potiuk opened a new pull request, #72201:
URL: https://github.com/apache/airflow/pull/72201
`SecretCache` built its key by concatenating three parts:
```python
_TEAM_PATTERN = "_{}_"
team = cls._TEAM_PATTERN.format(team_name) if team_name else ""
cls._cache.get(f"{prefix}{team}{key}")
```
That mapping is not injective while the team segment is optional. Team
`analytics` with key `DB_PASSWORD` composes to `__v__analytics_DB_PASSWORD`,
and so does no team with key `_analytics_DB_PASSWORD` — the two entries share a
cache slot.
Reads, writes and invalidations all resolve through the same composed
string, so entries that collide could read, overwrite or evict one another.
The three parts are now kept as a tuple, which is injective by construction
and needs no escaping or length-prefixing:
```python
@staticmethod
def _key(prefix: str, team_name: str | None, key: str) -> tuple[str, str |
None, str]:
return (prefix, team_name, key)
```
`_VARIABLE_PREFIX`, `_CONNECTION_PREFIX` and `_TEAM_PATTERN` are private to
this module and had no callers outside it, so nothing depended on the previous
key shape. `_TEAM_PATTERN` is now gone.
**Tests.** Added coverage for entries that shared a slot under the old
scheme, on each of the three paths — read, write (the colliding write must not
clobber the other entry) and invalidate — plus team names that share a prefix.
Reverting the source change fails four of them; they pass with it.
Local: 17 passed in the touched file, 1070 across
`task-sdk/tests/task_sdk/execution_time/` (11 pre-existing
`TriggerDagRunOperator` failures reproduce identically on a clean tree), 18 in
`airflow-core/tests/unit/always/test_secrets.py`. ruff and mypy clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
