vatsrahul1001 commented on code in PR #73794:
URL: https://github.com/apache/airflow/pull/73794#discussion_r4306171964
##########
airflow-core/src/airflow/api_fastapi/core_api/datamodels/connections.py:
##########
@@ -29,6 +30,60 @@
from airflow.api_fastapi.core_api.base import BaseModel, StrictBaseModel,
make_partial_model
from airflow.configuration import conf
+_MASK = "***"
+
+
+@cache
+def _sensitive_extra_fields() -> dict[str, frozenset[str]]:
+ """
+ Return, per connection type, the ``extra`` field names its provider
declares sensitive.
+
+ Providers mark a connection field as a secret with ``format: password`` in
their
+ ``conn-fields``. The name-based masking in ``redact`` cannot use that
knowledge, because it
+ only knows a fixed list of secret names, and ``config`` is not one of
them. Read from provider
+ metadata, without importing any hook.
+ """
+ from airflow.providers_manager import ProvidersManager
+
+ fields: dict[str, set[str]] = {}
+ for prefixed_name, widget in
ProvidersManager()._connection_form_widgets_from_metadata.items():
+ if not widget.is_sensitive:
+ continue
+ conn_type =
prefixed_name.removeprefix("extra__").removesuffix(f"__{widget.field_name}")
+ fields.setdefault(conn_type, set()).add(widget.field_name)
+ return {conn_type: frozenset(names) for conn_type, names in fields.items()}
+
+
+def _is_provider_sensitive_extra_key(key: str) -> bool:
Review Comment:
Nit: this loops over every sensitive connection type for every key. A single
frozenset of the plain and prefixed names, built once in
`_sensitive_extra_fields`, would be simpler.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
