This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new f47046fa239 Fix FAB Website permissions rows for the Grid and Graph
views (#74599)
f47046fa239 is described below
commit f47046fa23906368652540a1c08047ca8d15964e
Author: CyberNative AI LLC <[email protected]>
AuthorDate: Tue Oct 13 00:57:22 2026 -0700
Fix FAB Website permissions rows for the Grid and Graph views (#74599)
---
providers/fab/docs/auth-manager/access-control.rst | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/providers/fab/docs/auth-manager/access-control.rst
b/providers/fab/docs/auth-manager/access-control.rst
index 92a00fd5565..e8739f5c2f6 100644
--- a/providers/fab/docs/auth-manager/access-control.rst
+++ b/providers/fab/docs/auth-manager/access-control.rst
@@ -852,10 +852,9 @@ Mark Dag Run as failed DAGS.can_edit, Dag
Runs.can_edit
Mark Dag Run as success DAGS.can_edit, Dag Runs.can_edit
User
Mark Task as failed Dags.can_edit, Task Instances.can_edit
User
Mark Task as success Dags.can_edit, Task Instances.can_edit
User
-Get Dag as tree Dags.can_read, Task Instances.can_read,
Viewer
- Task Logs.can_read
-Get Dag as graph Dags.can_read, Task Instances.can_read,
Viewer
- Task Logs.can_read
+Get Dag as grid Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
+Get Dag as graph Dags.can_read, Dag Runs.can_read, Task
Instances.can_read, Viewer
+ Dag Dependencies.can_read
Get Dag as duration graph Dags.can_read, Task Instances.can_read
Viewer
Show all tries Dags.can_read, Task Instances.can_read
Viewer
Show landing times Dags.can_read, Task Instances.can_read
Viewer
@@ -908,6 +907,11 @@ Delete Users Users.can_delete
Reset user Passwords Passwords.can_edit, Passwords.can_read
Admin
======================================
=======================================================================
============
+The Grid and Graph views check Dag Runs.can_read and Task Instances.can_read
on the resources
+themselves. A Dag-specific ``DAG Run:example_dag_id.can_read`` permission does
not replace
+Dag Runs.can_read for these views. Granting these permissions does not expose
other Dags, because
+the Dag-level check (``DAGs.can_read`` or ``DAG:example_dag_id.can_read``)
still applies.
+
These Dag-level controls can be set directly through the UI / CLI, or encoded
in the dags themselves through the access_control arg.
Order of precedence for Dag-level permissions
