1fanwang opened a new pull request, #71260: URL: https://github.com/apache/airflow/pull/71260
The migration list in `deprecated_permissions.rst` mapped `DAG.access_control` to the auth manager's `filter_authorized_dag_ids` method. Two problems with that row. **It names the wrong layer.** `filter_authorized_dag_ids` has a [default implementation](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py#L668-L695) that loops over `is_authorized_dag`, and its own docstring frames overriding it as a performance concern. The decision is made in [`is_authorized_dag`](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py#L251-L252), which is abstract. The FAB auth manager, the one manager whose dag permissions actually come from `access_control`, does not override `filter_authorized_dag_ids` at all; it overrides [`get_authorized_dag_ids`](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py#L579). **It reads as a relocation.** The other two rows are import swaps. This one is not: `access_control` has no successor. It was an input to FAB's permission tables rather than an authorization mechanism, and core has only synced it when the auth manager is FAB since [#48070](https://github.com/apache/airflow/pull/48070) — see [`collection.py`](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/airflow-core/src/airflow/dag_processing/collection.py#L299-L300). Under any other auth manager the argument is still accepted and still [serialized](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/airflow-core/src/airflow/serialization/serialized_objects.py#L2287-L2288), but nothing reads it, so it neither grants nor denies access. A deployment migrating off the FAB auth manager and leaving `access_control` on its Dags stops enforcing those grants without an error. The [deprecation warning](https://github.com/apache/airflow/blob/299ca2c8582a0d16ee8ae2be92b17dbb6a1bd50f/task-sdk/src/airflow/sdk/definitions/dag.py#L589-L594) that fires on `access_control` points at this doc, so the doc is where a reader lands looking for the answer. This replaces that row with a short section stating that `access_control` has no drop-in replacement, a warning about the FAB-only read, and where the per-dag decision belongs. The `:param access_control:` docstring gets the same one-line note, since a Dag author reads that rather than the security docs. Docs only, no behavior change. related: #53716 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
