@langchain/langgraph-api 1.4.1 → 1.4.3

package/dist/api/runs.mjs

@@ -9,6 +9,7 @@ import { logError, logger } from "../logging.mjs";
 import * as schemas from "../schemas.mjs";
 import { runs, threads } from "../storage/context.mjs";
 import { getDisconnectAbortSignal, jsonExtra, waitKeepAlive, } from "../utils/hono.mjs";
+import { applyAuthToRunConfig, applyRequestHeadersToRunConfig, } from "../utils/run-auth.mjs";
 import { serialiseAsDict } from "../utils/serde.mjs";
 const api = new Hono();
 const createValidRun = async (threadId, payload, kwargs) => {
@@ -40,30 +41,8 @@ const createValidRun = async (threadId, payload, kwargs) => {
             langsmith_example_id: run.langsmith_tracer.example_id,
         });
     }
-    if (headers) {
-        for (const [rawKey, value] of headers.entries()) {
-            const key = rawKey.toLowerCase();
-            if (key.startsWith("x-")) {
-                if (["x-api-key", "x-tenant-id", "x-service-key"].includes(key)) {
-                    continue;
-                }
-                config.configurable ??= {};
-                config.configurable[key] = value;
-            }
-            else if (key === "user-agent") {
-                config.configurable ??= {};
-                config.configurable[key] = value;
-            }
-        }
-    }
-    let userId;
-    if (auth) {
-        userId = auth.user.identity ?? auth.user.id;
-        config.configurable ??= {};
-        config.configurable["langgraph_auth_user"] = auth.user;
-        config.configurable["langgraph_auth_user_id"] = userId;
-        config.configurable["langgraph_auth_permissions"] = auth.scopes;
-    }
+    applyRequestHeadersToRunConfig(config, headers);
+    const userId = applyAuthToRunConfig(config, auth);
     let feedbackKeys = run.feedback_keys != null
         ? Array.isArray(run.feedback_keys)
             ? run.feedback_keys

