From 71767e12a959b7aa8749f2e706d6bc5782f94759 Mon Sep 17 00:00:00 2001 From: Aaron Wolmutt Date: Sun, 9 Nov 2025 20:43:30 -0600 Subject: [PATCH 1/6] feat: added --create-all-roles flag to breeze. creates test users with each role by default for SimpleAuthManager --- dev/breeze/doc/03_developer_tasks.rst | 38 ++++++++++++++++++- .../commands/developer_commands.py | 13 +++++++ .../files/simple_auth_manager_passwords.json | 2 +- .../src/airflow_breeze/params/shell_params.py | 4 +- scripts/in_container/check_environment.sh | 12 +++++- 5 files changed, 65 insertions(+), 4 deletions(-) diff --git a/dev/breeze/doc/03_developer_tasks.rst b/dev/breeze/doc/03_developer_tasks.rst index 5babb592f3c27..ca5f5c0d1a9c7 100644 --- a/dev/breeze/doc/03_developer_tasks.rst +++ b/dev/breeze/doc/03_developer_tasks.rst @@ -132,12 +132,48 @@ You can connect to these ports/databases using: If you do not use ``start-airflow`` command. You can use ``tmux`` to multiply terminals. You may need to create a user prior to running the API server in order to log in. -This can be done with the following command: + +**Authentication and User Management** + +The authentication method depends on which auth manager is configured: + +**SimpleAuthManager (Default in Airflow 3.x)** + +SimpleAuthManager is the default authentication manager and comes pre-configured with test username and passwords for development: + +.. code-block:: + + * admin:admin (Admin role) + * viewer:viewer (Viewer role) + * user:user (User role) + * op:op (Operator role) + +These users are automatically available when using SimpleAuthManager and require no additional setup. + +**FabAuthManager** + +When using FabAuthManager, you can create users manually: .. code-block:: bash airflow users create --role Admin --username admin --password admin --email admin@example.com --firstname foo --lastname bar +Or use the ``--create-all-roles`` flag with ``start-airflow`` in dev mode to automatically create test users: + +.. code-block:: bash + + breeze start-airflow --dev-mode --create-all-roles --auth-manager FabAuthManager + +This will create the following test users: + +.. code-block:: + + * admin:admin (Admin role) + * viewer:viewer (Viewer role) + * user:user (User role) + * op:op (Op role) + * testadmin:testadmin (Admin role) + .. note:: ``airflow users`` command is only available when `FAB auth manager `_ is enabled. diff --git a/dev/breeze/src/airflow_breeze/commands/developer_commands.py b/dev/breeze/src/airflow_breeze/commands/developer_commands.py index 596be8d720751..f112279264357 100644 --- a/dev/breeze/src/airflow_breeze/commands/developer_commands.py +++ b/dev/breeze/src/airflow_breeze/commands/developer_commands.py @@ -503,6 +503,12 @@ def shell( "(mutually exclusive with --skip-assets-compilation).", is_flag=True, ) +@click.option( + "--create-all-roles", + help="Creates all user roles for testing with FabAuthManager (viewer, user, op, admin). " + "SimpleAuthManager always has all roles available. Only works with --dev-mode.", + is_flag=True, +) @click.argument("extra-args", nargs=-1, type=click.UNPROCESSED) @option_airflow_constraints_location @option_airflow_constraints_mode_ci @@ -565,6 +571,7 @@ def start_airflow( debug_components: tuple[str, ...], debugger: str, dev_mode: bool, + create_all_roles: bool, docker_host: str | None, executor: str | None, extra_args: tuple, @@ -603,6 +610,11 @@ def start_airflow( "[warning]You cannot skip asset compilation in dev mode! Assets will be compiled!" ) skip_assets_compilation = True + if create_all_roles and not dev_mode: + get_console().print( + "[error]--create-all-roles can only be used with --dev-mode!" + ) + sys.exit(1) if use_airflow_version is None and not skip_assets_compilation: # Now with the /ui project, lets only do a static build of /www and focus on the /ui run_compile_ui_assets(dev=dev_mode, run_in_background=True, force_clean=False) @@ -637,6 +649,7 @@ def start_airflow( debugger=debugger, db_reset=db_reset, dev_mode=dev_mode, + create_all_roles=create_all_roles, docker_host=docker_host, executor=executor, extra_args=extra_args, diff --git a/dev/breeze/src/airflow_breeze/files/simple_auth_manager_passwords.json b/dev/breeze/src/airflow_breeze/files/simple_auth_manager_passwords.json index 8f297bdae3d71..1f74a7b6616c3 100644 --- a/dev/breeze/src/airflow_breeze/files/simple_auth_manager_passwords.json +++ b/dev/breeze/src/airflow_breeze/files/simple_auth_manager_passwords.json @@ -1 +1 @@ -{"admin": "admin", "viewer": "viewer"} +{"admin": "admin", "viewer": "viewer", "user": "user", "op": "op"} diff --git a/dev/breeze/src/airflow_breeze/params/shell_params.py b/dev/breeze/src/airflow_breeze/params/shell_params.py index bce82a35e1239..e8bd1c6bc0f44 100644 --- a/dev/breeze/src/airflow_breeze/params/shell_params.py +++ b/dev/breeze/src/airflow_breeze/params/shell_params.py @@ -156,6 +156,7 @@ class ShellParams: celery_flower: bool = False clean_airflow_installation: bool = False collect_only: bool = False + create_all_roles: bool = False debug_components: tuple[str, ...] = () debugger: str = "debugpy" db_reset: bool = False @@ -543,7 +544,7 @@ def env_variables_for_docker_commands(self) -> dict[str, str]: _set_var(_env, "AIRFLOW__CORE__AUTH_MANAGER", self.auth_manager_path) _set_var(_env, "AIRFLOW__CORE__EXECUTOR", self.executor) if self.auth_manager == SIMPLE_AUTH_MANAGER: - _set_var(_env, "AIRFLOW__CORE__SIMPLE_AUTH_MANAGER_USERS", "admin:admin,viewer:viewer") + _set_var(_env, "AIRFLOW__CORE__SIMPLE_AUTH_MANAGER_USERS", "admin:admin,viewer:viewer,user:user,op:op") _set_var( _env, "AIRFLOW__CORE__SIMPLE_AUTH_MANAGER_PASSWORDS_FILE", @@ -589,6 +590,7 @@ def env_variables_for_docker_commands(self) -> dict[str, str]: _set_var(_env, "CI_TARGET_BRANCH", self.airflow_branch) _set_var(_env, "CI_TARGET_REPO", self.github_repository) _set_var(_env, "COLLECT_ONLY", self.collect_only) + _set_var(_env, "CREATE_ALL_ROLES", self.create_all_roles) _set_var(_env, "COMMIT_SHA", None, commit_sha()) _set_var(_env, "COMPOSE_FILE", self.compose_file) _set_var(_env, "DB_RESET", self.db_reset) diff --git a/scripts/in_container/check_environment.sh b/scripts/in_container/check_environment.sh index 6c385f9817316..71e4ef2b39e20 100755 --- a/scripts/in_container/check_environment.sh +++ b/scripts/in_container/check_environment.sh @@ -114,8 +114,18 @@ function startairflow_if_requested() { if airflow config get-value core auth_manager | grep -q "FabAuthManager"; then airflow users create -u admin -p admin -f Thor -l Adminstra -r Admin -e admin@email.domain || true + + # Create all roles for testing if CREATE_ALL_ROLES is set + if [[ "${CREATE_ALL_ROLES}" == "true" ]]; then + echo "Creating all test roles for FabAuthManager..." + airflow users create -u viewer -p viewer -f Test -l Viewer -r Viewer -e viewer@email.domain || true + airflow users create -u user -p user -f Test -l User -r User -e user@email.domain || true + airflow users create -u op -p op -f Test -l Op -r Op -e op@email.domain || true + airflow users create -u testadmin -p testadmin -f Test -l TestAdmin -r Admin -e testadmin@email.domain || true + echo "All test roles created successfully for FabAuthManager." + fi else - echo "Skipping user creation as auth manager different from Fab is used" + echo "SimpleAuthManager detected. All roles (admin, viewer, user, op) are always available via configuration in .dev/breeze/src/airflow_breeze/files/simple_auth_manager_passwords.json" fi fi return $? From 5c54c3df928b4512c4bc7ace91d6c25afb508688 Mon Sep 17 00:00:00 2001 From: Aaron Wolmutt Date: Sun, 9 Nov 2025 21:51:16 -0600 Subject: [PATCH 2/6] update command config --- .../src/airflow_breeze/commands/developer_commands_config.py | 1 + 1 file changed, 1 insertion(+) diff --git a/dev/breeze/src/airflow_breeze/commands/developer_commands_config.py b/dev/breeze/src/airflow_breeze/commands/developer_commands_config.py index 67ed4a81504dc..57329a1f0246b 100644 --- a/dev/breeze/src/airflow_breeze/commands/developer_commands_config.py +++ b/dev/breeze/src/airflow_breeze/commands/developer_commands_config.py @@ -287,6 +287,7 @@ "name": "Other options", "options": [ "--forward-credentials", + "--create-all-roles" ], }, { From 16a6d02e799fa36e45e00f49eb8c2abf72d2be45 Mon Sep 17 00:00:00 2001 From: Aaron Wolmutt Date: Mon, 10 Nov 2025 12:10:58 -0600 Subject: [PATCH 3/6] ci: ran prek --all-files --- dev/breeze/doc/03_developer_tasks.rst | 2 +- .../doc/images/output_start-airflow.svg | 40 +++++++++++-------- .../doc/images/output_start-airflow.txt | 2 +- .../commands/developer_commands.py | 4 +- .../commands/developer_commands_config.py | 5 +-- .../src/airflow_breeze/params/shell_params.py | 4 +- scripts/in_container/check_environment.sh | 4 +- 7 files changed, 33 insertions(+), 28 deletions(-) diff --git a/dev/breeze/doc/03_developer_tasks.rst b/dev/breeze/doc/03_developer_tasks.rst index ca5f5c0d1a9c7..8a7e3bcd17654 100644 --- a/dev/breeze/doc/03_developer_tasks.rst +++ b/dev/breeze/doc/03_developer_tasks.rst @@ -144,7 +144,7 @@ SimpleAuthManager is the default authentication manager and comes pre-configured .. code-block:: * admin:admin (Admin role) - * viewer:viewer (Viewer role) + * viewer:viewer (Viewer role) * user:user (User role) * op:op (Operator role) diff --git a/dev/breeze/doc/images/output_start-airflow.svg b/dev/breeze/doc/images/output_start-airflow.svg index 852322c8133c7..5f033fb18bee4 100644 --- a/dev/breeze/doc/images/output_start-airflow.svg +++ b/dev/breeze/doc/images/output_start-airflow.svg @@ -1,4 +1,4 @@ - +