potiuk opened a new pull request, #72199: URL: https://github.com/apache/airflow/pull/72199
`FabAuthManager.deserialize_user` resolves the token subject by id alone: ```python session.scalars(select(User).where(User.id == user_id)).one() ``` Deactivating an account leaves the row in place, so a bearer issued while the account was active continues to resolve to that user. The password path already refuses an inactive account (`override.py:2146`); the token path did not. The account state is now re-checked when the user is loaded. The check is done on the loaded object rather than as a query predicate, so that a null `active` column is treated as inactive — matching `auth_user_db`, and avoiding a difference in behaviour for legacy rows where `active` was never set. **Scope limit worth flagging in review.** `deserialize_user` is wrapped in `@cachedmethod` over a `TTLCache`, so this runs on a cache miss. Deactivation therefore takes effect within `[fab] cache_ttl` (default 30s) rather than immediately. Bounding it that way is a large improvement over unbounded, but if reviewers want it immediate, the cache needs to be keyed or invalidated on account-state change — a bigger change I did not want to fold in here. **On the test.** `test_is_logged_in_with_inactive_user` set `user.is_active.return_value = False`, but `is_active` is a *property*, so the mock stayed truthy and the assertion held regardless of the state under test. It now sets the attribute, and an active-user counterpart was added. That code was not broken — only its test was. Local: 463 passed across the provider; one pre-existing unrelated failure in `test_permissions_command.py` reproduces on a clean tree. ruff and mypy clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
