Repository: Significant-Gravitas/Auto-GPT
File: autogpt_platform/backend/backend/data/graph.py (Python)

Code before:
    # Step 2: Check if agent is in the library *and not deleted*
    where_clause: LibraryAgentWhereInput = {
        "userId": user_id,
        "agentGraphId": graph_id,
        "isDeleted": False,
    }

    if graph_version is not None:
        where_clause["agentGraphVersion"] = graph_version

    user_has_in_library = await LibraryAgent.prisma().count(where=where_clause) > 0

    # Step 3: Apply permission logic
    if user_owns_graph and user_has_in_library:
        pass

    # Step 4: If not owned, check if published in marketplace
    elif (
        is_marketplace_published := await is_graph_published_in_marketplace(
            graph_id, graph_version
        )
    ) and user_has_in_library:
        pass

    # Step 5: Still allow execution of sub-graph if not in Library
    elif is_marketplace_published and is_sub_graph:
        pass

    else:
        # None of the permission conditions are met
        raise GraphNotInLibraryError(
            f"Graph #{graph_id} is not accessible in your library"
        )

    # Step 6: Check execution-specific permissions (raises generic NotAuthorizedError)
    # Additional authorization checks beyond the above:
    # 1. Check if user has execution credits (future)
    # 2. Check if graph is suspended/disabled (future)
    # 3. Check rate limiting rules (future)
    # 4. Check organization-level permissions (future)

    # For now, the above check logic is sufficient for execution permission.
    # Future enhancements can add more granular permission checks here.
    # When adding new checks, raise NotAuthorizedError for non-library issues.


async def is_graph_published_in_marketplace(graph_id: str, graph_version: int) -> bool:
    """
    Check if a graph is published in the marketplace.

    Params:

Review comment (suggestion):
if is_sub_graph is enabled can't we just return early in the first place even before running the query? 

also the logic is rather complicated, should we just do early return? e.g:
```
if is_sub_graph:
    return

if not is_graph_published_in_marketplace and not user_owns_graph:
     raise GraphNotOwnedError

if not user_has_in_library:
    raise GraphNotInLibraryError
```

Code after:
        NotAuthorizedError: If the user lacks execution permissions for other reasons
    """
    graph, library_agent = await asyncio.gather(
        AgentGraph.prisma().find_unique(
            where={"graphVersionId": {"id": graph_id, "version": graph_version}}
        ),
        LibraryAgent.prisma().find_first(
            where={
                "userId": user_id,
                "agentGraphId": graph_id,
                "isDeleted": False,
                "isArchived": False,
            }
        ),
    )

    # Step 1: Check if user owns this graph
    user_owns_graph = graph and graph.userId == user_id

    # Step 2: Check if agent is in the library *and not deleted*
    user_has_in_library = library_agent is not None

    # Step 3: Apply permission logic
    if not (
        user_owns_graph
        or await is_graph_published_in_marketplace(graph_id, graph_version)
    ):
        raise GraphNotAccessibleError(
            f"You do not have access to graph #{graph_id} v{graph_version}: "
            "it is not owned by you and not available in the Marketplace"
        )
    elif not (user_has_in_library or is_sub_graph):
        raise GraphNotInLibraryError(f"Graph #{graph_id} is not in your library")

    # Step 6: Check execution-specific permissions (raises generic NotAuthorizedError)
    # Additional authorization checks beyond the above:
    # 1. Check if user has execution credits (future)
    # 2. Check if graph is suspended/disabled (future)
    # 3. Check rate limiting rules (future)
    # 4. Check organization-level permissions (future)

    # For now, the above check logic is sufficient for execution permission.
    # Future enhancements can add more granular permission checks here.
    # When adding new checks, raise NotAuthorizedError for non-library issues.


async def is_graph_published_in_marketplace(graph_id: str, graph_version: int) -> bool:
    """
    Check if a graph is published in the marketplace.

    Params: