jedcunningham opened a new pull request, #76376: URL: https://github.com/apache/airflow/pull/76376
The attempt-liveness check rejects any Execution API mutation whose token subject isn't a live task attempt or callback. Asset watchers have no task instance: the asset state store routes identify them by the null UUID and record their writes as `WATCHER`. In-process callers skip the check, so the built-in triggerer is unaffected, but a triggerer that reaches the Execution API over HTTP (as `TriggererJobRunner.make_client` allows) gets a 404 on every asset state write. This accepts the watcher identity on the asset state store mutation routes only; it's still rejected everywhere else. The existing watcher tests replaced `require_auth` entirely, which hid this. They now go through the real `require_auth`. An alternative would be a dedicated `asset_watcher` token scope instead of the null-UUID subject. That's a larger change, so I went with the identity the route already defines, but I'm happy to switch if reviewers prefer it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
