coleheflin opened a new pull request, #71572:
URL: https://github.com/apache/airflow/pull/71572
`Op-{team}` permissions created via `create-team` and via the standalone
`create-permissions --teams` flow only ever attach the team's
`Connection`/`Pool`/`Variable` resources — `Dag:{team}` is missing. The
equivalent `User-{team}` permission already includes `Dag:{team}`, and `Op`
is
meant to be a superset of `User`'s Dag access plus connection/pool/variable
management, so a team's Op-role users currently have no way to act on their
own team's Dags at all.
This adds `Dag:{team}` to the `Op-{team}` resource list in the two places
that build it: `_get_permissions_to_create` (used at permission-creation
time) and `_attach_team_permissions` (used at policy-attach time, which
`create-team` calls and which overwrites the permission's resource list).
Verified against a live Keycloak instance (`breeze start-airflow
--integration
keycloak`), in addition to the unit tests: before the fix, `Op-team-a`'s
attached resources were `Connection:team-a`, `Pool:team-a`, `Variable:team-a`
only; after the fix, both the `create-team` path and the standalone
`create-permissions --teams` path produce `Connection`, `Dag`, `Pool`,
`Variable` for the team.
Note: the existing `test_create_team_command` assertion for `Op-team-a` is
updated (not just extended) because it previously encoded the buggy
resource list as the expected behavior — the test change is part of the fix,
not an accommodation for a regression.
Out of scope: the non-team-scoped global `Op` permission has the same
missing-Dag characteristic, but the issue is specifically about the
team-scoped permission, so it's left untouched here to keep this change
minimal.
closes: #71319
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Sonnet 5)
Generated-by: Claude Code (Sonnet 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
