You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "aaron-wolmutt (via GitHub)" <gi...@apache.org> on 2025/11/14 03:26:39 UTC
[PR] feat: added /ui/auth/me to private endpoints [airflow]
aaron-wolmutt opened a new pull request, #58292:
URL: https://github.com/apache/airflow/pull/58292
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: 57966
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
- Adds /ui/auth/me endpoint to the private API
- /ui/auth/me can be used to get the role of the current user with SimpleAuth
- The endpoint should be used to disable buttons or conditionally render components that the role is authorized to view/use (maybe with the useLocalStorage hook)
Example use:
<img width="519" height="188" alt="image" src="https://github.com/user-attachments/assets/c73e25c6-3d93-4ec8-a424-15d748a10a45" />
related: 57966
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3576522887
> > I still do not understand (sorry) how this endpoint could be used to enable/disable buttons on the UI. Let's take an example. I am a user who has permission to trigger only the Dag `test`. What would be the response of such endpoint and how the front-end would handle such response to enable/disable the button?
>
> In the current state: /ui/auth/me is a convenience endpoint to access the user's information. It is flexible between auth managers. So if you look at the unit tests, the /ui/auth/me response using SimpleAuthManager would be:
>
> ```python
> def test_should_response_200_with_authenticated_user(self, test_client):
> """Test /auth/me endpoint with SimpleAuthManager authenticated user."""
> response = test_client.get("/auth/me")
>
> assert response.status_code == 200
> assert response.json() == {
> "username": "test",
> "id": "test",
> "extras": {"sub": "test", "role": "admin"},
> }
> ```
>
> So minimally, the endpoint can be used at a convenience to display the username and id in the UI. The role field can be accessed too (ie if the role is present and equals viewer disable all trigger dag buttons by default).
>
> I think the granular permissions-based controls (like in FabAuthManager) or group controls would go in a different endpoint.
>
> Here are the docs for azure web apps /auth/me usage: https://learn.microsoft.com/en-us/azure/static-web-apps/user-information?tabs=javascript
I am okay with id and username but we should not expose information such as role, there is no notion of role in Airflow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2530017185
##########
airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_auth.py:
##########
Review Comment:
I'm thinking that coverage for /ui/auth/me should be added for various auth providers as well, ie AWS or Fab
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3576845077
I think we should pursue this [solution](https://github.com/apache/airflow/issues/57966#issuecomment-3576460963) instead of this endpoint you are suggesting.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3567532048
@jason810496 did you want to review this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 merged PR #58292:
URL: https://github.com/apache/airflow/pull/58292
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3582161177
@vincbeck @pierrejeambrun @jason810496 can one of you guys assign me to #58618 as a follow up to this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3576449818
> I still do not understand (sorry) how this endpoint could be used to enable/disable buttons on the UI. Let's take an example. I am a user who has permission to trigger only the Dag `test`. What would be the response of such endpoint and how the front-end would handle such response to enable/disable the button?
In the current state:
/ui/auth/me is a convenience endpoint to access the user's information. It is flexible between auth managers. So if you look at the unit tests, the /ui/auth/me response using SimpleAuthManager would be:
```python
def test_should_response_200_with_authenticated_user(self, test_client):
"""Test /auth/me endpoint with SimpleAuthManager authenticated user."""
response = test_client.get("/auth/me")
assert response.status_code == 200
assert response.json() == {
"username": "test",
"id": "test",
"extras": {"sub": "test", "role": "admin"},
}
```
So minimally, the endpoint can be used at a convenience to display the username and id in the UI. The role field can be accessed too (ie if the role is present disable all trigger dag buttons by default).
I think the granular permissions-based controls (like in FabAuthManager) or group controls would go in a different endpoint.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2556703579
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/ui/auth.py:
##########
@@ -38,3 +40,27 @@ def get_auth_menus(
authorized_menu_items=authorized_menu_items,
extra_menu_items=extra_menu_items,
)
+
+
+@auth_router.get("/auth/me")
+def get_current_user(
+ user: GetUserDep,
+) -> SimpleAuthenticatedMeResponse | FabAuthenticatedMeResponse:
+ """Get current authenticated user information."""
+ auth_manager = get_auth_manager()
+ if auth_manager.get_auth_manager_type() == "SimpleAuthManager":
+ return SimpleAuthenticatedMeResponse(
+ username=user.username or "",
+ role=user.role or "",
+ )
+
+ if auth_manager.get_auth_manager_type() == "FabAuthManager":
+ return FabAuthenticatedMeResponse(
Review Comment:
> One doubt I have is "roles" - we do NOT have a concept of roles build in Airflow, we have permissions. Roles are specific for FAB provider Auth manager, and there is a different definition of Roles in KeyCloak Auth Manger - completely outside of Airflow "core" and outside of "Auth Manager".
