potiuk opened a new pull request, #72198:
URL: https://github.com/apache/airflow/pull/72198
`reset_user_sessions()` decodes each stored session and compares its
`_user_id` against `user.id`:
```python
if session_details.get("_user_id") == user.id:
```
Flask-Login stores whatever `User.get_id()` returns — a **string**
(`models/__init__.py:357`) — while `user.id` is the integer column. The
comparison is therefore `"1" == 1`, which is never true, so no session is ever
deleted and the password update proceeds independently. With `[fab]
session_backend=database`, `provider.yaml` documents that a password reset
deletes all sessions for that user; it deletes none.
Both sides are now compared as strings, and a row carrying no `_user_id` is
skipped rather than matched.
**On the test.** `test_reset_user_sessions_delete` passed throughout,
because its fixture wrote an *integer* `_user_id` into the session row by hand
— exercising a comparison that cannot occur in practice. It now stores what
`get_id()` returns. Reverting the source change makes all three
parametrisations fail (`assert 2 == 1`), which they did not before. Added
coverage for sessions written before `get_id()` returned a string, and for a
row with no `_user_id`.
Local: 28 passed in the touched file, 460 across the provider; ruff and mypy
clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
