[v3-2-test] Docs: refresh JWT and security model for v3.2 with mermaid diagrams (#67435) by vatsrahul1001 · Pull Request #67466 · apache/airflow

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-05-25T10:51:19Z

Manual backport of #67435 — auto-backport failed (conflict in devel-common/src/docs/utils/conf_constants.py).

Why auto-backport failed

The PR's diff added two sphinx extensions to SUPPORTED_SPHINX_EXTENSIONS:

sphinxcontrib.mermaid — needed for the new mermaid diagrams
common_compat_alias — added on main by Docs: Make common.compat.sdk re-exports clickable #67083 ("Docs: Make common.compat.sdk re-exports clickable")

#67083 has not been backported to v3-2-test, so common_compat_alias.py doesn't exist there. Adding the extension would break the docs build on v3-2-test with an ImportError.

Resolution

Kept only sphinxcontrib.mermaid in the extensions list — the cherry-picked docs themselves don't reference common.compat.sdk, so dropping common_compat_alias is safe. Everything else applied cleanly.

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

…67435) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1)

…67435) (#67466) * Docs: refresh JWT and security model for v3.2 with mermaid diagrams Catch up the public security documentation to match the security-relevant changes flowing into the 3.2 release branch. Adds six mermaid diagrams (four in jwt_token_authentication.rst, two in security_model.rst) and documents: - Typed TIClaims Pydantic schema validation of Execution API tokens. - Unconditional revoke_token() on /auth/logout so external IdP redirects no longer leave the Airflow JWT valid. - Router-level Depends(get_user) as a defense-in-depth backstop on /api/v2 and /ui. - ExecutionAPISecretsBackend raising PermissionError on 401/403 so a deny no longer falls through to less-restrictive backends. - Tightened deserialization allowlist regex (full-string match). Registers sphinxcontrib-mermaid as a new docs dependency in devel-common and BASIC_SPHINX_EXTENSIONS. * Docs: improve security-diagram readability and add credential matrix - Replace the arrow-spaghetti credential-distribution mermaid with a component-grouped layout (least- to most-privileged left-to-right) plus an explicit RST table for true matrix lookup. - Bump all six security-diagram color palettes from very-pale tints to medium-saturation fills with explicit black text and 2px strokes, so labels stay readable in both light and dark mode renderers. * Fix HTTP verb in JWT auth mermaid diagram (PATCH, not POST) The /run endpoint is PATCH /{task_instance_id}/run, not POST. Spotted in review of #67435. (cherry picked from commit 0a506b1) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

boring-cyborgBot added the kind:documentation label May 25, 2026

vatsrahul1001 requested review from amoghrajesh, jscheffl and potiuk and removed request for jscheffl May 25, 2026 10:52

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 25, 2026

potiuk approved these changes May 25, 2026
View reviewed changes

vatsrahul1001 added the type:doc-only Changelog: Doc Only label May 25, 2026

vatsrahul1001 merged commit 5371dd8 into v3-2-testMay 25, 2026
112 checks passed

vatsrahul1001 deleted the backport-67435-v3-2-test branch May 25, 2026 13:04

vatsrahul1001 mentioned this pull request May 25, 2026
[v3-2-test] Fix broken tests due to pymysql 1.2.0 incompat with aiomysql (#67467) #67470
Merged
1 task