langgraph-api 0.1.0__tar.gz → 0.1.3__tar.gz

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: langgraph-api
-Version: 0.1.0
+Version: 0.1.3
 Summary: 
 License: Elastic-2.0
 Author: Nuno Campos
@@ -11,7 +11,6 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: blockbuster (>=1.5.24,<2.0.0)
 Requires-Dist: cloudpickle (>=3.0.0,<4.0.0)
 Requires-Dist: cryptography (>=42.0.0,<45.0)
 Requires-Dist: httpx (>=0.25.0)

langgraph_api-0.1.3/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.3"

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/auth/custom.py

@@ -7,7 +7,7 @@ import os
 import sys
 from collections.abc import Awaitable, Callable, Mapping
 from contextlib import AsyncExitStack
-from typing import Any, get_args
+from typing import Any, Literal, get_args
 
 import structlog
 from langgraph_sdk import Auth
@@ -26,6 +26,7 @@ from starlette.responses import Response
 from langgraph_api.auth.langsmith.backend import LangsmithAuthBackend
 from langgraph_api.auth.studio_user import StudioUser
 from langgraph_api.config import LANGGRAPH_AUTH, LANGGRAPH_AUTH_TYPE
+from langgraph_api.js.base import is_js_path
 
 logger = structlog.stdlib.get_logger(__name__)
 
@@ -56,7 +57,7 @@ def get_custom_auth_middleware() -> AuthenticationBackend:
 
 
 @functools.lru_cache(maxsize=1)
-def get_auth_instance() -> Auth | None:
+def get_auth_instance() -> Auth | Literal["js"] | None:
     logger.info(
         f"Getting auth instance: {LANGGRAPH_AUTH}", langgraph_auth=str(LANGGRAPH_AUTH)
     )
@@ -89,6 +90,12 @@ async def handle_event(
     auth = get_auth_instance()
     if auth is None:
         return
+
+    if auth == "js":
+        from langgraph_api.js.remote import handle_js_auth_event
+
+        return await handle_js_auth_event(ctx, value)
+
     handler = _get_handler(auth, ctx)
     if not handler:
         return
@@ -195,6 +202,7 @@ def _get_custom_auth_middleware(
     else:
         path = config.get("path")
         disable_studio_auth = config.get("disable_studio_auth", disable_studio_auth)
+
     auth_instance = _get_auth_instance(path)
     if auth_instance is None:
         raise ValueError(
@@ -204,6 +212,12 @@ def _get_custom_auth_middleware(
             "from langgraph_sdk import Auth\n"
             "auth = Auth()"
         )
+
+    if auth_instance == "js":
+        from langgraph_api.js.remote import CustomJsAuthBackend
+
+        return CustomJsAuthBackend(disable_studio_auth=disable_studio_auth)
+
     if auth_instance._authenticate_handler is None:
         raise ValueError(
             f"Custom Auth object at path: {path} does not have an authenticate handler."
@@ -214,6 +228,7 @@ def _get_custom_auth_middleware(
             "async def authenticate(request):\n"
             '    return "my-user-id"'
         )
+
     result = CustomAuthBackend(
         auth_instance._authenticate_handler,
         disable_studio_auth,
@@ -223,12 +238,15 @@ def _get_custom_auth_middleware(
 
 
 @functools.lru_cache(maxsize=1)
-def _get_auth_instance(path: str | None = None) -> Auth | None:
+def _get_auth_instance(path: str | None = None) -> Auth | Literal["js"] | None:
     if path is not None:
         auth_instance = _load_auth_obj(path)
     else:
         auth_instance = None
 
+    if auth_instance == "js":
+        return auth_instance
+
     if auth_instance is not None and (
         deps := _get_dependencies(auth_instance._authenticate_handler)
     ):
@@ -544,7 +562,7 @@ def normalize_user(user: Any) -> BaseUser:
     )
 
 
-def _load_auth_obj(path: str) -> Auth:
+def _load_auth_obj(path: str) -> Auth | Literal["js"]:
     """Load an object from a path string."""
     if ":" not in path:
         raise ValueError(
@@ -555,6 +573,9 @@ def _load_auth_obj(path: str) -> Auth:
     module_name, callable_name = path.rsplit(":", 1)
     module_name = module_name.rstrip(":")
 
+    if is_js_path(module_name):
+        return "js"
+
     try:
         if "/" in module_name or ".py" in module_name:
             # Load from file path

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/auth/middleware.py

@@ -36,7 +36,7 @@ def on_error(conn: HTTPConnection, exc: AuthenticationError):
 
 class ConditionalAuthenticationMiddleware(AuthenticationMiddleware):
     async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
-        if scope["root_path"] == "/noauth":
+        if (root_path := scope.get("root_path")) and root_path.startswith("/noauth"):
             # disable auth for requests originating from SDK ASGI transport
             # root_path cannot be set from a request, so safe to use as auth bypass
             await self.app(scope, receive, send)
@@ -46,7 +46,6 @@ class ConditionalAuthenticationMiddleware(AuthenticationMiddleware):
             # disable auth for UI asset requests
             await self.app(scope, receive, send)
             return
-
         return await super().__call__(scope, receive, send)
 
 

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/config.py

@@ -37,6 +37,8 @@ class HttpConfig(TypedDict, total=False):
     """Disable /ui routes"""
     disable_mcp: bool
     """Disable /mcp routes"""
+    mount_prefix: str
+    """Prefix for mounted routes. E.g., "/my-deployment/api"."""
 
 
 class ThreadTTLConfig(TypedDict, total=False):
@@ -169,11 +171,15 @@ HTTP_CONFIG: HttpConfig | None = env("LANGGRAPH_HTTP", cast=_parse_json, default
 STORE_CONFIG: StoreConfig | None = env(
     "LANGGRAPH_STORE", cast=_parse_json, default=None
 )
+
+MOUNT_PREFIX: str | None = env("MOUNT_PREFIX", cast=str, default=None) or (
+    HTTP_CONFIG.get("mount_prefix") if HTTP_CONFIG else None
+)
+
 CORS_ALLOW_ORIGINS = env("CORS_ALLOW_ORIGINS", cast=CommaSeparatedStrings, default="*")
-if HTTP_CONFIG and HTTP_CONFIG.get("cors"):
-    CORS_CONFIG = HTTP_CONFIG["cors"]
-else:
-    CORS_CONFIG: CorsConfig | None = env("CORS_CONFIG", cast=_parse_json, default=None)
+CORS_CONFIG: CorsConfig | None = env("CORS_CONFIG", cast=_parse_json, default=None) or (
+    HTTP_CONFIG.get("cors") if HTTP_CONFIG else None
+)
 """
 {
     "type": "object",

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/graph.py

@@ -24,7 +24,7 @@ from starlette.exceptions import HTTPException
 
 from langgraph_api import asyncio as lg_asyncio
 from langgraph_api import config
-from langgraph_api.js.base import BaseRemotePregel
+from langgraph_api.js.base import BaseRemotePregel, is_js_path
 from langgraph_api.schema import Config
 
 if TYPE_CHECKING:
@@ -181,17 +181,6 @@ class GraphSpec(NamedTuple):
 js_bg_tasks: set[asyncio.Task] = set()
 
 
-def is_js_spec(spec: GraphSpec) -> bool:
-    return spec.path is not None and os.path.splitext(spec.path)[1] in (
-        ".ts",
-        ".mts",
-        ".cts",
-        ".js",
-        ".mjs",
-        ".cjs",
-    )
-
-
 def _load_graph_config_from_env() -> dict | None:
     """Return graph config from env."""
     config_str = os.getenv("LANGGRAPH_CONFIG")
@@ -283,6 +272,9 @@ async def collect_graphs_from_env(register: bool = False) -> None:
             for graph_path in glob.glob("/graphs/*.py")
         ]
 
+    def is_js_spec(x: GraphSpec) -> bool:
+        return is_js_path(x.path)
+
     js_specs = list(filter(is_js_spec, specs))
     py_specs = list(filterfalse(is_js_spec, specs))
 

langgraph_api-0.1.3/langgraph_api/js/base.py

@@ -0,0 +1,29 @@
+import os
+
+from langchain_core.runnables import Runnable
+
+from langgraph_api.schema import Config
+
+JS_EXTENSIONS = (
+    ".ts",
+    ".mts",
+    ".cts",
+    ".js",
+    ".mjs",
+    ".cjs",
+)
+
+
+def is_js_path(path: str | None) -> bool:
+    if path is None:
+        return False
+    return os.path.splitext(path)[1] in JS_EXTENSIONS
+
+
+class BaseRemotePregel(Runnable):
+    name: str = "LangGraph"
+
+    graph_id: str
+
+    # Config passed from get_graph()
+    config: Config

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/build.mts

@@ -4,19 +4,19 @@ import { z } from "zod";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import {
-  filterValidGraphSpecs,
   GraphSchema,
   resolveGraph,
   runGraphSchemaWorker,
 } from "./src/graph.mts";
 import { build } from "@langchain/langgraph-ui";
+import { filterValidExportPath } from "./src/utils/files.mts";
 
 const __dirname = new URL(".", import.meta.url).pathname;
 
 async function main() {
-  const specs = filterValidGraphSpecs(
+  const specs = Object.entries(
     z.record(z.string()).parse(JSON.parse(process.env.LANGSERVE_GRAPHS))
-  );
+  ).filter(([_, spec]) => filterValidExportPath(spec));
 
   const GRAPH_SCHEMAS: Record<string, Record<string, GraphSchema> | false> = {};
   let failed = false;

