CyberNativeAI opened a new pull request, #74599: URL: https://github.com/apache/airflow/pull/74599
The "Website Permissions" table in the FAB auth manager docs still lists the Airflow 2 permissions for the Tree and Graph views. On Airflow 3 these views load their data from UI API endpoints that check different resources. A custom role built from the table cannot open the Graph view, as reported in discussion #74563. Per #62532 the checks themselves are by design, so this change documents them and does not relax them. What the endpoints check with the FAB auth manager: - Graph (`/ui/structure/structure_data`): Dag read, DAG Dependencies read, and the `TASK_INSTANCE` Dag access entity. The FAB auth manager maps that entity to both Task Instances and DAG Runs. Task Logs is not checked. - Grid (`/ui/grid/structure`, `/ui/grid/runs`, `/ui/grid/ti_summaries`): Dag read, DAG Runs and Task Instances. The Grid view replaced the Tree view in Airflow 2.3, so the row is renamed. Tested on Airflow 3.1.8 with apache-airflow-providers-fab 3.4.0. The test role had `Website.can_read` and `DAG:dag_a.can_read` plus the grants listed in the new rows, and no Task Logs permission. All four endpoints returned 200 for `dag_a` and 403 for another Dag. Removing DAG Dependencies made only the Graph endpoint return 403. Removing Task Instances or DAG Runs made all four return 403. A per-Dag `DAG Run:dag_a.can_read` did not replace `DAG Runs.can_read`, because the `TASK_INSTANCE` entity checks the DAG Runs resource directly. The note under the table records this. The DAG Dependencies check is on `structure_data` in every release from 3.0.2 to 3.3.2 and on `v3-3-test`. On main it was removed from `structure_data` in #69833, but the Graph view on main still calls `/ui/dependencies`, which requires DAG Dependencies read, when "show all dependencies" is turned on. The row is therefore correct for every Airflow version this provider supports. Not changed: the duration graph, all tries, landing times and Gantt rows, which were not tested. No newsfragment or changelog entry, because this is a provider docs change. Checks run: `prek run --files providers/fab/docs/auth-manager/access-control.rst` passed in the pre-commit and manual stages, and docutils parsed the table (85 rows, no warnings). The docs build was not run locally. related: #74563 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5, Sonnet 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged. * For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. * When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). * For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
