zeekay
59caea463a
Phase (a) of "flow uses only Hanzo IAM": flow stops minting identity and validates a Hanzo IAM access token instead, mirroring the cloud's principal model so one IAM login is the same session across console, studio, and flow. - services/auth/iam.py — the self-contained seam. HanzoIAMValidator verifies an IAM JWT via the IAM JWKS (PyJWT PyJWKClient), pins RS256, enforces issuer (+audience), and extracts (org, project, user) into an IAMPrincipal. org falls back to the Casdoor `owner` claim. Sets current_org/current_project context vars — the hook the data layer scopes queries on (phase c). Enabled by FLOW_IAM_ISSUER (forward-only, no compat alias). - service.py — _authenticate_with_iam wired at the top of _authenticate_with_token: an IAM token is validated + resolved to an org-scoped flow user (get-or-create, org_id carries the tenant) BEFORE any local decode. Critically, a token FOR our IAM issuer that fails verification RAISES — it never falls through to the weaker local SECRET_KEY path. Inert unless FLOW_IAM_ISSUER is set, so existing deploys are unaffected. Verified: the security-critical validator logic was exercised directly (RSA keypair, signed tokens) — 7/7 pass incl. bad-signature-never-falls-through, wrong-issuer->local fallback, missing-org/expired rejected, tenant context vars set. iam_test.py runs the same in CI (full-app deps). py_compile clean. Follow-on: (b) org_id/project_id on the remaining 15 resource tables + Alembic migration (User already has org_id); (c) scope the 24 user_id query sites by current_org/current_project. Those need the running app + a migration, so they land as the next verified phase.
Hanzo Flow
Hanzo Flow is a powerful platform for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Hanzo Flow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools.
Highlight features
- Visual builder interface to quickly get started and iterate.
- Source code access lets you customize any component using Python.
- Interactive playground to immediately test and refine your flows with step-by-step control.
- Multi-agent orchestration with conversation management and retrieval.
- Deploy as an API or export as JSON for Python apps.
- Deploy as an MCP server and turn your flows into tools for MCP clients.
- Observability with LangSmith, LangFuse and other integrations.
- Enterprise-ready security and scalability.
Quickstart
Install locally (recommended)
Requires Python 3.10-3.13 and uv (recommended package manager).
Install
From a fresh directory, run:
uv pip install hanzoflow -U
Run
To start Hanzo Flow, run:
uv run hanzoflow run
Hanzo Flow starts at http://127.0.0.1:7860.
Other install options
Run from source
If you've cloned this repository and want to contribute, run this command from the repository root:
make run_cli
For more information, see DEVELOPMENT.md.
Docker
Start a Hanzo Flow container with default settings:
docker run -p 7860:7860 hanzoai/flow:latest
Hanzo Flow is available at http://localhost:7860/.
Deployment
Hanzo Flow is completely open source and you can deploy it to all major deployment clouds.
Contribute
We welcome contributions from developers of all levels. If you'd like to contribute, please check our contributing guidelines and help make Hanzo Flow more accessible.