anishgirianish commented on code in PR #60108:
URL: https://github.com/apache/airflow/pull/60108#discussion_r3132783010


##########
airflow-core/src/airflow/api_fastapi/execution_api/app.py:
##########
@@ -333,10 +342,30 @@ async def always_allow(request: Request):
                 claims = TIClaims(scope="execution")
                 return TIToken(id=ti_id, claims=claims)
 
+            # Override _container (the svcs service locator behind 
DepContainer).
+            # The default _container reads request.app.state.svcs_registry, but
+            # Cadwyn's versioned sub-apps don't inherit the main app's state,
+            # so lookups raise ServiceNotFoundError. This registry provides
+            # services needed by routes called during dag.test().
+            # Note: tokens generated by this stub are never validated since
+            # _jwt_bearer is overridden with always_allow in dag.test() mode.
+            stub_generator = JWTGenerator(

Review Comment:
   Thank you so much for this. Dissecting this actually led me to figure out 
that the entire override is not needed now as the token generation is now 
scope-gated.



##########
airflow-core/src/airflow/api_fastapi/execution_api/app.py:
##########
@@ -333,10 +342,30 @@ async def always_allow(request: Request):
                 claims = TIClaims(scope="execution")
                 return TIToken(id=ti_id, claims=claims)
 
+            # Override _container (the svcs service locator behind 
DepContainer).
+            # The default _container reads request.app.state.svcs_registry, but
+            # Cadwyn's versioned sub-apps don't inherit the main app's state,
+            # so lookups raise ServiceNotFoundError. This registry provides
+            # services needed by routes called during dag.test().
+            # Note: tokens generated by this stub are never validated since
+            # _jwt_bearer is overridden with always_allow in dag.test() mode.
+            stub_generator = JWTGenerator(

Review Comment:
   Thank you so much for this. Disecting this actually led me to figure out 
that the entire override is not needed now as the token generation is now 
scope-gated.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to