gaurav0107 commented on code in PR #65685:
URL: https://github.com/apache/airflow/pull/65685#discussion_r3126398497
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -158,6 +158,20 @@ async def get_user_from_token(self, token: str) ->
BaseUser:
log.error("Couldn't deserialize user from token, JWT token is not
valid: %s", e)
raise InvalidTokenError(str(e))
+ def get_public_user(self) -> BaseUser | None:
Review Comment:
Hey @vincbeck, thanks so much for the pointer! Really appreciate you taking
the time to flag this — the middleware pattern is much cleaner and I should
have looked at `SimpleAllAdminMiddleware` first.
I've just pushed a refactor (6041356) that follows the same approach:
- New `FabAuthRolePublicMiddleware` in `providers/fab/auth_manager/` —
mirrors the structure of `SimpleAllAdminMiddleware`
- It attaches an `AnonymousUser` to `request.state.user` on unauthenticated
requests (the existing `get_user` dependency already short-circuits on
`request.state.user`, so I skipped the JWT-minting step that simple does)
- `BaseAuthManager` now has a small generic `get_fastapi_middlewares()` hook
so any auth manager can plug in middleware without touching airflow-core
- `security.py` is back to the original upstream 401 behavior — no opinions
baked into the core auth gate anymore
The middleware only registers when `[fab] auth_role_public` is configured,
same gating as before.
Let me know if you'd like me to adjust anything — happy to iterate. 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
