pierrejeambrun opened a new pull request, #71428: URL: https://github.com/apache/airflow/pull/71428
Backport of #67620 to `v3-3-test`. Cherry-picked from 779efc6983b2b2497cd8f9c2d7bb376bae196825. #67620 merged to `main` on 2026-06-25, about a day after `v3-3-test` was branched (2026-06-24), and it never carried a `backport-to-v3-3-test` label — so despite its 3.3.0 milestone it missed the branch and shipped absent from 3.3.0. This restores the access-control fix on the release branch: `POST /connections/test` now authorizes GET (read) access on an existing `connection_id` before its secrets are merged into the test object, gating the secrets-backend lookup itself (so an unauthorized caller can't enumerate ids, generate audit-backend access-log entries, or impose backend load). **Conflict resolution.** `connections.py` conflicted with #70010 (the already-backported "skip stored credentials when a connection test overrides host or port", #69957), which touches the same block. Resolved so the endpoint keeps **both** protections: the read-access gate runs first (around loading the existing connection), and the credential-skip guard runs after, inside `if existing_conn is not None:`. The resolved `test_connection` is byte-for-byte identical to `main`'s (which carries both fixes). `test_connections.py` merged cleanly. All `TestConnection` tests pass locally on `v3-3-test`, covering both fixes (the read-access / secrets-lookup gate and the target-override credential guard). --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
