RehanAhmad25 commented on code in PR #76467:
URL: https://github.com/apache/airflow/pull/76467#discussion_r4514833925
##########
airflow-core/src/airflow/api_fastapi/auth/tokens.py:
##########
@@ -113,13 +137,18 @@ class JWKS:
refresh_jwks: bool = True
refresh_interval_secs: int = 3600
refresh_retry_interval_secs: int = 10
+ default_algorithm: str | None = attrs.field(default=None,
validator=_validate_known_algorithm)
+ _load_locks: weakref.WeakKeyDictionary[asyncio.AbstractEventLoop,
asyncio.Lock] = attrs.field(
Review Comment:
Could we coordinate in-flight reloads across event loops too?
`validated_claims()` calls `avalidated_claims()` through `async_to_sync`, and
callers may also invoke `avalidated_claims()` directly. Those paths can use
different event loops, each with its own lock from `_load_locks`.
If Loop A starts a reload after a key rotation, `_load_jwks()` updates
`last_fetch_attempt_at` before awaiting the fetch. A concurrent request on Loop
B sees its own lock as unlocked, then sees that the retry interval has not
elapsed and returns without waiting. It can then reject the new `kid` even if
Loop A’s in-flight reload is about to load it.
Could we add a cross-loop single-flight mechanism and cover this case in a
test?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
