potiuk opened a new pull request, #73696: URL: https://github.com/apache/airflow/pull/73696
The Keycloak auth manager checked every AccessView against the single ``View`` resource, and ``create-team`` grants ``ViewAccess`` (GET on ``View``) to every team role. That made the admin-by-default views -- ``AUDIT_LOGS_ALL``, ``IMPORT_ERRORS_ALL`` and ``REPARSE_ALL``, which cover records not tied to a Dag or a team -- readable by any team member, across teams. In multi-team mode these views are now checked against a new ``AdminView`` resource. The CLI creates it with an ``AdminViewAccess`` permission that is granted to ``SuperAdmin`` only; team roles keep ``ViewAccess`` on ``View`` for the other views. A client that does not have the ``AdminView`` resource yet denies these views instead of raising, until ``create-team`` is run again. Without ``[core] multi_team`` the checks are unchanged. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Claude Opus 5) Generated-by: Claude Opus 5 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
