ramitkataria commented on code in PR #66611:
URL: https://github.com/apache/airflow/pull/66611#discussion_r3455359266
##########
airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py:
##########
@@ -50,7 +50,10 @@ async def has_connection_access(
router = APIRouter(
responses={status.HTTP_404_NOT_FOUND: {"description": "Connection not
found"}},
- dependencies=[Depends(has_connection_access)],
+ dependencies=[
+ Security(require_auth, scopes=["token:execution", "token:workload"]),
Review Comment:
I don't think this `token:workload` scope takes effect, because the router
doesn't set `route_class=ExecutionAPIRoute`. `require_auth` reads
`allowed_token_types` (`security.py:170`), and that's only populated by
`ExecutionAPIRoute` (`security.py:206-233`); since `include_router` keeps each
route's own class, these stay plain `APIRoute` and fall back to execution-only.
##########
task-sdk/src/airflow/sdk/execution_time/callback_supervisor.py:
##########
@@ -75,10 +77,10 @@ class _BundleInfoLike(Protocol):
# The set of messages that a callback subprocess can send to the supervisor.
-# This is a minimal subset of ToSupervisor: read-only access to Connections
-# and Variables, plus MaskSecret for the secrets masker.
+# This is a minimal subset of ToSupervisor: read-only access to Connections,
+# Variables, and XCom values, plus MaskSecret for the secrets masker.
CallbackToSupervisor = Annotated[
- GetConnection | GetVariable | GetVariableKeys | MaskSecret,
+ GetConnection | GetVariable | GetVariableKeys | GetXCom | MaskSecret,
Review Comment:
This wires `GetXCom` (scalar get), but `get_all()`/mapped reads emit
`GetXComSequenceSlice`/`GetXComCount`/`GetXComSequenceItem`, which aren't in
this union and would fall through to the `else` branch as a 400. Is that the
intended behaviour?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
