refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

backend/app/flows/api.py

@@ -17,12 +17,13 @@ from pathlib import Path
 from typing import Annotated
 from uuid import UUID
 
-from fastapi import APIRouter, Depends, Header, HTTPException, Query
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request
 from fastapi.responses import StreamingResponse
 from sqlmodel import Session
 
 from app.auth.deps import get_current_user, require_admin
 from app.db import get_db
+from app.middleware import limiter, run_limit
 from app.models import User
 from app.settings import settings
 
@@ -50,6 +51,7 @@ from .schemas import (
     FlowVersionCreate,
     FlowVersionRead,
     InputSchemaRead,
+    NamedRunRead,
     RunRead,
     RunRequest,
     SyncReport,
@@ -58,6 +60,7 @@ from .sync import lfx_id_for
 
 flows_router = APIRouter(prefix="/api/flows", tags=["flows"])
 approvals_router = APIRouter(prefix="/api/approvals", tags=["approvals"])
+runs_router = APIRouter(prefix="/api/runs", tags=["runs"])
 
 logger = logging.getLogger(__name__)
 
@@ -211,7 +214,9 @@ def _resolve_version(session: Session, flow_id: UUID, version_no: int | None):
 
 
 @flows_router.post("/{flow_id}/run", response_model=RunRead)
+@limiter.limit(run_limit)
 async def run_flow(
+    request: Request,
     flow_id: UUID,
     data: RunRequest,
     session: Annotated[Session, Depends(get_db)],
@@ -279,6 +284,18 @@ async def _run_stream(
     return StreamingResponse(event_gen(), media_type="text/event-stream")
 
 
+@runs_router.get("", response_model=list[NamedRunRead])
+def list_all_runs(
+    session: Annotated[Session, Depends(get_db)],
+    user: Annotated[User, Depends(get_current_user)],
+):
+    """All runs of the session tenant with flow names (single query)."""
+    return [
+        NamedRunRead(flow_name=name, run=_read_run(run))
+        for run, name in store.list_all_runs(session, user.tenant_id)
+    ]
+
+
 @flows_router.get("/{flow_id}/runs", response_model=list[RunRead])
 def list_runs(
     flow_id: UUID,