You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "pierrejeambrun (via GitHub)" <gi...@apache.org> on 2026/02/03 15:43:16 UTC
[PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
pierrejeambrun opened a new pull request, #61400:
URL: https://github.com/apache/airflow/pull/61400
part of https://github.com/apache/airflow/issues/60948
Deprecate `is_authorized_backfill` and `BackfillDetails` in favor of `DagAccessEntity.Run`.
Basically this will allow dag access level control on backfills, and we chose to simply re-use the existing `DagAccessEntity.Run` because 'creating a backfill' is basically similar to creating multiple dag runs. (A user with `Can create on Dag Runs` can basically simulate a backfill by triggering as many dag runs as needed with the appropriate conf and data).
Note: I plan a follow up PR for the providers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #61400:
URL: https://github.com/apache/airflow/pull/61400#discussion_r2763013447
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -146,14 +148,19 @@ async def get_user(
def requires_access_dag(
Review Comment:
Done thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #61400:
URL: https://github.com/apache/airflow/pull/61400#discussion_r2759896473
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -146,14 +148,19 @@ async def get_user(
def requires_access_dag(
Review Comment:
Can you cover these changes in unit tests as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #61400:
URL: https://github.com/apache/airflow/pull/61400
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #61400:
URL: https://github.com/apache/airflow/pull/61400#issuecomment-3848027511
### Backport failed to create: v3-1-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/21676830949'> Run details </a>
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>v3-1-test</td>
<td><a href="https://github.com/apache/airflow/commit/9b48498f10386f9a0775f8c38b460c0b032fbbe2"><img src='https://img.shields.io/badge/Commit-9b48498-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker 9b48498 v3-1-test
```
This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
If you don't have cherry-picker installed, see the [installation guide](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#how-to-backport-pr-with-cherry-picker-cli).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #61400:
URL: https://github.com/apache/airflow/pull/61400#discussion_r2759804037
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -263,17 +270,33 @@ def depends_permitted_dags_filter(
]
-def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser], None]:
- def inner(
+def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser, Session], None]:
+ """Wrap ``requires_access_dag`` and extract the dag_id from the backfill_id."""
+
+ async def inner(
request: Request,
user: GetUserDep,
+ session: SessionDep,
) -> None:
- backfill_id: NonNegativeInt | None = request.path_params.get("backfill_id")
-
- _requires_access(
- is_authorized_callback=lambda: get_auth_manager().is_authorized_backfill(
- method=method, details=BackfillDetails(id=backfill_id), user=user
- ),
+ dag_id = None
+
+ # Try to retrieve the dag_id from the backfill_id path param
+ backfill_id = request.path_params.get("backfill_id")
+ if backfill_id is not None:
+ backfill = session.scalars(select(Backfill).where(Backfill.id == backfill_id)).one_or_none()
+ dag_id = backfill.dag_id if backfill else None
+
+ # Try to retrieve the dag_id from the request body (POST backfill)
Review Comment:
For now it's just a small wrapper to retrieve it from the backfill id (path parameter) or payload), until we do that, it's just too much work to be in that PR. (and less on the critical dag level access control path i'm trying to solve)
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -230,7 +231,6 @@ def is_authorized_dag(
:param details: optional details about the DAG
"""
- @abstractmethod
Review Comment:
Yeah I was hesitant, removed. I agree.
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -244,7 +244,18 @@ def is_authorized_backfill(
:param method: the method to perform
:param user: the user to performing the action
:param details: optional details about the backfill
+
+
+ .. deprecated:: 3.1.8
+ Use ``is_authorized_dag`` on ``DagAccessEntity.RUN`` instead for a dag level access control.
"""
+ warnings.warn(
+ "You have a plugin that is using a FAB view or Flask Blueprint, which was used for the Airflow 2 UI,"
Review Comment:
oups ty, removed.
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/resource_details.py:
##########
@@ -48,7 +48,12 @@ class DagDetails:
@dataclass
class BackfillDetails:
- """Represents the details of a backfill."""
+ """
+ Represents the details of a backfill.
+
+ .. deprecated:: 3.1.8
+ Use DagAccessEntity.BACKFILL instead for a dag level access control.
Review Comment:
Ty fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on PR #61400:
URL: https://github.com/apache/airflow/pull/61400#issuecomment-3848714719
Manual backport https://github.com/apache/airflow/pull/61456
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #61400:
URL: https://github.com/apache/airflow/pull/61400#discussion_r2759737351
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -263,17 +270,33 @@ def depends_permitted_dags_filter(
]
-def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser], None]:
- def inner(
+def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser, Session], None]:
+ """Wrap ``requires_access_dag`` and extract the dag_id from the backfill_id."""
