ashb commented on code in PR #69840:
URL: https://github.com/apache/airflow/pull/69840#discussion_r3705475717
##########
airflow-core/src/airflow/executors/workloads/base.py:
##########
@@ -84,12 +84,12 @@ class BaseWorkloadSchema(BaseModel):
"""The identity token for this workload"""
@staticmethod
- def generate_token(sub_id: str, generator: JWTGenerator | None = None) ->
str:
+ def generate_token(sub_id: str, generator: JWTGenerator | None = None,
scope: str = "workload") -> str:
Review Comment:
Hmmm, for a reason I can't fully articulate, I'm a bit wary of having a
`scope` argument here....
##########
airflow-core/src/airflow/api_fastapi/execution_api/security.py:
##########
@@ -196,13 +196,26 @@ async def require_auth(
status_code=status.HTTP_403_FORBIDDEN,
detail="Token subject does not match connection test ID",
)
+ elif "callback:self" in security_scopes.scopes:
+ cb_self_id = str(request.path_params["callback_id"])
+ if str(token.id) != cb_self_id:
+ raise HTTPException(
+ status_code=status.HTTP_403_FORBIDDEN,
+ detail="Token subject does not match callback ID",
+ )
return token
CurrentTIToken: TIToken = Depends(require_auth)
+def issue_execution_token(services: Any, response: Response, sub: str) -> None:
Review Comment:
Nit:
```suggestion
def issue_execution_token(services: svcs.Container, response: Response, sub:
str) -> None:
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
