This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new e2a0e8a4c40 Fix FAB FastAPI PATCH users to respect
FAB_PASSWORD_HASH_METHOD (#73110)
e2a0e8a4c40 is described below
commit e2a0e8a4c40979c2b28939ec54f6cbfa60382ee7
Author: auyua9 <[email protected]>
AuthorDate: Mon Sep 14 22:11:49 2026 +0800
Fix FAB FastAPI PATCH users to respect FAB_PASSWORD_HASH_METHOD (#73110)
PR #65735 made the security manager honor FAB_PASSWORD_HASH_METHOD
through _hash_password, but the FastAPI users service PATCH path
still called werkzeug's generate_password_hash directly, so REST-API
password updates were always hashed with the default method while
CLI/UI updates used the configured one - producing mixed hash
schemes in the DB and breaking deployments that rely on a specific
method. Route the PATCH path through
security_manager._hash_password and update the existing service
test to assert the new contract.
---
.../providers/fab/auth_manager/api_fastapi/services/users.py | 3 +--
.../unit/fab/auth_manager/api_fastapi/services/test_users.py | 10 ++++------
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git
a/providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/services/users.py
b/providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/services/users.py
index 8958219322d..f8ad0e50aad 100644
---
a/providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/services/users.py
+++
b/providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/services/users.py
@@ -18,7 +18,6 @@ from __future__ import annotations
from fastapi import HTTPException, status
from sqlalchemy import func, select
-from werkzeug.security import generate_password_hash
from airflow.providers.fab.auth_manager.api_fastapi.datamodels.roles import
Role
from airflow.providers.fab.auth_manager.api_fastapi.datamodels.users import (
@@ -188,7 +187,7 @@ class FABAuthManagerUsers:
password_changed = False
if "password" in fields_to_update and body.password is not None:
- user.password =
generate_password_hash(body.password.get_secret_value())
+ user.password =
security_manager._hash_password(body.password.get_secret_value())
password_changed = True
if "username" in fields_to_update and body.username is not None:
diff --git
a/providers/fab/tests/unit/fab/auth_manager/api_fastapi/services/test_users.py
b/providers/fab/tests/unit/fab/auth_manager/api_fastapi/services/test_users.py
index 84076a730e4..e9a5772e5e6 100644
---
a/providers/fab/tests/unit/fab/auth_manager/api_fastapi/services/test_users.py
+++
b/providers/fab/tests/unit/fab/auth_manager/api_fastapi/services/test_users.py
@@ -556,14 +556,12 @@ class TestUsersService:
password=password_mock,
)
- with patch(
-
"airflow.providers.fab.auth_manager.api_fastapi.services.users.generate_password_hash"
- ) as mock_hash:
- mock_hash.return_value = "hashed_password"
- FABAuthManagerUsers.update_user("alice", patch_body,
update_mask="password")
+ security_manager._hash_password.return_value = "hashed_password"
+ FABAuthManagerUsers.update_user("alice", patch_body,
update_mask="password")
password_mock.get_secret_value.assert_called_once()
- mock_hash.assert_called_once_with("newpassword")
+ security_manager._hash_password.assert_called_once_with("newpassword")
+ assert user_obj.password == "hashed_password"
# delete_user tests
