dhkim1920 opened a new pull request, #70906: URL: https://github.com/apache/airflow/pull/70906
The Keycloak `create-team` command attached the Viewer, User, Op, and Admin policies to the team ReadOnly permission while retaining an `UNANIMOUS` decision strategy. Team members normally satisfy only one of these mutually exclusive role policies, so non-admin users could not read their team's Dags. Use an `AFFIRMATIVE` strategy for the team ReadOnly permission so any applicable team role grants read access. Extend the create-team regression test to verify the strategy for all four team roles. Validation: - `prek run --from-ref main --stage pre-commit` - `prek run --from-ref main --stage manual` - `breeze testing providers-tests --test-type "Providers[common.compat]"` - `breeze testing providers-tests --test-type "Providers[keycloak]"` closes: #70251 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — OpenAI Codex (GPT-5) Generated-by: OpenAI Codex (GPT-5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- Drafted-by: OpenAI Codex (GPT-5) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
