seanghaeli opened a new pull request, #69840:
URL: https://github.com/apache/airflow/pull/69840
Adds a purpose-built, single-use `callback` token so a deadline-callback
subprocess can fetch its DagRun context from the Execution API without holding
a broad `workload` token (the scope creep that got #66608 reverted).
- New `PATCH /callbacks/{id}/run`: single-use exchange gated on an atomic
`Callback.state` QUEUED→RUNNING transition (409 on reuse), returning a
short-lived `execution` token via `Refreshed-API-Token`. Mirrors the TI `/run`
pattern.
- New `callback` token scope + `callback:self` check (token subject must
match the callback id).
- Extracts a shared `issue_execution_token` helper used by both the callback
exchange and TI `/run`, and collapses the `*:self` scope checks into one
parameterized check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
