pierrejeambrun commented on code in PR #72225:
URL: https://github.com/apache/airflow/pull/72225#discussion_r3934662153
##########
airflow-core/newsfragments/72225.significant.rst:
##########
Review Comment:
Newsfragment doesn't mention: invalid bearer + valid cookie now fails loud
where it used to silently fall back to cookie. Fine but worth a line.
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -147,22 +147,26 @@ async def get_user(
oauth_token: str | None = Depends(oauth2_scheme),
bearer_credentials: HTTPAuthorizationCredentials | None =
Depends(bearer_scheme),
) -> BaseUser:
- # A user might have been already built by a trusted in-tree middleware
(currently
- # only `JWTRefreshMiddleware`); if so, it is stored in
`request.state.user` AND
- # `request.state.user_authenticated_via` is set to the trust sentinel
above.
- # Honour the cached user only when both are present, so a stray
`state.user`
- # assignment from unrelated middleware can't bypass JWT validation.
- user: BaseUser | None = getattr(request.state, "user", None)
- trust_marker = getattr(request.state, "user_authenticated_via", None)
- if user and trust_marker is USER_INJECTED_BY_TRUSTED_MIDDLEWARE:
- return user
-
+ # An explicitly supplied credential always wins over the ambient session
cookie.
token_str: str | None
if bearer_credentials and bearer_credentials.scheme.lower() == "bearer":
token_str = bearer_credentials.credentials
elif oauth_token:
token_str = oauth_token
else:
+ token_str = None
Review Comment:
This `token_str = None` looks weird.
Early returns eveywhere read better, maybe:
```python
async def get_user(request, oauth_token, bearer_credentials) -> BaseUser:
if bearer_credentials and bearer_credentials.scheme.lower() ==
"bearer":
return await
resolve_user_from_token(bearer_credentials.credentials)
if oauth_token:
return await resolve_user_from_token(oauth_token)
# No explicit credential — cached middleware user, else cookie.
user = getattr(request.state, "user", None)
trust_marker = getattr(request.state, "user_authenticated_via", None)
if user and trust_marker is USER_INJECTED_BY_TRUSTED_MIDDLEWARE:
return user
return await
resolve_user_from_token(request.cookies.get(COOKIE_NAME_JWT_TOKEN))
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
