Migrate FAB POST /users to FastAPI #57480

chiuinggum · 2025-10-29T10:48:01Z

Why

Align FAB provider with Airflow 3’s FastAPI-first direction and reduce remaining Connexion/Flask surface. This PR is a small step for issue Replace connexion with fast-api for FAB provider. #56730 by migrating a single endpoint POST /auth/fab/v1/users.
Related PR:
- Migrate FAB POST /roles to FastAPI #57199
- Migrate FAB GET /roles to FastAPI #57411

How

Some differences from original implementation:

Data model: normalize created_on/changed_on to UTC tz-aware on output to avoid mixed-aware states. This intentionally differs from the old marshmallow behavior (which validates timezone and may reject naive datetimes unless configured) and aligns with Airflow’s “store in UTC” policy; implemented via a pydantic field_validator (default after parsing).
Service: explicitly raises 500 if the registration role is missing, instead of silently appending None.

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

vincbeck

One question as well: what about the old APIs we are replacing? Are you planning to delete them once all the APIs are implemented?

vincbeck · 2025-10-29T13:12:34Z

providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/datamodels/roles.py

    resource: ResourceResponse


+class RoleRef(BaseModel):


Suggested change

class RoleRef(BaseModel):

class Role(BaseModel):

I also realized in this file we have models such as ActionResourceResponse that is used in responses but requests as well. In that case could you rename them ActionResource. Same for ActionResponse and ResourceResponse

I also realized in this file we have models such as ActionResourceResponse that is used in responses but requests as well. In that case could you rename them ActionResource. Same for ActionResponse and ResourceResponse

may i fix this in the next PR? I want to keep the scope of this PR to /users API

For sure 👌 Please do not forget, that's the only thing :)

here's the PR: #58069

chiuinggum · 2025-11-07T02:03:54Z

One question as well: what about the old APIs we are replacing? Are you planning to delete them once all the APIs are implemented?

@vincbeck, yes that's the plan!

chiuinggum · 2025-11-07T06:10:27Z

scripts/in_container/install_airflow_and_providers.py

The latest commit fixes a MyPy error:

Run mypy for dev.................................................................Failed - hook id: mypy-dev - exit code: 1 Using 'uv' to install Airflow Using airflow version from current sources scripts/in_container/install_airflow_and_providers.py:438: error: Item "None" of "Match[str] | None" has no attribute "groups" [union-attr] owner, repo, branch = repo_match.groups() ^~~~~~~~~~~~~~~~~ Found 1 error in 1 file (checked 45 source files)

Thanks for the fix! Although this is a small change but it would be better to split it into another PR.
Since it will be much more easier to backport. Thanks!

vincbeck · 2025-11-07T12:53:02Z

Some conflicts

jason810496

Nice! LGTM overall.

jason810496 · 2025-11-09T12:40:30Z

providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/datamodels/users.py

+if TYPE_CHECKING:
+    from airflow.providers.fab.auth_manager.api_fastapi.datamodels.roles import Role


It seems we don't need the TYPE_CHECKING as we already imported in line 25.

Suggested change

if TYPE_CHECKING:

from airflow.providers.fab.auth_manager.api_fastapi.datamodels.roles import Role

jason810496 · 2025-11-09T12:45:52Z

providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/datamodels/users.py

+    created_on: datetime | None = None
+    changed_on: datetime | None = None
+
+    @field_validator("created_on", "changed_on")
+    @classmethod
+    def _coerce_tzaware(cls, v: datetime | None) -> datetime | None:
+        if v is None:
+            return None
+        return v if (v.tzinfo and v.utcoffset() is not None) else v.replace(tzinfo=timezone.utc)


Would it be possible to leverage UtcDateTime ? Then we don't need to handle the common timezone validation for this case.

airflow/airflow-core/src/airflow/api_fastapi/execution_api/datamodels/taskinstance.py

Lines 282 to 283 in bc3a750

timestamp: UtcDateTime

jason810496 · 2025-11-09T12:46:28Z

providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/users.py

+if TYPE_CHECKING:
+    from airflow.providers.fab.auth_manager.api_fastapi.datamodels.users import UserBody, UserResponse