Agree with Jarek that it would be better not to specify explicit Auth Manager as we have also support
- https://github.com/apache/airflow/blob/13dc31fc065d0250229bc38b0425bdd1bddcf9a9/providers/keycloak/src/airflow/providers/keycloak/auth_manager/user.py#L22-L23
- https://github.com/apache/airflow/blob/13dc31fc065d0250229bc38b0425bdd1bddcf9a9/providers/amazon/src/airflow/providers/amazon/aws/auth_manager/user.py#L32-L33
- etc, and might be more in future!
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/base_user.py:
##########
@@ -18,13 +18,35 @@
from __future__ import annotations
from abc import abstractmethod
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+ from typing import Any
class BaseUser:
- """User model interface."""
+ """User model interface. These attributes/methods should be implemented in the pluggable auth manager."""
+
+ id: int | str | None
+ first_name: str | None
+ last_name: str | None
+ username: str | None
+ role: str | None
+ email: str | None
+ active: bool | None
+ roles: list[Any] | None
Review Comment:
So maybe we just need `id` and `user` for now.
##########
airflow-core/src/airflow/api_fastapi/core_api/datamodels/ui/auth.py:
##########
@@ -26,3 +26,21 @@ class MenuItemCollectionResponse(BaseModel):
authorized_menu_items: list[MenuItem]
extra_menu_items: list[ExtraMenuItem]
+
+
+class SimpleAuthenticatedMeResponse(BaseModel):
+ """Current User (me) response serializer for SimpleAuth."""
+
+ username: str
+ role: str | None
+
+
+class FabAuthenticatedMeResponse(BaseModel):
+ """Current User (me) response serializer for FAB auth."""
+
+ id: int | str
+ first_name: str
+ last_name: str
+ username: str
+ email: str
+ roles: list[str] | None = None
Review Comment:
```suggestion
```
So maybe we could just return what `BaseUser` interface had supported currently if `id` and `user` are enough:
https://github.com/apache/airflow/blob/13dc31fc065d0250229bc38b0425bdd1bddcf9a9/airflow-core/src/airflow/api_fastapi/auth/managers/models/base_user.py#L23-L31
Or if we really want to show the additional properties, we could introduce something like `ui_attributes` (or other better name)on the `BaseUser` interface and each subclasses are able to specify the additional properties.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3572329434
You want to close this then? Or should we create an endpoint with the username and role is an optional field?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2565243320
##########
providers/amazon/tests/unit/amazon/aws/auth_manager/api_fastapi/__init__.py:
##########
@@ -0,0 +1,16 @@
+# Licensed to the Apache Software Foundation (ASF) under one
Review Comment:
Please delete this file
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2565401761
##########
providers/amazon/tests/unit/amazon/aws/auth_manager/api_fastapi/__init__.py:
##########
@@ -0,0 +1,16 @@
+# Licensed to the Apache Software Foundation (ASF) under one
Review Comment:
That file was created by prek. I will delete it and rerun prek
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2557017093
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/base_user.py:
##########
@@ -18,13 +18,35 @@
from __future__ import annotations
from abc import abstractmethod
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+ from typing import Any
class BaseUser:
- """User model interface."""
+ """User model interface. These attributes/methods should be implemented in the pluggable auth manager."""
+
+ id: int | str | None
+ first_name: str | None
+ last_name: str | None
+ username: str | None
+ role: str | None
+ email: str | None
+ active: bool | None
+ roles: list[Any] | None
Review Comment:
Maybe remove the attributes and do something like
```
def get_ui_endpoint_attributes() -> dict[str, Any]:
"""Get attributes for the ui endpoint."""
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2557021598
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/base_user.py:
##########
@@ -18,13 +18,35 @@
from __future__ import annotations
from abc import abstractmethod
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+ from typing import Any
class BaseUser:
- """User model interface."""
+ """User model interface. These attributes/methods should be implemented in the pluggable auth manager."""
+
+ id: int | str | None
+ first_name: str | None
+ last_name: str | None
+ username: str | None
+ role: str | None
+ email: str | None
+ active: bool | None
+ roles: list[Any] | None
Review Comment:
I think just adding a single getter in the base user class and leaving it up to the provider to implement might be better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3578845076
> > I'm going to make @jason810496 requested changes and wait for more feedback. I think we can include non-token information about the user in a ui_atrributes object (so ui_attributes fields will vary based on which auth manager is used). There is an issue open to display the username right now, so the endpoint is a convenience, and I don't think it violates the separation of concerns.
