Limit Flask to <2.3 in the wake of 2.2 breaking our tests

[potiuk]

Flask 2.2 added a few deprecations and made a few changes that
made our tests stop working. Those were really test problems not
real application problems (there were no breaking changes in 2.2):

• new deprecation warnings produced
• Flask app cannot be reused in multiple tests
• The way how session lifetime is calculated makes test fail
  if freezegun is frozen using Pendulum datetime rather than the
  stdlib ones

This is an early warning for the future as the deprecation
warnings make us aware that Flask 2.3 is breaking. So this PR
fixes the 2.2 compatibility but at the same time limits Flask to
< 2.3 with appropriate information when the limit can be removed.

---

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

[potiuk]

@ashb @uranusjr -> I need a second look here.

I think I solved the test problems introduced by Flask 2.2 - I tried to find a better way but actually it turned out that the only way I could make it work is by getting rid of Freezegun from two tests that failed on MySQL only.

This is rather weird but it is fully reproducible. There were two problems:

1. In test_views_grid.py CURRENT_TIME was pendulum.DateTime. But that caused the problem described here: Error using stdlib datetime when frozen to pendulum datetime instance. spulec/freezegun#411

ValueError: fromutc: dt.tzinfo is not self

I "fixed" it (or so I thought) by changing CURRENT_TIME to stdlib's datetime (does not matter if I used it naive or timezone aware ). And it seemed to work.

Until I saw in https://github.com/apache/airflow/runs/7656424982?check_suite_focus=true#step:10:14266 that while Postgres/Sqlite were working, Two MySQL tests failed with:

tests/www/views/test_views_tasks.py::test_run_ignoring_deps_sets_queued_dttm: 
sqlalchemy.exc.OperationalError: (MySQLdb.OperationalError)
(1292, "Incorrect datetime value: '2020-08-06 09:00:00+00:00'
for column 'expiry' at row 1")
[SQL: UPDATE session SET data=%s, expiry=%s WHERE session.id = %s]

I traced it down to this change in Flask (sessions.py):

Flask 2.1.2:

    def get_expiration_time(
        self, app: "Flask", session: SessionMixin
    ) -> t.Optional[datetime]:
        """A helper method that returns an expiration date for the session
        or ``None`` if the session is linked to the browser session.  The
        default implementation returns now + the permanent session
        lifetime configured on the application.
        """
        if session.permanent:
            return datetime.utcnow() + app.permanent_session_lifetime
        return None

Flask 2.2.0:

    def get_expiration_time(
        self, app: "Flask", session: SessionMixin
    ) -> t.Optional[datetime]:
        """A helper method that returns an expiration date for the session
        or ``None`` if the session is linked to the browser session.  The
        default implementation returns now + the permanent session
        lifetime configured on the application.
        """
        if session.permanent:
            return datetime.now(timezone.utc) + app.permanent_session_lifetime
        return None

Seems that this one change from datetime.utcnow() to datetime.now(timezone.utc) connected with FreezeGun and FakeDateTime apparently causes it to produce different results that either real datetime or pendulum datettime.

This is a little 🤯 , but apparently mixing Freezegun, Flask, Pendulum, Stdlib.datatime and MySQL SQLAlchemy is too much for Airflow to 🐻

🤣

I workarounded it with getting rid of the Freezegun from both tests (it's not really "nice" but seems to work fine).

But if you have other ideas, I would love to hear them :D

[potiuk]

Yep. Seems that my "workarounds" worked :)

[potiuk]

All green I will merge it to make main back 'green' and unblock @eladkal with #25426 - but I would love comments if you have them @ashb @uranusjr .

[uranusjr]

Patch in this PR looks good to me.

Seems that this one change from datetime.utcnow() to datetime.now(timezone.utc) connected with FreezeGun and FakeDateTime apparently causes it to produce different results that either real datetime or pendulum datettime.

Pendulum tries to be clever and returns a string form with a T separator (instead of a space used by datetime) to make the output. But it misses implementing now(timezone.utc) and returns a bare datetime (instead of a Pendulum DateTime) and clever abstraction crumbles down. This kind of little things caused me a lot of pain when I worked on the test case speedup a while ago.

[potiuk]

Pendulum tries to be clever and returns a string form with a T separator (instead of a space used by datetime) to make the output. But it misses implementing now(timezone.utc) and returns a bare datetime (instead of a Pendulum DateTime) and clever abstraction crumbles down. This kind of little things caused me a lot of pain when I worked on the test case speedup a while ago.

Yeah. Some clever absractions are just .... too clever :)

[potiuk]

BTW. I've opened an issue in Flask - maybe that is compelling enough case for them to revert that change (it should have no side-effects)