wilsonjefferson commented on issue #71277: URL: https://github.com/apache/airflow/issues/71277#issuecomment-5215705980
Follow-up: the inverse problem also occurs — global (teamless) resources reject writes from team members. The docs state that "Resources without a team assignment are considered global and accessible to all teams". As `user-a` (member of `team-a` only, realm role `Admin`): | Request | Target's team | Result | |---|---|---| | `PATCH /api/v2/dags/check_dag_running` | team-a | **200** | | `PATCH /api/v2/dags/test_dag` (bundle `shared_dags`) | none (global) | **403** | | `PATCH /api/v2/variables/shared_var` | none (global) | **403** | Same user, same token, same Keycloak permissions — the only variable is whether the target has a team association. Reproduced against the REST API directly (requests from 127.0.0.1 inside the apiserver container), so it is not UI-specific. So team scoping appears inconsistent in both directions: absent on list/read endpoints, and inverted on writes for teamless resources. Team-owned resources are writable by their team; global resources are writable by no team member. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
