Eason09053360 opened a new pull request, #72796:
URL: https://github.com/apache/airflow/pull/72796
`airflow roles export` writes a role that holds no permissions as an entry
with an
empty `resource` and `action`, so `airflow roles import` cannot always read
back
what `roles export` produced.
Importing such a file behaved differently depending on where that entry sat:
- **first entry** — the command aborted with `UnboundLocalError: cannot
access
local variable 'role_args'`, after the role had already been committed,
leaving
a half-finished import;
- **any later entry** — it silently re-applied the *preceding* entry's
permissions, because `role_args` was still bound from an earlier iteration.
Either way the export/import round trip that these two commands exist to
serve
was broken.
`roles_import` now adds the role unconditionally (`add_role` returns the
existing
role, so a role spanning several resources — which `roles_export` emits as
several
same-named entries — is safe) and skips the permission step when the entry
carries
no resource or action, so the `Namespace` is built only where it is used.
Two surrounding branches went away with it: the outer
`role_dict["name"] not in appbuilder.sm.get_all_roles()` compares a `str`
against
a list of `Role` ORM objects and is therefore always true, which made the
mirrored
`in` block below it unreachable.
### Why the existing test did not catch this
`test_cli_import_roles` already covers a permissionless role, but places it
last
in the fixture, where the stale binding from an earlier iteration papers
over the
missing one. The new test puts it first.
### Testing
- `uv run --project providers/fab pytest
providers/fab/tests/unit/fab/auth_manager/cli_commands/test_role_command.py` —
9 passed.
- Reverting only the source change (keeping the new test) fails exactly
`test_cli_import_roles_when_a_role_without_permissions_comes_first` with
the real
`UnboundLocalError`, and nothing else.
- Reproduced on a live CLI before the fix:
`airflow roles import` on `[{"name": "X", "resource": "", "action": ""}]`
raised `UnboundLocalError` at `role_command.py:219`.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