>
> If the purpose of this PR is to resolve the enable/disable button, then I think we should wait until the discussion in issue come up with final schema with the new meta permision router intead of the current implementation, and maybe close this one and raise a new PR for it.
>
> Or if the purpose of this PR is just for showing "Who I am" on the bottom-left setting tab, then I think we can skip it, but it will serve as differnt purpose than #57966.
We should just use it as a convenience for the "who i am" and close it out if that's ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3570312748
I think this one is a more general "API design" proposal - I find it useful to have this one also it could be potentially used to address things like https://github.com/apache/airflow/issues/58618 (but of course we do not need API for that).
One doubt I have is "roles" - we do NOT have a concept of roles build in Airflow, we have permissions. Roles are specific for FAB provider Auth manager, and there is a different definition of Roles in KeyCloak Auth Manger - completely outside of Airflow "core" and outside of "Auth Manager".
So I am not sure even if we can return anything there, because I believe we do not have anything to even enumerate permissions the user has - at most we can simply reject particular request , but in general case there is no "role" definition nor list of permissions - this is not how Auth Manager API is defined.
But I would love more @vincbeck and @pierrejeambrun and @jason810496 to take a look at and comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3572148367
> What is the goal of such endpoint? If the goal is the UI can use it to enable/disable some UI elements, then I think we should go with this [approach](https://github.com/apache/airflow/issues/57966#issuecomment-3571803446).
Yeah the goal would be to enable/disable buttons. I think we could have hooks on the front end to access whether the component is disabled or enabled. It's just hard to do without violating the design.
We use Okta at work, so you can access the authenticated users permissions/role with the useOktaAuth hook like this. It looks user role is accessed from claims in okta, so you could put the users role in claims (viewer, user, admin, op).
```javascript
import React, { useEffect, useState } from 'react';
import { useOktaAuth } from '@okta/okta-react';
function UserRoles() {
const { authState, oktaAuth } = useOktaAuth();
const [userRoles, setUserRoles] = useState([]);
useEffect(() => {
if (authState && authState.isAuthenticated) {
// Assuming roles are included as a custom claim, e.g., "roles"
const roles = authState.idToken?.claims.roles || [];
setUserRoles(roles);
}
}, [authState]);
if (!authState || !authState.isAuthenticated) {
return <div>Not authenticated</div>;
}
return (
<div>
<h2>Your Roles:</h2>
{userRoles.length > 0 ? (
<ul>
{userRoles.map((role, index) => (
<li key={index}>{role}</li>
))}
</ul>
) : (
<p>No roles found.</p>
)}
</div>
);
}
export default UserRoles;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3573783179
> Thanks for the update! Having a generic response for all Auth Managers LGMT overall.
>
> > ```
> > extras={k: v for k, v in current_user.items()},
> > ```
>
> However, instead of having `extras` for passing all the additional properties, I think `ui_attributes` might still be a better option. Or maybe just returning `id` and `username` without `extras` are also good enough IMHO.
>
> Take `KeycloakAuthManagerUser` for example, the `access_token` and `refresh_token` will be included in `extras` field, which is the reason why I propose `ui_attributes` to limit the only suitable attributes for UI. Showing those tokens explicitly on frontend might not be a good idea.
>
> https://github.com/apache/airflow/blob/13dc31fc065d0250229bc38b0425bdd1bddcf9a9/providers/keycloak/src/airflow/providers/keycloak/auth_manager/user.py#L22-L30
How about something like this?
```python
@auth_router.get("/auth/me")
def get_current_user_info(
user: GetUserDep,
) -> AuthenticatedMeResponse:
"""Get current authenticated user information."""
current_user = get_auth_manager().serialize_user(user=user)
return AuthenticatedMeResponse(
id=user.get_id(),
username=user.get_name(),
# Exclude any token-like information from being included in the response
ui_attributes={k: v for k, v in current_user.items() if "token" not in k.lower()},
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3576655112
> > > I still do not understand (sorry) how this endpoint could be used to enable/disable buttons on the UI. Let's take an example. I am a user who has permission to trigger only the Dag `test`. What would be the response of such endpoint and how the front-end would handle such response to enable/disable the button?
> >
> >
> > In the current state: /ui/auth/me is a convenience endpoint to access the user's information. It is flexible between auth managers. So if you look at the unit tests, the /ui/auth/me response using SimpleAuthManager would be:
> > ```python
> > def test_should_response_200_with_authenticated_user(self, test_client):
> > """Test /auth/me endpoint with SimpleAuthManager authenticated user."""
