Skip to content

Add LS sdk to link_py.py for auth link fix #1333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 7, 2025
Merged

Add LS sdk to link_py.py for auth link fix #1333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 72 additions & 1 deletion pipeline/preprocessors/link_map.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,11 +237,82 @@ class LinkMap(TypedDict):
"Runtime": "langgraph/runtime/#langgraph.runtime.Runtime",
"Send": "langgraph/types/#langgraph.types.Send",
"Topic": "langgraph/channels/#langgraph.channels.Topic",
# SDK
# LangSmith Deployment SDK
# Main client
"get_client": "langsmith/deployment/sdk/#langgraph_sdk.get_client",
"get_sync_client": "langsmith/deployment/sdk/#langgraph_sdk.get_sync_client",
"LangGraphClient": "langsmith/deployment/sdk/#langgraph_sdk.client.LangGraphClient",
# HTTP clients
"HttpClient": "langsmith/deployment/sdk/#langgraph_sdk.client.HttpClient",
"SyncHttpClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncHttpClient",
# Resource clients - Async
"AssistantsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.AssistantsClient",
"ThreadsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.ThreadsClient",
"RunsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.RunsClient",
"CronClient": "langsmith/deployment/sdk/#langgraph_sdk.client.CronClient",
"StoreClient": "langsmith/deployment/sdk/#langgraph_sdk.client.StoreClient",
# Resource clients - Sync
"SyncAssistantsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncAssistantsClient",
"SyncThreadsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncThreadsClient",
"SyncRunsClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncRunsClient",
"SyncCronClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncCronClient",
"SyncStoreClient": "langsmith/deployment/sdk/#langgraph_sdk.client.SyncStoreClient",
# Client methods
"client.runs.stream": "langsmith/deployment/sdk/#langgraph_sdk.client.RunsClient.stream",
"client.runs.wait": "langsmith/deployment/sdk/#langgraph_sdk.client.RunsClient.wait",
"client.threads.get_history": "langsmith/deployment/sdk/#langgraph_sdk.client.ThreadsClient.get_history",
"client.threads.update_state": "langsmith/deployment/sdk/#langgraph_sdk.client.ThreadsClient.update_state",
# Schema types - Enumerations
"RunStatus": "langsmith/deployment/sdk/#langgraph_sdk.schema.RunStatus",
"ThreadStatus": "langsmith/deployment/sdk/#langgraph_sdk.schema.ThreadStatus",
"StreamMode": "langsmith/deployment/sdk/#langgraph_sdk.schema.StreamMode",
"DisconnectMode": "langsmith/deployment/sdk/#langgraph_sdk.schema.DisconnectMode",
"MultitaskStrategy": "langsmith/deployment/sdk/#langgraph_sdk.schema.MultitaskStrategy",
"OnConflictBehavior": "langsmith/deployment/sdk/#langgraph_sdk.schema.OnConflictBehavior",
# Schema types - Data models
"Assistant": "langsmith/deployment/sdk/#langgraph_sdk.schema.Assistant",
"AssistantVersion": "langsmith/deployment/sdk/#langgraph_sdk.schema.AssistantVersion",
"Thread": "langsmith/deployment/sdk/#langgraph_sdk.schema.Thread",
"Run": "langsmith/deployment/sdk/#langgraph_sdk.schema.Run",
"Cron": "langsmith/deployment/sdk/#langgraph_sdk.schema.Cron",
"Config": "langsmith/deployment/sdk/#langgraph_sdk.schema.Config",
"Checkpoint": "langsmith/deployment/sdk/#langgraph_sdk.schema.Checkpoint",
"GraphSchema": "langsmith/deployment/sdk/#langgraph_sdk.schema.GraphSchema",
"Item": "langsmith/deployment/sdk/#langgraph_sdk.schema.Item",
"SearchItem": "langsmith/deployment/sdk/#langgraph_sdk.schema.SearchItem",
"ThreadState": "langsmith/deployment/sdk/#langgraph_sdk.schema.ThreadState",
# Auth types
"Auth": "langsmith/deployment/sdk/#langgraph_sdk.auth.Auth",
"Auth.authenticate": "langsmith/deployment/sdk/#langgraph_sdk.auth.Auth.authenticate",
"Auth.on": "langsmith/deployment/sdk/#langgraph_sdk.auth.Auth.on",
"AuthContext": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AuthContext",
"BaseUser": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.BaseUser",
"StudioUser": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.StudioUser",
"MinimalUserDict": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.MinimalUserDict",
"HTTPException": "langsmith/deployment/sdk/#langgraph_sdk.auth.exceptions.HTTPException",
# Auth types - Threads
"ThreadsCreate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.ThreadsCreate",
"ThreadsRead": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.ThreadsRead",
"ThreadsUpdate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.ThreadsUpdate",
"ThreadsDelete": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.ThreadsDelete",
"ThreadsSearch": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.ThreadsSearch",
# Auth types - Assistants
"AssistantsCreate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AssistantsCreate",
"AssistantsRead": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AssistantsRead",
"AssistantsUpdate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AssistantsUpdate",
"AssistantsDelete": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AssistantsDelete",
"AssistantsSearch": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.AssistantsSearch",
# Auth types - Runs
"RunsCreate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.RunsCreate",
# Auth types - Crons
"CronsCreate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.CronsCreate",
"CronsRead": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.CronsRead",
"CronsUpdate": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.CronsUpdate",
"CronsDelete": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.CronsDelete",
"CronsSearch": "langsmith/deployment/sdk/#langgraph_sdk.auth.types.CronsSearch",
# Schema create types
"RunCreate": "langsmith/deployment/sdk/#langgraph_sdk.schema.RunCreate",
"RunCreateMetadata": "langsmith/deployment/sdk/#langgraph_sdk.schema.RunCreateMetadata",
# Functional API
"@task": "langgraph/func/#langgraph.func.task",
"@entrypoint": "langgraph/func/#langgraph.func.entrypoint",
Expand Down
56 changes: 28 additions & 28 deletions src/langsmith/auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ While often used interchangeably, these terms represent distinct security concep
* [**Authentication**](#authentication) ("AuthN") verifies _who_ you are. This runs as middleware for every request.
* [**Authorization**](#authorization) ("AuthZ") determines _what you can do_. This validates the user's privileges and roles on a per-resource basis.

