potiuk commented on PR #66504: URL: https://github.com/apache/airflow/pull/66504#issuecomment-4486604043
Addressed all three review points in f0d28ed81c: @jason810496 — agreed, switched to raising `HTTP_400_BAD_REQUEST` directly on `JSONDecodeError` instead of falling through to a `team=None` auth call. Updated the existing parse-failure test (renamed `..._fails_closed` → `..._returns_400`) to assert the 400 and that `is_authorized_connection` is never called. @amoghrajesh — - Moved `from json import JSONDecodeError` to the top of `test_security.py`. - On commit 2 not being in the diff: you were right, the non-string rejection was in a second commit on my local branch but only the first one made it into the original push — sorry about that. It's now in this update, with parametrised tests covering integer / list / dict / bool inputs for both \`team_name\` (via \`requires_access_connection\`) and \`dag_id\` (via \`requires_access_backfill\`). Both raise \`400\` before any authz callback or DB lookup runs. --- Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