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/client.mts

@@ -42,11 +42,17 @@ import {
   GraphSchema,
   resolveGraph,
   GraphSpec,
-  filterValidGraphSpecs,
   type CompiledGraphFactory,
 } from "./src/graph.mts";
 import { asyncExitHook, gracefulExit } from "exit-hook";
 import { awaitAllCallbacks } from "@langchain/core/callbacks/promises";
+import { StatusCode } from "hono/utils/http-status";
+import {
+  authenticate,
+  authorize,
+  registerAuth,
+} from "@langchain/langgraph-api/auth";
+import { filterValidExportPath } from "./src/utils/files.mts";
 
 const logger = createLogger({
   level: "debug",
@@ -872,9 +878,9 @@ async function main() {
     store: new RemoteStore(),
   };
 
-  const specs = filterValidGraphSpecs(
+  const specs = Object.entries(
     z.record(z.string()).parse(JSON.parse(process.env.LANGSERVE_GRAPHS ?? "{}"))
-  );
+  ).filter(([_, spec]) => filterValidExportPath(spec));
 
   if (!process.argv.includes("--skip-schema-cache")) {
     try {
@@ -944,6 +950,61 @@ async function main() {
     )
   );
 
+  // Load LANGGRAPH_AUTH
+  const auth = z
+    .object({
+      path: z.string().optional(),
+      disable_studio_auth: z.boolean().optional(),
+    })
+    .parse(JSON.parse(process.env.LANGGRAPH_AUTH ?? "{}"));
+
+  if (filterValidExportPath(auth.path)) {
+    await registerAuth(auth, { cwd: process.cwd() });
+
+    app.post("/auth/authenticate", async (c) => {
+      try {
+        const rawHeaders = c.req.raw.headers;
+        const authUrl = rawHeaders.get("x-langgraph-auth-url") as string;
+        const method = rawHeaders.get("x-langgraph-auth-method") as string;
+
+        const headers = new Headers(rawHeaders);
+        headers.delete("x-langgraph-auth-url");
+        headers.delete("x-langgraph-auth-method");
+
+        const context = await authenticate(
+          new Request(authUrl, { headers, method })
+        );
+
+        return c.json(context);
+      } catch (error) {
+        if (error instanceof HTTPException) {
+          return c.json(
+            {
+              ...serializeError(error),
+              status: error.res?.status ?? error.status,
+              headers: error.res?.headers,
+            },
+            error.status as StatusCode
+          );
+        }
+
+        return c.json(serializeError(error), 403);
+      }
+    });
+
+    app.post("/auth/authorize", async (c) => {
+      try {
+        return c.json(await authorize(await c.req.json()));
+      } catch (error) {
+        if (error instanceof HTTPException) {
+          return c.json(serializeError(error), error.status);
+        }
+
+        return c.json(serializeError(error), 500);
+      }
+    });
+  }
+
   app.get("/ok", (c) => c.json({ ok: true }));
 
   app.onError((err, c) => {

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/global.d.ts

@@ -3,6 +3,7 @@ declare namespace NodeJS {
     LANGSERVE_GRAPHS: string;
     LANGGRAPH_UI?: string;
     LANGGRAPH_UI_CONFIG?: string;
+    LANGGRAPH_AUTH?: string;
     PORT: string;
   }
 }

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/package.json

@@ -24,15 +24,16 @@
     "undici": "^6.21.1",
     "uuid": "^10.0.0",
     "winston": "^3.17.0",
-    "@langchain/langgraph-api": "~0.0.20",
-    "@langchain/langgraph-ui": "~0.0.20",
+    "@langchain/langgraph-api": "~0.0.21",
+    "@langchain/langgraph-ui": "~0.0.21",
     "zod": "^3.23.8"
   },
   "resolutions": {
     "esbuild": "^0.25.0"
   },
   "devDependencies": {
-    "@langchain/langgraph-sdk": "^0.0.60",
+    "jose": "^6.0.10",
+    "@langchain/langgraph-sdk": "^0.0.66",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@types/node": "^22.2.0",

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/remote.py

@@ -5,7 +5,7 @@ import shutil
 import ssl
 from collections.abc import AsyncIterator
 from contextlib import AbstractContextManager
-from typing import Any, Literal, Self
+from typing import Any, Literal, Self, cast
 
 import certifi
 import httpx
@@ -24,12 +24,20 @@ from langgraph.checkpoint.serde.base import SerializerProtocol
 from langgraph.pregel.types import PregelTask, StateSnapshot
 from langgraph.store.base import GetOp, Item, ListNamespacesOp, PutOp, SearchOp
 from langgraph.types import Command, Interrupt, Send
+from langgraph_sdk import Auth
 from pydantic import BaseModel
 from starlette.applications import Starlette
+from starlette.authentication import (
+    AuthCredentials,
+    AuthenticationBackend,
+    BaseUser,
+)
 from starlette.exceptions import HTTPException
-from starlette.requests import Request
+from starlette.requests import HTTPConnection, Request
 from starlette.routing import Route
 
