potiuk commented on code in PR #70886:
URL: https://github.com/apache/airflow/pull/70886#discussion_r3765539263
##########
airflow-core/src/airflow/cli/commands/team_command.py:
##########
@@ -69,6 +104,15 @@ def team_create(args, *, session=NEW_SESSION):
if session.scalar(select(Team).where(Team.name == team_name)):
raise SystemExit(f"Team with name '{team_name}' already exists")
+ collision = _case_collision(team_name,
Team.get_all_team_names(session=session))
+ if collision:
+ raise SystemExit(
+ f"Team name '{team_name}' differs only in case from the existing
team "
+ f"'{collision}'. They would share one secrets namespace, so each
team could read "
+ f"the other's Connections and Variables. Choose a name that
differs by more than "
+ f"case."
+ )
Review Comment:
Done — team names are now lower case only: `(?!.*__)[a-z0-9_-]{3,50}`. The
case-collision check that this comment was anchored to is gone entirely, along
with the helper behind it; two names can no longer differ only in case, so
there is nothing left to detect.
Rebasing also dropped this PR's changes to `environment_variables.py`.
#70902 and #71079 landed in the meantime and made `_names_a_team_namespace` a
plain `TEAM_SEP in secret_id` gated on `multi_team`, running before the
team-scoped lookup — that already closes the cross-team read this PR described,
and re-applying the leading-segment refinement would only loosen it. What is
left here is the name rule itself.
One addition worth a look: existing deployments can hold names the new rule
rejects, so `airflow db migrate` now lower-cases stored team names and carries
each team's Dag bundles, Connections, Variables, Pools and Triggers with it
(migration `c7f0a5d2e9b4`). Two stored names that fold together would silently
merge two teams and nothing can pick a winner, so `_check_migration_errors`
refuses to start migration while such a pair exists. `teams delete`
deliberately no longer validates the name, otherwise a legacy team could never
be removed.
---
Drafted-by: Claude Opus 5 (1M context); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
