seanghaeli opened a new issue, #75364: URL: https://github.com/apache/airflow/issues/75364
### Apache Airflow version main (development) ### What happened In multi-team mode, a deadline callback run by an executor is always treated as teamless by the Execution API. The callback calls the Execution API with a token whose subject is the callback's id (from the callback token exchange in #71192). But every team lookup in the Execution API resolves the team through `TaskInstance.id == token.id` (`_team_name_for_ti_stmt` in `airflow-core/src/airflow/api_fastapi/execution_api/security.py`, used by `get_team_name_dep` and the XCom access check). A callback id never matches a task instance, so the lookup returns `None`. As a result: - Connections and Variables read from a team's callback silently return the global value instead of the team's (`routes/connections.py`, `routes/variables.py`), and Variable writes and deletes land on the global variable. - XCom reads from a team's callback get a 403 once callbacks can read XComs (#74779), because the XCom access check is the first one that actually enforces the team. A teamless requester can't read a team's Dag's XComs. ### What you think should happen instead A callback should resolve to the team of the Dag it belongs to, the same way a task does. Callbacks already store `bundle_name`, and `Callback` already resolves its team with `DagBundleModel.get_team_name(self.bundle_name)` for metrics and triggers, so the Execution API could do the same when the token's subject is a callback. ### How to reproduce 1. Enable `[core] multi_team` with a team mapped to a Dag bundle. 2. Give the team a connection or variable that also exists globally with a different value. 3. Add a deadline with a `SyncCallback` (run by the executor) to a Dag in that bundle, and have the callback read the connection or variable. 4. Let the deadline be missed: the callback gets the global value, not the team's. ### Anything else Found while reviewing #74779. It's out of scope there, since the gap is in the shared team lookup and not in the XCom change. ### Are you willing to submit PR? - [X] Yes I am willing to submit a PR! --- Drafted-by: Claude Code (Opus 5.5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
