You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "CyberNativeAI (via GitHub)" <gi...@apache.org> on 2026/10/13 14:07:20 UTC
[PR] Update remaining FAB Website permissions rows for Airflow 3 [airflow]
CyberNativeAI opened a new pull request, #74653:
URL: https://github.com/apache/airflow/pull/74653
This finishes the review of the "Website Permissions" table in the FAB auth manager docs that #74599 and #74630 started. Every row that those PRs did not change was checked against the routes, React views and default roles on main.
Removed rows (no Airflow 3 equivalent, or no code checks the permission):
- `Show Browse menu`, `Show Admin menu` and `Show Docs menu`: nothing checks `Browse.menu_access`, `Admin.menu_access` or `Docs.menu_access`. The Browse and Admin menus show the entries the user is authorized for, and the Docs menu is always shown. A note under the table now says this.
- `Show Dag Runs menu`, `Show Task Instances menu` and `Show Dag Dependencies menu`: `MenuItem` has no entry for them. Dag Runs and Task Instances are tabs of the Dags page.
- `Triggers Task Instance`: there is no route to run a single task instance, and nothing checks `Task Instances.can_create`.
- `Set Task Instance as running` and `Set Task Instance as up_for_retry`: the task instance PATCH body only accepts `success`, `failed` and `skipped`.
- `List Task Reschedules`, `Show Triggers menu` and `List Triggers`: Airflow 3 has no page or route for them. Nothing checks the `Task Reschedules` resource or `AccessView.TRIGGERS`.
Rows that now also list Dag Runs, because their routes check the `TASK_INSTANCE` entity, which the FAB auth manager maps to Dag Runs and Task Instances:
- `Get rendered Dag`, `Get Log`, `Get Logs with metadata` and `Redirect to external Log`: the task instance page loads the task instance before it shows the rendered templates or requests the logs.
- `Get external links`: `/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}/links` checks `TASK_INSTANCE`.
- `Show Task Instances`: the list reads `/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`.
- `Mark Task as failed`, `Mark Task as success`, `Set Task Instance as success` and `Clear Dag`: the task instance PATCH routes, the bulk PATCH route and `/dags/{dag_id}/clearTaskInstances` check `PUT` on `TASK_INSTANCE`, so they need Dag Runs.can_edit and Task Instances.can_edit. Nothing checks Task Instances.can_delete when task instances are cleared.
Other changed rows:
- `Clear Dag Run`: `/dags/{dag_id}/dagRuns/{dag_run_id}/clear` checks `PUT` on `RUN`, so it needs Dag Runs.can_edit, not Task Instances.can_delete.
- `Create XCom` and `Delete XCom`: the XCom routes include a Dag id, so the Dag-level edit check applies as well (Dags.can_edit).
- `Get Dag Dependencies`: `/ui/dependencies` has no Dag id, so the Dag list check applies as well (Dags.can_read).
- `List Logs`: the event log routes check the `AUDIT_LOG` Dag entity, so Dags.can_read applies as well.
- Minimum role, from the role lists included at the top of this page: `Show Configs`, `List Plugins`, `Show Plugins menu` and `Show Pools menu` are Op, not Viewer. `Show Audit Log` and `List Logs` are Admin, not Viewer.
- `Show Users menu`, `Show Roles menu` and `Show Permissions menu`: the Security menu checks `menu_access` on `List Users`, `List Roles` and `Permission Pairs`. These are the names that the FAB views register.
- `Show Documentation menu` is renamed to `Show REST API Reference link`, because `Documentation.menu_access` now only controls that link in the Docs menu.
The note under the table now also names the Task Instances list and the task instance pages, and says that marking or clearing task instances checks Dag Runs.can_edit in the same way.
Not changed, because the correct value could not be settled from the code:
- `Access homepage`: the FAB views use `Website.can_read`, but no core route checks it.
- `Autocomplete`: the Dag search calls `/ui/dags`, which also checks Dag Runs, Task Instances and, from Airflow 3.1, HITL Detail. Because the full set depends on the Airflow version, the row is left as it is.
- `Get XCom` and `Get Dag details`: the routes check less than the rows list, but the pages that show them may need more.
- `Delete multiple records`: in Airflow 3, each kind of record has its own bulk route with its own checks.
This change comes from reading the code on main. It was not tested against a running instance. No newsfragment or changelog entry, because this is a provider docs change.
Checks run: `prek run --files providers/fab/docs/auth-manager/access-control.rst` passed in the pre-commit and manual stages, and docutils parsed the table (69 rows, no warnings). The docs build was not run locally.
related: #74599, #74630
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update remaining FAB Website permissions rows for Airflow 3 [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #74653:
URL: https://github.com/apache/airflow/pull/74653
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org