package/dist/api/store.mjs

@@ -3,8 +3,21 @@ import { zValidator } from "@hono/zod-validator";
 import * as schemas from "../schemas.mjs";
 import { HTTPException } from "hono/http-exception";
 import { store as storageStore } from "../storage/store.mjs";
-import { handleAuthEvent } from "../auth/index.mjs";
+import { handleAuthEvent, isAuthMatching, } from "../auth/index.mjs";
 const api = new Hono();
+const AUTH_FILTER_SCAN_PAGE_LIMIT = 1000;
+const AUTH_FILTER_MAX_SCAN_LIMIT = 10_000;
+const throwStoreAuthScanLimitError = () => {
+    throw new HTTPException(400, {
+        message: "Authenticated store query exceeded maximum scan limit. Narrow the namespace or filters.",
+    });
+};
+const getStoreAuthMetadata = (namespace, key, value) => ({
+    ...(value ?? {}),
+    namespace: namespace ?? [],
+    ...(key == null ? {} : { key }),
+});
+const isStoreAuthMatching = (namespace, key, value, filters) => isAuthMatching(getStoreAuthMetadata(namespace, key, value), filters);
 const validateNamespace = (namespace) => {
     if (!namespace || namespace.length === 0) {
         throw new HTTPException(400, { message: "Namespace is required" });
@@ -35,41 +48,99 @@ api.post("/store/namespaces", zValidator("json", schemas.StoreListNamespaces), a
         validateNamespace(payload.prefix);
     if (payload.suffix)
         validateNamespace(payload.suffix);
-    await handleAuthEvent(c.var.auth, "store:list_namespaces", {
+    const [filters] = await handleAuthEvent(c.var.auth, "store:list_namespaces", {
         namespace: payload.prefix,
         suffix: payload.suffix,
         max_depth: payload.max_depth,
         limit: payload.limit,
         offset: payload.offset,
     });
-    return c.json({
-        namespaces: await storageStore.listNamespaces({
-            limit: payload.limit ?? 100,
-            offset: payload.offset ?? 0,
+    const limit = payload.limit ?? 100;
+    const offset = payload.offset ?? 0;
+    let namespaces;
+    if (filters == null) {
+        namespaces = await storageStore.listNamespaces({
+            limit,
+            offset,
             prefix: payload.prefix,
             suffix: payload.suffix,
             maxDepth: payload.max_depth,
-        }),
-    });
+        });
+    }
+    else {
+        const authorizedNamespaces = [];
+        const requiredCount = offset + limit;
+        let scannedCount = 0;
+        while (authorizedNamespaces.length < requiredCount &&
+            scannedCount < AUTH_FILTER_MAX_SCAN_LIMIT) {
+            const scanLimit = Math.min(AUTH_FILTER_SCAN_PAGE_LIMIT, AUTH_FILTER_MAX_SCAN_LIMIT - scannedCount);
+            const candidates = await storageStore.listNamespaces({
+                limit: scanLimit,
+                offset: scannedCount,
+                prefix: payload.prefix,
+                suffix: payload.suffix,
+                maxDepth: payload.max_depth,
+            });
+            scannedCount += candidates.length;
+            authorizedNamespaces.push(...candidates.filter((namespace) => isStoreAuthMatching(namespace, undefined, undefined, filters)));
+            if (candidates.length < scanLimit)
+                break;
+        }
+        if (authorizedNamespaces.length < requiredCount &&
+            scannedCount >= AUTH_FILTER_MAX_SCAN_LIMIT) {
+            throwStoreAuthScanLimitError();
+        }
+        namespaces = authorizedNamespaces.slice(offset, requiredCount);
+    }
+    return c.json({ namespaces });
 });
 api.post("/store/items/search", zValidator("json", schemas.StoreSearchItems), async (c) => {
     // Search Items
     const payload = c.req.valid("json");
-    if (payload.namespace_prefix)
+    if (payload.namespace_prefix.length)
         validateNamespace(payload.namespace_prefix);
-    await handleAuthEvent(c.var.auth, "store:search", {
+    const [filters] = await handleAuthEvent(c.var.auth, "store:search", {
         namespace: payload.namespace_prefix,
         filter: payload.filter,
         limit: payload.limit,
         offset: payload.offset,
         query: payload.query,
     });
-    const items = await storageStore.search(payload.namespace_prefix, {
-        filter: payload.filter,
-        limit: payload.limit ?? 10,
-        offset: payload.offset ?? 0,
-        query: payload.query,
-    });
+    const limit = payload.limit ?? 10;
+    const offset = payload.offset ?? 0;
+    let items;
+    if (filters == null) {
+        items = await storageStore.search(payload.namespace_prefix, {
+            filter: payload.filter,
+            limit,
+            offset,
+            query: payload.query,
+        });
+    }
+    else {
+        const authorizedItems = [];
+        const requiredCount = offset + limit;
+        let scannedCount = 0;
+        while (authorizedItems.length < requiredCount &&
+            scannedCount < AUTH_FILTER_MAX_SCAN_LIMIT) {
+            const scanLimit = Math.min(AUTH_FILTER_SCAN_PAGE_LIMIT, AUTH_FILTER_MAX_SCAN_LIMIT - scannedCount);
+            const candidates = await storageStore.search(payload.namespace_prefix, {
+                filter: payload.filter,
+                limit: scanLimit,
+                offset: scannedCount,
+                query: payload.query,
+            });
+            scannedCount += candidates.length;
+            authorizedItems.push(...candidates.filter((item) => isStoreAuthMatching(item.namespace, item.key, item.value, filters)));
+            if (candidates.length < scanLimit)
+                break;
+        }
+        if (authorizedItems.length < requiredCount &&
+            scannedCount >= AUTH_FILTER_MAX_SCAN_LIMIT) {
+            throwStoreAuthScanLimitError();
+        }
+        items = authorizedItems.slice(offset, requiredCount);
+    }
     return c.json({ items: items.map(mapItemsToApi) });
 });
 api.put("/store/items", zValidator("json", schemas.StorePutItem), async (c) => {
@@ -77,12 +148,22 @@ api.put("/store/items", zValidator("json", schemas.StorePutItem), async (c) => {
     const payload = c.req.valid("json");
     if (payload.namespace)
         validateNamespace(payload.namespace);
-    await handleAuthEvent(c.var.auth, "store:put", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:put", {
         namespace: payload.namespace,
         key: payload.key,
         value: payload.value,
     });
-    await storageStore.put(payload.namespace, payload.key, payload.value);
+    if (mutable.namespace)
+        validateNamespace(mutable.namespace);
+    const existingItem = await storageStore.get(mutable.namespace, mutable.key);
+    if (existingItem != null &&
+        !isStoreAuthMatching(existingItem.namespace, existingItem.key, existingItem.value, filters)) {
+        throw new HTTPException(404, { message: "Item not found" });
+    }
+    if (!isStoreAuthMatching(mutable.namespace, mutable.key, mutable.value, filters)) {
+        throw new HTTPException(403, { message: "Not authorized" });
+    }
+    await storageStore.put(mutable.namespace, mutable.key, mutable.value);
     return c.body(null, 204);
 });
 api.delete("/store/items", zValidator("json", schemas.StoreDeleteItem), async (c) => {
@@ -90,22 +171,38 @@ api.delete("/store/items", zValidator("json", schemas.StoreDeleteItem), async (c
     const payload = c.req.valid("json");
     if (payload.namespace)
         validateNamespace(payload.namespace);
-    await handleAuthEvent(c.var.auth, "store:delete", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:delete", {
         namespace: payload.namespace,
         key: payload.key,
     });
-    await storageStore.delete(payload.namespace ?? [], payload.key);
+    const namespace = mutable.namespace ?? [];
+    if (namespace.length)
+        validateNamespace(namespace);
+    const existingItem = await storageStore.get(namespace, mutable.key);
+    if (existingItem != null) {
+        if (!isStoreAuthMatching(existingItem.namespace, existingItem.key, existingItem.value, filters)) {
+            throw new HTTPException(404, { message: "Item not found" });
+        }
+    }
+    else if (!isStoreAuthMatching(namespace, mutable.key, undefined, filters)) {
+        throw new HTTPException(403, { message: "Not authorized" });
+    }
+    await storageStore.delete(namespace, mutable.key);
     return c.body(null, 204);
 });
 api.get("/store/items", zValidator("query", schemas.StoreGetItem), async (c) => {
     // Get Item
     const payload = c.req.valid("query");
-    await handleAuthEvent(c.var.auth, "store:get", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:get", {
         namespace: payload.namespace,
         key: payload.key,
     });
-    const key = payload.key;
-    const namespace = payload.namespace;
-    return c.json(mapItemsToApi(await storageStore.get(namespace, key)));
+    const namespace = mutable.namespace ?? [];
+    const item = await storageStore.get(namespace, mutable.key);
+    if (item != null &&
+        !isStoreAuthMatching(item.namespace, item.key, item.value, filters)) {
+        throw new HTTPException(404, { message: "Item not found" });
+    }
+    return c.json(mapItemsToApi(item));
 });
 export default api;

