seanghaeli opened a new pull request, #71192:
URL: https://github.com/apache/airflow/pull/71192
Adds single-use `callback` token so a deadline-callback subprocess can fetch
its DagRun context from the Execution API without holding a broad `workload`
token (the scope creep that got #66608 reverted).
- New `PATCH /callbacks/{id}/run`: single-use exchange gated on an atomic
`Callback.state` QUEUED→RUNNING transition (409 on reuse), returning a
short-lived `execution` token via `Refreshed-API-Token`. Mirrors the TI `/run`
pattern.
- New `callback` token scope + `callback:self` check (token subject must
match the callback id).
- Extracts a shared `issue_execution_token` helper used by both the callback
exchange and TI `/run`, and collapses the `*:self` scope checks into one
parameterized check.
Reopen of #69840, which GitHub auto-closed after an errant force-push landed
the branch head on a base commit; the branch and content are unchanged. Prior
review thread with @ashb is on #69840.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Fable 5)
Generated-by: Claude Code (Fable 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
