amoghrajesh commented on code in PR #66073: URL: https://github.com/apache/airflow/pull/66073#discussion_r3173257699
########## airflow-core/src/airflow/api_fastapi/execution_api/routes/task_state.py: ########## @@ -0,0 +1,127 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +from typing import Annotated +from uuid import UUID + +from cadwyn import VersionedAPIRouter +from fastapi import HTTPException, Path, Query, Security, status +from sqlalchemy.orm import Session + +from airflow._shared.state import TaskScope +from airflow.api_fastapi.common.db.common import SessionDep +from airflow.api_fastapi.execution_api.datamodels.task_state import ( + TaskStatePutBody, + TaskStateResponse, +) +from airflow.api_fastapi.execution_api.security import require_auth +from airflow.models.taskinstance import TaskInstance as TI +from airflow.state import get_state_backend + +router = VersionedAPIRouter( + responses={ + status.HTTP_401_UNAUTHORIZED: {"description": "Unauthorized"}, + status.HTTP_403_FORBIDDEN: {"description": "Access denied"}, + status.HTTP_404_NOT_FOUND: {"description": "Not found"}, + }, + dependencies=[Security(require_auth, scopes=["ti:self"])], +) + + +def _get_task_scope_for_ti(task_instance_id: UUID, session: Session) -> TaskScope: + ti = session.get(TI, task_instance_id) + if ti is None: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail={ + "reason": "not_found", + "message": f"Task instance {task_instance_id} not found", + }, + ) + return TaskScope(dag_id=ti.dag_id, run_id=ti.run_id, task_id=ti.task_id, map_index=ti.map_index) + + [email protected]("/{task_instance_id}/{key}") +def get_task_state( + task_instance_id: UUID, + key: Annotated[str, Path(min_length=1)], + session: SessionDep, +) -> TaskStateResponse: + """Get value for a task state.""" + scope = _get_task_scope_for_ti(task_instance_id, session) + value = get_state_backend().get(scope, key) + if value is None: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail={ + "reason": "not_found", + "message": f"Task state key {key!r} not found", + }, + ) + return TaskStateResponse(value=value) + + [email protected]("/{task_instance_id}/{key}", status_code=status.HTTP_204_NO_CONTENT) +def set_task_state( + task_instance_id: UUID, + key: Annotated[str, Path(min_length=1)], + body: TaskStatePutBody, + session: SessionDep, +) -> None: + """Set a task state key, creating or updating the row.""" + scope = _get_task_scope_for_ti(task_instance_id, session) + get_state_backend().set(scope, key, body.value) Review Comment: Hey, thanks for asking. It's intentional. `ti:self` confirms the caller is a valid member of the mapped task group and that is the right trust boundary for a fleet-wide clearing, since requiring each sibling's token would make the feature unusable. The SDK only sends the flag on explicit `clear(all_map_indices=True)` calls, so the wider scope is always author opt-in. I have updated the docstring to call this out. ########## airflow-core/src/airflow/api_fastapi/execution_api/routes/task_state.py: ########## @@ -0,0 +1,127 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +from typing import Annotated +from uuid import UUID + +from cadwyn import VersionedAPIRouter +from fastapi import HTTPException, Path, Query, Security, status +from sqlalchemy.orm import Session + +from airflow._shared.state import TaskScope +from airflow.api_fastapi.common.db.common import SessionDep +from airflow.api_fastapi.execution_api.datamodels.task_state import ( + TaskStatePutBody, + TaskStateResponse, +) +from airflow.api_fastapi.execution_api.security import require_auth +from airflow.models.taskinstance import TaskInstance as TI +from airflow.state import get_state_backend + +router = VersionedAPIRouter( + responses={ + status.HTTP_401_UNAUTHORIZED: {"description": "Unauthorized"}, + status.HTTP_403_FORBIDDEN: {"description": "Access denied"}, + status.HTTP_404_NOT_FOUND: {"description": "Not found"}, + }, + dependencies=[Security(require_auth, scopes=["ti:self"])], +) + + +def _get_task_scope_for_ti(task_instance_id: UUID, session: Session) -> TaskScope: + ti = session.get(TI, task_instance_id) + if ti is None: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail={ + "reason": "not_found", + "message": f"Task instance {task_instance_id} not found", + }, + ) + return TaskScope(dag_id=ti.dag_id, run_id=ti.run_id, task_id=ti.task_id, map_index=ti.map_index) + + [email protected]("/{task_instance_id}/{key}") +def get_task_state( + task_instance_id: UUID, + key: Annotated[str, Path(min_length=1)], + session: SessionDep, +) -> TaskStateResponse: + """Get value for a task state.""" + scope = _get_task_scope_for_ti(task_instance_id, session) + value = get_state_backend().get(scope, key) + if value is None: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail={ + "reason": "not_found", + "message": f"Task state key {key!r} not found", + }, + ) + return TaskStateResponse(value=value) + + [email protected]("/{task_instance_id}/{key}", status_code=status.HTTP_204_NO_CONTENT) +def set_task_state( + task_instance_id: UUID, + key: Annotated[str, Path(min_length=1)], + body: TaskStatePutBody, + session: SessionDep, +) -> None: + """Set a task state key, creating or updating the row.""" + scope = _get_task_scope_for_ti(task_instance_id, session) + get_state_backend().set(scope, key, body.value) + + [email protected]("/{task_instance_id}/{key}", status_code=status.HTTP_204_NO_CONTENT) +def delete_task_state( + task_instance_id: UUID, + key: Annotated[str, Path(min_length=1)], + session: SessionDep, +) -> None: + """Delete a single task state key.""" + scope = _get_task_scope_for_ti(task_instance_id, session) + get_state_backend().delete(scope, key) + + [email protected]("/{task_instance_id}", status_code=status.HTTP_204_NO_CONTENT) +def clear_task_state( + task_instance_id: UUID, + session: SessionDep, + all_map_indices: Annotated[bool, Query()] = False, Review Comment: Hey, thanks for asking. It's intentional. ti:self confirms the caller is a valid member of the mapped task group and that is the right trust boundary for a fleet-wide clearing, since requiring each sibling's token would make the feature unusable. The SDK only sends the flag on explicit clear(all_map_indices=True) calls, so the wider scope is always author opt-in. I have updated the docstring to call this out. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
