pierrejeambrun commented on code in PR #76306:
URL: https://github.com/apache/airflow/pull/76306#discussion_r4455937417
##########
airflow-core/src/airflow/api_fastapi/core_api/services/public/variables.py:
##########
@@ -85,14 +67,23 @@ def update_orm_from_pydantic(
raise RequestValidationError(errors=e.errors())
non_update_fields = {"key"}
+ # The UI edit form is filled from the redacted response, so saving it
unchanged would otherwise
+ # write ``***`` over every sensitive field.
if (
"value" in patch_body.model_fields_set
and (not update_mask or "value" in update_mask)
and isinstance(patch_body.value, str)
+ and old_variable.val is not None
):
- patch_body = patch_body.model_copy(
- update={"value": _restore_redacted_value(patch_body.value,
old_variable.val, old_variable.key)}
- )
+ try:
+ new_obj, old_obj = json.loads(patch_body.value),
json.loads(old_variable.val)
+ except json.JSONDecodeError:
+ merged_value = merge(patch_body.value, old_variable.val,
old_variable.key)
Review Comment:
Good catch, thanks! Bound it once with the walrus as suggested.
##########
shared/secrets_masker/src/airflow_shared/secrets_masker/secrets_masker.py:
##########
@@ -562,13 +556,14 @@ def merge(
Takes a user-modified redacted item and merges it with the original
unredacted item.
For sensitive fields that still contain "***" (or whatever the
``replacement`` is specified as), the
original value is restored. For fields that have been updated, the new
value is preserved.
+
+ ``max_depth`` is ignored: containers are walked at any depth, as
``redact`` does, and the
+ parameter is kept for backward compatibility.
Review Comment:
Agreed, that reads much more accurately. Applied, thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