package/dist/protocol/service.mjs

@@ -1,6 +1,7 @@
 import { inferChannel, isPrefixMatch } from "@langchain/langgraph/stream";
 import { v7 as uuid7 } from "@langchain/core/utils/uuid";
 import { getAssistantId } from "../graph/load.mjs";
+import { applyAuthToRunConfig } from "../utils/run-auth.mjs";
 import { PROTOCOL_STREAM_RUN_KEY } from "./constants.mjs";
 import { RunProtocolSession } from "./session/index.mjs";
 const DEFAULT_RUN_STREAM_MODES = [
@@ -326,6 +327,7 @@ export class ProtocolService {
                 thread_id: record.threadId,
             },
         };
+        const userId = applyAuthToRunConfig(runConfig, record.auth);
         const runPayload = {
             assistant_id: assistantId,
             input: isResume ? null : params.input,
@@ -366,6 +368,7 @@ export class ProtocolService {
             [PROTOCOL_STREAM_RUN_KEY]: true,
         }, {
             threadId: record.threadId,
+            userId,
             metadata: runPayload.metadata,
             status: "pending",
             multitaskStrategy: runPayload.multitask_strategy,

package/dist/server.mjs

@@ -132,6 +132,13 @@ export async function startServer(options, storage) {
     });
     // Loopback fetch used by webhooks and custom routes
     bindLoopbackFetch(app);
+    app.use(cors(options.http?.cors));
+    app.use(requestLogger());
+    if (options.auth?.path) {
+        logger.info(`Loading auth from ${options.auth.path}`);
+        await registerAuth(options.auth, { cwd: options.cwd });
+        app.use(auth());
+    }
     app.post("/internal/truncate", zValidator("json", z.object({
         runs: z.boolean().optional(),
         threads: z.boolean().optional(),
@@ -143,13 +150,6 @@ export async function startServer(options, storage) {
         ops.truncate({ runs, threads, assistants, checkpointer, store });
         return c.json({ ok: true });
     });
-    app.use(cors(options.http?.cors));
-    app.use(requestLogger());
-    if (options.auth?.path) {
-        logger.info(`Loading auth from ${options.auth.path}`);
-        await registerAuth(options.auth, { cwd: options.cwd });
-        app.use(auth());
-    }
     if (options.http?.app) {
         logger.info(`Loading HTTP app from ${options.http.app}`);
         const { api } = await registerHttp(options.http.app, { cwd: options.cwd });

