Visitar URL original
docs: Correct what _validate_token claims to do by larrysingleton007 · Pull Request #6689 · feast-dev/feast · GitHub
Skip to content

docs: Correct what _validate_token claims to do #6689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 2 commits into from
Aug 14, 2026
Merged

docs: Correct what _validate_token claims to do #6689

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c64bb4a
docs: Correct what _validate_token claims to do
larrysingleton007 Jul 31, 2026
5a80a2b
refactor: Rename _validate_token to _check_discovery_endpoints
larrysingleton007 Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
refactor: Rename _validate_token to _check_discovery_endpoints 
The method never verified the token it takes: it builds a bearer scheme
whose header it supplies itself, so any token value passes. What it does
check is that the discovery document exposes the OAuth2 endpoints, which
is what the docstring already said after the previous commit.

Leaving the old name meant the docstring had to spend its opening
correcting the name. Private method, single caller in the same file, so
the rename is contained.

The access_token parameter stays: the bearer scheme requires a
well-formed Authorization header, and the caller has the token to hand.

Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>
  • Loading branch information
@larrysingleton007 @ntkathole
larrysingleton007 authored and ntkathole committed Aug 14, 2026
commit 5a80a2b18ed32fed242f3a915be9faf02a45496f
4 changes: 2 additions & 2 deletions sdk/python/feast/permissions/auth/oidc_token_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ def _get_jwks_client(self) -> PyJWKClient:
)
return self._jwks_client

async def _validate_token(self, access_token: str):
async def _check_discovery_endpoints(self, access_token: str):
"""Check that the provider's discovery document exposes the OAuth2 endpoints.

@ntkathole ntkathole Aug 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't the function name misleading then ?


This does **not** verify *access_token*, despite taking it: the bearer
Expand Down Expand Up @@ -227,7 +227,7 @@ async def user_details_from_access_token(self, access_token: str) -> User:

# Standard OIDC / Keycloak flow
try:
await self._validate_token(access_token)
await self._check_discovery_endpoints(access_token)
logger.debug("OIDC discovery document exposes the expected endpoints.")
except Exception as e:
if self._is_ssl_error(e):
Expand Down
Loading