Add single-use callback token for deadline callback context fetch - #69840
Closed
seanghaeli wants to merge 0 commit into
Closed
Add single-use callback token for deadline callback context fetch#69840seanghaeli wants to merge 0 commit into
seanghaeli wants to merge 0 commit into
Conversation
boring-cyborg
Bot
added
area:API
seanghaeli
force-pushed
the
callback-token-apache
branch
from
July 13, 2026 23:15
fa89c3b to
f97d103
Compare
seanghaeli
changed the title
seanghaeli
force-pushed
the
callback-token-apache
branch
from
July 13, 2026 23:15
f97d103 to
02af3fd
Compare
seanghaeli
marked this pull request as ready for review
July 25, 2026 00:50
seanghaeli
requested review from
XD-DENG,
amoghrajesh,
ashb,
dheerajturaga,
hussein-awala,
kaxil,
o-nikolas and
pierrejeambrun
as code owners
July 25, 2026 00:50
seanghaeli
force-pushed
the
callback-token-apache
branch
from
July 28, 2026 22:32
2fb2423 to
14b0d9d
Compare
Contributor
Author
|
@ashb this one is as-per your suggestion. Your feedback would be appreciated! |
ashb
reviewed
Aug 3, 2026
ashb
left a comment
ashb
left a comment
Member
There was a problem hiding this comment.
Am I correct in my understanding that this new callback token is exchanged for a normal execution token once by hitting the /callbacks/{id}/run endpoint?
|
|
||
| @staticmethod | ||
| def generate_token(sub_id: str, generator: JWTGenerator | None = None) -> str: | ||
| def generate_token(sub_id: str, generator: JWTGenerator | None = None, scope: str = "workload") -> str: |
Member
There was a problem hiding this comment.
Hmmm, for a reason I can't fully articulate, I'm a bit wary of having a scope argument here....
Contributor
Author
There was a problem hiding this comment.
Re-wrote it so that only workloads can set their own scope, instead of being passed as a free parameter from anywhere
Contributor
Author
Exactly right |
seanghaeli
force-pushed
the
callback-token-apache
branch
from
August 5, 2026 05:53
a46f220 to
9a85faa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds single-use
callbacktoken so a deadline-callback subprocess can fetch its DagRun context from the Execution API without holding a broadworkloadtoken (the scope creep that got #66608 reverted).PATCH /callbacks/{id}/run: single-use exchange gated on an atomicCallback.stateQUEUED→RUNNING transition (409 on reuse), returning a short-livedexecutiontoken viaRefreshed-API-Token. Mirrors the TI/runpattern.callbacktoken scope +callback:selfcheck (token subject must match the callback id).issue_execution_tokenhelper used by both the callback exchange and TI/run, and collapses the*:selfscope checks into one parameterized check.