tableau / TabPy / 32305107728

66%

Build Type

push

github

Committed by web-flow

Commit Message

@W-23493263 Add JWT Bearer authentication to Arrow Flight (#665)

* Add JWT Bearer authentication to Arrow Flight.

* Send JSON Content-Type in max-request-size tests

Without it Tornado treats the 2MB body as form-urlencoded and newer
Python parse_qsl rejects it with 400 before TabPy's 413 check runs.

* Move Flight Authorization helper out of password util

Keep util.py unchanged so the pre-existing PBKDF2 hash stays out of
this diff. Flight header parsing now lives in flight_headers.py.

* Stop JWKS refreshes from blocking cached JWT validation

Hold a per-URI fetch lock only around forced JWKS refreshes so a
forged unknown kid cannot reject valid HTTP or Flight tokens. Flight
still follows TABPY_TRANSFER_PROTOCOL, including http, matching the
existing HTTP Basic/Bearer cleartext behavior.

* Single-flight cold JWKS fetches and recheck unknown-kid cooldown

* Make JWKS refresh outcomes atomic

Keep unknown-kid cooldown publication under refresh ownership and preserve opaque Flight sessions without cross-user capacity eviction.

* Pin the JWKS cache lifetime

Keep TabPy's parsed-key snapshot synchronized with PyJWT's cache and clarify the remaining cold-fetch availability tradeoff.

* Harden Flight authentication concurrency and token lifecycle

* Preserve JWKS single-flight availability

* Make Flight token overlap eviction deterministic

Coverage Stats

236 of 247 new or added lines in 6 files covered. (95.55%)

56 existing lines in 2 files now uncovered.

1774 of 2839 relevant lines covered (62.49%)

0.62 hits per line