potiuk commented on code in PR #69790:
URL: https://github.com/apache/airflow/pull/69790#discussion_r3623180262
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -357,13 +359,52 @@ def is_authorized_view(
*,
access_view: AccessView,
user: T,
+ team_name: str | None = None,
) -> bool:
"""
Return whether the user is authorized to access a read-only state of
the installation.
+ Auth managers that support multi-team isolation use ``team_name`` to
restrict access
+ to users belonging to that team. Managers without multi-team support
accept the
+ argument and ignore it, which authorizes the view globally.
+
:param access_view: the specific read-only view/state the
authorization request is about.
:param user: the user to performing the action
- """
+ :param team_name: team the view is scoped to, if any
+ """
+
+ @cached_property
+ def _is_authorized_view_team_aware(self) -> bool:
+ """Whether this manager's ``is_authorized_view`` override accepts
``team_name``."""
+ params = inspect.signature(self.is_authorized_view).parameters
+ return "team_name" in params or any(p.kind is
inspect.Parameter.VAR_KEYWORD for p in params.values())
+
+ def authorize_view(self, *, access_view: AccessView, user: T, team_name:
str | None = None) -> bool:
Review Comment:
It does not change anything - the is_authorized_view implemented by old
versions of Auth Manager will override implementation of it anyway - and will
fail with "team_name parameter missing" when called.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
