authorization for voice-enabled flows.
  • Restricted access to flows based on permissions while preserving approved shared and public access.
  • Standardized missing or unauthorized flow responses as generic not-found errors.
  • Prevented unauthorized requests from initiating voice connections or processing flow data.

• Tests

  • Added regression coverage for owner, shared, public, missing, and unauthorized flow access scenarios.

[coderabbitai]

Walkthrough

The voice flow-as-tool WebSocket now retrieves and authorizes the flow before reading its description, resolving voice configuration, or opening connections. New tests cover owner, shared, public, missing, and denied-flow scenarios.

Changes

Voice flow authorization

Layer / File(s)	Summary
Authorized flow loading src/backend/base/langflow/api/v1/voice_mode.py, src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py	Shared flow-read and execution-permission checks replace direct description lookup, with coverage for owner, shared, public, and missing flows.
WebSocket authorization ordering src/backend/base/langflow/api/v1/voice_mode.py, src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py	The endpoint authorizes the flow before resolving voice configuration or opening connections, and denied requests stop before description, connection, or message-sink access.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• langflow-ai/langflow#13702: Also changes voice configuration scoping and resolution order in the flow-as-tool WebSocket.

Suggested reviewers: adam-aghili, jordanrfrazier, mendonk, nv-nfreybler, ogabrielluiz

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enforcing flow authorization in the voice websocket path.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	PASS: PR adds test_voice_mode_flow_authz.py with meaningful auth/helper and websocket regression tests, matching test_*.py naming and covering the new flow auth path.
Test Quality And Coverage	✅ Passed	Tests cover auth success paths, generic 404 denial, and websocket short-circuiting with asyncio/pytest patterns; they assert behavior and lack of side effects.
Test File Naming And Structure	✅ Passed	New backend test file is correctly named, uses pytest/async tests, has descriptive cases, and covers positive and negative auth scenarios.
Excessive Mock Usage Warning	✅ Passed	Mocks are limited to external boundaries; core auth logic is exercised with simple real objects, and the broader setup is a deny-before-connection regression.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/le-1789-voice-flow-authorization

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[coderabbitai]

🧹 Nitpick comments (1)

src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py (1)

37-164: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider adding one DB-backed integration test alongside the mock-based suite.

All five tests mock _read_flow/ensure_flow_permission (and, in the WS test, the OpenAI connection, DB writes, and voice config). This is reasonable for asserting call ordering, but none exercise the real _read_flow/ensure_flow_permission implementations against an actual flow, so drift between the mocked contract and the real authorization logic wouldn't be caught here. As per coding guidelines, "Backend unit tests should avoid mocking when possible and prefer real integrations for more reliable tests" and reviewers should "prefer integration tests when unit tests are overly mocked." The flow fixture in conftest.py already provides a DB-backed flow that could back at least one end-to-end _get_authorized_voice_flow test.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py` around lines 37
- 164, Add one DB-backed integration test using the existing conftest.py flow
fixture, without mocking _read_flow or ensure_flow_permission, and exercise
_get_authorized_voice_flow with a real session and user authorization path.
Assert the real flow is returned and preserve the existing mocked tests for
call-order coverage.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py`:
- Around line 37-164: Add one DB-backed integration test using the existing
conftest.py flow fixture, without mocking _read_flow or ensure_flow_permission,
and exercise _get_authorized_voice_flow with a real session and user
authorization path. Assert the real flow is returned and preserve the existing
mocked tests for call-order coverage.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 13cadc2a-c5c0-41a8-a6c2-8eeacad01108

📥 Commits

Reviewing files that changed from the base of the PR and between 61d6490 and 0019173.

📒 Files selected for processing (2)

• src/backend/base/langflow/api/v1/voice_mode.py
• src/backend/tests/unit/api/v1/test_voice_mode_flow_authz.py

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	43.54% (58072/133362)	69.2% (7884/11392)	41.56% (1298/3123)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4978	0 💤	0 ❌	0 🔥	11m 21s ⏱️

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release-1.10.3@61d6490). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/backend/base/langflow/api/v1/voice_mode.py	90.90%	2 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##             release-1.10.3   #14043   +/-   ##
=================================================
  Coverage                  ?   58.90%           
=================================================
  Files                     ?     2307           
  Lines                     ?   221052           
  Branches                  ?    34259           
=================================================
  Hits                      ?   130201           
  Misses                    ?    89366           
  Partials                  ?     1485           

Flag	Coverage Δ
backend	65.96% <90.90%> (?)
frontend	58.15% <ø> (?)
lfx	54.65% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/api/v1/voice_mode.py	20.89% <90.90%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Adam-Aghili]

LGTM