namanjain24-sudo opened a new pull request, #73104: URL: https://github.com/apache/airflow/pull/73104
The users, roles and permissions endpoints under `/auth/fab/v1` wrapped every request in `get_application_builder()`, the helper written for the FAB CLI commands. It creates a new Flask app per call, so the `@cache` on `_return_appbuilder` never hits and keeps every app alive. Each request also re-runs `init_appbuilder`, which swaps the auth manager's `appbuilder` for the throwaway one and, with the default `update_fab_perms`, runs a full `sync_roles()`. These routes now use the auth manager's own Flask app through `_get_flask_app()`, the same way the login routes already do. The CLI helper is unchanged. I ran a local `airflow api-server` (sqlite, one worker) and sent 400 authenticated GETs to users and roles, 8 at a time: | | before | after | |---|---|---| | p50 / p95 latency | 506 / 878 ms | 75 / 131 ms | | API server RSS growth | +271 MiB | +6.6 MiB | Postgres 16 showed the same pattern. The fab unit tests pass on sqlite and Postgres 16, and the API server also behaves correctly on MySQL 8. One behaviour change: `sync_roles()` no longer runs on every request, so a role created through the API without actions doesn't get `can_read` on `Website` until the next startup sync or `airflow sync-perm`. Roles created in the UI already work this way. closes: #72937 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: a Gen-AI coding assistant, following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions). I reviewed the change and ran the tests and the checks above locally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
