slavachy commented on code in PR #75978: URL: https://github.com/apache/airflow/pull/75978#discussion_r4442434637
########## providers/apache/ozone/src/airflow/providers/apache/ozone/utils/security.py: ########## @@ -0,0 +1,561 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from __future__ import annotations + +import logging +import os +from dataclasses import dataclass, field +from pathlib import Path + +from airflow.configuration import ensure_secrets_loaded +from airflow.providers.apache.ozone.utils.cli_runner import KerberosCliRunner +from airflow.providers.apache.ozone.utils.connection_schema import ( + OzoneConnSnapshot, +) +from airflow.providers.apache.ozone.utils.errors import OzoneProviderError +from airflow.providers.apache.ozone.utils.helpers import FileHelper +from airflow.providers.apache.ozone.version_compat import AirflowException, mask_secret + +log = logging.getLogger(__name__) + + +def _normalize_and_validate_scope(scope: str) -> str: + """Normalize security scope and validate supported values.""" + normalized = str(scope).strip().lower() + if normalized not in {"ozone", "hdfs", "all"}: + raise ValueError("scope must be one of: 'ozone', 'hdfs', 'all'") + return normalized + + +class SecretResolver: + """Resolve `secret://` references via Airflow Secrets Backend.""" + + @classmethod + def get_secret_value( + cls, value: str | None, conn_id: str | None = None, *, mask: bool = True + ) -> str | None: + """ + Resolve secret from Airflow Secrets Backend or return value as-is. + + If ``value`` starts with ``secret://``, each configured backend is queried + via ``get_config(value)`` and the first non-None value is returned. + """ + if not value: + return value + + if not value.startswith("secret://"): + if mask: + mask_secret(value) + return value + + for backend in ensure_secrets_loaded(): + try: + secret_value = backend.get_config(value) + except (AttributeError, TypeError) as err: + log.error("Secrets Backend returned invalid response for %s: %s", value, str(err)) Review Comment: Fixed log no longer includes the secret URI or the backend error text, it now says only that Secrets backend returned an invalid response -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
