stephen-bracken commented on PR #70783: URL: https://github.com/apache/airflow/pull/70783#issuecomment-5270161785
@pierrejeambrun > 1. Moves generate_jwt from before call_next to inside _set_new_token after call_next — introduces the fail-hard-vs-fail-soft semantic When `call_next` is called, the `request.state.user` attributes should be populated in the same way, allowing auth to take place via `get_user()`. If the user model was refreshed, the JWT cookies will be set on the response object from `call_next` like they normally would. > 2. Reorganizes the outer try scope so the "if current_token" gate lives inside _refresh_user — makes the flow harder to read for anyone tracing "when is _refresh_user called". Restored the `if current_token` gate > 3. Changes the outer condition from if new_token is not None to if new_user or new_token is not None. Under a minimal refactor, the original condition > still works. In the new flow, `new_token` should only ever be `None` or `""`. The first condition checks whether we are setting any cookies and calls the necessary `get_cookie_path` and `request_cookie_is_secure` helpers, then clears the JWT cookie `if new_token == ""`, or passes the user model and response to `_set_new_token()` to set the cookies if it is populated. > 4. Introduces the if new_user: else new_token = "" dead branch inside _set_new_token — dead because dispatch never calls it with new_user=None, but present because the extraction was over-scoped. Removed dead branch > 5. Swaps delete_cookie for set_cookie(max_age=0) — drops the expires=0 attribute. Small, but again: not needed for extensibility. Restored `delete_cookie` > 6. `@classmethod` async def on _set_new_token despite using neither cls nor await. Swapped to `@staticmethod` async def to match `_refresh_user()` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
