EncrypterParv opened a new pull request, #75377: URL: https://github.com/apache/airflow/pull/75377
Closes #75364 ### Problem Execution API tokens for executor callbacks use the callback ID as their subject. The shared team lookup treated every execution subject as a TaskInstance ID, so callback requests were treated as teamless. This could select global Connections or Variables instead of team-scoped values, and caused callback XCom requests to fail team authorization. ### Solution Resolve execution subjects against both task instances and callbacks. Callback team membership comes from the callback's DAG bundle. Preserve task token and teamless behavior, and reject ambiguous subjects that match both a task instance and callback so a token cannot resolve to a different team. Apply the same identity lookup to XCom authorization. ### Tests Added coverage for callback, task, teamless, and ambiguous identity lookups; callback Variable team context; and callback XCom access within and across teams. ### Checks - Ruff format and Ruff check passed. - Python compile check passed. - `git diff --check` passed. - Focused pytest could not complete: pytest setup attempted to download provider dependencies, but DNS access to pypi.org failed. The updated Variable and XCom regression tests remain unverified. ##### Was generative AI tooling used to co-author this PR? - [X] Yes — OpenAI Codex (GPT-6) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
