potiuk commented on code in PR #73794:
URL: https://github.com/apache/airflow/pull/73794#discussion_r4313244020
##########
airflow-core/src/airflow/api_fastapi/core_api/datamodels/connections.py:
##########
@@ -29,6 +30,60 @@
from airflow.api_fastapi.core_api.base import BaseModel, StrictBaseModel,
make_partial_model
from airflow.configuration import conf
+_MASK = "***"
+
+
+@cache
+def _sensitive_extra_fields() -> dict[str, frozenset[str]]:
+ """
+ Return, per connection type, the ``extra`` field names its provider
declares sensitive.
+
+ Providers mark a connection field as a secret with ``format: password`` in
their
+ ``conn-fields``. The name-based masking in ``redact`` cannot use that
knowledge, because it
+ only knows a fixed list of secret names, and ``config`` is not one of
them. Read from provider
+ metadata, without importing any hook.
+ """
+ from airflow.providers_manager import ProvidersManager
+
+ fields: dict[str, set[str]] = {}
+ for prefixed_name, widget in
ProvidersManager()._connection_form_widgets_from_metadata.items():
+ if not widget.is_sensitive:
+ continue
+ conn_type =
prefixed_name.removeprefix("extra__").removesuffix(f"__{widget.field_name}")
+ fields.setdefault(conn_type, set()).add(widget.field_name)
+ return {conn_type: frozenset(names) for conn_type, names in fields.items()}
+
+
+def _is_provider_sensitive_extra_key(key: str) -> bool:
Review Comment:
Done in 99e8b5b676: one cached frozenset of the plain and `extra__<type>__`
names, so each key is a single membership test. Matching is unchanged: a plain
name matches if any provider declares it, a prefixed name only for its own type.
---
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
