Drop the token reissue opt-out from the Dag processor session exchange

The opt-out stopped the reissue middleware from re-validating the external
workload identity as if it were an Airflow token. The middleware now only
renews tokens that Airflow's own JWT check has already validated, and the
exchange never runs that check, so the opt-out no longer prevents anything.

Author: ephraimbuddy

airflow-core/src/airflow/api_fastapi/execution_api/app.py

@@ -152,9 +152,6 @@ class JWTReissueMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
         response: Response = await call_next(request)
 
-        if getattr(request.state, "skip_execution_token_reissue", False):
-            return response
-
         refreshed_token: str | None = None
         token = request.scope.get(_REQUEST_SCOPE_TOKEN_KEY)
         if token:

airflow-core/src/airflow/api_fastapi/execution_api/routes/session_tokens.py

@@ -51,7 +51,6 @@ async def require_workload_identity(
     request: Request,
     credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(identity_bearer)],
 ) -> DagProcessorIdentity:
-    request.state.skip_execution_token_reissue = True
     verifier: DagProcessorIdentityVerifier | None = request.app.state.dag_processor_identity_verifier
     if verifier is None:
         raise HTTPException(status.HTTP_404_NOT_FOUND, "Workload identity provisioning is not enabled")