fix: authorize flow management, gate runs, token-gate callbacks, strict tenants

backend/scripts/smoke_e2e.py

@@ -10,6 +10,8 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
+import socket
 import subprocess
 import sys
 import tempfile
@@ -18,11 +20,21 @@ import urllib.request
 from pathlib import Path
 
 BACKEND = Path(__file__).resolve().parent.parent
-VENV_BIN = BACKEND / ".venv" / "bin"
+# Local venv (uv run) or image venv (/opt/venv in containers): prefer PATH.
+VENV_BIN = Path(shutil.which("lfx") or "").parent or (BACKEND / ".venv" / "bin")
 FIXTURES = BACKEND / "tests" / "fixtures" / "flows"
 
-LFX_PORT = 6004
-API_PORT = 8000
+
+def _free_port() -> int:
+    # Ephemeral ports: the dev API/LFX may already occupy the defaults
+    # (e.g. when smoke runs inside the api container itself).
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+LFX_PORT = _free_port()
+API_PORT = _free_port()
 LFX_KEY = "lfx-759GsfJKjAeOBZ_44-cll9WdHp_yfYn_tIg7eHG38Rs"
 
 
@@ -42,6 +54,9 @@ def api(method: str, path: str, body: dict | None = None) -> tuple[int, dict | s
     import httpx
 
     with httpx.Client(base_url=f"http://127.0.0.1:{API_PORT}", timeout=120) as c:
+        # Management + runs are login-gated; the smoke admin session is
+        # planted directly in the throwaway DB (see main()).
+        c.cookies.set("kirche_session", "smoke-session", domain="127.0.0.1")
         r = c.request(method, path, json=body)
         try:
             return r.status_code, r.json()
@@ -68,8 +83,36 @@ def main() -> None:
     cfg = Config()
     cfg.set_main_option("script_location", str(BACKEND / "migrations"))
     cfg.set_main_option("sqlalchemy.url", db_url)
+    # migrations/env.py takes the URL from settings (not the ini value):
+    # point this process at the throwaway DB before migrating.
+    from app.settings import settings as app_settings
+
+    app_settings.database_url = db_url
     alembic_command.upgrade(cfg, "head")
 
+    # Plant an admin session: management + runs require login, and there is
+    # no SMTP in smoke to deliver a magic link.
+    from datetime import UTC, datetime, timedelta
+
+    from sqlmodel import Session, create_engine
+
+    from app.models import User, UserSession
+
+    engine = create_engine(db_url)
+    with Session(engine) as s:
+        user = User(name="smoke", email="smoke@example.com", role="admin")
+        s.add(user)
+        s.flush()
+        s.add(
+            UserSession(
+                id="smoke-session",
+                user_id=user.id,
+                expires_at=datetime.now(UTC) + timedelta(hours=1),
+            )
+        )
+        s.commit()
+    engine.dispose()
+
     env = {
         **os.environ,
         # lfx prefers LANGFLOW_API_KEY over LFX_API_KEY; the repo .env may set
@@ -80,6 +123,7 @@ def main() -> None:
         "FLOWS_WATCH_ENABLED": "false",
         "LFX_URL": f"http://127.0.0.1:{LFX_PORT}",
         "CALLBACK_BASE_URL": f"http://127.0.0.1:{API_PORT}",
+        "CALLBACK_TOKEN": "smoke-callback-token",
     }
     lfx = subprocess.Popen(
         [