[GitHub] [airflow] jhtimmins commented on pull request #11260: Add DAG permissions based on DAG tags

[GitBox <gi...@apache.org>]

jhtimmins commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-750467565


   @zacharya19 @kaxil @ashb 
   
   At a high-level I like the idea of tying permissions to DAG tags, however this presents two issues.
   
   1. This would allow anyone with the User role to give DAG access to anyone else. Currently, you need to be an Admin user to give DAG access to someone else. But with this change, if a user is able to edit a DAG (which the User role permits), they are able to add arbitrary DAG tags. This allows them to give permissions to other users.
   
   2. Dag-level permissions were hacked into the existing permission design, which we attempted to clean up with the `DAG:` prefix. It was a step in the right direction, but was a less than ideal solution. I'm somewhat hesitant to go further down the path of creating special classes of permissions via prefix strings. Creating a more robust permission design to better handle flexible permissions such as this may not be warranted, but I think we should consider the pros/cons of adding to the hack. I'm happy to defer to Ash and Kaxil.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org