Locking Flows

[knolleary]

This is a design proposal for supporting 'locked' flows: flows that can be seen, but not edited.

Use Cases

1. A developer wants to stop accidental changes to their flows. But they want to be able to ‘unlock’ a flow in the editor to make a change, before locking it again.

2. Developer-1 wants to share a flow with Developer-2 and not allow them to change some of the flows. Developer-2 should not be able to unlock the locked flows

Summary

We add an optional locked boolean property to flow objects (nodes with type=tab).

In the editor, by default, the Flow/Subflow edit dialogs will get a new option at the bottom (next to the enabled/disabled toggle). This will be to lock/unlock the flow/subflow.

When locked, the editor will prevent any modification to the flow/subflow or any nodes within it. It will show some visual indication that the flow/subflow is locked.

A locked flow/subflow can still be exported - it will keep the locked property, but of course the user is free to edit the json that is exported and reimport it.

When importing a flow, the editor will refuse to replace a locked flow/subflow - the user will be able to import a copy, but the original will not be modified.

The runtime apis (/flows and /flow) will reject any POST that attempts to modify the contents of a locked flow/subflow.

Locking down the lockdown

In settings.js we add a new option (the exact details TBD) that turns off the ability to modify the ‘locked’ flag on flows/subflows. This will do two things:

1. The editor will not show the lock/unlock button in the edit dialogs
2. The runtime api will not allow a POST to /flows (or /flow) that includes a change to the lock flag of any existing object in the flow.

Future work

We could add something to the permissions object of individual users to say whether they can modify the locked state of objects. That would then allow a system with ‘admin’ users who can modify locked flows and ‘normal’ users who cannot.

[ckudor123]

any news related to this?

[knolleary]

Yes - Node-RED 3.1.0-beta.1 was published an hour ago that adds this feature.

https://discourse.nodered.org/t/node-red-3-1-0-beta-1-released/74644

[knolleary]

This feature was delivered in Node-RED 3.1

[alexmc1510]

I don't see the option to lock a subflow. Can someone explain how to do it?

[knolleary]

Hi @alexmc1510

We only added support for locking flows. Locking subflows wasn't considered for the initial implementation