Suggested change

if TYPE_CHECKING:

from airflow.providers.fab.auth_manager.api_fastapi.datamodels.users import UserBody, UserResponse

jason810496 · 2025-11-09T12:48:21Z

providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/users.py

+if TYPE_CHECKING:
+    from airflow.providers.fab.auth_manager.api_fastapi.datamodels.users import UserBody, UserResponse
+
+users_router = AirflowRouter(prefix="/fab/v1", tags=["FabAuthManager"])


Non-blocking nit, can be done in follow-up PR:
How about adding a common root router for all providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/<entity>.py? Then we could specified the prefix and tags in single source.

jason810496 · 2025-11-09T13:07:49Z

scripts/in_container/install_airflow_and_providers.py

Thanks for the fix! Although this is a small change but it would be better to split it into another PR.
Since it will be much more easier to backport. Thanks!

vincbeck · 2025-12-01T20:01:09Z

Are you planning to update this PR?

vincbeck · 2026-01-14T22:38:47Z

Completed in #60523

chiuinggum requested a review from vincbeck as a code owner October 29, 2025 10:48

boring-cyborg bot added area:providers provider:fab labels Oct 29, 2025

chiuinggum force-pushed the feat/fab-fastapi-users-post branch from 1924364 to 6374f0d Compare October 29, 2025 10:48

vincbeck reviewed Oct 29, 2025

View reviewed changes

chiuinggum force-pushed the feat/fab-fastapi-users-post branch from 6374f0d to c8da155 Compare November 7, 2025 06:06

chiuinggum requested review from amoghrajesh, ashb, bugraoz93, eladkal, gopidesupavan, jason810496, jscheffl, kaxil and potiuk as code owners November 7, 2025 06:06

chiuinggum requested a review from vincbeck November 7, 2025 06:06

chiuinggum commented Nov 7, 2025

View reviewed changes

chiuinggum force-pushed the feat/fab-fastapi-users-post branch from c8da155 to 7549439 Compare November 8, 2025 03:23

chiuinggum added 6 commits November 8, 2025 11:33

add users data model for POST /users API

2ee941c

add users service for POST /users API

14f9262

add users router for POST /users API

b012a08

change RoleRef to Role

390ba56

format auto-generated api spec

deab77d

guard repo_match with explicit check to satisfy mypy-dev

02b7b5e

chiuinggum force-pushed the feat/fab-fastapi-users-post branch from 7549439 to 02b7b5e Compare November 8, 2025 03:33

chiuinggum mentioned this pull request Nov 8, 2025

rename names of data models related to roles for consistency across requests and responses #58069

Closed

jason810496 reviewed Nov 9, 2025

View reviewed changes

kyounghunJang mentioned this pull request Nov 18, 2025

Migrate FAB PATCH /roles/{name} to FastAPI #58023

Merged

potiuk mentioned this pull request Dec 31, 2025

Werkzeug package cannot be upgraded to >=3.0 version with even the airflow version i.e. 2.10.5 #52123

Closed

2 tasks

This was referenced Jan 9, 2026

rename names of data models related to roles for consistency across r… #60312

Merged

Migrate FAB POST /users to FastAPI #60523

Merged

vincbeck closed this Jan 14, 2026

		if TYPE_CHECKING:
		from airflow.providers.fab.auth_manager.api_fastapi.datamodels.roles import Role

Migrate FAB POST /users to FastAPI #57480

Migrate FAB POST /users to FastAPI #57480

Uh oh!

Conversation

chiuinggum commented Oct 29, 2025

Why

How

Uh oh!

vincbeck left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chiuinggum commented Nov 7, 2025

Uh oh!

chiuinggum Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vincbeck commented Nov 7, 2025

Uh oh!

jason810496 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vincbeck commented Dec 1, 2025

Uh oh!

vincbeck commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chiuinggum Nov 7, 2025 •

edited

Loading