pierrejeambrun commented on code in PR #76453:
URL: https://github.com/apache/airflow/pull/76453#discussion_r4515264586
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/connections.py:
##########
@@ -389,16 +390,34 @@ def test_connection(
existing_conn = None
if existing_conn is not None:
- # Stored credentials are only reused to test the connection's own
- # host/port; testing a different destination must supply its own.
+ # Stored credentials are only reused to test the stored connection
itself;
+ # testing a different one must supply its own. Besides host and
port, the
+ # connection type, schema, login and extra also decide where and
how a hook
+ # connects (e.g. a URL in schema, or proxies and endpoints in
extra).
fields_set = test_body.model_fields_set
host_changed = "host" in fields_set and not
_same_endpoint(test_body.host, existing_conn.host)
port_changed = "port" in fields_set and not
_same_endpoint(test_body.port, existing_conn.port)
- if host_changed or port_changed:
+ conn_type_changed = test_body.conn_type != existing_conn.conn_type
+ schema_changed = "schema_" in fields_set and not _same_endpoint(
+ test_body.schema_, existing_conn.schema
+ )
+ login_changed = "login" in fields_set and not
_same_endpoint(test_body.login, existing_conn.login)
+ # Compare with the stored extra as the API shows it, with its
secrets masked.
+ extra_changed = "extra" in fields_set and
json.loads(test_body.extra or "{}") != json.loads(
+ ConnectionResponse.model_validate(existing_conn).extra or "{}"
+ )
Review Comment:
Good catch that pattern masking depends on what the process has registered.
Two workers can disagree when a non-sensitive extra value contains a password
some other connection registered, which is
rare and fails closed (a 400 asking for credentials). I'd rather not run the
request body through redact too: a new value under a sensitive key like api_key
would then read as *** on both sides, count as unchanged, and reuse the stored
password. That's what this check is here to prevent, so I'd keep comparing the
raw request against the masked stored view.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