> > response = test_client.get("/auth/me")
> >
> > assert response.status_code == 200
> > assert response.json() == {
> > "username": "test",
> > "id": "test",
> > "extras": {"sub": "test", "role": "admin"},
> > }
> > ```
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > So minimally, the endpoint can be used at a convenience to display the username and id in the UI. The role field can be accessed too (ie if the role is present and equals viewer disable all trigger dag buttons by default).
> > I think the granular permissions-based controls (like in FabAuthManager) or group controls would go in a different endpoint.
> > Here are the docs for azure web apps /auth/me usage: https://learn.microsoft.com/en-us/azure/static-web-apps/user-information?tabs=javascript
>
> I am okay with id and username but we should not expose information such as role, there is no notion of role in Airflow.
The role is included based on the provider auth managers serialize_user() implementation.
I can remove the extras field completely for the scope of this pull request (convenience API endpoint for the front end to access the username and user id).
Will any of the supported auth managers be role based in the future? Or will airflow only support permissions based (PBAC)? It looks like the Aws and keycloak auth managers have a groups attribute as well. There is a role assignment in FAB, but I don't think it's used at all by the front end
```python
class User(Model, BaseUser):
"""Represents an Airflow user which has roles assigned to it."""
__tablename__ = "ab_user"
id: Mapped[int] = mapped_column(
Integer,
Sequence("ab_user_id_seq", start=1, increment=1, minvalue=1, cycle=False),
primary_key=True,
)
first_name: Mapped[str] = mapped_column(String(64), nullable=False)
last_name: Mapped[str] = mapped_column(String(64), nullable=False)
username: Mapped[str] = mapped_column(
String(512).with_variant(String(512, collation="NOCASE"), "sqlite"), unique=True, nullable=False
)
password: Mapped[str | None] = mapped_column(String(256))
active: Mapped[bool | None] = mapped_column(Boolean, default=True)
email: Mapped[str] = mapped_column(String(320), unique=True, nullable=False)
last_login: Mapped[datetime.datetime | None] = mapped_column(DateTime, nullable=True)
login_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
fail_login_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
roles: Mapped[list[Role]] = relationship(
"Role",
secondary=assoc_user_role,
backref="user",
lazy="selectin",
passive_deletes=True,
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2565553013
##########
providers/amazon/tests/unit/amazon/aws/auth_manager/api_fastapi/__init__.py:
##########
@@ -0,0 +1,16 @@
+# Licensed to the Apache Software Foundation (ASF) under one
Review Comment:
Deleted the file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2558298377
##########
airflow-core/src/airflow/api_fastapi/core_api/datamodels/ui/auth.py:
##########
@@ -26,3 +26,21 @@ class MenuItemCollectionResponse(BaseModel):
authorized_menu_items: list[MenuItem]
extra_menu_items: list[ExtraMenuItem]
+
+
+class SimpleAuthenticatedMeResponse(BaseModel):
+ """Current User (me) response serializer for SimpleAuth."""
+
+ username: str
+ role: str | None
+
+
+class FabAuthenticatedMeResponse(BaseModel):
+ """Current User (me) response serializer for FAB auth."""
+
+ id: int | str
+ first_name: str
+ last_name: str
+ username: str
+ email: str
+ roles: list[str] | None = None
Review Comment:
Removed the multiple serializers per auth manager and added the extras field like this. extras are implemented in the providers auth manager.
```python
class AuthenticatedMeResponse(BaseModel):
"""Authenticated user information serializer for responses."""
id: str
username: str
extras: dict[str, str] = {}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2558292407
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/ui/auth.py:
##########
@@ -38,3 +40,27 @@ def get_auth_menus(
authorized_menu_items=authorized_menu_items,
extra_menu_items=extra_menu_items,
)
+
+
+@auth_router.get("/auth/me")
+def get_current_user(
+ user: GetUserDep,
+) -> SimpleAuthenticatedMeResponse | FabAuthenticatedMeResponse:
+ """Get current authenticated user information."""
+ auth_manager = get_auth_manager()
+ if auth_manager.get_auth_manager_type() == "SimpleAuthManager":
+ return SimpleAuthenticatedMeResponse(
+ username=user.username or "",
+ role=user.role or "",
+ )
+
+ if auth_manager.get_auth_manager_type() == "FabAuthManager":
+ return FabAuthenticatedMeResponse(
Review Comment:
Removed the get_auth_manager_type() and check
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2530017185
##########
airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_auth.py:
##########
Review Comment:
I'm thinking that coverage for /ui/auth/me should be added for various auth providers as well, ie AWS or Fab
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3572372724
Let's wait for others to see what they think either here or in #57966
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3572160692
/auth/me is in azure web apps btw. And the design was suggested by AI when I started working on this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3576045896
I still do not understand (sorry) how this endpoint could be used to enable/disable buttons on the UI. Let's take an example. I am a user who has permission to trigger only the Dag `test`. What would be the response of such endpoint and how the front-end would handle such response to enable/disable the button?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3577650702
I'm going to make @jason810496 requested changes and wait for more feedback. I think we can include non-token information about the user in a ui_atrributes object (so which ui_attributes fields will vary based on which auth manager is used). There is an issue open to display the username right now so the endpoint is a convenience and i don't think it violates the separation of concerns.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3579314209
> > We should just use it as a convenience for the "who i am" issue and close it out if that's ok. This is my first API change in the project.
