potiuk opened a new pull request, #70890:
URL: https://github.com/apache/airflow/pull/70890
The audit-log maskers for Variables and Connections dispatch on top-level key
names -- `val`/`value` for variables, `extra` for connections. A bulk request
body has exactly one top-level key, `actions`, and the entities sit two
levels
down in `actions[].entities[]`, so neither masker ever saw a key it
recognised
and the payload was recorded as supplied. The single-entity endpoints mask
the
same fields correctly; only the bulk paths diverged.
### Approach
`_mask_bulk_entities` walks `actions[].entities[]` and applies the existing
per-entity masking to each entry, so the two shapes now agree. The per-entity
logic is unchanged and simply factored out (`_mask_connection_entity`,
`_mask_variable_entity`) so both call sites share it.
- A `delete` action may list bare id/key strings rather than entity objects;
those carry nothing to mask and are passed through.
- The helper returns `None` for a non-bulk body so the flat path is
untouched.
- It runs on the request body *before* validation, so malformed shapes
(`actions` not a list, missing `entities`, non-dict actions) must not
raise --
each is covered by a test.
Worth noting for connections: a nested `password` was already covered, but
only
while `hide_sensitive_var_conn_fields` is enabled, since that is key-name
redaction. `extra` was never covered by it -- the name is not a recognised
sensitive field and the value is a JSON *string*, which `redact` returns
unchanged. Masking `extra` here is structural and so does not depend on that
setting.
### Test plan
- [x] `TestMaskBulkFields` -- bulk variables, bulk connection `extra`,
multiple
actions/entities, delete-by-key, and five malformed shapes
- [x] Verified against unmodified code: 5 of the new tests **fail**, and the
guard tests correctly pass either way
- [x] `test_decorators.py` -- 30 passed
- [x] `test_variables.py` + `test_connections.py` -- 230 passed
- [x] `ruff check` / `ruff format` clean
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 5 (1M context)
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