In LangSmith, authentication is handled by your [`@auth.authenticate`](/langsmith/smith-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler, and authorization is handled by your [`@auth.on`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.on) handlers.
In LangSmith, authentication is handled by your @[`@auth.authenticate`][Auth.authenticate] handler, and authorization is handled by your @[`@auth.on`][Auth.on] handlers.

## Default security models

Expand Down Expand Up @@ -76,15 +76,15 @@ sequenceDiagram
LG-->>Client: 8. Return resources
```

Your [`@auth.authenticate`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler in LangGraph handles steps 4-6, while your [`@auth.on`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.on) handlers implement step 7.
Your @[`@auth.authenticate`][Auth.authenticate] handler in LangGraph handles steps 4-6, while your @[`@auth.on`][Auth.on] handlers implement step 7.

## Authentication

Authentication in LangGraph runs as middleware on every request. Your [`@auth.authenticate`](/langsmith/langgraph-python-sdk#langgraph_sdk.auth.Auth.authenticate) handler receives request information and should:
Authentication in LangGraph runs as middleware on every request. Your @[`@auth.authenticate`][Auth.authenticate] handler receives request information and should:

1. Validate the credentials
2. Return [user info](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.MinimalUserDict) containing the user's identity and user information if valid
3. Raise an [HTTP exception](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.exceptions.HTTPException) or AssertionError if invalid
2. Return @[user info][MinimalUserDict] containing the user's identity and user information if valid
3. Raise an @[HTTP exception][HTTPException] or AssertionError if invalid

