anmolxlight opened a new pull request, #72495: URL: https://github.com/apache/airflow/pull/72495
## Summary Closes #72465. Provider auth managers like the Keycloak auth manager need to model the Airflow RBAC permissions in an external system, which today means hand-maintaining a copy of the RBAC surface. This adds `BaseAuthManager.get_rbac_reference()`, a machine-readable reference introspected from the `is_authorized_*` methods, so it stays in sync automatically whenever resources are added or changed. Each entry is keyed by resource name (e.g. `"dag"`) and holds the authorizing method, allowed actions, scoping enum with values (e.g. `DagAccessEntity`, `AccessView`), details dataclass fields (e.g. `DagDetails`), and a short description. The reference is JSON-serializable so external systems can consume it directly. Also adds an "RBAC reference" docs page under Auth manager concepts, unit tests, and a newsfragment. Skipped: a dedicated Sphinx extension or prek codegen hook. The runtime-introspected method cannot drift by construction; add codegen only if a static artifact is ever required. ## Test Plan - [x] New `TestGetRbacReference` tests pass (64 passed in `test_base_auth_manager.py`) - [x] `ruff check` and `ruff format --check` pass on changed files - [x] `mypy-airflow-core` prek hook passes - [x] `prek run --from-ref apache/main --stage pre-commit` passes (includes newsfragment validation) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
