CyberNativeAI opened a new pull request, #74653:
URL: https://github.com/apache/airflow/pull/74653
This finishes the review of the "Website Permissions" table in the FAB auth
manager docs that #74599 and #74630 started. Every row that those PRs did not
change was checked against the routes, React views and default roles on main.
Removed rows (no Airflow 3 equivalent, or no code checks the permission):
- `Show Browse menu`, `Show Admin menu` and `Show Docs menu`: nothing checks
`Browse.menu_access`, `Admin.menu_access` or `Docs.menu_access`. The Browse and
Admin menus show the entries the user is authorized for, and the Docs menu is
always shown. A note under the table now says this.
- `Show Dag Runs menu`, `Show Task Instances menu` and `Show Dag
Dependencies menu`: `MenuItem` has no entry for them. Dag Runs and Task
Instances are tabs of the Dags page.
- `Triggers Task Instance`: there is no route to run a single task instance,
and nothing checks `Task Instances.can_create`.
- `Set Task Instance as running` and `Set Task Instance as up_for_retry`:
the task instance PATCH body only accepts `success`, `failed` and `skipped`.
- `List Task Reschedules`, `Show Triggers menu` and `List Triggers`: Airflow
3 has no page or route for them. Nothing checks the `Task Reschedules` resource
or `AccessView.TRIGGERS`.
Rows that now also list Dag Runs, because their routes check the
`TASK_INSTANCE` entity, which the FAB auth manager maps to Dag Runs and Task
Instances:
- `Get rendered Dag`, `Get Log`, `Get Logs with metadata` and `Redirect to
external Log`: the task instance page loads the task instance before it shows
the rendered templates or requests the logs.
- `Get external links`:
`/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}/links` checks
`TASK_INSTANCE`.
- `Show Task Instances`: the list reads
`/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`.
- `Mark Task as failed`, `Mark Task as success`, `Set Task Instance as
success` and `Clear Dag`: the task instance PATCH routes, the bulk PATCH route
and `/dags/{dag_id}/clearTaskInstances` check `PUT` on `TASK_INSTANCE`, so they
need Dag Runs.can_edit and Task Instances.can_edit. Nothing checks Task
Instances.can_delete when task instances are cleared.
Other changed rows:
- `Clear Dag Run`: `/dags/{dag_id}/dagRuns/{dag_run_id}/clear` checks `PUT`
on `RUN`, so it needs Dag Runs.can_edit, not Task Instances.can_delete.
- `Create XCom` and `Delete XCom`: the XCom routes include a Dag id, so the
Dag-level edit check applies as well (Dags.can_edit).
- `Get Dag Dependencies`: `/ui/dependencies` has no Dag id, so the Dag list
check applies as well (Dags.can_read).
- `List Logs`: the event log routes check the `AUDIT_LOG` Dag entity, so
Dags.can_read applies as well.
- Minimum role, from the role lists included at the top of this page: `Show
Configs`, `List Plugins`, `Show Plugins menu` and `Show Pools menu` are Op, not
Viewer. `Show Audit Log` and `List Logs` are Admin, not Viewer.
- `Show Users menu`, `Show Roles menu` and `Show Permissions menu`: the
Security menu checks `menu_access` on `List Users`, `List Roles` and
`Permission Pairs`. These are the names that the FAB views register.
- `Show Documentation menu` is renamed to `Show REST API Reference link`,
because `Documentation.menu_access` now only controls that link in the Docs
menu.
The note under the table now also names the Task Instances list and the task
instance pages, and says that marking or clearing task instances checks Dag
Runs.can_edit in the same way.
Not changed, because the correct value could not be settled from the code:
- `Access homepage`: the FAB views use `Website.can_read`, but no core route
checks it.
- `Autocomplete`: the Dag search calls `/ui/dags`, which also checks Dag
Runs, Task Instances and, from Airflow 3.1, HITL Detail. Because the full set
depends on the Airflow version, the row is left as it is.
- `Get XCom` and `Get Dag details`: the routes check less than the rows
list, but the pages that show them may need more.
- `Delete multiple records`: in Airflow 3, each kind of record has its own
bulk route with its own checks.
This change comes from reading the code on main. It was not tested against a
running instance. No newsfragment or changelog entry, because this is a
provider docs change.
Checks run: `prek run --files
providers/fab/docs/auth-manager/access-control.rst` passed in the pre-commit
and manual stages, and docutils parsed the table (69 rows, no warnings). The
docs build was not run locally.
related: #74599, #74630
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 5.5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