+from langgraph_api.auth.custom import DotDict, ProxyUser
+from langgraph_api.config import LANGGRAPH_AUTH_TYPE
 from langgraph_api.js.base import BaseRemotePregel
 from langgraph_api.js.errors import RemoteException
 from langgraph_api.js.sse import SSEDecoder, aiter_lines_raw
@@ -729,3 +737,86 @@ async def js_healthcheck():
                     status_code=500,
                     detail="JS healthcheck failed. Either the JS server is not running or the event loop is blocked by a CPU-intensive task.",
                 ) from exc
+
+
+class CustomJsAuthBackend(AuthenticationBackend):
+    ls_auth: AuthenticationBackend | None
+
+    def __init__(self, disable_studio_auth: bool = False):
+        self.ls_auth = None
+        if not disable_studio_auth and LANGGRAPH_AUTH_TYPE == "langsmith":
+            from langgraph_api.auth.langsmith.backend import LangsmithAuthBackend
+
+            self.ls_auth = LangsmithAuthBackend()
+
+    async def authenticate(
+        self, conn: HTTPConnection
+    ) -> tuple[AuthCredentials, BaseUser] | None:
+        if self.ls_auth is not None and (
+            (auth_scheme := conn.headers.get("x-auth-scheme"))
+            and auth_scheme == "langsmith"
+        ):
+            return await self.ls_auth.authenticate(conn)
+
+        headers = dict(conn.headers)
+        # need to remove content-length to prevent confusing the HTTP client
+        headers.pop("content-length", None)
+        headers["x-langgraph-auth-url"] = str(conn.url)
+        headers["x-langgraph-auth-method"] = conn.scope.get("method")
+
+        res = await _client.post("/auth/authenticate", headers=headers)
+        data = res.json()
+
+        if data.get("error"):
+            status = data.get("status") or 403
+            headers = data.get("headers")
+            message = data.get("message") or "Unauthorized"
+
+            raise HTTPException(status_code=status, detail=message, headers=headers)
+
+        return AuthCredentials(data["scopes"]), ProxyUser(DotDict(data["user"]))
+
+
+async def handle_js_auth_event(
+    ctx: Auth.types.AuthContext | None,
+    value: dict,
+) -> Auth.types.FilterType | None:
+    res = await _client.post(
+        "/auth/authorize",
+        headers={"Content-Type": "application/json"},
+        data=json_dumpb(
+            {
+                "resource": ctx.resource,
+                "action": ctx.action,
+                "value": value,
+                "context": {
+                    "user": cast(DotDict, ctx.user).dict(),
+                    "scopes": ctx.permissions,
+                }
+                if ctx
+                else None,
+            }
+        ),
+    )
+
+    response = res.json()
+
+    if response.get("error"):
+        status = response.get("status") or 403
+        headers = response.get("headers")
+        message = response.get("message") or "Unauthorized"
+
+        raise HTTPException(status_code=status, detail=message, headers=headers)
+
+    filters = cast(Auth.types.FilterType | None, response.get("filters"))
+
+    # mutate metadata in value if applicable
+    # we need to preserve the identity of the object, so cannot create a new
+    # dictionary, otherwise the changes will not persist
+    if isinstance(value, dict) and (updated_value := response.get("value")):
+        if isinstance(value.get("metadata"), dict) and (
+            metadata := updated_value.get("metadata")
+        ):
+            value["metadata"].update(metadata)
+
+    return filters

{langgraph_api-0.1.0 → langgraph_api-0.1.3}/langgraph_api/js/src/graph.mts

@@ -20,12 +20,6 @@ export interface GraphSpec {
   exportSymbol: string;
 }
 
-export function filterValidGraphSpecs(specs: Record<string, string>) {
-  return Object.entries(specs).filter(
-    ([_, spec]) => !spec.split(":")[0].endsWith(".py")
-  );
-}
-
 export type CompiledGraphFactory<T extends string> = (config: {
   configurable?: Record<string, unknown>;
 }) => Promise<CompiledGraph<T>>;

langgraph_api-0.1.3/langgraph_api/js/src/utils/files.mts

@@ -0,0 +1,4 @@
+export function filterValidExportPath(path: string | undefined) {
+  if (!path) return false;
+  return !path.split(":")[0].endsWith(".py");
+}