kjh0623 opened a new pull request, #74722: URL: https://github.com/apache/airflow/pull/74722
Re-submission of #70057, which was auto-closed as stale (bot-closed, so I can't reopen it). Same branch, with current `main` merged in. Earlier review discussion is in #70057. **Problem** `JWTRefreshMiddleware.dispatch` runs outside the FastAPI exception handlers and only catches `HTTPException` / `AuthManagerRefreshTokenExpiredException`. Any other error from `_refresh_user()` becomes a bare 500. We hit this in production when PgBouncer drops a connection and the user lookup raises `OperationalError`. Related: #57859. **Fix** Add a final `except Exception` arm that: - logs with `log.exception()` (ERROR + traceback), - continues without injecting the user (the route's auth dependency still validates the token), - leaves the cookie untouched. The catch is broad on purpose: the middleware can't know which exceptions are transient for the configured auth manager. **Testing** New unit test: a non-HTTP error from `_refresh_user` → the request succeeds, no `set-cookie`, an ERROR record with `exc_info` is logged. --- ##### Was generative AI tooling used to co-author this PR? - [x] Yes (please specify the tool below) Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
