jabbera opened a new pull request, #75665: URL: https://github.com/apache/airflow/pull/75665
When the UI's API token (`_token`) expires while the FAB session is still valid, the UI redirects to `/auth/login/?next=<deep link>`. FAB 5.2.2's DB, LDAP and OAuth login views then see an authenticated user and redirect to the index page, so `next` is dropped and the user lands on the home page instead of the page they opened. Clicking the link again works because the redirect issued a fresh token. This adds `CustomAuthDBView` and `CustomAuthLDAPView`, and overrides `CustomAuthOAuthView.login`, so an authenticated user is redirected to the safe `next` URL (via the existing `get_safe_url`). The provider's `redirect` sets the fresh `_token` cookie on that response. Anonymous users still get the parent login flow, and remote-user auth already honors `next`. Flask-AppBuilder fixed this upstream in dpgaspar/Flask-AppBuilder#2479 (5.3.0), but that release also changes authenticated-but-unauthorized requests to return 403. This keeps the provider on 5.2.2 and fixes only the login redirect. Tests: - `test_views_login.py`: end-to-end against the FAB app with a logged-in DB user, checking the redirect to `next`, the `_token` cookie, the fallback to the index, and rejection of an external `next`. The `next` test fails without this change. - `test_auth_login.py`: unit tests for the helper and the DB, LDAP and OAuth views. closes: #75663 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: GitHub Copilot CLI following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
