wityat opened a new pull request, #75124: URL: https://github.com/apache/airflow/pull/75124
When the FAB user cache is cold or expires, resolving a valid JWT runs a synchronous SQLAlchemy lookup on the API event loop. A slow lookup or connection-pool wait stalls unrelated requests on that worker, including request cleanup that may release a connection. Add an optional `BaseAuthManager.deserialize_user_async` hook and await it from the existing JWT resolution path. Its default delegates to `deserialize_user` in the current thread, preserving existing auth managers' calling context. FAB overrides the hook to offload its synchronous lookup with `run_in_threadpool`. A shared lock protects the shared TTL cache; database work runs outside that lock. This complements the revocation lookup offload already merged in #74856. It does not duplicate the revoked-token cleanup changes proposed in #74364. JWT validation, per-request revocation checks, invalid-user handling, cache TTL and authorization rules are unchanged. The provider remains importable on older supported cores; the asynchronous dispatch requires a core containing the new hook. The regression tests cover legacy calling context, async dispatch and invalid-user errors, event-loop progress during a FAB lookup, and shared-cache access during concurrent cold, warm and expired lookups across two manager instances. The auth-manager documentation explains the new optional hook and its session/thread requirements. Validation performed: - Fast and manual workspace checks passed, including Ruff, core/provider mypy and OpenAPI generation. The exact pinned ast-grep check ran in the CI image because the host glibc is too old for its binary. - All 70 tests in the core auth-manager test file and both new FAB tests passed in Breeze. The new cases also have baseline and offload/cache-lock mutation checks. - All commands selected by `breeze verify --json` completed on `aa85a900`, based on `e3110a30`, using Python 3.11 and SQLite for DB tests: | Selected tests | Result | | --- | --- | | Core API, DB | 4398 passed, 12 skipped, 1 baseline failure described below | | Core Always, DB | 1939 passed, 3 skipped | | Core API/Always, non-DB | 1247 passed, 1 xfailed | | cncf.kubernetes/common.compat/FAB, DB | 1057 passed, 6 skipped | | cncf.kubernetes/common.compat/FAB, non-DB | 1359 passed, 30 skipped | Documentation for `apache-airflow`, `common.compat` and `fab` built with zero Sphinx warnings. The final head `21d1463d` rebases that tested patch onto `9a62eadd`. The only intervening upstream change is #75120 (four added lines in `generated/provider_metadata.json`); `git range-diff` confirms the patch is identical. Source, test, dependency and build inputs are unchanged by this final rebase. The single failure is `TestGetDagRunAssetTriggerEvents::test_returns_only_events_of_assets_the_caller_may_read` in `test_dag_run.py:2199` (expected event IDs `[4]`, actual `[3, 4, 5]`). The same failure and traceback reproduce on pristine parent `e3110a30` (407 passed, 1 failed for that file) and in an isolated candidate run. The test added in #72924 patches `BaseAuthManager.get_authorized_assets`, while its `SimpleAuthManager` client overrides that method since #72934, so the restricted-asset mock is not applied. The selected matrix therefore completed with **10000 passed, 51 skipped, 1 xfailed and this one pre-existing failure**. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — OpenAI Codex (GPT-6) Generated-by: OpenAI Codex (GPT-6) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- Drafted-by: OpenAI Codex (GPT-6) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
