kaxil commented on code in PR #73797:
URL: https://github.com/apache/airflow/pull/73797#discussion_r4390294981
##########
airflow-core/tests/unit/always/test_providers_manager.py:
##########
@@ -269,6 +270,40 @@ def test_connection_form_widgets(self,
yaml_ui_metadata_counts):
# widgets loaded from YAML metadata only
assert len(connections_form_widgets) == yaml_widgets
+ @pytest.mark.execution_timeout(120)
+ def test_sensitive_connection_fields_are_redactable(self):
+ """
+ Every connection field a provider declares as sensitive must be in the
redaction allowlist.
+
+ Providers already state which fields are secret; this asserts the
allowlist never drifts
+ apart from them.
+ """
+ pytest.importorskip("flask_appbuilder", reason="connection form
widgets need flask_appbuilder")
+
+ # Check the shipped defaults rather than the process-wide masker, whose
+ # sensitive_variables_fields is only populated once settings have been
configured.
+ masker = SecretsMasker()
+ masker.sensitive_variables_fields = list(DEFAULT_SENSITIVE_FIELDS)
+
+ # "config" is too generic a field name to add to the allowlist;
apprise's
+ # "config" field is handled separately.
+ allowed_unredacted = {("config", "apache-airflow-providers-apprise")}
+
+ provider_manager = ProvidersManager()
+ missing = sorted(
+ {
+ (widget.field_name, widget.package_name)
+ for widget in provider_manager.connection_form_widgets.values()
Review Comment:
#73794 is on main now and reads the same `is_sensitive` flag from
`_connection_form_widgets_from_metadata`, which doesn't import any hooks.
Iterating that here would let the `importorskip` and the 120s timeout go. With
it in, the apprise comment above can also say what's left: `config` is masked
in the API response but still not in task logs.
##########
shared/secrets_masker/src/airflow_shared/secrets_masker/secrets_masker.py:
##########
@@ -590,6 +610,8 @@ def should_hide_value_for_key(self, name):
if isinstance(name, str) and self.hide_sensitive_var_conn_fields:
name = name.strip().lower()
normalized = re.sub(r"\W+", "_", name)
+ if normalized.rsplit("__", 1)[-1] in DEFAULT_SENSITIVE_FIELD_NAMES:
Review Comment:
This conflicts with #74840 on main, which now also matches a camelCase-split
form of the key. When rebasing, could the whole-name check look at that form
too? Checking only `normalized` leaves `kubeConfig` and `routingKey` visible
while `privateKey` is hidden.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
