-
Notifications
You must be signed in to change notification settings - Fork 16.3k
Update is_authorized_dag method in FabAuthManager
#54926
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
5c673a2 to
b9f7808
Compare
providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py
Outdated
Show resolved
Hide resolved
providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py
Show resolved
Hide resolved
…manager.py Co-authored-by: Niko Oliveira <onikolas@amazon.com>
59bcf28 to
e360e2c
Compare
o-nikolas
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not my area of expertise, but the code seems reasonable.
|
Please do not merge before @pierrejeambrun approval, I'd like to have it before merging :) |
pierrejeambrun
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Makes sense to me, thanks Vincent!
Just one question for my own understanding.
Resolves #53936.
Follow-up of #54197.
The way
FabAuthManagerchecks for Dag permission is partially broken in multiple ways:get_authorized_dag_ids(which returns the list of Dags the user is authorized to access) and checking whether this list is not empty. Even though this is not strictly wrong, it is not good either. A more robust solution proposed by @pierrejeambrun (see thread here for more information about the solution but also the reason why it is better) is to check whether the user has either access to all Dags or at least one dag permission withRESOURCE_DAG_PREFIXRESOURCE_DAG_RUN_PREFIXbecause I think this is very wrong. The purpose of this constant (value isDAG Run:) is to be able to give access to Dag runs of specific Dags. Example: To give read access to userXof Dag runs of Dagtest, I can add to the user's permissions(CAN_READ, DAG Run:test). But this is possible without this constant, using the same example, to grant the user access to Dagtestruns, you can give them(CAN_READ, Dag:test)and(CAN_READ, RESOURCE_DAG_RUN).^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.