pierrejeambrun opened a new pull request, #72889:
URL: https://github.com/apache/airflow/pull/72889
Follow-up to #72649, and stacked on it.
`HTTPBearer` and `OAuth2PasswordBearer` both extract the same `Authorization:
Bearer <token>` header. Declaring both as FastAPI dependencies produces the
same token string twice on every request, so:
- `get_user()` had a dead second branch: the OAuth2 branch never ran because
the `HTTPBearer` branch above it always matched first for any valid bearer
request.
- `collect_request_tokens()` (introduced by #72649) deduped the duplicate
anyway.
Drop the OAuth2 scheme so the two functions each read one token per
credential
channel. The JWT auth description moves onto the bearer scheme so `/docs`
still
carries the same explanation; users obtain a token from `POST /auth/token`
exactly as before. Regenerated OpenAPI specs drop `OAuth2PasswordBearer` from
each endpoint's `security` list.
The `/docs` "Authorize" affordance changes shape: the interactive OAuth2
password grant form goes away and users paste a token into the plain
`HTTPBearer` input instead. The token endpoint itself is unchanged.
This PR is stacked on #72649 and should be merged after it.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
