RehanAhmad25 commented on code in PR #72499:
URL: https://github.com/apache/airflow/pull/72499#discussion_r4387520911
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py:
##########
@@ -129,6 +129,41 @@
dag_run_at_dag_router = AirflowRouter(tags=["DagRun"], prefix="/dags/{dag_id}")
+def _mask_password_conf(dag, conf: dict | None) -> dict | None:
+ """Redact conf values for keys whose declared Param uses schema
format="password"."""
+ if not conf or dag is None:
+ return conf
+ params = getattr(dag, "params", None)
+ if not params:
+ return conf
+ masked = dict(conf)
+ for key in masked:
+ if key not in params:
+ continue
+ schema = params.get_param(key).schema
+ if schema.get("type") == "string" and schema.get("format") ==
"password":
+ masked[key] = "***"
+ return masked
+
+
+def _build_masked_dag_run_responses(dag_runs, dag_bag, session) ->
list[DAGRunResponse]:
+ """
+ Convert ORM DagRuns to DAGRunResponse, redacting password-format conf keys
per-run.
+
+ Deliberately does not cache DAGs by dag_id: two DagRuns can share a dag_id
but resolve to
+ different Dag versions (get_dag_for_run keys off
dag_run.created_dag_version_id), and a param's
+ format="password" declaration can differ between versions. dag_bag itself
already caches by
+ dag_version_id internally, so this stays cheap without an extra, incorrect
layer on top.
Review Comment:
Agreed, removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