package/dist/utils/run-auth.d.mts

@@ -0,0 +1,13 @@
+import type { AuthContext } from "../auth/index.mjs";
+import type { RunnableConfig } from "../storage/types.mjs";
+/**
+ * Copy allowed request headers into `config.configurable`, matching the REST
+ * runs API (`createValidRun`). Used by both REST and protocol-v2 run creation.
+ */
+export declare function applyRequestHeadersToRunConfig(config: RunnableConfig, headers: Headers | undefined): void;
+/**
+ * Stamp the authenticated user onto `config.configurable` so graph nodes and
+ * tools can read `langgraph_auth_user`. Returns the resolved user id for run
+ * metadata when auth is present.
+ */
+export declare function applyAuthToRunConfig(config: RunnableConfig, auth: AuthContext | undefined): string | undefined;

package/dist/utils/run-auth.mjs

@@ -0,0 +1,42 @@
+const BLOCKED_CONFIGURABLE_HEADERS = new Set([
+    "x-api-key",
+    "x-tenant-id",
+    "x-service-key",
+]);
+/**
+ * Copy allowed request headers into `config.configurable`, matching the REST
+ * runs API (`createValidRun`). Used by both REST and protocol-v2 run creation.
+ */
+export function applyRequestHeadersToRunConfig(config, headers) {
+    if (!headers)
+        return;
+    for (const [rawKey, value] of headers.entries()) {
+        const key = rawKey.toLowerCase();
+        if (key.startsWith("x-")) {
+            if (BLOCKED_CONFIGURABLE_HEADERS.has(key))
+                continue;
+            config.configurable ??= {};
+            config.configurable[key] = value;
+        }
+        else if (key === "user-agent") {
+            config.configurable ??= {};
+            config.configurable[key] = value;
+        }
+    }
+}
+/**
+ * Stamp the authenticated user onto `config.configurable` so graph nodes and
+ * tools can read `langgraph_auth_user`. Returns the resolved user id for run
+ * metadata when auth is present.
+ */
+export function applyAuthToRunConfig(config, auth) {
+    if (!auth)
+        return undefined;
+    const userId = auth.user.identity ??
+        (typeof auth.user.id === "string" ? auth.user.id : undefined);
+    config.configurable ??= {};
+    config.configurable.langgraph_auth_user = auth.user;
+    config.configurable.langgraph_auth_user_id = userId;
+    config.configurable.langgraph_auth_permissions = auth.scopes;
+    return userId;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@langchain/langgraph-api",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "type": "module",
   "engines": {
     "node": "^18.19.0 || >=20.16.0"
@@ -71,7 +71,7 @@
     "winston": "^3.17.0",
     "winston-console-format": "^1.0.8",
     "zod": "^3.25.76 || ^4",
-    "@langchain/langgraph-ui": "1.4.1"
+    "@langchain/langgraph-ui": "1.4.3"
   },
   "peerDependencies": {
     "@langchain/core": "^1.1.48",
@@ -93,20 +93,20 @@
     "@langchain/core": "^1.2.1",
     "@types/babel__code-frame": "^7.0.6",
     "@types/node": "^18.15.11",
-    "@types/react": "^19.2.16",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.0.3",
     "@types/semver": "^7.7.0",
     "deepagents": "^1.10.5",
     "jose": "^6.0.10",
-    "langchain": "^1.5.1",
+    "langchain": "^1.5.2",
     "postgres": "^3.4.5",
     "ts-node": "^10.9.2",
     "typescript": "^4.9.5 || ^5.4.5",
-    "vitest": "^4.1.0",
+    "vitest": "^4.1.9",
     "wait-port": "^1.1.0",
-    "@langchain/langgraph": "1.4.6",
+    "@langchain/langgraph": "1.4.8",
     "@langchain/langgraph-checkpoint": "1.1.3",
-    "@langchain/langgraph-sdk": "1.9.25"
+    "@langchain/langgraph-sdk": "1.9.26"
   },
   "scripts": {
     "clean": "rm -rf dist/ .turbo/ ./tests/graphs/.langgraph_api/ ./tests/protocol-v2/graphs/.langgraph_api/",