@langchain/langgraph-api 1.4.2 → 1.4.3

package/dist/api/store.mjs

@@ -3,8 +3,21 @@ import { zValidator } from "@hono/zod-validator";
 import * as schemas from "../schemas.mjs";
 import { HTTPException } from "hono/http-exception";
 import { store as storageStore } from "../storage/store.mjs";
-import { handleAuthEvent } from "../auth/index.mjs";
+import { handleAuthEvent, isAuthMatching, } from "../auth/index.mjs";
 const api = new Hono();
+const AUTH_FILTER_SCAN_PAGE_LIMIT = 1000;
+const AUTH_FILTER_MAX_SCAN_LIMIT = 10_000;
+const throwStoreAuthScanLimitError = () => {
+    throw new HTTPException(400, {
+        message: "Authenticated store query exceeded maximum scan limit. Narrow the namespace or filters.",
+    });
+};
+const getStoreAuthMetadata = (namespace, key, value) => ({
+    ...(value ?? {}),
+    namespace: namespace ?? [],
+    ...(key == null ? {} : { key }),
+});
+const isStoreAuthMatching = (namespace, key, value, filters) => isAuthMatching(getStoreAuthMetadata(namespace, key, value), filters);
 const validateNamespace = (namespace) => {
     if (!namespace || namespace.length === 0) {
         throw new HTTPException(400, { message: "Namespace is required" });
@@ -35,41 +48,99 @@ api.post("/store/namespaces", zValidator("json", schemas.StoreListNamespaces), a
         validateNamespace(payload.prefix);
     if (payload.suffix)
         validateNamespace(payload.suffix);
-    await handleAuthEvent(c.var.auth, "store:list_namespaces", {
+    const [filters] = await handleAuthEvent(c.var.auth, "store:list_namespaces", {
         namespace: payload.prefix,
         suffix: payload.suffix,
         max_depth: payload.max_depth,
         limit: payload.limit,
         offset: payload.offset,
     });
-    return c.json({
-        namespaces: await storageStore.listNamespaces({
-            limit: payload.limit ?? 100,
-            offset: payload.offset ?? 0,
+    const limit = payload.limit ?? 100;
+    const offset = payload.offset ?? 0;
+    let namespaces;
+    if (filters == null) {
+        namespaces = await storageStore.listNamespaces({
+            limit,
+            offset,
             prefix: payload.prefix,
             suffix: payload.suffix,
             maxDepth: payload.max_depth,
-        }),
-    });
+        });
+    }
+    else {
+        const authorizedNamespaces = [];
+        const requiredCount = offset + limit;
+        let scannedCount = 0;
+        while (authorizedNamespaces.length < requiredCount &&
+            scannedCount < AUTH_FILTER_MAX_SCAN_LIMIT) {
+            const scanLimit = Math.min(AUTH_FILTER_SCAN_PAGE_LIMIT, AUTH_FILTER_MAX_SCAN_LIMIT - scannedCount);
+            const candidates = await storageStore.listNamespaces({
+                limit: scanLimit,
+                offset: scannedCount,
+                prefix: payload.prefix,
+                suffix: payload.suffix,
+                maxDepth: payload.max_depth,
+            });
+            scannedCount += candidates.length;
+            authorizedNamespaces.push(...candidates.filter((namespace) => isStoreAuthMatching(namespace, undefined, undefined, filters)));
+            if (candidates.length < scanLimit)
+                break;
+        }
+        if (authorizedNamespaces.length < requiredCount &&
+            scannedCount >= AUTH_FILTER_MAX_SCAN_LIMIT) {
+            throwStoreAuthScanLimitError();
+        }
+        namespaces = authorizedNamespaces.slice(offset, requiredCount);
+    }
+    return c.json({ namespaces });
 });
 api.post("/store/items/search", zValidator("json", schemas.StoreSearchItems), async (c) => {
     // Search Items
     const payload = c.req.valid("json");
-    if (payload.namespace_prefix)
+    if (payload.namespace_prefix.length)
         validateNamespace(payload.namespace_prefix);
