You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "lyric2249 (via GitHub)" <gi...@apache.org> on 2026/07/12 10:50:27 UTC
[PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
lyric2249 opened a new pull request, #69773:
URL: https://github.com/apache/airflow/pull/69773
`FabAuthRolePublicMiddleware` (added in #65685) sets `request.state.user` for anonymous requests when `AUTH_ROLE_PUBLIC` / `[fab] auth_role_public` is configured, but never sets `request.state.user_authenticated_via`. Core's `get_user()` dependency requires both attributes before it will trust a pre-set user and skip JWT validation, so anonymous requests still fall through to JWT validation and get rejected with 401 even though the public role is configured correctly.
This sets the same trust marker `JWTRefreshMiddleware` already sets, so both middlewares satisfy the same contract that `get_user()` checks.
The existing `test_sets_public_user_when_no_auth_present` test already exercises this exact code path, so it is extended with one assertion for the new attribute rather than adding a separate test; no existing assertions were changed or removed.
related: #60897
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Sonnet 5)
Generated-by: Claude Code (Sonnet 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "lyric2249 (via GitHub)" <gi...@apache.org>.
lyric2249 commented on code in PR #69773:
URL: https://github.com/apache/airflow/pull/69773#discussion_r3567827017
##########
providers/fab/src/airflow/providers/fab/auth_manager/middleware.py:
##########
@@ -47,6 +54,12 @@ async def dispatch(self, request: Request, call_next):
public_user = auth_manager.build_public_user()
if public_user is not None:
request.state.user = public_user
+
+ if _USER_INJECTED_BY_TRUSTED_MIDDLEWARE is not None:
Review Comment:
Thanks for comment. I applied it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal merged PR #69773:
URL: https://github.com/apache/airflow/pull/69773
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #69773:
URL: https://github.com/apache/airflow/pull/69773#issuecomment-4959529922
Awesome work, congrats on your first merged pull request! You are invited to check our [Issue Tracker](https://github.com/apache/airflow/issues) for additional contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on code in PR #69773:
URL: https://github.com/apache/airflow/pull/69773#discussion_r3571829656
##########
providers/fab/src/airflow/providers/fab/auth_manager/middleware.py:
##########
@@ -23,6 +23,9 @@
from airflow.api_fastapi.app import get_auth_manager
from airflow.api_fastapi.auth.managers.base_auth_manager import COOKIE_NAME_JWT_TOKEN
+from airflow.api_fastapi.core_api import security as core_api_security
+
+
if TYPE_CHECKING:
Review Comment:
```suggestion
from airflow.api_fastapi.core_api import security as core_api_security
if TYPE_CHECKING:
```
To fix static checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "SameerMesiah97 (via GitHub)" <gi...@apache.org>.
SameerMesiah97 commented on code in PR #69773:
URL: https://github.com/apache/airflow/pull/69773#discussion_r3566535734
##########
providers/fab/src/airflow/providers/fab/auth_manager/middleware.py:
##########
@@ -47,6 +54,12 @@ async def dispatch(self, request: Request, call_next):
public_user = auth_manager.build_public_user()
if public_user is not None:
request.state.user = public_user
+
+ if _USER_INJECTED_BY_TRUSTED_MIDDLEWARE is not None:
Review Comment:
I don't see the need for the `_USER_INJECTED_BY_TRUSTED_MIDDLEWARE ` if it is only being used once. It would be better to in-line it like this:
```
user_injected = getattr(
core_api_security,
"USER_INJECTED_BY_TRUSTED_MIDDLEWARE",
None,
)
if user_injected is not None:
request.state.user_authenticated_via = user_injected
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #69773:
URL: https://github.com/apache/airflow/pull/69773#issuecomment-4950903239
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server [airflow]
Posted by "lyric2249 (via GitHub)" <gi...@apache.org>.
lyric2249 closed pull request #69773: Fix AUTH_ROLE_PUBLIC returning 401 in FastAPI API server
URL: https://github.com/apache/airflow/pull/69773
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org