+
+ async def inner(
request: Request,
user: GetUserDep,
+ session: SessionDep,
) -> None:
- backfill_id: NonNegativeInt | None = request.path_params.get("backfill_id")
-
- _requires_access(
- is_authorized_callback=lambda: get_auth_manager().is_authorized_backfill(
- method=method, details=BackfillDetails(id=backfill_id), user=user
- ),
+ dag_id = None
+
+ # Try to retrieve the dag_id from the backfill_id path param
+ backfill_id = request.path_params.get("backfill_id")
+ if backfill_id is not None:
+ backfill = session.scalars(select(Backfill).where(Backfill.id == backfill_id)).one_or_none()
+ dag_id = backfill.dag_id if backfill else None
+
+ # Try to retrieve the dag_id from the request body (POST backfill)
Review Comment:
Fixes a bug, we should check access control based on the 'dag_id' in the payload when we try to create a backfill.
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -230,7 +231,6 @@ def is_authorized_dag(
:param details: optional details about the DAG
"""
- @abstractmethod
Review Comment:
Remove the abstractmethod and implement a body, so we are not forcing custom authmanager to implement this anymore since it is deprecated.
By default will return False and log a deprecation warning.
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -136,7 +136,6 @@ These authorization methods are:
Also, ``is_authorized_dag`` is called for any entity related to Dags (e.g. task instances, Dag runs, ...). This information is passed in ``access_entity``.
Example: ``auth_manager.is_authorized_dag(method="GET", access_entity=DagAccessEntity.Run, details=DagDetails(id="dag-1"))`` asks
whether the user has permission to read the Dag runs of the Dag "dag-1".
-* ``is_authorized_backfill``: Return whether the user is authorized to access Airflow backfills. Some details about the backfill can be provided (e.g. the backfill ID).
Review Comment:
Remove the `is_authorized_backfill` from the public interface as this is deprecated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Deprecate BackfillDetails and use DagAcccessEntity.Run for backfill p… [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #61400:
URL: https://github.com/apache/airflow/pull/61400#discussion_r2759747272
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -244,7 +244,18 @@ def is_authorized_backfill(
:param method: the method to perform
:param user: the user to performing the action
:param details: optional details about the backfill
+
+
+ .. deprecated:: 3.1.8
+ Use ``is_authorized_dag`` on ``DagAccessEntity.RUN`` instead for a dag level access control.
"""
+ warnings.warn(
+ "You have a plugin that is using a FAB view or Flask Blueprint, which was used for the Airflow 2 UI,"
Review Comment:
If we decide to keep it, this message should be updated
##########
airflow-core/src/airflow/api_fastapi/auth/managers/models/resource_details.py:
##########
@@ -48,7 +48,12 @@ class DagDetails:
@dataclass
class BackfillDetails:
- """Represents the details of a backfill."""
+ """
+ Represents the details of a backfill.
+
+ .. deprecated:: 3.1.8
+ Use DagAccessEntity.BACKFILL instead for a dag level access control.
Review Comment:
`DagAccessEntity.BACKFILL` does not exist
```suggestion
Use DagAccessEntity.RUN instead for a dag level access control.
```
##########
airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py:
##########
@@ -230,7 +231,6 @@ def is_authorized_dag(
:param details: optional details about the DAG
"""
- @abstractmethod
Review Comment:
Do we need to keep it? I do not think removing it is a breaking change
##########
airflow-core/src/airflow/api_fastapi/core_api/security.py:
##########
@@ -263,17 +270,33 @@ def depends_permitted_dags_filter(
]
-def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser], None]:
- def inner(
+def requires_access_backfill(method: ResourceMethod) -> Callable[[Request, BaseUser, Session], None]:
+ """Wrap ``requires_access_dag`` and extract the dag_id from the backfill_id."""
+
+ async def inner(
request: Request,
user: GetUserDep,
+ session: SessionDep,
) -> None:
- backfill_id: NonNegativeInt | None = request.path_params.get("backfill_id")
-
- _requires_access(
- is_authorized_callback=lambda: get_auth_manager().is_authorized_backfill(
- method=method, details=BackfillDetails(id=backfill_id), user=user
- ),
+ dag_id = None
+
+ # Try to retrieve the dag_id from the backfill_id path param
+ backfill_id = request.path_params.get("backfill_id")
+ if backfill_id is not None:
+ backfill = session.scalars(select(Backfill).where(Backfill.id == backfill_id)).one_or_none()
+ dag_id = backfill.dag_id if backfill else None
+
+ # Try to retrieve the dag_id from the request body (POST backfill)
Review Comment:
So I assume you do not want to go with moving the backfill api under dag api (as a nested api)? That way, we would get the dag id from the path
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org