Add single-use callback token for deadline callback context fetch - #69840
Add single-use callback token for deadline callback context fetch#69840seanghaeli wants to merge 0 commit into
Conversation
boring-cyborg
Bot
added
area:API
fa89c3b to
f97d103
Compare
seanghaeli
changed the title
f97d103 to
02af3fd
Compare
2fb2423 to
14b0d9d
Compare
|
@ashb this one is as-per your suggestion. Your feedback would be appreciated! |
ashb
left a comment
ashb
left a comment
There was a problem hiding this comment.
Am I correct in my understanding that this new callback token is exchanged for a normal execution token once by hitting the /callbacks/{id}/run endpoint?
|
|
||
| @staticmethod | ||
| def generate_token(sub_id: str, generator: JWTGenerator | None = None) -> str: | ||
| def generate_token(sub_id: str, generator: JWTGenerator | None = None, scope: str = "workload") -> str: |
There was a problem hiding this comment.
Hmmm, for a reason I can't fully articulate, I'm a bit wary of having a scope argument here....
There was a problem hiding this comment.
Re-wrote it so that only workloads can set their own scope, instead of being passed as a free parameter from anywhere
Exactly right |
a46f220 to
9a85faa
Compare
|
Accidentally closed this and it's not letting me re-open it, so I made a new PR #71192 |
2 participants
Adds single-use
callbacktoken so a deadline-callback subprocess can fetch its DagRun context from the Execution API without holding a broadworkloadtoken (the scope creep that got #66608 reverted).PATCH /callbacks/{id}/run: single-use exchange gated on an atomicCallback.stateQUEUED→RUNNING transition (409 on reuse), returning a short-livedexecutiontoken viaRefreshed-API-Token. Mirrors the TI/runpattern.callbacktoken scope +callback:selfcheck (token subject must match the callback id).issue_execution_tokenhelper used by both the callback exchange and TI/run, and collapses the*:selfscope checks into one parameterized check.