feat(integrations): broker delegated OAuth connections

[erichare]

Connections can now complete delegated OAuth consent and refresh credentials inside the worker that uses them. Adds instance-configured Google, Microsoft, and separate Slack user/bot registrations, one-time browser-bound state, PKCE, encrypted token storage, and provider revocation with an explicit outcome.

Refresh, callback completion, revoke, and delete share database transaction locks. Concurrent workers reuse a completed exchange, including the single reactive retry after a provider rejects a cached token. Callback replay, removed registrations, tenant restrictions, and revoked connections fail closed.

Stacked on #14921 (INT-4). Includes customer-owned registration runbooks, hosted configuration, Desktop loopback public clients, and authorization endpoint coverage.

Validation:

• 82 backend/API/provider/artifact/authorization-matrix regression tests passed; final provider suite: 20 passed.
• 6 SQLite/PostgreSQL checks passed: separate-process refresh performs exactly one exchange, migration round-trip, and schema consistency on both databases.
• 85 isolated lfx connection/integration/environment-security tests passed.
• Focused mypy passed for 7 source files; repository Ruff and commit hooks passed.

Live consent against customer provider registrations was not exercised. Microsoft upstream consent removal remains an operator action; local revocation always removes credentials, and the API reports the provider outcome separately.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 6110fc9a-7c40-40f1-8c48-56642a96dbc0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[github-actions]

✅ Migration Validation Passed

All migrations follow the Expand-Contract pattern correctly.

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 126 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.63%. Comparing base (2e3225b) to head (5615cd0).

Files with missing lines	Patch %	Lines
.../base/langflow/services/connection/oauth/broker.py	55.40%	66 Missing ⚠️
...se/langflow/services/connection/oauth/providers.py	80.29%	27 Missing ⚠️
.../base/langflow/services/connection/oauth/config.py	79.59%	20 Missing ⚠️
src/backend/base/langflow/api/v1/connections.py	86.44%	8 Missing ⚠️
...ckend/base/langflow/services/connection/service.py	83.33%	5 Missing ⚠️

Additional details and impacted files

@@                     Coverage Diff                      @@
##           fix/int-4-connection-api   #14935      +/-   ##
============================================================
- Coverage                     65.84%   65.63%   -0.21%     
============================================================
  Files                          2523     2519       -4     
  Lines                        263021   263230     +209     
  Branches                      36940    39299    +2359     
============================================================
- Hits                         173174   172771     -403     
- Misses                        87623    88239     +616     
+ Partials                       2224     2220       -4     

Flag	Coverage Δ
backend	74.19% <74.74%> (+0.75%)	⬆️
frontend	63.03% <ø> (-0.60%)	⬇️
lfx	65.09% <100.00%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...base/langflow/services/connection/oauth/locking.py	100.00% <100.00%> (ø)
...gflow/services/database/models/connection/oauth.py	100.00% <100.00%> (ø)
...low/services/database/models/connection/schemas.py	91.11% <100.00%> (+0.30%)	⬆️
src/lfx/src/lfx/integrations/models.py	87.60% <100.00%> (+0.31%)	⬆️
src/lfx/src/lfx/log/logger.py	56.75% <ø> (ø)
...ckend/base/langflow/services/connection/service.py	58.56% <83.33%> (+2.76%)	⬆️
src/backend/base/langflow/api/v1/connections.py	81.08% <86.44%> (+6.53%)	⬆️
.../base/langflow/services/connection/oauth/config.py	79.59% <79.59%> (ø)
...se/langflow/services/connection/oauth/providers.py	80.29% <80.29%> (ø)
.../base/langflow/services/connection/oauth/broker.py	55.40% <55.40%> (ø)

... and 264 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	55.65% (84754/152292)	72.47% (12552/17320)	50.95% (2000/3925)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
6641	0 💤	0 ❌	0 🔥	23m 46s ⏱️