pierrejeambrun commented on PR #54113: URL: https://github.com/apache/airflow/pull/54113#issuecomment-3175378918
> This means that only users with GET permissions on plugins will be able to see the menu items from plugins? I do not think that's right. Or at least a misunderstanding on what plugins permissions mean. Having GET permissions on plugins allow a user to see the list of plugins installed in the environment. This is often only granted to admins. Plugins can register UI menu item, extra views, extra links, etc... To know what the UI should display (extra buttons, link etc...) we need to read plugins information. Indeed only people with `READ` permissions on plugin will be able to see what are the extra menu items/views registered by them and have the UI display the appropriate information to navigate to them. The other alternative would be to expose via another endpoint, or the `ui` `config` endpoint additional information on extra views/menu items to tell the UI what are the extra UI stuff without needed READ on plugins. But since they can now come from legacy AF2 (`appbuilder_views`,`appbuilder_menu_items`) or AF3 (`react_apps`, `external_views`), that's basically dumping most of the plugins information at this point so virtually it would be like making `read` plugins public... Not sure what would be the correct path forward as I don't see how we can have access to all that plugin information, without having READ access on plugin. Do you have any suggestions? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
