potiuk commented on code in PR #74837:
URL: https://github.com/apache/airflow/pull/74837#discussion_r4299834370
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/connections.py:
##########
@@ -452,7 +452,8 @@ def enqueue_connection_test(
else:
effective_team = test_body.team_name
- auth_method: ResourceMethod = "PUT" if existing is not None and
test_body.commit_on_success else "POST"
+ commit_allows_update = existing is not None and test_body.commit_on_success
Review Comment:
Yes — with `commit_allows_update` set it's last-writer-wins, the same as A
issuing a `PUT` after B's edit. That flag is only set when the connection
already existed and A was authorised to edit it, so no permission boundary is
crossed; what this PR closes is a create-only request overwriting a connection
it was never allowed to edit. Guarding against lost updates between two
authorised editors would need optimistic locking on `connection`, which is out
of scope for 3.4.0 — I've noted that in the description.
---
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