-    await handleAuthEvent(c.var.auth, "store:search", {
+    const [filters] = await handleAuthEvent(c.var.auth, "store:search", {
         namespace: payload.namespace_prefix,
         filter: payload.filter,
         limit: payload.limit,
         offset: payload.offset,
         query: payload.query,
     });
-    const items = await storageStore.search(payload.namespace_prefix, {
-        filter: payload.filter,
-        limit: payload.limit ?? 10,
-        offset: payload.offset ?? 0,
-        query: payload.query,
-    });
+    const limit = payload.limit ?? 10;
+    const offset = payload.offset ?? 0;
+    let items;
+    if (filters == null) {
+        items = await storageStore.search(payload.namespace_prefix, {
+            filter: payload.filter,
+            limit,
+            offset,
+            query: payload.query,
+        });
+    }
+    else {
+        const authorizedItems = [];
+        const requiredCount = offset + limit;
+        let scannedCount = 0;
+        while (authorizedItems.length < requiredCount &&
+            scannedCount < AUTH_FILTER_MAX_SCAN_LIMIT) {
+            const scanLimit = Math.min(AUTH_FILTER_SCAN_PAGE_LIMIT, AUTH_FILTER_MAX_SCAN_LIMIT - scannedCount);
+            const candidates = await storageStore.search(payload.namespace_prefix, {
+                filter: payload.filter,
+                limit: scanLimit,
+                offset: scannedCount,
+                query: payload.query,
+            });
+            scannedCount += candidates.length;
+            authorizedItems.push(...candidates.filter((item) => isStoreAuthMatching(item.namespace, item.key, item.value, filters)));
+            if (candidates.length < scanLimit)
+                break;
+        }
+        if (authorizedItems.length < requiredCount &&
+            scannedCount >= AUTH_FILTER_MAX_SCAN_LIMIT) {
+            throwStoreAuthScanLimitError();
+        }
+        items = authorizedItems.slice(offset, requiredCount);
+    }
     return c.json({ items: items.map(mapItemsToApi) });
 });
 api.put("/store/items", zValidator("json", schemas.StorePutItem), async (c) => {
@@ -77,12 +148,22 @@ api.put("/store/items", zValidator("json", schemas.StorePutItem), async (c) => {
     const payload = c.req.valid("json");
     if (payload.namespace)
         validateNamespace(payload.namespace);
-    await handleAuthEvent(c.var.auth, "store:put", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:put", {
         namespace: payload.namespace,
         key: payload.key,
         value: payload.value,
     });
-    await storageStore.put(payload.namespace, payload.key, payload.value);
+    if (mutable.namespace)
+        validateNamespace(mutable.namespace);
+    const existingItem = await storageStore.get(mutable.namespace, mutable.key);
+    if (existingItem != null &&
+        !isStoreAuthMatching(existingItem.namespace, existingItem.key, existingItem.value, filters)) {
+        throw new HTTPException(404, { message: "Item not found" });
+    }
+    if (!isStoreAuthMatching(mutable.namespace, mutable.key, mutable.value, filters)) {
+        throw new HTTPException(403, { message: "Not authorized" });
+    }
+    await storageStore.put(mutable.namespace, mutable.key, mutable.value);
     return c.body(null, 204);
 });
 api.delete("/store/items", zValidator("json", schemas.StoreDeleteItem), async (c) => {
@@ -90,22 +171,38 @@ api.delete("/store/items", zValidator("json", schemas.StoreDeleteItem), async (c
     const payload = c.req.valid("json");
     if (payload.namespace)
         validateNamespace(payload.namespace);
-    await handleAuthEvent(c.var.auth, "store:delete", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:delete", {
         namespace: payload.namespace,
         key: payload.key,
     });
