CyberNativeAI opened a new pull request, #74630:
URL: https://github.com/apache/airflow/pull/74630
The "Website Permissions" table in the FAB auth manager docs still has four
rows for Airflow 2 UI features that Airflow 3 does not have. Three other rows
describe views that still exist but leave out a permission those views check.
This follows #74599, which fixed the Grid and Graph rows in the same table.
Removed rows:
- `Mark Dag as blocked`: this was the Airflow 2 `/blocked` endpoint. Airflow
3 has no such route.
- `Show landing times`: in Airflow 2.11 this URL already redirected to the
run duration tab of the Grid view. Airflow 3 has no landing times view.
- `Show SLA Misses menu` and `List SLA Misses`: SLAs were removed in Airflow
3.0.0. The UI has no SLA menu item, and nothing checks the SLA Misses resource.
The Viewer role still creates the two permissions, but they have no effect.
Changed rows, which now also list Dag Runs.can_read:
- `Show Gantt Chart`: `/ui/gantt/{dag_id}/{run_id}` and the Grid endpoints
that the Gantt panel loads check the `TASK_INSTANCE` and `RUN` Dag access
entities.
- `Get Dag as duration graph`: the run duration chart on the Dag overview
reads `/ui/grid/runs/{dag_id}`, and the duration chart on the task overview
reads the task instances list. Both check `TASK_INSTANCE`.
- `Show all tries`: the try selector reads
`/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}/{map_index}/tries`,
which checks `TASK_INSTANCE`.
The FAB auth manager maps `TASK_INSTANCE` to both DAG Runs and Task
Instances, so these views need Dag Runs.can_read, the same as the Grid row. The
note under the table now names these views too, because a Dag-specific `DAG
Run:` permission does not replace Dag Runs.can_read for them either.
The Grid routes and the two task tries routes check `TASK_INSTANCE` in every
release from 3.0.2 to 3.3.2. The Gantt view was rebuilt in 3.1, where it loads
the Grid endpoints. The Gantt endpoint itself was added in 3.2.0.
This change comes from reading the code on main. It was not tested against a
running instance. Other rows that list Task Instances.can_read without Dag
Runs.can_read, for example `Get external links` and `Show Task Instances`, were
not reviewed for this change. No newsfragment or changelog entry, because this
is a provider docs change.
Checks run: `prek run --files
providers/fab/docs/auth-manager/access-control.rst` passed in the pre-commit
and manual stages, and docutils parsed the table (81 rows, no warnings). The
docs build was not run locally.
related: #74599
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 5.5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