```python
from langgraph_sdk import Auth
Expand Down Expand Up @@ -116,11 +116,11 @@ async def authenticate(headers: dict) -> Auth.types.MinimalUserDict:

The returned user information is available:

* To your authorization handlers via [`ctx.user`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AuthContext)
* To your authorization handlers via @[`ctx.user`][AuthContext]
* In your application via `config["configuration"]["langgraph_auth_user"]`

<Accordion title="Supported Parameters">
The [`@auth.authenticate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.authenticate) handler can accept any of the following parameters by name:
The @[`@auth.authenticate`][Auth.authenticate] handler can accept any of the following parameters by name:

* request (Request): The raw ASGI request object
* path (str): The request path, e.g., `"/threads/abcd-1234-abcd-1234/runs/abcd-1234-abcd-1234/stream"`
Expand Down Expand Up @@ -172,7 +172,7 @@ sequenceDiagram
```

After authentication, the platform creates a special configuration object that is passed to your graph and all nodes via the configurable context.
This object contains information about the current user, including any custom fields you return from your [`@auth.authenticate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.authenticate) handler.
This object contains information about the current user, including any custom fields you return from your @[`@auth.authenticate`][Auth.authenticate] handler.

To enable an agent to act on behalf of the user, use [custom authentication middleware](/langsmith/custom-auth). This will allow the agent to interact with external systems like MCP servers, external databases, and even other agents on behalf of the user.

Expand All @@ -184,13 +184,13 @@ For information on how to authenticate an agent to an MCP server, see the [MCP c

## Authorization

After authentication, LangGraph calls your [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) handlers to control access to specific resources (e.g., threads, assistants, crons). These handlers can:
After authentication, LangGraph calls your @[`@auth.on`][Auth] handlers to control access to specific resources (e.g., threads, assistants, crons). These handlers can:

1. Add metadata to be saved during resource creation by mutating the `value["metadata"]` dictionary directly. See the [supported actions table](#supported-actions) for the list of types the value can take for each action.
2. Filter resources by metadata during search/list or read operations by returning a [filter dictionary](#filter-operations).
3. Raise an HTTP exception if access is denied.

If you want to just implement simple user-scoped access control, you can use a single [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) handler for all resources and actions. If you want to have different control depending on the resource and action, you can use [resource-specific handlers](#resource-specific-handlers). See the [Supported Resources](#supported-resources) section for a full list of the resources that support access control.
If you want to just implement simple user-scoped access control, you can use a single @[`@auth.on`][Auth] handler for all resources and actions. If you want to have different control depending on the resource and action, you can use [resource-specific handlers](#resource-specific-handlers). See the [Supported Resources](#supported-resources) section for a full list of the resources that support access control.

```python
@auth.on
Expand Down Expand Up @@ -235,7 +235,7 @@ async def add_owner(
<a id="resource-specific-handlers"></a>
### Resource-specific handlers

You can register handlers for specific resources and actions by chaining the resource and action names together with the [`@auth.on`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.Auth.on) decorator.
You can register handlers for specific resources and actions by chaining the resource and action names together with the @[`@auth.on`][Auth] decorator.
When a request is made, the most specific handler that matches that resource and action is called. Below is an example of how to register handlers for specific resources and actions. For the following setup:

1. Authenticated users are able to create threads, read threads, and create runs on threads
Expand Down Expand Up @@ -351,7 +351,7 @@ A filter dictionary is a dictionary with keys that match the resource metadata.
* `$contains`: List membership (e.g., `{"allowed_users": {"$contains": user_id}}`) or list containment (e.g., `{"allowed_users": {"$contains": [user_id_1, user_id_2]}}`). The value here must be an element of the list or a subset of the elements of the list, respectively. The metadata in the stored resource must be a list/container type.

