apache / airflow

Apache Airflow - A platform to programmatically author, schedule, and monitor workflows
https://airflow.apache.org/
Apache License 2.0
36.57k stars 14.17k forks source link

Revoking stale permissions breaks DAG import #42743

Open RostD opened 2 days ago

RostD commented 2 days ago

Apache Airflow Provider(s)

fab

Versions of Apache Airflow Providers

apache-airflow-providers-fab==1.4.0

Apache Airflow version

2.9.3

Operating System

Oracle Linux Server 8.10

Deployment

Virtualenv installation

Deployment details

No response

What happened

In DAG I use the "old" format of the access_control parameter. "DAG Import Errors" appears in the web interface when revoking stale permissions

Traceback(most recent call last):
  File "/opt/venv/lib64/python3.11/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 1128, in sync_perm_for_dag
    self._sync_dag_view_permissions(dag_id, access_control.copy())
  File "/opt/venv/lib64/python3.11/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 1175, in _sync_dag_view_permissions
    target_perms_for_role = access_control.get(role.name, {}).get(resource_name, set())
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'set' object has no attribute 'get'

What you think should happen instead

According to the provider's documentation, it supports the old format, I think its support should be added

How to reproduce

In DAG use the "old" format of the access_control parameter: with DAG( ... access_control={'BASIC_ROLE': {'can_read', 'can_edit', 'can_delete'}, 'BASIC_ROLE_VIEW': {'can_read'}}, ... )

Wait until all permissions are added. Then remove can_delete permission, then when revoking obsolete permissions fab crashes and DAG Import Errors message appears in web interface

Anything else

No response

Are you willing to submit PR?

Code of Conduct

boring-cyborg[bot] commented 2 days ago

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

potiuk commented 2 days ago

Can. you take a look @joaopamaral ? It looks legit.