-    await storageStore.delete(payload.namespace ?? [], payload.key);
+    const namespace = mutable.namespace ?? [];
+    if (namespace.length)
+        validateNamespace(namespace);
+    const existingItem = await storageStore.get(namespace, mutable.key);
+    if (existingItem != null) {
+        if (!isStoreAuthMatching(existingItem.namespace, existingItem.key, existingItem.value, filters)) {
+            throw new HTTPException(404, { message: "Item not found" });
+        }
+    }
+    else if (!isStoreAuthMatching(namespace, mutable.key, undefined, filters)) {
+        throw new HTTPException(403, { message: "Not authorized" });
+    }
+    await storageStore.delete(namespace, mutable.key);
     return c.body(null, 204);
 });
 api.get("/store/items", zValidator("query", schemas.StoreGetItem), async (c) => {
     // Get Item
     const payload = c.req.valid("query");
-    await handleAuthEvent(c.var.auth, "store:get", {
+    const [filters, mutable] = await handleAuthEvent(c.var.auth, "store:get", {
         namespace: payload.namespace,
         key: payload.key,
     });
-    const key = payload.key;
-    const namespace = payload.namespace;
-    return c.json(mapItemsToApi(await storageStore.get(namespace, key)));
+    const namespace = mutable.namespace ?? [];
+    const item = await storageStore.get(namespace, mutable.key);
+    if (item != null &&
+        !isStoreAuthMatching(item.namespace, item.key, item.value, filters)) {
+        throw new HTTPException(404, { message: "Item not found" });
+    }
+    return c.json(mapItemsToApi(item));
 });
 export default api;

package/dist/server.mjs

@@ -132,6 +132,13 @@ export async function startServer(options, storage) {
     });
     // Loopback fetch used by webhooks and custom routes
     bindLoopbackFetch(app);
+    app.use(cors(options.http?.cors));
+    app.use(requestLogger());
+    if (options.auth?.path) {
+        logger.info(`Loading auth from ${options.auth.path}`);
+        await registerAuth(options.auth, { cwd: options.cwd });
+        app.use(auth());
+    }
     app.post("/internal/truncate", zValidator("json", z.object({
         runs: z.boolean().optional(),
         threads: z.boolean().optional(),
@@ -143,13 +150,6 @@ export async function startServer(options, storage) {
         ops.truncate({ runs, threads, assistants, checkpointer, store });
         return c.json({ ok: true });
     });
-    app.use(cors(options.http?.cors));
-    app.use(requestLogger());
-    if (options.auth?.path) {
-        logger.info(`Loading auth from ${options.auth.path}`);
-        await registerAuth(options.auth, { cwd: options.cwd });
-        app.use(auth());
-    }
     if (options.http?.app) {
         logger.info(`Loading HTTP app from ${options.http.app}`);
         const { api } = await registerHttp(options.http.app, { cwd: options.cwd });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@langchain/langgraph-api",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "type": "module",
   "engines": {
     "node": "^18.19.0 || >=20.16.0"
@@ -71,7 +71,7 @@
     "winston": "^3.17.0",
     "winston-console-format": "^1.0.8",
     "zod": "^3.25.76 || ^4",
-    "@langchain/langgraph-ui": "1.4.2"
+    "@langchain/langgraph-ui": "1.4.3"
   },
   "peerDependencies": {
     "@langchain/core": "^1.1.48",
@@ -104,9 +104,9 @@
     "typescript": "^4.9.5 || ^5.4.5",
     "vitest": "^4.1.9",
     "wait-port": "^1.1.0",
-    "@langchain/langgraph": "1.4.7",
-    "@langchain/langgraph-sdk": "1.9.25",
-    "@langchain/langgraph-checkpoint": "1.1.3"
+    "@langchain/langgraph": "1.4.8",
+    "@langchain/langgraph-checkpoint": "1.1.3",
+    "@langchain/langgraph-sdk": "1.9.26"
   },
   "scripts": {
     "clean": "rm -rf dist/ .turbo/ ./tests/graphs/.langgraph_api/ ./tests/protocol-v2/graphs/.langgraph_api/",