A dictionary with multiple keys is treated using a logical `AND` filter. For example, `{"owner": org_id, "allowed_users": {"$contains": user_id}}` will only match resources with metadata whose "owner" is `org_id` and whose "allowed_users" list contains `user_id`.
See the reference [here](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.FilterType) for more information.
See the reference @[`Auth`](Auth) for more information.

## Common access patterns

Expand Down Expand Up @@ -457,22 +457,22 @@ Here are all the supported action handlers:

| Resource | Handler | Description | Value Type |
|----------|---------|-------------|------------|
| **Threads** | `@auth.on.threads.create` | Thread creation | [`ThreadsCreate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.ThreadsCreate) |
| | `@auth.on.threads.read` | Thread retrieval | [`ThreadsRead`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.ThreadsRead) |
| | `@auth.on.threads.update` | Thread updates | [`ThreadsUpdate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.ThreadsUpdate) |
| | `@auth.on.threads.delete` | Thread deletion | [`ThreadsDelete`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.ThreadsDelete) |
| | `@auth.on.threads.search` | Listing threads | [`ThreadsSearch`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.ThreadsSearch) |
| | `@auth.on.threads.create_run` | Creating or updating a run | [`RunsCreate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.RunsCreate) |
| **Assistants** | `@auth.on.assistants.create` | Assistant creation | [`AssistantsCreate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AssistantsCreate) |
| | `@auth.on.assistants.read` | Assistant retrieval | [`AssistantsRead`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AssistantsRead) |
| | `@auth.on.assistants.update` | Assistant updates | [`AssistantsUpdate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AssistantsUpdate) |
| | `@auth.on.assistants.delete` | Assistant deletion | [`AssistantsDelete`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AssistantsDelete) |
| | `@auth.on.assistants.search` | Listing assistants | [`AssistantsSearch`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.AssistantsSearch) |
| **Crons** | `@auth.on.crons.create` | Cron job creation | [`CronsCreate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsCreate) |
| | `@auth.on.crons.read` | Cron job retrieval | [`CronsRead`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsRead) |
| | `@auth.on.crons.update` | Cron job updates | [`CronsUpdate`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsUpdate) |
| | `@auth.on.crons.delete` | Cron job deletion | [`CronsDelete`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsDelete) |
| | `@auth.on.crons.search` | Listing cron jobs | [`CronsSearch`](https://langchain-ai.github.io/langgraph/cloud/reference/sdk/python_sdk_ref/#langgraph_sdk.auth.types.CronsSearch) |
| **Threads** | `@auth.on.threads.create` | Thread creation | @[`ThreadsCreate`] |
| | `@auth.on.threads.read` | Thread retrieval | @[`ThreadsRead`] |
| | `@auth.on.threads.update` | Thread updates | @[`ThreadsUpdate`] |
| | `@auth.on.threads.delete` | Thread deletion | @[`ThreadsDelete`] |
| | `@auth.on.threads.search` | Listing threads | @[`ThreadsSearch`] |
| | `@auth.on.threads.create_run` | Creating or updating a run | @[`RunsCreate`] |
| **Assistants** | `@auth.on.assistants.create` | Assistant creation | @[`AssistantsCreate`] |
| | `@auth.on.assistants.read` | Assistant retrieval | @[`AssistantsRead`] |
| | `@auth.on.assistants.update` | Assistant updates | @[`AssistantsUpdate`] |
| | `@auth.on.assistants.delete` | Assistant deletion | @[`AssistantsDelete`] |
| | `@auth.on.assistants.search` | Listing assistants | @[`AssistantsSearch`] |
| **Crons** | `@auth.on.crons.create` | Cron job creation | @[`CronsCreate`] |
| | `@auth.on.crons.read` | Cron job retrieval | @[`CronsRead`] |
| | `@auth.on.crons.update` | Cron job updates | @[`CronsUpdate`] |
| | `@auth.on.crons.delete` | Cron job deletion | @[`CronsDelete`] |
| | `@auth.on.crons.search` | Listing cron jobs | @[`CronsSearch`] |

<Note>
"About Runs"
Expand Down