>
> Sure! If this is the case, maybe we could remove the `ui_attributes` as `id` and `username` are enough for frontend to showing our identity.
>
> The PR is good to go after removing the `ui_attributes`, thanks for your contribution!
The changes you requested are all set. I'll wait for you guys to decide on the meta permissions on #57966
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3573467404
> I do not think we should do that. As already mentioned by Jarek, there is no notion of roles, permissions, active or any auth related attributes in Airflow. Everything is delegated to the auth manager. Everytime a user performs an action in Airflow through the API (directly or through the UI), Airflow asks the auth manager configured in the environment: "Is this user authorized to perform such action". But there is no way to retrieve the list of roles of permissions because, again, these do not exist in Airflow. If you really want such API, you should implement them as part of the auth manager. Such API in FAB auth manager, for instance, would make more sense. But if you do that, we should wonder what is this API for? If the intent is to use it in Airflow, then that's wrong
Hey guys I worked on this branch this afternoon and tried to narrow down the scope of the pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on code in PR #58292:
URL: https://github.com/apache/airflow/pull/58292#discussion_r2558293413
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/base_user.py:
##########
@@ -18,13 +18,35 @@
from __future__ import annotations
from abc import abstractmethod
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+ from typing import Any
class BaseUser:
- """User model interface."""
+ """User model interface. These attributes/methods should be implemented in the pluggable auth manager."""
+
+ id: int | str | None
+ first_name: str | None
+ last_name: str | None
+ username: str | None
+ role: str | None
+ email: str | None
+ active: bool | None
+ roles: list[Any] | None
Review Comment:
Removed the changes made to the BaseUser and those pydantic fields.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3571816841
What is the goad of such endpoint? If the goal is the UI can use it to enable/disable some UI elements, then I think we should go with this [approach](https://github.com/apache/airflow/issues/57966#issuecomment-3571803446).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3572198506
As explained [here](https://github.com/apache/airflow/issues/57966#issuecomment-3571803446), this would not work. Not all auth managers are role based, plus it is not compatible with fine grained access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3571795190
> I do not think we should do that. As already mentioned by Jarek, there is no notion of roles, permissions, active or any auth related attributes in Airflow. Everything is delegated to the auth manager. Everytime a user performs an action in Airflow through the API (directly or through the UI), Airflow asks the auth manager configured in the environment: "Is this user authorized to perform such action". But there is no way to retrieve the list of roles of permissions because, again, these do not exist in Airflow. If you really want such API, you should implement them as part of the auth manager. Such API in FAB auth manager, for instance, would make more sense. But if you do that, we should wonder what is this API for? If the intent is to use it in Airflow, then that's wrong
@vincbeck @potiuk @jason810496
I think a better design might be
```python
class BaseUser:
"""User model interface. These attributes/methods should be implemented in the pluggable auth manager."""
username: str
role: str | None
@abstractmethod
def get_id(self) -> str:
"""Get user ID."""
...
@abstractmethod
def get_name(self) -> str:
"""Get user name."""
...
@abstractmethod
def get_ui_attributes() -> dict[str, Any]:
"""Get user interface attributes."""
```
Leaves the base user API contract alone but adds a single getter method to get user attributes for the private ui API. That way the implementation is left up to each provider auth manager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3587676330
nice indeed :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "aaron-wolmutt (via GitHub)" <gi...@apache.org>.
aaron-wolmutt commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3581789367
> Thanks for the PR, LGTM.
>
> Do you plan to follow up with a UI update (separate PR) to use this endpoint ? (Maybe to display the username somewhere)
Yeah I can follow up with the username display in a separate PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3583943150
Nice! Looking forward for the further UI contribution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: added /ui/auth/me to private endpoints [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #58292:
URL: https://github.com/apache/airflow/pull/58292#issuecomment-3582194008
> @vincbeck @pierrejeambrun @jason810496 can one of you guys assign me to #58618 as a follow up to this.
Please comment on the issue so that we can do so
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org