fix: authorize flow management, gate runs, token-gate callbacks, strict tenants

backend/scripts/make_flow_fixtures.py

@@ -302,6 +302,11 @@ class EnvelopeComponent(Component):
             name="continuation",
             method="get_continuation",
         ),
+        Output(
+            display_name="Callback Token",
+            name="callback_token",
+            method="get_callback_token",
+        ),
     ]
 
     def _text(self, value) -> str:
@@ -333,6 +338,9 @@ class EnvelopeComponent(Component):
     def get_continuation(self) -> Message:
         value = self._env().get("continuation_flow_id")
         return Message(text=str(value) if value else "")
+
+    def get_callback_token(self) -> Message:
+        return Message(text=str(self._env().get("callback_token", "")))
 """
 
 APPROVAL_CALLBACK_CODE = """from lfx.custom import Component
@@ -348,6 +356,10 @@ class ApprovalCallbackComponent(Component):
         MessageTextInput(name="trigger", display_name="Trigger"),
         MessageTextInput(name="run_id", display_name="Run ID"),
         MessageTextInput(name="callback_url", display_name="Callback URL"),
+        MessageTextInput(
+            name="callback_token",
+            display_name="Callback Token",
+        ),
         MessageTextInput(
             name="continuation_flow_id",
             display_name="Continuation Flow ID",
@@ -384,8 +396,9 @@ class ApprovalCallbackComponent(Component):
             "payload": {"verdict": trigger, "facts": facts},
             "continuation_flow_id": self._text(self.continuation_flow_id) or None,
         }
+        headers = {"X-Callback-Token": self._text(self.callback_token)}
         try:
-            response = httpx.post(url, json=body, timeout=10.0)
+            response = httpx.post(url, json=body, headers=headers, timeout=10.0)
             response.raise_for_status()
         except Exception as exc:
             return Message(text=f"CALLBACK_FAILED: {exc}")
@@ -487,6 +500,7 @@ def build_approval_handoff() -> dict:
         edge(router, "true_result", callback, "trigger"),
         edge(envelope, "run_id", callback, "run_id"),
         edge(envelope, "callback_url", callback, "callback_url"),
+        edge(envelope, "callback_token", callback, "callback_token"),
         edge(envelope, "continuation", callback, "continuation_flow_id"),
         edge(envelope, "payload", callback, "facts"),
         edge(callback, "result", out_pending, "input_value"),

backend/scripts/smoke_e2e.py

@@ -10,6 +10,8 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
+import socket
 import subprocess
 import sys
 import tempfile
@@ -18,11 +20,21 @@ import urllib.request
 from pathlib import Path
 
 BACKEND = Path(__file__).resolve().parent.parent
-VENV_BIN = BACKEND / ".venv" / "bin"
+# Local venv (uv run) or image venv (/opt/venv in containers): prefer PATH.
+VENV_BIN = Path(shutil.which("lfx") or "").parent or (BACKEND / ".venv" / "bin")
 FIXTURES = BACKEND / "tests" / "fixtures" / "flows"
 
-LFX_PORT = 6004
-API_PORT = 8000
+
+def _free_port() -> int:
+    # Ephemeral ports: the dev API/LFX may already occupy the defaults
+    # (e.g. when smoke runs inside the api container itself).
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+LFX_PORT = _free_port()
+API_PORT = _free_port()
 LFX_KEY = "lfx-759GsfJKjAeOBZ_44-cll9WdHp_yfYn_tIg7eHG38Rs"
 
 
@@ -42,6 +54,9 @@ def api(method: str, path: str, body: dict | None = None) -> tuple[int, dict | s
     import httpx
 
     with httpx.Client(base_url=f"http://127.0.0.1:{API_PORT}", timeout=120) as c:
+        # Management + runs are login-gated; the smoke admin session is
+        # planted directly in the throwaway DB (see main()).
+        c.cookies.set("kirche_session", "smoke-session", domain="127.0.0.1")
         r = c.request(method, path, json=body)
         try:
             return r.status_code, r.json()
@@ -68,8 +83,36 @@ def main() -> None:
     cfg = Config()
     cfg.set_main_option("script_location", str(BACKEND / "migrations"))
     cfg.set_main_option("sqlalchemy.url", db_url)
+    # migrations/env.py takes the URL from settings (not the ini value):
+    # point this process at the throwaway DB before migrating.
+    from app.settings import settings as app_settings
+
+    app_settings.database_url = db_url
     alembic_command.upgrade(cfg, "head")
 
+    # Plant an admin session: management + runs require login, and there is
+    # no SMTP in smoke to deliver a magic link.
+    from datetime import UTC, datetime, timedelta
+
+    from sqlmodel import Session, create_engine
+
+    from app.models import User, UserSession
+
+    engine = create_engine(db_url)
+    with Session(engine) as s:
+        user = User(name="smoke", email="smoke@example.com", role="admin")
+        s.add(user)
+        s.flush()
+        s.add(
+            UserSession(
+                id="smoke-session",
+                user_id=user.id,
+                expires_at=datetime.now(UTC) + timedelta(hours=1),
+            )
+        )
+        s.commit()
+    engine.dispose()
+
     env = {
         **os.environ,
         # lfx prefers LANGFLOW_API_KEY over LFX_API_KEY; the repo .env may set
@@ -80,6 +123,7 @@ def main() -> None:
         "FLOWS_WATCH_ENABLED": "false",
         "LFX_URL": f"http://127.0.0.1:{LFX_PORT}",
         "CALLBACK_BASE_URL": f"http://127.0.0.1:{API_PORT}",
+        "CALLBACK_TOKEN": "smoke-callback-token",
     }
     lfx = subprocess.Popen(
         [